1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@astron.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83# From: Joerg Jenderek 84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir 85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c 86# GRR: line below is too general as it matches also "Git pack" in ./revision 870 string PACK\0 88# check for valid compression method 0-4 89>5 ulelong <5 90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems 91# To skip "Git pack" version 0 test for root directory object like 92# ADFS::RPC.$.websitezip.FONTFIX 93>>9 string >ADFS\ PackDir archive (RISC OS) 94# TrID labels above as "Acorn PackDir compressed Archive" 95# compression mode y (0 - 4) for GIF LZW with a maximum n bits 96# (y~n,0~12,1~13,2~14,3~15,4~16) 97>>>5 ulelong+12 x \b, LZW %u-bits compression 98# https://www.filebase.org.uk/filetypes 99# !Packdir compressed archive has three hexadecimal digits code 68E 100!:mime application/x-acorn-68E 101!:ext pkd/bin 102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo 103>>>9 string x \b, root "%s" 104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time 105>>>>&1 ulelong x \b, load address 0x%x 106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC 107>>>>&5 ulelong x \b, exec address 0x%x 108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) 109>>>>&9 ulelong x \b, attributes 0x%x 110# number of entries in this directory. for root dir 0 111#>>>&13 ulelong x \b, entries 0x%x 112# the entries start here with object name 113>>>>&17 string x \b, 1st object "%s" 114 115 116#------------------------------------------------------------------------------ 117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 118# adi: file(1) magic for ADi's objects 119# From Gregory McGarry <g.mcgarry@ieee.org> 120# 1210 leshort 0x521c COFF DSP21k 122>18 lelong &02 executable, 123>18 lelong ^02 124>>18 lelong &01 static object, 125>>18 lelong ^01 relocatable object, 126>18 lelong &010 stripped 127>18 lelong ^010 not stripped 128 129#------------------------------------------------------------------------------ 130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $ 131# adventure: file(1) magic for Adventure game files 132# 133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 136# 137# ALAN 138# I assume there are other, lower versions, but these are the only ones I 139# saw in the archive. 1400 beshort 0x0206 ALAN game data 141>2 byte <10 version 2.6%d 142 143 144# Infocom (see z-machine) 145#------------------------------------------------------------------------------ 146# Z-machine: file(1) magic for Z-machine binaries. 147# Sanity checks by David Griffith <dave@661.org> 148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 149# 150#http://www.gnelson.demon.co.uk/zspec/sect11.html 151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 152#https://en.wikipedia.org/wiki/Z-machine 153# The first byte is the Z-machine revision; it is always between 1 and 8. We 154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 155# well as an occasional MP3 file), so we sanity-check the version number. 156# 157# It might be possible to sanity-check the release number as well, as it seems 158# (at least in classic Infocom games) to always be a relatively small number, 159# always under 150 or so, but as this isn't rigorous, we'll wait on that until 160# it becomes clear that it's needed. 161# 1620 ubyte >0 163>0 ubyte <9 164>>16 belong&0xfe00f0f0 0x3030 165>>>0 ubyte < 10 166>>>>2 ubeshort x 167>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 168>>>>>>0 ubyte < 10 Infocom (Z-machine %d 169>>>>>>>2 ubeshort x \b, Release %d 170>>>>>>>>18 string >\0 \b, Serial %.6s 171>>>>>>>>18 string x \b) 172!:strength + 40 173!:mime application/x-zmachine 174 175#------------------------------------------------------------------------------ 176# Glulx: file(1) magic for Glulx binaries. 177# 178# David Griffith <dave@661.org> 179# I haven't checked for false matches yet. 180# 1810 string Glul Glulx game data 182>4 beshort x (Version %d 183>>6 byte x \b.%d 184>>8 byte x \b.%d) 185>36 string Info Compiled by Inform 186!:mime application/x-glulx 187 188 189# For Quetzal and blorb magic see iff 190 191 192# TADS (Text Adventure Development System) version 2 193# All files are machine-independent (games compile to byte-code) and are tagged 194# with a version string of the form "V2.<digit>.<digit>\0". 195# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1960 string TADS2\ bin TADS 197>9 belong !0x0A0D1A00 game data, CORRUPTED 198>9 belong 0x0A0D1A00 199>>13 string >\0 %s game data 200!:mime application/x-tads 201# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 2020 string TADS2\ rsc TADS 203>9 belong !0x0A0D1A00 resource data, CORRUPTED 204>9 belong 0x0A0D1A00 205>>13 string >\0 %s resource data 206!:mime application/x-tads 207# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 208# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 209# "TADS2 save\n\r\032\0" and the interpreter version. 2100 string TADS2\ save/g TADS 211>12 belong !0x0A0D1A00 saved game data, CORRUPTED 212>12 belong 0x0A0D1A00 213>>(16.s+32) string >\0 %s saved game data 214!:mime application/x-tads 215# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 216# version. 2170 string TADS2\ save TADS 218>10 belong !0x0A0D1A00 saved game data, CORRUPTED 219>10 belong 0x0A0D1A00 220>>14 string >\0 %s saved game data 221!:mime application/x-tads 222 223# TADS (Text Adventure Development System) version 3 224# Game files start with "T3-image\015\012\032" 2250 string T3-image\015\012\032 226>11 leshort x TADS 3 game data (format version %d) 227# Saved game files start with "T3-state-v####\015\012\032" 228# where #### is a format version number 2290 string T3-state-v 230>14 string \015\012\032 TADS 3 saved game data (format version 231>>10 byte x %c 232>>11 byte x \b%c 233>>12 byte x \b%c 234>>13 byte x \b%c) 235!:mime application/x-t3vm-image 236 237# edited by David Griffith <dave@661.org> 238# Danny Milosavljevic <danny.milo@gmx.net> 239# These are ADRIFT (adventure game standard) game files, extension .taf 240# Checked from source at (http://www.adrift.co/) and various taf files 241# found at the Interactive Fiction Archive (https://ifarchive.org/) 2420 belong 0x3C423FC9 243>4 belong 0x6A87C2CF Adrift game file version 244>>8 belong 0x94453661 3.80 245>>8 belong 0x94453761 3.90 246>>8 belong 0x93453E61 4.0 247>>8 belong 0x92453E61 5.0 248>>8 default x unknown 249!:mime application/x-adrift 250 251#------------------------------------------------------------------------------ 252# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $ 253# 254# aes: magic file for AES encrypted files 255 256# Summary: AES Crypt Encrypted Data File 257# From: Joerg Jenderek 258# URL: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard 259# Reference: https://www.aescrypt.com/aes_file_format.html 2600 string AES 261>3 ubyte <3 AES encrypted data, version %u 262#!:mime application/aes 263!:mime application/x-aes-encrypted 264!:ext aes 265# For Version 2 the encrypted file can have text tags 266>>3 ubyte =2 267# length of an extension identifier and contents like: 0 24 33 38 268#>>5 ubeshort x \b, tag length %u 269#>>5 pstring/H x '%s' 270# standard extension tags like CREATED_BY 271>>>7 string CREATED_BY \b, created by 272# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ... 273>>>>&1 string x "%s" 274# TODO: more other tags 275# tag CREATED_DATE like YYYY-MM-DD 276# tag CREATED_TIME like HH:MM:SS 277# 278 279 280#------------------------------------------------------------------------------ 281# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $ 282# algol68: file(1) magic for Algol 68 source 283# 2840 search/8192 (input, Algol 68 source text 285!:mime text/x-Algol68 2860 regex/1024 \^PROC Algol 68 source text 287!:mime text/x-Algol68 2880 regex/1024 \bMODE[\t\ ] Algol 68 source text 289!:mime text/x-Algol68 2900 regex/1024 \bREF[\t\ ] Algol 68 source text 291!:mime text/x-Algol68 2920 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text 293!:mime text/x-Algol68 294#0 regex [\t\ ]OD Algol 68 source text 295#!:mime text/x-Algol68 296#0 regex [\t\ ]FI Algol 68 source text 297#!:mime text/x-Algol68 298 299#------------------------------------------------------------------------------ 300# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 301# allegro: file(1) magic for Allegro datafiles 302# Toby Deshane <hac@shoelace.digivill.net> 303# 3040 belong 0x736C6821 Allegro datafile (packed) 3050 belong 0x736C682E Allegro datafile (not packed/autodetect) 3060 belong 0x736C682B Allegro datafile (appended exe data) 307 308#------------------------------------------------------------------------------ 309# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 310# alliant: file(1) magic for Alliant FX series a.out files 311# 312# If the FX series is the one that had a processor with a 68K-derived 313# instruction set, the "short" should probably become "beshort" and the 314# "long" should probably become "belong". 315# If it's the i860-based one, they should probably become either the 316# big-endian or little-endian versions, depending on the mode they ran 317# the 860 in.... 318# 3190 short 0420 0420 Alliant virtual executable 320>2 short &0x0020 common library 321>16 long >0 not stripped 3220 short 0421 0421 Alliant compact executable 323>2 short &0x0020 common library 324>16 long >0 not stripped 325 326#------------------------------------------------------------------------------ 327# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $ 328# amanda: file(1) magic for amanda file format 329# 3300 string AMANDA:\ AMANDA 331>8 string TAPESTART\ DATE tape header file, 332>>23 string X 333>>>25 string >\ Unused %s 334>>23 string >\ DATE %s 335>8 string FILE\ dump file, 336>>13 string >\ DATE %s 337 338#------------------------------------------------------------------------------ 339# $File: amigaos,v 1.18 2020/08/02 16:42:00 christos Exp $ 340# amigaos: file(1) magic for AmigaOS binary formats: 341 342# 343# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 344# 3450 belong 0x000003fa AmigaOS shared library 3460 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 3470 belong 0x000003e7 AmigaOS object/library data 348# 3490 beshort 0xe310 Amiga Workbench 350>2 beshort 1 351>>48 byte 1 disk icon 352>>48 byte 2 drawer icon 353>>48 byte 3 tool icon 354>>48 byte 4 project icon 355>>48 byte 5 garbage icon 356>>48 byte 6 device icon 357>>48 byte 7 kickstart icon 358>>48 byte 8 workbench application icon 359>2 beshort >1 icon, vers. %d 360# 361# various sound formats from the Amiga 362# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 363# 3640 string FC14 Future Composer 1.4 Module sound file 3650 string SMOD Future Composer 1.3 Module sound file 3660 string AON4artofnoise Art Of Noise Module sound file 3671 string MUGICIAN/SOFTEYES Mugician Module sound file 36858 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3690 string Synth4.0 Synthesis Module sound file 3700 string ARP. The Holy Noise Module sound file 3710 string BeEp\0 JamCracker Module sound file 3720 string COSO\0 Hippel-COSO Module sound file 373# Too simple (short, pure ASCII, deep), MPi 374#26 string V.3 Brian Postma's Soundmon Module sound file v3 375#26 string BPSM Brian Postma's Soundmon Module sound file v3 376#26 string V.2 Brian Postma's Soundmon Module sound file v2 377 378# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 3790 beshort 0x0f00 AmigaOS bitmap font 3800 beshort 0x0f03 AmigaOS outline font 3810 belong 0x80001001 AmigaOS outline tag 3820 string ##\ version catalog translation 3830 string EMOD\0 Amiga E module 3848 string ECXM\0 ECX module 3850 string/c @database AmigaGuide file 386 387# Amiga disk types 388# display information like volume name of root block on Amiga (floppy) disk 3890 name adf-rootblock 390# block primary type = T_HEADER (value 2) 391>0x000 ubelong !2 \b, type %u 392# header_key; unused in rootblock (value 0) 393>0x004 ubelong !0 \b, header_key %u 394# high_seq; unused (value 0) 395>0x008 ubelong !0 \b, high_seq %u 396# ht_size; hash table size; 0x48 for flopies 397>0x00c ubelong !0x48 \b, hash table size 0x%x 398# bm_flag; bitmap flag, -1 means VALID 399>0x138 belong !-1 \b, bitmap flag 0x%x 400# bm_ext; first bitmap extension block (Hard disks only) 401>0x1A0 ubelong !0 \b, bitmap extension block 0x%x 402# name_len; volume name length; diskname[30]; volume name 403>0x1B0 pstring >\0 \b, "%s" 404# first directory cache block for FFS; otherwise 0 405>0x1F8 ubelong !0 \b, directory cache block 0x%x 406# block secondary type = ST_ROOT (value 1) 407>0x1FC ubelong !1 \b, sec_type 0x%x 408# 4090 string RDSK Rigid Disk Block 410>160 string x on %.24s 411# URL: http://fileformats.archiveteam.org/wiki/ADF_(Amiga) 412# https://en.wikipedia.org/wiki/Amiga_Fast_File_System 413# Reference: http://lclevy.free.fr/adflib/adf_info.html 414# Update: Joerg Jenderek 415# Note: created by ADFOpus.exe 416# and verified by `unadf -l TURBO_SILVER_SV.ADF` 4170 string DOS 418# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG 419>3 ubyte <8 Amiga 420# https://reposcope.com/mimetype/application/x-amiga-disk-format 421!:mime application/x-amiga-disk-format 422!:ext adf 423>>3 ubyte 0 DOS disk 424>>3 ubyte 1 FFS disk 425>>3 ubyte 2 Inter DOS disk 426>>3 ubyte 3 Inter FFS disk 427# For Fastdir mode the international mode is also enabled, 428>>3 ubyte 4 Fastdir DOS disk 429>>3 ubyte 5 Fastdir FFS dis 430# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)" 431>>3 ubyte 6 Inter Fastdir DOS disk 432# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)" 433>>3 ubyte 7 Inter Fastdir FFS disk 434# but according to Wikipedia variants with long name support 435#>>3 ubyte 6 long name DOS disk 436#>>3 ubyte 7 long name FFS disk 437# DOES NOT only work! Partly for file size ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h 438#>>-0 offset x \b, %lld bytes 439# Correct file size, but next lines are NOT executed 440#>>-0 offset 901120 (DD 880 KiB floppy) 441# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2 442>>0x6E00C ubelong 0x48 443>>>0x6E000 ubelong 2 (DD 880 KiB) 444# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48 445>>0xDC00C ubelong 0x48 446>>>0xDC000 ubelong 2 (HD 1760 KiB) 447# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ... 448#>>4 ubelong x \b, CRC 0x%x 449# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF) 450>>8 ubelong >0 \b, probably root block %d 451# bootblock code 452>>12 quad !0 \b, bootable 453# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6) 454>>>12 ubequad =0x43fa003e70254eae AmigaDOS 3.0 455>>>12 default x 456>>>>12 ubequad !0x43fa003e70254eae 0x%llx.. 457# 880 KiB Double Density floppy disk (901120 bytes) 458>>0x6E00C ubelong 0x48 459>>>0x6E000 ubelong 2 460>>>>0x6E000 use adf-rootblock 461# 1760 KiB High Density floppy disk (1802240 bytes) 462>>0xDC00C ubelong 0x48 463>>>0xDC000 ubelong 2 464>>>>0xDC000 use adf-rootblock 465# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq 466>>0x80000 ubelong 2 467>>>0x80004 quad 0 468>>>>0x80000 use adf-rootblock 469# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB 470#>>0x100000 ubelong x 2 MiB TEST 471#>>0x100000 ubelong 2 \b, 2 MiB hard disc rootblock 472#>>>0x100000 use adf-rootblock 4730 string KICK Kickstart disk 474 475# From: Alex Beregszaszi <alex@fsn.hu> 4760 string LZX LZX compressed archive (Amiga) 477 478# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 4790 string .KEY AmigaDOS script 4800 string .key AmigaDOS script 481 482# AMOS Basic file formats 483# https://www.exotica.org.uk/wiki/AMOS_file_formats 4840 string AMOS\040Basic\040 AMOS Basic source code 485>11 byte =0x56 \b, tested 486>11 byte =0x76 \b, untested 4870 string AMOS\040Pro AMOS Basic source code 488>11 byte =0x56 \b, tested 489>11 byte =0x76 \b, untested 4900 string AmSp AMOS Basic sprite bank 491>4 beshort x \b, %d sprites 4920 string AmIc AMOS Basic icon bank 493>4 beshort x \b, %d icons 4940 string AmBk AMOS Basic memory bank 495>4 beshort x \b, bank number %d 496>8 belong&0xFFFFFFF x \b, length %d 497>12 regex .{8} \b, type %s 4980 string AmBs AMOS Basic memory banks 499>4 beshort x \b, %d banks 500 501#------------------------------------------------------------ 502# $File: android,v 1.18 2021/02/23 00:51:10 christos Exp $ 503# Various android related magic entries 504#------------------------------------------------------------ 505 506# Dalvik .dex format. http://retrodev.com/android/dexformat.html 507# From <mkf@google.com> "Mike Fleming" 508# Fixed to avoid regexec 17 errors on some dex files 509# From <diff@lookout.com> "Tim Strazzere" 5100 string dex\n 511>0 regex dex\n[0-9]{2}\0 Dalvik dex file 512>4 string >000 version %s 5130 string dey\n 514>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 515>4 string >000 version %s 516 517# Android bootimg format 518# From https://android.googlesource.com/\ 519# platform/system/core/+/master/mkbootimg/bootimg.h 520# https://github.com/djrbliss/loki/blob/master/loki.h#L43 5210 string ANDROID! Android bootimg 522>1024 string LOKI \b, LOKI'd 523>>1028 lelong 0 \b (boot) 524>>1028 lelong 1 \b (recovery) 525>8 lelong >0 \b, kernel 526>>12 lelong >0 \b (0x%x) 527>16 lelong >0 \b, ramdisk 528>>20 lelong >0 \b (0x%x) 529>24 lelong >0 \b, second stage 530>>28 lelong >0 \b (0x%x) 531>36 lelong >0 \b, page size: %d 532>38 string >0 \b, name: %s 533>64 string >0 \b, cmdline (%s) 534 535# Android Backup archive 536# From: Ariel Shkedi 537# Update: Joerg Jenderek 538# URL: https://github.com/android/platform_frameworks_base/blob/\ 539# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 540# android/server/BackupManagerService.java#L2367 541# Reference: https://sourceforge.net/projects/adbextractor/ 542# android-backup-extractor/perl/backupencrypt.pl 543# Note: only unix line feeds "\n" found 544# After the header comes a tar file 545# If compressed, the entire tar file is compressed with JAVA deflate 546# 547# Include the version number hardcoded with the magic string to avoid 548# false positives 5490 string/b ANDROID\ BACKUP\n Android Backup 550# maybe look for some more characteristics like linefeed '\n' or version 551#>16 string \n 552# No mime-type defined officially 553!:mime application/x-google-ab 554!:ext ab 555# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) 556>15 string >\0 \b, version %s 557# "1" on 3rd line means compressed 558>17 string 0\n \b, Not-Compressed 559>17 string 1\n \b, Compressed 560# The 4th line is encryption "none" or "AES-256" 561# any string as long as it's not the word none (which is matched below) 562>19 string none\n \b, Not-Encrypted 563# look for backup content after line with encryption info 564#>>19 search/7 \n 565# data part after header for not encrypted Android Backup 566#>>>&0 ubequad x \b, content 0x%16.16llx... 567# look for zlib compressed by ./compress after message with 1 space at end 568#>>>&0 indirect x \b; contains 569# look for tar archive block by ./archive for package name manifest 570>>288 string ustar \b; contains 571>>>31 use tar-file 572# look for zip/jar archive by ./archive ./zip after message with 1 space at end 573#>>2079 search/1025/s PK\003\004 \b; contains 574#>>>&0 indirect x 575>19 string !none 576>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 577# Commented out because they don't seem useful to print 578# (but they are part of the header - the tar file comes after them): 579# The 5th line is User Password Salt (128 Hex) 580# string length too high with standard src configuration 581#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s" 582#>>>&1 regex/1l .* \b, Password salt: %s 583# The 6th line is Master Key Checksum Salt (128 Hex) 584#>>>>&1 regex/1l .* \b, Master salt: %s 585# The 7th line is Number of PBDKF2 Rounds (10000) 586#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 587# The 8th line is User key Initialization Vector (IV) (32 Hex) 588#>>>>>>&1 regex/1l .* \b, IV: %s 589#>>>>>>&1 regex/1l .* \b, IV: %s 590# The 9th line is Master IV+Key+Checksum (192 Hex) 591#>>>>>>>&1 regex/1l .* \b, Key: %s 592# look for new line separator char after line number 9 593#>>>0x204 ubyte 0x0a NL found 594#>>>>&1 ubequad x \b, Content magic %16.16llx 595 596# *.pit files by Joerg Jenderek 597# https://forum.xda-developers.com/showthread.php?p=9122369 598# https://forum.xda-developers.com/showthread.php?t=816449 599# Partition Information Table for Samsung's smartphone with Android 600# used by flash software Odin 6010 ulelong 0x12349876 602# 1st pit entry marker 603>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 604# minimal 13 and maximal 18 PIT entries found 605>>4 ulelong <128 Partition Information Table for Samsung smartphone 606>>>4 ulelong x \b, %d entries 607# 1. pit entry 608>>>4 ulelong >0 \b; #1 609>>>0x01C use PIT-entry 610>>>4 ulelong >1 \b; #2 611>>>0x0A0 use PIT-entry 612>>>4 ulelong >2 \b; #3 613>>>0x124 use PIT-entry 614>>>4 ulelong >3 \b; #4 615>>>0x1A8 use PIT-entry 616>>>4 ulelong >4 \b; #5 617>>>0x22C use PIT-entry 618>>>4 ulelong >5 \b; #6 619>>>0x2B0 use PIT-entry 620>>>4 ulelong >6 \b; #7 621>>>0x334 use PIT-entry 622>>>4 ulelong >7 \b; #8 623>>>0x3B8 use PIT-entry 624>>>4 ulelong >8 \b; #9 625>>>0x43C use PIT-entry 626>>>4 ulelong >9 \b; #10 627>>>0x4C0 use PIT-entry 628>>>4 ulelong >10 \b; #11 629>>>0x544 use PIT-entry 630>>>4 ulelong >11 \b; #12 631>>>0x5C8 use PIT-entry 632>>>4 ulelong >12 \b; #13 633>>>>0x64C use PIT-entry 634# 14. pit entry 635>>>4 ulelong >13 \b; #14 636>>>>0x6D0 use PIT-entry 637>>>4 ulelong >14 \b; #15 638>>>0x754 use PIT-entry 639>>>4 ulelong >15 \b; #16 640>>>0x7D8 use PIT-entry 641>>>4 ulelong >16 \b; #17 642>>>0x85C use PIT-entry 643# 18. pit entry 644>>>4 ulelong >17 \b; #18 645>>>0x8E0 use PIT-entry 646 6470 name PIT-entry 648# garbage value implies end of pit entries 649>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 650# skip empty partition name 651>>0x24 ubyte !0 652# partition name 653>>>0x24 string >\0 %-.32s 654# flags 655>>>0x0C ulelong&0x00000002 2 \b+RW 656# partition ID: 657# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER 658# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 659>>>0x08 ulelong x (0x%x) 660# filename 661>>>0x44 string >\0 "%-.64s" 662#>>>0x18 ulelong >0 663# blocksize in 512 byte units ? 664#>>>>0x18 ulelong x \b, %db 665# partition size in blocks ? 666#>>>>0x22 ulelong x \b*%d 667 668# Android sparse img format 669# From https://android.googlesource.com/\ 670# platform/system/core/+/master/libsparse/sparse_format.h 6710 lelong 0xed26ff3a Android sparse image 672>4 leshort x \b, version: %d 673>6 leshort x \b.%d 674>16 lelong x \b, Total of %d 675>12 lelong x \b %d-byte output blocks in 676>20 lelong x \b %d input chunks. 677 678# Android binary XML magic 679# In include/androidfw/ResourceTypes.h: 680# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), 681# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 6820 lelong 0x00080003 Android binary XML 683 684# Android cryptfs footer 685# From https://android.googlesource.com/\ 686# platform/system/vold/+/refs/heads/master/cryptfs.h 6870 lelong 0xd0b5b1c4 Android cryptfs footer 688>4 leshort x \b, version: %d 689>6 leshort x \b.%d 690 691# Android Vdex format 692# From https://android.googlesource.com/\ 693# platform/art/+/master/runtime/vdex_file.h 6940 string vdex Android vdex file, 695>4 string >000 verifier deps version: %s, 696>8 string >000 dex section version: %s, 697>12 lelong >0 number of dex files: %d, 698>16 lelong >0 verifier deps size: %d 699 700# Android Vdex format, dexfile is currently being updated 701# by android system 702# From https://android.googlesource.com/\ 703# platform/art/+/master/dex2oat/dex2oat.cc 7040 string wdex Android vdex file, being processed by dex2oat, 705>4 string >000 verifier deps version: %s, 706>8 string >000 dex section version: %s, 707>12 lelong >0 number of dex files: %d, 708>16 lelong >0 verifier deps size: %d 709 710#------------------------------------------------------------------------------ 711# $File: animation,v 1.85 2021/03/14 16:36:53 christos Exp $ 712# animation: file(1) magic for animation/movie formats 713# 714# animation formats 715# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 716# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 717 718# SGI and Apple formats 7190 string MOVI Silicon Graphics movie file 720!:mime video/x-sgi-movie 7214 string moov Apple QuickTime 722!:mime video/quicktime 723>12 string mvhd \b movie (fast start) 724>12 string mdra \b URL 725>12 string cmov \b movie (fast start, compressed header) 726>12 string rmra \b multiple URLs 7274 string mdat Apple QuickTime movie (unoptimized) 728!:mime video/quicktime 729#4 string wide Apple QuickTime movie (unoptimized) 730#!:mime video/quicktime 731#4 string skip Apple QuickTime movie (modified) 732#!:mime video/quicktime 733#4 string free Apple QuickTime movie (modified) 734#!:mime video/quicktime 7354 string idsc Apple QuickTime image (fast start) 736!:mime image/x-quicktime 737#4 string idat Apple QuickTime image (unoptimized) 738#!:mime image/x-quicktime 7394 string pckg Apple QuickTime compressed archive 740!:mime application/x-quicktime-player 7414 string/W jP JPEG 2000 image 742!:mime image/jp2 743 744#### MP4 #### 745# https://www.ftyps.com/ with local additions 746# https://cconcolato.github.io/mp4ra/filetype.html 7474 string ftyp ISO Media 748# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ 749>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec 750>>96 string x \b, Audio "%.4s" 751>>118 beshort x at %dHz 752>>140 string x \b, Video "%.4s" 753>>168 beshort x %d 754>>170 beshort x \bx%d 755>8 string 3g2 \b, MPEG v4 system, 3GPP2 756!:mime video/3gpp2 757>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 758>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 759>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 760# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf 761# Section 8.1.1, corresponds to a, b, c 762>>11 byte 0x61 \b C.S0050-0 V1.0 763>>11 byte 0x62 \b C.S0050-0-A V1.0.0 764>>11 byte 0x63 \b C.S0050-0-B V1.0 765>8 string 3ge \b, MPEG v4 system, 3GPP 766!:mime video/3gpp 767>>11 byte 6 \b, Release %d MBMS Extended Presentations 768>>11 byte 7 \b, Release %d MBMS Extended Presentations 769>>11 byte 9 \b, Release %d MBMS Extended Presentations 770>8 string 3gf \b, MPEG v4 system, 3GPP 771>>11 byte 9 \b, Release %d File-delivery profile 772>8 string 3gg \b, MPEG v4 system, 3GPP 773!:mime video/3gpp 774>>11 byte 6 \b, Release %d General Profile 775>>11 byte 9 \b, Release %d General Profile 776>8 string 3gh \b, MPEG v4 system, 3GPP 777!:mime video/3gpp 778>>11 byte 9 \b, Release %d Adaptive Streaming Profile 779>8 string 3gm \b, MPEG v4 system, 3GPP 780!:mime video/3gpp 781>>11 byte 9 \b, Release %d Media Segment Profile 782>8 string 3gp \b, MPEG v4 system, 3GPP 783!:mime video/3gpp 784>>11 byte 1 \b, Release %d (non existent) 785>>11 byte 2 \b, Release %d (non existent) 786>>11 byte 3 \b, Release %d (non existent) 787>>11 byte 4 \b, Release %d 788>>11 byte 5 \b, Release %d 789>>11 byte 6 \b, Release %d 790>>11 byte 7 \b, Release %d Streaming Servers 791>8 string 3gr \b, MPEG v4 system, 3GPP 792!:mime video/3gpp 793>>11 byte 6 \b, Release %d Progressive Download Profile 794>>11 byte 9 \b, Release %d Progressive Download Profile 795>8 string 3gs \b, MPEG v4 system, 3GPP 796!:mime video/3gpp 797>>11 byte 6 \b, Release %d Streaming Servers 798>>11 byte 7 \b, Release %d Streaming Servers 799>>11 byte 9 \b, Release %d Streaming Servers 800>8 string 3gt \b, MPEG v4 system, 3GPP 801!:mime video/3gpp 802>>11 byte 8 \b, Release %d Media Stream Recording Profile 803>>11 byte 9 \b, Release %d Media Stream Recording Profile 804>8 string ARRI \b, MPEG v4 system, ARRI Digital Camera 805!:mime video/mp4 806>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 807!:mime video/mp4 808>8 string bbxm \b, Blinkbox Master File: H.264 video/16-bit LE LPCM audio 809!:mime video/mp4 810>8 string/W qt \b, Apple QuickTime movie 811!:mime video/quicktime 812>8 string CAEP \b, Canon Digital Camera 813>8 string caqv \b, Casio Digital Camera 814>8 string CDes \b, Convergent Design 815>8 string caaa \b, CMAF Media Profile - AAC Adaptive Audio 816>8 string caac \b, CMAF Media Profile - AAC Core 817>8 string caqv \b, Casio Digital Camera Casio 818>8 string ccea \b, CMAF Supplemental Data - CEA-608/708 819>8 string ccff \b, Common container file format 820>8 string cfhd \b, CMAF Media Profile - AVC HD 821>8 string cfsd \b, CMAF Media Profile - AVC SD 822>8 string chd1 \b, CMAF Media Profile - HEVC HDR10 823>8 string chdf \b, CMAF Media Profile - AVC HDHF 824>8 string chhd \b, CMAF Media Profile - HEVC HHD8 825>8 string chh1 \b, CMAF Media Profile - HEVC HHD10 826>8 string clg1 \b, CMAF Media Profile - HEVC HLG10 827>8 string cmfc \b, CMAF Track Format 828>8 string cmff \b, CMAF Fragment Format 829>8 string cmfl \b, CMAF Chunk Format 830>8 string cmfs \b, CMAF Segment Format 831>8 string cud1 \b, CMAF Media Profile - HEVC UHD10 832>8 string cud8 \b, CMAF Media Profile - HEVC UHD8 833>8 string cwvt \b, CMAF Media Profile - WebVTT 834>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 835>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 836>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 837>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 838>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 839>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 840>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 841>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 842>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP 843!:mime video/mp4 844>8 string dby1 \b, MP4 files with Dolby content 845>8 string dsms \b, Media Segment DASH conformant 846>8 string dts1 \b, MP4 track file with audio codecs dtsc dtsh or dtse 847>8 string dts2 \b, MP4 track file with audio codec dtsx 848>8 string dts3 \b, MP4 track file with audio codec dtsy 849>8 string dxo$20 \b, DxO ONE camera 850>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 851>8 string dmpf \b, Digital Media Project 852>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 853>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 854>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 855>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 856>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 857>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 858>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 859>8 string dvr1 \b, DVB (.DVB) over RTP 860!:mime video/vnd.dvb.file 861>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 862>8 string emsg \b, Event message box present 863!:mime video/vnd.dvb.file 864>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 865!:mime video/mp4 866>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 867!:mime video/mp4 868>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 869!:mime audio/mp4 870>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 871!:mime audio/mp4 872>8 string ifrm \b, Apple iFrame Specification, Version 8.1 Jan 2013 873>8 string im1i \b, CMAF Media Profile - IMSC1 Image 874>8 string im1t \b, CMAF Media Profile - IMSC1 Text 875>8 string isc2 \b, ISMACryp 2.0 Encrypted File 876# ?/enc-isoff-generic 877>8 string iso \b, MP4 Base Media 878!:mime video/mp4 879>>11 string m v1 [ISO 14496-12:2003] 880>>11 string 2 v2 [ISO 14496-12:2005] 881>>11 string 4 v4 882>>11 string 5 v5 883>>11 string 6 v6 884>8 string isml \b, MP4 Base Media v2 [ISO 14496-12:2005] 885!:mime video/mp4 886>8 string J2P0 \b, JPEG2000 Profile 0 887>8 string J2P1 \b, JPEG2000 Profile 1 888>8 string/W jp2 \b, JPEG 2000 889!:mime image/jp2 890>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 891!:mime image/jp2 892>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 893>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 894!:mime image/jpm 895>8 string jpsi \b, The JPSearch data interchange format 896>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 897!:mime image/jpx 898>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 899!:mime video/3gpp2 900>8 string LCAG \b, Leica digital camera 901>8 string lmsg \b, Last Media Segment indicator for ISO base media file format. 902>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 903!:mime audio/x-m4a 904>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 905!:mime audio/mp4 906>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 907!:mime video/mp4 908>8 string M4V \b, Apple iTunes Video (.M4V) Video 909!:mime video/x-m4v 910>8 string M4VH \b, Apple TV (.M4V) 911!:mime video/x-m4v 912>8 string M4VP \b, Apple iPhone (.M4V) 913!:mime video/x-m4v 914>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 915!:mime video/mj2 916>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 917>8 string MFSM \b, Media File for Samsung video Metadata 918>8 string MGSV \b, Sony Home and Mobile Multimedia Platform (HMMP) 919!:mime video/mj2 920>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 921!:mime video/mp4 922>8 string mobi \b, MPEG-4, MOBI format 923!:mime video/mp4 924>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 925>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 926!:mime video/mp4 927>8 string mp42 \b, MP4 v2 [ISO 14496-14] 928!:mime video/mp4 929>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 930>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 931>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 932>8 string mpuf \b, Compliance with the MMT Processing Unit format 933>8 string msdh \b, Media Segment conforming to ISO base media file format. 934>8 string msix \b, Media Segment conforming to ISO base media file format. 935>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 936!:mime video/mp4 937>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 938>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 939!:mime video/quicktime 940>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 941!:mime audio/mp4 942>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 943!:mime audio/mp4 944>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 945!:mime video/mp4 946>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 947!:mime video/mp4 948>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 949!:mime video/mp4 950>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 951!:mime video/mp4 952>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 953!:mime video/mp4 954>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 955!:mime video/mp4 956>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 957!:mime video/mp4 958>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 959!:mime video/mp4 960>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 961!:mime video/mp4 962>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 963>8 string niko \b, Nikon Digital Camera 964!:mime video/mp4 965>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 966>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 967>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 968>8 string pana \b, Panasonic Digital Camera 969>8 string piff \b, Protected Interoperable File Format 970>8 string pnvi ]b, Panasonic Video Intercom 971>8 string qt \b, Apple QuickTime (.MOV/QT) 972!:mime video/quicktime 973# HEIF image format 974# see https://nokiatech.github.io/heif/technical.html 975>8 string mif1 \b, HEIF Image 976!:mime image/heif 977>8 string msf1 \b, HEIF Image Sequence 978!:mime image/heif-sequence 979>8 string heic \b, HEIF Image HEVC Main or Main Still Picture Profile 980!:mime image/heic 981>8 string heix \b, HEIF Image HEVC Main 10 Profile 982!:mime image/heic 983>8 string hevc \b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile 984!:mime image/heic-sequence 985>8 string hevx \b, HEIF Image Sequence HEVC Main 10 Profile 986!:mime image/heic-sequence 987# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017) 988# but used in the reference implementation: 989# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp 990>8 string heim \b, HEIF Image L-HEVC 991!:mime image/heif 992>8 string heis \b, HEIF Image L-HEVC 993!:mime image/heif 994>8 string avic \b, HEIF Image AVC 995!:mime image/heif 996>8 string hevm \b, HEIF Image Sequence L-HEVC 997!:mime image/heif-sequence 998>8 string hevs \b, HEIF Image Sequence L-HEVC 999!:mime image/heif-sequence 1000>8 string avcs \b, HEIF Image Sequence AVC 1001!:mime image/heif-sequence 1002# AVIF image format 1003# see https://aomediacodec.github.io/av1-avif/ 1004>8 string avif \b, AVIF Image 1005!:mime image/avif 1006>8 string avis \b, AVIF Image Sequence 1007!:mime image/avif 1008>8 string risx \b, Representation Index Segment for MPEG-2 TS Segments 1009>8 string ROSS \b, Ross Video 1010>8 string sdv \b, SD Memory Card Video 1011>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 1012>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 1013>8 string SEAU \b, Sony Home and Mobile Multimedia Platform (HMMP) 1014>8 string SEBK \b, Sony Home and Mobile Multimedia Platform (HMMP) 1015>8 string senv \b, Video contents Sony Entertainment Network 1016>8 string sims \b, Media Segment for Sub-Indexed Media Segment format 1017>8 string sisx \b, Single Index Segment forindex MPEG-2 TS 1018>8 string ssss \b, Subsegment Index Segment used to index MPEG-2 Segments 1019>8 string uvvu \b, UltraViolet file brand for DECE Common Format 1020 1021# MPEG sequences 1022# Scans for all common MPEG header start codes 10230 belong 0x00000001 1024>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 1025>>5 byte 66 \b, baseline 1026>>5 byte 77 \b, main 1027>>5 byte 88 \b, extended 1028>>7 byte x \b @ L %u 10290 belong&0xFFFFFF00 0x00000100 1030>3 byte 0xBA MPEG sequence 1031!:mime video/mpeg 1032# http://fileformats.archiveteam.org/wiki/Enhanced_VOB 1033# https://reposcope.com/mimetype/video/mpeg 1034!:ext vob/evo/mpg/mpeg 1035>>4 byte &0x40 \b, v2, program multiplex 1036>>4 byte ^0x40 \b, v1, system multiplex 1037>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 1038>3 byte&0x1F 0x07 MPEG sequence, H.264 video 1039>>4 byte 66 \b, baseline 1040>>4 byte 77 \b, main 1041>>4 byte 88 \b, extended 1042>>6 byte x \b @ L %u 1043# GRR too general as it catches also FoxPro Memo example NG.FPT 1044>3 byte 0xB0 MPEG sequence, v4 1045# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 1046#>>4 byte !0 MPEG sequence, v4 1047!:mime video/mpeg4-generic 1048>>5 belong 0x000001B5 1049>>>9 byte &0x80 1050>>>>10 byte&0xF0 16 \b, video 1051>>>>10 byte&0xF0 32 \b, still texture 1052>>>>10 byte&0xF0 48 \b, mesh 1053>>>>10 byte&0xF0 64 \b, face 1054>>>9 byte&0xF8 8 \b, video 1055>>>9 byte&0xF8 16 \b, still texture 1056>>>9 byte&0xF8 24 \b, mesh 1057>>>9 byte&0xF8 32 \b, face 1058>>4 byte 1 \b, simple @ L1 1059>>4 byte 2 \b, simple @ L2 1060>>4 byte 3 \b, simple @ L3 1061>>4 byte 4 \b, simple @ L0 1062>>4 byte 17 \b, simple scalable @ L1 1063>>4 byte 18 \b, simple scalable @ L2 1064>>4 byte 33 \b, core @ L1 1065>>4 byte 34 \b, core @ L2 1066>>4 byte 50 \b, main @ L2 1067>>4 byte 51 \b, main @ L3 1068>>4 byte 53 \b, main @ L4 1069>>4 byte 66 \b, n-bit @ L2 1070>>4 byte 81 \b, scalable texture @ L1 1071>>4 byte 97 \b, simple face animation @ L1 1072>>4 byte 98 \b, simple face animation @ L2 1073>>4 byte 99 \b, simple face basic animation @ L1 1074>>4 byte 100 \b, simple face basic animation @ L2 1075>>4 byte 113 \b, basic animation text @ L1 1076>>4 byte 114 \b, basic animation text @ L2 1077>>4 byte 129 \b, hybrid @ L1 1078>>4 byte 130 \b, hybrid @ L2 1079>>4 byte 145 \b, advanced RT simple @ L! 1080>>4 byte 146 \b, advanced RT simple @ L2 1081>>4 byte 147 \b, advanced RT simple @ L3 1082>>4 byte 148 \b, advanced RT simple @ L4 1083>>4 byte 161 \b, core scalable @ L1 1084>>4 byte 162 \b, core scalable @ L2 1085>>4 byte 163 \b, core scalable @ L3 1086>>4 byte 177 \b, advanced coding efficiency @ L1 1087>>4 byte 178 \b, advanced coding efficiency @ L2 1088>>4 byte 179 \b, advanced coding efficiency @ L3 1089>>4 byte 180 \b, advanced coding efficiency @ L4 1090>>4 byte 193 \b, advanced core @ L1 1091>>4 byte 194 \b, advanced core @ L2 1092>>4 byte 209 \b, advanced scalable texture @ L1 1093>>4 byte 210 \b, advanced scalable texture @ L2 1094>>4 byte 211 \b, advanced scalable texture @ L3 1095>>4 byte 225 \b, simple studio @ L1 1096>>4 byte 226 \b, simple studio @ L2 1097>>4 byte 227 \b, simple studio @ L3 1098>>4 byte 228 \b, simple studio @ L4 1099>>4 byte 229 \b, core studio @ L1 1100>>4 byte 230 \b, core studio @ L2 1101>>4 byte 231 \b, core studio @ L3 1102>>4 byte 232 \b, core studio @ L4 1103>>4 byte 240 \b, advanced simple @ L0 1104>>4 byte 241 \b, advanced simple @ L1 1105>>4 byte 242 \b, advanced simple @ L2 1106>>4 byte 243 \b, advanced simple @ L3 1107>>4 byte 244 \b, advanced simple @ L4 1108>>4 byte 245 \b, advanced simple @ L5 1109>>4 byte 247 \b, advanced simple @ L3b 1110>>4 byte 248 \b, FGS @ L0 1111>>4 byte 249 \b, FGS @ L1 1112>>4 byte 250 \b, FGS @ L2 1113>>4 byte 251 \b, FGS @ L3 1114>>4 byte 252 \b, FGS @ L4 1115>>4 byte 253 \b, FGS @ L5 1116>3 byte 0xB5 MPEG sequence, v4 1117!:mime video/mpeg4-generic 1118>>4 byte &0x80 1119>>>5 byte&0xF0 16 \b, video (missing profile header) 1120>>>5 byte&0xF0 32 \b, still texture (missing profile header) 1121>>>5 byte&0xF0 48 \b, mesh (missing profile header) 1122>>>5 byte&0xF0 64 \b, face (missing profile header) 1123>>4 byte&0xF8 8 \b, video (missing profile header) 1124>>4 byte&0xF8 16 \b, still texture (missing profile header) 1125>>4 byte&0xF8 24 \b, mesh (missing profile header) 1126>>4 byte&0xF8 32 \b, face (missing profile header) 1127>3 byte 0xB3 MPEG sequence 1128!:mime video/mpeg 1129>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1130>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1131>>12 belong 0x000001B5 \b, v2, 1132>>>16 byte&0x0F 1 \b HP 1133>>>16 byte&0x0F 2 \b Spt 1134>>>16 byte&0x0F 3 \b SNR 1135>>>16 byte&0x0F 4 \b MP 1136>>>16 byte&0x0F 5 \b SP 1137>>>17 byte&0xF0 64 \b@HL 1138>>>17 byte&0xF0 96 \b@H-14 1139>>>17 byte&0xF0 128 \b@ML 1140>>>17 byte&0xF0 160 \b@LL 1141>>>17 byte &0x08 \b progressive 1142>>>17 byte ^0x08 \b interlaced 1143>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 1144>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 1145>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 1146>>11 byte &0x02 1147>>>75 byte &0x01 1148>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1149>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1150>>>>140 belong 0x000001B5 \b, v2, 1151>>>>>144 byte&0x0F 1 \b HP 1152>>>>>144 byte&0x0F 2 \b Spt 1153>>>>>144 byte&0x0F 3 \b SNR 1154>>>>>144 byte&0x0F 4 \b MP 1155>>>>>144 byte&0x0F 5 \b SP 1156>>>>>145 byte&0xF0 64 \b@HL 1157>>>>>145 byte&0xF0 96 \b@H-14 1158>>>>>145 byte&0xF0 128 \b@ML 1159>>>>>145 byte&0xF0 160 \b@LL 1160>>>>>145 byte &0x08 \b progressive 1161>>>>>145 byte ^0x08 \b interlaced 1162>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 1163>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 1164>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 1165>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1166>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1167>>76 belong 0x000001B5 \b, v2, 1168>>>80 byte&0x0F 1 \b HP 1169>>>80 byte&0x0F 2 \b Spt 1170>>>80 byte&0x0F 3 \b SNR 1171>>>80 byte&0x0F 4 \b MP 1172>>>80 byte&0x0F 5 \b SP 1173>>>81 byte&0xF0 64 \b@HL 1174>>>81 byte&0xF0 96 \b@H-14 1175>>>81 byte&0xF0 128 \b@ML 1176>>>81 byte&0xF0 160 \b@LL 1177>>>81 byte &0x08 \b progressive 1178>>>81 byte ^0x08 \b interlaced 1179>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 1180>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 1181>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 1182>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 1183>>>7 byte&0xF0 0x10 \b, 16:9 1184>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 1185>>>7 byte&0xF0 0x10 \b, 16:9 1186>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 1187>>>7 byte&0xF0 0x10 \b, 4:3 1188>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 1189>>>5 beshort&0x0FFF 0x01E0 \b NTSC 1190>>>5 beshort&0x0FFF 0x0240 \b PAL 1191>>>7 byte&0xF0 0x20 \b, 4:3 1192>>>7 byte&0xF0 0x30 \b, 16:9 1193>>>7 byte&0xF0 0x40 \b, 11:5 1194>>>7 byte&0xF0 0x80 \b, PAL 4:3 1195>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 1196>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 1197>>>7 byte&0xF0 0x10 \b, 4:3 1198>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 1199>>>7 byte&0xF0 0x10 \b, 4:3 1200>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 1201>>>7 byte&0xF0 0x10 \b, 4:3 1202>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 1203>>>7 byte&0xF0 0x10 \b, 4:3 1204>>4 beshort&0xFFF0 0x1600 \b, CIF 1205>>>5 beshort&0x0FFF 0x00F0 \b NTSC 1206>>>5 beshort&0x0FFF 0x0120 \b PAL 1207>>>7 byte&0xF0 0x20 \b, 4:3 1208>>>7 byte&0xF0 0x30 \b, 16:9 1209>>>7 byte&0xF0 0x40 \b, 11:5 1210>>>7 byte&0xF0 0x80 \b, PAL 4:3 1211>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 1212>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1213>>>>7 byte&0xF0 0x20 \b, 4:3 1214>>>>7 byte&0xF0 0x30 \b, 16:9 1215>>>>7 byte&0xF0 0x40 \b, 11:5 1216>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 1217>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1218>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1219>>>7 byte&0xF0 0x20 \b, 4:3 1220>>>7 byte&0xF0 0x30 \b, 16:9 1221>>>7 byte&0xF0 0x40 \b, 11:5 1222>>4 beshort&0xFFF0 0x1E00 \b, SVCD 1223>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1224>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1225>>>7 byte&0xF0 0x20 \b, 4:3 1226>>>7 byte&0xF0 0x30 \b, 16:9 1227>>>7 byte&0xF0 0x40 \b, 11:5 1228>>7 byte&0x0F 1 \b, 23.976 fps 1229>>7 byte&0x0F 2 \b, 24 fps 1230>>7 byte&0x0F 3 \b, 25 fps 1231>>7 byte&0x0F 4 \b, 29.97 fps 1232>>7 byte&0x0F 5 \b, 30 fps 1233>>7 byte&0x0F 6 \b, 50 fps 1234>>7 byte&0x0F 7 \b, 59.94 fps 1235>>7 byte&0x0F 8 \b, 60 fps 1236>>11 byte &0x04 \b, Constrained 1237 1238# MPEG ADTS Audio (*.mpx/mxa/aac) 1239# from dreesen@math.fu-berlin.de 1240# modified to fully support MPEG ADTS 1241 1242# MP3, M1A 1243# modified by Joerg Jenderek 1244# GRR the original test are too common for many DOS files 1245# so don't accept as MP3 until we've tested the rate 1246# But also beat GEMDOS fonts 12470 beshort&0xFFFE 0xFFFA 1248# rates 1249>2 byte&0xF0 !0 1250>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1 1251!:strength +20 1252!:mime audio/mpeg 1253>2 byte&0xF0 0x10 \b, 32 kbps 1254>2 byte&0xF0 0x20 \b, 40 kbps 1255>2 byte&0xF0 0x30 \b, 48 kbps 1256>2 byte&0xF0 0x40 \b, 56 kbps 1257>2 byte&0xF0 0x50 \b, 64 kbps 1258>2 byte&0xF0 0x60 \b, 80 kbps 1259>2 byte&0xF0 0x70 \b, 96 kbps 1260>2 byte&0xF0 0x80 \b, 112 kbps 1261>2 byte&0xF0 0x90 \b, 128 kbps 1262>2 byte&0xF0 0xA0 \b, 160 kbps 1263>2 byte&0xF0 0xB0 \b, 192 kbps 1264>2 byte&0xF0 0xC0 \b, 224 kbps 1265>2 byte&0xF0 0xD0 \b, 256 kbps 1266>2 byte&0xF0 0xE0 \b, 320 kbps 1267# timing 1268>2 byte&0x0C 0x00 \b, 44.1 kHz 1269>2 byte&0x0C 0x04 \b, 48 kHz 1270>2 byte&0x0C 0x08 \b, 32 kHz 1271# channels/options 1272>3 byte&0xC0 0x00 \b, Stereo 1273>3 byte&0xC0 0x40 \b, JntStereo 1274>3 byte&0xC0 0x80 \b, 2x Monaural 1275>3 byte&0xC0 0xC0 \b, Monaural 1276#>1 byte ^0x01 \b, Data Verify 1277#>2 byte &0x02 \b, Packet Pad 1278#>2 byte &0x01 \b, Custom Flag 1279#>3 byte &0x08 \b, Copyrighted 1280#>3 byte &0x04 \b, Original Source 1281#>3 byte&0x03 1 \b, NR: 50/15 ms 1282#>3 byte&0x03 3 \b, NR: CCIT J.17 1283 1284# MP2, M1A 12850 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 1286!:mime audio/mpeg 1287# rates 1288>2 byte&0xF0 0x10 \b, 32 kbps 1289>2 byte&0xF0 0x20 \b, 48 kbps 1290>2 byte&0xF0 0x30 \b, 56 kbps 1291>2 byte&0xF0 0x40 \b, 64 kbps 1292>2 byte&0xF0 0x50 \b, 80 kbps 1293>2 byte&0xF0 0x60 \b, 96 kbps 1294>2 byte&0xF0 0x70 \b, 112 kbps 1295>2 byte&0xF0 0x80 \b, 128 kbps 1296>2 byte&0xF0 0x90 \b, 160 kbps 1297>2 byte&0xF0 0xA0 \b, 192 kbps 1298>2 byte&0xF0 0xB0 \b, 224 kbps 1299>2 byte&0xF0 0xC0 \b, 256 kbps 1300>2 byte&0xF0 0xD0 \b, 320 kbps 1301>2 byte&0xF0 0xE0 \b, 384 kbps 1302# timing 1303>2 byte&0x0C 0x00 \b, 44.1 kHz 1304>2 byte&0x0C 0x04 \b, 48 kHz 1305>2 byte&0x0C 0x08 \b, 32 kHz 1306# channels/options 1307>3 byte&0xC0 0x00 \b, Stereo 1308>3 byte&0xC0 0x40 \b, JntStereo 1309>3 byte&0xC0 0x80 \b, 2x Monaural 1310>3 byte&0xC0 0xC0 \b, Monaural 1311#>1 byte ^0x01 \b, Data Verify 1312#>2 byte &0x02 \b, Packet Pad 1313#>2 byte &0x01 \b, Custom Flag 1314#>3 byte &0x08 \b, Copyrighted 1315#>3 byte &0x04 \b, Original Source 1316#>3 byte&0x03 1 \b, NR: 50/15 ms 1317#>3 byte&0x03 3 \b, NR: CCIT J.17 1318 1319# MPA, M1A 1320# updated by Joerg Jenderek 1321# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 1322# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 1323# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 1324#0 beshort&0xFFFE 0xFFFE 1325#>2 ubyte&0xF0 >0x0F 1326#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 1327## rate 1328#>>>2 byte&0xF0 0x10 \b, 32 kbps 1329#>>>2 byte&0xF0 0x20 \b, 64 kbps 1330#>>>2 byte&0xF0 0x30 \b, 96 kbps 1331#>>>2 byte&0xF0 0x40 \b, 128 kbps 1332#>>>2 byte&0xF0 0x50 \b, 160 kbps 1333#>>>2 byte&0xF0 0x60 \b, 192 kbps 1334#>>>2 byte&0xF0 0x70 \b, 224 kbps 1335#>>>2 byte&0xF0 0x80 \b, 256 kbps 1336#>>>2 byte&0xF0 0x90 \b, 288 kbps 1337#>>>2 byte&0xF0 0xA0 \b, 320 kbps 1338#>>>2 byte&0xF0 0xB0 \b, 352 kbps 1339#>>>2 byte&0xF0 0xC0 \b, 384 kbps 1340#>>>2 byte&0xF0 0xD0 \b, 416 kbps 1341#>>>2 byte&0xF0 0xE0 \b, 448 kbps 1342## timing 1343#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 1344#>>>2 byte&0x0C 0x04 \b, 48 kHz 1345#>>>2 byte&0x0C 0x08 \b, 32 kHz 1346## channels/options 1347#>>>3 byte&0xC0 0x00 \b, Stereo 1348#>>>3 byte&0xC0 0x40 \b, JntStereo 1349#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1350#>>>3 byte&0xC0 0xC0 \b, Monaural 1351##>1 byte ^0x01 \b, Data Verify 1352##>2 byte &0x02 \b, Packet Pad 1353##>2 byte &0x01 \b, Custom Flag 1354##>3 byte &0x08 \b, Copyrighted 1355##>3 byte &0x04 \b, Original Source 1356##>3 byte&0x03 1 \b, NR: 50/15 ms 1357##>3 byte&0x03 3 \b, NR: CCIT J.17 1358 1359# MP3, M2A 13600 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1361!:mime audio/mpeg 1362# rate 1363>2 byte&0xF0 0x10 \b, 8 kbps 1364>2 byte&0xF0 0x20 \b, 16 kbps 1365>2 byte&0xF0 0x30 \b, 24 kbps 1366>2 byte&0xF0 0x40 \b, 32 kbps 1367>2 byte&0xF0 0x50 \b, 40 kbps 1368>2 byte&0xF0 0x60 \b, 48 kbps 1369>2 byte&0xF0 0x70 \b, 56 kbps 1370>2 byte&0xF0 0x80 \b, 64 kbps 1371>2 byte&0xF0 0x90 \b, 80 kbps 1372>2 byte&0xF0 0xA0 \b, 96 kbps 1373>2 byte&0xF0 0xB0 \b, 112 kbps 1374>2 byte&0xF0 0xC0 \b, 128 kbps 1375>2 byte&0xF0 0xD0 \b, 144 kbps 1376>2 byte&0xF0 0xE0 \b, 160 kbps 1377# timing 1378>2 byte&0x0C 0x00 \b, 22.05 kHz 1379>2 byte&0x0C 0x04 \b, 24 kHz 1380>2 byte&0x0C 0x08 \b, 16 kHz 1381# channels/options 1382>3 byte&0xC0 0x00 \b, Stereo 1383>3 byte&0xC0 0x40 \b, JntStereo 1384>3 byte&0xC0 0x80 \b, 2x Monaural 1385>3 byte&0xC0 0xC0 \b, Monaural 1386#>1 byte ^0x01 \b, Data Verify 1387#>2 byte &0x02 \b, Packet Pad 1388#>2 byte &0x01 \b, Custom Flag 1389#>3 byte &0x08 \b, Copyrighted 1390#>3 byte &0x04 \b, Original Source 1391#>3 byte&0x03 1 \b, NR: 50/15 ms 1392#>3 byte&0x03 3 \b, NR: CCIT J.17 1393 1394# MP2, M2A 13950 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1396!:mime audio/mpeg 1397# rate 1398>2 byte&0xF0 0x10 \b, 8 kbps 1399>2 byte&0xF0 0x20 \b, 16 kbps 1400>2 byte&0xF0 0x30 \b, 24 kbps 1401>2 byte&0xF0 0x40 \b, 32 kbps 1402>2 byte&0xF0 0x50 \b, 40 kbps 1403>2 byte&0xF0 0x60 \b, 48 kbps 1404>2 byte&0xF0 0x70 \b, 56 kbps 1405>2 byte&0xF0 0x80 \b, 64 kbps 1406>2 byte&0xF0 0x90 \b, 80 kbps 1407>2 byte&0xF0 0xA0 \b, 96 kbps 1408>2 byte&0xF0 0xB0 \b, 112 kbps 1409>2 byte&0xF0 0xC0 \b, 128 kbps 1410>2 byte&0xF0 0xD0 \b, 144 kbps 1411>2 byte&0xF0 0xE0 \b, 160 kbps 1412# timing 1413>2 byte&0x0C 0x00 \b, 22.05 kHz 1414>2 byte&0x0C 0x04 \b, 24 kHz 1415>2 byte&0x0C 0x08 \b, 16 kHz 1416# channels/options 1417>3 byte&0xC0 0x00 \b, Stereo 1418>3 byte&0xC0 0x40 \b, JntStereo 1419>3 byte&0xC0 0x80 \b, 2x Monaural 1420>3 byte&0xC0 0xC0 \b, Monaural 1421#>1 byte ^0x01 \b, Data Verify 1422#>2 byte &0x02 \b, Packet Pad 1423#>2 byte &0x01 \b, Custom Flag 1424#>3 byte &0x08 \b, Copyrighted 1425#>3 byte &0x04 \b, Original Source 1426#>3 byte&0x03 1 \b, NR: 50/15 ms 1427#>3 byte&0x03 3 \b, NR: CCIT J.17 1428 1429# MPA, M2A 14300 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1431!:mime audio/mpeg 1432# rate 1433>2 byte&0xF0 0x10 \b, 32 kbps 1434>2 byte&0xF0 0x20 \b, 48 kbps 1435>2 byte&0xF0 0x30 \b, 56 kbps 1436>2 byte&0xF0 0x40 \b, 64 kbps 1437>2 byte&0xF0 0x50 \b, 80 kbps 1438>2 byte&0xF0 0x60 \b, 96 kbps 1439>2 byte&0xF0 0x70 \b, 112 kbps 1440>2 byte&0xF0 0x80 \b, 128 kbps 1441>2 byte&0xF0 0x90 \b, 144 kbps 1442>2 byte&0xF0 0xA0 \b, 160 kbps 1443>2 byte&0xF0 0xB0 \b, 176 kbps 1444>2 byte&0xF0 0xC0 \b, 192 kbps 1445>2 byte&0xF0 0xD0 \b, 224 kbps 1446>2 byte&0xF0 0xE0 \b, 256 kbps 1447# timing 1448>2 byte&0x0C 0x00 \b, 22.05 kHz 1449>2 byte&0x0C 0x04 \b, 24 kHz 1450>2 byte&0x0C 0x08 \b, 16 kHz 1451# channels/options 1452>3 byte&0xC0 0x00 \b, Stereo 1453>3 byte&0xC0 0x40 \b, JntStereo 1454>3 byte&0xC0 0x80 \b, 2x Monaural 1455>3 byte&0xC0 0xC0 \b, Monaural 1456#>1 byte ^0x01 \b, Data Verify 1457#>2 byte &0x02 \b, Packet Pad 1458#>2 byte &0x01 \b, Custom Flag 1459#>3 byte &0x08 \b, Copyrighted 1460#>3 byte &0x04 \b, Original Source 1461#>3 byte&0x03 1 \b, NR: 50/15 ms 1462#>3 byte&0x03 3 \b, NR: CCIT J.17 1463 1464# MP3, M25A 14650 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1466!:mime audio/mpeg 1467# rate 1468>2 byte&0xF0 0x10 \b, 8 kbps 1469>2 byte&0xF0 0x20 \b, 16 kbps 1470>2 byte&0xF0 0x30 \b, 24 kbps 1471>2 byte&0xF0 0x40 \b, 32 kbps 1472>2 byte&0xF0 0x50 \b, 40 kbps 1473>2 byte&0xF0 0x60 \b, 48 kbps 1474>2 byte&0xF0 0x70 \b, 56 kbps 1475>2 byte&0xF0 0x80 \b, 64 kbps 1476>2 byte&0xF0 0x90 \b, 80 kbps 1477>2 byte&0xF0 0xA0 \b, 96 kbps 1478>2 byte&0xF0 0xB0 \b, 112 kbps 1479>2 byte&0xF0 0xC0 \b, 128 kbps 1480>2 byte&0xF0 0xD0 \b, 144 kbps 1481>2 byte&0xF0 0xE0 \b, 160 kbps 1482# timing 1483>2 byte&0x0C 0x00 \b, 11.025 kHz 1484>2 byte&0x0C 0x04 \b, 12 kHz 1485>2 byte&0x0C 0x08 \b, 8 kHz 1486# channels/options 1487>3 byte&0xC0 0x00 \b, Stereo 1488>3 byte&0xC0 0x40 \b, JntStereo 1489>3 byte&0xC0 0x80 \b, 2x Monaural 1490>3 byte&0xC0 0xC0 \b, Monaural 1491#>1 byte ^0x01 \b, Data Verify 1492#>2 byte &0x02 \b, Packet Pad 1493#>2 byte &0x01 \b, Custom Flag 1494#>3 byte &0x08 \b, Copyrighted 1495#>3 byte &0x04 \b, Original Source 1496#>3 byte&0x03 1 \b, NR: 50/15 ms 1497#>3 byte&0x03 3 \b, NR: CCIT J.17 1498 1499# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1500 1501# Stored AAC streams (instead of the MP4 format) 15020 string ADIF MPEG ADIF, AAC 1503!:mime audio/x-hx-aac-adif 1504>4 byte &0x80 1505>>13 byte &0x10 \b, VBR 1506>>13 byte ^0x10 \b, CBR 1507>>16 byte&0x1E 0x02 \b, single stream 1508>>16 byte&0x1E 0x04 \b, 2 streams 1509>>16 byte&0x1E 0x06 \b, 3 streams 1510>>16 byte &0x08 \b, 4 or more streams 1511>>16 byte &0x10 \b, 8 or more streams 1512>>4 byte &0x80 \b, Copyrighted 1513>>13 byte &0x40 \b, Original Source 1514>>13 byte &0x20 \b, Home Flag 1515>4 byte ^0x80 1516>>4 byte &0x10 \b, VBR 1517>>4 byte ^0x10 \b, CBR 1518>>7 byte&0x1E 0x02 \b, single stream 1519>>7 byte&0x1E 0x04 \b, 2 streams 1520>>7 byte&0x1E 0x06 \b, 3 streams 1521>>7 byte &0x08 \b, 4 or more streams 1522>>7 byte &0x10 \b, 8 or more streams 1523>>4 byte &0x40 \b, Original Stream(s) 1524>>4 byte &0x20 \b, Home Source 1525 1526# Live or stored single AAC stream (used with MPEG-2 systems) 15270 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1528!:mime audio/x-hx-aac-adts 1529>1 byte &0x08 \b, v2 1530>1 byte ^0x08 \b, v4 1531# profile 1532>>2 byte &0xC0 \b LTP 1533>2 byte&0xc0 0x00 \b Main 1534>2 byte&0xc0 0x40 \b LC 1535>2 byte&0xc0 0x80 \b SSR 1536# timing 1537>2 byte&0x3c 0x00 \b, 96 kHz 1538>2 byte&0x3c 0x04 \b, 88.2 kHz 1539>2 byte&0x3c 0x08 \b, 64 kHz 1540>2 byte&0x3c 0x0c \b, 48 kHz 1541>2 byte&0x3c 0x10 \b, 44.1 kHz 1542>2 byte&0x3c 0x14 \b, 32 kHz 1543>2 byte&0x3c 0x18 \b, 24 kHz 1544>2 byte&0x3c 0x1c \b, 22.05 kHz 1545>2 byte&0x3c 0x20 \b, 16 kHz 1546>2 byte&0x3c 0x24 \b, 12 kHz 1547>2 byte&0x3c 0x28 \b, 11.025 kHz 1548>2 byte&0x3c 0x2c \b, 8 kHz 1549# channels 1550>2 beshort&0x01c0 0x0040 \b, monaural 1551>2 beshort&0x01c0 0x0080 \b, stereo 1552>2 beshort&0x01c0 0x00c0 \b, stereo + center 1553>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1554>2 beshort&0x01c0 0x0140 \b, surround 1555>2 beshort&0x01c0 0x0180 \b, surround + LFE 1556>2 beshort &0x01C0 \b, surround + side 1557#>1 byte ^0x01 \b, Data Verify 1558#>2 byte &0x02 \b, Custom Flag 1559#>3 byte &0x20 \b, Original Stream 1560#>3 byte &0x10 \b, Home Source 1561#>3 byte &0x08 \b, Copyrighted 1562 1563# Live MPEG-4 audio streams (instead of RTP FlexMux) 15640 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1565!:mime audio/x-mp4a-latm 1566#>1 beshort&0x1FFF x \b, %hu byte packet 1567>3 byte&0xE0 0x40 1568>>4 byte&0x3C 0x04 \b, single stream 1569>>4 byte&0x3C 0x08 \b, 2 streams 1570>>4 byte&0x3C 0x0C \b, 3 streams 1571>>4 byte &0x08 \b, 4 or more streams 1572>>4 byte &0x20 \b, 8 or more streams 1573>3 byte&0xC0 0 1574>>4 byte&0x78 0x08 \b, single stream 1575>>4 byte&0x78 0x10 \b, 2 streams 1576>>4 byte&0x78 0x18 \b, 3 streams 1577>>4 byte &0x20 \b, 4 or more streams 1578>>4 byte &0x40 \b, 8 or more streams 1579# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1580#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1581#!:mime audio/x-mp4a-latm 1582 1583# Summary: FLI animation format 1584# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1585# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 15864 leshort 0xAF11 1587# standard FLI always has 320x200 resolution and 8 bit color 1588>8 leshort 320 1589>>10 leshort 200 1590>>>12 leshort 8 FLI animation, 320x200x8 1591!:mime video/x-fli 1592>>>>6 leshort x \b, %d frames 1593# frame speed is multiple of 1/70s 1594>>>>16 leshort x \b, %d/70s per frame 1595 1596# Summary: FLC animation format 1597# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1598# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 15994 leshort 0xAF12 1600# standard FLC always use 8 bit color 1601>12 leshort 8 FLC animation 1602!:mime video/x-flc 1603>>8 leshort x \b, %d 1604>>10 leshort x \bx%dx8 1605>>6 uleshort x \b, %d frames 1606>>16 uleshort x \b, %dms per frame 1607 1608# DL animation format 1609# XXX - collision with most `mips' magic 1610# 1611# I couldn't find a real magic number for these, however, this 1612# -appears- to work. Note that it might catch other files, too, so be 1613# careful! 1614# 1615# Note that title and author appear in the two 20-byte chunks 1616# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1617# 255 (hex FF)! The DL format is really bad. 1618# 1619#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1620#!:mime video/x-unknown 1621#>42 byte x - %d screens, 1622#>43 byte x %d commands 1623#0 byte 2 DL version 2 1624#!:mime video/x-unknown 1625#>1 byte 1 - large format (320x200,1 image/screen), 1626#>1 byte 2 - medium format (160x100,4 images/screen), 1627#>1 byte >2 - unknown format, 1628#>42 byte x %d screens, 1629#>43 byte x %d commands 1630# Based on empirical evidence, DL version 3 have several nulls following the 1631# \003. Most of them start with non-null values at hex offset 0x34 or so. 1632#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1633 1634# iso 13818 transport stream 1635# 1636# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1637# syncbyte 8 bit 0x47 1638# error_ind 1 bit - 1639# payload_start 1 bit 1 1640# priority 1 bit - 1641# PID 13 bit 0x0000 1642# scrambling 2 bit - 1643# adaptfld_ctrl 2 bit 1 or 3 1644# conti_count 4 bit - 16450 belong&0xFF5FFF10 0x47400010 1646>188 byte 0x47 MPEG transport stream data 1647!:mime video/MP2T 1648 1649# DIF digital video file format <mpruett@sgi.com> 16500 belong&0xffffff00 0x1f070000 DIF 1651>4 byte &0x01 (DVCPRO) movie file 1652>4 byte ^0x01 (DV) movie file 1653>3 byte &0x80 (PAL) 1654>3 byte ^0x80 (NTSC) 1655 1656# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 16570 string \x8aMNG MNG video data, 1658!:mime video/x-mng 1659>4 belong !0x0d0a1a0a CORRUPTED, 1660>4 belong 0x0d0a1a0a 1661>>16 belong x %d x 1662>>20 belong x %d 1663 1664# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 16650 string \x8bJNG JNG video data, 1666!:mime video/x-jng 1667>4 belong !0x0d0a1a0a CORRUPTED, 1668>4 belong 0x0d0a1a0a 1669>>16 belong x %d x 1670>>20 belong x %d 1671 1672# Vivo video (Wolfram Kleff) 16733 string \x0D\x0AVersion:Vivo Vivo video data 1674 1675# ABC (alembic.io 3d models) 16760 string 0gawa ABC 3d model 1677 1678# VRML (Virtual Reality Modelling Language) 16790 string/w #VRML\ V1.0\ ascii VRML 1 file 1680!:mime model/vrml 16810 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1682!:mime model/vrml 1683 1684# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd] 1685# From Michel Briand <michelbriand@free.fr> 1686# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml 1687# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 16880 string/w \<?xml\ version= 1689!:strength + 5 1690>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1691!:mime model/x3d+xml 1692 1693#--------------------------------------------------------------------------- 1694# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1695# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1696# 16970 string HVQM4 %s 1698>6 string >\0 v%s 1699>0 byte x GameCube movie, 1700>0x34 ubeshort x %d x 1701>0x36 ubeshort x %d, 1702>0x26 ubeshort x %dus, 1703>0x42 ubeshort 0 no audio 1704>0x42 ubeshort >0 %dHz audio 1705 1706# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org> 1707# Update: Joerg Jenderek 1708# URL: https://en.wikipedia.org/wiki/VOB 17090 string DVDVIDEO-VTS Video title set, 1710!:mime video/x-ifo 1711!:ext ifo/bup 1712>0x21 byte x v%x 17130 string DVDVIDEO-VMG Video manager, 1714!:mime video/x-ifo 1715!:ext ifo/bup 1716>0x21 byte x v%x 1717 1718# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org> 17190 string xMovieSetter MovieSetter movie 17200 string xSceneEditor MovieSetter movie 1721 1722# From: Behan Webster <behanw@websterwood.com> 1723# NuppelVideo used by Mythtv (*.nuv) 1724# Note: there are two identical stanzas here differing only in the 1725# initial string matched. It used to be done with a regex, but we're 1726# trying to get rid of those. 17270 string NuppelVideo MythTV NuppelVideo 1728>12 string x v%s 1729>20 lelong x (%d 1730>24 lelong x \bx%d), 1731>36 string P \bprogressive, 1732>36 string I \binterlaced, 1733>40 ledouble x \baspect:%.2f, 1734>48 ledouble x \bfps:%.2f 17350 string MythTV MythTV NuppelVideo 1736>12 string x v%s 1737>20 lelong x (%d 1738>24 lelong x \bx%d), 1739>36 string P \bprogressive, 1740>36 string I \binterlaced, 1741>40 ledouble x \baspect:%.2f, 1742>48 ledouble x \bfps:%.2f 1743 1744# MPEG file 1745# MPEG sequences 1746# FIXME: This section is from the old magic.mime file and needs 1747# integrating with the rest 1748#0 belong 0x000001BA 1749#>4 byte &0x40 1750#!:mime video/mp2p 1751#>4 byte ^0x40 1752#!:mime video/mpeg 1753#0 belong 0x000001BB 1754#!:mime video/mpeg 1755#0 belong 0x000001B0 1756#!:mime video/mp4v-es 1757#0 belong 0x000001B5 1758#!:mime video/mp4v-es 1759#0 belong 0x000001B3 1760#!:mime video/mpv 1761#0 belong&0xFF5FFF10 0x47400010 1762#!:mime video/mp2t 1763#0 belong 0x00000001 1764#>4 byte&0x1F 0x07 1765#!:mime video/h264 1766 1767# Type: Bink Video 1768# Extension: .bik 1769# URL: https://wiki.multimedia.cx/index.php?title=Bink_Container 1770# From: <hoehle@users.sourceforge.net> 2008-07-18 17710 name bik 1772#>4 ulelong x size %d 1773>20 ulelong x \b, %d 1774>24 ulelong x \bx%d 1775>8 ulelong x \b, %d frames 1776>32 ulelong x at rate %d/ 1777>28 ulelong >1 \b%d 1778>40 ulelong =0 \b, no audio 1779>40 ulelong !0 \b, %d audio track 1780>>40 ulelong !1 \bs 1781# follow properties of the first audio track only 1782>>48 uleshort x %dHz 1783>>51 byte&0x20 0 mono 1784>>51 byte&0x20 !0 stereo 1785#>>51 byte&0x10 0 FFT 1786#>>51 byte&0x10 !0 DCT 1787 17880 string BIK 1789>3 regex =[bdfghi] Bink Video rev.%s 1790>>0 use bik 1791 17920 string KB2 1793>3 regex =[adfghi] Bink Video 2 rev.%s 1794>>0 use bik 1795 1796# Type: NUT Container 1797# URL: https://wiki.multimedia.cx/index.php?title=NUT 1798# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17990 string nut/multimedia\ container\0 NUT multimedia container 1800 1801# Type: Nullsoft Video (NSV) 1802# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1803# From: Mike Melanson <mike@multimedia.cx> 18040 string NSVf Nullsoft Video 1805 1806# Type: REDCode Video 1807# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode 1808# From: Mike Melanson <mike@multimedia.cx> 18094 string RED1 REDCode Video 1810 1811# Type: MTV Multimedia File 1812# URL: https://wiki.multimedia.cx/index.php?title=MTV 1813# From: Mike Melanson <mike@multimedia.cx> 18140 string AMVS MTV Multimedia File 1815 1816# Type: ARMovie 1817# URL: https://wiki.multimedia.cx/index.php?title=ARMovie 1818# From: Mike Melanson <mike@multimedia.cx> 18190 string ARMovie\012 ARMovie 1820 1821# Type: Interplay MVE Movie 1822# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE 1823# From: Mike Melanson <mike@multimedia.cx> 18240 string Interplay\040MVE\040File\032 Interplay MVE Movie 1825 1826# Type: Windows Television DVR File 1827# URL: https://wiki.multimedia.cx/index.php?title=WTV 1828# From: Mike Melanson <mike@mutlimedia.cx> 1829# This takes the form of a Windows-style GUID 18300 bequad 0xB7D800203749DA11 1831>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1832 1833# Type: Sega FILM/CPK Multimedia 1834# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM 1835# From: Mike Melanson <mike@multimedia.cx> 18360 string FILM Sega FILM/CPK Multimedia, 1837>32 belong x %d x 1838>28 belong x %d 1839 1840# Type: Nintendo THP Multimedia 1841# URL: https://wiki.multimedia.cx/index.php?title=THP 1842# From: Mike Melanson <mike@multimedia.cx> 18430 string THP\0 Nintendo THP Multimedia 1844 1845# Type: BBC Dirac Video 1846# URL: https://wiki.multimedia.cx/index.php?title=Dirac 1847# From: Mike Melanson <mike@multimedia.cx> 18480 string BBCD BBC Dirac Video 1849 1850# Type: RAD Game Tools Smacker Multimedia 1851# URL: https://wiki.multimedia.cx/index.php?title=Smacker 1852# From: Mike Melanson <mike@multimedia.cx> 18530 string SMK RAD Game Tools Smacker Multimedia 1854>3 byte x version %c, 1855>4 lelong x %d x 1856>8 lelong x %d, 1857>12 lelong x %d frames 1858 1859# Material Exchange Format 1860# More information: 1861# https://en.wikipedia.org/wiki/Material_Exchange_Format 1862# http://www.freemxf.org/ 18630 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format 1864!:ext mxf 1865!:mime application/mxf 1866 1867# Recognize LucasArts Smush video files (cf. 1868# https://wiki.multimedia.cx/index.php/Smush) 18690 string ANIM 1870>8 string AHDR LucasArts Smush Animation Format (SAN) video 18710 string SANM 1872>8 string SHDR LucasArts Smush v2 (SANM) video 1873 1874# Type: Scaleform video 1875# Extension: .usm 1876# URL: https://wiki.multimedia.cx/index.php/USM 1877# From: David Korth <gerbilsoft@gerbilsoft.com> 18780 string CRID 1879>32 string @UTF Scaleform video 1880 1881# http://www.jerrysguide.com/tips/demystify-tvs-file-format.html 18820 string TVS\015\012 1883>&0 string Version\040 TeamViewer Session File 1884>>&0 string x \b, version %s 1885 1886#------------------------------------------------------------------------------ 1887# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1888# aout: file(1) magic for a.out executable/object/etc entries that 1889# handle executables on multiple platforms. 1890# 1891 1892# 1893# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1894# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1895# 1896# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1897# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1898# works only for binaries using shared libraries. Grabbing the entry 1899# point from the a.out header, using it to find the first code executed 1900# in the program, and looking at that might help. 1901# 19020 lelong 0407 a.out little-endian 32-bit executable 1903>16 lelong >0 not stripped 1904>32 byte 0x6a (uses BSD/OS shared libs) 1905 19060 lelong 0410 a.out little-endian 32-bit pure executable 1907>16 lelong >0 not stripped 1908>32 byte 0x6a (uses BSD/OS shared libs) 1909 19100 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1911>16 lelong >0 not stripped 1912>32 byte 0x6a (uses BSD/OS shared libs) 1913 1914# 1915# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1916# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1917# 1918# XXX - is there anything we can look at to distinguish old SunOS 68010 1919# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1920# the first instruction or instructions in the program. 1921# 19220 belong 0407 a.out big-endian 32-bit executable 1923>16 belong >0 not stripped 1924 19250 belong 0410 a.out big-endian 32-bit pure executable 1926>16 belong >0 not stripped 1927 19280 belong 0413 a.out big-endian 32-bit demand paged executable 1929>16 belong >0 not stripped 1930 1931 1932#------------------------------------------------------------------------------ 1933# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $ 1934# apache: file(1) magic for Apache Big Data formats 1935 1936# Avro files 19370 string Obj Apache Avro 1938>3 byte x version %d 1939 1940# ORC files 1941# Important information is in file footer, which we can't index to :( 19420 string ORC Apache ORC 1943 1944# Parquet files 19450 string PAR1 Apache Parquet 1946 1947# Hive RC files 19480 string RCF Apache Hive RC file 1949>3 byte x version %d 1950 1951# Sequence files (and the careless first version of RC file) 1952 19530 string SEQ 1954>3 byte <6 Apache Hadoop Sequence file version %d 1955>3 byte >6 Apache Hadoop Sequence file version %d 1956>3 byte =6 1957>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0 1958>>3 default x Apache Hadoop Sequence file version 6 1959 1960#------------------------------------------------------------------------------ 1961# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1962# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1963# workspaces) 1964# 19650 long 0100554 APL workspace (Ken's original?) 1966 1967#------------------------------------------------------------------------------ 1968# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ 1969# apple: file(1) magic for Apple file formats 1970# 19710 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 19720 string \x0aGL Binary II (apple ][) data 19730 string \x76\xff Squeezed (apple ][) data 19740 string NuFile NuFile archive (apple ][) data 19750 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 19760 belong 0x00051600 AppleSingle encoded Macintosh file 19770 belong 0x00051607 AppleDouble encoded Macintosh file 1978 1979# Type: Apple Emulator WOZ format 1980# From: Greg Wildman <greg@apple2.org.za> 1981# Ref: https://applesaucefdc.com/woz/reference/ 1982# Ref: https://applesaucefdc.com/woz/reference2/ 1983# 1984# Note: The following test are mostly identical. I would rather not 1985# use a regex to identify the WOZ format number. 19860 string WOZ1 1987>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image 1988>12 string INFO 1989>>21 byte 01 \b, 5.25 inch 1990>>21 byte 02 \b, 3.5 inch 1991>>22 byte 01 \b, write protected 1992>>23 byte 01 \b, cross track synchronized 1993>>25 string/T x \b, %.32s 19940 string WOZ2 1995>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image 1996>12 string INFO 1997>>21 byte 01 \b, 5.25 inch 1998>>21 byte 02 \b, 3.5 inch 1999>>22 byte 01 \b, write protected 2000>>23 byte 01 \b, cross track synchronized 2001>>25 string/T x \b, %.32s 2002 2003# Type: Apple Emulator disk images 2004# From: Greg Wildman <greg@apple2.org.za> 2005# ProDOS boot loader? 20060 string \x01\x38\xB0\x03\x4C Apple ProDOS Image 2007# Detect Volume Directory block ($02) 2008>0x400 string \x00\x00\x03\x00 2009>>0x404 byte &0xF0 2010>>>0x405 string x \b, Volume /%s 2011>>>0x429 leshort x \b, %u Blocks 2012# ProDOS ordered ? 2013>0xb00 string \x00\x00\x03\x00 2014>>0xb04 byte &0xF0 2015>>>0xb05 string x \b, Volume /%s 2016>>>0xb29 leshort x \b, %u Blocks 2017# 2018# DOS3.3 boot loader? 20190 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B 2020>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image 2021>>0x11006 byte x \b, Volume %u 2022>>0x11034 byte x \b, %u Tracks 2023>>0x11035 byte x \b, %u Sectors 2024>>0x11036 leshort x \b, %u bytes per sector 2025# DOS3.2 ? 2026>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image 2027>>0x11006 byte x \b, Volume %u 2028>>0x11034 byte x \b, %u Tracks 2029>>0x11035 byte x \b, %u Sectors 2030>>0x11036 leshort x \b, %u bytes per sector 2031# DOS3.1 ? 2032>0x11001 string \x11\x0C\x01 2033>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image 2034# 2035# Pascal boot loader? 20360 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD 2037>0xd6 pstring SYSTEM.APPLE 2038>>0xb00 leshort 0x0000 2039>>>0xb04 leshort 0x0000 Apple Pascal Image 2040>>>>0xb06 pstring x \b, Volume %s: 2041>>>>0xb0e leshort x \b, %u Blocks 2042>>>>0xb10 leshort x \b, %u Files 2043# 2044# Diversi Dos boot loader? 20450 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD 2046>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image 2047>>0x11006 byte x \b, Volume %u 2048>>0x11034 byte x \b, %u Tracks 2049>>0x11035 byte x \b, %u Sectors 2050>>0x11036 leshort x \b, %u bytes per sector 2051 2052# Type: Apple Emulator 2IMG format 2053# From: Radek Vokal <rvokal@redhat.com> 2054# Update: Greg Wildman <greg@apple2.org.za> 20550 string 2IMG Apple ][ 2IMG Disk Image 2056>4 clear x 2057>4 string XGS! \b, XGS 2058>4 string CTKG \b, Catakig 2059>4 string ShIm \b, Sheppy's ImageMaker 2060>4 string SHEP \b, Sheppy's ImageMaker 2061>4 string WOOF \b, Sweet 16 2062>4 string B2TR \b, Bernie ][ the Rescue 2063>4 string \!nfc \b, ASIMOV2 2064>4 string \>BD\< \b, Brutal Deluxe's Cadius 2065>4 string CdrP \b, CiderPress 2066>4 string Vi][ \b, Virtual ][ 2067>4 string PRFS \b, ProFUSE 2068>4 string FISH \b, FishWings 2069>4 string RVLW \b, Revival for Windows 2070>4 default x 2071>>4 string x \b, Creator tag "%-4.4s" 2072>0xc byte 00 \b, DOS 3.3 sector order 2073>>0x10 byte 00 \b, Volume 254 2074>>0x10 byte&0x7f x \b, Volume %u 2075>0xc byte 01 \b, ProDOS sector order 2076# Detect Volume Directory block ($02) + 2mg header offset 2077>>0x440 string \x00\x00\x03\x00 2078>>>0x444 byte &0xF0 2079>>>>0x445 string x \b, Volume /%s 2080>>>>0x469 leshort x \b, %u Blocks 2081>0xc byte 02 \b, NIB data 2082 2083# magic for Newton PDA package formats 2084# from Ruda Moura <ruda@helllabs.org> 20850 string package0 Newton package, NOS 1.x, 2086>12 belong &0x80000000 AutoRemove, 2087>12 belong &0x40000000 CopyProtect, 2088>12 belong &0x10000000 NoCompression, 2089>12 belong &0x04000000 Relocation, 2090>12 belong &0x02000000 UseFasterCompression, 2091>16 belong x version %d 2092 20930 string package1 Newton package, NOS 2.x, 2094>12 belong &0x80000000 AutoRemove, 2095>12 belong &0x40000000 CopyProtect, 2096>12 belong &0x10000000 NoCompression, 2097>12 belong &0x04000000 Relocation, 2098>12 belong &0x02000000 UseFasterCompression, 2099>16 belong x version %d 2100 21010 string package4 Newton package, 2102>8 byte 8 NOS 1.x, 2103>8 byte 9 NOS 2.x, 2104>12 belong &0x80000000 AutoRemove, 2105>12 belong &0x40000000 CopyProtect, 2106>12 belong &0x10000000 NoCompression, 2107 2108# The following entries for the Apple II are for files that have 2109# been transferred as raw binary data from an Apple, without having 2110# been encapsulated by any of the above archivers. 2111# 2112# In general, Apple II formats are hard to identify because Apple DOS 2113# and especially Apple ProDOS have strong typing in the file system and 2114# therefore programmers never felt much need to include type information 2115# in the files themselves. 2116# 2117# Eric Fischer <enf@pobox.com> 2118 2119# AppleWorks word processor: 2120# URL: https://en.wikipedia.org/wiki/AppleWorks 2121# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 2122# Update: Joerg Jenderek 2123# NOTE: 2124# The "O" is really the magic number, but that's so common that it's 2125# necessary to check the tab stops that follow it to avoid false positives. 2126# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 2127# the newer AppleWorks is from claris with extension CWK 21284 string O 2129# test for unused bits of zoom- , paginated-boolean bytes 2130>84 ubequad ^0x00Fe00000000Fe00 2131# look for tabstop definitions "=" no tab, "|" no tab 2132# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 2133# unofficial "!" other , "\x8a" other 2134# official only if SFMinVers is nonzero 2135>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 2136# AppleWorks Word Processor File (Apple II) 2137# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 2138# application/x-appleworks is mime type for claris version with cwk extension 2139!:mime application/x-appleworks3 2140# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 2141# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 2142# $70 $1A $F8 $FF is this the apple type ? 2143#:apple pdosp^Z\xf8\xff 2144!:ext awp 2145# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 2146>>>183 ubyte 30 3.0 2147>>>183 ubyte !30 2148>>>>183 ubyte !0 0x%x 2149# usual tabstop start sequence "=====<" 2150>>>5 string x \b, tabstop ruler "%6.6s" 2151# tabstop ruler 2152#>>>5 string >\0 \b, tabstops "%-79s" 2153# zoom switch 2154>>>85 byte&0x01 >0 \b, zoomed 2155# whether paginated 2156>>>90 byte&0x01 >0 \b, paginated 2157# contains any mail-merge commands 2158>>>92 byte&0x01 >0 \b, with mail merge 2159# left margin in 1/10 inches ( normally 0 or 10 ) 2160>>>91 ubyte >0 2161>>>>91 ubyte x \b, %d/10 inch left margin 2162 2163# AppleWorks database: 2164# 2165# This isn't really a magic number, but it's the closest thing to one 2166# that I could find. The 1 and 2 really mean "order in which you defined 2167# categories" and "left to right, top to bottom," respectively; the D and R 2168# mean that the cursor should move either down or right when you press Return. 2169 2170#30 string \x01D AppleWorks database data 2171#30 string \x02D AppleWorks database data 2172#30 string \x01R AppleWorks database data 2173#30 string \x02R AppleWorks database data 2174 2175# AppleWorks spreadsheet: 2176# 2177# Likewise, this isn't really meant as a magic number. The R or C means 2178# row- or column-order recalculation; the A or M means automatic or manual 2179# recalculation. 2180 2181#131 string RA AppleWorks spreadsheet data 2182#131 string RM AppleWorks spreadsheet data 2183#131 string CA AppleWorks spreadsheet data 2184#131 string CM AppleWorks spreadsheet data 2185 2186# Applesoft BASIC: 2187# 2188# This is incredibly sloppy, but will be true if the program was 2189# written at its usual memory location of 2048 and its first line 2190# number is less than 256. Yuck. 2191# update by Joerg Jenderek at Feb 2013 2192 2193# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 2194#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 21950 belong&0x00ff00ff 0x00080000 2196# assuming that line number must be positive 2197>2 leshort >0 Applesoft BASIC program data, first line number %d 2198#>2 leshort x \b, first line number %d 2199 2200# ORCA/EZ assembler: 2201# 2202# This will not identify ORCA/M source files, since those have 2203# some sort of date code instead of the two zero bytes at 6 and 7 2204# XXX Conflicts with ELF 2205#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 2206#>5 byte x \b, build number %d 2207 2208# Broderbund Fantavision 2209# 2210# I don't know what these values really mean, but they seem to recur. 2211# Will they cause too many conflicts? 2212 2213# Probably :-) 2214#2 belong&0xFF00FF 0x040008 Fantavision movie data 2215 2216# Some attempts at images. 2217# 2218# These are actually just bit-for-bit dumps of the frame buffer, so 2219# there's really no reasonably way to distinguish them except for their 2220# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 2221# or, occasionally, 8184. 2222# 2223# Nevertheless this will manage to catch a lot of images that happen 2224# to have a solid-colored line at the bottom of the screen. 2225 2226# GRR: Magic too weak 2227#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 2228#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 2229#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 2230#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 2231#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 2232 2233# Beagle Bros. Apple Mechanic fonts 2234 22350 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 2236 2237# Apple Universal Disk Image Format (UDIF) - dmg files. 2238# From Johan Gade. 2239# These entries are disabled for now until we fix the following issues. 2240# 2241# Note there might be some problems with the "VAX COFF executable" 2242# entry. Note this entry should be placed before the mac filesystem section, 2243# particularly the "Apple Partition data" entry. 2244# 2245# The intended meaning of these tests is, that the file is only of the 2246# specified type if both of the lines are correct - i.e. if the first 2247# line matches and the second doesn't then it is not of that type. 2248# 2249#0 long 0x7801730d 2250#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 2251# 2252# Note that this entry is recognized correctly by the "Apple Partition 2253# data" entry - however since this entry is more specific - this 2254# information seems to be more useful. 2255#0 long 0x45520200 2256#>0x410 string disk\ image UDIF read/write image (UDRW) 2257 2258# From: Toby Peterson <toby@apple.com> 22590 string bplist00 Apple binary property list 2260 2261# Apple binary property list (bplist) 2262# Assumes version bytes are hex. 2263# Provides content hints for version 0 files. Assumes that the root 2264# object is the first object (true for CoreFoundation implementation). 2265# From: David Remahl <dremahl@apple.com> 22660 string bplist 2267>6 byte x \bCoreFoundation binary property list data, version 0x%c 2268>>7 byte x \b%c 2269>6 string 00 \b 2270>>8 byte&0xF0 0x00 \b 2271>>>8 byte&0x0F 0x00 \b, root type: null 2272>>>8 byte&0x0F 0x08 \b, root type: false boolean 2273>>>8 byte&0x0F 0x09 \b, root type: true boolean 2274>>8 byte&0xF0 0x10 \b, root type: integer 2275>>8 byte&0xF0 0x20 \b, root type: real 2276>>8 byte&0xF0 0x30 \b, root type: date 2277>>8 byte&0xF0 0x40 \b, root type: data 2278>>8 byte&0xF0 0x50 \b, root type: ascii string 2279>>8 byte&0xF0 0x60 \b, root type: unicode string 2280>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 2281>>8 byte&0xF0 0xa0 \b, root type: array 2282>>8 byte&0xF0 0xd0 \b, root type: dictionary 2283 2284# Apple/NeXT typedstream data 2285# Serialization format used by NeXT and Apple for various 2286# purposes in YellowStep/Cocoa, including some nib files. 2287# From: David Remahl <dremahl@apple.com> 22882 string typedstream NeXT/Apple typedstream data, big endian 2289>0 byte x \b, version %d 2290>0 byte <5 \b 2291>>13 byte 0x81 \b 2292>>>14 ubeshort x \b, system %d 22932 string streamtyped NeXT/Apple typedstream data, little endian 2294>0 byte x \b, version %d 2295>0 byte <5 \b 2296>>13 byte 0x81 \b 2297>>>14 uleshort x \b, system %d 2298 2299#------------------------------------------------------------------------------ 2300# CAF: Apple CoreAudio File Format 2301# 2302# Container format for high-end audio purposes. 2303# From: David Remahl <dremahl@apple.com> 2304# 23050 string caff CoreAudio Format audio file 2306>4 beshort <10 version %d 2307>6 beshort x 2308 2309 2310#------------------------------------------------------------------------------ 2311# Keychain database files 23120 string kych Mac OS X Keychain File 2313 2314#------------------------------------------------------------------------------ 2315# Code Signing related file types 23160 belong 0xfade0c00 Mac OS X Code Requirement 2317>8 belong 1 (opExpr) 2318>4 belong x - %d bytes 2319 23200 belong 0xfade0c01 Mac OS X Code Requirement Set 2321>8 belong >1 containing %d items 2322>4 belong x - %d bytes 2323 23240 belong 0xfade0c02 Mac OS X Code Directory 2325>8 belong x version %x 2326>12 belong >0 flags 0x%x 2327>4 belong x - %d bytes 2328 23290 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 2330>4 belong x - %d bytes 2331 23320 belong 0xfade0cc1 Mac OS X Detached Code Signature 2333>8 belong >1 (%d elements) 2334>4 belong x - %d bytes 2335 2336# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2337# .vdi 23384 string innotek\ VirtualBox\ Disk\ Image %s 2339 2340# Apple disk partition stuff 2341# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2342# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 2343# Update: Joerg Jenderek 2344# "ER" is APPLE_DRVR_MAP_MAGIC signature 23450 beshort 0x4552 2346# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 2347#!:strength +0 2348# strengthen the magic by looking for used blocksizes 512 2048 2349>2 ubeshort&0xf1FF 0 Apple Driver Map 2350# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 2351#>>504 ubequad&0x0000FFffFFff0000 0 2352!:mime application/x-apple-diskimage 2353!:apple ????devr 2354# https://en.wikipedia.org/wiki/Apple_Disk_Image 2355!:ext dmg/iso 2356# sbBlkSize for driver descriptor map 512 2048 2357>>2 beshort x \b, blocksize %d 2358# sbBlkCount sometimes garbish like 2359# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 2360# 0xf2720100 for bunziped Firefox 48.0-2.dmg 2361# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 2362# 0x00009090 by syslinux-6.03/utils/isohybrid.c 2363>>4 ubelong x \b, blockcount %u 2364# following device/driver information not very useful 2365# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2366>>8 ubeshort x \b, devtype %u 2367# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2368>>10 ubeshort x \b, devid %u 2369# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2370>>12 ubelong >0 2371>>>12 ubelong x \b, driver data %u 2372# number of driver descriptors sbDrvrCount <= 61 2373# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2374>>16 ubeshort x \b, driver count %u 2375# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 2376# >>18 use apple-driver-map 2377# >>26 use apple-driver-map 2378# # ... 2379# >>500 use apple-driver-map 2380# number of partitions is always same in every partition (map block count) 2381#>>0x0204 ubelong x \b, %u partitions 2382>>0x0204 ubelong >0 \b, contains[@0x200]: 2383>>>0x0200 use apple-apm 2384>>0x0204 ubelong >1 \b, contains[@0x400]: 2385>>>0x0400 use apple-apm 2386>>0x0204 ubelong >2 \b, contains[@0x600]: 2387>>>0x0600 use apple-apm 2388>>0x0204 ubelong >3 \b, contains[@0x800]: 2389>>>0x0800 use apple-apm 2390>>0x0204 ubelong >4 \b, contains[@0xA00]: 2391>>>0x0A00 use apple-apm 2392>>0x0204 ubelong >5 \b, contains[@0xC00]: 2393>>>0x0C00 use apple-apm 2394>>0x0204 ubelong >6 \b, contains[@0xE00]: 2395>>>0x0E00 use apple-apm 2396>>0x0204 ubelong >7 \b, contains[@0x1000]: 2397>>>0x1000 use apple-apm 2398# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 23990 name apple-driver-map 2400>0 ubequad !0 2401# descBlock first block of driver 2402>>0 ubelong x \b, driver start block %u 2403# descSize driver size in blocks 2404>>4 ubeshort x \b, size %u 2405# descType driver system type 1 701h F8FFh FFFFh 2406>>6 ubeshort x \b, type 0x%x 2407 2408# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2409# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 2410# Update: Joerg Jenderek 2411# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 2412# magic stronger. 2413# for apple partition map stored as a single file 24140 belong 0x504d0000 2415# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 2416#!:strength +0 2417>0 use apple-apm 2418# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 2419# file: could not find any valid magic files! 2420#!:ext bin 2421# display apple partition map. Normally called after Apple driver map 24220 name apple-apm 2423>0 belong 0x504d0000 Apple Partition Map 2424# number of partitions 2425>>4 ubelong x \b, map block count %u 2426# logical block (512 bytes) start of partition 2427>>8 ubelong x \b, start block %u 2428>>12 ubelong x \b, block count %u 2429>>16 string >0 \b, name %s 2430>>48 string >0 \b, type %s 2431# processor type dpme_process_id[16] e.g. "68000" "68020" 2432>>120 string >0 \b, processor %s 2433# A/UX boot arguments BootArgs[128] 2434>>136 string >0 \b, boot arguments %s 2435# status of partition dpme_flags 2436>>88 belong & 1 \b, valid 2437>>88 belong & 2 \b, allocated 2438>>88 belong & 4 \b, in use 2439>>88 belong & 8 \b, has boot info 2440>>88 belong & 16 \b, readable 2441>>88 belong & 32 \b, writable 2442>>88 belong & 64 \b, pic boot code 2443>>88 belong & 128 \b, chain compatible driver 2444>>88 belong & 256 \b, real driver 2445>>88 belong & 512 \b, chain driver 2446# mount automatically at startup APPLE_PS_AUTO_MOUNT 2447>>88 ubelong &0x40000000 \b, mount at startup 2448# is the startup partition APPLE_PS_STARTUP 2449>>88 ubelong &0x80000000 \b, is the startup partition 2450 2451#https://wiki.mozilla.org/DS_Store_File_Format 2452#https://en.wikipedia.org/wiki/.DS_Store 24530 string \0\0\0\1Bud1\0 Apple Desktop Services Store 2454 2455# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 2456# Usually not in separate files, but have either filename rsrc with 2457# no extension, or a filename corresponding to another file, with 2458# extensions rsr/rsrc 24590 string \000\000\001\000 2460>4 leshort 0 2461>>16 lelong 0 Apple HFS/HFS+ resource fork 2462 2463#https://en.wikipedia.org/wiki/AppleScript 24640 string FasdUAS AppleScript compiled 2465 2466# AppleWorks/ClarisWorks 2467# https://github.com/joshenders/appleworks_format 2468# http://fileformats.archiveteam.org/wiki/AppleWorks 24690 name appleworks 2470>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 2471>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 2472>0 default x 2473>>0 belong x AppleWorks/ClarisWorks CWK Document 2474>0 byte x \b, version %d 2475>30 beshort x \b, %d 2476>32 beshort x \bx%d 2477!:ext cwk 2478 24794 string BOBO 2480>0 byte >4 2481>>12 belong 0 2482>>>26 belong 0 2483>>>>0 use appleworks 2484>0 belong 0x0481ad00 2485>>0 use appleworks 2486 2487# magic for Apple File System (APFS) 2488# from Alex Myczko <alex@aiei.ch> 248932 string NXSB Apple File System (APFS) 2490>36 ulelong x \b, blocksize %u 2491 2492# iTunes cover art (versions 1 and 2) 24934 string itch 2494>24 string artw 2495>>0x1e8 string data iTunes cover art 2496>>>0x1ed string PNG (PNG) 2497>>>0x1ec beshort 0xffd8 (JPEG) 2498 2499# MacPaint image 250065 string PNTGMPNT MacPaint image data 2501#0 belong 2 MacPaint image data 2502 2503#------------------------------------------------------------------------------ 2504# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $ 2505# application: file(1) magic for applications on small devices 2506# 2507# Pebble Application 25080 string PBLAPP\000\000 Pebble application 2509 2510#------------------------------------------------------------------------------ 2511# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2512# applix: file(1) magic for Applixware 2513# From: Peter Soos <sp@osb.hu> 2514# 25150 string *BEGIN Applixware 2516>7 string WORDS Words Document 2517>7 string GRAPHICS Graphic 2518>7 string RASTER Bitmap 2519>7 string SPREADSHEETS Spreadsheet 2520>7 string MACRO Macro 2521>7 string BUILDER Builder Object 2522 2523#------------------------------------------------------------------------------ 2524# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $ 2525# apt: file(1) magic for APT Cache files 2526# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html> 2527# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292> 2528 2529# before version 10 ("old format"), data was in arch-specific long/short 2530 2531# old format 64 bit 25320 name apt-cache-64bit-be 2533>12 beshort 1 \b, dirty 2534>40 bequad x \b, %llu packages 2535>48 bequad x \b, %llu versions 2536 2537# old format 32 bit 25380 name apt-cache-32bit-be 2539>8 beshort 1 \b, dirty 2540>40 belong x \b, %u packages 2541>44 belong x \b, %u versions 2542 2543# new format 25440 name apt-cache-be 2545>6 byte 1 \b, dirty 2546>24 belong x \b, %u packages 2547>28 belong x \b, %u versions 2548 25490 bequad 0x98FE76DC 2550>8 ubeshort <10 APT cache data, version %u 2551>>10 beshort x \b.%u, 64 bit big-endian 2552>>0 use apt-cache-64bit-be 2553 25540 lequad 0x98FE76DC 2555>8 uleshort <10 APT cache data, version %u 2556>>10 leshort x \b.%u, 64 bit little-endian 2557>>0 use \^apt-cache-64bit-be 2558 25590 belong 0x98FE76DC 2560>4 ubeshort <10 APT cache data, version %u 2561>>6 ubeshort x \b.%u, 32 bit big-endian 2562>>0 use apt-cache-32bit-be 2563>4 ubyte >9 APT cache data, version %u 2564>>5 ubyte x \b.%u, big-endian 2565>>0 use apt-cache-be 2566 25670 lelong 0x98FE76DC 2568>4 uleshort <10 APT cache data, version %u 2569>>6 uleshort x \b.%u, 32 bit little-endian 2570>>0 use \^apt-cache-32bit-be 2571>4 ubyte >9 APT cache data, version %u 2572>>5 ubyte x \b.%u, little-endian 2573>>0 use \^apt-cache-be 2574#------------------------------------------------------------------------------ 2575# $File: archive,v 1.145 2021/01/03 20:58:47 christos Exp $ 2576# archive: file(1) magic for archive formats (see also "msdos" for self- 2577# extracting compressed archives) 2578# 2579# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 2580# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 2581 2582# POSIX tar archives 2583# URL: https://en.wikipedia.org/wiki/Tar_(computing) 2584# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 2585# header mainly padded with nul bytes 2586500 quad 0 2587!:strength /2 2588# filename or extended attribute printable strings in range space null til umlaut ue 2589>0 ubeshort >0x1F00 2590>>0 ubeshort <0xFCFD 2591# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 2592# at https://sourceforge.net/projects/s-tar/files/testscripts/ 2593>>>508 ubelong&0x8B9E8DFF 0 2594# nul, space or ascii digit 0-7 at start of mode 2595>>>>100 ubyte&0xC8 =0 2596>>>>>101 ubyte&0xC8 =0 2597# nul, space at end of check sum 2598>>>>>>155 ubyte&0xDF =0 2599# space or ascii digit 0 at start of check sum 2600>>>>>>>148 ubyte&0xEF =0x20 2601>>>>>>>>0 use tar-file 2602# minimal check and then display tar archive information which can also be 2603# embedded inside others like Android Backup, Clam AntiVirus database 26040 name tar-file 2605>257 string !ustar 2606# header padded with nuls 2607>>257 ulong =0 2608# GNU tar version 1.29 with non pax format option without refusing 2609# creates misleading V7 header for Long path, Multi-volume, Volume type 2610>>>156 ubyte 0x4c GNU tar archive 2611!:mime application/x-gtar 2612!:ext tar/gtar 2613>>>156 ubyte 0x4d GNU tar archive 2614!:mime application/x-gtar 2615!:ext tar/gtar 2616>>>156 ubyte 0x56 GNU tar archive 2617!:mime application/x-gtar 2618!:ext tar/gtar 2619>>>156 default x tar archive (V7) 2620!:mime application/x-tar 2621!:ext tar 2622# other stuff in padding 2623# some implementations add new fields to the blank area at the end of the header record 2624# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 2625>>257 ulong !0 tar archive (old) 2626!:mime application/x-tar 2627!:ext tar 2628# magic in newer, GNU, posix variants 2629>257 string =ustar 2630# 2 last char of magic and UStar version because string expression does not work 2631# 2 space characters followed by a null for GNU variant 2632>>261 ubelong =0x72202000 POSIX tar archive (GNU) 2633!:mime application/x-gtar 2634!:ext tar/gtar 2635# UStar version with ASCII "00" 2636>>261 ubelong 0x72003030 POSIX 2637# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 2638>>>156 ubyte 0x67 \b.1-2001 2639>>>156 ubyte 0x78 \b.1-2001 2640>>>156 ubyte x tar archive 2641!:mime application/x-ustar 2642!:ext tar/ustar 2643# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 2644>>261 ubelong 0x72000000 tar archive (ustar) 2645!:mime application/x-ustar 2646!:ext tar/ustar 2647# not seen ustar variant with garbish version 2648>>261 default x tar archive (unknown ustar) 2649!:mime application/x-ustar 2650!:ext tar/ustar 2651# type flag of 1st tar archive member 2652#>156 ubyte x \b, %c-type 2653>156 ubyte x 2654>>156 ubyte 0 \b, file 2655>>156 ubyte 0x30 \b, file 2656>>156 ubyte 0x31 \b, hard link 2657>>156 ubyte 0x32 \b, symlink 2658>>156 ubyte 0x33 \b, char device 2659>>156 ubyte 0x34 \b, block device 2660>>156 ubyte 0x35 \b, directory 2661>>156 ubyte 0x36 \b, fifo 2662>>156 ubyte 0x37 \b, reserved 2663>>156 ubyte 0x4c \b, long path 2664>>156 ubyte 0x4d \b, multi volume 2665>>156 ubyte 0x56 \b, volume 2666>>156 ubyte 0x67 \b, global 2667>>156 ubyte 0x78 \b, extension 2668>>156 default x \b, type 2669>>>156 ubyte x '%c' 2670# name[100] 2671>0 string >\0 %-.60s 2672# mode mainly stored as an octal number in ASCII null or space terminated 2673>100 string >\0 \b, mode %-.7s 2674# user id mainly as octal numbers in ASCII null or space terminated 2675>108 string >\0 \b, uid %-.7s 2676# group id mainly as octal numbers in ASCII null or space terminated 2677>116 string >\0 \b, gid %-.7s 2678# size mainly as octal number in ASCII 2679>124 ubyte <0x38 2680>>124 string >\0 \b, size %-.12s 2681# coding indicated by setting the high-order bit of the leftmost byte 2682>124 ubyte >0xEF \b, size 0x 2683>>124 ubyte !0xff \b%2.2x 2684>>125 ubyte !0xff \b%2.2x 2685>>126 ubyte !0xff \b%2.2x 2686>>127 ubyte !0xff \b%2.2x 2687>>128 ubyte !0xff \b%2.2x 2688>>129 ubyte !0xff \b%2.2x 2689>>130 ubyte !0xff \b%2.2x 2690>>131 ubyte !0xff \b%2.2x 2691>>132 ubyte !0xff \b%2.2x 2692>>133 ubyte !0xff \b%2.2x 2693>>134 ubyte !0xff \b%2.2x 2694>>135 ubyte !0xff \b%2.2x 2695# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 2696>136 string >\0 \b, seconds %-.11s 2697# header checksum stored as an octal number in ASCII null or space terminated 2698#>148 string x \b, cksum %.7s 2699# linkname[100] 2700>157 string >\0 \b, linkname %-.40s 2701# additional fields for ustar 2702>257 string =ustar 2703# owner user name null terminated 2704>>265 string >\0 \b, user %-.32s 2705# group name null terminated 2706>>297 string >\0 \b, group %-.32s 2707# device major minor if not zero 2708>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 2709>>>329 string x \b, devmaj %-.7s 2710>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 2711>>>337 string x \b, devmin %-.7s 2712# prefix[155] 2713>>345 string >\0 \b, prefix %-.155s 2714# old non ustar/POSIX tar 2715>257 string !ustar 2716>>508 string =tar\0 2717# padding[255] in old star 2718>>>257 string >\0 \b, padding: %-.40s 2719>>508 default x 2720# padding[255] in old tar sometimes comment field 2721>>>257 string >\0 \b, comment: %-.40s 2722 2723# Incremental snapshot gnu-tar format from: 2724# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 27250 string GNU\ tar- GNU tar incremental snapshot data 2726>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 2727 2728# cpio archives 2729# 2730# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2731# The idea is to indicate archives produced on machines with the same 2732# byte order as the machine running "file" with "cpio archive", and 2733# to indicate archives produced on machines with the opposite byte order 2734# from the machine running "file" with "byte-swapped cpio archive". 2735# 2736# The SVR4 "cpio(4)" hints that there are additional formats, but they 2737# are defined as "short"s; I think all the new formats are 2738# character-header formats and thus are strings, not numbers. 27390 short 070707 cpio archive 2740!:mime application/x-cpio 27410 short 0143561 byte-swapped cpio archive 2742!:mime application/x-cpio # encoding: swapped 27430 string 070707 ASCII cpio archive (pre-SVR4 or odc) 27440 string 070701 ASCII cpio archive (SVR4 with no CRC) 27450 string 070702 ASCII cpio archive (SVR4 with CRC) 2746 2747# 2748# Various archive formats used by various versions of the "ar" 2749# command. 2750# 2751 2752# 2753# Original UNIX archive formats. 2754# They were written with binary values in host byte order, and 2755# the magic number was a host "int", which might have been 16 bits 2756# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 2757# been ports to little-endian 16-bit-int or 32-bit-int platforms 2758# (x86?) using some of those formats; if none existed, feel free 2759# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 2760# 32-bit. There might have been big-endian ports of that sort as 2761# well. 2762# 27630 leshort 0177555 very old 16-bit-int little-endian archive 27640 beshort 0177555 very old 16-bit-int big-endian archive 27650 lelong 0177555 very old 32-bit-int little-endian archive 27660 belong 0177555 very old 32-bit-int big-endian archive 2767 27680 leshort 0177545 old 16-bit-int little-endian archive 2769>2 string __.SYMDEF random library 27700 beshort 0177545 old 16-bit-int big-endian archive 2771>2 string __.SYMDEF random library 27720 lelong 0177545 old 32-bit-int little-endian archive 2773>4 string __.SYMDEF random library 27740 belong 0177545 old 32-bit-int big-endian archive 2775>4 string __.SYMDEF random library 2776 2777# 2778# From "pdp" (but why a 4-byte quantity?) 2779# 27800 lelong 0x39bed PDP-11 old archive 27810 lelong 0x39bee PDP-11 4.0 archive 2782 2783# 2784# XXX - what flavor of APL used this, and was it a variant of 2785# some ar archive format? It's similar to, but not the same 2786# as, the APL workspace magic numbers in pdp. 2787# 27880 long 0100554 apl workspace 2789 2790# 2791# System V Release 1 portable(?) archive format. 2792# 27930 string =<ar> System V Release 1 ar archive 2794!:mime application/x-archive 2795 2796# 2797# Debian package; it's in the portable archive format, and needs to go 2798# before the entry for regular portable archives, as it's recognized as 2799# a portable archive whose first member has a name beginning with 2800# "debian". 2801# 2802# Update: Joerg Jenderek 2803# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 28040 string =!<arch>\ndebian 2805# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html 2806>14 string -split part of multipart Debian package 2807!:mime application/vnd.debian.binary-package 2808# udeb is used for stripped down deb file 2809!:ext deb/udeb 2810>14 string -binary Debian binary package 2811!:mime application/vnd.debian.binary-package 2812# For ipk packager see also https://en.wikipedia.org/wiki/Opkg 2813!:ext deb/udeb/ipk 2814# This should not happen 2815>14 default x Unknown Debian package 2816# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split 2817>68 string >\0 (format %s) 2818#>68 string !2.0\n 2819#>>68 string x (format %.3s) 2820>68 string =2.0\n 2821# 2nd archive name=control archive name like control.tar.gz or control.tar.xz 2822>>72 string >\0 \b, with %.14s 2823# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} 2824>>0 search/0x93e4f data.tar. \b, data compression 2825# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised 2826# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb 2827>>>&0 string x %.2s 2828# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name 2829>>>&2 ubyte !0x20 2830>>>>&-1 ubyte !0x2f 2831# display 3rd character of file name extension like 2 of bz2 or m of lzma 2832>>>>>&-1 ubyte x \b%c 2833>>>>>>&0 ubyte !0x20 2834>>>>>>>&-1 ubyte !0x2f 2835# display 4th character of file name extension like a of lzma 2836>>>>>>>>&-1 ubyte x \b%c 2837# split debian package case 2838>68 string =2.1\n 2839# dpkg-1.18.25/dpkg-split/info.c 2840# NL terminated ASCII package name like ckermit 2841>>&0 string x \b, %s 2842# NL terminated package version like 302-5.3 2843>>>&1 string x %s 2844# NL terminated MD5 checksum 2845>>>>&1 string x \b, MD5 %s 2846# NL terminated original package length 2847>>>>>&1 string x \b, unsplitted size %s 2848# NL terminated part length 2849>>>>>>&1 string x \b, part length %s 2850# NL terminated package part like n/m 2851>>>>>>>&1 string x \b, part %s 2852# NL terminated package architecture like armhf since dpkg 1.16.1 or later 2853>>>>>>>>&1 string x \b, %s 2854 2855# 2856# MIPS archive; they're in the portable archive format, and need to go 2857# before the entry for regular portable archives, as it's recognized as 2858# a portable archive whose first member has a name beginning with 2859# "__________E". 2860# 28610 string =!<arch>\n__________E MIPS archive 2862!:mime application/x-archive 2863>20 string U with MIPS Ucode members 2864>21 string L with MIPSEL members 2865>21 string B with MIPSEB members 2866>19 string L and an EL hash table 2867>19 string B and an EB hash table 2868>22 string X -- out of date 2869 2870# 2871# BSD/SVR2-and-later portable archive formats. 2872# 2873# Update: Joerg Jenderek 2874# URL: http://fileformats.archiveteam.org/wiki/AR 2875# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ 2876# Note: Mach-O universal binary in ./cafebabe is dependent 2877# TODO: unify current ar archive, MIPS archive, Debian package 2878# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; 2879# *.ar packages from *.a libraries. handle empty archive 28800 string =!<arch>\n current ar archive 2881# print first and possibly second ar_name[16] for debugging purpose 2882#>8 string x \b, 1st "%.16s" 2883#>68 string x \b, 2nd "%.16s" 2884!:mime application/x-archive 2885# a in most case for libraries; lib for Microsoft libraries; ar else cases 2886!:ext a/lib/ar 2887>8 string __.SYMDEF random library 2888# first member with long marked name __.SYMDEF SORTED implies BSD library 2889>68 string __.SYMDEF\ SORTED random library 2890# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf 2891# "archive file" entry moved from ./hp 2892# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture 2893# LST header a_magic 0619h~relocatable library 2894>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 2895>68 belong 0x02100619 - PA-RISC1.1 relocatable library 2896>68 belong 0x02110619 - PA-RISC1.2 relocatable library 2897>68 belong 0x02140619 - PA-RISC2.0 relocatable library 2898#EOF for common ar archives 2899 2900# 2901# "Thin" archive, as can be produced by GNU ar. 2902# 29030 string =!<thin>\n thin archive with 2904>68 belong 0 no symbol entries 2905>68 belong 1 %d symbol entry 2906>68 belong >1 %d symbol entries 2907 29080 search/1 -h- Software Tools format archive text 2909 2910# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 2911# 2912# The first byte is the magic (0x1a), byte 2 is the compression type for 2913# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 2914# filename of the first file (null terminated). Since some types collide 2915# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 2916# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 29170 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 2918!:mime application/x-arc 29190 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 2920!:mime application/x-arc 29210 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 2922!:mime application/x-arc 29230 lelong&0x8080ffff 0x0000031a ARC archive data, packed 2924!:mime application/x-arc 29250 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 2926!:mime application/x-arc 29270 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 2928!:mime application/x-arc 2929# [JW] stuff taken from idarc, obviously ARC successors: 29300 lelong&0x8080ffff 0x00000a1a PAK archive data 2931!:mime application/x-arc 29320 lelong&0x8080ffff 0x0000141a ARC+ archive data 2933!:mime application/x-arc 29340 lelong&0x8080ffff 0x0000481a HYP archive data 2935!:mime application/x-arc 2936 2937# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 2938# I can't create either SPARK or ArcFS archives so I have not tested this stuff 2939# [GRR: the original entries collide with ARC, above; replaced with combined 2940# version (not tested)] 2941#0 byte 0x1a RISC OS archive (spark format) 29420 string \032archive RISC OS archive (ArcFS format) 29430 string Archive\000 RISC OS archive (ArcFS format) 2944 2945# All these were taken from idarc, many could not be verified. Unfortunately, 2946# there were many low-quality sigs, i.e. easy to trigger false positives. 2947# Please notify me of any real-world fishy/ambiguous signatures and I'll try 2948# to get my hands on the actual archiver and see if I find something better. [JW] 2949# probably many can be enhanced by finding some 0-byte or control char near the start 2950 2951# idarc calls this Crush/Uncompressed... *shrug* 29520 string CRUSH Crush archive data 2953# Squeeze It (.sqz) 29540 string HLSQZ Squeeze It archive data 2955# SQWEZ 29560 string SQWEZ SQWEZ archive data 2957# HPack (.hpk) 29580 string HPAK HPack archive data 2959# HAP 29600 string \x91\x33HF HAP archive data 2961# MD/MDCD 29620 string MDmd MDCD archive data 2963# LIM 29640 string LIM\x1a LIM archive data 2965# SAR 29663 string LH5 SAR archive data 2967# BSArc/BS2 29680 string \212\3SB\020\0 BSArc/BS2 archive data 2969# Bethesda Softworks Archive (Oblivion) 29700 string BSA\0 BSArc archive data 2971>4 lelong x version %d 2972# MAR 29732 string =-ah MAR archive data 2974# ACB 2975#0 belong&0x00f800ff 0x00800000 ACB archive data 2976# CPZ 2977# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 2978# JRC 29790 string JRchive JRC archive data 2980# Quantum 29810 string DS\0 Quantum archive data 2982# ReSOF 29830 string PK\3\6 ReSOF archive data 2984# QuArk 29850 string 7\4 QuArk archive data 2986# YAC 298714 string YC YAC archive data 2988# X1 29890 string X1 X1 archive data 29900 string XhDr X1 archive data 2991# CDC Codec (.dqt) 29920 belong&0xffffe000 0x76ff2000 CDC Codec archive data 2993# AMGC 29940 string \xad6" AMGC archive data 2995# NuLIB 29960 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 2997# PakLeo 29980 string LEOLZW PAKLeo archive data 2999# ChArc 30000 string SChF ChArc archive data 3001# PSA 30020 string PSA PSA archive data 3003# CrossePAC 30040 string DSIGDCC CrossePAC archive data 3005# Freeze 30060 string \x1f\x9f\x4a\x10\x0a Freeze archive data 3007# KBoom 30080 string \xc2\xa8MP\xc2\xa8 KBoom archive data 3009# NSQ, must go after CDC Codec 30100 string \x76\xff NSQ archive data 3011# DPA 30120 string Dirk\ Paehl DPA archive data 3013# BA 3014# TODO: idarc says "bytes 0-2 == bytes 3-5" 3015# TTComp 3016# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 3017# Update: Joerg Jenderek 3018# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 30190 string \0\6 3020# look for first keyword of Panorama database *.pan 3021>12 search/261 DESIGN 3022# skip keyword with low entropy 3023>12 default x TTComp archive, binary, 4K dictionary 3024# (version 5.25) labeled the above entry as "TTComp archive data" 3025# From: Joerg Jenderek 3026# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification 3027# reference: http://nulib.com/library/FTN.e00005.htm 30280x52 ubeshort 0x0100 3029# test for disk image size equal or above 400k 3030>0x40 ubelong >409599 3031# test also for disk image size equal or below 1440k to skip 3032# windows7en.mbr UNICODE.DAT 3033>>0x40 ubelong <1474561 3034# To skip Flags$StringJoiner.class with size 00106A61h test also for only 4 disk image sizes 3035# 00064000 for 400k GCR disks 3036# 000c8000 for 800k GCR disks 3037# 000b4000 for 720k MFM disks 3038# 00168000 for 1440k MFM disks 3039>>>0x40 ubelong&0xffE03fFF 0 3040>>>>0 use dc42-floppy 3041# display information of Apple DiskCopy 4.2 floppy image 30420 name dc42-floppy 3043# image pascal name padded with NULs like Microsoft Mail 3044>00 pstring/B x Apple DiskCopy 4.2 image %s 3045#!:mime application/octet-stream 3046!:mime application/x-dc42-floppy-image 3047!:apple dCpydImg 3048!:ext image/dc42 3049# data size in bytes like 409600 3050>0x40 ubelong x \b, %u bytes 3051# for debugging purpose size in hexadecimal 3052#>0x40 ubelong x (0x%8.8x) 3053# tag size in bytes 3054>0x44 ubelong >0 \b, 0x%x tag size 3055# data checksum 3056#>0x48 ubelong x \b, 0x%x checksum 3057# tag checksum 3058#>0x4c ubelong x \b, 0x%x tag checksum 3059# disk encoding 3060>0x50 ubyte 0 \b, GCR CLV ssdd (400k) 3061>0x50 ubyte 1 \b, GCR CLV dsdd (800k) 3062>0x50 ubyte 2 \b, MFM CAV dsdd (720k) 3063>0x50 ubyte 3 \b, MFM CAV dshd (1440k) 3064>0x50 ubyte >3 \b, 0x%x encoding 3065# format byte 3066>0x51 ubyte x \b, 0x%x format 3067#>0x54 ubequad x \b, data 0x%16.16llx 3068# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 30690 string ESP ESP archive data 3070# ZPack 30710 string \1ZPK\1 ZPack archive data 3072# Sky 30730 string \xbc\x40 Sky archive data 3074# UFA 30750 string UFA UFA archive data 3076# Dry 30770 string =-H2O DRY archive data 3078# FoxSQZ 30790 string FOXSQZ FoxSQZ archive data 3080# AR7 30810 string ,AR7 AR7 archive data 3082# PPMZ 30830 string PPMZ PPMZ archive data 3084# MS Compress 3085# Update: Joerg Jenderek 3086# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 3087# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 3088# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 30894 string \x88\xf0\x27 3090# KWAJ variant 3091>0 string KWAJ MS Compress archive data, KWAJ variant 3092!:mime application/x-ms-compress-kwaj 3093# extension not working in version 5.32 3094# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 3095# file: line 284: Bad magic entry ' ??_' 3096!:ext ??_ 3097# compression method (0-4) 3098>>8 uleshort x \b, %u method 3099# offset of compressed data 3100>>10 uleshort x \b, 0x%x offset 3101#>>(10.s) uleshort x 3102#>>>&-6 string x \b, TEST extension %-.3s 3103# header flags to mark header extensions 3104>>12 uleshort >0 \b, 0x%x flags 3105# 4 bytes: decompressed length of file 3106>>12 uleshort &0x01 3107>>>14 ulelong x \b, original size: %u bytes 3108# 2 bytes: unknown purpose 3109# 2 bytes: length of unknown data + mentioned bytes 3110# 1-9 bytes: null-terminated file name 3111# 1-4 bytes: null-terminated file extension 3112>>12 uleshort &0x08 3113>>>12 uleshort ^0x01 3114>>>>12 uleshort ^0x02 3115>>>>>12 uleshort ^0x04 3116>>>>>>12 uleshort ^0x10 3117>>>>>>>14 string x \b, %-.8s 3118>>>>>>12 uleshort &0x10 3119>>>>>>>14 string x \b, %-.8s 3120>>>>>>>>&1 string x \b.%-.3s 3121>>>>>12 uleshort &0x04 3122>>>>>>12 uleshort ^0x10 3123>>>>>>>(14.s) uleshort x 3124>>>>>>>>&14 string x \b, %-.8s 3125>>>>>>12 uleshort &0x10 3126>>>>>>>(14.s) uleshort x 3127>>>>>>>>&14 string x \b, %-.8s 3128>>>>>>>>>&1 string x \b.%-.3s 3129>>>>12 uleshort &0x02 3130>>>>>12 uleshort ^0x04 3131>>>>>>12 uleshort ^0x10 3132>>>>>>>16 string x \b, %-.8s 3133>>>>>>12 uleshort &0x10 3134>>>>>>>16 string x \b, %-.8s 3135>>>>>>>>&1 string x \b.%-.3s 3136>>>>>12 uleshort &0x04 3137>>>>>>12 uleshort ^0x10 3138>>>>>>>(16.s) uleshort x 3139>>>>>>>>&16 string x \b, %-.8s 3140>>>>>>12 uleshort &0x10 3141>>>>>>>(16.s) uleshort x 3142>>>>>>>&16 string x %-.8s 3143>>>>>>>>&1 string x \b.%-.3s 3144>>>12 uleshort &0x01 3145>>>>12 uleshort ^0x02 3146>>>>>12 uleshort ^0x04 3147>>>>>>12 uleshort ^0x10 3148>>>>>>>18 string x \b, %-.8s 3149>>>>>>12 uleshort &0x10 3150>>>>>>>18 string x \b, %-.8s 3151>>>>>>>>&1 string x \b.%-.3s 3152>>>>>12 uleshort &0x04 3153>>>>>>12 uleshort ^0x10 3154>>>>>>>(18.s) uleshort x 3155>>>>>>>>&18 string x \b, %-.8s 3156>>>>>>12 uleshort &0x10 3157>>>>>>>(18.s) uleshort x 3158>>>>>>>>&18 string x \b, %-.8s 3159>>>>>>>>>&1 string x \b.%-.3s 3160>>>>12 uleshort &0x02 3161>>>>>12 uleshort ^0x04 3162>>>>>>12 uleshort ^0x10 3163>>>>>>>20 string x \b, %-.8s 3164>>>>>>12 uleshort &0x10 3165>>>>>>>20 string x \b, %-.8s 3166>>>>>>>>&1 string x \b.%-.3s 3167>>>>>12 uleshort &0x04 3168>>>>>>12 uleshort ^0x10 3169>>>>>>>(20.s) uleshort x 3170>>>>>>>>&20 string x \b, %-.8s 3171>>>>>>12 uleshort &0x10 3172>>>>>>>(20.s) uleshort x 3173>>>>>>>>&20 string x \b, %-.8s 3174>>>>>>>>>&1 string x \b.%-.3s 3175# 2 bytes: length of data + mentioned bytes 3176# 3177# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 3178>0 string SZDD MS Compress archive data, SZDD variant 3179!:mime application/x-ms-compress-szdd 3180!:ext ??_ 3181# The character missing from the end of the filename (0=unknown) 3182>>9 string >\0 \b, %-.1s is last character of original name 3183# https://www.betaarchive.com/forum/viewtopic.php?t=26161 3184# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 3185>>8 string !A \b, %-.1s method 3186>>10 ulelong >0 \b, original size: %u bytes 3187# QBasic SZDD variant 31883 string \x88\xf0\x27 3189>0 string SZ\x20 MS Compress archive data, QBasic variant 3190!:mime application/x-ms-compress-sz 3191!:ext ??$ 3192>>8 ulelong >0 \b, original size: %u bytes 3193 3194# MP3 (archiver, not lossy audio compression) 31950 string MP3\x1a MP3-Archiver archive data 3196# ZET 31970 string OZ\xc3\x9d ZET archive data 3198# TSComp 31990 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 3200# ARQ 32010 string gW\4\1 ARQ archive data 3202# Squash 32033 string OctSqu Squash archive data 3204# Terse 32050 string \5\1\1\0 Terse archive data 3206# PUCrunch 32070 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 3208# UHarc 32090 string UHA UHarc archive data 3210# ABComp 32110 string \2AB ABComp archive data 32120 string \3AB2 ABComp archive data 3213# CMP 32140 string CO\0 CMP archive data 3215# Splint 32160 string \x93\xb9\x06 Splint archive data 3217# InstallShield 32180 string \x13\x5d\x65\x8c InstallShield Z archive Data 3219# Gather 32201 string GTH Gather archive data 3221# BOA 32220 string BOA BOA archive data 3223# RAX 32240 string ULEB\xa RAX archive data 3225# Xtreme 32260 string ULEB\0 Xtreme archive data 3227# Pack Magic 32280 string @\xc3\xa2\1\0 Pack Magic archive data 3229# BTS 32300 belong&0xfeffffff 0x1a034465 BTS archive data 3231# ELI 5750 32320 string Ora\ ELI 5750 archive data 3233# QFC 32340 string \x1aFC\x1a QFC archive data 32350 string \x1aQF\x1a QFC archive data 3236# PRO-PACK 32370 string RNC PRO-PACK archive data 3238# 777 32390 string 777 777 archive data 3240# LZS221 32410 string sTaC LZS221 archive data 3242# HPA 32430 string HPA HPA archive data 3244# Arhangel 32450 string LG Arhangel archive data 3246# EXP1, uses bzip2 32470 string 0123456789012345BZh EXP1 archive data 3248# IMP 32490 string IMP\xa IMP archive data 3250# NRV 32510 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 3252# Squish 32530 string \x73\xb2\x90\xf4 Squish archive data 3254# Par 32550 string PHILIPP Par archive data 32560 string PAR Par archive data 3257# HIT 32580 string UB HIT archive data 3259# SBX 32600 belong&0xfffff000 0x53423000 SBX archive data 3261# NaShrink 32620 string NSK NaShrink archive data 3263# SAPCAR 32640 string #\ CAR\ archive\ header SAPCAR archive data 32650 string CAR\ 2.00RG SAPCAR archive data 3266# Disintegrator 32670 string DST Disintegrator archive data 3268# ASD 32690 string ASD ASD archive data 3270# InstallShield CAB 32710 string ISc( InstallShield CAB 3272# TOP4 32730 string T4\x1a TOP4 archive data 3274# BatComp left out: sig looks like COM executable 3275# so TODO: get real 4dos batcomp file and find sig 3276# BlakHole 32770 string BH\5\7 BlakHole archive data 3278# BIX 32790 string BIX0 BIX archive data 3280# ChiefLZA 32810 string ChfLZ ChiefLZA archive data 3282# Blink 32830 string Blink Blink archive data 3284# Logitech Compress 32850 string \xda\xfa Logitech Compress archive data 3286# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 32871 string (C)\ STEPANYUK ARS-Sfx archive data 3288# AKT/AKT32 32890 string AKT32 AKT32 archive data 32900 string AKT AKT archive data 3291# NPack 32920 string MSTSM NPack archive data 3293# PFT 32940 string \0\x50\0\x14 PFT archive data 3295# SemOne 32960 string SEM SemOne archive data 3297# PPMD 32980 string \x8f\xaf\xac\x84 PPMD archive data 3299# FIZ 33000 string FIZ FIZ archive data 3301# MSXiE 33020 belong&0xfffff0f0 0x4d530000 MSXiE archive data 3303# DeepFreezer 33040 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 3305# DC 33060 string =<DC- DC archive data 3307# TPac 33080 string \4TPAC\3 TPac archive data 3309# Ai 33100 string Ai\1\1\0 Ai archive data 33110 string Ai\1\0\0 Ai archive data 3312# Ai32 33130 string Ai\2\0 Ai32 archive data 33140 string Ai\2\1 Ai32 archive data 3315# SBC 33160 string SBC SBC archive data 3317# Ybs 33180 string YBS Ybs archive data 3319# DitPack 33200 string \x9e\0\0 DitPack archive data 3321# DMS 33220 string DMS! DMS archive data 3323# EPC 33240 string \x8f\xaf\xac\x8c EPC archive data 3325# VSARC 33260 string VS\x1a VSARC archive data 3327# PDZ 33280 string PDZ PDZ archive data 3329# ReDuq 33300 string rdqx ReDuq archive data 3331# GCA 33320 string GCAX GCA archive data 3333# PPMN 33340 string pN PPMN archive data 3335# WinImage 33363 string WINIMAGE WinImage archive data 3337# Compressia 33380 string CMP0CMP Compressia archive data 3339# UHBC 33400 string UHB UHBC archive data 3341# WinHKI 33420 string \x61\x5C\x04\x05 WinHKI archive data 3343# WWPack data file 33440 string WWP WWPack archive data 3345# BSN (BSA, PTS-DOS) 33460 string \xffBSG BSN archive data 33471 string \xffBSG BSN archive data 33483 string \xffBSG BSN archive data 33491 string \0\xae\2 BSN archive data 33501 string \0\xae\3 BSN archive data 33511 string \0\xae\7 BSN archive data 3352# AIN 33530 string \x33\x18 AIN archive data 33540 string \x33\x17 AIN archive data 3355# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 3356# SZip (TODO: doesn't catch all versions) 33570 string SZ\x0a\4 SZip archive data 3358# XPack DiskImage 3359# *.XDI updated by Joerg Jenderek Sep 2015 3360# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 3361# GRR: this test is still too general as it catches also text files starting with jm 33620 string jm 3363# only found examples with this additional characteristic 2 bytes 3364>2 string \x2\x4 Xpack DiskImage archive data 3365#!:ext xdi 3366# XPack Data 3367# *.xpa updated by Joerg Jenderek Sep 2015 3368# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 33690 string xpa XPA 3370!:ext xpa 3371# XPA32 3372# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 3373# created by XPA32.EXE version 1.0.2 for Windows 3374>0 string xpa\0\1 \b32 archive data 3375# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 3376>3 ubeshort !0x0001 \bck archive data 3377# XPack Single Data 3378# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 3379# letter 'I'+ acute accent is equivalent to \xcd 33800 string \xcd\ jm Xpack single archive data 3381#!:mime application/x-xpa-compressed 3382!:ext xpa 3383 3384# TODO: missing due to unknown magic/magic at end of file: 3385#DWC 3386#ARG 3387#ZAR 3388#PC/3270 3389#InstallIt 3390#RKive 3391#RK 3392#XPack Diskimage 3393 3394# These were inspired by idarc, but actually verified 3395# Dzip archiver (.dz) 3396# Update: Joerg Jenderek 3397# URL: http://speeddemosarchive.com/dzip/ 3398# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 3399# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 34000 string DZ 3401# latest version is 2.9 dated 7 may 2003 3402>2 byte <4 Dzip archive data 3403!:mime application/x-dzip 3404!:ext dz 3405>>2 byte x \b, version %i 3406>>3 byte x \b.%i 3407>>4 ulelong x \b, offset 0x%x 3408>>8 ulelong x \b, %u files 3409# ZZip archiver (.zz) 34100 string ZZ\ \0\0 ZZip archive data 34110 string ZZ0 ZZip archive data 3412# PAQ archiver (.paq) 34130 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 34140 string PAQ PAQ archive data 3415>3 byte&0xf0 0x30 3416>>3 byte x (v%c) 3417# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 34180xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 34190 string JARCS JAR (ARJ Software, Inc.) archive data 3420 3421# ARJ archiver (jason@jarthur.Claremont.EDU) 34220 leshort 0xea60 ARJ archive data 3423!:mime application/x-arj 3424>5 byte x \b, v%d, 3425>8 byte &0x04 multi-volume, 3426>8 byte &0x10 slash-switched, 3427>8 byte &0x20 backup, 3428>34 string x original name: %s, 3429>7 byte 0 os: MS-DOS 3430>7 byte 1 os: PRIMOS 3431>7 byte 2 os: Unix 3432>7 byte 3 os: Amiga 3433>7 byte 4 os: Macintosh 3434>7 byte 5 os: OS/2 3435>7 byte 6 os: Apple ][ GS 3436>7 byte 7 os: Atari ST 3437>7 byte 8 os: NeXT 3438>7 byte 9 os: VAX/VMS 3439>3 byte >0 %d] 3440# [JW] idarc says this is also possible 34412 leshort 0xea60 ARJ archive data 3442 3443# HA archiver (Greg Roelofs, newt@uchicago.edu) 3444# This is a really bad format. A file containing HAWAII will match this... 3445#0 string HA HA archive data, 3446#>2 leshort =1 1 file, 3447#>2 leshort >1 %hu files, 3448#>4 byte&0x0f =0 first is type CPY 3449#>4 byte&0x0f =1 first is type ASC 3450#>4 byte&0x0f =2 first is type HSC 3451#>4 byte&0x0f =0x0e first is type DIR 3452#>4 byte&0x0f =0x0f first is type SPECIAL 3453# suggestion: at least identify small archives (<1024 files) 34540 belong&0xffff00fc 0x48410000 HA archive data 3455>2 leshort =1 1 file, 3456>2 leshort >1 %u files, 3457>4 byte&0x0f =0 first is type CPY 3458>4 byte&0x0f =1 first is type ASC 3459>4 byte&0x0f =2 first is type HSC 3460>4 byte&0x0f =0x0e first is type DIR 3461>4 byte&0x0f =0x0f first is type SPECIAL 3462 3463# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 34640 string HPAK HPACK archive data 3465 3466# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 34670 string \351,\001JAM\ JAM archive, 3468>7 string >\0 version %.4s 3469>0x26 byte =0x27 - 3470>>0x2b string >\0 label %.11s, 3471>>0x27 lelong x serial %08x, 3472>>0x36 string >\0 fstype %.8s 3473 3474# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 3475# Update: Joerg Jenderek 3476# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3477# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 3478# 3479# check and display information of lharc (LHa,PMarc) file 34800 name lharc-file 3481# check 1st character of method id like -lz4- -lh5- or -pm2- 3482>2 string - 3483# check 5th character of method id 3484>>6 string - 3485# check header level 0 1 2 3 3486>>>20 ubyte <4 3487# check 2nd, 3th and 4th character of method id 3488>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 3489!:mime application/x-lzh-compressed 3490# creator type "LHA " 3491!:apple ????LHA 3492# display archive type name like "LHa/LZS archive data" or "LArc archive" 3493>>>>>2 string -lz \b 3494!:ext lzs 3495# already known -lzs- -lz4- -lz5- with old names 3496>>>>>>2 string -lzs LHa/LZS archive data 3497>>>>>>3 regex \^lz[45] LHarc 1.x archive data 3498# missing -lz?- with wikipedia names 3499>>>>>>3 regex \^lz[2378] LArc archive 3500# display archive type name like "LHa (2.x) archive data" 3501>>>>>2 string -lh \b 3502# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 3503>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 3504# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 3505# FOOBAR archiver use ".foo" as name extension instead usual one 3506# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 3507>>>>>>>2 string -lh1 \b 3508!:ext lha/lzh/ice 3509>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 3510>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 3511>>>>>>3 regex \^lh[456] LHa (2.x) archive data 3512>>>>>>>2 string -lh5 \b 3513# https://en.wikipedia.org/wiki/BIOS 3514# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like 3515# bios.rom , kd7_v14.bin, 1010.004, ... 3516!:ext lha/lzh/rom/bin 3517# missing -lh?- variants (Joe Jared) 3518>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 3519# UNLHA32 2.67a 3520>>>>>>2 string -lhx LHa (UNLHA32) archive 3521# lha archives with standard file name extensions ".lha" ".lzh" 3522>>>>>>3 regex !\^(lh1|lh5) \b 3523!:ext lha/lzh 3524# this should not happen if all -lh variants are described 3525>>>>>>2 default x LHa (unknown) archive 3526#!:ext lha 3527# PMarc 3528>>>>>3 regex \^pm[012] PMarc archive data 3529!:ext pma 3530# append method id without leading and trailing minus character 3531>>>>>3 string x [%3.3s] 3532>>>>>>0 use lharc-header 3533# 3534# check and display information of lharc header 35350 name lharc-header 3536# header size 0x4 , 0x1b-0x61 3537>0 ubyte x 3538# compressed data size != compressed file size 3539#>7 ulelong x \b, data size %d 3540# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 3541#>19 ubyte x \b, 19_0x%x 3542# level identifier 0 1 2 3 3543#>20 ubyte x \b, level %d 3544# time stamp 3545#>15 ubelong x DATE 0x%8.8x 3546# OS ID for level 1 3547>20 ubyte 1 3548# 0x20 types find for *.rom files 3549>>(21.b+24) ubyte <0x21 \b, 0x%x OS 3550# ascii type like M for MSDOS 3551>>(21.b+24) ubyte >0x20 \b, '%c' OS 3552# OS ID for level 2 3553>20 ubyte 2 3554#>>23 ubyte x \b, OS ID 0x%x 3555>>23 ubyte <0x21 \b, 0x%x OS 3556>>23 ubyte >0x20 \b, '%c' OS 3557# filename only for level 0 and 1 3558>20 ubyte <2 3559# length of filename 3560>>21 ubyte >0 \b, with 3561# filename 3562>>>21 pstring x "%s" 3563# 3564#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 3565#!:mime application/x-lharc 35662 string -lh0- 3567>0 use lharc-file 3568#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 3569#!:mime application/x-lharc 35702 string -lh1- 3571>0 use lharc-file 3572# NEW -lz2- ... -lz8- 35732 string -lz2- 3574>0 use lharc-file 35752 string -lz3- 3576>0 use lharc-file 35772 string -lz4- 3578>0 use lharc-file 35792 string -lz5- 3580>0 use lharc-file 35812 string -lz7- 3582>0 use lharc-file 35832 string -lz8- 3584>0 use lharc-file 3585# [never seen any but the last; -lh4- reported in comp.compression:] 3586#2 string -lzs- LHa/LZS archive data [lzs] 35872 string -lzs- 3588>0 use lharc-file 3589# According to wikipedia and others such a version does not exist 3590#2 string -lh\40- LHa 2.x? archive data [lh ] 3591#2 string -lhd- LHa 2.x? archive data [lhd] 35922 string -lhd- 3593>0 use lharc-file 3594#2 string -lh2- LHa 2.x? archive data [lh2] 35952 string -lh2- 3596>0 use lharc-file 3597#2 string -lh3- LHa 2.x? archive data [lh3] 35982 string -lh3- 3599>0 use lharc-file 3600#2 string -lh4- LHa (2.x) archive data [lh4] 36012 string -lh4- 3602>0 use lharc-file 3603#2 string -lh5- LHa (2.x) archive data [lh5] 36042 string -lh5- 3605>0 use lharc-file 3606#2 string -lh6- LHa (2.x) archive data [lh6] 36072 string -lh6- 3608>0 use lharc-file 3609#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 36102 string -lh7- 3611# !:mime application/x-lha 3612# >20 byte x - header level %d 3613>0 use lharc-file 3614# NEW -lh8- ... -lhe- , -lhx- 36152 string -lh8- 3616>0 use lharc-file 36172 string -lh9- 3618>0 use lharc-file 36192 string -lha- 3620>0 use lharc-file 36212 string -lhb- 3622>0 use lharc-file 36232 string -lhc- 3624>0 use lharc-file 36252 string -lhe- 3626>0 use lharc-file 36272 string -lhx- 3628>0 use lharc-file 3629# taken from idarc [JW] 36302 string -lZ PUT archive data 3631# already done by LHarc magics 3632# this should never happen if all sub types of LZS archive are identified 3633#2 string -lz LZS archive data 36342 string -sw1- Swag archive data 3635 36360 name rar-file-header 3637>24 byte 15 \b, v1.5 3638>24 byte 20 \b, v2.0 3639>24 byte 29 \b, v4 3640>15 byte 0 \b, os: MS-DOS 3641>15 byte 1 \b, os: OS/2 3642>15 byte 2 \b, os: Win32 3643>15 byte 3 \b, os: Unix 3644>15 byte 4 \b, os: Mac OS 3645>15 byte 5 \b, os: BeOS 3646 36470 name rar-archive-header 3648>3 leshort&0x1ff >0 \b, flags: 3649>>3 leshort &0x01 ArchiveVolume 3650>>3 leshort &0x02 Commented 3651>>3 leshort &0x04 Locked 3652>>3 leshort &0x10 NewVolumeNaming 3653>>3 leshort &0x08 Solid 3654>>3 leshort &0x20 Authenticated 3655>>3 leshort &0x40 RecoveryRecordPresent 3656>>3 leshort &0x80 EncryptedBlockHeader 3657>>3 leshort &0x100 FirstVolume 3658 3659# RAR (Roshal Archive) archive 36600 string Rar!\x1a\7\0 RAR archive data 3661!:mime application/x-rar 3662!:ext rar/cbr 3663# file header 3664>(0xc.l+9) byte 0x74 3665>>(0xc.l+7) use rar-file-header 3666# subblock seems to share information with file header 3667>(0xc.l+9) byte 0x7a 3668>>(0xc.l+7) use rar-file-header 3669>9 byte 0x73 3670>>7 use rar-archive-header 3671 36720 string Rar!\x1a\7\1\0 RAR archive data, v5 3673!:mime application/x-rar 3674!:ext rar 3675 3676# Very old RAR archive 3677# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 36780 string RE\x7e\x5e RAR archive data (<v1.5) 3679!:mime application/x-rar 3680!:ext rar/cbr 3681 3682# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 36830 string SQSH squished archive data (Acorn RISCOS) 3684 3685# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 3686# [JW] see exe section for self-extracting version 36870 string UC2\x1a UC2 archive data 3688 3689# PKZIP multi-volume archive 36900 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 3691!:mime application/zip 3692!:ext zip/cbz 3693 3694# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 36950 string PK\005\006 Zip archive data (empty) 3696!:mime application/zip 3697!:ext zip/cbz 3698!:strength +1 36990 string PK\003\004 3700!:strength +1 3701 3702# Specialised zip formats which start with a member named 'mimetype' 3703# (stored uncompressed, with no 'extra field') containing the file's MIME type. 3704# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 3705# contents starting with "application/": 3706>26 string \x8\0\0\0mimetypeapplication/ 3707 3708# KOffice / OpenOffice & StarOffice / OpenDocument formats 3709# From: Abel Cheung <abel@oaka.org> 3710 3711# KOffice (1.2 or above) formats 3712# (mimetype contains "application/vnd.kde.<SUBTYPE>") 3713>>50 string vnd.kde. KOffice (>=1.2) 3714>>>58 string karbon Karbon document 3715>>>58 string kchart KChart document 3716>>>58 string kformula KFormula document 3717>>>58 string kivio Kivio document 3718>>>58 string kontour Kontour document 3719>>>58 string kpresenter KPresenter document 3720>>>58 string kspread KSpread document 3721>>>58 string kword KWord document 3722 3723# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 3724# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 3725# URL: https://en.wikipedia.org/wiki/OpenOffice.org_XML 3726# reference: http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML 3727>>50 string vnd.sun.xml. OpenOffice.org 1.x 3728>>>62 string writer Writer 3729>>>>68 byte !0x2e document 3730!:mime application/vnd.sun.xml.writer 3731!:ext sxw 3732>>>>68 string .template template 3733!:mime application/vnd.sun.xml.writer.template 3734!:ext stw 3735>>>>68 string .web Web template 3736!:mime application/vnd.sun.xml.writer.web 3737!:ext stw 3738>>>>68 string .global global document 3739!:mime application/vnd.sun.xml.writer.global 3740!:ext sxg 3741>>>62 string calc Calc 3742>>>>66 byte !0x2e spreadsheet 3743!:mime application/vnd.sun.xml.calc 3744!:ext sxc 3745>>>>66 string .template template 3746!:mime application/vnd.sun.xml.calc.template 3747!:ext stc 3748>>>62 string draw Draw 3749>>>>66 byte !0x2e document 3750!:mime application/vnd.sun.xml.draw 3751!:ext sxd 3752>>>>66 string .template template 3753!:mime application/vnd.sun.xml.draw.template 3754!:ext std 3755>>>62 string impress Impress 3756>>>>69 byte !0x2e presentation 3757!:mime application/vnd.sun.xml.impress 3758!:ext sxi 3759>>>>69 string .template template 3760!:mime application/vnd.sun.xml.impress.template 3761!:ext sti 3762>>>62 string math Math document 3763!:mime application/vnd.sun.xml.math 3764!:ext sxm 3765>>>62 string base Database file 3766!:mime application/vnd.sun.xml.base 3767!:ext sdb 3768 3769# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 3770# URL: http://fileformats.archiveteam.org/wiki/OpenDocument 3771# https://lists.oasis-open.org/archives/office/200505/msg00006.html 3772# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 3773>>50 string vnd.oasis.opendocument. OpenDocument 3774>>>73 string text 3775>>>>77 byte !0x2d Text 3776!:mime application/vnd.oasis.opendocument.text 3777!:ext odt 3778>>>>77 string -template Text Template 3779!:mime application/vnd.oasis.opendocument.text-template 3780!:ext ott 3781>>>>77 string -web HTML Document Template 3782!:mime application/vnd.oasis.opendocument.text-web 3783!:ext oth 3784>>>>77 string -master Master Document 3785!:mime application/vnd.oasis.opendocument.text-master 3786!:ext odm 3787>>>73 string graphics 3788>>>>81 byte !0x2d Drawing 3789!:mime application/vnd.oasis.opendocument.graphics 3790!:ext odg 3791>>>>81 string -template Drawing Template 3792!:mime application/vnd.oasis.opendocument.graphics-template 3793!:ext otg 3794>>>73 string presentation 3795>>>>85 byte !0x2d Presentation 3796!:mime application/vnd.oasis.opendocument.presentation 3797!:ext odp 3798>>>>85 string -template Presentation Template 3799!:mime application/vnd.oasis.opendocument.presentation-template 3800!:ext otp 3801>>>73 string spreadsheet 3802>>>>84 byte !0x2d Spreadsheet 3803!:mime application/vnd.oasis.opendocument.spreadsheet 3804!:ext ods 3805>>>>84 string -template Spreadsheet Template 3806!:mime application/vnd.oasis.opendocument.spreadsheet-template 3807!:ext ots 3808>>>73 string chart 3809>>>>78 byte !0x2d Chart 3810!:mime application/vnd.oasis.opendocument.chart 3811!:ext odc 3812>>>>78 string -template Chart Template 3813!:mime application/vnd.oasis.opendocument.chart-template 3814!:ext otc 3815>>>73 string formula 3816>>>>80 byte !0x2d Formula 3817!:mime application/vnd.oasis.opendocument.formula 3818!:ext odf 3819>>>>80 string -template Formula Template 3820!:mime application/vnd.oasis.opendocument.formula-template 3821!:ext otf 3822# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml 3823>>>73 string database Database 3824!:mime application/vnd.oasis.opendocument.database 3825!:ext odb 3826# Valid for LibreOffice Base 6.0.1.1 at least 3827>>>73 string base Database 3828# https://bugs.documentfoundation.org/show_bug.cgi?id=45854 3829!:mime application/vnd.oasis.opendocument.database 3830#!:mime application/vnd.oasis.opendocument.base 3831!:ext odb 3832>>>73 string image 3833>>>>78 byte !0x2d Image 3834!:mime application/vnd.oasis.opendocument.image 3835!:ext odi 3836>>>>78 string -template Image Template 3837!:mime application/vnd.oasis.opendocument.image-template 3838!:ext oti 3839 3840# EPUB (OEBPS) books using OCF (OEBPS Container Format) 3841# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 3842# From: Ralf Brown <ralf.brown@gmail.com> 3843>>50 string epub+zip EPUB document 3844!:mime application/epub+zip 3845 3846# From: Joerg Jenderek 3847# URL: http://en.wikipedia.org/wiki/CorelDRAW 3848# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based 3849>>50 string x-vnd.corel. Corel 3850>>>62 string draw.document+zip Draw drawing, version 14-16 3851!:mime application/x-vnd.corel.draw.document+zip 3852!:ext cdr 3853>>>62 string draw.template+zip Draw template, version 14-16 3854!:mime application/x-vnd.corel.draw.template+zip 3855!:ext cdrt 3856>>>62 string zcf.draw.document+zip Draw drawing, version 17-22 3857!:mime application/x-vnd.corel.zcf.draw.document+zip 3858!:ext cdr 3859>>>62 string zcf.draw.template+zip Draw template, version 17-22 3860!:mime application/x-vnd.corel.zcf.draw.template+zip 3861!:ext cdt/cdrt 3862# URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html 3863>>>62 string zcf.pattern+zip Draw pattern, version 22 3864!:mime application/x-vnd.corel.zcf.pattern+zip 3865!:ext pat 3866# URL: https://en.wikipedia.org/wiki/Corel_Designer 3867# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 3868# Note: called by TrID "Corel DESIGN graphics" 3869>>>62 string designer.document+zip DESIGNER graphics, version 14-16 3870!:mime application/x-vnd.corel.designer.document+zip 3871!:ext des 3872>>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21 3873!:mime application/x-vnd.corel.zcf.designer.document+zip 3874!:ext des 3875# URL: http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/ 3876# CorelDRAW-Corel-Symbol-Library-CSL.html 3877>>>62 string symbol.library+zip Symbol Library, version 6-16.3 3878!:mime application/x-vnd.corel.symbol.library+zip 3879!:ext csl 3880>>>62 string zcf.symbol.library+zip Symbol Library, version 17-22 3881!:mime application/x-vnd.corel.zcf.symbol.library+zip 3882!:ext csl 3883 3884# Catch other ZIP-with-mimetype formats 3885# In a ZIP file, the bytes immediately after a member's contents are 3886# always "PK". The 2 regex rules here print the "mimetype" member's 3887# contents up to the first 'P'. Luckily, most MIME types don't contain 3888# any capital 'P's. This is a kludge. 3889# (mimetype contains "application/<OTHER>") 3890>>50 default x Zip data 3891>>>38 regex [!-OQ-~]+ (MIME type "%s"?) 3892!:mime application/zip 3893# (mimetype contents other than "application/*") 3894>26 string \x8\0\0\0mimetype 3895>>38 string !application/ 3896>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 3897!:mime application/zip 3898 3899# Java Jar files 3900>(26.s+30) leshort 0xcafe Java archive data (JAR) 3901!:mime application/java-archive 3902 3903# iOS App 3904>(26.s+30) leshort !0xcafe 3905>>26 string !\x8\0\0\0mimetype 3906>>>30 string Payload/ 3907>>>>38 search/64 .app/ iOS App 3908!:mime application/x-ios-app 3909 3910>30 search/100/b application/epub+zip EPUB document 3911!:mime application/epub+zip 3912 3913# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 3914# Next line excludes specialized formats: 3915>(26.s+30) leshort !0xcafe 3916>>30 search/100/b !application/epub+zip 3917>>>26 string !\x8\0\0\0mimetype Zip archive data 3918!:mime application/zip 3919>>>>4 beshort x \b, at least 3920>>>>4 use zipversion 3921>>>>4 beshort x to extract 3922>>>>8 beshort x \b, compression method= 3923>>>>8 use zipcompression 3924>>>>0x161 string WINZIP \b, WinZIP self-extracting 3925 3926# StarView Metafile 3927# From Pierre Ducroquet <pinaraf@pinaraf.info> 39280 string VCLMTF StarView MetaFile 3929>6 beshort x \b, version %d 3930>8 belong x \b, size %d 3931 3932# Zoo archiver 393320 lelong 0xfdc4a7dc Zoo archive data 3934!:mime application/x-zoo 3935>4 byte >48 \b, v%c. 3936>>6 byte >47 \b%c 3937>>>7 byte >47 \b%c 3938>32 byte >0 \b, modify: v%d 3939>>33 byte x \b.%d+ 3940>42 lelong 0xfdc4a7dc \b, 3941>>70 byte >0 extract: v%d 3942>>>71 byte x \b.%d+ 3943 3944# Shell archives 394510 string #\ This\ is\ a\ shell\ archive shell archive text 3946!:mime application/octet-stream 3947 3948# 3949# LBR. NB: May conflict with the questionable 3950# "binary Computer Graphics Metafile" format. 3951# 39520 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 3953# 3954# PMA (CP/M derivative of LHA) 3955# Update: Joerg Jenderek 3956# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3957# 3958#2 string -pm0- PMarc archive data [pm0] 39592 string -pm0- 3960>0 use lharc-file 3961#2 string -pm1- PMarc archive data [pm1] 39622 string -pm1- 3963>0 use lharc-file 3964#2 string -pm2- PMarc archive data [pm2] 39652 string -pm2- 3966>0 use lharc-file 39672 string -pms- PMarc SFX archive (CP/M, DOS) 3968#!:mime application/x-foobar-exec 3969!:ext com 39705 string -pc1- PopCom compressed executable (CP/M) 3971#!:mime application/x- 3972#!:ext com 3973 3974# From Rafael Laboissiere <rafael@laboissiere.net> 3975# The Project Revision Control System (see 3976# http://prcs.sourceforge.net) generates a packaged project 3977# file which is recognized by the following entry: 39780 leshort 0xeb81 PRCS packaged project 3979 3980# Microsoft cabinets 3981# by David Necas (Yeti) <yeti@physics.muni.cz> 3982#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 3983#>25 byte x v%d 3984#>24 byte x \b.%d 3985# MPi: All CABs have version 1.3, so this is pointless. 3986# Better magic in debian-additions. 3987 3988# GTKtalog catalogs 3989# by David Necas (Yeti) <yeti@physics.muni.cz> 39904 string gtktalog\ GTKtalog catalog data, 3991>13 string 3 version 3 3992>>14 beshort 0x677a (gzipped) 3993>>14 beshort !0x677a (not gzipped) 3994>13 string >3 version %s 3995 3996############################################################################ 3997# Parity archive reconstruction file, the 'par' file format now used on Usenet. 39980 string PAR\0 PARity archive data 3999>48 leshort =0 - Index file 4000>48 leshort >0 - file number %d 4001 4002# Felix von Leitner <felix-file@fefe.de> 40030 string d8:announce BitTorrent file 4004!:mime application/x-bittorrent 4005# Durval Menezes, <jmgthbfile at durval dot com> 40060 string d13:announce-list BitTorrent file 4007!:mime application/x-bittorrent 40080 string d7:comment BitTorrent file 4009!:mime application/x-bittorrent 40100 string d4:info BitTorrent file 4011!:mime application/x-bittorrent 4012 4013# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 40140 beshort 0x0e0f Atari MSA archive data 4015>2 beshort x \b, %d sectors per track 4016>4 beshort 0 \b, 1 sided 4017>4 beshort 1 \b, 2 sided 4018>6 beshort x \b, starting track: %d 4019>8 beshort x \b, ending track: %d 4020 4021# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 40220 string PK00PK\003\004 Zip archive data 4023!:mime application/zip 4024!:ext zip/cbz 4025 4026# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 4027# by Stefan `Sec` Zehl <sec@42.org> 40287 string **ACE** ACE archive data 4029>15 byte >0 version %d 4030>16 byte =0x00 \b, from MS-DOS 4031>16 byte =0x01 \b, from OS/2 4032>16 byte =0x02 \b, from Win/32 4033>16 byte =0x03 \b, from Unix 4034>16 byte =0x04 \b, from MacOS 4035>16 byte =0x05 \b, from WinNT 4036>16 byte =0x06 \b, from Primos 4037>16 byte =0x07 \b, from AppleGS 4038>16 byte =0x08 \b, from Atari 4039>16 byte =0x09 \b, from Vax/VMS 4040>16 byte =0x0A \b, from Amiga 4041>16 byte =0x0B \b, from Next 4042>14 byte x \b, version %d to extract 4043>5 leshort &0x0080 \b, multiple volumes, 4044>>17 byte x \b (part %d), 4045>5 leshort &0x0002 \b, contains comment 4046>5 leshort &0x0200 \b, sfx 4047>5 leshort &0x0400 \b, small dictionary 4048>5 leshort &0x0800 \b, multi-volume 4049>5 leshort &0x1000 \b, contains AV-String 4050>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 4051>5 leshort &0x2000 \b, with recovery record 4052>5 leshort &0x4000 \b, locked 4053>5 leshort &0x8000 \b, solid 4054# Date in MS-DOS format (whatever that is) 4055#>18 lelong x Created on 4056 4057# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 4058# <doj@cubic.org> 40590x1A string sfArk sfArk compressed Soundfont 4060>0x15 string 2 4061>>0x1 string >\0 Version %s 4062>>0x2A string >\0 : %s 4063 4064# DR-DOS 7.03 Packed File *.??_ 4065# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 4066# Note: unpacked by PNUNPACK.EXE 40670 string Packed\ File\ 4068# by looking for Control-Z skip ASCII text starting with Packed File 4069>0x18 ubyte 0x1a Personal NetWare Packed File 4070!:mime application/x-novell-compress 4071!:ext ??_ 4072>>12 string x \b, was "%.12s" 4073# 1 or 2 4074#>>0x19 ubyte x \b, at 0x19 %u 4075>>0x1b ulelong x with %u bytes 4076 4077# EET archive 4078# From: Tilman Sauerbeck <tilman@code-monkey.de> 40790 belong 0x1ee7ff00 EET archive 4080!:mime application/x-eet 4081 4082# rzip archives 40830 string RZIP rzip compressed data 4084>4 byte x - version %d 4085>5 byte x \b.%d 4086>6 belong x (%d bytes) 4087 4088# From: Joerg Jenderek 4089# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php 4090# reference: http://mark0.net/download/triddefs_xml.7z/ 4091# defs/f/fzip.trid.xml 4092# Note: unknown compression; No "PK" zip magic; normally in directory like 4093# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" 40940 ubequad 0x2506781901010000 Foxit add-on/update 4095!:mime application/x-fzip 4096!:ext fzip 4097 4098# From: "Robert Dale" <robdale@gmail.com> 40990 belong 123 dar archive, 4100>4 belong x label "%.8x 4101>>8 belong x %.8x 4102>>>12 beshort x %.4x" 4103>14 byte 0x54 end slice 4104>14 beshort 0x4e4e multi-part 4105>14 beshort 0x4e53 multi-part, with -S 4106 4107# Symbian installation files 4108# https://www.thouky.co.uk/software/psifs/sis.html 4109# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 41108 lelong 0x10000419 Symbian installation file 4111!:mime application/vnd.symbian.install 4112>4 lelong 0x1000006D (EPOC release 3/4/5) 4113>4 lelong 0x10003A12 (EPOC release 6) 41140 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 4115!:mime x-epoc/x-sisx-app 4116 4117# From "Nelson A. de Oliveira" <naoliv@gmail.com> 41180 string MPQ\032 MoPaQ (MPQ) archive 4119 4120# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 4121# .kgb 41220 string KGB_arch KGB Archiver file 4123>10 string x with compression level %.1s 4124 4125# xar (eXtensible ARchiver) archive 4126# URL: https://en.wikipedia.org/wiki/Xar_(archiver) 4127# xar archive format: https://code.google.com/p/xar/ 4128# From: "David Remahl" <dremahl@apple.com> 4129# Update: Joerg Jenderek 4130# TODO: lzma compression; X509Data for pkg and xip 4131# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or 4132# 7z t -txar Xcode_10.2_beta_4.xip` 41330 string xar! xar archive 4134!:mime application/x-xar 4135# pkg for Mac OSX installer package like FullBundleUpdate.pkg 4136# xip for signed Apple software like Xcode_10.2_beta_4.xip 4137!:ext xar/pkg/xip 4138# always 28 in older archives 4139>4 ubeshort >28 \b, header size %u 4140# currently there exit only version 1 since about 2014 4141>6 ubeshort >1 version %u, 4142>8 ubequad x compressed TOC: %llu, 4143#>16 ubequad x uncompressed TOC: %llu, 4144# cksum_alg 0-2 in older and also 3-4 in newer 4145>24 belong 0 no checksum 4146>24 belong 1 SHA-1 checksum 4147>24 belong 2 MD5 checksum 4148>24 belong 3 SHA-256 checksum 4149>24 belong 4 SHA-512 checksum 4150>24 belong >4 unknown 0x%x checksum 4151#>24 belong >4 checksum 4152# For no compression jump 0 bytes 4153>24 belong 0 4154>>0 ubyte x 4155# jump more bytes forward by header size 4156>>>&(4.S) ubyte x 4157# jump more bytes forward by compressed table of contents size 4158#>>>>&(8.Q) ubequad x \b, heap data 0x%llx 4159>>>>&(8.Q) ubyte x 4160# look for data by ./compress after message with 1 space at end 4161>>>>>&-3 indirect x \b, contains 4162# For SHA-1 jump 20 minus 2 bytes 4163>24 belong 1 4164>>18 ubyte x 4165# jump more bytes forward by header size 4166>>>&(4.S) ubyte x 4167# jump more bytes forward by compressed table of contents size 4168>>>>&(8.Q) ubyte x 4169# data compressed by gzip, bzip, lzma or none 4170>>>>>&-1 indirect x \b, contains 4171# For SHA-256 jump 32 minus 2 bytes 4172>24 belong 3 4173>>30 ubyte x 4174# jump more bytes forward by header size 4175>>>&(4.S) ubyte x 4176# jump more bytes forward by compressed table of contents size 4177>>>>&(8.Q) ubyte x 4178>>>>>&-1 indirect x \b, contains 4179# For SHA-512 jump 64 minus 2 bytes 4180>24 belong 4 4181>>62 ubyte x 4182# jump more bytes forward by header size 4183>>>&(4.S) ubyte x 4184# jump more bytes forward by compressed table of contents size 4185>>>>&(8.Q) ubyte x 4186>>>>>&-1 indirect x \b, contains 4187 4188# Type: Parity Archive 4189# From: Daniel van Eeden <daniel_e@dds.nl> 41900 string PAR2 Parity Archive Volume Set 4191 4192# Bacula volume format. (Volumes always start with a block header.) 4193# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 4194# From: Adam Buchbinder <adam.buchbinder@gmail.com> 419512 string BB02 Bacula volume 4196>20 bedate x \b, started %s 4197 4198# ePub is XHTML + XML inside a ZIP archive. The first member of the 4199# archive must be an uncompressed file called 'mimetype' with contents 4200# 'application/epub+zip' 4201 4202 4203# From: "Michael Gorny" <mgorny@gentoo.org> 4204# ZPAQ: http://mattmahoney.net/dc/zpaq.html 42050 string zPQ ZPAQ stream 4206>3 byte x \b, level %d 4207# From: Barry Carter <carter.barry@gmail.com> 4208# https://encode.ru/threads/456-zpaq-updates/page32 42090 string 7kSt ZPAQ file 4210 4211# BBeB ebook, unencrypted (LRF format) 4212# URL: https://www.sven.de/librie/Librie/LrfFormat 4213# From: Adam Buchbinder <adam.buchbinder@gmail.com> 42140 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 4215>8 beshort x \b, version %d 4216>36 byte 1 \b, front-to-back 4217>36 byte 16 \b, back-to-front 4218>42 beshort x \b, (%dx, 4219>44 beshort x %d) 4220 4221# Symantec GHOST image by Joerg Jenderek at May 2014 4222# https://us.norton.com/ghost/ 4223# https://www.garykessler.net/library/file_sigs.html 42240 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 4225# *.GHO 4226>2 ubyte&0x08 0x00 \b, first file 4227# *.GHS or *.[0-9] with cns program option 4228>2 ubyte&0x08 0x08 \b, split file 4229# part of split index interesting for *.ghs 4230>>4 ubyte x id=0x%x 4231# compression tag minus one equals numeric compression command line switch z[1-9] 4232>3 ubyte 0 \b, no compression 4233>3 ubyte 2 \b, fast compression (Z1) 4234>3 ubyte 3 \b, medium compression (Z2) 4235>3 ubyte >3 4236>>3 ubyte <11 \b, compression (Z%d-1) 4237>2 ubyte&0x08 0x00 4238# ~ 30 byte password field only for *.gho 4239>>12 ubequad !0 \b, password protected 4240>>44 ubyte !1 4241# 1~Image All, sector-by-sector only for *.gho 4242>>>10 ubyte 1 \b, sector copy 4243# 1~Image Boot track only for *.gho 4244>>>43 ubyte 1 \b, boot track 4245# 1~Image Disc only for *.gho implies Image Boot track and sector copy 4246>>44 ubyte 1 \b, disc sector copy 4247# optional image description only *.gho 4248>>0xff string >\0 "%-.254s" 4249# look for DOS sector end sequence 4250>0xE08 search/7776 \x55\xAA 4251>>&-512 indirect x \b; contains 4252 4253# Google Chrome extensions 4254# https://developer.chrome.com/extensions/crx 4255# https://developer.chrome.com/extensions/hosting 42560 string Cr24 Google Chrome extension 4257!:mime application/x-chrome-extension 4258>4 ulong x \b, version %u 4259 4260# SeqBox - Sequenced container 4261# ext: sbx, seqbox 4262# Marco Pontello marcopon@gmail.com 4263# reference: https://github.com/MarcoPon/SeqBox 42640 string SBx SeqBox, 4265>3 byte x version %d 4266 4267# LyNX archive 426856 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 4269 4270# From: Joerg Jenderek 4271# URL: https://www.acronis.com/ 4272# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) 4273# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 42740 ubequad 0xce24b9a220000000 Acronis True Image backup 4275!:mime application/x-acronis-tib 4276!:ext tib 4277# 01000000 4278#>20 ubelong x \b, at 20 0x%x 4279# 20000000 4280#>28 ubelong x \b, at 28 0x%x 4281# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" 4282# ??? 4283# strings like "\Device\0000011e" "\Device\0000015a" 4284#>0 search/0x6852300/cs \\Device\\ 4285#>>&-1 pstring x \b, %s 4286# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" 4287#>>>&1 search/180/cs \\Device\\ 4288#>>>>&-1 pstring x \b, %s 4289#>>>>>&0 search/29/cs \0\0\xc8\0 4290# disk label 4291#>>>>>>&10 lestring16 x \b, disk label %11.11s 4292#>>>>>>&9 plestring16 x \b, disk label "%11.11s" 4293#>>>>>>&10 ubequad x %16.16llx 4294 4295 4296# Gentoo XPAK binary package 4297# by Michal Gorny <mgorny@gentoo.org> 4298# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 4299-4 string STOP 4300>-16 string XPAKSTOP Gentoo binary package (XPAK) 4301 4302# From: Joerg Jenderek 4303# URL: https://kodi.wiki/view/TexturePacker 4304# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz 4305# /xbmc-Krypton/xbmc/guilib/XBTF.h 4306# /xbmc-Krypton/xbmc/guilib/XBTF.cpp 43070 string XBTF 4308# skip ASCII text by looking for terminating \0 of path 4309>264 ubyte 0 XBMC texture package 4310!:mime application/x-xbmc-xbt 4311!:ext xbt 4312# XBTF_VERSION 2 4313>>4 string !2 \b, version %-.1s 4314# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp 4315>>5 ulelong x \b, %u file 4316# plural s 4317>>5 ulelong >1 \bs 4318# path[CXBTFFile[MaximumPathLength=256] 4319>>9 string x \b, 1st %s 4320 4321# ALZIP archive 4322# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com> 4323# http://kippler.com/win/unalz/ 4324# https://salsa.debian.org/l10n-korean-team/unalz 43250 string ALZ\001 ALZ archive data 4326!:ext alz 4327 4328# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip 43290 string EGGA EGG archive data, 4330!:ext egg 4331>5 byte x version %u 4332>4 byte x \b.%u 4333>>0x0E ulelong =0x08E28222 4334>>0x0E ulelong =0x24F5A262 \b, split 4335>>0x0E ulelong =0x24E5A060 \b, solid 4336>>0x0E default x \b, unknown 4337 4338# PAQ9A archive 4339# URL: http://mattmahoney.net/dc/#paq9a 4340# Note: Line 1186 of paq9a.cpp gives the magic bytes 43410 string pQ9\001 PAQ9A archive 4342 4343#------------------------------------------------------------------------------ 4344# $File: asf,v 1.1 2019/12/26 02:07:53 christos Exp $ 4345# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files 4346# http://www.staroceans.org/e-book/ASF_Specification.pdf 4347 43480 name asf-name 4349# ASF_Data_Object 4350#>0 guid 75B22636-668E-11CF-A6D9-00AA0062CE6C 4351#>16 lequad >0 4352#>>(16.q) use asf-object 4353# ASF_Simple_Index_Object 4354>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB 4355>0 guid D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object 4356>0 guid FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object 4357>0 guid 3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object 4358 4359# ASF_File_Properties_Object 4360>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365 4361 4362# ASF_Stream_Properties_Object 4363>0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365 4364#>>56 lequad x Time Offset %lld 4365#>>64 lelong x Type-Specicic Data Length %d 4366#>>68 lelong x Error Correction Data Length %d 4367#>>72 leshort x Flags 0x%x 4368#>>74 lelong x Reserved %x 4369# ASF_Audio_Media 4370>>24 guid F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media ( 4371>>>78 leshort x \bCodec Id %d 4372>>>80 leshort x \b, Number of channels %d 4373>>>82 lelong x \b, Samples Per Second %d 4374>>>86 lelong x \b, Average Number of Bytes Per Second %d 4375>>>90 lelong x \b, Block Alignment %d 4376>>>94 leshort x \b, Bits Per Sample %d 4377# ASF_Video_Media 4378>>24 guid BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media ( 4379>>>78 lelong x \bEncoded Image Width %d 4380>>>82 lelong x \b, Encoded Image Height %d 4381#>>>85 leshort x \b, Format Data Size %x 4382>>>93 lelong x \b, Image Width %d 4383>>>97 lelong x \b, Image Height %d 4384#>>>101 leshort x \b, Reserved 0x%x 4385>>>103 leshort x \b, Bits Per Pixel Count %d 4386#>>>105 lelong x \b, Compression ID %d 4387#>>>109 lelong x \b, Image Size %d 4388#>>>113 lelong x \b, Horizontal Pixels Per Meter %d 4389#>>>117 lelong x \b, Vertical Pixels Per Meter %d 4390#>>>121 lelong x \b, Colors Used Count %d 4391#>>>125 lelong x \b, Important Colors Count %d 4392>>0 lelong x \b, Error correction type 4393>>40 use asf-name 4394>>0 lelong x \b) 4395#ASF_Header_Extension_Object 4396>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365 4397# ASF_Codec_List_Object 4398>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6 4399>0 guid 1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object 4400>0 guid F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object 4401>0 guid D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object 4402>0 guid 75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object 4403# ASF_Content_Description_Object 4404>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C 4405#>>24 leshort title length %d 4406#>>26 leshort author length %d 4407#>>28 leshort copyright length %d 4408#>>30 leshort descriptor length %d 4409#>>32 leshort rating length %d 4410>0 guid D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object 4411>0 guid 2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object 4412>0 guid 7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object 4413>0 guid 2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object 4414>0 guid 298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object 4415>0 guid 2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object 4416# ASF_Padding_Object 4417>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8 4418>0 guid 14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object 4419>0 guid A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object 4420>0 guid D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object 4421>0 guid D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object 4422>0 guid A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object 4423>0 guid 7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object 4424>0 guid C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object 4425>0 guid 44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object 4426>0 guid D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object 4427>0 guid 6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object 4428>0 guid F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object 4429>0 guid 26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object 4430>0 guid 43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object 4431>0 guid 59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media 4432>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C44 ASF_JFIF_Media 4433>0 guid 35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media 4434>0 guid 91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media 4435>0 guid 3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media 4436>0 guid 776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype 4437>0 guid DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format 4438>0 guid 20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction 4439>0 guid BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread 4440>0 guid ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1 4441>0 guid 7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM 4442# _Network_Devices 4443>0 guid 86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2 4444>0 guid 4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3 4445>0 guid 4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4 4446>0 guid D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language 4447>0 guid D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate 4448>0 guid D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown 4449>0 guid AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive 4450>0 guid AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial 4451>0 guid 399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode 4452>0 guid E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name 4453>0 guid D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type 4454>0 guid 1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio 4455>0 guid C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration 4456>0 guid 6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID 4457>0 guid 00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG 4458 44590 name asf-object 4460>0 use asf-name 4461#>>16 lequad >0 (size %lld) [ 4462>>16 lequad >0 4463>>>(16.q) use asf-object 4464#>>16 lequad 0 ] 4465 4466# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 44670 guid 75B22630-668E-11CF-A6D9-00AA0062CE6C Microsoft ASF 4468!:mime video/x-ms-asf 4469#>16 lequad >0 (size %lld 4470#>>24 lelong x \b, %d header objects) 4471>16 lequad >0 4472>>30 use asf-object 4473>>(16.q) use asf-object 4474#------------------------------------------------------------------------------ 4475# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 4476# make: file(1) magic for assembler source 4477# 44780 regex \^[\040\t]{0,50}\\.asciiz assembler source text 4479!:mime text/x-asm 44800 regex \^[\040\t]{0,50}\\.byte assembler source text 4481!:mime text/x-asm 44820 regex \^[\040\t]{0,50}\\.even assembler source text 4483!:mime text/x-asm 44840 regex \^[\040\t]{0,50}\\.globl assembler source text 4485!:mime text/x-asm 44860 regex \^[\040\t]{0,50}\\.text assembler source text 4487!:mime text/x-asm 44880 regex \^[\040\t]{0,50}\\.file assembler source text 4489!:mime text/x-asm 44900 regex \^[\040\t]{0,50}\\.type assembler source text 4491!:mime text/x-asm 4492 4493#------------------------------------------------------------------------------ 4494# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 4495# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 4496# strings as "long" - we assume they're just strings: 4497# From: guy@netapp.com (Guy Harris) 4498# 44990 string *STA Aster*x 4500>7 string WORD Words Document 4501>7 string GRAP Graphic 4502>7 string SPRE Spreadsheet 4503>7 string MACR Macro 45040 string 2278 Aster*x Version 2 4505>29 byte 0x36 Words Document 4506>29 byte 0x35 Graphic 4507>29 byte 0x32 Spreadsheet 4508>29 byte 0x38 Macro 4509 4510 4511#------------------------------------------------------------------------------ 4512# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $ 4513# att3b: file(1) magic for AT&T 3B machines 4514# 4515# The `versions' should be un-commented if they work for you. 4516# (Was the problem just one of endianness?) 4517# 4518# 3B20 4519# 4520# The 3B20 conflicts with SCCS. 4521#0 beshort 0550 3b20 COFF executable 4522#>12 belong >0 not stripped 4523#>22 beshort >0 - version %d 4524#0 beshort 0551 3b20 COFF executable (TV) 4525#>12 belong >0 not stripped 4526#>22 beshort >0 - version %d 4527# 4528# WE32K 4529# 45300 beshort 0560 WE32000 COFF 4531>18 beshort ^00000020 object 4532>18 beshort &00000020 executable 4533>12 belong >0 not stripped 4534>18 beshort ^00010000 N/A on 3b2/300 w/paging 4535>18 beshort &00020000 32100 required 4536>18 beshort &00040000 and MAU hardware required 4537>20 beshort 0407 (impure) 4538>20 beshort 0410 (pure) 4539>20 beshort 0413 (demand paged) 4540>20 beshort 0443 (target shared library) 4541>22 beshort >0 - version %d 45420 beshort 0561 WE32000 COFF executable (TV) 4543>12 belong >0 not stripped 4544#>18 beshort &00020000 - 32100 required 4545#>18 beshort &00040000 and MAU hardware required 4546#>22 beshort >0 - version %d 4547# 4548# core file for 3b2 45490 string \000\004\036\212\200 3b2 core file 4550>364 string >\0 of '%s' 4551 4552#------------------------------------------------------------------------------ 4553# $File: audio,v 1.120 2021/02/23 00:51:10 christos Exp $ 4554# audio: file(1) magic for sound formats (see also "iff") 4555# 4556# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 4557# and others 4558# 4559 4560# Sun/NeXT audio data 45610 string .snd Sun/NeXT audio data: 4562>12 belong 1 8-bit ISDN mu-law, 4563!:mime audio/basic 4564>12 belong 2 8-bit linear PCM [REF-PCM], 4565!:mime audio/basic 4566>12 belong 3 16-bit linear PCM, 4567!:mime audio/basic 4568>12 belong 4 24-bit linear PCM, 4569!:mime audio/basic 4570>12 belong 5 32-bit linear PCM, 4571!:mime audio/basic 4572>12 belong 6 32-bit IEEE floating point, 4573!:mime audio/basic 4574>12 belong 7 64-bit IEEE floating point, 4575!:mime audio/basic 4576>12 belong 8 Fragmented sample data, 4577>12 belong 10 DSP program, 4578>12 belong 11 8-bit fixed point, 4579>12 belong 12 16-bit fixed point, 4580>12 belong 13 24-bit fixed point, 4581>12 belong 14 32-bit fixed point, 4582>12 belong 18 16-bit linear with emphasis, 4583>12 belong 19 16-bit linear compressed, 4584>12 belong 20 16-bit linear with emphasis and compression, 4585>12 belong 21 Music kit DSP commands, 4586>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4587!:mime audio/x-adpcm 4588>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4589>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4590>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4591>12 belong 27 8-bit A-law (CCITT G.711), 4592>20 belong 1 mono, 4593>20 belong 2 stereo, 4594>20 belong 4 quad, 4595>16 belong >0 %d Hz 4596 4597# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 4598# that uses little-endian encoding and has a different magic number 45990 lelong 0x0064732E DEC audio data: 4600>12 lelong 1 8-bit ISDN mu-law, 4601!:mime audio/x-dec-basic 4602>12 lelong 2 8-bit linear PCM [REF-PCM], 4603!:mime audio/x-dec-basic 4604>12 lelong 3 16-bit linear PCM, 4605!:mime audio/x-dec-basic 4606>12 lelong 4 24-bit linear PCM, 4607!:mime audio/x-dec-basic 4608>12 lelong 5 32-bit linear PCM, 4609!:mime audio/x-dec-basic 4610>12 lelong 6 32-bit IEEE floating point, 4611!:mime audio/x-dec-basic 4612>12 lelong 7 64-bit IEEE floating point, 4613!:mime audio/x-dec-basic 4614>12 belong 8 Fragmented sample data, 4615>12 belong 10 DSP program, 4616>12 belong 11 8-bit fixed point, 4617>12 belong 12 16-bit fixed point, 4618>12 belong 13 24-bit fixed point, 4619>12 belong 14 32-bit fixed point, 4620>12 belong 18 16-bit linear with emphasis, 4621>12 belong 19 16-bit linear compressed, 4622>12 belong 20 16-bit linear with emphasis and compression, 4623>12 belong 21 Music kit DSP commands, 4624>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4625!:mime audio/x-dec-basic 4626>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4627>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4628>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4629>12 belong 27 8-bit A-law (CCITT G.711), 4630>20 lelong 1 mono, 4631>20 lelong 2 stereo, 4632>20 lelong 4 quad, 4633>16 lelong >0 %d Hz 4634 4635# Creative Labs AUDIO stuff 46360 string MThd Standard MIDI data 4637!:mime audio/midi 4638>8 beshort x (format %d) 4639>10 beshort x using %d track 4640>10 beshort >1 \bs 4641>12 beshort&0x7fff x at 1/%d 4642>12 beshort&0x8000 >0 SMPTE 4643 46440 string CTMF Creative Music (CMF) data 4645!:mime audio/x-unknown 46460 string SBI SoundBlaster instrument data 4647!:mime audio/x-unknown 46480 string Creative\ Voice\ File Creative Labs voice data 4649!:mime audio/x-unknown 4650# is this next line right? it came this way... 4651>19 byte 0x1A 4652>23 byte >0 - version %d 4653>22 byte >0 \b.%d 4654 4655# first entry is also the string "NTRK" 46560 belong 0x4e54524b MultiTrack sound data 4657>4 belong x - version %d 4658 4659# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 4660# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 46610 string EMOD Extended MOD sound data, 4662>4 byte&0xf0 x version %d 4663>4 byte&0x0f x \b.%d, 4664>45 byte x %d instruments 4665>83 byte 0 (module) 4666>83 byte 1 (song) 4667 4668# Real Audio (Magic .ra\0375) 46690 belong 0x2e7261fd RealAudio sound file 4670!:mime audio/x-pn-realaudio 46710 string .RMF\0\0\0 RealMedia file 4672!:mime application/vnd.rn-realmedia 4673#video/x-pn-realvideo 4674#video/vnd.rn-realvideo 4675#application/vnd.rn-realmedia 4676# sigh, there are many mimes for that but the above are the most common. 4677 4678# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 4679# Oct 31, 1995 4680# fixed by <doj@cubic.org> 2003-06-24 4681# Too short... 4682#0 string MTM MultiTracker Module sound file 4683#0 string if Composer 669 Module sound data 4684#0 string JN Composer 669 Module sound data (extended format) 46850 string MAS_U ULT(imate) Module sound data 4686 4687#0 string FAR Module sound data 4688#>4 string >\15 Title: "%s" 4689 46900x2c string SCRM ScreamTracker III Module sound data 4691>0 string >\0 Title: "%s" 4692!:mime audio/x-s3m 4693 4694# .stm before it got above .s3m extension 46950x16 string \!Scream\! ScreamTracker Module sound data 4696>0 string >\0 Title: "%s" 4697 4698# Gravis UltraSound patches 4699# From <ache@nagual.ru> 4700 47010 string GF1PATCH110\0ID#000002\0 GUS patch 47020 string GF1PATCH100\0ID#000002\0 Old GUS patch 4703 4704# mime types according to http://www.geocities.com/nevilo/mod.htm: 4705# audio/it .it 4706# audio/x-zipped-it .itz 4707# audio/xm fasttracker modules 4708# audio/x-s3m screamtracker modules 4709# audio/s3m screamtracker modules 4710# audio/x-zipped-mod mdz 4711# audio/mod mod 4712# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 4713 4714# 4715# Taken from loader code from mikmod version 2.14 4716# by Steve McIntyre (stevem@chiark.greenend.org.uk) 4717# <doj@cubic.org> added title printing on 2003-06-24 47180 string MAS_UTrack_V00 4719>14 string >/0 ultratracker V1.%.1s module sound data 4720!:mime audio/x-mod 4721#audio/x-tracker-module 4722 47230 string UN05 MikMod UNI format module sound data 4724 47250 string Extended\ Module: Fasttracker II module sound data 4726!:mime audio/x-mod 4727#audio/x-tracker-module 4728>17 string >\0 Title: "%s" 4729 473021 string/c =!SCREAM! Screamtracker 2 module sound data 4731!:mime audio/x-mod 4732#audio/x-screamtracker-module 473321 string BMOD2STM Screamtracker 2 module sound data 4734!:mime audio/x-mod 4735#audio/x-screamtracker-module 47361080 string M.K. 4-channel Protracker module sound data 4737!:mime audio/x-mod 4738#audio/x-protracker-module 4739>0 string >\0 Title: "%s" 47401080 string M!K! 4-channel Protracker module sound data 4741!:mime audio/x-mod 4742#audio/x-protracker-module 4743>0 string >\0 Title: "%s" 47441080 string FLT4 4-channel Startracker module sound data 4745!:mime audio/x-mod 4746#audio/x-startracker-module 4747>0 string >\0 Title: "%s" 47481080 string FLT8 8-channel Startracker module sound data 4749!:mime audio/x-mod 4750#audio/x-startracker-module 4751>0 string >\0 Title: "%s" 47521080 string 4CHN 4-channel Fasttracker module sound data 4753!:mime audio/x-mod 4754#audio/x-fasttracker-module 4755>0 string >\0 Title: "%s" 47561080 string 6CHN 6-channel Fasttracker module sound data 4757!:mime audio/x-mod 4758#audio/x-fasttracker-module 4759>0 string >\0 Title: "%s" 47601080 string 8CHN 8-channel Fasttracker module sound data 4761!:mime audio/x-mod 4762#audio/x-fasttracker-module 4763>0 string >\0 Title: "%s" 47641080 string CD81 8-channel Octalyser module sound data 4765!:mime audio/x-mod 4766#audio/x-octalysertracker-module 4767>0 string >\0 Title: "%s" 47681080 string OKTA 8-channel Octalyzer module sound data 4769!:mime audio/x-mod 4770#audio/x-octalysertracker-module 4771>0 string >\0 Title: "%s" 4772# Not good enough. 4773#1082 string CH 4774#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 47751080 string 16CN 16-channel Taketracker module sound data 4776!:mime audio/x-mod 4777#audio/x-taketracker-module 4778>0 string >\0 Title: "%s" 47791080 string 32CN 32-channel Taketracker module sound data 4780!:mime audio/x-mod 4781#audio/x-taketracker-module 4782>0 string >\0 Title: "%s" 4783 4784# TOC sound files -Trevor Johnson <trevor@jpj.net> 4785# 47860 string TOC TOC sound file 4787 4788# sidfiles <pooka@iki.fi> 4789# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 47900 string SIDPLAY\ INFOFILE Sidplay info file 4791 47920 string PSID PlaySID v2.2+ (AMIGA) sidtune 4793>4 beshort >0 w/ header v%d, 4794>14 beshort =1 single song, 4795>14 beshort >1 %d songs, 4796>16 beshort >0 default song: %d 4797>0x16 string >\0 name: "%s" 4798>0x36 string >\0 author: "%s" 4799>0x56 string >\0 copyright: "%s" 4800 48010 string RSID RSID sidtune PlaySID compatible 4802>4 beshort >0 w/ header v%d, 4803>14 beshort =1 single song, 4804>14 beshort >1 %d songs, 4805>16 beshort >0 default song: %d 4806>0x16 string >\0 name: "%s" 4807>0x36 string >\0 author: "%s" 4808>0x56 string >\0 copyright: "%s" 4809 4810# IRCAM sound files - Michael Pruett <michael@68k.org> 4811# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 48120 belong 0x64a30100 IRCAM file (VAX little-endian) 48130 belong 0x0001a364 IRCAM file (VAX big-endian) 48140 belong 0x64a30200 IRCAM file (Sun big-endian) 48150 belong 0x0002a364 IRCAM file (Sun little-endian) 48160 belong 0x64a30300 IRCAM file (MIPS little-endian) 48170 belong 0x0003a364 IRCAM file (MIPS big-endian) 48180 belong 0x64a30400 IRCAM file (NeXT big-endian) 48190 belong 0x64a30400 IRCAM file (NeXT big-endian) 48200 belong 0x0004a364 IRCAM file (NeXT little-endian) 4821 4822# NIST SPHERE <mpruett@sgi.com> 48230 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 4824 4825# Sample Vision <mpruett@sgi.com> 48260 string SOUND\ SAMPLE\ DATA\ Sample Vision file 4827 4828# Audio Visual Research <tonigonenstein@users.sourceforge.net> 48290 string 2BIT Audio Visual Research file, 4830>12 beshort =0 mono, 4831>12 beshort =-1 stereo, 4832>14 beshort x %d bits 4833>16 beshort =0 unsigned, 4834>16 beshort =-1 signed, 4835>22 belong&0x00ffffff x %d Hz, 4836>18 beshort =0 no loop, 4837>18 beshort =-1 loop, 4838>21 ubyte <128 note %d, 4839>22 byte =0 replay 5.485 KHz 4840>22 byte =1 replay 8.084 KHz 4841>22 byte =2 replay 10.971 KHz 4842>22 byte =3 replay 16.168 KHz 4843>22 byte =4 replay 21.942 KHz 4844>22 byte =5 replay 32.336 KHz 4845>22 byte =6 replay 43.885 KHz 4846>22 byte =7 replay 47.261 KHz 4847 4848# SGI SoundTrack <mpruett@sgi.com> 48490 string _SGI_SoundTrack SGI SoundTrack project file 4850# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 48510 string ID3 Audio file with ID3 version 2 4852>3 byte x \b.%d 4853>4 byte x \b.%d 4854>>5 byte &0x80 \b, unsynchronized frames 4855>>5 byte &0x40 \b, extended header 4856>>5 byte &0x20 \b, experimental 4857>>5 byte &0x10 \b, footer present 4858>(6.I+10) indirect x \b, contains: 4859 4860# NSF (NES sound file) magic 48610 string NESM\x1a NES Sound File 4862>14 string >\0 ("%s" by 4863>46 string >\0 %s, copyright 4864>78 string >\0 %s), 4865>5 byte x version %d, 4866>6 byte x %d tracks, 4867>122 byte&0x2 =1 dual PAL/NTSC 4868>122 byte&0x1 =1 PAL 4869>122 byte&0x1 =0 NTSC 4870 4871# NSFE (Extended NES sound file) magic 4872# http://slickproductions.org/docs/NSF/nsfespec.txt 4873# From: David Pflug <david@pflug.email> 48740 string NSFE Extended NES Sound File 4875>48 search/0x1000 auth 4876>>&0 string >\0 ("%s" 4877>>>&1 string >\0 by %s 4878>>>>&1 string >\0 \b, copyright %s 4879>>>>>&1 string >\0 \b, ripped by %s 4880>20 byte x \b), %d tracks, 4881>18 byte&0x2 =1 dual PAL/NTSC 4882>18 byte&0x2 =0 4883>>18 byte&0x1 =1 PAL 4884>>18 byte&0x1 =0 NTSC 4885 4886# Type: SNES SPC700 sound files 4887# From: Josh Triplett <josh@freedesktop.org> 48880 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 4889>&0 string 0.30 \b, version %s 4890>>0x23 byte 0x1B \b, without ID666 tag 4891>>0x23 byte 0x1A \b, with ID666 tag 4892>>>0x2E string >\0 \b, song "%.32s" 4893>>>0x4E string >\0 \b, game "%.32s" 4894 4895# Impulse tracker module (audio/x-it) 48960 string IMPM Impulse Tracker module sound data - 4897!:mime audio/x-mod 4898>4 string >\0 "%s" 4899>40 leshort !0 compatible w/ITv%x 4900>42 leshort !0 created w/ITv%x 4901 4902# Imago Orpheus module (audio/x-imf) 490360 string IM10 Imago Orpheus module sound data - 4904>0 string >\0 "%s" 4905 4906# From <collver1@attbi.com> 4907# These are the /etc/magic entries to decode modules, instruments, and 4908# samples in Impulse Tracker's native format. 4909 49100 string IMPS Impulse Tracker Sample 4911>18 byte &2 16 bit 4912>18 byte ^2 8 bit 4913>18 byte &4 stereo 4914>18 byte ^4 mono 49150 string IMPI Impulse Tracker Instrument 4916>28 leshort !0 ITv%x 4917>30 byte !0 %d samples 4918 4919# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 4920# From <collver1@attbi.com> 49210 string LM8953 Yamaha TX Wave 4922>22 byte 0x49 looped 4923>22 byte 0xC9 non-looped 4924>23 byte 1 33kHz 4925>23 byte 2 50kHz 4926>23 byte 3 16kHz 4927 4928# scream tracker: file(1) magic for Scream Tracker sample files 4929# 4930# From <collver1@attbi.com> 493176 string SCRS Scream Tracker Sample 4932>0 byte 1 sample 4933>0 byte 2 adlib melody 4934>0 byte >2 adlib drum 4935>31 byte &2 stereo 4936>31 byte ^2 mono 4937>31 byte &4 16bit little endian 4938>31 byte ^4 8bit 4939>30 byte 0 unpacked 4940>30 byte 1 packed 4941 4942# audio 4943# From: Cory Dikkers <cdikkers@swbell.net> 49440 string MMD0 MED music file, version 0 49450 string MMD1 OctaMED Pro music file, version 1 49460 string MMD3 OctaMED Soundstudio music file, version 3 49470 string OctaMEDCmpr OctaMED Soundstudio compressed file 49480 string MED MED_Song 49490 string SymM Symphonie SymMOD music file 4950# 4951# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS) 4952# http://lclevy.free.fr/exotica/ahx/ahxformat.txt 49530 string THX AHX version 4954>3 byte =0 1 module data 4955>3 byte =1 2 module data 4956>10 byte x TRL: %u 4957>11 byte x TRK: %u 4958>12 byte x SMP: %u 4959>13 byte x SS: %u 4960# 49610 string OKTASONG Oktalyzer module data 4962# 49630 string DIGI\ Booster\ module\0 %s 4964>20 byte >0 %c 4965>>21 byte >0 \b%c 4966>>>22 byte >0 \b%c 4967>>>>23 byte >0 \b%c 4968>610 string >\0 \b, "%s" 4969# 49700 string DBM0 DIGI Booster Pro Module 4971>4 byte >0 V%X. 4972>>5 byte x \b%02X 4973>16 string >\0 \b, "%s" 4974# 49750 string FTMN FaceTheMusic module 4976>16 string >\0d \b, "%s" 4977 4978# From: <doj@cubic.org> 2003-06-24 49790 string AMShdr\32 Velvet Studio AMS Module v2.2 49800 string Extreme Extreme Tracker AMS Module v1.3 49810 string DDMF Xtracker DMF Module 4982>4 byte x v%i 4983>0xD string >\0 Title: "%s" 4984>0x2B string >\0 Composer: "%s" 49850 string DSM\32 Dynamic Studio Module DSM 49860 string SONG DigiTrekker DTM Module 49870 string DMDL DigiTrakker MDL Module 49880 string PSM\32 Protracker Studio PSM Module 498944 string PTMF Poly Tracker PTM Module 4990>0 string >\32 Title: "%s" 49910 string MT20 MadTracker 2.0 Module MT2 49920 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 49930 string RTMM RTM Module 49940x426 string MaDoKaN96 XMS Adlib Module 4995>0 string >\0 Composer: "%s" 49960 string AMF AMF Module 4997>4 string >\0 Title: "%s" 49980 string MODINFO1 Open Cubic Player Module Information MDZ 49990 string Extended\40Instrument: Fast Tracker II Instrument 5000 5001# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 5002# NOA Nancy Codec file 50030 string \210NOA\015\012\032 NOA Nancy Codec Movie file 5004# Yamaha SMAF format 50050 string MMMD Yamaha SMAF file 5006# Sharp Jisaku Melody format for PDC 50070 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 5008>20 string Ver01.00 Ver. 1.00 5009>>32 byte x , %d tracks 5010 5011# Free lossless audio codec <http://flac.sourceforge.net> 5012# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 50130 string fLaC FLAC audio bitstream data 5014!:mime audio/flac 5015>4 byte&0x7f >0 \b, unknown version 5016>4 byte&0x7f 0 \b 5017# some common bits/sample values 5018>>20 beshort&0x1f0 0x030 \b, 4 bit 5019>>20 beshort&0x1f0 0x050 \b, 6 bit 5020>>20 beshort&0x1f0 0x070 \b, 8 bit 5021>>20 beshort&0x1f0 0x0b0 \b, 12 bit 5022>>20 beshort&0x1f0 0x0f0 \b, 16 bit 5023>>20 beshort&0x1f0 0x170 \b, 24 bit 5024>>20 byte&0xe 0x0 \b, mono 5025>>20 byte&0xe 0x2 \b, stereo 5026>>20 byte&0xe 0x4 \b, 3 channels 5027>>20 byte&0xe 0x6 \b, 4 channels 5028>>20 byte&0xe 0x8 \b, 5 channels 5029>>20 byte&0xe 0xa \b, 6 channels 5030>>20 byte&0xe 0xc \b, 7 channels 5031>>20 byte&0xe 0xe \b, 8 channels 5032# sample rates derived from known oscillator frequencies; 5033# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and 5034# 16.384 (other/fs=32kHz). 5035>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 5036>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 5037>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 5038>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 5039>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 5040>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 5041>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 5042>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 5043>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz 5044>>17 belong&0xfffff0 0x177000 \b, 96 kHz 5045>>17 belong&0xfffff0 0x1f4000 \b, 128 kHz 5046>>17 belong&0xfffff0 0x2b1100 \b, 176.4 kHz 5047>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz 5048>>17 belong&0xfffff0 0x3e8000 \b, 256 kHz 5049>>17 belong&0xfffff0 0x562200 \b, 352.8 kHz 5050>>17 belong&0xfffff0 0x5dc000 \b, 384 kHz 5051>>21 byte&0xf >0 \b, >4G samples 5052>>21 byte&0xf 0 \b 5053>>>22 belong >0 \b, %u samples 5054>>>22 belong 0 \b, length unknown 5055 5056# (ISDN) VBOX voice message file (Wolfram Kleff) 50570 string VBOX VBOX voice message data 5058 5059# ReBorn Song Files (.rbs) 5060# David J. Singer <doc@deadvirgins.org.uk> 50618 string RB40 RBS Song file 5062>29 string ReBorn created by ReBorn 5063>37 string Propellerhead created by ReBirth 5064 5065# Synthesizer Generator and Kimwitu share their file format 50660 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 5067# Kimwitu++ uses a slightly different magic 50680 string A#S#C#S#S#L#HUB Kimwitu++ data 5069 5070# From "Simon Hosie 50710 string TFMX-SONG TFMX module sound data 5072 5073# Monkey's Audio compressed audio format (.ape) 5074# From danny.milo@gmx.net (Danny Milosavljevic) 5075# New version from Abel Cheung <abel (@) oaka.org> 50760 string MAC\040 Monkey's Audio compressed format 5077!:mime audio/x-ape 5078>4 uleshort >0x0F8B version %d 5079>>(0x08.l) uleshort =1000 with fast compression 5080>>(0x08.l) uleshort =2000 with normal compression 5081>>(0x08.l) uleshort =3000 with high compression 5082>>(0x08.l) uleshort =4000 with extra high compression 5083>>(0x08.l) uleshort =5000 with insane compression 5084>>(0x08.l+18) uleshort =1 \b, mono 5085>>(0x08.l+18) uleshort =2 \b, stereo 5086>>(0x08.l+20) ulelong x \b, sample rate %d 5087>4 uleshort <0x0F8C version %d 5088>>6 uleshort =1000 with fast compression 5089>>6 uleshort =2000 with normal compression 5090>>6 uleshort =3000 with high compression 5091>>6 uleshort =4000 with extra high compression 5092>>6 uleshort =5000 with insane compression 5093>>10 uleshort =1 \b, mono 5094>>10 uleshort =2 \b, stereo 5095>>12 ulelong x \b, sample rate %d 5096 5097# adlib sound files 5098# From: Alex Myczko <alex@aiei.ch> 5099 5100# https://github.com/rerrahkr/BambooTracker 51010 string BambooTrackerMod BambooTracker module 5102>22 byte x \b, version %u 5103>21 byte x \b.%u 5104>20 byte x \b.%u 5105 51060 string BambooTrackerIst BambooTracker instrument 5107>22 byte x \b, version %u 5108>21 byte x \b.%u 5109>20 byte x \b.%u 5110 51110 string CC2x CheeseCutter 2 song 5112 51130 string RAWADATA RdosPlay RAW 5114 51151068 string RoR AMUSIC Adlib Tracker 5116 51170 string JCH EdLib 5118 51190 string mpu401tr MPU-401 Trakker 5120 51210 string SAdT Surprise! Adlib Tracker 5122>4 byte x Version %d 5123 51240 string XAD! eXotic ADlib 5125 51260 string ofTAZ! eXtra Simple Music 5127 51280 string FMK! FM Kingtracker Song 5129 51300 string DFM DFM Song 5131 51320 string \<CUD-FM-File\> CFF Song 5133 51340 string _A2module A2M Song 5135 5136# Spectrum 128 tunes (.ay files). 5137# From: Emanuel Haupt <ehaupt@critical.ch> 51380 string ZXAYEMUL Spectrum 128 tune 5139 51400 string \0BONK BONK, 5141#>5 byte x version %d 5142>14 byte x %d channel(s), 5143>15 byte =1 lossless, 5144>15 byte =0 lossy, 5145>16 byte x mid-side 5146 5147384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 5148 5149# format VQF (proprietary codec for sound) 5150# some infos on the header file available at : 5151# http://www.twinvq.org/english/technology_format.html 51520 string TWIN97012000 VQF data 5153>27 short 0 \b, Mono 5154>27 short 1 \b, Stereo 5155>31 short >0 \b, %d kbit/s 5156>35 short >0 \b, %d kHz 5157 5158# Nelson A. de Oliveira (naoliv@gmail.com) 5159# .eqf 51600 string Winamp\ EQ\ library\ file %s 5161# it will match only versions like v<digit>.<digit> 5162# Since I saw only eqf files with version v1.1 I think that it's OK 5163>23 string x \b%.4s 5164# .preset 51650 string [Equalizer\ preset] XMMS equalizer preset 5166# .m3u 51670 search/1 #EXTM3U M3U playlist text 5168# .pls 51690 search/1 [playlist] PLS playlist text 5170# licq.conf 51711 string [licq] LICQ configuration file 5172 5173# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 5174# NOTE: Most SNDH music is packed using ICE, which has 5175# magic numbers "ICE!" and "Ice!". Some SNDH music is 5176# not packed, so we check for both packed and unpacked. 517712 string SNDH SNDH Atari ST music 51780 belong&0xFFDFDFFF 0x49434521 5179>14 search/40 NDH SNDH Atari ST music 5180>14 search/40 TITL SNDH Atari ST music 51810 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 5182 5183# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 51840 string MP+ Musepack audio (MP+) 5185!:mime audio/x-musepack 5186>3 byte 255 \b, SV pre8 5187>3 byte&0xF 0x6 \b, SV 6 5188>3 byte&0xF 0x8 \b, SV 8 5189>3 byte&0xF 0x7 \b, SV 7 5190>>3 byte&0xF0 0x0 \b.0 5191>>3 byte&0xF0 0x10 \b.1 5192>>3 byte&0xF0 240 \b.15 5193>>10 byte&0xF0 0x0 \b, no profile 5194>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 5195>>10 byte&0xF0 0x50 \b, quality 0 5196>>10 byte&0xF0 0x60 \b, quality 1 5197>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 5198>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 5199>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 5200>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 5201>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 5202>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 5203>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 5204>>10 byte&0xF0 0xE0 \b, quality 9 5205>>10 byte&0xF0 0xF0 \b, quality 10 5206>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 5207>>27 byte 102 \b, Beta 1.02 5208>>27 byte 104 \b, Beta 1.04 5209>>27 byte 105 \b, Alpha 1.05 5210>>27 byte 106 \b, Beta 1.06 5211>>27 byte 110 \b, Release 1.1 5212>>27 byte 111 \b, Alpha 1.11 5213>>27 byte 112 \b, Beta 1.12 5214>>27 byte 113 \b, Alpha 1.13 5215>>27 byte 114 \b, Beta 1.14 5216>>27 byte 115 \b, Alpha 1.15 5217 52180 string MPCK Musepack audio (MPCK) 5219!:mime audio/x-musepack 5220 5221# IMY 5222# from http://filext.com/detaillist.php?extdetail=IMY 5223# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 5224# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 5225# http://www.wx800.com/msg/download/irda/iMelody.pdf 52260 string BEGIN:IMELODY iMelody Ringtone Format 5227 5228# From: "Mateus Caruccio" <mateus@caruccio.com> 5229# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 52300 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 5231 5232# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 523360 string SONG SoundFX Module sound file 5234 5235# Type: Adaptive Multi-Rate Codec 5236# URL: http://filext.com/detaillist.php?extdetail=AMR 5237# From: Russell Coker <russell@coker.com.au> 52380 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 5239!:mime audio/amr 5240!:ext amr 5241 5242# Type: SuperCollider 3 Synth Definition File Format 5243# From: Mario Lang <mlang@debian.org> 52440 string SCgf SuperCollider3 Synth Definition file, 5245>4 belong x version %d 5246 5247# Type: True Audio Lossless Audio 5248# URL: https://wiki.multimedia.cx/index.php?title=True_Audio 5249# From: Mike Melanson <mike@multimedia.cx> 52500 string TTA1 True Audio Lossless Audio 5251 5252# Type: WavPack Lossless Audio 5253# URL: https://wiki.multimedia.cx/index.php?title=WavPack 5254# From: Mike Melanson <mike@multimedia.cx> 52550 string wvpk WavPack Lossless Audio 5256 5257# From Fabio R. Schmidlin <frs@pop.com.br> 5258# VGM music file 52590 string Vgm\040 5260>9 ubyte >0 VGM Video Game Music dump v 5261!:mime audio/x-vgm 5262!:ext vgm 5263>>9 ubyte/16 >0 \b%d 5264>>9 ubyte&0x0F x \b%d 5265>>8 ubyte/16 x \b.%d 5266>>8 ubyte&0x0F >0 \b%d 5267#Get soundchips 5268>>8 ubyte x \b, soundchip(s)= 5269>>0x0C ulelong >0 SN76489 (PSG), 5270>>0x10 ulelong >0 YM2413 (OPLL), 5271>>0x2C ulelong >0 YM2612 (OPN2), 5272>>0x30 ulelong >0 YM2151 (OPM), 5273>>0x38 ulelong >0 Sega PCM, 5274>>0x34 ulelong >0xC 5275>>>0x40 ulelong >0 RF5C68 (PCM), 5276>>0x34 ulelong >0x10 5277>>>0x44 ulelong >0 YM2203 (OPN), 5278>>0x34 ulelong >0x14 5279>>>0x48 ulelong >0 YM2608 (OPNA), 5280>>0x34 ulelong >0x18 5281>>>0x4C lelong >0 YM2610 (OPNB), 5282>>>0x4C lelong <0 YM2610B (OPNB+2FM), 5283>>0x34 ulelong >0x1C 5284>>>0x50 ulelong >0 YM3812 (OPL2), 5285>>0x34 ulelong >0x20 5286>>>0x54 ulelong >0 YM3526 (OPL), 5287>>0x34 ulelong >0x24 5288>>>0x58 ulelong >0 Y8950 (MSX-Audio), 5289>>0x34 ulelong >0x28 5290>>>0x5C ulelong >0 YMF262 (OPL3), 5291>>0x34 ulelong >0x2C 5292>>>0x60 ulelong >0 YMF278B (OPL4), 5293>>0x34 ulelong >0x30 5294>>>0x64 ulelong >0 YMF271 (OPX), 5295>>0x34 ulelong >0x34 5296>>>0x68 ulelong >0 YMZ280B (PCMD8), 5297>>0x34 ulelong >0x38 5298>>>0x6C ulelong >0 RF5C164 (PCM), 5299>>0x34 ulelong >0x3C 5300>>>0x70 ulelong >0 PWM, 5301>>0x34 ulelong >0x40 5302>>>0x74 ulelong >0 5303>>>>0x78 ubyte 0x00 AY-3-8910, 5304>>>>0x78 ubyte 0x01 AY-3-8912, 5305>>>>0x78 ubyte 0x02 AY-3-8913, 5306>>>>0x78 ubyte 0x03 AY-3-8930, 5307>>>>0x78 ubyte 0x10 YM2149, 5308>>>>0x78 ubyte 0x11 YM3439, 5309>>>>0x78 ubyte 0x12 YMZ284, 5310>>>>0x78 ubyte 0x13 YMZ294, 5311# VGM 1.61 5312>>0x34 ulelong >0x4C 5313>>>0x80 ulelong >0 DMG, 5314>>0x34 ulelong >0x50 5315>>>0x84 lelong >0 NES APU, 5316>>>0x84 lelong <0 NES APU with FDS, 5317>>0x34 ulelong >0x54 5318>>>0x88 ulelong >0 MultiPCM, 5319>>0x34 ulelong >0x58 5320>>>0x8C ulelong >0 uPD7759 (ADPCM Speech), 5321>>0x34 ulelong >0x5C 5322>>>0x90 ulelong >0 OKIM6258 (ADPCM Speech), 5323>>0x34 ulelong >0x64 5324>>>0x98 ulelong >0 OKIM6295 (ADPCM), 5325>>0x34 ulelong >0x68 5326>>>0x9C ulelong >0 K051649, 5327>>0x34 ulelong >0x6C 5328>>>0xA0 ulelong >0 K054539, 5329>>0x34 ulelong >0x70 5330>>>0xA4 ulelong >0 HuC6280, 5331>>0x34 ulelong >0x74 5332>>>0xA8 ulelong >0 C140, 5333>>0x34 ulelong >0x78 5334>>>0xAC ulelong >0 K053260, 5335>>0x34 ulelong >0x7C 5336>>>0xB0 ulelong >0 Pokey, 5337>>0x34 ulelong >0x80 5338>>>0xB4 ulelong >0 QSound, 5339# VGM 1.71 5340>>0x34 ulelong >0x84 5341>>>0xB8 ulelong >0 SCSP, 5342>>0x34 ulelong >0x8C 5343>>>0xC0 ulelong >0 WonderSwan, 5344>>0x34 ulelong >0x90 5345>>>0xC4 ulelong >0 VSU, 5346>>0x34 ulelong >0x94 5347>>>0xC8 ulelong >0 SAA1099, 5348>>0x34 ulelong >0x98 5349>>>0xCC ulelong >0 ES5503 (DOC), 5350>>0x34 ulelong >0x9C 5351>>>0xD0 lelong >0 ES5505 (OTIS), 5352>>>0xD0 lelong <0 ES5506 (OTTO), 5353>>0x34 ulelong >0xA4 5354>>>0xD8 ulelong >0 X1-010, 5355>>0x34 ulelong >0xA8 5356>>>0xDC ulelong >0 C352, 5357>>0x34 ulelong >0xAC 5358>>>0xE0 ulelong >0 GA20, 5359 5360# GVOX Encore file format 5361# Since this is a proprietary file format and there is no publicly available 5362# format specification, this is just based on induction 5363# 53640 string SCOW 5365>4 byte 0xc4 GVOX Encore music, version 5.0 or above 5366>4 byte 0xc2 GVOX Encore music, version < 5.0 5367 53680 string ZBOT 5369>4 byte 0xc5 GVOX Encore music, version < 5.0 5370 5371# Summary: Garmin Voice Processing Module (WAVE audios) 5372# From: Joerg Jenderek 5373# URL: https://www.garmin.com/ 5374# Reference: http://www.poi-factory.com/node/19580 5375# NOTE: there exist 2 other Garmin VPM formats 53760 string AUDIMG 5377# skip text files starting with string "AUDIMG" 5378>13 ubyte <13 Garmin Voice Processing Module 5379!:mime audio/x-vpm-wav-garmin 5380!:ext vpm 5381# 3 bytes indicating the voice version (200,220) 5382>>6 string x \b, version %3.3s 5383# day of release (01-31) 5384>>12 ubyte x \b, %.2d 5385# month of release (01-12) 5386>>13 ubyte x \b.%.2d 5387# year of release (like 2006, 2007, 2008) 5388>>14 uleshort x \b.%.4d 5389# hour of release (0-23) 5390>>11 ubyte x %.2d 5391# minute of release (0-59) 5392>>10 ubyte x \b:%.2d 5393# second of release (0-59) 5394>>9 ubyte x \b:%.2d 5395# if you select a language like german on your garmin device 5396# you can only select voice modules with corresponding language byte ID like 1 5397>>18 ubyte x \b, language ID %d 5398# structure for phrases/sentences? 5399# number of voice sample in the 1st phrase? 5400#>>19 uleshort x \b, 0x%x samples 5401#>>>21 uleshort >0 \b, at 0x%4.4x 5402#>>>(21.s) ubequad x 0x%llx 5403# 2nd phrase? 5404#>>23 uleshort x \b, 0x%x samples 5405#>>>25 uleshort >0 \b, at 0x%4.4x 5406#>>>(25.s) ubequad x 0x%llx 5407# pointer to 1st audio WAV sample 5408>>16 uleshort >0 5409>>>(16.s) ulelong >0 \b, at 0x%x 5410# WAV length 5411# 1 space char after "bytes" to get phrase "bytes RIFF" 5412>>>>(16.s+4) ulelong >0 %u bytes 5413# look for magic 5414>>>>>(&-8.l) string RIFF 5415# determine type by ./riff 5416>>>>>>&-4 indirect x 5417# 2 - ~ 131 WAV samples following same way 5418# 5419# Summary: encrypted Garmin Voice Processing Module 5420# From: Joerg Jenderek 5421# URL: https://www.garmin.com/us/products/ontheroad/voicestudio 5422# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti. 5423# There exist 2 other Garmin VPM formats 54240 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted) 5425!:mime audio/x-vpm-garmin 5426!:ext vpm 5427 5428# From Martin Mueller Skarbiniks Pedersen 54290 string GDM 5430>0x3 byte 0xFE General Digital Music. 5431>0x4 string >\0 title: "%s" 5432>0x24 string >\0 musician: "%s" 5433>>0x44 beshort 0x0D0A 5434>>>0x46 byte 0x1A 5435>>>>0x47 string GMFS Version 5436>>>>0x4B byte x %d. 5437>>>>0x4C byte x \b%02d 5438>>>>0x4D beshort 0x000 (2GDM v 5439>>>>0x4F byte x \b%d. 5440>>>>>0x50 byte x \b%d) 5441 54420 string MTM Multitracker 5443>0x3 byte/16 x Version %d. 5444>0x3 byte&0x0F x \b%02d 5445>>0x4 string >\0 title: "%s" 5446 54470 string HVL 5448>3 byte <2 Hively Tracker Song 5449>3 byte 0 1 module data 5450>3 byte 1 2 module data 5451 54520 string MO3 5453>3 ubyte <6 MOdule with MP3 5454>>3 byte 0 Version 0 (With MP3 and lossless) 5455>>3 byte 1 Version 1 (With ogg and lossless) 5456>>3 byte 3 Version 2.2 5457>>3 byte 4 (With no LAME header) 5458>>3 byte 5 Version 2.4 5459 54600 string ADRVPACK AProSys module 5461 5462# ftp://ftp.modland.com/pub/documents/format_documentation/\ 5463# Art%20Of%20Noise%20(.aon).txt 54640 string AON 5465>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)" 5466>0x2e string NAME Art of Noise Tracker Song 5467>3 string <9 5468>3 string 4 (4 voices) 5469>3 string 8 (8 voices) 5470>>0x36 string >\0 Title: "%s" 5471 54720 string FAR 5473>0x2c byte 0x0d 5474>0x2d byte 0x0a 5475>0x2e byte 0x1a 5476>>0x3 byte 0xFE Farandole Tracker Song 5477>>>0x31 byte/16 x Version %d. 5478>>>0x31 byte&0x0F x \b%02d 5479>>>>0x4 string >\0 \b, title: "%s" 5480 5481# magic for Klystrack, https://kometbomb.github.io/klystrack/ 5482# from Alex Myczko <alex@aiei.ch> 54830 string cyd!song Klystrack song 5484>8 byte >0 \b, version %u 5485>8 byte >26 5486#>>9 byte x \b, channels %u 5487#>>10 leshort x \b, time signature %u 5488#>>12 leshort x \b, sequence step %u 5489#>>14 byte x \b, instruments %u 5490#>>15 leshort x \b, patterns %u 5491#>>17 leshort x \b, sequences %u 5492#>>19 leshort x \b, length %u 5493#>>21 leshort x \b, loop point %u 5494#>>23 byte x \b, master volume %u 5495#>>24 byte x \b, song speed %u 5496#>>25 byte x \b, song speed2 %u 5497#>>26 byte x \b, song rate %u 5498#>>27 belong x \b, flags %#x 5499#>>31 byte x \b, multiplex period %u 5500#>>32 byte x \b, pitch inaccuracy %u 5501>>149 pstring x \b, title %s 5502 55030 string cyd!inst Klystrack instrument 5504 5505# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor 5506# see Specifications/WOPL-and-OPLI-Specification.txt 5507 55080 string WOPL3-INST\0 WOPL instrument 5509>11 leshort x \b, version %u 55100 string WOPL3-BANK\0 WOPL instrument bank 5511>11 leshort x \b, version %u 5512 5513# AdLib/OPL instrument files. Format specifications on 5514# http://www.shikadi.net/moddingwiki 55150 string Junglevision\ Patch\ File Junglevision instrument data 55160 string #OPL_II# DMX OP2 instrument data 55170 string IBK\x1a IBK instrument data 55180 string 2OP\x1a IBK instrument data, 2 operators 55190 string 4OP\x1a IBK instrument data, 4 operators 55202 string ADLIB- AdLib instrument data 5521>0 byte x \b, version %u 5522>1 byte x \b.%u 5523 5524# CRI ADX ADPCM audio 5525# Used by various Sega games. 5526# https://en.wikipedia.org/wiki/ADX_(file_format) 5527# https://wiki.multimedia.cx/index.php/CRI_ADX_file 5528# Added by David Korth <gerbilsoft@gerbilsoft.com> 55290x00 beshort 0x8000 5530>(2.S-2) string (c)CRI CRI ADX ADPCM audio 5531!:ext adx 5532!:mime audio/x-adx 5533!:strength +50 5534>>0x12 byte x v%u 5535>>0x04 byte 0x02 \b, pre-set prediction coefficients 5536>>0x04 byte 0x03 \b, standard ADX 5537>>0x04 byte 0x04 \b, exponential scale 5538>>0x04 byte 0x10 \b, AHX (Dreamcast) 5539>>0x04 byte 0x11 \b, AHX 5540>>0x08 belong x \b, %u Hz 5541>>0x12 byte 0x03 5542>>>0x02 beshort >0x2B 5543>>>>0x18 belong !0 \b, looping 5544>>0x12 byte 0x04 5545>>>0x02 beshort >0x37 5546>>>>0x24 belong !0 \b, looping 5547>>0x13 byte&0x08 0x08 \b, encrypted 5548 5549# Lossless audio (.la) (http://www.lossless-audio.com/) 55500 string LA 5551>2 string 03 Lossless audio version 0.3 5552>2 string 04 Lossless audio version 0.4 5553 5554# Sony PlayStation Audio (.xa) 55550 leshort 0x4158 Sony PlayStation Audio 5556 5557# Portable Sound Format 5558# Used for audio rips for various consoles. 5559# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format 5560# Added by David Korth <gerbilsoft@gerbilsoft.com> 55610 string PSF 5562>3 byte 0x01 5563>3 byte 0x02 5564>3 byte 0x11 5565>3 byte 0x12 5566>3 byte 0x13 5567>3 byte 0x21 5568>3 byte 0x22 5569>3 byte 0x23 5570>3 byte 0x41 5571>>0 string PSF Portable Sound Format 5572!:mime audio/x-psf 5573>>>3 byte 0x01 (Sony PlayStation) 5574>>>3 byte 0x02 (Sony PlayStation 2) 5575>>>3 byte 0x11 (Sega Saturn) 5576>>>3 byte 0x12 (Sega Dreamcast) 5577>>>3 byte 0x13 (Sega Mega Drive) 5578>>>3 byte 0x21 (Nintendo 64) 5579>>>3 byte 0x22 (Game Boy Advance) 5580>>>3 byte 0x23 (Super NES) 5581>>>3 byte 0x41 (Capcom QSound) 5582 5583# Atari 8-bit SAP audio format 5584# http://asap.sourceforge.net/sap-format.html 5585# Added by David Korth <gerbilsoft@gerbilsoft.com> 55860 string SAP\r\n Atari 8-bit SAP audio file 5587!:mime audio/x-sap 5588!:ext sap 5589>5 search/1024 NAME 5590>>&1 string x \b: %s 5591>>5 search/1024 AUTHOR 5592>>>&1 string x by %s 5593 5594# Nintendo Wii BRSTM audio format (fields) 5595# NOTE: Assuming HEAD starts at 0x40. 5596# FIXME: Replace 0x48 with HEAD offset plus 8. 55970 name nintendo-wii-brstm-fields 5598>(0x10.L) string HEAD \b: 5599>>(0x10.L+0x0C) belong x 5600>>>(&-4.L+0x48) belong x 5601>>>>&-4 byte 0 PCM, signed 8-bit, 5602>>>>&-4 byte 1 PCM, signed 16-bit, 5603>>>>&-4 byte 2 THP ADPCM, 5604>>>>&-3 byte !0 looping, 5605>>>>&-2 byte 1 mono 5606>>>>&-2 byte 2 stereo 5607>>>>&-2 byte 3 3 channels 5608>>>>&-2 byte 4 quad 5609>>>>&-2 byte >4 %u channels 5610>>>>&0 beshort !0 %u Hz 5611 5612# Nintendo Wii BRSTM audio format 5613# https://wiibrew.org/wiki/BRSTM_file 5614# Added by David Korth <gerbilsoft@gerbilsoft.com> 56150 string RSTM Nintendo Wii BRSTM audio file 5616!:mime audio/x-brstm 5617!:ext brstm 5618# Wii is big-endian, so default to BE. 5619>4 beshort 0xFEFF 5620>>0 use nintendo-wii-brstm-fields 5621>4 leshort 0xFEFF 5622>>0 use \^nintendo-wii-brstm-fields 5623 5624# Nintendo 3DS BCSTM audio format (fields) 56250 name nintendo-3ds-bcstm-fields 5626>(0x18.l) string INFO \b: 5627# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic) 5628>>&0x1C byte 0 PCM, signed 8-bit, 5629>>&0x1C byte 1 PCM, signed 16-bit, 5630>>&0x1C byte 2 DSP ADPCM, 5631>>&0x1C byte 3 IMA ADPCM, 5632>>&0x1D byte !0 looping, 5633>>&0x1E byte 1 mono 5634>>&0x1E byte 2 stereo 5635>>&0x1E byte 3 3 channels 5636>>&0x1E byte 4 quad 5637>>&0x1E byte >4 %u channels 5638>>&0x20 lelong !0 %u Hz 5639 5640# Nintendo 3DS BCSTM audio format 5641# https://www.3dbrew.org/wiki/BCSTM 5642# Added by David Korth <gerbilsoft@gerbilsoft.com> 56430 string CSTM Nintendo 3DS BCSTM audio file 5644!:mime audio/x-bcstm 5645!:ext bcstm 5646# 3DS is little-endian, so default to LE. 5647>4 leshort 0xFEFF 5648>>0 use nintendo-3ds-bcstm-fields 5649>4 beshort 0xFEFF 5650>>0 use \^nintendo-3ds-bcstm-fields 5651 5652# Nintendo Wii U BFSTM audio format 5653# http://mk8.tockdom.com/wiki/BFSTM_(File_Format) 5654# NOTE: This format is very similar to BCSTM. 5655# Added by David Korth <gerbilsoft@gerbilsoft.com> 56560 string FSTM Nintendo Wii U BFSTM audio file 5657!:mime audio/x-bfstm 5658!:ext bfstm 5659# BFSTM is used on both Wii U (BE) and Switch (LE), 5660# so default to LE. 5661>4 leshort 0xFEFF 5662>>0 use nintendo-3ds-bcstm-fields 5663>4 beshort 0xFEFF 5664>>0 use \^nintendo-3ds-bcstm-fields 5665 5666# Nintendo 3DS BCSTM audio format (fields) 56670 name nintendo-3ds-bcwav-fields 5668>(0x18.l) string INFO \b: 5669# INFO block (minus 4 for INFO magic) 5670>>&0x4 byte 0 PCM, signed 8-bit, 5671>>&0x4 byte 1 PCM, signed 16-bit, 5672>>&0x4 byte 2 DSP ADPCM, 5673>>&0x4 byte 3 IMA ADPCM, 5674>>&0x5 byte !0 looping, 5675>>&0x8 lelong x stereo 5676>>&0x8 lelong !0 %u Hz 5677 5678# Nintendo 3DS BCWAV audio format 5679# https://www.3dbrew.org/wiki/BCWAV 5680# Added by David Korth <gerbilsoft@gerbilsoft.com> 56810 string CWAV Nintendo 3DS BCWAV audio file 5682!:mime audio/x-bcwav 5683!:ext bcwav 5684# 3DS is little-endian, so default to LE. 5685>4 leshort 0xFEFF 5686>>0 use nintendo-3ds-bcwav-fields 5687>4 beshort 0xFEFF 5688>>0 use \^nintendo-3ds-bcwav-fields 5689 5690#------------------------------------------------------------------------------ 5691# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $ 5692# avm: file(1) magic for avm files; this is not use 5693 5694# Summary: FRITZ!Box router configuration backup 5695# From: Joerg Jenderek 5696# URL: https://en.wikipedia.org/wiki/Fritz!Box 5697# Reference: http://www.mengelke.de/Projekte/FritzBoxTools2 5698# Note: only tested with models 4040 and 6490 Cable (lgi) 56990 string ****\ FRITZ!Box\ FRITZ!Box configuration backup 5700#!:mime text/plain 5701!:mime application/x-avm-export 5702!:ext export 5703# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT" 5704>15 string x of %-.4s 5705# on 2nd line hashed password 5706#>41 search/54 Password= \b, password 5707# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83 5708>41 search/172 FirmwareVersion= \b, firmware version 5709>>&0 string x %s 5710# on 5th line oem like: avme lgi 5711>41 search/285 OEM= \b, oem 5712>>&0 string x %s 5713# on 7th line language like: de en 5714>41 search/305 Language= \b, language 5715>>&0 string x %s 5716# on 10th line cfg file name like: /var/tmp.cfg 5717>41 search/349 tmp.cfg 5718# on 11th line date inside c-comment like: Thu Jun 4 22:25:19 2015 5719>>&4 string x \b, %s 5720# 5721 5722 5723#---------------------------------------------------------------- 5724# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $ 5725# basis: file(1) magic for BBx/Pro5-files 5726# Oliver Dammer <dammer@olida.de> 2005/11/07 5727# https://www.basis.com business-basic-files. 5728# 57290 string \074\074bbx\076\076 BBx 5730>7 string \000 indexed file 5731>7 string \001 serial file 5732>7 string \002 keyed file 5733>>13 short 0 (sort) 5734>7 string \004 program 5735>>18 byte x (LEVEL %d) 5736>>>23 string >\000 psaved 5737>7 string \006 mkeyed file 5738>>13 short 0 (sort) 5739>>8 string \000 (mkey) 5740#------------------------------------------------------------------------------ 5741# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $ 5742# beetle: file(1) magic for Beetle VM object files 5743# https://github.com/rrthomas/beetle/ 5744 5745# Beetle object module 57460 string BEETLE\000 Beetle VM object file 5747 5748#------------------------------------------------------------------------------ 5749# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $ 5750# ber: file(1) magic for several BER formats used in the mobile 5751# telecommunications industry (Georg Sauthoff) 5752 5753# The file formats are standardized by the GSMA (GSM association). 5754# They are specified via ASN.1 schemas and some prose. Basic encoding 5755# rules (BER) is the used encoding. The formats are used for exchanging 5756# call data records (CDRs) between mobile operators and associated 5757# parties for roaming clearing purposes and fraud detection. 5758 5759# The magic file covers: 5760 5761# - TAP files (TD.57) - CDR batches and notifications 5762# - RAP files (TD.32) - return batches and acknowledgements 5763# - NRT files (TD.35) - CDR batches for 'near real time' processing 5764 5765# 5766# TAP 3 Files 5767# TAP -> Transferred Account Procedure 5768# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf 5769# TransferBatch short tag 57700 byte 0x61 5771# BatchControlInfo short tag 5772>&1 search/b5 \x64 5773# Sender long tag #TAP 3.x (BER encoded) 5774>>&1 search/b8 \x5f\x81\x44 5775# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5776>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5777>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account) 5778 5779# Notification short tag 57800 byte 0x62 5781# Sender long tag 5782>2 search/b8 \x5f\x81\x44 5783# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5784>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5785>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account) 5786 5787 5788# NRT Files 5789# NRT a.k.a. NRTRDE 57900 byte 0x61 5791# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block 5792>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01 5793>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) 5794 5795# RAP Files 5796# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf 5797# Long ReturnBatch tag 57980 string \x7f\x84\x16 5799# Long RapBatchControlInfo tag 5800>&1 search/b8 \x7f\x84\x19 5801# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5802>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5803# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block 5804>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01 5805>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure), 5806>>>&0 byte x TAP 3.%d 5807 5808# Long Acknowledgement tag 58090 string \x7f\x84\x17 5810# Long Sender tag 5811>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure) 5812 5813#------------------------------------------------------------------------------ 5814# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $ 5815# bFLT: file(1) magic for BFLT uclinux binary files 5816# 5817# From Philippe De Muyter <phdm@macqel.be> 5818# 58190 string bFLT BFLT executable 5820>4 belong x - version %d 5821>4 belong 4 5822>>36 belong&0x1 0x1 ram 5823>>36 belong&0x2 0x2 gotpic 5824>>36 belong&0x4 0x4 gzip 5825>>36 belong&0x8 0x8 gzdata 5826 5827#------------------------------------------------------------------------------ 5828# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $ 5829# BlockHashLoc 5830# ext: bhl 5831# Marco Pontello marcopon@gmail.com 5832# reference: https://github.com/MarcoPon/BlockHashLoc 58330 string BlockHashLoc\x1a BlockHashLoc recovery info, 5834>13 byte x version %d 5835!:ext bhl 5836 5837#------------------------------------------------------------------------------ 5838# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $ 5839# bioinfomatics: file(1) magic for Bioinfomatics file formats 5840 5841############################################################################### 5842# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable 5843# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5844############################################################################### 58450 string \037\213 5846>3 byte &0x04 5847>>12 string BC 5848>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible) 5849>>>>16 leshort x \b, block length %d 5850!:mime application/x-gzip 5851 5852 5853############################################################################### 5854# Tabix index file 5855# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5856############################################################################### 58570 string TBI\1 SAMtools TBI (Tabix index format) 5858>0x04 lelong =1 \b, with %d reference sequence 5859>0x04 lelong >1 \b, with %d reference sequences 5860>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style) 5861>0x08 lelong ^0x10000 5862>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style) 5863>>0x08 lelong =1 \b, using SAM format 5864>>0x08 lelong =2 \b, using VCF format 5865>0x0c lelong x \b, sequence name column: %d 5866>0x10 lelong x \b, region start column: %d 5867>0x08 lelong =0 5868>>0x14 lelong x \b, region end column: %d 5869>0x18 byte x \b, comment character: %c 5870>0x1c lelong x \b, skip line count: %d 5871 5872 5873############################################################################### 5874# BAM (Binary Sequence Alignment/Map format) 5875# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5876# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5877############################################################################### 58780 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map) 5879>0x04 lelong >0 5880>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header 5881>>>&0 regex =[0-9.]+ \b version %s 5882>>&(0x04) lelong >0 \b, with %d reference sequences 5883 5884 5885############################################################################### 5886# BAI (BAM indexing format) 5887# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5888############################################################################### 58890 string BAI\1 SAMtools BAI (BAM indexing format) 5890>0x04 lelong >0 \b, with %d reference sequences 5891 5892 5893############################################################################### 5894# CRAM (Binary Sequence Alignment/Map format) 5895############################################################################### 58960 string CRAM CRAM 5897>0x04 byte >-1 version %d. 5898>0x05 byte >-1 \b%d 5899>0x06 string >\0 (identified as %s) 5900 5901 5902############################################################################### 5903# BCF (Binary Call Format), version 1 5904# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf) 5905# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5906############################################################################### 59070 string BCF\4 5908# length of seqnm data in bytes is positive 5909>&0x00 lelong >0 5910# length of smpl data in bytes is positive 5911>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format) 5912# length of meta in bytes 5913>>>&(&-0x04) lelong >0 5914# have meta text string 5915>>>>&0x00 search ##samtoolsVersion= 5916>>>>>&0x00 string x \b, generated by SAMtools version %s 5917 5918 5919############################################################################### 5920# BCF (Binary Call Format), version 2.1 5921# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5922# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5923############################################################################### 59240 string BCF\2\1 Binary Call Format (BCF) version 2.1 5925# length of header text 5926>&0x00 lelong >0 5927# have header string 5928>>&0x00 search ##samtoolsVersion= 5929>>>&0x00 string x \b, generated by SAMtools version %s 5930 5931 5932############################################################################### 5933# BCF (Binary Call Format), version 2.2 5934# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5935# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5936############################################################################### 59370 string BCF\2\2 Binary Call Format (BCF) version 2.2 5938# length of header text 5939>&0x00 lelong >0 5940# have header string 5941>>&0x00 search ##samtoolsVersion= 5942>>>&0x00 string x \b, generated by SAMtools version %s 5943 5944############################################################################### 5945# VCF (Variant Call Format) 5946# used by VCFtools (http://vcftools.sourceforge.net/) 5947############################################################################### 59480 search ##fileformat=VCFv Variant Call Format (VCF) 5949>&0 string x \b version %s 5950 5951############################################################################### 5952# FASTQ 5953# used by MAQ (http://maq.sourceforge.net/fastq.shtml) 5954############################################################################### 5955# XXX Broken? 5956# @<seqname> 5957#0 regex =^@[A-Za-z0-9_.:-]+\?\n 5958# <seq> 5959#>&1 regex =^[A-Za-z\n.~]++ 5960# +[<seqname>] 5961#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n 5962# <qual> 5963#>>>&1 regex =^[!-~\n]+\n FASTQ 5964 5965############################################################################### 5966# FASTA 5967# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) 5968############################################################################### 5969#0 byte 0x3e 5970# q>0 regex =^[>][!-~\t\ ]+$ 5971# Amino Acid codes: [A-IK-Z*-]+ 5972#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA 5973# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+ 5974# not in IUPAC codes/gaps: [EFIJLOPQZ] 5975#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes 5976#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes 5977 5978############################################################################### 5979# SAM (Sequence Alignment/Map format) 5980# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5981############################################################################### 5982# Short-cut version to recognise SAM files with (optional) header at beginning 5983############################################################################### 59840 string @HD\t 5985>4 search VN: Sequence Alignment/Map (SAM), with header 5986>>&0 regex [0-9.]+ \b version %s 5987############################################################################### 5988# Longer version to recognise SAM alignment lines using (many) regexes 5989############################################################################### 5990# SAM Alignment QNAME 59910 regex =^[!-?A-~]{1,255}(\t[^\t]+){11} 5992# SAM Alignment FLAG 5993>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t 5994# SAM Alignment RNAME 5995>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t 5996# SAM Alignment POS 5997>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t 5998# SAM Alignment MAPQ 5999>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t 6000# SAM Alignment CIGAR 6001>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t 6002# SAM Alignment RNEXT 6003>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t 6004# SAM Alignment PNEXT 6005>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t 6006# SAM Alignment TLEN 6007>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t 6008# SAM Alignment SEQ 6009>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t 6010# SAM Alignment QUAL 6011>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM) 6012>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header 6013>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s 6014 6015############################################################################## 6016# 6017# Magic ids for biomedical signal file formats 6018# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com> 6019# 6020# The list has been derived from biosig projects 6021# http://biosig.sourceforge.net 6022# https://pub.ist.ac.at/~schloegl/matlab/eeg/ 6023# https://pub.ist.ac.at/~schloegl/biosig/TESTED 6024# 6025############################################################################## 6026# 60270 string ABF\x20 Biosig/Axon Binary format 6028!:mime biosig/abf2 60290 string ABF2\0\0 Biosig/Axon Binary format 6030!:mime biosig/abf2 6031# 60320 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows 6033!:mime biosig/ates 6034# 60350 string ATF\x09 Biosig/Axon Text format 6036!:mime biosig/atf 6037# 60380 string ADU1 Biosig/Axona file format 6039!:mime biosig/axona 60400 string ADU2 Biosig/Axona file format 6041!:mime biosig/axona 6042# 60430 string ALPHA-TRACE-MEDICAL Biosig/alpha trace 6044!:mime biosig/alpha 6045# 60460 string AxGr Biosig/AXG 60470 string axgx Biosig/AXG 6048!:mime biosig/axg 6049# 60500 string HeaderLen= Biosig/BCI2000 60510 string BCI2000V Biosig/BCI2000 6052!:mime biosig/bci2000 6053# 6054### Specification: https://www.biosemi.com/faq/file_format.htm 60550 string \xffBIOSEMI Biosig/Biosemi data format 6056!:mime biosig/bdf 6057# 60580 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file 60590 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file 60600 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file 6061!:mime biosig/brainvision 6062# 60630 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format 6064!:mime biosig/ced 6065# 6066### Specification: https://www.edfplus.info/specs/index.html 60670 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format 6068!:mime biosig/edf 6069# 6070### Specifications: https://arxiv.org/abs/cs/0608052 60710 string GDF Biosig/GDF: General data format for biosignals 6072!:mime biosig/gdf 6073# 60740 string DATA\0\0\0\0 Biosig/Heka Patchmaster 60750 string DAT1\0\0\0\0 Biosig/Heka Patchmaster 60760 string DAT2\0\0\0\0 Biosig/Heka Patchmaster 6077!:mime biosig/heka 6078# 60790 string (C)\x20CED\x2087 Biosig/CED SMR 6080!:mime biosig/ced-smr 6081# 60820 string CFWB\1\0\0\0 Biosig/CFWB 6083!:mime biosig/cfwb 6084# 60850 string DEMG Biosig/DEMG 6086!:mime biosig/demg 6087# 60880 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS 6089!:mime biosig/ebs 6090# 60910 string Embla\x20data\x20file Biosig/Embla 6092!:mime biosig/embla 6093# 60940 string Header\r\nFile Version Biosig/ETG4000 6095!:mime biosig/etg4000 6096# 60970 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo 6098!:mime biosig/galileo 6099# 61000 string IGOR Biosig/IgorPro ITX file 6101!:mime biosig/igorpro 6102# 6103# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf 61040 string ISHNE1.0 Biosig/ISHNE 6105!:mime biosig/ishne 6106# 6107# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm 61080 string @\x20\x20MFER\x20 Biosig/MFER 61090 string @\x20MFR\x20 Biosig/MFER 6110!:mime biosig/mfer 6111# 61120 string NEURALEV Biosig/NEV 61130 string N.EV.\0 Biosig/NEV 6114!:mime biosig/nev 6115# 61160 string NEX1 Biosig/NEX 6117!:mime biosig/nex1 6118# 61190 string PLEX Biosig/Plexon v1.0 612010 string PLEXON Biosig/Plexon v2.0 6121!:mime biosig/plexon 6122# 61230 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format 6124# 6125# Specification: CEN 1064:2005/ISO 11073:91064 612616 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 6127!:mime biosig/scpecg 6128# 61290 string IAvSFo Biosig/SIGIF 6130!:mime biosig/sigif 6131# 61320 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32 6133!:mime biosig/tms32 6134# 61350 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG 6136!:mime biosig/tmsilog 6137# 61384 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0 6139>63 string CRawDataElement 6140>>85 string CRawDataBuffer Biosig/SYNERGY 6141!:mime biosig/synergy 6142# 61434 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO 6144!:mime biosig/unipro 6145# 61460 string VER=9\r\nCTIME= Biosig/WCP 6147!:mime biosig/wcp 6148# 61490 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek 61500 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek 61510 string \x55\x55\xFE\xAF Biosig/Walter Graphtek 6152!:mime biosig/walter-graphtek 6153# 61540 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 6155>32 string [PatInfo] Biosig/Sigma 6156!:mime biosig/sigma 6157# 61580 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF) 6159!:mime biosig/fef 61600 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF) 6161!:mime biosig/fef 6162# 61630 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1 6164>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0 6165>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF 6166!:mime biosig/fiff 6167# 6168 6169#------------------------------------------------------------------------------ 6170# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $ 6171# blackberry: file(1) magic for BlackBerry file formats 6172# 61735 belong 0 6174>8 belong 010010010 BlackBerry RIM ETP file 6175>>22 string x \b for %s 6176# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 6177# https://ftg.lbl.gov/checkpoint 61780 string C\0\0\0R\0\0\0 BLCR 6179>16 lelong 1 x86 6180>16 lelong 3 alpha 6181>16 lelong 5 x86-64 6182>16 lelong 7 ARM 6183>8 lelong x context data (little endian, version %d) 6184# Uncomment the following only of your "file" program supports "search" 6185#>0 search/1024 VMA\06 for kernel 6186#>>&1 byte x %d. 6187#>>&2 byte x %d. 6188#>>&3 byte x %d 61890 string \0\0\0C\0\0\0R BLCR 6190>16 belong 2 SPARC 6191>16 belong 4 ppc 6192>16 belong 6 ppc64 6193>16 belong 7 ARMEB 6194>16 belong 8 SPARC64 6195>8 belong x context data (big endian, version %d) 6196# Uncomment the following only of your "file" program supports "search" 6197#>0 search/1024 VMA\06 for kernel 6198#>>&1 byte x %d. 6199#>>&2 byte x \b%d. 6200#>>&3 byte x \b%d 6201 6202#------------------------------------------------------------------------------ 6203# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $ 6204# blender: file(1) magic for Blender 3D related files 6205# 6206# Native format rule v1.2. For questions use the developers list 6207# https://lists.blender.org/mailman/listinfo/bf-committers 6208# GLOB chunk was moved near start and provides subversion info since 2.42 6209 62100 string =BLENDER Blender3D, 6211>7 string =_ saved as 32-bits 6212>>8 string =v little endian 6213>>>9 byte x with version %c. 6214>>>10 byte x \b%c 6215>>>11 byte x \b%c 6216>>>0x40 string =GLOB \b. 6217>>>>0x58 leshort x \b%.4d 6218>>8 string =V big endian 6219>>>9 byte x with version %c. 6220>>>10 byte x \b%c 6221>>>11 byte x \b%c 6222>>>0x40 string =GLOB \b. 6223>>>>0x58 beshort x \b%.4d 6224>7 string =- saved as 64-bits 6225>>8 string =v little endian 6226>>9 byte x with version %c. 6227>>10 byte x \b%c 6228>>11 byte x \b%c 6229>>0x44 string =GLOB \b. 6230>>>0x60 leshort x \b%.4d 6231>>8 string =V big endian 6232>>>9 byte x with version %c. 6233>>>10 byte x \b%c 6234>>>11 byte x \b%c 6235>>>0x44 string =GLOB \b. 6236>>>>0x60 beshort x \b%.4d 6237 6238# Scripts that run in the embedded Python interpreter 62390 string #!BPY Blender3D BPython script 6240 6241#------------------------------------------------------------------------------ 6242# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 6243# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 6244# 6245# Note that this 0407 conflicts with several other a.out formats... 6246# 6247# XXX - should this be redone with "be" and "le", so that it works on 6248# little-endian machines as well? If so, what's the deal with 6249# "VAX-order" and "VAX-order2"? 6250# 6251#0 long 0407 68K Blit (standalone) executable 6252#0 short 0407 VAX-order2 68K Blit (standalone) executable 62530 short 03401 VAX-order 68K Blit (standalone) executable 62540 long 0406 68k Blit mpx/mux executable 62550 short 0406 VAX-order2 68k Blit mpx/mux executable 62560 short 03001 VAX-order 68k Blit mpx/mux executable 6257# Need more values for WE32 DMD executables. 6258# Note that 0520 is the same as COFF 6259#0 short 0520 tty630 layers executable 6260 6261#------------------------------------------------------------------------------ 6262# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $ 6263# bm: file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm 6264 62650 string bm\001\244 Birtual Machine 6266>4 leshort x \b, version %d 6267>6 lelong x \b, program size %u 6268>14 lelong x \b, memory size %u 6269>22 lelong x \b, memory capacity %u 6270 6271#------------------------------------------------------------------------------ 6272# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 6273# i80960 b.out objects and archives 6274# 62750 long 0x10d i960 b.out relocatable object 6276>16 long >0 not stripped 6277# 6278# b.out archive (hp-rt on i960) 62790 string =!<bout> b.out archive 6280>8 string __.SYMDEF random library 6281 6282#------------------------------------------------------------------------------ 6283# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $ 6284# bsdi: file(1) magic for BSD/OS (from BSDI) objects 6285# Some object/executable formats use the same magic numbers as are used 6286# in other OSes; those are handled by entries in aout. 6287# 6288 62890 lelong 0314 386 compact demand paged pure executable 6290>16 lelong >0 not stripped 6291>32 byte 0x6a (uses shared libs) 6292 6293# same as in SunOS 4.x, except for static shared libraries 62940 belong&077777777 0600413 SPARC demand paged 6295>0 byte &0x80 6296>>20 belong <4096 shared library 6297>>20 belong =4096 dynamically linked executable 6298>>20 belong >4096 dynamically linked executable 6299>0 byte ^0x80 executable 6300>16 belong >0 not stripped 6301>36 belong 0xb4100001 (uses shared libs) 6302 63030 belong&077777777 0600410 SPARC pure 6304>0 byte &0x80 dynamically linked executable 6305>0 byte ^0x80 executable 6306>16 belong >0 not stripped 6307>36 belong 0xb4100001 (uses shared libs) 6308 63090 belong&077777777 0600407 SPARC 6310>0 byte &0x80 dynamically linked executable 6311>0 byte ^0x80 executable 6312>16 belong >0 not stripped 6313>36 belong 0xb4100001 (uses shared libs) 6314# Chiasmus is an encryption standard developed by the German Federal 6315# Office for Information Security (Bundesamt fuer Sicherheit in der 6316# Informationstechnik). 6317 6318# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html 63190 string XIA1\r Chiasmus Encrypted data 6320!:ext xia 6321 63220 string XIS Chiasmus key 6323!:ext xis 6324 6325#------------------------------------------------------------------------------ 6326# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 6327# BTSnoop: file(1) magic for BTSnoop files 6328# 6329# From <marcel@holtmann.org> 63300 string btsnoop\0 BTSnoop 6331>8 belong x version %d, 6332>12 belong 1001 Unencapsulated HCI 6333>12 belong 1002 HCI UART (H4) 6334>12 belong 1003 HCI BCSP 6335>12 belong 1004 HCI Serial (H5) 6336>>12 belong x type %d 6337 6338#------------------------------------------------------------------------------ 6339# $File: c64,v 1.8 2020/12/20 16:17:43 christos Exp $ 6340# c64: file(1) magic for various commodore 64 related files 6341# 6342# From: Dirk Jagdmann <doj@cubic.org> 6343 63440x16500 belong 0x12014100 D64 Image 63450x16500 belong 0x12014180 D71 Image 63460x61800 belong 0x28034400 D81 Image 63470 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 63480 belong 0x43154164 X64 Image 6349 63500 string GCR-1541 GCR Image 6351>8 byte x version: %i 6352>9 byte x tracks: %i 6353 63549 string PSUR ARC archive (c64) 63552 string -LH1- LHA archive (c64) 6356 63570 string C64File PC64 Emulator file 6358>8 string >\0 "%s" 63590 string C64Image PC64 Freezer Image 6360 63610 beshort 0x38CD C64 PCLink Image 63620 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 6363 63640 belong 0xFF424CFF WRAptor packer (c64) 6365 63660 string C64S\x20tape\x20file T64 tape Image 6367>32 leshort x Version:0x%x 6368>36 leshort !0 Entries:%i 6369>40 string x Name:%.24s 6370 63710 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 6372>32 leshort x Version:0x%x 6373>36 leshort !0 Entries:%i 6374>40 string x Name:%.24s 6375 63760 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 6377>32 leshort x Version:0x%x 6378>36 leshort !0 Entries:%i 6379>40 string x Name:%.24s 6380 6381# Raw tape file format (.tap files) 6382# Esa Hyyti <esa@netlab.tkk.fi> 63830 string C64-TAPE-RAW C64 Raw Tape File (.tap), 6384>0x0c byte x Version:%u, 6385>0x10 lelong x Length:%u cycles 6386 6387# magic for Goattracker2, http://covertbitops.c64.org/ 6388# from Alex Myczko <alex@aiei.ch> 63890 string GTS5 GoatTracker 2 song 6390>4 string >\0 \b, "%s" 6391>36 string >\0 \b by %s 6392>68 string >\0 \b (C) %s 6393>100 byte >0 \b, %u subsong(s) 6394 6395# CBM BASIC (cc65 compiled) 63960 leshort 0x0801 6397>2 leshort 0x080b 6398>6 string \x9e CBM BASIC 6399>7 string >\0 \b, SYS %s 6400 6401#------------------------------------------------------------------------------ 6402# $File: cad,v 1.25 2021/02/23 00:51:10 christos Exp $ 6403# autocad: file(1) magic for cad files 6404# 6405 6406# Microstation DGN/CIT Files (www.bentley.com) 6407# Last updated July 29, 2005 by Lester Hightower 6408# DGN is the default file extension of Microstation/Intergraph CAD files. 6409# CIT is the proprietary raster format (similar to TIFF) used to attach 6410# raster underlays to Microstation DGN (vector) drawings. 6411# 6412# http://www.wotsit.org/search.asp 6413# https://filext.com/detaillist.php?extdetail=DGN 6414# https://filext.com/detaillist.php?extdetail=CIT 6415# 6416# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 6417# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 6418# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 6419# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 6420# 6421# URL: https://en.wikipedia.org/wiki/MicroStation 6422# reference: http://dgnlib.maptools.org/dgn.html 6423# http://dgnlib.maptools.org/dl/ref18.pdf 6424# Update: Joerg Jenderek 6425# Note: verfied by command like `dgndump seed2d_b.dgn` 6426# test for level 8 and type 5 or 9 64270 beshort&0x3F73 0x0801 6428# level of element like 8 6429#>0 ubyte&0x3F x \b, level %u 6430#>0 ubyte &0x80 \b, complex 6431#>0 ubyte &0x40 \b, reserved 6432# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements 6433#>1 ubyte&0x7F x \b, type %u 6434# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT 6435#>2 uleshort x \b, words 0x%4.4x to follow 6436# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL) 6437#>508 ubelong x \b, RESERVED %8.8x 6438>508 ubelong&0xFFffFF00 =0 6439# test for level 8 and type 9 for INGR raster image 6440>>0 beshort 0x0809 6441# test for length of 1st element is multiple of blocks a 512 bytes 6442>>>2 ubyte 0xfe 6443>>>>0 use ingr-image 6444# test for DGN or CEL by jump words (uleshort) forward to next element 6445>(2.s*2) ulong x 6446# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT 6447#>>&1 ubyte&0x7F x \b, 2nd type %u 6448# DGN 6449>>&1 ubyte&0x7F 8 6450>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing 6451!:mime application/x-bentley-dgn 6452!:ext dgn 6453# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0 6454>>>>1214 ubyte &0x40 3D 6455>>>>1214 ubyte ^0x40 2D 6456# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040 6457>>>>1120 string x \b, units %-.2s 6458# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0 6459>>>>1122 string >\0 %-.2s 6460#>>>>1120 ubelong x \b, units 0x%8.8x 6461# element range low,high x y z like xlow=0 08010000h 01080000h 6462#>>>>4 ubelong !0 \b, xlow %8.8x 6463#>>>>8 ubelong !0 \b, ylow %8.8x 6464#>>>>12 ubelong !0 \b, zlow %8.8x 6465#>>>>16 ubelong !0 \b, xhigh %8.8x 6466#>>>>20 ubelong !0 \b, yhigh %8.8x 6467#>>>>24 ubelong !0 \b, zhigh %8.8x 6468# graphic group number; all other elements in that group have same non-0 number 6469#>>>>28 leshort x \b, grphgrp 0x%4.4x 6470# words to optional attribute linkage 6471#>>>>30 ubyte x \b, attindx \%o 6472#>>>>31 ubyte x \b\%o 6473# >>30 string \026\105 DGNFile 6474# >>30 string \034\105 DGNFile 6475# >>30 string \073\107 DGNFile 6476# >>30 string \073\110 DGNFile 6477# >>30 string \106\107 DGNFile 6478# >>30 string \110\103 DGNFile 6479# >>30 string \120\104 DGNFile 6480# >>30 string \172\104 DGNFile 6481# >>30 string \172\105 DGNFile 6482# >>30 string \172\106 DGNFile 6483# >>30 string \234\106 DGNFile 6484# >>30 string \273\105 DGNFile 6485# >>30 string \306\106 DGNFile 6486# >>30 string \310\104 DGNFile 6487# >>30 string \341\104 DGNFile 6488# >>30 string \372\103 DGNFile 6489# >>30 string \372\104 DGNFile 6490# >>30 string \372\106 DGNFile 6491# >>30 string \376\103 DGNFile 6492# elements properties indicator 6493#>>>>32 uleshort !0 \b, properties 0x%4.4x 6494# class 0~Primary 6495#>>>>>32 uleshort&0x000F !0 \b, class 0x%4.4x 6496# Symbology 6497#>>>>>34 uleshort x \b, Symbology 0x%4.4x 6498# test for 2nd element type 1~library cell header 6499>>&1 ubyte&0x7F 1 6500# test for 1st element with level 8 and type 5 for cell library 6501>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library 6502!:mime application/x-bentley-cel 6503!:ext cel 6504# 6505# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster 6506# reference: https://web.archive.org/web/20140903185431/ 6507# http://oreilly.com/www/centers/gff/formats/ingr/index.htm 6508# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT` 6509# display information for intergraph raster bitmap 65100 name ingr-image 6511# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD" 6512# DataTypeCode indicates format, depth of the pixel data and used compression 6513>4 uleshort x Intergraph raster image 6514>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit 6515!:mime image/x-intergraph-rle 6516!:ext rel 6517>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit 6518!:mime image/x-intergraph-cit 6519!:ext cit 6520>>4 uleshort 27 \b, Adaptive RLE RGB 6521!:mime image/x-intergraph-rgb 6522!:ext rgb 6523>>4 default x 6524>>>4 uleshort x \b, Type %u 6525!:mime image/x-intergraph 6526# TODO: 6527#>4 uleshort 0 \b, no data 6528# ... 6529#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed) 6530# ApplicationType: 0~generic raster image 3~drawing, scanning 6531# 8~I/IMAGE and MicroStation Imager 9~ModelView 6532>6 uleshort !0 \b, ApplicationType %u 6533#>6 uleshort x \b, ApplicationType %u 6534# XViewOrigin; Raster grid data X origin 6535#>8 ulequad !0 \b, XViewOrigin %llx 6536# PixelsPerLine is the number of pixels in a scan line of bitmapp 6537>184 ulelong x \b, %u x 6538# NumberOfLines is height of the raster data in scanlines 6539>188 ulelong x %u 6540# DeviceResolution; resolution of scanning device 6541# positive indicates number of micros between lines; negative indicates DPI 6542#>192 leshort x \b, DeviceResolution %d 6543# ScanlineOrient indicates the origin and the orientation of the scan lines 6544#>194 ubyte x \b, ScanlineOrient %x 6545>194 ubyte x \b, orientation 6546>194 ubyte &0x01 right 6547>194 ubyte ^0x01 left 6548>194 ubyte &0x02 down 6549>194 ubyte ^0x02 top 6550>194 ubyte &0x04 horizontal 6551>194 ubyte ^0x04 vertical 6552# ScannableFlag; Scanline indexing method used 6553#>195 ubyte !0 \b, ScannableFlag 0x%x 6554# RotationAngle; Rotation angle of raster data 6555#>196 ubequad !0 \b, RotationAngle 0x%llx 6556# SkewAngle; Skew angle of raster data 6557#>204 ubequad !0 \b, SkewAngle %llx 6558# DataTypeModifier; Additional raster data format info 6559#>212 uleshort !0 \b, DataTypeModifier 0x%4.4x 6560# DesignFile[66]; Name of the design file 6561>214 string >\0 \b, DesignFile %-.66s 6562# DatabaseFile[66]; Name of the database file 6563>280 string >\0 \b, DatabaseFile %-.66s 6564# ParentGridFile[66]; Name of parent grid file 6565>346 string >\0 \b, ParentGridFile %-.66s 6566# FileDescription[80]; Text description of file and contents 6567>412 string >\0 \b, FileDescription %-.80s 6568# MinValue 6569#>492 ubequad !0 \b, MinValue 0x%llx 6570# MaxValue 6571#>500 ubequad !0 \b, MaxValue 0x%llx 6572# Reserved[3]; Unused (always 0) 6573#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x 6574# GridFileVersion; Grid File Version like 2 3 6575#>511 ubyte x \b, GridFileVersion %x 6576 6577# AutoCAD 6578# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg 6579# and https://www.iana.org/assignments/media-types/image/vnd.dwg 65800 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 6581!:mime image/vnd.dwg 65820 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 6583!:mime image/vnd.dwg 65840 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 6585!:mime image/vnd.dwg 65860 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 6587!:mime image/vnd.dwg 65880 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 6589!:mime image/vnd.dwg 65900 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 6591!:mime image/vnd.dwg 65920 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 6593!:mime image/vnd.dwg 65940 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 6595!:mime image/vnd.dwg 65960 string AC1001 DWG AutoDesk AutoCAD Release 2.22 6597!:mime image/vnd.dwg 65980 string AC1002 DWG AutoDesk AutoCAD Release 2.50 6599!:mime image/vnd.dwg 66000 string AC1003 DWG AutoDesk AutoCAD Release 2.60 6601!:mime image/vnd.dwg 66020 string AC1004 DWG AutoDesk AutoCAD Release 9 6603!:mime image/vnd.dwg 66040 string AC1006 DWG AutoDesk AutoCAD Release 10 6605!:mime image/vnd.dwg 66060 string AC1009 DWG AutoDesk AutoCAD Release 11/12 6607!:mime image/vnd.dwg 6608# AutoCAD DWG versions R13/R14 (www.autodesk.com) 6609# Written December 01, 2003 by Lester Hightower 6610# Based on the DWG File Format Specifications at http://www.opendwg.org/ 6611# AutoCad, from Nahuel Greco 6612# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 66130 string AC1012 DWG AutoDesk AutoCAD Release 13 6614!:mime image/vnd.dwg 66150 string AC1013 DWG AutoDesk AutoCAD Release 13c3 6616!:mime image/vnd.dwg 66170 string AC1014 DWG AutoDesk AutoCAD Release 14 6618!:mime image/vnd.dwg 66190 string AC1015 DWG AutoDesk AutoCAD 2000 6620!:mime image/vnd.dwg 6621 6622# A new version of AutoCAD DWG 6623# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 6624# ICQ 358572321) 6625# From various sources like: 6626# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html 66270 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 6628!:mime image/vnd.dwg 66290 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 6630!:mime image/vnd.dwg 66310 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 6632!:mime image/vnd.dwg 66330 string AC1027 DWG AutoDesk AutoCAD 2013-2017 6634!:mime image/vnd.dwg 6635 6636# From GNU LibreDWG 66370 string AC1032 DWG AutoDesk AutoCAD 2018/2019/2020 6638!:mime image/vnd.dwg 66390 string AC1035 DWG AutoDesk AutoCAD 2021 6640!:mime image/vnd.dwg 6641 6642# KOMPAS 2D drawing from ASCON 6643# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 6644# gathered nor specification 6645# ASCON https://ascon.net/main/ in English, 6646# https://ascon.ru/ main site in Russian 6647# Extension is CDW for drawing and FRW for fragment of drawing 6648# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 6649# ICQ 358572321, https://vkontakte.ru/id16076543) 6650# From: 6651# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 6652# (in russian) and my experiments 66530 string KF 6654>2 belong 0x4E00000C Kompas drawing 12.0 SP1 6655>2 belong 0x4D00000C Kompas drawing 12.0 6656>2 belong 0x3200000B Kompas drawing 11.0 SP1 6657>2 belong 0x3100000B Kompas drawing 11.0 6658>2 belong 0x2310000A Kompas drawing 10.0 SP1 6659>2 belong 0x2110000A Kompas drawing 10.0 6660>2 belong 0x08000009 Kompas drawing 9.0 SP1 6661>2 belong 0x05000009 Kompas drawing 9.0 6662>2 belong 0x33010008 Kompas drawing 8+ 6663>2 belong 0x1A000008 Kompas drawing 8.0 6664>2 belong 0x2C010107 Kompas drawing 7+ 6665>2 belong 0x05000007 Kompas drawing 7.0 6666>2 belong 0x32000006 Kompas drawing 6+ 6667>2 belong 0x09000006 Kompas drawing 6.0 6668>2 belong 0x5C009005 Kompas drawing 5.11R03 6669>2 belong 0x54009005 Kompas drawing 5.11R02 6670>2 belong 0x51009005 Kompas drawing 5.11R01 6671>2 belong 0x22009005 Kompas drawing 5.10R03 6672>2 belong 0x22009005 Kompas drawing 5.10R02 mar 6673>2 belong 0x21009005 Kompas drawing 5.10R02 febr 6674>2 belong 0x19009005 Kompas drawing 5.10R01 6675>2 belong 0xF4008005 Kompas drawing 5.9R01.003 6676>2 belong 0x1C008005 Kompas drawing 5.9R01.002 6677>2 belong 0x11008005 Kompas drawing 5.8R01.003 6678 6679# CAD: file(1) magic for computer aided design files 6680# Phillip Griffith <phillip dot griffith at gmail dot com> 6681# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 6682# 6683 6684# 3DS (3d Studio files) 66850 leshort 0x4d4d 6686>6 leshort 0x2 6687>>8 lelong 0xa 6688>>>16 leshort 0x3d3d 3D Studio model 6689!:mime image/x-3ds 6690!:ext 3ds 6691 6692# MegaCAD 2D/3D drawing (.prt) 6693# https://megacad.de/ 6694# From: Markus Heidelberg <markus.heidelberg@web.de> 66950 string MegaCad23\0 MegaCAD 2D/3D drawing 6696 6697# Hoops CAD files 6698# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\ 6699# HSF_architecture.html 6700# Stephane Charette <stephane.charette@gmail.com> 67010 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) 6702>7 regex/9 V[.0-9]{4,5}\020 %s 6703!:ext hsf 6704 6705# AutoCAD Drawing Exchange Format 67060 regex \^[\ \t]*0\r?\000$ 6707>1 regex \^[\ \t]*SECTION\r?$ 6708>>2 regex \^[\ \t]*2\r?$ 6709>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format 6710!:mime application/x-dxf 6711!:ext dxf 6712>>>>&1 search/8192 AC1006 \b, R10 6713>>>>&1 search/8192 AC1009 \b, R11/R12 6714>>>>&1 search/8192 AC1012 \b, R13 6715>>>>&1 search/8192 AC1013 \b, R13c3 6716>>>>&1 search/8192 AC1014 \b, R14 6717>>>>&1 search/8192 AC1015 \b, version 2000 6718>>>>&1 search/8192 AC1018 \b, version 2004 6719>>>>&1 search/8192 AC1021 \b, version 2007 6720>>>>&1 search/8192 AC1024 \b, version 2010 6721>>>>&1 search/8192 AC1027 \b, version 2013 6722>>>>&1 search/8192 AC1032 \b, version 2018 6723>>>>&1 search/8192 AC1035 \b, version 2021 6724 6725# The Sketchup 3D model format https://www.sketchup.com/ 67260 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model 6727!:mime application/vnd.sketchup.skp 6728!:ext skp 6729 67304 regex/b P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9] NAXOS CAD System file from version %s 6731!:strength +40 6732 6733#------------------------------------------------------------------------------ 6734# $File: cafebabe,v 1.26 2020/12/12 20:01:47 christos Exp $ 6735# Cafe Babes unite! 6736# 6737# Since Java bytecode and Mach-O universal binaries have the same magic number, 6738# the test must be performed in the same "magic" sequence to get both right. 6739# The long at offset 4 in a Mach-O universal binary tells the number of 6740# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 6741# version and the short at offset 6 is the JVM major version. Since there are only 6742# only 18 labeled Mach-O architectures at current, and the first released 6743# Java class format was version 43.0, we can safely choose any number 6744# between 18 and 39 to test the number of architectures against 6745# (and use as a hack). Let's not use 18, because the Mach-O people 6746# might add another one or two as time goes by... 6747# 6748### JAVA START ### 6749# Reference: http://en.wikipedia.org/wiki/Java_class_file 6750# Update: Joerg Jenderek 67510 belong 0xcafebabe 6752>4 ubelong >30 compiled Java class data, 6753!:mime application/x-java-applet 6754#!:mime application/java-byte-code 6755!:ext class 6756>>6 ubeshort x version %d. 6757>>4 ubeshort x \b%d 6758# for debugging purpose version as hexadecimal to compare with Mach-O universal binary 6759#>>4 ubelong x (0x%8.8x) 6760# Which is which? 6761# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html 6762#>>4 belong 0x002b (Java 0.?) 6763#>>4 belong 0x032d (Java 1.0) 6764#>>4 belong 0x032d (Java 1.1) 6765>>4 belong 0x002e (Java 1.2) 6766>>4 belong 0x002f (Java 1.3) 6767>>4 belong 0x0030 (Java 1.4) 6768>>4 belong 0x0031 (Java 1.5) 6769>>4 belong 0x0032 (Java 1.6) 6770>>4 belong 0x0033 (Java 1.7) 6771>>4 belong 0x0034 (Java 1.8) 6772>>4 belong 0x0035 (Java SE 9) 6773>>4 belong 0x0036 (Java SE 10) 6774>>4 belong 0x0037 (Java SE 11) 6775>>4 belong 0x0038 (Java SE 12) 6776>>4 belong 0x0039 (Java SE 13) 6777>>4 belong 0x003A (Java SE 14) 6778# pool count unequal zero 6779#>>8 beshort x \b, pool count 0x%x 6780# pool table 6781#>>10 ubequad x \b, pool 0x%16.16llx... 6782 67830 belong 0xcafed00d JAR compressed with pack200, 6784>5 byte x version %d. 6785>4 byte x \b%d 6786!:mime application/x-java-pack200 6787 6788 67890 belong 0xcafed00d JAR compressed with pack200, 6790>5 byte x version %d. 6791>4 byte x \b%d 6792!:mime application/x-java-pack200 6793 6794### JAVA END ### 6795### MACH-O START ### 6796# URL: https://en.wikipedia.org/wiki/Mach-O 6797 67980 name mach-o \b [ 6799# for debugging purpose CPU type as hexadecimal 6800#>0 ubequad x CPU=%16.16llx 6801# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 6802>0 use mach-o-cpu \b 6803# for debugging purpose print offset to 1st mach_header like: 6804# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h 6805#>8 ubelong x at 0x%x offset 6806>(8.L) indirect x \b: 6807>0 belong x \b] 6808 6809# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 6810# include/mach-o/fat.h 6811# include/mach/machine.h 68120 belong 0xcafebabe 6813>4 belong 1 Mach-O universal binary with 1 architecture: 6814!:mime application/x-mach-binary 6815>>8 use mach-o \b 6816# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020 6817>4 ubelong >1 6818>>4 ubelong <20 Mach-O universal binary with %d architectures: 6819!:mime application/x-mach-binary 6820>>>8 use mach-o \b 6821>>>4 ubelong >1 6822>>>>28 use mach-o \b 6823>>>4 ubelong >2 6824>>>>48 use mach-o \b 6825>>>4 ubelong >3 6826>>>>68 use mach-o \b 6827>>>4 ubelong >4 6828>>>>88 use mach-o \b 6829>>>4 ubelong >5 6830>>>>108 use mach-o \b 6831 6832### MACH-O END ### 6833 6834#------------------------------------------------------------------------------ 6835# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $ 6836# cbor: file(1) magic for CBOR files as defined in RFC 7049 6837 68380 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 6839!:mime application/cbor 6840>3 ubyte <0x20 (positive integer) 6841>3 ubyte <0x40 6842>>3 ubyte >0x1f (negative integer) 6843>3 ubyte <0x60 6844>>3 ubyte >0x3f (byte string) 6845>3 ubyte <0x80 6846>>3 ubyte >0x5f (text string) 6847>3 ubyte <0xa0 6848>3 ubyte >0x7f (array) 6849>3 ubyte <0xc0 6850>>3 ubyte >0x9f (map) 6851>3 ubyte <0xe0 6852>>3 ubyte >0xbf (tagged) 6853>3 ubyte >0xdf (other) 6854 6855#------------------------------------------------------------------------------ 6856# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 6857# CDDB: file(1) magic for CDDB(tm) format CD text data files 6858# 6859# From <steve@gracenote.com> 6860# 6861# This is the /etc/magic entry to decode datafiles as used by 6862# CDDB-enabled CD player applications. 6863# 6864 68650 search/1/w #\040xmcd CDDB(tm) format CD text data 6866 6867#------------------------------------------------------------------------------ 6868# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 6869# chord: file(1) magic for Chord music sheet typesetting utility input files 6870# 6871# From Philippe De Muyter <phdm@macqel.be> 6872# File format is actually free, but many distributed files begin with `{title' 6873# 68740 string {title Chord text file 6875 6876# Type: PowerTab file format 6877# URL: http://www.power-tab.net/ 6878# From: Jelmer Vernooij <jelmer@samba.org> 68790 string ptab\003\000 Power-Tab v3 Tablature File 68800 string ptab\004\000 Power-Tab v4 Tablature File 6881 6882#------------------------------------------------------------------------------ 6883# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 6884# cisco: file(1) magic for cisco Systems routers 6885# 6886# Most cisco file-formats are covered by the generic elf code 6887# 6888# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 68890 belong&0xffffff00 0x85011400 cisco IOS microcode 6890>7 string >\0 for '%s' 68910 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 6892>7 string >\0 for '%s' 6893 6894#------------------------------------------------------------------------------ 6895# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $ 6896# citrus locale declaration 6897# 6898 68990 string RuneCT Citrus locale declaration for LC_CTYPE 69000 string CtrsME Citrus locale declaration for LC_MESSAGES 69010 string CtrsMO Citrus locale declaration for LC_MONETARY 69020 string CtrsNU Citrus locale declaration for LC_NUMERIC 69030 string CtrsTI Citrus locale declaration for LC_TIME 6904 6905#------------------------------------------------------------------------------ 6906# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $ 6907# c-lang: file(1) magic for C and related languages programs 6908# 6909# The strength is to beat standard HTML 6910 6911# BCPL 69120 search/8192 "libhdr" BCPL source text 6913!:mime text/x-bcpl 69140 search/8192 "LIBHDR" BCPL source text 6915!:mime text/x-bcpl 6916 6917# C 6918# Check for class if include is found, otherwise class is beaten by include because of lowered strength 69190 search/8192 #include 6920>0 regex \^#include C 6921>>0 regex \^class[[:space:]]+ 6922>>>&0 regex \\{[\.\*]\\}(;)?$ \b++ 6923>>&0 clear x source text 6924!:strength + 13 6925!:mime text/x-c 69260 search/8192 pragma 6927>0 regex \^#[[:space:]]*pragma C source text 6928!:mime text/x-c 69290 search/8192 endif 6930>0 regex \^#[[:space:]]*(if\|ifn)def 6931>>&0 regex \^#[[:space:]]*endif$ C source text 6932!:mime text/x-c 69330 search/8192 define 6934>0 regex \^#[[:space:]]*(if\|ifn)def 6935>>&0 regex \^#[[:space:]]*define C source text 6936!:mime text/x-c 69370 search/8192 char 6938>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6939!:mime text/x-c 69400 search/8192 double 6941>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6942!:mime text/x-c 69430 search/8192 extern 6944>0 regex \^[[:space:]]*extern[[:space:]]+ C source text 6945!:mime text/x-c 69460 search/8192 float 6947>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6948!:mime text/x-c 69490 search/8192 struct 6950>0 regex \^struct[[:space:]]+ C source text 6951!:mime text/x-c 69520 search/8192 union 6953>0 regex \^union[[:space:]]+ C source text 6954!:mime text/x-c 69550 search/8192 main( 6956>&0 regex \\)[[:space:]]*\\{ C source text 6957!:mime text/x-c 6958 6959# C++ 6960# The strength of these rules is increased so they beat the C rules above 69610 search/8192 namespace 6962>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text 6963!:strength + 30 6964!:mime text/x-c++ 6965# using namespace [namespace] or using std::[lib] 69660 search/8192 using 6967>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text 6968!:strength + 30 6969!:mime text/x-c++ 69700 search/8192 template 6971>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text 6972!:strength + 30 6973!:mime text/x-c++ 69740 search/8192 virtual 6975>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text 6976!:strength + 30 6977!:mime text/x-c++ 6978# But class alone is reduced to avoid beating php (Jens Schleusener) 69790 search/8192 class 6980>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text 6981!:strength + 13 6982!:mime text/x-c++ 69830 search/8192 public 6984>0 regex \^[[:space:]]*public: C++ source text 6985!:strength + 30 6986!:mime text/x-c++ 69870 search/8192 private 6988>0 regex \^[[:space:]]*private: C++ source text 6989!:strength + 30 6990!:mime text/x-c++ 69910 search/8192 protected 6992>0 regex \^[[:space:]]*protected: C++ source text 6993!:strength + 30 6994!:mime text/x-c++ 6995 6996# Objective-C 69970 search/8192 #import 6998>0 regex \^#import Objective-C source text 6999!:strength + 25 7000!:mime text/x-objective-c 7001 7002# From: Mikhail Teterin <mi@aldan.algebra.com> 70030 string cscope cscope reference data 7004>7 string x version %.2s 7005# We skip the path here, because it is often long (so file will 7006# truncate it) and mostly redundant. 7007# The inverted index functionality was added some time between 7008# versions 11 and 15, so look for -q if version is above 14: 7009>7 string >14 7010>>10 search/100 \ -q\ with inverted index 7011>10 search/100 \ -c\ text (non-compressed) 7012 7013#------------------------------------------------------------------------------ 7014# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $ 7015# clarion: file(1) magic for # Clarion Personal/Professional Developer 7016# (v2 and above) 7017# From: Julien Blache <jb@jblache.org> 7018 7019# Database files 7020# signature 70210 leshort 0x3343 Clarion Developer (v2 and above) data file 7022# attributes 7023>2 leshort &0x0001 \b, locked 7024>2 leshort &0x0004 \b, encrypted 7025>2 leshort &0x0008 \b, memo file exists 7026>2 leshort &0x0010 \b, compressed 7027>2 leshort &0x0040 \b, read only 7028# number of records 7029>5 lelong x \b, %d records 7030 7031# Memo files 70320 leshort 0x334d Clarion Developer (v2 and above) memo data 7033 7034# Key/Index files 7035# No magic? :( 7036 7037# Help files 70380 leshort 0x49e0 Clarion Developer (v2 and above) help data 7039 7040#------------------------------------------------------------------------------ 7041# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $ 7042# claris: file(1) magic for claris 7043# "H. Nanosecond" <aldomel@ix.netcom.com> 7044# Claris Works a word processor, etc. 7045# Version 3.0 7046 7047# .pct claris works clip art files 7048#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 7049#* 7050#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 7051#null to byte 1000 octal 7052514 string \377\377\377\377\000 7053>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 7054514 string \377\377\377\377\001 7055>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 7056 7057# Claris works files 7058# .cwk 7059# Moved to Apple AppleWorks document 7060#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 7061# .plt 70620 string \020\341\000\000\010\010 Claris Works palette files .plt 7063 7064# .msp a dictionary file I am not sure about this I have only one .msp file 70650 string \002\271\262\000\040\002\000\164 Claris works dictionary 7066 7067# .usp are user dictionary bits 7068# I am not sure about a magic header: 7069#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 7070# soh S p f 8 U D sp ^ S cr nl p o d i 7071#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 7072# a t r i s t sp ^ S cr nl d i v sp # 7073 7074# .mth Thesaurus 7075# starts with \0 but no magic header 7076 7077# .chy Hyphenation file 7078# I am not sure: 000 210 034 000 000 7079 7080# other claris files 7081#./windows/claris/useng.ndx: data 7082#./windows/claris/xtndtran.l32: data 7083#./windows/claris/xtndtran.lst: data 7084#./windows/claris/clworks.lbl: data 7085#./windows/claris/clworks.prf: data 7086#./windows/claris/userd.spl: data 7087 7088#------------------------------------------------------------------------------ 7089# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $ 7090# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 7091# 7092# XXX - what byte order does the Clipper use? 7093# 7094# XXX - what's the "!" stuff: 7095# 7096# >18 short !074000,000000 C1 R1 7097# >18 short !074000,004000 C2 R1 7098# >18 short !074000,010000 C3 R1 7099# >18 short !074000,074000 TEST 7100# 7101# I shall assume it's ANDing the field with the first value and 7102# comparing it with the second, and rewrite it as: 7103# 7104# >18 short&074000 000000 C1 R1 7105# >18 short&074000 004000 C2 R1 7106# >18 short&074000 010000 C3 R1 7107# >18 short&074000 074000 TEST 7108# 7109# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 7110# sort, nor does SunOS 4.x, so either it's something Intergraph added 7111# in CLIX, or something AT&T added in SVR3.2 or later, or something 7112# somebody else thought was a good idea; it's not documented in the 7113# man page for this version of "magic", nor does it appear to be 7114# implemented (at least not after I blew off the bogus code to turn 7115# old-style "&"s into new-style "&"s, which just didn't work at all). 7116# 71170 short 0575 CLIPPER COFF executable (VAX #) 7118>20 short 0407 (impure) 7119>20 short 0410 (5.2 compatible) 7120>20 short 0411 (pure) 7121>20 short 0413 (demand paged) 7122>20 short 0443 (target shared library) 7123>12 long >0 not stripped 7124>22 short >0 - version %d 71250 short 0577 CLIPPER COFF executable 7126>18 short&074000 000000 C1 R1 7127>18 short&074000 004000 C2 R1 7128>18 short&074000 010000 C3 R1 7129>18 short&074000 074000 TEST 7130>20 short 0407 (impure) 7131>20 short 0410 (pure) 7132>20 short 0411 (separate I&D) 7133>20 short 0413 (paged) 7134>20 short 0443 (target shared library) 7135>12 long >0 not stripped 7136>22 short >0 - version %d 7137>48 long&01 01 alignment trap enabled 7138>52 byte 1 -Ctnc 7139>52 byte 2 -Ctsw 7140>52 byte 3 -Ctpw 7141>52 byte 4 -Ctcb 7142>53 byte 1 -Cdnc 7143>53 byte 2 -Cdsw 7144>53 byte 3 -Cdpw 7145>53 byte 4 -Cdcb 7146>54 byte 1 -Csnc 7147>54 byte 2 -Cssw 7148>54 byte 3 -Cspw 7149>54 byte 4 -Cscb 7150#4 string pipe CLIPPER instruction trace 7151#4 string prof CLIPPER instruction profile 7152#------------------------------------------------------------------------------ 7153# file: file(1) magic for Clojure 7154# URL: https://clojure.org/ 7155# From: Jason Felice <jason.m.felice@gmail.com> 7156 71570 string/w #!\ /usr/bin/clj Clojure script text executable 7158!:mime text/x-clojure 71590 string/w #!\ /usr/local/bin/clj Clojure script text executable 7160!:mime text/x-clojure 71610 string/w #!\ /usr/bin/clojure Clojure script text executable 7162!:mime text/x-clojure 71630 string/w #!\ /usr/local/bin/clojure Clojure script text executable 7164!:mime text/x-clojure 71650 string/W #!/usr/bin/env\ clj Clojure script text executable 7166!:mime text/x-clojure 71670 string/W #!/usr/bin/env\ clojure Clojure script text executable 7168!:mime text/x-clojure 71690 string/W #!\ /usr/bin/env\ clj Clojure script text executable 7170!:mime text/x-clojure 71710 string/W #!\ /usr/bin/env\ clojure Clojure script text executable 7172!:mime text/x-clojure 7173 71740 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text 7175!:mime text/x-clojure 7176 71770 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text 7178!:mime text/x-clojure 7179 71800 regex \^\\\(defn-?[[:space:]] Clojure module source text 7181!:mime text/x-clojure 7182 7183#------------------------------------------------------------------------------ 7184# $File: coff,v 1.4 2021/02/10 00:37:02 christos Exp $ 7185# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 7186# 7187# COFF 7188# 7189# by Joerg Jenderek at Oct 2015, Feb 2021 7190# https://en.wikipedia.org/wiki/COFF 7191# https://de.wikipedia.org/wiki/Common_Object_File_Format 7192# http://www.delorie.com/djgpp/doc/coff/filhdr.html 7193 7194# display name+variables+flags of Common Object Files Format (32bit) 7195# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 7196# mips,motorola,msdos,osf1,sharc,varied.out,vax 71970 name display-coff 7198# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 7199>18 uleshort&0x8E80 0 7200# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections 7201>>2 uleshort >0 7202# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections 7203>>>2 uleshort <4207 7204>>>>0 clear x 7205# f_magic - magic number 7206# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 7207>>>>0 uleshort 0x014C Intel 80386 7208# Hitachi SH big-endian COFF (./hitachi-sh) 7209>>>>0 uleshort 0x0500 Hitachi SH big-endian 7210# Hitachi SH little-endian COFF (./hitachi-sh) 7211>>>>0 uleshort 0x0550 Hitachi SH little-endian 7212# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 7213#>>>>0 uleshort 0x01DF 7214# MS Windows COFF Intel Itanium, AMD64 7215# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx 7216>>>>0 uleshort 0x0200 Intel ia64 7217>>>>0 uleshort 0x8664 Intel amd64 7218# TODO for other COFFs 7219#>>>>0 uleshort 0xABCD COFF_TEMPLATE 7220>>>>0 default x 7221>>>>>0 uleshort x type 0x%04x 7222>>>>0 uleshort x COFF 7223# F_EXEC flag bit 7224>>>>18 leshort ^0x0002 object file 7225!:mime application/x-coff 7226!:ext o/obj/lib 7227# no cof sample found 7228#!:ext cof/o/obj/lib 7229>>>>18 leshort &0x0002 executable 7230#!:mime application/x-coffexec 7231# F_RELFLG flag bit,static object 7232>>>>18 leshort &0x0001 \b, no relocation info 7233# F_LNNO flag bit 7234>>>>18 leshort &0x0004 \b, no line number info 7235# F_LSYMS flag bit 7236>>>>18 leshort &0x0008 \b, stripped 7237>>>>18 leshort ^0x0008 \b, not stripped 7238# flags in other COFF versions 7239#0x0010 F_FDPR_PROF 7240#0x0020 F_FDPR_OPTI 7241#0x0040 F_DSA 7242# F_AR32WR flag bit 7243#>>>>18 leshort &0x0100 \b, 32 bit little endian 7244#0x1000 F_DYNLOAD 7245#0x2000 F_SHROBJ 7246#0x4000 F_LOADONLY 7247# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124 7248>>>>2 uleshort <2 \b, %u section 7249>>>>2 uleshort >1 \b, %u sections 7250# f_symptr - symbol table pointer, only for not stripped 7251# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0 7252>>>>8 ulelong >0 \b, symbol offset=0x%x 7253# f_nsyms - number of symbols, only for not stripped 7254# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546 7255>>>>12 ulelong >0 \b, %d symbols 7256# f_opthdr - optional header size. An object file should have a value of 0 7257>>>>16 uleshort >0 \b, optional header size %u 7258# f_timdat - file time & date stamp only for little endian 7259>>>>4 ledate >0 \b, created %s 7260# at offset 20 can be optional header, extra bytes FILHSZ-20 because 7261# do not rely on sizeof(FILHDR) to give the correct size for header. 7262# or first section header 7263# additional variables for other COFF files 7264>>>>16 uleshort =0 7265# first section name s_name[8] like: .text .data .debug$S .drectve .testseg 7266>>>>>20 string x \b, 1st section name "%.8s" 7267# >20 beshort 0407 (impure) 7268# >20 beshort 0410 (pure) 7269# >20 beshort 0413 (demand paged) 7270# >20 beshort 0421 (standalone) 7271# >22 leshort >0 - version %d 7272# >168 string .lowmem Apple toolbox 7273 7274 7275#------------------------------------------------------------------------------ 7276# $File: commands,v 1.63 2020/06/06 15:36:30 christos Exp $ 7277# commands: file(1) magic for various shells and interpreters 7278# 7279#0 string/w : shell archive or script for antique kernel text 72800 string/wt #!\ /bin/sh POSIX shell script text executable 7281!:mime text/x-shellscript 72820 string/wb #!\ /bin/sh POSIX shell script executable (binary data) 7283!:mime text/x-shellscript 7284 72850 string/wt #!\ /bin/csh C shell script text executable 7286!:mime text/x-shellscript 7287 7288# korn shell magic, sent by George Wu, gwu@clyde.att.com 72890 string/wt #!\ /bin/ksh Korn shell script text executable 7290!:mime text/x-shellscript 72910 string/wb #!\ /bin/ksh Korn shell script executable (binary data) 7292!:mime text/x-shellscript 7293 72940 string/wt #!\ /bin/tcsh Tenex C shell script text executable 7295!:mime text/x-shellscript 72960 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 7297!:mime text/x-shellscript 72980 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 7299!:mime text/x-shellscript 73000 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 7301!:mime text/x-shellscript 7302 7303# 7304# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 73050 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 7306!:mime text/x-shellscript 73070 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 7308!:mime text/x-shellscript 73090 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 7310!:mime text/x-shellscript 73110 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable 7312!:mime text/x-shellscript 7313 73140 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 7315!:mime text/x-shellscript 73160 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 7317!:mime text/x-shellscript 73180 string/wt #!\ /bin/nawk new awk script text executable 7319!:mime text/x-nawk 73200 string/wt #!\ /usr/bin/nawk new awk script text executable 7321!:mime text/x-nawk 73220 string/wt #!\ /usr/local/bin/nawk new awk script text executable 7323!:mime text/x-nawk 73240 string/wt #!\ /bin/gawk GNU awk script text executable 7325!:mime text/x-gawk 73260 string/wt #!\ /usr/bin/gawk GNU awk script text executable 7327!:mime text/x-gawk 73280 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 7329!:mime text/x-gawk 7330# 73310 string/wt #!\ /bin/awk awk script text executable 7332!:mime text/x-awk 73330 string/wt #!\ /usr/bin/awk awk script text executable 7334!:mime text/x-awk 73350 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text 7336 7337# AT&T Bell Labs' Plan 9 shell 73380 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 7339 7340# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 73410 string/wt #!\ /bin/bash Bourne-Again shell script text executable 7342!:mime text/x-shellscript 73430 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data) 7344!:mime text/x-shellscript 73450 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 7346!:mime text/x-shellscript 73470 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 7348!:mime text/x-shellscript 73490 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 7350!:mime text/x-shellscript 73510 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 7352!:mime text/x-shellscript 73530 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 7354!:mime text/x-shellscript 73550 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 7356!:mime text/x-shellscript 73570 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable 7358!:mime text/x-shellscript 7359 7360# Fish shell magic 7361# From: Benjamin Lowry <ben@ben.gmbh> 73620 string/wt #!\ /usr/local/bin/fish fish shell script text executable 7363!:mime text/x-shellscript 73640 string/wt #!\ /usr/bin/fish fish shell script text executable 7365!:mime text/x-shellscript 73660 string/wt #!\ /usr/bin/env\ fish fish shell script text executable 7367!:mime text/x-shellscript 7368 7369 73700 search/1/wt #!\ /usr/bin/tclsh Tcl/Tk script text executable 7371!:mime text/x-tcl 7372 73730 search/1/wt #!\ /usr/bin/texlua LuaTex script text executable 7374!:mime text/x-luatex 7375 73760 search/1/wt #!\ /usr/bin/luatex LuaTex script text executable 7377!:mime text/x-luatex 7378 73790 search/1/wt #!\ /usr/bin/stap Systemtap script text executable 7380!:mime text/x-systemtap 7381 7382 7383 7384# PHP scripts 7385# Ulf Harnhammar <ulfh@update.uu.se> 73860 search/1/c =<?php PHP script text 7387!:strength + 30 7388!:mime text/x-php 73890 search/1 =<?\n PHP script text 7390!:mime text/x-php 73910 search/1 =<?\r PHP script text 7392!:mime text/x-php 73930 search/1/w #!\ /usr/local/bin/php PHP script text executable 7394!:strength + 10 7395!:mime text/x-php 73960 search/1/w #!\ /usr/bin/php PHP script text executable 7397!:strength + 10 7398!:mime text/x-php 7399# Smarty compiled template, https://www.smarty.net/ 7400# Elan Ruusamae <glen@delfi.ee> 74010 string =<?php 7402>5 regex [\ \n] 7403>>6 string /*\ Smarty\ version Smarty compiled template 7404>>>24 regex [0-9.]+ \b, version %s 7405!:mime text/x-php 7406 74070 string Zend\x00 PHP script Zend Optimizer data 7408 74090 string/t $! DCL command file 7410 7411# Type: Pdmenu 7412# URL: https://packages.debian.org/pdmenu 7413# From: Edward Betts <edward@debian.org> 74140 string #!/usr/bin/pdmenu Pdmenu configuration file text 7415 7416# From Danny Weldon 74170 string \x0b\x13\x08\x00 7418>0x04 uleshort <4 ksh byte-code version %d 7419 7420#---------------------------------------------------------------------------- 7421# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 7422# communication 7423 7424# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 7425# It is used for conformance testing of communication protocols. 7426# Added by W. Borgert <debacle@debian.org>. 74270 string $Suite TTCN Abstract Test Suite 7428>&1 string $SuiteId 7429>>&1 string >\n %s 7430>&2 string $SuiteId 7431>>&1 string >\n %s 7432>&3 string $SuiteId 7433>>&1 string >\n %s 7434 7435# MSC (message sequence charts) are a formal description technique, 7436# described in ITU-T Z.120, mainly used for communication protocols. 7437# Added by W. Borgert <debacle@debian.org>. 74380 string mscdocument Message Sequence Chart (document) 74390 string msc Message Sequence Chart (chart) 74400 string submsc Message Sequence Chart (subchart) 7441#------------------------------------------------------------------------------ 7442# $File: compress,v 1.81 2021/04/19 17:01:45 christos Exp $ 7443# compress: file(1) magic for pure-compression formats (no archives) 7444# 7445# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 7446# 7447# Formats for various forms of compressed data 7448# Formats for "compress" proper have been moved into "compress.c", 7449# because it tries to uncompress it to figure out what's inside. 7450 7451# standard unix compress 74520 string \037\235 compress'd data 7453!:mime application/x-compress 7454!:apple LZIVZIVU 7455>2 byte&0x80 >0 block compressed 7456>2 byte&0x1f x %d bits 7457 7458# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 7459# URL: https://en.wikipedia.org/wiki/Gzip 7460# Reference: https://tools.ietf.org/html/rfc1952 7461# Update: Joerg Jenderek, Apr 2019 7462# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 7463# * Original filename is only at offset 10 if "extra field" absent 7464# * Produce shorter output - notably, only report compression methods 7465# other than 8 ("deflate", the only method defined in RFC 1952). 7466# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls 7467# TODO: 7468# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/ 7469# KPR KOffice/Calligra KPresenter application/x-kpresenter 7470# KPT KOffice/Calligra KPresenter template? application/x-kpresenter 7471# SAV Diggles Saved Game File http://www.innonics.com 7472# SAV FarCry (demo) saved game http://www.farcry-thegame.com 7473# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter 74740 string \037\213 7475# to display gzip compressed (strength=100=2*50) before other (strength=50)? 7476#!:strength * 2 7477# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary 7478>3 byte&0x18 =0 7479# For binary gzipped no ASCII text should occur 7480# mcd-monu-cad.trid.xml 7481>>10 string MCD Monu-Cad Drawing, Component or Font 7482#>>36 string Created\ with\ MONU-CAD 7483#!:mime application/octet-stream 7484# http://fileformats.archiveteam.org/wiki/Monu-CAD 7485# http://www.monucad.com/downloads/FullDemo-2005.EXE 7486# /HANDS96.MCC Component 7487# /DEMO_DD01.MCD Drawing 7488# /MCALF020.FNT Font 7489!:ext mcc/mcd/fnt 7490# http://www.generalcadd.com 7491>>10 string GXD General CADD, Drawing or Component 7492#!:mime application/octet-stream 7493# /gxc/BUILDINGEDGE.gxc Component 7494# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing 7495# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06 7496!:ext gxc/gxd 7497#>>>13 ubyte 0 \b, version 0 7498>>>13 string 09 \b, version 9 7499# other gzipped binary like gzipped tar, VirtualBox extension package,... 7500>>10 default x gzip compressed data 7501!:mime application/gzip 7502>>>0 use gzip-info 7503# size of the original (uncompressed) input data modulo 2^32 7504>>-0 offset >48 7505>>>-4 ulelong x \b, original size modulo 2^32 %u 7506>>-0 offset <48 \b, truncated 7507# gzipped TAR or VirtualBox extension package 7508#!:mime application/x-compressed-tar 7509#!:mime application/x-virtualbox-vbox-extpack 7510# https://www.w3.org/TR/SVG/mimereg.html 7511#!:mime image/image/svg+xml-compressed 7512# zlib.3.gz 7513# microcode-20180312.tgz 7514# tpz same as tgz 7515# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg 7516# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack 7517!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz 7518# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text 7519>3 byte&0x18 >0 gzip compressed data 7520!:mime application/gzip 7521# gzipped tar, gzipped Abiword document 7522#!:mime application/x-compressed-tar 7523#!:mime application/x-abiword-compressed 7524#!:mime image/image/svg+xml-compressed 7525# kleopatra_splashscreen.svgz gzipped .svg 7526!:ext gz/tgz/tpz/zabw/svgz 7527>>0 use gzip-info 7528# size of the original (uncompressed) input data modulo 2^32 7529>>-0 offset >48 7530>>>-4 ulelong x \b, original size modulo 2^32 %u 7531>>-0 offset <48 \b, truncated 7532# display information of gzip compressed files 75330 name gzip-info 7534#>2 byte x THIS iS GZIP 7535>2 byte <8 \b, reserved method 7536>2 byte >8 \b, unknown method 7537>3 byte &0x01 \b, ASCII 7538>3 byte &0x02 \b, has CRC 7539>3 byte &0x04 \b, extra field 7540>3 byte&0xC =0x08 7541>>10 string x \b, was "%s" 7542>3 byte &0x10 \b, has comment 7543>3 byte &0x20 \b, encrypted 7544>4 ledate >0 \b, last modified: %s 7545>8 byte 2 \b, max compression 7546>8 byte 4 \b, max speed 7547>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 7548>9 byte =0x01 \b, from Amiga 7549>9 byte =0x02 \b, from VMS 7550>9 byte =0x03 \b, from Unix 7551>9 byte =0x04 \b, from VM/CMS 7552>9 byte =0x05 \b, from Atari 7553>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 7554>9 byte =0x07 \b, from MacOS 7555>9 byte =0x08 \b, from Z-System 7556>9 byte =0x09 \b, from CP/M 7557>9 byte =0x0A \b, from TOPS/20 7558>9 byte =0x0B \b, from NTFS filesystem (NT) 7559>9 byte =0x0C \b, from QDOS 7560>9 byte =0x0D \b, from Acorn RISCOS 7561# size of the original (uncompressed) input data modulo 2^32 7562#>-4 ulelong x \b, original size modulo 2^32 %u 7563#ERROR: line 114: non zero offset 1048572 at level 1 7564 7565# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 75660 string \037\036 packed data 7567!:mime application/octet-stream 7568>2 belong >1 \b, %d characters originally 7569>2 belong =1 \b, %d character originally 7570# 7571# This magic number is byte-order-independent. 75720 short 0x1f1f old packed data 7573!:mime application/octet-stream 7574 7575# XXX - why *two* entries for "compacted data", one of which is 7576# byte-order independent, and one of which is byte-order dependent? 7577# 75780 short 0x1fff compacted data 7579!:mime application/octet-stream 7580# This string is valid for SunOS (BE) and a matching "short" is listed 7581# in the Ultrix (LE) magic file. 75820 string \377\037 compacted data 7583!:mime application/octet-stream 75840 short 0145405 huf output 7585!:mime application/octet-stream 7586 7587# bzip2 75880 string BZh bzip2 compressed data 7589!:mime application/x-bzip2 7590>3 byte >47 \b, block size = %c00k 7591 7592# bzip a block-sorting file compressor 7593# by Julian Seward <sewardj@cs.man.ac.uk> and others 75940 string BZ0 bzip compressed data 7595!:mime application/x-bzip 7596>3 byte >47 \b, block size = %c00k 7597 7598# lzip 75990 string LZIP lzip compressed data 7600!:mime application/x-lzip 7601>4 byte x \b, version: %d 7602 7603# squeeze and crunch 7604# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 76050 beshort 0x76FF squeezed data, 7606>4 string x original name %s 76070 beshort 0x76FE crunched data, 7608>2 string x original name %s 76090 beshort 0x76FD LZH compressed data, 7610>2 string x original name %s 7611 7612# Freeze 76130 string \037\237 frozen file 2.1 76140 string \037\236 frozen file 1.0 (or gzip 0.5) 7615 7616# SCO compress -H (LZH) 76170 string \037\240 SCO compress -H (LZH) data 7618 7619# European GSM 06.10 is a provisional standard for full-rate speech 7620# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 7621# excitation/long term prediction) coding at 13 kbit/s. 7622# 7623# There's only a magic nibble (4 bits); that nibble repeats every 33 7624# bytes. This isn't suited for use, but maybe we can use it someday. 7625# 7626# This will cause very short GSM files to be declared as data and 7627# mismatches to be declared as data too! 7628#0 byte&0xF0 0xd0 data 7629#>33 byte&0xF0 0xd0 7630#>66 byte&0xF0 0xd0 7631#>99 byte&0xF0 0xd0 7632#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 7633 7634# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 76350 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 7636>9 beshort <0x0940 7637>>9 byte&0xf0 =0x00 - version 0. 7638>>9 beshort&0x0fff x \b%03x, 7639>>13 byte 1 LZO1X-1, 7640>>13 byte 2 LZO1X-1(15), 7641>>13 byte 3 LZO1X-999, 7642## >>22 bedate >0 last modified: %s, 7643>>14 byte =0x00 os: MS-DOS 7644>>14 byte =0x01 os: Amiga 7645>>14 byte =0x02 os: VMS 7646>>14 byte =0x03 os: Unix 7647>>14 byte =0x05 os: Atari 7648>>14 byte =0x06 os: OS/2 7649>>14 byte =0x07 os: MacOS 7650>>14 byte =0x0A os: Tops/20 7651>>14 byte =0x0B os: WinNT 7652>>14 byte =0x0E os: Win32 7653>9 beshort >0x0939 7654>>9 byte&0xf0 =0x00 - version 0. 7655>>9 byte&0xf0 =0x10 - version 1. 7656>>9 byte&0xf0 =0x20 - version 2. 7657>>9 beshort&0x0fff x \b%03x, 7658>>15 byte 1 LZO1X-1, 7659>>15 byte 2 LZO1X-1(15), 7660>>15 byte 3 LZO1X-999, 7661## >>25 bedate >0 last modified: %s, 7662>>17 byte =0x00 os: MS-DOS 7663>>17 byte =0x01 os: Amiga 7664>>17 byte =0x02 os: VMS 7665>>17 byte =0x03 os: Unix 7666>>17 byte =0x05 os: Atari 7667>>17 byte =0x06 os: OS/2 7668>>17 byte =0x07 os: MacOS 7669>>17 byte =0x0A os: Tops/20 7670>>17 byte =0x0B os: WinNT 7671>>17 byte =0x0E os: Win32 7672 7673# 4.3BSD-Quasijarus Strong Compression 7674# https://minnie.tuhs.org/Quasijarus/compress.html 76750 string \037\241 Quasijarus strong compressed data 7676 7677# From: Cory Dikkers <cdikkers@swbell.net> 76780 string XPKF Amiga xpkf.library compressed data 76790 string PP11 Power Packer 1.1 compressed data 76800 string PP20 Power Packer 2.0 compressed data, 7681>4 belong 0x09090909 fast compression 7682>4 belong 0x090A0A0A mediocre compression 7683>4 belong 0x090A0B0B good compression 7684>4 belong 0x090A0C0C very good compression 7685>4 belong 0x090A0C0D best compression 7686 7687# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 7688# https://www.7-zip.org or DOC/7zFormat.txt 7689# 76900 string 7z\274\257\047\034 7-zip archive data, 7691>6 byte x version %d 7692>7 byte x \b.%d 7693!:mime application/x-7z-compressed 7694!:ext 7z/cb7 7695 7696# Type: LZMA 76970 lelong&0xffffff =0x5d 7698>12 leshort 0xff LZMA compressed data, 7699!:mime application/x-lzma 7700>>5 lequad =0xffffffffffffffff streamed 7701>>5 lequad !0xffffffffffffffff non-streamed, size %lld 7702>12 leshort 0 LZMA compressed data, 7703>>5 lequad =0xffffffffffffffff streamed 7704>>5 lequad !0xffffffffffffffff non-streamed, size %lld 7705 7706# http://tukaani.org/xz/xz-file-format.txt 77070 ustring \xFD7zXZ\x00 XZ compressed data, checksum 7708!:strength * 2 7709!:mime application/x-xz 7710>7 byte&0xf 0x0 NONE 7711>7 byte&0xf 0x1 CRC32 7712>7 byte&0xf 0x4 CRC64 7713>7 byte&0xf 0xa SHA-256 7714 7715# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 77160 string LRZI LRZIP compressed data 7717>4 byte x - version %d 7718>5 byte x \b.%d 7719!:mime application/x-lrzip 7720 7721# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 77220 lelong 0x184d2204 LZ4 compressed data (v1.4+) 7723!:mime application/x-lz4 7724# Added by osm0sis@xda-developers.com 77250 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 7726!:mime application/x-lz4 77270 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 7728!:mime application/x-lz4 7729 7730# Zstandard/LZ4 skippable frames 7731# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 77320 lelong&0xFFFFFFF0 0x184D2A50 7733>(4.l+8) indirect x 7734 7735# Zstandard Dictionary ID subroutine 77360 name zstd-dictionary-id 7737# Single Segment = True 7738>0 byte &0x20 \b, Dictionary ID: 7739>>0 byte&0x03 0 None 7740>>0 byte&0x03 1 7741>>>1 byte x %u 7742>>0 byte&0x03 2 7743>>>1 leshort x %u 7744>>0 byte&0x03 3 7745>>>1 lelong x %u 7746# Single Segment = False 7747>0 byte ^0x20 \b, Dictionary ID: 7748>>0 byte&0x03 0 None 7749>>0 byte&0x03 1 7750>>>2 byte x %u 7751>>0 byte&0x03 2 7752>>>2 leshort x %u 7753>>0 byte&0x03 3 7754>>>2 lelong x %u 7755 7756# Zstandard compressed data 7757# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 77580 lelong 0xFD2FB522 Zstandard compressed data (v0.2) 7759!:mime application/zstd 77600 lelong 0xFD2FB523 Zstandard compressed data (v0.3) 7761!:mime application/zstd 77620 lelong 0xFD2FB524 Zstandard compressed data (v0.4) 7763!:mime application/zstd 77640 lelong 0xFD2FB525 Zstandard compressed data (v0.5) 7765!:mime application/zstd 77660 lelong 0xFD2FB526 Zstandard compressed data (v0.6) 7767!:mime application/zstd 77680 lelong 0xFD2FB527 Zstandard compressed data (v0.7) 7769!:mime application/zstd 7770>4 use zstd-dictionary-id 77710 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) 7772!:mime application/zstd 7773>4 use zstd-dictionary-id 7774 7775# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 77760 lelong 0xEC30A437 Zstandard dictionary 7777!:mime application/x-std-dictionary 7778>4 lelong x (ID %u) 7779 7780# AFX compressed files (Wolfram Kleff) 77812 string -afx- AFX compressed file data 7782 7783# Supplementary magic data for the file(1) command to support 7784# rzip(1). The format is described in magic(5). 7785# 7786# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 7787# this file. 7788# 77890 string RZIP rzip compressed data 7790>4 byte x - version %d 7791>5 byte x \b.%d 7792>6 belong x (%d bytes) 7793 77940 string ArC\x01 FreeArc archive <http://freearc.org> 7795 7796# Type: DACT compressed files 77970 long 0x444354C3 DACT compressed data 7798>4 byte >-1 (version %i. 7799>5 byte >-1 %i. 7800>6 byte >-1 %i) 7801>7 long >0 , original size: %i bytes 7802>15 long >30 , block size: %i bytes 7803 7804# Valve Pack (VPK) files 78050 lelong 0x55aa1234 Valve Pak file 7806>0x4 lelong x \b, version %u 7807>0x8 lelong x \b, %u entries 7808 7809# Snappy framing format 7810# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 78110 string \377\006\0\0sNaPpY snappy framed data 7812!:mime application/x-snappy-framed 7813 7814# qpress, https://www.quicklz.com/ 78150 string qpress10 qpress compressed data 7816!:mime application/x-qpress 7817 7818# Zlib https://www.ietf.org/rfc/rfc6713.txt 78190 string/b x 7820>0 beshort%31 =0 7821>>0 byte&0xf =8 7822>>>0 byte&0x80 =0 zlib compressed data 7823!:mime application/zlib 7824 7825# BWC compression 78260 string BWC 7827>3 byte 0 BWC compressed data 7828 7829# UCL compression 78300 bequad 0x00e955434cff011a UCL compressed data 7831 7832# Softlib archive 78330 string SLIB Softlib archive 7834>4 leshort x \b, version %d 7835>6 leshort x (contains %d files) 7836 7837# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276 7838# From: Eric Hall <eric.hall@darkart.com> 78390 string bvx- lzfse encoded, no compression 78400 string bvx1 lzfse compressed, uncompressed tables 78410 string bvx2 lzfse compressed, compressed tables 78420 string bvxn lzfse encoded, lzvn compressed 7843 7844# pcxLib.exe compression program 7845# http://www.shikadi.net/moddingwiki/PCX_Library 78460 string/b pcxLib 7847>0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed 7848 7849#------------------------------------------------------------------------------ 7850# $File: console,v 1.62 2021/02/05 21:51:06 christos Exp $ 7851# Console game magic 7852# Toby Deshane <hac@shoelace.digivill.net> 7853 7854# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format 7855# Updated by David Korth <gerbilsoft@gerbilsoft.com> 7856# References: 7857# - https://wiki.nesdev.com/w/index.php/INES 7858# - https://wiki.nesdev.com/w/index.php/NES_2.0 7859 7860# Common header for iNES, NES 2.0, and Wii U iNES. 78610 name nes-rom-image-ines 7862>7 byte&0x0C =0x8 (NES 2.0) 7863>4 byte x \b: %ux16k PRG 7864>5 byte x \b, %ux8k CHR 7865>6 byte&0x08 =0x8 [4-Scr] 7866>6 byte&0x09 =0x0 [H-mirror] 7867>6 byte&0x09 =0x1 [V-mirror] 7868>6 byte&0x02 =0x2 [SRAM] 7869>6 byte&0x04 =0x4 [Trainer] 7870>7 byte&0x03 =0x2 [PC10] 7871>7 byte&0x03 =0x1 [VS] 7872>>7 byte&0x0C =0x8 7873# NES 2.0: VS PPU 7874>>>13 byte&0x0F =0x0 \b, RP2C03B 7875>>>13 byte&0x0F =0x1 \b, RP2C03G 7876>>>13 byte&0x0F =0x2 \b, RP2C04-0001 7877>>>13 byte&0x0F =0x3 \b, RP2C04-0002 7878>>>13 byte&0x0F =0x4 \b, RP2C04-0003 7879>>>13 byte&0x0F =0x5 \b, RP2C04-0004 7880>>>13 byte&0x0F =0x6 \b, RP2C03B 7881>>>13 byte&0x0F =0x7 \b, RP2C03C 7882>>>13 byte&0x0F =0x8 \b, RP2C05-01 7883>>>13 byte&0x0F =0x9 \b, RP2C05-02 7884>>>13 byte&0x0F =0xA \b, RP2C05-03 7885>>>13 byte&0x0F =0xB \b, RP2C05-04 7886>>>13 byte&0x0F =0xC \b, RP2C05-05 7887# TODO: VS protection hardware? 7888>>7 byte x \b] 7889# NES 2.0-specific flags. 7890>7 byte&0x0C =0x8 7891>>12 byte&0x03 =0x0 [NTSC] 7892>>12 byte&0x03 =0x1 [PAL] 7893>>12 byte&0x02 =0x2 [NTSC+PAL] 7894 7895# Standard iNES ROM header. 78960 string NES\x1A NES ROM image (iNES) 7897!:mime application/x-nes-rom 7898>0 use nes-rom-image-ines 7899 7900# Wii U Virtual Console iNES ROM header. 79010 belong 0x4E455300 NES ROM image (Wii U Virtual Console) 7902!:mime application/x-nes-rom 7903>0 use nes-rom-image-ines 7904 7905#------------------------------------------------------------------------------ 7906# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images 7907# Reference: https://wiki.nesdev.com/w/index.php/UNIF 7908# From: David Korth <gerbilsoft@gerbilsoft.com> 7909# 7910# NOTE: The UNIF format uses chunks instead of a fixed header, 7911# so most of the data isn't easily parseable. 7912# 79130 string UNIF 7914>4 lelong <16 NES ROM image (UNIF v%d format) 7915!:mime application/x-nes-rom 7916 7917#------------------------------------------------------------------------------ 7918# fds: file(1) magic for Famciom Disk System disk images 7919# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format 7920# From: David Korth <gerbilsoft@gerbilsoft.com> 7921# TODO: Check "Disk info block" and get info from that in addition to the optional header. 7922 7923# Disk info block. (block 1) 79240 name nintendo-fds-disk-info-block 7925>23 byte !1 FMC- 7926>23 byte 1 FSC- 7927>16 string x \b%.3s 7928>15 byte x \b, mfr %02X 7929>20 byte x (Rev.%02u) 7930 7931# Headered version. 79320 string FDS\x1A 7933>0x11 string *NINTENDO-HVC* Famicom Disk System disk image: 7934!:mime application/x-fds-disk 7935>>0x10 use nintendo-fds-disk-info-block 7936>4 byte 1 (%u side) 7937>4 byte !1 (%u sides) 7938 7939# Unheadered version. 79401 string *NINTENDO-HVC* Famicom Disk System disk image: 7941!:mime application/x-fds-disk 7942>0 use nintendo-fds-disk-info-block 7943 7944#------------------------------------------------------------------------------ 7945# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images 7946# Used by Nintendo 3DS NES Virtual Console games. 7947# From: David Korth <gerbilsoft@gerbilsoft.com> 7948# 79490 string TNES NES ROM image (Nintendo 3DS Virtual Console) 7950!:mime application/x-nes-rom 7951>4 byte 100 \b: FDS, 7952>>0x2010 use nintendo-fds-disk-info-block 7953>4 byte !100 \b: TNES mapper %u 7954>>5 byte x \b, %ux8k PRG 7955>>6 byte x \b, %ux8k CHR 7956>>7 byte&0x08 =1 [WRAM] 7957>>8 byte&0x09 =1 [H-mirror] 7958>>8 byte&0x09 =2 [V-mirror] 7959>>8 byte&0x02 =3 [VRAM] 7960 7961#------------------------------------------------------------------------------ 7962# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 7963# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header 7964# 79650x104 bequad 0xCEED6666CC0D000B Game Boy ROM image 7966# TODO: application/x-gameboy-color-rom for GBC. 7967!:mime application/x-gameboy-rom 7968>0x143 byte&0x80 0x80 7969>>0x134 string >\0 \b: "%.15s" 7970>0x143 byte&0x80 !0x80 7971>>0x134 string >\0 \b: "%.16s" 7972>0x14c byte x (Rev.%02u) 7973 7974# Machine type. (SGB, CGB, SGB+CGB) 7975# Old licensee code 0x33 is required for SGB, but not CGB. 7976>0x14b byte 0x33 7977>>0x146 byte 0x03 7978>>>0x143 byte&0x80 0x80 [SGB+CGB] 7979>>>0x143 byte&0x80 !0x80 [SGB] 7980>>0x146 byte !0x03 7981>>>0x143 byte&0xC0 0x80 [CGB] 7982>>>0x143 byte&0xC0 0xC0 [CGB ONLY] 7983>0x14b byte !0x33 7984>>0x143 byte&0xC0 0x80 [CGB] 7985>>0x143 byte&0xC0 0xC0 [CGB ONLY] 7986 7987# Mapper. 7988>0x147 byte 0x00 [ROM ONLY] 7989>0x147 byte 0x01 [MBC1] 7990>0x147 byte 0x02 [MBC1+RAM] 7991>0x147 byte 0x03 [MBC1+RAM+BATT] 7992>0x147 byte 0x05 [MBC2] 7993>0x147 byte 0x06 [MBC2+BATTERY] 7994>0x147 byte 0x08 [ROM+RAM] 7995>0x147 byte 0x09 [ROM+RAM+BATTERY] 7996>0x147 byte 0x0B [MMM01] 7997>0x147 byte 0x0C [MMM01+SRAM] 7998>0x147 byte 0x0D [MMM01+SRAM+BATT] 7999>0x147 byte 0x0F [MBC3+TIMER+BATT] 8000>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT] 8001>0x147 byte 0x11 [MBC3] 8002>0x147 byte 0x12 [MBC3+RAM] 8003>0x147 byte 0x13 [MBC3+RAM+BATT] 8004>0x147 byte 0x19 [MBC5] 8005>0x147 byte 0x1A [MBC5+RAM] 8006>0x147 byte 0x1B [MBC5+RAM+BATT] 8007>0x147 byte 0x1C [MBC5+RUMBLE] 8008>0x147 byte 0x1D [MBC5+RUMBLE+SRAM] 8009>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT] 8010>0x147 byte 0xFC [Pocket Camera] 8011>0x147 byte 0xFD [Bandai TAMA5] 8012>0x147 byte 0xFE [Hudson HuC-3] 8013>0x147 byte 0xFF [Hudson HuC-1] 8014 8015# ROM size. 8016>0x148 byte 0 \b, ROM: 256Kbit 8017>0x148 byte 1 \b, ROM: 512Kbit 8018>0x148 byte 2 \b, ROM: 1Mbit 8019>0x148 byte 3 \b, ROM: 2Mbit 8020>0x148 byte 4 \b, ROM: 4Mbit 8021>0x148 byte 5 \b, ROM: 8Mbit 8022>0x148 byte 6 \b, ROM: 16Mbit 8023>0x148 byte 7 \b, ROM: 32Mbit 8024>0x148 byte 0x52 \b, ROM: 9Mbit 8025>0x148 byte 0x53 \b, ROM: 10Mbit 8026>0x148 byte 0x54 \b, ROM: 12Mbit 8027 8028# RAM size. 8029>0x149 byte 1 \b, RAM: 16Kbit 8030>0x149 byte 2 \b, RAM: 64Kbit 8031>0x149 byte 3 \b, RAM: 256Kbit 8032>0x149 byte 4 \b, RAM: 1Mbit 8033>0x149 byte 5 \b, RAM: 512Kbit 8034 8035#------------------------------------------------------------------------------ 8036# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats 8037# Updated by David Korth <gerbilsoft@gerbilsoft.com> 8038# References: 8039# - https://www.retrodev.com/segacd.html 8040# - http://devster.monkeeh.com/sega/32xguide1.txt 8041# 8042 8043# Common Sega Mega Drive header format. 8044# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s. 80450 name sega-mega-drive-header 8046# ROM title. (Use domestic if present; if not, use international.) 8047>0x120 byte >0x20 8048>>0x120 string >\0 \b: "%.16s" 8049>0x120 byte <0x21 8050>>0x150 string >\0 \b: "%.16s" 8051# Other information. 8052>0x180 string >\0 (%.14s 8053>>0x110 string >\0 \b, %.16s 8054>0x180 byte 0 8055>>0x110 string >\0 (%.16s 8056>0 byte x \b) 8057 8058# TODO: Check for 32X CD? 8059# Sega Mega CD disc images: 2048-byte sectors. 80600 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 8061!:mime application/x-sega-cd-rom 8062>0 use sega-mega-drive-header 8063>0 byte x \b, 2048-byte sectors 80640 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 8065!:mime application/x-sega-cd-rom 8066>0 use sega-mega-drive-header 8067>0 byte x \b, 2048-byte sectors 8068# Sega Mega CD disc images: 2352-byte sectors. 80690x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 8070!:mime application/x-sega-cd-rom 8071>0x10 use sega-mega-drive-header 8072>0 byte x \b, 2352-byte sectors 80730x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 8074!:mime application/x-sega-cd-rom 8075>0x10 use sega-mega-drive-header 8076>0 byte x \b, 2352-byte sectors 8077 8078# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images. 80790x100 string SEGA 8080>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image 8081!:mime application/x-genesis-32x-rom 8082>>0 use sega-mega-drive-header 8083>0x3C0 bequad !0x4D41525320434845 8084>>0x105 belong 0x5049434F Sega Pico ROM image 8085!:mime application/x-sega-pico-rom 8086>>>0 use sega-mega-drive-header 8087>>0x105 belong !0x5049434F 8088>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image 8089!:mime application/x-genesis-rom 8090>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image 8091!:mime application/x-genesis-rom 8092>>>0 use sega-mega-drive-header 8093 8094#------------------------------------------------------------------------------ 8095# genesis: file(1) magic for the Super MegaDrive ROM dump format 8096# 8097 8098# NOTE: Due to interleaving, we can't display anything 8099# other than the copier header information. 81000 name sega-genesis-smd-header 8101>0 byte x %dx16k blocks 8102>2 byte 0 \b, last in series or standalone 8103>2 byte >0 \b, split ROM 8104 8105# "Sega Genesis" header. 81060x280 string EAGN 8107>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 8108!:mime application/x-genesis-rom 8109>>0 use sega-genesis-smd-header 8110 8111# "Sega Mega Drive" header. 81120x280 string EAMG 8113>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 8114!:mime application/x-genesis-rom 8115>>0 use sega-genesis-smd-header 8116 8117#------------------------------------------------------------------------------ 8118# smsgg: file(1) magic for Sega Master System and Game Gear ROM images 8119# Detects all Game Gear and export Sega Master System ROM images, 8120# and some Japanese Sega Master System ROM images. 8121# From: David Korth <gerbilsoft@gerbilsoft.com> 8122# Reference: https://www.smspower.org/Development/ROMHeader 8123# 8124 8125# General SMS header rule. 8126# The SMS boot ROM checks the header at three locations. 81270 name sega-master-system-rom-header 8128# Machine type. 8129>0x0F byte&0xF0 0x30 Sega Master System 8130!:mime application/x-sms-rom 8131>0x0F byte&0xF0 0x40 Sega Master System 8132!:mime application/x-sms-rom 8133>0x0F byte&0xF0 0x50 Sega Game Gear 8134!:mime application/x-gamegear-rom 8135>0x0F byte&0xF0 0x60 Sega Game Gear 8136!:mime application/x-gamegear-rom 8137>0x0F byte&0xF0 0x70 Sega Game Gear 8138!:mime application/x-gamegear-rom 8139>0x0F default x Sega Master System / Game Gear 8140!:mime application/x-sms-rom 8141>0 byte x ROM image: 8142# Product code. 8143>0x0E byte&0xF0 0x10 1 8144>0x0E byte&0xF0 0x20 2 8145>0x0E byte&0xF0 0x30 3 8146>0x0E byte&0xF0 0x40 4 8147>0x0E byte&0xF0 0x50 5 8148>0x0E byte&0xF0 0x60 6 8149>0x0E byte&0xF0 0x70 7 8150>0x0E byte&0xF0 0x80 8 8151>0x0E byte&0xF0 0x90 9 8152>0x0E byte&0xF0 0xA0 10 8153>0x0E byte&0xF0 0xB0 11 8154>0x0E byte&0xF0 0xC0 12 8155>0x0E byte&0xF0 0xD0 13 8156>0x0E byte&0xF0 0xE0 14 8157>0x0E byte&0xF0 0xF0 15 8158# If the product code is 5 digits, we'll need to backspace here. 8159>0x0E byte&0xF0 !0 8160>>0x0C leshort x \b%04x 8161>0x0E byte&0xF0 0 8162>>0x0C leshort x %04x 8163# Revision. 8164>0x0E byte&0x0F x (Rev.%02d) 8165# ROM size. (Used for the boot ROM checksum routine.) 8166>0x0F byte&0x0F 0x0A (8 KB) 8167>0x0F byte&0x0F 0x0B (16 KB) 8168>0x0F byte&0x0F 0x0C (32 KB) 8169>0x0F byte&0x0F 0x0D (48 KB) 8170>0x0F byte&0x0F 0x0E (64 KB) 8171>0x0F byte&0x0F 0x0F (128 KB) 8172>0x0F byte&0x0F 0x00 (256 KB) 8173>0x0F byte&0x0F 0x01 (512 KB) 8174>0x0F byte&0x0F 0x02 (1 MB) 8175 8176# SMS/GG header locations. 81770x7FF0 string TMR\ SEGA 8178>0x7FF0 use sega-master-system-rom-header 81790x3FF0 string TMR\ SEGA 8180>0x3FF0 use sega-master-system-rom-header 81810x1FF0 string TMR\ SEGA 8182>0x1FF0 use sega-master-system-rom-header 8183 8184#------------------------------------------------------------------------------ 8185# saturn: file(1) magic for the Sega Saturn disc image format. 8186# From: David Korth <gerbilsoft@gerbilsoft.com> 8187# 8188 8189# Common Sega Saturn disc header format. 8190# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding. 8191# TODO: Release date, device information, region code, others? 81920 name sega-saturn-disc-header 8193>0x60 string >\0 \b: "%.32s" 8194>0x20 string >\0 (%.10s 8195>>0x2A string >\0 \b, %.6s) 8196>>0x2A byte 0 \b) 8197 8198# 2048-byte sector version. 81990 string SEGA\ SEGASATURN\ Sega Saturn disc image 8200!:mime application/x-saturn-rom 8201>0 use sega-saturn-disc-header 8202>0 byte x (2048-byte sectors) 8203# 2352-byte sector version. 82040x10 string SEGA\ SEGASATURN\ Sega Saturn disc image 8205!:mime application/x-saturn-rom 8206>0x10 use sega-saturn-disc-header 8207>0 byte x (2352-byte sectors) 8208 8209#------------------------------------------------------------------------------ 8210# dreamcast: file(1) magic for the Sega Dreamcast disc image format. 8211# From: David Korth <gerbilsoft@gerbilsoft.com> 8212# Reference: https://mc.pp.se/dc/ip0000.bin.html 8213# 8214 8215# Common Sega Dreamcast disc header format. 8216# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding. 8217# TODO: Release date, device information, region code, others? 82180 name sega-dreamcast-disc-header 8219>0x80 string >\0 \b: "%.32s" 8220>0x40 string >\0 (%.10s 8221>>0x4A string >\0 \b, %.6s) 8222>>0x4A byte 0 \b) 8223 8224# 2048-byte sector version. 82250 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 8226!:mime application/x-dc-rom 8227>0 use sega-dreamcast-disc-header 8228>0 byte x (2048-byte sectors) 8229# 2352-byte sector version. 82300x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 8231!:mime application/x-dc-rom 8232>0x10 use sega-dreamcast-disc-header 8233>0 byte x (2352-byte sectors) 8234 8235#------------------------------------------------------------------------------ 8236# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 8237# 82380 belong 0x21068028 Sega Dreamcast VMU game image 82390 string LCDi Dream Animator file 8240 8241#------------------------------------------------------------------------------ 8242# z64: file(1) magic for the Z64 format N64 ROM dumps 8243# Reference: http://forum.pj64-emu.com/showthread.php?t=2239 8244# From: David Korth <gerbilsoft@gerbilsoft.com> 8245# 82460 bequad 0x803712400000000F Nintendo 64 ROM image 8247!:mime application/x-n64-rom 8248>0x20 string >\0 \b: "%.20s" 8249>0x3B string x (%.4s 8250>0x3F byte x \b, Rev.%02u) 8251 8252#------------------------------------------------------------------------------ 8253# v64: file(1) magic for the V64 format N64 ROM dumps 8254# Same as z64 format, but with 16-bit byteswapping. 8255# 82560 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) 8257!:mime application/x-n64-rom 8258 8259#------------------------------------------------------------------------------ 8260# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps 8261# Same as z64 format, but with swapped 16-bit words. 8262# 82630 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) 8264!:mime application/x-n64-rom 8265 8266#------------------------------------------------------------------------------ 8267# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps 8268# Same as z64 format, but with 32-bit byteswapping. 8269# 82700 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) 8271!:mime application/x-n64-rom 8272 8273#------------------------------------------------------------------------------ 8274# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format 8275# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader 8276# 8277# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 8278# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 8279# 82804 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image 8281!:mime application/x-gba-rom 8282>0xA0 string >\0 \b: "%.12s" 8283>0xAC string x (%.6s 8284>0xBC byte x \b, Rev.%02u) 8285 8286#------------------------------------------------------------------------------ 8287# nds: file(1) magic for the Nintendo DS(i) raw ROM format 8288# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader 8289# 8290# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 8291# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 8292# 82930xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image 8294!:mime application/x-nintendo-ds-rom 8295>0x00 string >\0 \b: "%.12s" 8296>0x0C string x (%.6s 8297>0x1E byte x \b, Rev.%02u) 8298>0x12 byte 2 (DSi enhanced) 8299>0x12 byte 3 (DSi only) 8300# Secure Area check. 8301>0x20 lelong <0x4000 (homebrew) 8302>0x20 lelong >0x3FFF 8303>>0x4000 lequad 0x0000000000000000 (multiboot) 8304>>0x4000 lequad !0x0000000000000000 8305>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted) 8306>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF 8307>>>>0x1000 lequad 0x0000000000000000 (encrypted) 8308>>>>0x1000 lequad !0x0000000000000000 (mask ROM) 8309 8310#------------------------------------------------------------------------------ 8311# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot. 8312# This is also used for loading .nds files using the MSET exploit on 3DS. 8313# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 83140xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) 8315!:mime application/x-nintendo-ds-rom 8316 8317#------------------------------------------------------------------------------ 8318# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. 8319# From: David Korth <gerbilsoft@gerbilsoft.com> 8320# References: 8321# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp 8322# - https://www.devrs.com/ngp/files/ngpctech.txt 8323# 83240x0A string BY\ SNK\ CORPORATION Neo Geo Pocket 8325!:mime application/x-neo-geo-pocket-rom 8326>0x23 byte 0x10 Color 8327>0 byte x ROM image 8328>0x24 string >\0 \b: "%.12s" 8329>0x1F byte 0xFF (debug mode enabled) 8330 8331#------------------------------------------------------------------------------ 8332# msx: file(1) magic for MSX game cartridge dumps 8333# Too simple - MPi 8334#0 beshort 0x4142 MSX game cartridge dump 8335 8336#------------------------------------------------------------------------------ 8337# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 83380 string PS-X\ EXE Sony Playstation executable 8339>16 lelong x PC=0x%08x, 8340>20 lelong !0 GP=0x%08x, 8341>24 lelong !0 .text=[0x%08x, 8342>>28 lelong x \b0x%x], 8343>32 lelong !0 .data=[0x%08x, 8344>>36 lelong x \b0x%x], 8345>40 lelong !0 .bss=[0x%08x, 8346>>44 lelong x \b0x%x], 8347>48 lelong !0 Stack=0x%08x, 8348>48 lelong =0 No Stack!, 8349>52 lelong !0 StackSize=0x%x, 8350#>76 string >\0 (%s) 8351# Area: 8352>113 string x (%s) 8353 8354# CPE executables 83550 string CPE CPE executable 8356>3 byte x (version %d) 8357 8358#------------------------------------------------------------------------------ 8359# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 83600 string XBEH Microsoft Xbox executable 8361!:mime audio/x-xbox-executable 8362!:ext xbe 8363# expect base address of 0x10000 8364>0x0104 ulelong =0x10000 8365>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" 8366>>(0x0118.l-0x0FFF5) byte x (%c 8367>>(0x0118.l-0x0FFF6) byte x \b%c- 8368>>(0x0118.l-0x0FFF8) uleshort x \b%03u) 8369>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 8370>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007 8371>>>(0x0118.l-0x0FF60) ulelong >0 (regions: 8372>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA 8373>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan 8374>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World 8375>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer 8376>>>(0x0118.l-0x0FF60) ulelong >0 \b) 8377# probabilistic checks whether signed or not 8378>0x0004 ulelong =0x0 8379>>&2 ulelong =0x0 8380>>>&2 ulelong =0x0 \b, not signed 8381>0x0004 ulelong >0 8382>>&2 ulelong >0 8383>>>&2 ulelong >0 \b, signed 8384 8385# -------------------------------- 8386# Microsoft Xbox data file formats 83870 string XIP0 XIP, Microsoft Xbox data 83880 string XTF0 XTF, Microsoft Xbox data 8389 8390#------------------------------------------------------------------------------ 8391# Microsoft Xbox 360 executables (.xex) 8392# From: David Korth <gerbilsoft@gerbilsoft.com> 8393# References: 8394# - https://free60project.github.io/wiki/XEX.html 8395# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 8396 8397# Title ID (part of Execution ID section) 83980 name xbox-360-xex-execution-id 8399>(0.L+0xC) byte x (%c 8400>(0.L+0xD) byte x \b%c 8401>(0.L+0xE) beshort x \b-%04u, media ID: 8402>(0.L) belong x %08X) 8403 8404# Region code (part of Security Info) 84050 name xbox-360-xex-region-code 8406>0 ubelong 0xFFFFFFFF \b, all regions 8407>0 ubelong !0xFFFFFFFF 8408>>0 ubelong >0 (regions: 8409>>0 ubelong&0x000000FF 0x000000FF USA 8410>>0 ubelong&0x00000100 0x00000100 Japan 8411>>0 ubelong&0x00000200 0x00000200 China 8412>>0 ubelong&0x0000FC00 0x0000FC00 Asia 8413>>0 ubelong&0x00FF0000 0x00FF0000 PAL 8414>>0 ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] 8415>>0 ubelong&0x00FF0000 0x00010000 AU/NZ 8416>>0 ubelong&0xFF000000 0xFF000000 Other 8417>>0 ubelong >0 \b) 8418 84190 string XEX2 Microsoft Xbox 360 executable 8420!:mime audio/x-xbox360-executable 8421!:ext xex 8422>0x18 search/0x100 \x00\x04\x00\x06 8423>>&0 use xbox-360-xex-execution-id 8424>(0x010.L+0x178) use xbox-360-xex-region-code 8425 84260 string XEX1 Microsoft Xbox 360 executable (XEX1) 8427!:mime audio/x-xbox360-executable 8428!:ext xex 8429>0x18 search/0x100 \x00\x04\x00\x06 8430>>&0 use xbox-360-xex-execution-id 8431>(0x010.L+0x154) use xbox-360-xex-region-code 8432 8433#------------------------------------------------------------------------------ 8434# Microsoft Xbox 360 packages 8435# From: David Korth <gerbilsoft@gerbilsoft.com> 8436# References: 8437# - https://free60project.github.io/wiki/STFS.html 8438# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 8439 8440# TODO: More information for console-signed packages. 8441 84420 name xbox-360-package 8443>0x360 byte x (%c 8444>0x361 byte x \b%c 8445>0x362 beshort x \b-%04u, media ID: 8446>0x354 belong x %08X) 8447>0x344 belong x \b, content type: 8448>>0x344 belong 0x1 Saved Game 8449>>0x344 belong 0x2 Marketplace Content 8450>>0x344 belong 0x3 Publisher 8451>>0x344 belong 0x1000 Xbox 360 Title 8452>>0x344 belong 0x2000 IPTV Pause Buffer 8453>>0x344 belong 0x4000 Installed Game 8454>>0x344 belong 0x5000 Original Xbox Game 8455>>0x344 belong 0x9000 Avatar Item 8456>>0x344 belong 0x10000 Profile 8457>>0x344 belong 0x20000 Gamer Picture 8458>>0x344 belong 0x30000 Theme 8459>>0x344 belong 0x40000 Cache File 8460>>0x344 belong 0x50000 Storage Download 8461>>0x344 belong 0x60000 Xbox Saved Game 8462>>0x344 belong 0x70000 Xbox Download 8463>>0x344 belong 0x80000 Game Demo 8464>>0x344 belong 0x90000 Video 8465>>0x344 belong 0xA0000 Game 8466>>0x344 belong 0xB0000 Installer 8467>>0x344 belong 0xC0000 Game Trailer 8468>>0x344 belong 0xD0000 Arcade Title 8469>>0x344 belong 0xE0000 XNA 8470>>0x344 belong 0xF0000 License Store 8471>>0x344 belong 0x100000 Movie 8472>>0x344 belong 0x200000 TV 8473>>0x344 belong 0x300000 Music Video 8474>>0x344 belong 0x400000 Game Video 8475>>0x344 belong 0x500000 Podcast Video 8476>>0x344 belong 0x600000 Viral Video 8477>>0x344 belong 0x2000000 Community Game 8478 84790 string CON\x20 Microsoft Xbox 360 package (console-signed) 8480>0 use xbox-360-package 84810 string PIRS 8482>0 belong 0 Microsoft Xbox 360 package (non-Xbox Live) 8483>>0 use xbox-360-package 84840 string LIVE 8485>0x104 belong 0 Microsoft Xbox 360 package (Xbox Live) 8486>>0 use xbox-360-package 8487 8488# Atari Lynx cartridge dump (EXE/BLL header) 8489# From: "Stefan A. Haubenthal" <polluks@web.de> 8490 8491# Double-check that the image type matches too, 0x8008 conflicts with 8492# 8 character OMF-86 object file headers. 84930 beshort 0x8008 8494>6 string BS93 Lynx homebrew cartridge 8495!:mime application/x-atari-lynx-rom 8496>>2 beshort x \b, RAM start $%04x 8497>6 string LYNX Lynx cartridge 8498!:mime application/x-atari-lynx-rom 8499>>2 beshort x \b, RAM start $%04x 8500 8501# Opera file system that is used on the 3DO console 8502# From: Serge van den Boom <svdb@stack.nl> 85030 string \x01ZZZZZ\x01 3DO "Opera" file system 8504 8505# From: Alex Myczko <alex@aiei.ch> 8506# From: David Pflug <david@pflug.email> 8507# is the offset 12 or the offset 16 correct? 8508# GBS (Game Boy Sound) magic 8509# ftp://ftp.modland.com/pub/documents/format_documentation/\ 8510# Gameboy%20Sound%20System%20(.gbs).txt 85110 string GBS Nintendo Gameboy Music/Audio Data 8512#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 8513>16 string >\0 ("%.32s" by 8514>48 string >\0 %.32s, copyright 8515>80 string >\0 %.32s), 8516>3 byte x version %u, 8517>4 byte x %u tracks 8518 8519# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at> 8520# see https://zerosoft.zophar.net/ips.php 85210 string PATCH IPS patch file 8522!:ext ips 8523 8524# BPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8525# Reference: https://www.romhacking.net/documents/746/ 85260 string BPS1 BPS patch file 8527!:ext bps 8528 8529# APS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8530# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64) 85310 string APS10 APS patch file 8532!:ext aps 8533>5 byte 0 \b, simple patch 8534>5 byte 1 \b, N64-specific patch for 8535>>58 byte x N%c 8536>>59 byte x \b%c 8537>>60 byte x \b%c 8538>7 byte !0x20 8539# FIXME: /T specifier isn't working with a fixed-length string. 8540>>7 string x \b: "%.50s" 8541 8542# UPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 8543# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format) 85440 string UPS1 UPS patch file 8545!:ext ups 8546 8547# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 85480 string PPF30 Playstation Patch File version 3.0 8549>5 byte 0 \b, PPF 1.0 patch 8550>5 byte 1 \b, PPF 2.0 patch 8551>5 byte 2 \b, PPF 3.0 patch 8552>>56 byte 0 \b, Imagetype BIN (any) 8553>>56 byte 1 \b, Imagetype GI (PrimoDVD) 8554>>57 byte 0 \b, Blockcheck disabled 8555>>57 byte 1 \b, Blockcheck enabled 8556>>58 byte 0 \b, Undo data not available 8557>>58 byte 1 \b, Undo data available 8558>6 string x \b, description: %s 8559 85600 string PPF20 Playstation Patch File version 2.0 8561>5 byte 0 \b, PPF 1.0 patch 8562>5 byte 1 \b, PPF 2.0 patch 8563>>56 lelong >0 \b, size of file to patch %d 8564>6 string x \b, description: %s 8565 85660 string PPF10 Playstation Patch File version 1.0 8567>5 byte 0 \b, Simple Encoding 8568>6 string x \b, description: %s 8569 8570# From: Daniel Dawson <ddawson@icehouse.net> 8571# SNES9x .smv "movie" file format. 85720 string SMV\x1A SNES9x input recording 8573>0x4 lelong x \b, version %d 8574# version 4 is latest so far 8575>0x4 lelong <5 8576>>0x8 ledate x \b, recorded at %s 8577>>0xc lelong >0 \b, rerecorded %d times 8578>>0x10 lelong x \b, %d frames long 8579>>0x14 byte >0 \b, data for controller(s): 8580>>>0x14 byte &0x1 #1 8581>>>0x14 byte &0x2 #2 8582>>>0x14 byte &0x4 #3 8583>>>0x14 byte &0x8 #4 8584>>>0x14 byte &0x10 #5 8585>>0x15 byte ^0x1 \b, begins from snapshot 8586>>0x15 byte &0x1 \b, begins from reset 8587>>0x15 byte ^0x2 \b, NTSC standard 8588>>0x15 byte &0x2 \b, PAL standard 8589>>0x17 byte &0x1 \b, settings: 8590# WIP1Timing not used as of version 4 8591>>>0x4 lelong <4 8592>>>>0x17 byte &0x2 WIP1Timing 8593>>>0x17 byte &0x4 Left+Right 8594>>>0x17 byte &0x8 VolumeEnvX 8595>>>0x17 byte &0x10 FakeMute 8596>>>0x17 byte &0x20 SyncSound 8597# New flag as of version 4 8598>>>0x4 lelong >3 8599>>>>0x17 byte &0x80 NoCPUShutdown 8600>>0x4 lelong <4 8601>>>0x18 lelong >0x23 8602>>>>0x20 leshort !0 8603>>>>>0x20 lestring16 x \b, metadata: "%s" 8604>>0x4 lelong >3 8605>>>0x24 byte >0 \b, port 1: 8606>>>>0x24 byte 1 joypad 8607>>>>0x24 byte 2 mouse 8608>>>>0x24 byte 3 SuperScope 8609>>>>0x24 byte 4 Justifier 8610>>>>0x24 byte 5 multitap 8611>>>0x24 byte >0 \b, port 2: 8612>>>>0x25 byte 1 joypad 8613>>>>0x25 byte 2 mouse 8614>>>>0x25 byte 3 SuperScope 8615>>>>0x25 byte 4 Justifier 8616>>>>0x25 byte 5 multitap 8617>>>0x18 lelong >0x43 8618>>>>0x40 leshort !0 8619>>>>>0x40 lestring16 x \b, metadata: "%s" 8620>>0x17 byte &0x40 \b, ROM: 8621>>>(0x18.l-26) lelong x CRC32 0x%08x 8622>>>(0x18.l-23) string x "%s" 8623 8624# Type: scummVM savegame files 8625# From: Sven Hartge <debian@ds9.argh.org> 86260 string SCVM ScummVM savegame 8627>12 string >\0 "%s" 8628 8629#------------------------------------------------------------------------------ 8630# Nintendo GameCube / Wii file formats. 8631# 8632 8633# Type: Nintendo GameCube/Wii common disc header data. 8634# From: David Korth <gerbilsoft@gerbilsoft.com> 8635# Reference: https://wiibrew.org/wiki/Wii_Disc 86360 name nintendo-gcn-disc-common 8637>0x20 string x "%.64s" 8638>0x00 string x (%.6s 8639>0x06 byte >0 8640>>0x06 byte 1 \b, Disc 2 8641>>0x06 byte 2 \b, Disc 3 8642>>0x06 byte 3 \b, Disc 4 8643>0x07 byte x \b, Rev.%02u) 8644>0x18 belong 0x5D1C9EA3 8645>>0x60 beshort 0x0101 \b (Unencrypted) 8646>0x200 string NKIT \b (NKit compressed) 8647 8648 8649# Type: Nintendo GameCube disc image 8650# From: David Korth <gerbilsoft@gerbilsoft.com> 8651# Reference: https://wiibrew.org/wiki/Wii_Disc 86520x1C belong 0xC2339F3D Nintendo GameCube disc image: 8653!:mime application/x-gamecube-rom 8654>0 use nintendo-gcn-disc-common 8655 8656# Type: Nintendo GameCube embedded disc image 8657# Commonly found on demo discs. 8658# From: David Korth <gerbilsoft@gerbilsoft.com> 8659# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8 86600 belong 0xAE0F38A2 8661>0x0C belong 0x00100000 8662>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: 8663!:mime application/x-gamecube-rom 8664>>>(8.L) use nintendo-gcn-disc-common 8665 8666# Type: Nintendo Wii disc image 8667# From: David Korth <gerbilsoft@gerbilsoft.com> 8668# Reference: https://wiibrew.org/wiki/Wii_Disc 86690x18 belong 0x5D1C9EA3 Nintendo Wii disc image: 8670>0 use nintendo-gcn-disc-common 8671 8672# Type: Nintendo Wii disc image (WBFS format) 8673# From: David Korth <gerbilsoft@gerbilsoft.com> 8674# Reference: https://wiibrew.org/wiki/Wii_Disc 86750 string WBFS 8676>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): 8677!:mime application/x-wii-rom 8678>>0x200 use nintendo-gcn-disc-common 8679 8680# Type: Nintendo GameCube/Wii disc image (CISO format) 8681# NOTE: This is NOT the same as Compact ISO or PSP CISO, 8682# though it has the same magic number. 86830 string CISO 8684# Other fields are used to determine what type of CISO this is: 8685# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 8686# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 8687# - None of the above: Compact ISO. 8688>4 lelong 0x200000 8689>>8 byte 1 8690>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): 8691!:mime application/x-wii-rom 8692>>>>0x8000 use nintendo-gcn-disc-common 8693>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): 8694!:mime application/x-wii-rom 8695>>>>0x8000 use nintendo-gcn-disc-common 8696 8697# Type: Nintendo GameCube/Wii disc image (GCZ format) 8698# Due to zlib compression, we can't get the actual disc information. 86990 lelong 0xB10BC001 8700>4 lelong 0 Nintendo GameCube disc image (GCZ format) 8701!:mime application/x-gamecube-rom 8702>4 lelong 1 Nintendo Wii disc image (GCZ format) 8703!:mime application/x-wii-rom 8704>4 default x Nintendo GameCube/Wii disc image (GCZ format) 8705 8706# Type: Nintendo GameCube/Wii disc image (WDF format) 87070 string WII\001DISC 8708>8 belong 1 8709# WDFv1 8710>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): 8711!:mime application/x-gamecube-rom 8712>>>0x38 use nintendo-gcn-disc-common 8713>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): 8714!:mime application/x-wii-rom 8715>>>0x38 use nintendo-gcn-disc-common 8716>8 belong 2 8717# WDFv2 8718>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): 8719!:mime application/x-gamecube-rom 8720>>>(12.L) use nintendo-gcn-disc-common 8721>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): 8722!:mime application/x-wii-rom 8723>>>(12.L) use nintendo-gcn-disc-common 8724 8725# Type: Nintendo GameCube/Wii disc image (WIA format) 87260 string WIA\001 Nintendo 8727>0x48 belong 1 GameCube 8728!:mime application/x-gamecube-rom 8729>0x48 belong 2 Wii 8730!:mime application/x-wii-rom 8731>0x48 default x GameCube/Wii 8732>0x48 belong x disc image (WIA format): 8733>>0x58 use nintendo-gcn-disc-common 8734 8735# Type: Nintendo GameCube/Wii disc image (with SDK header) 8736# From: David Korth <gerbilsoft@gerbilsoft.com> 8737# Reference: https://wiibrew.org/wiki/Wii_Disc 87380 belong 0xFFFF0000 8739>0x18 belong 0x00000000 8740>>0x1C belong 0x00000000 8741>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: 8742!:mime application/x-wii-rom 8743>>>>0x8000 use nintendo-gcn-disc-common 8744>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: 8745!:mime application/x-gamecube-rom 8746>>>>0x8000 use nintendo-gcn-disc-common 8747 8748#------------------------------------------------------------------------------ 8749# Nintendo 3DS file formats. 8750# 8751 8752# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC) 8753# From: David Korth <gerbilsoft@gerbilsoft.com> 8754# Reference: https://www.3dbrew.org/wiki/NCSD 87550x100 string NCSD 8756>0x118 lequad 0 Nintendo 3DS Game Card image 8757# NCCH header for partition 0. (game data) 8758>>0x1150 string >\0 \b: "%.16s" 8759>>0x312 byte x (Rev.%02u) 8760>>0x118C byte 2 (New3DS only) 8761>>0x18D byte 0 (inner device) 8762>>0x18D byte 1 (Card1) 8763>>0x18D byte 2 (Card2) 8764>>0x18D byte 3 (extended device) 8765>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS) 8766>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS) 8767 8768# Nintendo 3DS version code. 8769# Reference: https://www.3dbrew.org/wiki/Titles 8770# Format: leshort containing three fields: 8771# - 6-bit: Major 8772# - 6-bit: Minor 8773# - 4-bit: Revision 8774# NOTE: Only supporting major/minor versions from 0-15 right now. 8775# NOTE: Should be prefixed with "v". 87760 name nintendo-3ds-version-code 8777# Raw version. 8778>0 leshort x \b%u, 8779# Major version. 8780>0 leshort&0xFC00 0x0000 0 8781>0 leshort&0xFC00 0x0400 1 8782>0 leshort&0xFC00 0x0800 2 8783>0 leshort&0xFC00 0x0C00 3 8784>0 leshort&0xFC00 0x1000 4 8785>0 leshort&0xFC00 0x1400 5 8786>0 leshort&0xFC00 0x1800 6 8787>0 leshort&0xFC00 0x1C00 7 8788>0 leshort&0xFC00 0x2000 8 8789>0 leshort&0xFC00 0x2400 9 8790>0 leshort&0xFC00 0x2800 10 8791>0 leshort&0xFC00 0x2C00 11 8792>0 leshort&0xFC00 0x3000 12 8793>0 leshort&0xFC00 0x3400 13 8794>0 leshort&0xFC00 0x3800 14 8795>0 leshort&0xFC00 0x3C00 15 8796# Minor version. 8797>0 leshort&0x03F0 0x0000 \b.0 8798>0 leshort&0x03F0 0x0010 \b.1 8799>0 leshort&0x03F0 0x0020 \b.2 8800>0 leshort&0x03F0 0x0030 \b.3 8801>0 leshort&0x03F0 0x0040 \b.4 8802>0 leshort&0x03F0 0x0050 \b.5 8803>0 leshort&0x03F0 0x0060 \b.6 8804>0 leshort&0x03F0 0x0070 \b.7 8805>0 leshort&0x03F0 0x0080 \b.8 8806>0 leshort&0x03F0 0x0090 \b.9 8807>0 leshort&0x03F0 0x00A0 \b.10 8808>0 leshort&0x03F0 0x00B0 \b.11 8809>0 leshort&0x03F0 0x00C0 \b.12 8810>0 leshort&0x03F0 0x00D0 \b.13 8811>0 leshort&0x03F0 0x00E0 \b.14 8812>0 leshort&0x03F0 0x00F0 \b.15 8813# Revision. 8814>0 leshort&0x000F x \b.%u 8815 8816# Type: Nintendo 3DS "NCCH" container. 8817# https://www.3dbrew.org/wiki/NCCH 88180x100 string NCCH Nintendo 3DS 8819>0x18D byte&2 0 File Archive (CFA) 8820>0x18D byte&2 2 Executable Image (CXI) 8821>0x150 string >\0 \b: "%.16s" 8822>0x18D byte 0x05 8823>>0x10E leshort x (Old3DS System Update v 8824>>0x10E use nintendo-3ds-version-code 8825>>0x10E leshort x \b) 8826>0x18D byte 0x15 8827>>0x10E leshort x (New3DS System Update v 8828>>0x10E use nintendo-3ds-version-code 8829>>0x10E leshort x \b) 8830>0x18D byte !0x05 8831>>0x18D byte !0x15 8832>>>0x112 byte x (v 8833>>>0x112 use nintendo-3ds-version-code 8834>>>0x112 byte x \b) 8835>0x18C byte 2 (New3DS only) 8836 8837# Type: Nintendo 3DS "SMDH" file. (application description) 8838# From: David Korth <gerbilsoft@gerbilsoft.com> 8839# Reference: https://3dbrew.org/wiki/SMDH 88400 string SMDH Nintendo 3DS SMDH file 8841>0x208 leshort !0 8842>>0x208 lestring16 x \b: "%.128s" 8843>>0x388 leshort !0 8844>>>0x388 lestring16 x by %.128s 8845>0x208 leshort 0 8846>>0x008 leshort !0 8847>>>0x008 lestring16 x \b: "%.128s" 8848>>>0x188 leshort !0 8849>>>>0x188 lestring16 x by %.128s 8850 8851# Type: Nintendo 3DS Homebrew Application. 8852# From: David Korth <gerbilsoft@gerbilsoft.com> 8853# Reference: https://3dbrew.org/wiki/3DSX_Format 88540 string 3DSX Nintendo 3DS Homebrew Application (3DSX) 8855 8856# Type: Nintendo 3DS Banner Model Data. 8857# From: David Korth <gerbilsoft@gerbilsoft.com> 8858# Reference: https://3dbrew.org/wiki/CBMD 88590 string CBMD\0\0\0\0 Nintendo 3DS Banner Model Data 8860 8861#------------------------------------------------------------------------------ 8862# a7800: file(1) magic for the Atari 7800 raw ROM format. 8863# From: David Korth <gerbilsoft@gerbilsoft.com> 8864# Reference: https://sites.google.com/site/atari7800wiki/a78-header 8865 88660 byte >0 8867>0 byte <3 8868>>1 string ATARI7800 Atari 7800 ROM image 8869!:mime application/x-atari-7800-rom 8870>>>0x11 string >\0 \b: "%.32s" 8871# Display type. 8872>>>0x39 byte 0 (NTSC) 8873>>>0x39 byte 1 (PAL) 8874>>>0x36 byte&1 1 (POKEY) 8875 8876#------------------------------------------------------------------------------ 8877# vectrex: file(1) magic for the GCE Vectrex raw ROM format. 8878# From: David Korth <gerbilsoft@gerbilsoft.com> 8879# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm 8880# 8881# NOTE: Title is terminated with 0x80, not 0. 8882# The header is terminated with a 0, so that will 8883# terminate the title as well. 8884# 88850 string g\ GCE Vectrex ROM image 8886>0x11 string >\0 \b: "%.16s" 8887 8888#------------------------------------------------------------------------------ 8889# amiibo: file(1) magic for Nintendo amiibo NFC dumps. 8890# From: David Korth <gerbilsoft@gerbilsoft.com> 8891# Reference: https://www.3dbrew.org/wiki/Amiibo 88920x00 byte 0x04 8893>0x0A beshort 0x0FE0 8894>>0x0C belong 0xF110FFEE 8895>>>0x208 beshort 0x0100 8896>>>>0x020A byte 0x0F 8897>>>>>0x020C bequad 0x000000045F000000 8898>>>>>>0x5B byte 0x02 8899>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- 8900>>>>>>>0x58 belong x \b%08X 8901 8902#------------------------------------------------------------------------------ 8903# Type: Nintendo Switch XCI (Game Cartridge Image) 8904# From: Benjamin Lowry <ben@ben.gmbh> 8905# Reference: https://switchbrew.org/wiki/Gamecard_Format 89060x100 string HEAD 8907>0x10D byte 0xFA Nintendo Switch cartridge image (XCI), 1GB 8908>0x10D byte 0xF8 Nintendo Switch cartridge image (XCI), 2GB 8909>0x10D byte 0xF0 Nintendo Switch cartridge image (XCI), 4GB 8910>0x10D byte 0xE0 Nintendo Switch cartridge image (XCI), 8GB 8911>0x10D byte 0xE1 Nintendo Switch cartridge image (XCI), 16GB 8912>0x10D byte 0xE2 Nintendo Switch cartridge image (XCI), 32GB 8913 8914#------------------------------------------------------------------------------ 8915# Type: Nintendo Switch Executable 8916# From: Benjamin Lowry <ben@ben.gmbh> 8917# Reference: https://switchbrew.org/wiki/NSO 89180x00 string NSO0 Nintendo Switch executable (NSO) 8919 8920#------------------------------------------------------------------------------ 8921# Type: Nintendo Switch PFS0 8922# From: Benjamin Lowry <ben@ben.gmbh> 8923# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0 89240x00 string PFS0 Nintendo Switch partition filesystem (PFS0) 8925>0x04 ulelong x \b, %d files 8926 8927#------------------------------------------------------------------------------ 8928# amiibo: file(1) magic for Nintendo Badge Arcade files. 8929# From: David Korth <gerbilsoft@gerbilsoft.com> 8930# References: 8931# - https://github.com/GerbilSoft/rom-properties/issues/92 8932# - https://github.com/CaitSith2/BadgeArcadeTool 8933# - https://github.com/TheMachinumps/Advanced-badge-editor 8934 8935# PRBS: Individual badge and/or mega badge. 89360 string PRBS 8937>0x44 byte >0x20 Nintendo Badge Arcade 8938>>0xB8 ulelong <2 8939>>>0xBC ulelong <2 badge: 8940>>>0xBC ulelong >1 Mega Badge 8941>>>>0xB8 ulelong x (%ux 8942>>>>0xBC ulelong x \b%u): 8943>>0xB8 ulelong >1 Mega Badge 8944>>>0xB8 ulelong x (%ux 8945>>>0xBC ulelong x \b%u): 8946>0x44 string x "%s" 8947>0x3C ulelong x \b, badge ID: %u 8948>0x74 byte >0x20 8949>>0x74 string x \b, set: "%s" 8950>0xA8 ulelong !0xFFFFFFFF 8951>>0xA8 ulelong x \b, launch title ID: %08X 8952>>0xA4 ulelong x \b-%08X 8953 8954# CABS: Badge set. 89550 string CABS 8956>0x2C byte >0x20 Nintendo Badge Arcade badge set: 8957>>0x2C string x "%.48s" 8958>>0x24 ulelong x \b, set ID: %u 8959 8960#------------------------------------------------------------------------------ 8961# sufami: file(1) magic for Sufami Turbo ROM images. 8962# From: David Korth <gerbilsoft@gerbilsoft.com> 8963# References: 8964# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor 89650 string BANDAI\ SFC-ADX 8966>0x10 string !SFC-ADX\ BACKUP Sufami Turbo ROM image: 8967>>0x10 string/T x "%.14s" 8968>>0x30 byte x \b, ID %02X 8969>>0x31 byte x \b%02X 8970>>0x32 byte x \b%02X 8971>>0x33 ubyte >0 \b, series index %u 8972>>0x34 ubyte 0 [SlowROM] 8973>>0x34 ubyte 1 [FastROM] 8974>>0x35 ubyte 1 [SRAM] 8975>>0x35 ubyte 3 [Special] 8976 8977# Type: Nintendo GameCube/Wii disc image (RVZ format) 89780 string RVZ\001 Nintendo 8979>0x48 belong 1 GameCube 8980!:mime application/x-gamecube-rom 8981>0x48 belong 2 Wii 8982!:mime application/x-wii-rom 8983>0x48 default x GameCube/Wii 8984>0x48 belong x disc image (RVZ format): 8985>>0x58 use nintendo-gcn-disc-common 8986 8987 8988#------------------------------------------------------------------------------ 8989# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 8990# convex: file(1) magic for Convex boxes 8991# 8992# Convexes are big-endian. 8993# 8994# /*\ 8995# * Below are the magic numbers and tests added for Convex. 8996# * Added at beginning, because they are expected to be used most. 8997# \*/ 89980 belong 0507 Convex old-style object 8999>16 belong >0 not stripped 90000 belong 0513 Convex old-style demand paged executable 9001>16 belong >0 not stripped 90020 belong 0515 Convex old-style pre-paged executable 9003>16 belong >0 not stripped 90040 belong 0517 Convex old-style pre-paged, non-swapped executable 9005>16 belong >0 not stripped 90060 belong 0x011257 Core file 9007# 9008# The following are a series of dump format magic numbers. Each one 9009# corresponds to a drastically different dump format. The first on is 9010# the original dump format on a 4.1 BSD or earlier file system. The 9011# second marks the change between the 4.1 file system and the 4.2 file 9012# system. The Third marks the changing of the block size from 1K 9013# to 2K to be compatible with an IDC file system. The fourth indicates 9014# a dump that is dependent on Convex Storage Manager, because data in 9015# secondary storage is not physically contained within the dump. 9016# The restore program uses these number to determine how the data is 9017# to be extracted. 9018# 901924 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 902024 belong =60014 dump format, Convex Storage Manager by-reference dump 9021# 9022# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 9023# If there is no `=' sign, assume just checking for whether the bit is set? 9024# 90250 belong 0601 Convex SOFF 9026>88 belong&0x000f0000 =0x00000000 c1 9027>88 belong &0x00010000 c2 9028>88 belong &0x00020000 c2mp 9029>88 belong &0x00040000 parallel 9030>88 belong &0x00080000 intrinsic 9031>88 belong &0x00000001 demand paged 9032>88 belong &0x00000002 pre-paged 9033>88 belong &0x00000004 non-swapped 9034>88 belong &0x00000008 POSIX 9035# 9036>84 belong &0x80000000 executable 9037>84 belong &0x40000000 object 9038>84 belong&0x20000000 =0 not stripped 9039>84 belong&0x18000000 =0x00000000 native fpmode 9040>84 belong&0x18000000 =0x10000000 ieee fpmode 9041>84 belong&0x18000000 =0x18000000 undefined fpmode 9042# 90430 belong 0605 Convex SOFF core 9044# 90450 belong 0607 Convex SOFF checkpoint 9046>88 belong&0x000f0000 =0x00000000 c1 9047>88 belong &0x00010000 c2 9048>88 belong &0x00020000 c2mp 9049>88 belong &0x00040000 parallel 9050>88 belong &0x00080000 intrinsic 9051>88 belong &0x00000008 POSIX 9052# 9053>84 belong&0x18000000 =0x00000000 native fpmode 9054>84 belong&0x18000000 =0x10000000 ieee fpmode 9055>84 belong&0x18000000 =0x18000000 undefined fpmode 9056 9057#------------------------------------------------------------------------------ 9058# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $ 9059# xoverage: file(1) magic for test coverage data 9060 9061# File formats used to store test coverage data 9062# 2016-05-21, Georg Sauthoff <mail@georg.so> 9063 9064 9065# - GCC gcno - written by GCC at compile time when compiling with 9066# gcc -ftest-coverage 9067# - GCC gcda - written by a program that was compiled with 9068# gcc -fprofile-arcs 9069# - LLVM raw profiles - generated by a program compiled with 9070# clang -fprofile-instr-generate -fcoverage-mapping ... 9071# - LLVM indexed profiles - generated by 9072# llvm-profdata 9073# - GCOV reports, i.e. the annotated source code 9074# - LCOV trace files, i.e. aggregated GCC profiles 9075# 9076# GCC coverage tracefiles 9077# .gcno file are created during compile time, 9078# while data collected during runtime is stored in .gcda files 9079# cf. gcov-io.h 9080# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html 9081# Examples: 9082# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35 9083# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a 90840 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage), 9085>&3 byte x version %c. 9086>&1 byte x \b%c 9087 9088# big endian 90890 belong 0x67636e6f GCC gcno coverage (-ftest-coverage), 9090>&0 byte x version %c. 9091>&2 byte x \b%c (big-endian) 9092 9093# Examples: 9094# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35 9095# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a 90960 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs), 9097>&3 byte x version %c. 9098>&1 byte x \b%c 9099 9100# big endian 91010 belong 0x67636461 GCC gcda coverage (-fprofile-arcs), 9102>&0 byte x version %c. 9103>&2 byte x \b%c (big-endian) 9104 9105 9106# LCOV tracefiles 9107# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php 91080 string TN: 9109>&0 search/64 \nSF:/ LCOV coverage tracefile 9110 9111 9112# Coverage reports generated by gcov 9113# i.e. source code annotated with coverage information 91140 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source: 9115>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph: 9116>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report 9117 9118 9119# LLVM coverage files 9120 9121# raw data after running a program compiled with: 9122# `clang -fprofile-instr-generate -fcoverage-mapping ...` 9123# default name: default.profraw 9124# magic is: \xFF lprofr \x81 9125# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 91260 lequad 0xff6c70726f667281 LLVM raw profile data, 9127>&0 byte x version %d 9128 9129# big endian 91300 bequad 0xff6c70726f667281 LLVM raw profile data, 9131>&7 byte x version %d (big-endian) 9132 9133 9134# LLVM indexed instruction profile (as generated by llvm-profdata) 9135# magic is: reverse(\xFF lprofi \x81) 9136# cf. https://llvm.org/docs/CoverageMappingFormat.html 9137# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html 9138# https://llvm.org/docs/CommandGuide/llvm-cov.html 9139# https://llvm.org/docs/CommandGuide/llvm-profdata.html 91400 lequad 0x8169666f72706cff LLVM indexed profile data, 9141>&0 byte x version %d 9142 9143# big endian 91440 bequad 0x8169666f72706cff LLVM indexed profile data, 9145>&7 byte x version %d (big-endian) 9146 9147 9148#------------------------------------------------------------------------------ 9149# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 9150# cracklib: file (1) magic for cracklib v2.7 9151 91520 lelong 0x70775631 Cracklib password index, little endian 9153>4 long >0 (%i words) 9154>4 long 0 ("64-bit") 9155>>8 long >-1 (%i words) 91560 belong 0x70775631 Cracklib password index, big endian 9157>4 belong >-1 (%i words) 9158# really bellong 0x0000000070775631 91590 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 9160>12 belong >0 (%i words) 9161 9162#------------------------------------------------------------------------------ 9163# $File: crypto,v 1.2 2021/03/27 20:15:53 christos Exp $ 9164# crypto: file(1) magic for crypto formats 9165# 9166 9167# ---------------------------------------------------------------------------- 9168# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 9169# ctags: file (1) magic for Exuberant Ctags files 9170# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 91710 search/1 =!_TAG Exuberant Ctags tag file text 9172 9173#-------------------------------------------------------------- 9174# ctf: file(1) magic for CTF (Common Trace Format) trace files 9175# 9176# Specs. available here: <https://www.efficios.com/ctf> 9177#-------------------------------------------------------------- 9178 9179# CTF trace data 91800 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 91810 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 9182 9183# CTF metadata (packetized) 91840 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 9185>35 byte x \b, v%d 9186>36 byte x \b.%d 91870 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 9188>35 byte x \b, v%d 9189>36 byte x \b.%d 9190 9191# CTF metadata (plain text) 91920 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 9193!:strength + 5 # this is to make sure we beat C 9194>&0 regex [0-9]+\.[0-9]+ \b, v%s 9195 9196#------------------------------------------------------------------------------ 9197# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 9198# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 9199# 92000 string ACMP Map file for the AssaultCube FPS game 92010 string CUBE Map file for cube and cube2 engine games 92020 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 9203 9204#------------------------------------------------------------------------------ 9205# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $ 9206# Cups: file(1) magic for the cups raster file format 9207# From: Laurent Martelli <martellilaurent@gmail.com> 9208# https://www.cups.org/documentation.php/spec-raster.html 9209# 9210 92110 name cups-le 9212>280 lelong x \b, %d 9213>284 lelong x \bx%d dpi 9214>376 lelong x \b, %dx 9215>380 lelong x \b%d pixels 9216>388 lelong x %d bits/color 9217>392 lelong x %d bits/pixel 9218>400 lelong 0 ColorOrder=Chunky 9219>400 lelong 1 ColorOrder=Banded 9220>400 lelong 2 ColorOrder=Planar 9221>404 lelong 0 ColorSpace=gray 9222>404 lelong 1 ColorSpace=RGB 9223>404 lelong 2 ColorSpace=RGBA 9224>404 lelong 3 ColorSpace=black 9225>404 lelong 4 ColorSpace=CMY 9226>404 lelong 5 ColorSpace=YMC 9227>404 lelong 6 ColorSpace=CMYK 9228>404 lelong 7 ColorSpace=YMCK 9229>404 lelong 8 ColorSpace=KCMY 9230>404 lelong 9 ColorSpace=KCMYcm 9231>404 lelong 10 ColorSpace=GMCK 9232>404 lelong 11 ColorSpace=GMCS 9233>404 lelong 12 ColorSpace=WHITE 9234>404 lelong 13 ColorSpace=GOLD 9235>404 lelong 14 ColorSpace=SILVER 9236>404 lelong 15 ColorSpace=CIE XYZ 9237>404 lelong 16 ColorSpace=CIE Lab 9238>404 lelong 17 ColorSpace=RGBW 9239>404 lelong 18 ColorSpace=sGray 9240>404 lelong 19 ColorSpace=sRGB 9241>404 lelong 20 ColorSpace=AdobeRGB 9242 9243# Cups Raster image format, Big Endian 92440 string RaS 9245>3 string t Cups Raster version 1, Big Endian 9246>3 string 2 Cups Raster version 2, Big Endian 9247>3 string 3 Cups Raster version 3, Big Endian 9248!:mime application/vnd.cups-raster 9249>0 use \^cups-le 9250 9251 9252# Cups Raster image format, Little Endian 92531 string SaR 9254>0 string t Cups Raster version 1, Little Endian 9255>0 string 2 Cups Raster version 2, Little Endian 9256>0 string 3 Cups Raster version 3, Little Endian 9257!:mime application/vnd.cups-raster 9258>0 use cups-le 9259 9260#------------------------------------------------------------------------------ 9261# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 9262# dact: file(1) magic for DACT compressed files 9263# 92640 long 0x444354C3 DACT compressed data 9265>4 byte >-1 (version %i. 9266>5 byte >-1 $BS%i. 9267>6 byte >-1 $BS%i) 9268>7 long >0 $BS, original size: %i bytes 9269>15 long >30 $BS, block size: %i bytes 9270 9271#------------------------------------------------------------------------------ 9272# $File: database,v 1.61 2021/02/23 00:51:10 christos Exp $ 9273# database: file(1) magic for various databases 9274# 9275# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 9276# 9277# 9278# GDBM magic numbers 9279# Will be maintained as part of the GDBM distribution in the future. 9280# <downsj@teeny.org> 92810 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 9282!:mime application/x-gdbm 92830 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 9284!:mime application/x-gdbm 92850 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 9286!:mime application/x-gdbm 92870 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 9288!:mime application/x-gdbm 92890 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 9290!:mime application/x-gdbm 92910 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 9292!:mime application/x-gdbm 92930 string GDBM GNU dbm 2.x database 9294!:mime application/x-gdbm 9295# 9296# Berkeley DB 9297# 9298# Ian Darwin's file /etc/magic files: big/little-endian version. 9299# 9300# Hash 1.85/1.86 databases store metadata in network byte order. 9301# Btree 1.85/1.86 databases store the metadata in host byte order. 9302# Hash and Btree 2.X and later databases store the metadata in host byte order. 9303 93040 long 0x00061561 Berkeley DB 9305!:mime application/x-dbm 9306>8 belong 4321 9307>>4 belong >2 1.86 9308>>4 belong <3 1.85 9309>>4 belong >0 (Hash, version %d, native byte-order) 9310>8 belong 1234 9311>>4 belong >2 1.86 9312>>4 belong <3 1.85 9313>>4 belong >0 (Hash, version %d, little-endian) 9314 93150 belong 0x00061561 Berkeley DB 9316>8 belong 4321 9317>>4 belong >2 1.86 9318>>4 belong <3 1.85 9319>>4 belong >0 (Hash, version %d, big-endian) 9320>8 belong 1234 9321>>4 belong >2 1.86 9322>>4 belong <3 1.85 9323>>4 belong >0 (Hash, version %d, native byte-order) 9324 93250 long 0x00053162 Berkeley DB 1.85/1.86 9326>4 long >0 (Btree, version %d, native byte-order) 93270 belong 0x00053162 Berkeley DB 1.85/1.86 9328>4 belong >0 (Btree, version %d, big-endian) 93290 lelong 0x00053162 Berkeley DB 1.85/1.86 9330>4 lelong >0 (Btree, version %d, little-endian) 9331 933212 long 0x00061561 Berkeley DB 9333>16 long >0 (Hash, version %d, native byte-order) 933412 belong 0x00061561 Berkeley DB 9335>16 belong >0 (Hash, version %d, big-endian) 933612 lelong 0x00061561 Berkeley DB 9337>16 lelong >0 (Hash, version %d, little-endian) 9338 933912 long 0x00053162 Berkeley DB 9340>16 long >0 (Btree, version %d, native byte-order) 934112 belong 0x00053162 Berkeley DB 9342>16 belong >0 (Btree, version %d, big-endian) 934312 lelong 0x00053162 Berkeley DB 9344>16 lelong >0 (Btree, version %d, little-endian) 9345 934612 long 0x00042253 Berkeley DB 9347>16 long >0 (Queue, version %d, native byte-order) 934812 belong 0x00042253 Berkeley DB 9349>16 belong >0 (Queue, version %d, big-endian) 935012 lelong 0x00042253 Berkeley DB 9351>16 lelong >0 (Queue, version %d, little-endian) 9352 9353# From Max Bowsher. 935412 long 0x00040988 Berkeley DB 9355>16 long >0 (Log, version %d, native byte-order) 935612 belong 0x00040988 Berkeley DB 9357>16 belong >0 (Log, version %d, big-endian) 935812 lelong 0x00040988 Berkeley DB 9359>16 lelong >0 (Log, version %d, little-endian) 9360 9361# 9362# 9363# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 93640 string/b RRD\0 RRDTool DB 9365>4 string/b x version %s 9366 9367>>10 short !0 16bit aligned 9368>>>10 bedouble 8.642135e+130 big-endian 9369>>>>18 short x 32bit long (m68k) 9370 9371>>10 short 0 9372>>>12 long !0 32bit aligned 9373>>>>12 bedouble 8.642135e+130 big-endian 9374>>>>>20 long 0 64bit long 9375>>>>>20 long !0 32bit long 9376>>>>12 ledouble 8.642135e+130 little-endian 9377>>>>>24 long 0 64bit long 9378>>>>>24 long !0 32bit long (i386) 9379>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 9380>>>>>24 short !0 32bit long (arm) 9381 9382>>8 quad 0 64bit aligned 9383>>>16 bedouble 8.642135e+130 big-endian 9384>>>>24 long 0 64bit long (s390x) 9385>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 9386>>>16 ledouble 8.642135e+130 little-endian 9387>>>>28 long 0 64bit long (alpha/amd64/ia64) 9388>>>>28 long !0 32bit long (armel/mipsel) 9389 9390#---------------------------------------------------------------------- 9391# ROOT: file(1) magic for ROOT databases 9392# 93930 string root\0 ROOT file 9394>4 belong x Version %d 9395>33 belong x (Compression: %d) 9396 9397# XXX: Weak magic. 9398# Alex Ott <ott@jet.msk.su> 9399## Paradox file formats 9400#2 leshort 0x0800 Paradox 9401#>0x39 byte 3 v. 3.0 9402#>0x39 byte 4 v. 3.5 9403#>0x39 byte 9 v. 4.x 9404#>0x39 byte 10 v. 5.x 9405#>0x39 byte 11 v. 5.x 9406#>0x39 byte 12 v. 7.x 9407#>>0x04 byte 0 indexed .DB data file 9408#>>0x04 byte 1 primary index .PX file 9409#>>0x04 byte 2 non-indexed .DB data file 9410#>>0x04 byte 3 non-incrementing secondary index .Xnn file 9411#>>0x04 byte 4 secondary index .Ynn file 9412#>>0x04 byte 5 incrementing secondary index .Xnn file 9413#>>0x04 byte 6 non-incrementing secondary index .XGn file 9414#>>0x04 byte 7 secondary index .YGn file 9415#>>>0x04 byte 8 incrementing secondary index .XGn file 9416 9417## XBase database files 9418# updated by Joerg Jenderek at Feb 2013 9419# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 9420# https://www.clicketyclick.dk/databases/xbase/format/dbf.html 9421# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 94220 ubelong&0x0000FFFF <0x00000C20 9423# skip Infocom game Z-machine 9424>2 ubyte >0 9425# skip Androids *.xml 9426>>3 ubyte >0 9427>>>3 ubyte <32 9428# 1 < version VV 9429>>>>0 ubyte >1 9430# skip HELP.CA3 by test for reserved byte ( NULL ) 9431>>>>>27 ubyte 0 9432# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 9433#>>>>>30 ubeshort x 30NULL?%x 9434# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 9435>>>>>>24 ubelong&0xffFFFFff >0x01302000 9436# .DBF or .MDX 9437>>>>>>24 ubelong&0xffFFFFff <0x01302001 9438# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 9439>>>>>>>24 ubelong&0xffFFFFff =0 9440# test for 2 reserved NULL bytes,transaction and encryption byte flag 9441>>>>>>>>12 ubelong&0xFFFFfEfE 0 9442# test for MDX flag 9443>>>>>>>>>28 ubyte x 9444>>>>>>>>>28 ubyte&0xf8 0 9445# header size >= 32 9446>>>>>>>>>>8 uleshort >31 9447# skip PIC15736.PCX by test for language driver name or field name 9448>>>>>>>>>>>32 ubyte >0 9449#!:mime application/x-dbf; charset=unknown-8bit ?? 9450#!:mime application/x-dbase 9451>>>>>>>>>>>>0 use xbase-type 9452# database file 9453>>>>>>>>>>>>0 ubyte x \b DBF 9454>>>>>>>>>>>>4 lelong 0 \b, no records 9455>>>>>>>>>>>>4 lelong >0 \b, %d record 9456# plural s appended 9457>>>>>>>>>>>>>4 lelong >1 \bs 9458# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 9459# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 9460>>>>>>>>>>>>10 uleshort x * %d 9461# file size = records * record size + header size 9462>>>>>>>>>>>>1 ubyte x \b, update-date 9463>>>>>>>>>>>>1 use xbase-date 9464# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 9465#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 9466# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 9467>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 9468#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 9469>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 9470>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 9471>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 9472# 1st record offset + 1 = header size 9473>>>>>>>>>>>>8 uleshort >0 9474>>>>>>>>>>>>(8.s+1) ubyte >0 9475>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 9476>>>>>>>>>>>>>(8.s+1) ubyte >0 9477>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 9478# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 9479>>>>>>>24 ubelong&0x0133f7ff >0 9480# test for reserved NULL byte 9481>>>>>>>>47 ubyte 0 9482# test for valid TAG key format (0x10 or 0) 9483>>>>>>>>>559 ubyte&0xeF 0 9484# test MM <= 12 9485>>>>>>>>>>45 ubeshort <0x0C20 9486>>>>>>>>>>>45 ubyte >0 9487>>>>>>>>>>>>46 ubyte <32 9488>>>>>>>>>>>>>46 ubyte >0 9489#!:mime application/x-mdx 9490>>>>>>>>>>>>>>0 use xbase-type 9491>>>>>>>>>>>>>>0 ubyte x \b MDX 9492>>>>>>>>>>>>>>1 ubyte x \b, creation-date 9493>>>>>>>>>>>>>>1 use xbase-date 9494>>>>>>>>>>>>>>44 ubyte x \b, update-date 9495>>>>>>>>>>>>>>44 use xbase-date 9496# No.of tags in use (1,2,5,12) 9497>>>>>>>>>>>>>>28 uleshort x \b, %d 9498# No. of entries in tag (0x30) 9499>>>>>>>>>>>>>>25 ubyte x \b/%d tags 9500# Length of tag 9501>>>>>>>>>>>>>>26 ubyte x * %d 9502# 1st tag name_ 9503>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 9504# 2nd tag name 9505#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 9506# 9507# Print the xBase names of different version variants 95080 name xbase-type 9509>0 ubyte <2 9510# 1 < version 9511>0 ubyte >1 9512>>0 ubyte 0x02 FoxBase 9513# FoxBase+/dBaseIII+, no memo 9514>>0 ubyte 0x03 FoxBase+/dBase III 9515!:mime application/x-dbf 9516# dBASE IV no memo file 9517>>0 ubyte 0x04 dBase IV 9518!:mime application/x-dbf 9519# dBASE V no memo file 9520>>0 ubyte 0x05 dBase V 9521!:mime application/x-dbf 9522>>0 ubyte 0x30 Visual FoxPro 9523!:mime application/x-dbf 9524>>0 ubyte 0x31 Visual FoxPro, autoincrement 9525!:mime application/x-dbf 9526# Visual FoxPro, with field type Varchar or Varbinary 9527>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 9528!:mime application/x-dbf 9529# dBASE IV SQL, no memo;dbv memo var size (Flagship) 9530>>0 ubyte 0x43 dBase IV, with SQL table 9531!:mime application/x-dbf 9532# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9533#>>0 ubyte 0x62 dBase IV, with SQL table 9534#!:mime application/x-dbf 9535# dBASE IV, with memo!! 9536>>0 ubyte 0x7b dBase IV, with memo 9537!:mime application/x-dbf 9538# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9539#>>0 ubyte 0x82 dBase IV, with SQL system 9540#!:mime application/x-dbf 9541# FoxBase+/dBaseIII+ with memo .DBT! 9542>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 9543!:mime application/x-dbf 9544# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 9545>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 9546!:mime application/x-dbf 9547# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9548#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 9549#!:mime application/x-dbf 9550# dBASE IV with memo! 9551>>0 ubyte 0x8B dBase IV, with memo .DBT 9552!:mime application/x-dbf 9553# dBase IV with SQL Table,no memo? 9554>>0 ubyte 0x8E dBase IV, with SQL table 9555!:mime application/x-dbf 9556# .dbv and .dbt memo (Flagship)? 9557>>0 ubyte 0xB3 Flagship 9558# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9559#>>0 ubyte 0xCA dBase IV with memo .DBT 9560#!:mime application/x-dbf 9561# dBASE IV with SQL table, with memo .DBT 9562>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 9563!:mime application/x-dbf 9564# HiPer-Six format;Clipper SIX, with SMT memo file 9565>>0 ubyte 0xE5 Clipper SIX with memo 9566!:mime application/x-dbf 9567# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9568#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 9569#!:mime application/x-dbf 9570>>0 ubyte 0xF5 FoxPro with memo 9571!:mime application/x-dbf 9572# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 9573#>>0 ubyte 0xFA FoxPro 2.x, with memo 9574#!:mime application/x-dbf 9575# unknown version (should not happen) 9576>>0 default x xBase 9577!:mime application/x-dbf 9578>>>0 ubyte x (0x%x) 9579# flags in version byte 9580# DBT flag (with dBASE III memo .DBT)!! 9581# >>0 ubyte&0x80 >0 DBT_FLAG=%x 9582# memo flag ?? 9583# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 9584# SQL flag ?? 9585# >>0 ubyte&0x70 >0 SQL_FLAG=%x 9586# test and print the date of xBase .DBF .MDX 95870 name xbase-date 9588# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 9589>0 ubelong x 9590>1 ubyte <13 9591>>1 ubyte >0 9592>>>2 ubyte >0 9593>>>>2 ubyte <32 9594>>>>>0 ubyte x 9595# YY is interpreted as 20YY or 19YY 9596>>>>>>0 ubyte <100 \b %.2d 9597# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 9598>>>>>>0 ubyte >99 \b %d 9599>>>>>1 ubyte x \b-%d 9600>>>>>2 ubyte x \b-%d 9601 9602# dBase memo files .DBT or .FPT 9603# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 960416 ubyte <4 9605>16 ubyte !2 9606>>16 ubyte !1 9607# next free block index is positive 9608>>>0 ulelong >0 9609# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 9610>>>>17 ubelong&0xFFfdFEff 0x00000000 9611# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 9612>>>>>20 ubelong&0xFF01209B 0x00000000 9613# dBASE III 9614>>>>>>16 ubyte 3 9615# dBASE III DBT 9616>>>>>>>0 use dbase3-memo-print 9617# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 9618>>>>>>16 ubyte 0 9619# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 9620>>>>>>>20 uleshort 0 9621# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 9622>>>>>>>>8 ulong =0 9623>>>>>>>>>6 ubeshort >0 9624# skip emacs.PIF 9625>>>>>>>>>>4 ushort 0 9626# check for valid FoxPro field type 9627>>>>>>>>>>>512 ubelong <3 9628>>>>>>>>>>>>0 use foxpro-memo-print 9629# dBASE III DBT , garbage 9630# skip WORD1XW.DOC with improbably high free block index 9631>>>>>>>>>0 ulelong <0x400000 9632# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item 9633>>>>>>>>>>513 ubyte >037 9634# unusual dBASE III DBT like adressen.dbt 9635>>>>>>>>>>>0 use dbase3-memo-print 9636# dBASE III DBT like angest.dbt, or garbage PCX DBF 9637>>>>>>>>8 ubelong !0 9638# skip PCX and some DBF by test for for reserved NULL bytes 9639>>>>>>>>>510 ubeshort 0 9640# skip bad symples with improbably high free block index above 2 GiB file limit 9641>>>>>>>>>>0 ulelong <0x400000 9642# skip AI070GEP.EPS by printable 1st character of 1st memo item 9643>>>>>>>>>>>512 ubyte >037 9644# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character 9645>>>>>>>>>>>>513 ubyte >037 9646>>>>>>>>>>>>>0 use dbase3-memo-print 9647# dBASE IV DBT with positive block size 9648>>>>>>>20 uleshort >0 9649# dBASE IV DBT with valid block length like 512, 1024 9650# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 9651# skip also 3600h 3E00h size 9652>>>>>>>>20 uleshort&0xE00f 0 9653>>>>>>>>>0 use dbase4-memo-print 9654 9655# Print the information of dBase III DBT memo file 96560 name dbase3-memo-print 9657>0 ubyte x dBase III DBT 9658!:mime application/x-dbt 9659!:ext dbt 9660# instead 3 as version number 0 for unusual examples like biblio.dbt 9661>16 ubyte !3 \b, version number %u 9662# Number of next available block for appending data 9663#>0 lelong =0 \b, next free block index %u 9664>0 lelong !0 \b, next free block index %u 9665# no positive block length 9666#>20 uleshort =0 \b, block length %u 9667>20 uleshort !0 \b, block length %u 9668# dBase III memo field terminated by \032\032 9669>512 string >\0 \b, 1st item "%s" 9670# https://www.clicketyclick.dk/databases/xbase/format/dbt.html 9671# Print the information of dBase IV DBT memo file 96720 name dbase4-memo-print 9673>0 lelong x dBase IV DBT 9674!:mime application/x-dbt 9675!:ext dbt 9676# 8 character shorted main name of corresponding dBASE IV DBF file 9677>8 ubelong >0x20000000 9678# skip unusual like for angest.dbt 9679>>20 uleshort >0 9680>>>8 string >\0 \b of %-.8s.DBF 9681# value 0 implies 512 as size 9682#>4 ulelong =0 \b, blocks size %u 9683# size of blocks not reliable like 0x2020204C in angest.dbt 9684>4 ulelong !0 9685>>4 ulelong&0x0000003f 0 \b, blocks size %u 9686# dBase IV DBT with positive block length (found 512 , 1024) 9687>20 uleshort >0 \b, block length %u 9688# next available block 9689#>0 lelong =0 \b, next free block index %u 9690>0 lelong !0 \b, next free block index %u 9691>20 uleshort >0 9692>>(20.s) ubelong x 9693>>>&-4 use dbase4-memofield-print 9694# unusual dBase IV DBT without block length (implies 512 as length) 9695>20 uleshort =0 9696>>512 ubelong x 9697>>>&-4 use dbase4-memofield-print 9698# Print the information of dBase IV memo field 96990 name dbase4-memofield-print 9700# free dBase IV memo field 9701>0 ubelong !0xFFFF0800 9702>>0 lelong x \b, next free block %u 9703>>4 lelong x \b, next used block %u 9704# used dBase IV memo field 9705>0 ubelong =0xFFFF0800 9706# length of memo field 9707>>4 lelong x \b, field length %d 9708>>>8 string >\0 \b, 1st used item "%s" 9709# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm 9710# Print the information of FoxPro FPT memo file 97110 name foxpro-memo-print 9712>0 belong x FoxPro FPT 9713!:mime application/x-fpt 9714!:ext fpt 9715# Size of blocks for FoxPro ( 64,256 ) 9716>6 ubeshort x \b, blocks size %u 9717# next available block 9718#>0 belong =0 \b, next free block index %u 9719>0 belong !0 \b, next free block index %u 9720# field type ( 0~picture, 1~memo, 2~object ) 9721>512 ubelong <3 \b, field type %u 9722# length of memo field 9723>512 ubelong 1 9724>>516 belong >0 \b, field length %d 9725>>>520 string >\0 \b, 1st item "%s" 9726 9727# TODO: 9728# DBASE index file *.NDX 9729# DBASE Compound Index file *.CDX 9730# dBASE IV Printer Driver *.PRF 9731## End of XBase database stuff 9732 9733# MS Access database 97344 string Standard\ Jet\ DB Microsoft Access Database 9735!:mime application/x-msaccess 97364 string Standard\ ACE\ DB Microsoft Access Database 9737!:mime application/x-msaccess 9738 9739# From: Joerg Jenderek 9740# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 9741# Reference: https://github.com/libyal/libesedb/archive/master.zip 9742# libesedb-master/documentation/ 9743# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 9744# Note: also known as "JET Blue". Used by numerous Windows components such as 9745# Windows Search, Mail, Exchange and Active Directory. 97464 ubelong 0xefcdab89 9747# unknown1 9748>132 ubelong 0 Extensible storage engine 9749!:mime application/x-ms-ese 9750# file_type 0~database 1~stream 9751>>12 ulelong 0 DataBase 9752# Security DataBase (sdb) 9753!:ext edb/sdb 9754>>12 ulelong 1 STreaMing 9755!:ext stm 9756# format_version 620h 9757>>8 uleshort x \b, version 0x%x 9758>>10 uleshort >0 revision 0x%4.4x 9759>>0 ubelong x \b, checksum 0x%8.8x 9760# Page size 4096 8192 32768 9761>>236 ulequad x \b, page size %lld 9762# database_state 9763>>52 ulelong 1 \b, JustCreated 9764>>52 ulelong 2 \b, DirtyShutdown 9765#>>52 ulelong 3 \b, CleanShutdown 9766>>52 ulelong 4 \b, BeingConverted 9767>>52 ulelong 5 \b, ForceDetach 9768# Windows NT major version when the databases indexes were updated. 9769>>216 ulelong x \b, Windows version %d 9770# Windows NT minor version 9771>>220 ulelong x \b.%d 9772 9773# From: Joerg Jenderek 9774# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility 9775# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 97768 string sdbf 9777>7 ubyte 0 9778# TAG_TYPE_LIST+TAG_INDEXES 9779>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 9780# version? 2 3 9781#>>>0 ulelong x \b, version %d 9782!:mime application/x-ms-sdb 9783!:ext sdb 9784 9785# TDB database from Samba et al - Martin Pool <mbp@samba.org> 97860 string TDB\ file TDB database 9787>32 lelong 0x2601196D version 6, little-endian 9788>>36 lelong x hash size %d bytes 9789 9790# SE Linux policy database 97910 lelong 0xf97cff8c SE Linux policy 9792>16 lelong x v%d 9793>20 lelong 1 MLS 9794>24 lelong x %d symbols 9795>28 lelong x %d ocons 9796 9797# ICE authority file data (Wolfram Kleff) 97982 string ICE ICE authority data 9799 9800# X11 Xauthority file (Wolfram Kleff) 980110 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980211 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980312 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980413 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980514 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980615 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980716 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980817 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 980918 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 9810 9811# From: Maxime Henrion <mux@FreeBSD.org> 9812# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 98130 string PGDMP PostgreSQL custom database dump 9814>5 byte x - v%d 9815>6 byte x \b.%d 9816>5 beshort <0x101 \b-0 9817>5 beshort >0x100 9818>>7 byte x \b-%d 9819 9820# Type: Advanced Data Format (ADF) database 9821# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ 9822# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 98230 string @(#)ADF\ Database CGNS Advanced Data Format 9824 9825# Tokyo Cabinet magic data 9826# http://tokyocabinet.sourceforge.net/index.html 98270 string ToKyO\ CaBiNeT\n Tokyo Cabinet 9828>14 string x \b (%s) 9829>32 byte 0 \b, Hash 9830!:mime application/x-tokyocabinet-hash 9831>32 byte 1 \b, B+ tree 9832!:mime application/x-tokyocabinet-btree 9833>32 byte 2 \b, Fixed-length 9834!:mime application/x-tokyocabinet-fixed 9835>32 byte 3 \b, Table 9836!:mime application/x-tokyocabinet-table 9837>33 byte &1 \b, [open] 9838>33 byte &2 \b, [fatal] 9839>34 byte x \b, apow=%d 9840>35 byte x \b, fpow=%d 9841>36 byte &0x01 \b, [large] 9842>36 byte &0x02 \b, [deflate] 9843>36 byte &0x04 \b, [bzip] 9844>36 byte &0x08 \b, [tcbs] 9845>36 byte &0x10 \b, [excodec] 9846>40 lequad x \b, bnum=%lld 9847>48 lequad x \b, rnum=%lld 9848>56 lequad x \b, fsiz=%lld 9849 9850# Type: QDBM Quick Database Manager 9851# From: Benoit Sibaud <bsibaud@april.org> 98520 string \\[depot\\]\n\f Quick Database Manager, little endian 98530 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 9854 9855# Type: TokyoCabinet database 9856# URL: http://tokyocabinet.sourceforge.net/ 9857# From: Benoit Sibaud <bsibaud@april.org> 98580 string ToKyO\ CaBiNeT\n TokyoCabinet database 9859>14 string x (version %s) 9860 9861# From: Stephane Blondon https://www.yaal.fr 9862# Database file for Zope (done by FileStorage) 98630 string FS21 Zope Object Database File Storage v3 (data) 98640 string FS30 Zope Object Database File Storage v4 (data) 9865 9866# Cache file for the database of Zope (done by ClientStorage) 98670 string ZEC3 Zope Object Database Client Cache File (data) 9868 9869# IDA (Interactive Disassembler) database 98700 string IDA1 IDA (Interactive Disassembler) database 9871 9872# Hopper (reverse engineering tool) https://www.hopperapp.com/ 98730 string hopperdb Hopper database 9874 9875# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 9876# Reference: http://www.provue.com/Panorama/ 9877# From: Joerg Jenderek 9878# NOTE: test only versions 4 and 6.0 with Windows 9879# length of Panorama database name 98805 ubyte >0 9881# look after database name for "some" null bits 9882>(5.B+7) ubelong&0xF3ffF000 0 9883# look for first keyword 9884>>&1 search/2 DESIGN Panorama database 9885#!:mime application/x-panorama-database 9886!:apple KASXZEPD 9887!:ext pan 9888# database name 9889>>>5 pstring x \b, "%s" 9890 9891# 9892# 9893# askSam Database by Stefan A. Haubenthal <polluks@web.de> 98940 string askw40\0 askSam DB 9895 9896# 9897# 9898# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 98990 string MBSTV\040 MUIbase DB 9900>6 string x version %s 9901 9902# 9903# CDB database 99040 string NBCDB\012 NetBSD Constant Database 9905>7 byte x \b, version %d 9906>8 string x \b, for '%s' 9907>24 lelong x \b, datasize %d 9908>28 lelong x \b, entries %d 9909>32 lelong x \b, index %d 9910>36 lelong x \b, seed %#x 9911 9912# 9913# Redis RDB - https://redis.io/topics/persistence 99140 string REDIS Redis RDB file, 9915>5 regex [0-9][0-9][0-9][0-9] version %s 9916 9917# Mork database. 9918# Used by older versions of Mozilla Suite and Firefox, 9919# and current versions of Thunderbird. 9920# From: David Korth <gerbilsoft@gerbilsoft.com> 99210 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database 9922>23 string x \b, version %.3s 9923 9924# URL: https://en.wikipedia.org/wiki/Management_Information_Format 9925# Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf 9926# From: Joerg Jenderek 9927# Note: only tested with monitor asset reports of Dell Display Manager 9928# skip start like Language=fr|CA|iso8859-1 99290 search/27/C Start\040Component DMI Management Information Format 9930#!:mime text/plain 9931!:mime text/x-dmtf-mif 9932!:ext mif 9933 9934 9935#------------------------------------------------------------------------------ 9936# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $ 9937# 9938# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> & 9939# Pratik Shrivastava <pratikshrivastava23@gmail.com> 9940# 9941# file formats: https://cn.dataone.org/cn/v2/formats 9942#------------------------------------------------------------------------------ 9943 9944# EML (Ecological Metadata Language Format) 99450 string <?xml 9946>&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s 9947 9948# onedcx (DataONE Dublin Core Extended v1.0) 9949>&0 regex (onedcx/v)[0-9].[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0 9950 9951# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata, 9952# version 001-1998) 9953>&0 regex fgdc FGDC-STD-001-1998 9954 9955# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0) 9956>&0 regex (mercury/terms/v)[0-9].[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0 9957 9958# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language) 9959>&0 regex isotc211 9960>>&0 regex eng;USA https://www.isotc211.org/2005/gmd 9961 9962# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language) 9963>>&0 regex gov.noaa.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa 9964 9965# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language 9966>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea 9967!:mime text/xml 9968 9969 9970# Object Reuse and Exchange Vocabulary 99710 string <?xml 9972>&0 regex rdf 9973>>&0 regex openarchives https://www.openarchives.org/ore/terms 9974!:mime application/rdf+xml 9975 9976 9977# Dryad Metadata Application Profile Version 3.1 99780 string <DryadData 9979>&0 regex (dryad-bibo/v)[0-9].[0-9] https://datadryad.org/profile/v3.1 9980!:mime text/xml 9981 9982#------------------------------------------------------------------------------ 9983# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $ 9984# dppf: Maxis Database Packed Files, the stored data file format used by all 9985# Maxis games after the Sims: http://wiki.niotso.org/DBPF 9986# https://www.wiki.sc4devotion.com/index.php?title=DBPF 9987# 13 Oct 2017, Kip Warner <kip at thevertigo dot com> 99880 string DBPF Maxis Database Packed File 9989>4 ulelong x \b, version: %u. 9990>>8 ulelong x \b%u 9991>>>36 ulelong x \b, files: %u 9992>>24 ledate !0 \b, created: %s 9993>>28 ledate !0 \b, modified: %s 9994!:ext dbpf/package/dat/sc4 9995!:mime application/x-maxis-dbpf 9996#------------------------------------------------------------------------------ 9997# $File: der,v 1.4 2021/03/14 17:12:04 christos Exp $ 9998# der: file(1) magic for DER encoded files 9999# 10000 10001# Certificate information piece 100020 name certinfo 10003>0 der seq 10004>>&0 der set 10005>>>&0 der seq 10006>>>>&0 der obj_id3=550406 10007>>>>&0 der prt_str=x \b, countryName=%s 10008>>&0 der set 10009>>>&0 der seq 10010>>>>&0 der obj_id3=550408 10011>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s 10012>>&0 der set 10013>>>&0 der seq 10014>>>>&0 der obj_id3=55040a 10015>>>>&0 der utf8_str=x \b, organizationName=%s 10016>>&0 der set 10017>>>&0 der seq 10018>>>>&0 der obj_id3=550403 10019>>>>&0 der utf8_str=x \b, commonName=%s 10020>>&0 der seq 10021 10022# Certificate requests 100230 der seq 10024>&0 der seq 10025>>&0 der int1=00 DER Encoded Certificate request 10026>>&0 use certinfo 10027 10028# Key Pairs 100290 der seq 10030>&0 der int1=00 10031>&0 der int65=x 10032>&0 der int3=010001 DER Encoded Key Pair, 512 bits 10033 100340 der seq 10035>&0 der int1=00 10036>&0 der int129=x 10037>&0 der int3=010001 DER Encoded Key Pair, 1024 bits 10038 100390 der seq 10040>&0 der int1=00 10041>&0 der int257=x 10042>&0 der int3=010001 DER Encoded Key Pair, 2048 bits 10043 100440 der seq 10045>&0 der int1=00 10046>&0 der int513=x 10047>&0 der int3=010001 DER Encoded Key Pair, 4096 bits 10048 100490 der seq 10050>&0 der int1=00 10051>&0 der int1025=x 10052>&0 der int3=010001 DER Encoded Key Pair, 8192 bits 10053 100540 der seq 10055>&0 der int1=00 10056>&0 der int2049=x 10057>&0 der int3=010001 DER Encoded Key Pair, 16k bits 10058 100590 der seq 10060>&0 der int1=00 10061>&0 der int4097=x 10062>&0 der int3=010001 DER Encoded Key Pair, 32k bits 10063 10064# Certificates 100650 der seq 10066>&0 der seq 10067>>&0 der int2=0dfa DER Encoded Certificate, 512 bits 10068>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits 10069>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits 10070>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits 10071>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits 10072>>&0 der int2=0dff DER Encoded Certificate, 16k bits 10073>>&0 der int2=0e04 DER Encoded Certificate, 32k bits 10074>>&0 der int2=x DER Encoded Certificate, ? bits (%s) 10075>>&0 der seq 10076>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption 10077>>>&0 der obj_id9=x \b, ? Encryption (%s) 10078>>>&0 der null 10079>>&0 der seq 10080>>>&0 der set 10081>>>>&0 der seq 10082>>>>>&0 der obj_id3=550406 10083>>>>>&0 der prt_str=x \b, countryName=%s 10084>>>&0 der set 10085>>>>&0 der seq 10086>>>>>&0 der obj_id3=550408 10087>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s 10088>>>&0 der set 10089>>>>&0 der seq 10090>>>>>&0 der obj_id3=550407 10091>>>>>&0 der prt_str=x \b, localityName=%s 10092>>>&0 der set 10093>>>>&0 der seq 10094>>>>>&0 der obj_id3=55040a 10095>>>>>&0 der prt_str=x \b, organizationName=%s 10096>>>&0 der set 10097>>>>&0 der seq 10098>>>>>&0 der obj_id3=55040b 10099>>>>>&0 der prt_str=x \b, organizationUnitName=%s 10100>>>&0 der set 10101>>>>&0 der seq 10102>>>>>&0 der obj_id3=550403 10103>>>>>&0 der prt_str=x \b, commonName=%s 10104>>>&0 der set 10105>>>>&0 der seq 10106>>>>>&0 der obj_id9=2a864886f70d010901 10107>>>>>&0 der ia5_str=x \b, emailAddress=%s 10108>>&0 der seq 10109>>>&0 der utc_time=x \b, utcTime=%s 10110>>>&0 der utc_time=x \b, utcTime=%s 10111>>&0 use certinfo 10112 101130 der seq 10114>&0 der seq 10115>>&0 der eoc 10116>>>&0 der int1=02 Certificate, Version=3 10117>>>&0 der int1=x Certificate, Version=%s 10118>>&0 der int9=x \b, Serial=%s 10119>>&0 der seq 10120>>>&0 der obj_id9=2a864886f70d01010b 10121>>>&0 der null 10122>>&0 der seq 10123>>>&0 der set 10124>>>>&0 der seq 10125>>>>>&0 der obj_id3=550403 10126>>>>>&0 der utf8_str=x \b, Issuer=%s 10127>>&0 der seq 10128>>>&0 der utc_time=x \b, not-valid-before=%s 10129>>>&0 der utc_time=x \b, not-valid-after=%s 10130>>&0 der seq 10131>>>&0 der set 10132>>>>&0 der seq 10133>>>>>&0 der obj_id3=550403 10134>>>>>&0 der utf8_str=x \b, Subject=%s 10135 10136#------------------------------------------------------------------------------ 10137# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 10138# diamond: file(1) magic for Diamond system 10139# 10140# ... diamond is a multi-media mail and electronic conferencing system.... 10141# 10142# XXX - I think it was either renamed Slate, or replaced by Slate.... 10143# 10144# The full deal is too long... 10145#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 101460 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 10147 10148#------------------------------------------------------------------------------ 10149# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $ 10150# dif: file(1) magic for DIF text files 10151 10152#------------------------------------------------------------------------------ 10153# From: Joerg Jenderek 10154# URL: http://en.wikipedia.org/wiki/Data_Interchange_Format 10155# http://fileformats.archiveteam.org/wiki/Data_Interchange_Format 10156# Note: called by TrID "Data Interchange Format", 10157# by DROID x-fmt/368 "VisiCalc Database" 101580 string TABLE 10159# skip text starting with TABLE by looking for numeric version on 2nd line 10160>6 search/2 0, 10161# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning 10162>>27 search/128 TUPLES Data Interchange Format 10163# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html 10164#!:mime application/x-dif-spreadsheet Gnumeric 10165# https://github.com/LibreOffice/online/blob/master/discovery.xml 10166#!:mime application/x-dif-document LibreOffice 10167# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats 10168!:mime application/x-dif 10169# https://extension.nirsoft.net/dif 10170#!:mime application/vnd.ms-excel 10171#!:mime text/plain 10172!:ext dif 10173# look for double quote 0x22 on 3rd line 10174>>>10 search/3 " 10175# skip if next character also double quote 10176>>>>&0 ubyte !0x22 \b, generator or table name 10177# comment like EXCEL, pwm enclosed in double quotes 10178>>>>>&-2 string x %s 10179 10180 10181#------------------------------------------------------------------------------ 10182# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $ 10183# diff: file(1) magic for diff(1) output 10184# 101850 search/1 diff\040 diff output text 10186!:mime text/x-diff 101870 search/1 ***\040 10188>&0 search/1024 \n---\040 context diff output text 10189!:mime text/x-diff 101900 search/1 Only\040in\040 diff output text 10191!:mime text/x-diff 101920 search/1 Common\040subdirectories:\040 diff output text 10193!:mime text/x-diff 10194 101950 search/1 Index: RCS/CVS diff output text 10196!:mime text/x-diff 10197 10198# bsdiff: file(1) magic for bsdiff(1) output 101990 string/b BSDIFF40 bsdiff(1) patch file 10200 10201 10202# unified diff 102030 search/4096 ---\040 10204>&0 search/1024 \n 10205>>&0 search/1 +++\040 10206>>>&0 search/1024 \n 10207>>>>&0 search/1 @@ unified diff output text 10208!:mime text/x-diff 10209!:strength + 90 10210 10211# librsync -- the library for network deltas 10212# 10213# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 10214# this file. 10215# 102160 belong 0x72730236 rdiff network-delta data 10217 102180 belong 0x72730136 rdiff network-delta signature data 10219>4 belong x (block length=%d, 10220>8 belong x signature strength=%d) 10221 10222#------------------------------------------------------------------------------ 10223# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 10224# Digital UNIX - Info 10225# 102260 string =!<arch>\n________64E Alpha archive 10227>22 string X -- out of date 10228# 10229 102300 leshort 0603 10231>24 leshort 0410 COFF format alpha pure 10232>24 leshort 0413 COFF format alpha demand paged 10233>>22 leshort&030000 !020000 executable 10234>>22 leshort&020000 !0 dynamically linked 10235>>16 lelong !0 not stripped 10236>>16 lelong 0 stripped 10237>>27 byte x - version %d 10238>>26 byte x \b.%d 10239>>28 byte x \b-%d 10240>24 leshort 0407 COFF format alpha object 10241>>22 leshort&030000 020000 shared library 10242>>27 byte x - version %d 10243>>26 byte x \b.%d 10244>>28 byte x \b-%d 10245 10246# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 10247# 10248# The actual magic number is just "Core", followed by a 2-byte version 10249# number; however, treating any file that begins with "Core" as a Digital 10250# UNIX core dump file may produce too many false hits, so we include one 10251# byte of the version number as well; DU 5.0 appears only to be up to 10252# version 2. 10253# 102540 string Core\001 Alpha COFF format core dump (Digital UNIX) 10255>24 string >\0 \b, from '%s' 102560 string Core\002 Alpha COFF format core dump (Digital UNIX) 10257>24 string >\0 \b, from '%s' 10258# 10259# The next is incomplete, we could tell more about this format, 10260# but its not worth it. 102610 leshort 0x188 Alpha compressed COFF 102620 leshort 0x18f Alpha u-code object 10263# 10264# 10265# Some other interesting Digital formats, 102660 string \377\377\177 ddis/ddif 102670 string \377\377\174 ddis/dots archive 102680 string \377\377\176 ddis/dtif table data 102690 string \033c\033 LN03 output 102700 long 04553207 X image 10271# 102720 string =!<PDF>!\n profiling data file 10273# 10274# Locale data tables (MIPS and Alpha). 10275# 102760 short 0x0501 locale data table 10277>6 short 0x24 for MIPS 10278>6 short 0x40 for Alpha 10279 10280#------------------------------------------------------------------------------ 10281# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $ 10282# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 10283# from https://www.atsc.org/standards/a_52a.pdf 10284# corrections, additions, etc. are always welcome! 10285# 10286# syncword 102870 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 10288# Proposed audio/ac3 RFC/4184 10289!:mime audio/vnd.dolby.dd-raw 10290# fscod 10291>4 byte&0xc0 = 0x00 48 kHz, 10292>4 byte&0xc0 = 0x40 44.1 kHz, 10293>4 byte&0xc0 = 0x80 32 kHz, 10294# is this one used for 96 kHz? 10295>4 byte&0xc0 = 0xc0 reserved frequency, 10296# 10297>5 byte&0x07 = 0x00 \b, complete main (CM) 10298>5 byte&0x07 = 0x01 \b, music and effects (ME) 10299>5 byte&0x07 = 0x02 \b, visually impaired (VI) 10300>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 10301>5 byte&0x07 = 0x04 \b, dialogue (D) 10302>5 byte&0x07 = 0x05 \b, commentary (C) 10303>5 byte&0x07 = 0x06 \b, emergency (E) 10304>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 10305>5 beshort&0x07e0 >0x0720 \b, karaoke 10306# acmod 10307>6 byte&0xe0 = 0x00 1+1 front, 10308>>6 byte&0x10 = 0x10 LFE on, 10309>6 byte&0xe0 = 0x20 1 front/0 rear, 10310>>6 byte&0x10 = 0x10 LFE on, 10311>6 byte&0xe0 = 0x40 2 front/0 rear, 10312# dsurmod (for stereo only) 10313>>6 byte&0x18 = 0x00 Dolby Surround not indicated 10314>>6 byte&0x18 = 0x08 not Dolby Surround encoded 10315>>6 byte&0x18 = 0x10 Dolby Surround encoded 10316>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 10317>>6 byte&0x04 = 0x04 LFE on, 10318>6 byte&0xe0 = 0x60 3 front/0 rear, 10319>>6 byte&0x04 = 0x04 LFE on, 10320>6 byte&0xe0 = 0x80 2 front/1 rear, 10321>>6 byte&0x04 = 0x04 LFE on, 10322>6 byte&0xe0 = 0xa0 3 front/1 rear, 10323>>6 byte&0x01 = 0x01 LFE on, 10324>6 byte&0xe0 = 0xc0 2 front/2 rear, 10325>>6 byte&0x04 = 0x04 LFE on, 10326>6 byte&0xe0 = 0xe0 3 front/2 rear, 10327>>6 byte&0x01 = 0x01 LFE on, 10328# 10329>4 byte&0x3e = 0x00 \b, 32 kbit/s 10330>4 byte&0x3e = 0x02 \b, 40 kbit/s 10331>4 byte&0x3e = 0x04 \b, 48 kbit/s 10332>4 byte&0x3e = 0x06 \b, 56 kbit/s 10333>4 byte&0x3e = 0x08 \b, 64 kbit/s 10334>4 byte&0x3e = 0x0a \b, 80 kbit/s 10335>4 byte&0x3e = 0x0c \b, 96 kbit/s 10336>4 byte&0x3e = 0x0e \b, 112 kbit/s 10337>4 byte&0x3e = 0x10 \b, 128 kbit/s 10338>4 byte&0x3e = 0x12 \b, 160 kbit/s 10339>4 byte&0x3e = 0x14 \b, 192 kbit/s 10340>4 byte&0x3e = 0x16 \b, 224 kbit/s 10341>4 byte&0x3e = 0x18 \b, 256 kbit/s 10342>4 byte&0x3e = 0x1a \b, 320 kbit/s 10343>4 byte&0x3e = 0x1c \b, 384 kbit/s 10344>4 byte&0x3e = 0x1e \b, 448 kbit/s 10345>4 byte&0x3e = 0x20 \b, 512 kbit/s 10346>4 byte&0x3e = 0x22 \b, 576 kbit/s 10347>4 byte&0x3e = 0x24 \b, 640 kbit/s 10348 10349#------------------------------------------------------------------------------ 10350# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $ 10351# dump: file(1) magic for dump file format--for new and old dump filesystems 10352# 10353# We specify both byte orders in order to recognize byte-swapped dumps. 10354# 103550 name new-dump-be 10356>4 bedate x This dump %s, 10357>8 bedate x Previous dump %s, 10358>12 belong >0 Volume %d, 10359>692 belong 0 Level zero, type: 10360>692 belong >0 Level %d, type: 10361>0 belong 1 tape header, 10362>0 belong 2 beginning of file record, 10363>0 belong 3 map of inodes on tape, 10364>0 belong 4 continuation of file record, 10365>0 belong 5 end of volume, 10366>0 belong 6 map of inodes deleted, 10367>0 belong 7 end of medium (for floppy), 10368>676 string >\0 Label %s, 10369>696 string >\0 Filesystem %s, 10370>760 string >\0 Device %s, 10371>824 string >\0 Host %s, 10372>888 belong >0 Flags %x 10373 103740 name old-dump-be 10375#>4 bedate x This dump %s, 10376#>8 bedate x Previous dump %s, 10377>12 belong >0 Volume %d, 10378>692 belong 0 Level zero, type: 10379>692 belong >0 Level %d, type: 10380>0 belong 1 tape header, 10381>0 belong 2 beginning of file record, 10382>0 belong 3 map of inodes on tape, 10383>0 belong 4 continuation of file record, 10384>0 belong 5 end of volume, 10385>0 belong 6 map of inodes deleted, 10386>0 belong 7 end of medium (for floppy), 10387>676 string >\0 Label %s, 10388>696 string >\0 Filesystem %s, 10389>760 string >\0 Device %s, 10390>824 string >\0 Host %s, 10391>888 belong >0 Flags %x 10392 103930 name ufs2-dump-be 10394>896 beqdate x This dump %s, 10395>904 beqdate x Previous dump %s, 10396>12 belong >0 Volume %d, 10397>692 belong 0 Level zero, type: 10398>692 belong >0 Level %d, type: 10399>0 belong 1 tape header, 10400>0 belong 2 beginning of file record, 10401>0 belong 3 map of inodes on tape, 10402>0 belong 4 continuation of file record, 10403>0 belong 5 end of volume, 10404>0 belong 6 map of inodes deleted, 10405>0 belong 7 end of medium (for floppy), 10406>676 string >\0 Label %s, 10407>696 string >\0 Filesystem %s, 10408>760 string >\0 Device %s, 10409>824 string >\0 Host %s, 10410>888 belong >0 Flags %x 10411 1041224 belong 60012 new-fs dump file (big endian), 10413>0 use new-dump-be 10414 1041524 belong 60011 old-fs dump file (big endian), 10416>0 use old-dump-be 10417 1041824 lelong 60012 new-fs dump file (little endian), 10419# to correctly recognize '*.mo' GNU message catalog (little endian) 10420!:strength - 15 10421>0 use \^new-dump-be 10422 1042324 lelong 60011 old-fs dump file (little endian), 10424>0 use \^old-dump-be 10425 10426 1042724 belong 0x19540119 new-fs dump file (ufs2, big endian), 10428>0 use ufs2-dump-be 10429 1043024 lelong 0x19540119 new-fs dump file (ufs2, little endian), 10431>0 use \^ufs2-dump-be 10432 1043318 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 10434>2 medate x Previous dump %s, 10435>6 medate x This dump %s, 10436>10 leshort >0 Volume %d, 10437>0 leshort 1 tape header. 10438>0 leshort 2 beginning of file record. 10439>0 leshort 3 map of inodes on tape. 10440>0 leshort 4 continuation of file record. 10441>0 leshort 5 end of volume. 10442>0 leshort 6 map of inodes deleted. 10443>0 leshort 7 end of medium (for floppy). 10444 10445#------------------------------------------------------------------------------ 10446# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $ 10447# Dyadic: file(1) magic for Dyalog APL. 10448# 10449# updated by Joerg Jenderek at Oct 2013 10450# https://en.wikipedia.org/wiki/Dyalog_APL 10451# https://www.dyalog.com/ 10452# .DXV Dyalog APL External Variable 10453# .DIN Dyalog APL Input Table 10454# .DOT Dyalog APL Output Table 10455# .DFT Dyalog APL Format File 104560 ubeshort&0xFF60 0xaa00 10457# skip biblio.dbt 10458>1 byte !4 10459# real Dyalog APL have non zero version numbers like 7.3 or 13.4 10460>>2 ubeshort >0x0000 Dyalog APL 10461>>>1 byte 0x00 aplcore 10462#>>>1 byte 0x00 incomplete workspace 10463# *.DCF Dyalog APL Component File 10464>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 10465#>>>1 byte 0x01 component file 10466>>>1 byte 0x02 external variable exclusive 10467#>>>1 byte 0x02 external variable 10468# *.DWS Dyalog APL Workspace 10469>>>1 byte 0x03 workspace 10470>>>>7 byte&0x28 0x00 32-bit 10471>>>>7 byte&0x28 0x20 64-bit 10472>>>>7 byte&0x0c 0x00 classic 10473>>>>7 byte&0x0c 0x04 unicode 10474>>>>7 byte&0x88 0x00 big-endian 10475>>>>7 byte&0x88 0x80 little-endian 10476>>>1 byte 0x06 external variable shared 10477# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 10478>>>1 byte 0x07 session 10479>>>1 byte 0x08 mapped file 32-bit 10480>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 10481>>>1 byte 0x0a mapped file 64-bit 10482>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 10483>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 10484>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 10485>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 10486>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 10487>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 10488>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 10489>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 10490>>>1 byte 0x13 component file 32-bit non-journaled checksummed 10491>>>1 byte 0x14 component file 64-bit non-journaled checksummed 10492>>>1 byte 0x15 component file under construction 10493>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed 10494>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed 10495>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed 10496>>>1 byte 0x19 external workspace 10497>>>1 byte 0x80 DDB 10498>>>2 byte x version %d 10499>>>3 byte x \b.%d 10500#>>>2 byte x type %d 10501#>>>3 byte x subtype %d 10502 10503# *.DXF Dyalog APL Transfer File 105040 short 0x6060 Dyalog APL transfer 10505 10506#------------------------------------------------------------------------------ 10507# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $ 10508# ebml: file(1) magic for various Extensible Binary Meta Language 10509# https://www.matroska.org/technical/specs/index.html#track 105100 belong 0x1a45dfa3 EBML file 10511>4 search/b/100 \102\202 10512>>&1 string x \b, creator %.8s 10513 10514#------------------------------------------------------------------------------ 10515# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $ 10516# edid: file(1) magic for EDID dump files 10517 105180 quad 0x00ffffffffffff00 Extended display identification data dump 10519!:mime application/x-edid-dump 10520>18 byte 0x01 Version 1 10521>>19 byte <0x04 \b.%d 10522>18 byte 0x02 Version 2 10523>>19 byte 0x00 \b.0 10524 10525#------------------------------------------------------------------------------ 10526# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $ 10527# T602 editor documents 10528# by David Necas <yeti@physics.muni.cz> 105290 string @CT\ T602 document data, 10530>4 string 0 Kamenicky 10531>4 string 1 CP 852 10532>4 string 2 KOI8-CS 10533>4 string >2 unknown encoding 10534 10535# Vi IMproved Encrypted file 10536# by David Necas <yeti@physics.muni.cz> 10537# updated by Osman Surkatty 105380 string VimCrypt~ Vim encrypted file data 10539>9 string 01! with zip cryptmethod 10540>9 string 02! with blowfish cryptmethod 10541>9 string 03! with blowfish2 cryptmethod 10542 105430 name vimnanoswap 10544>67 byte 0 10545>>107 byte 0 10546#>>>2 string x %s swap file 10547>>>24 ulelong x \b, pid %d 10548>>>28 string >\0 \b, user %s 10549>>>68 string >\0 \b, host %s 10550>>>108 string >\0 \b, file %s 10551>>>1007 byte 0x55 \b, modified 10552 10553# Vi IMproved Swap file 10554# by Sven Wegener <swegener@gentoo.org> 105550 string b0VIM\ Vim swap file 10556>&0 string >\0 \b, version %s 10557>0 use vimnanoswap 10558 10559 10560# Lock/swap file for several editors, at least 10561# Vi IMproved and nano 105620 string b0nano Nano swap file 10563>0 use vimnanoswap 10564 10565# kate (K Advanced Text Editor) 105660 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file 10567 10568#------------------------------------------------------------------------------ 10569# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $ 10570# efi: file(1) magic for Universal EFI binaries 10571 105720 lelong 0x0ef1fab9 10573>4 lelong 1 Universal EFI binary with 1 architecture 10574>>&0 lelong 7 \b, i386 10575>>&0 lelong 0x01000007 \b, x86_64 10576>4 lelong 2 Universal EFI binary with 2 architectures 10577>>&0 lelong 7 \b, i386 10578>>&0 lelong 0x01000007 \b, x86_64 10579>>&20 lelong 7 \b, i386 10580>>&20 lelong 0x01000007 \b, x86_64 10581>4 lelong >2 Universal EFI binary with %d architectures 10582 10583#------------------------------------------------------------------------------ 10584# $File: elf,v 1.85 2021/03/27 20:18:38 christos Exp $ 10585# elf: file(1) magic for ELF executables 10586# 10587# We have to check the byte order flag to see what byte order all the 10588# other stuff in the header is in. 10589# 10590# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 10591# 10592# Created by: unknown 10593# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 10594# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 10595# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 10596# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 10597# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 10598 105990 name elf-mips 10600>0 lelong&0xf0000000 0x00000000 MIPS-I 10601>0 lelong&0xf0000000 0x10000000 MIPS-II 10602>0 lelong&0xf0000000 0x20000000 MIPS-III 10603>0 lelong&0xf0000000 0x30000000 MIPS-IV 10604>0 lelong&0xf0000000 0x40000000 MIPS-V 10605>0 lelong&0xf0000000 0x50000000 MIPS32 10606>0 lelong&0xf0000000 0x60000000 MIPS64 10607>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 10608>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 10609>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 10610>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 10611 106120 name elf-sparc 10613>0 lelong&0x00ffff00 0x00000100 V8+ Required, 10614>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, 10615>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, 10616>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, 10617>0 lelong&0x3 0 total store ordering, 10618>0 lelong&0x3 1 partial store ordering, 10619>0 lelong&0x3 2 relaxed memory ordering, 10620 106210 name elf-pa-risc 10622>2 leshort 0x020b 1.0 10623>2 leshort 0x0210 1.1 10624>2 leshort 0x0214 2.0 10625>0 leshort &0x0008 (LP64) 10626 106270 name elf-riscv 10628>0 lelong&0x00000001 0x00000001 RVC, 10629>0 lelong&0x00000008 0x00000008 RVE, 10630>0 lelong&0x00000006 0x00000000 soft-float ABI, 10631>0 lelong&0x00000006 0x00000002 single-float ABI, 10632>0 lelong&0x00000006 0x00000004 double-float ABI, 10633>0 lelong&0x00000006 0x00000006 quad-float ABI, 10634 106350 name elf-le 10636>16 leshort 0 no file type, 10637!:mime application/octet-stream 10638>16 leshort 1 relocatable, 10639!:mime application/x-object 10640>16 leshort 2 executable, 10641!:mime application/x-executable 10642>16 leshort 3 ${x?pie executable:shared object}, 10643 10644!:mime application/x-${x?pie-executable:sharedlib} 10645>16 leshort 4 core file, 10646!:mime application/x-coredump 10647# OS-specific 10648>7 byte 202 10649>>16 leshort 0xFE01 executable, 10650!:mime application/x-executable 10651# Core file detection is not reliable. 10652#>>>(0x38+0xcc) string >\0 of '%s' 10653#>>>(0x38+0x10) lelong >0 (signal %d), 10654>16 leshort &0xff00 10655>>18 leshort !8 processor-specific, 10656>>18 leshort 8 10657>>>16 leshort 0xFF80 PlayStation 2 IOP module, 10658!:mime application/x-sharedlib 10659>>>16 leshort !0xFF80 processor-specific, 10660>18 clear x 10661>18 leshort 0 no machine, 10662>18 leshort 1 AT&T WE32100, 10663>18 leshort 2 SPARC, 10664>18 leshort 3 Intel 80386, 10665>18 leshort 4 Motorola m68k, 10666>>4 byte 1 10667>>>36 lelong &0x01000000 68000, 10668>>>36 lelong &0x00810000 CPU32, 10669>>>36 lelong 0 68020, 10670>18 leshort 5 Motorola m88k, 10671>18 leshort 6 Intel 80486, 10672>18 leshort 7 Intel 80860, 10673# The official e_machine number for MIPS is now #8, regardless of endianness. 10674# The second number (#10) will be deprecated later. For now, we still 10675# say something if #10 is encountered, but only gory details for #8. 10676>18 leshort 8 MIPS, 10677>>4 byte 1 10678>>>36 lelong &0x20 N32 10679>18 leshort 10 MIPS, 10680>>4 byte 1 10681>>>36 lelong &0x20 N32 10682>18 leshort 8 10683# only for 32-bit 10684>>4 byte 1 10685>>>36 use elf-mips 10686# only for 64-bit 10687>>4 byte 2 10688>>>48 use elf-mips 10689>18 leshort 9 Amdahl, 10690>18 leshort 10 MIPS (deprecated), 10691>18 leshort 11 RS6000, 10692>18 leshort 15 PA-RISC, 10693# only for 32-bit 10694>>4 byte 1 10695>>>36 use elf-pa-risc 10696# only for 64-bit 10697>>4 byte 2 10698>>>48 use elf-pa-risc 10699>18 leshort 16 nCUBE, 10700>18 leshort 17 Fujitsu VPP500, 10701>18 leshort 18 SPARC32PLUS, 10702# only for 32-bit 10703>>4 byte 1 10704>>>36 use elf-sparc 10705>18 leshort 19 Intel 80960, 10706>18 leshort 20 PowerPC or cisco 4500, 10707>18 leshort 21 64-bit PowerPC or cisco 7500, 10708>>48 lelong 0 Unspecified or Power ELF V1 ABI, 10709>>48 lelong 1 Power ELF V1 ABI, 10710>>48 lelong 2 OpenPOWER ELF V2 ABI, 10711>18 leshort 22 IBM S/390, 10712>18 leshort 23 Cell SPU, 10713>18 leshort 24 cisco SVIP, 10714>18 leshort 25 cisco 7200, 10715>18 leshort 36 NEC V800 or cisco 12000, 10716>18 leshort 37 Fujitsu FR20, 10717>18 leshort 38 TRW RH-32, 10718>18 leshort 39 Motorola RCE, 10719>18 leshort 40 ARM, 10720>>4 byte 1 10721>>>36 lelong&0xff000000 0x04000000 EABI4 10722>>>36 lelong&0xff000000 0x05000000 EABI5 10723>>>36 lelong &0x00800000 BE8 10724>>>36 lelong &0x00400000 LE8 10725>18 leshort 41 Alpha, 10726>18 leshort 42 Renesas SH, 10727>18 leshort 43 SPARC V9, 10728>>4 byte 2 10729>>>48 use elf-sparc 10730>18 leshort 44 Siemens Tricore Embedded Processor, 10731>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 10732>18 leshort 46 Renesas H8/300, 10733>18 leshort 47 Renesas H8/300H, 10734>18 leshort 48 Renesas H8S, 10735>18 leshort 49 Renesas H8/500, 10736>18 leshort 50 IA-64, 10737>18 leshort 51 Stanford MIPS-X, 10738>18 leshort 52 Motorola Coldfire, 10739>18 leshort 53 Motorola M68HC12, 10740>18 leshort 54 Fujitsu MMA, 10741>18 leshort 55 Siemens PCP, 10742>18 leshort 56 Sony nCPU, 10743>18 leshort 57 Denso NDR1, 10744>18 leshort 58 Start*Core, 10745>18 leshort 59 Toyota ME16, 10746>18 leshort 60 ST100, 10747>18 leshort 61 Tinyj emb., 10748>18 leshort 62 x86-64, 10749>18 leshort 63 Sony DSP, 10750>18 leshort 64 DEC PDP-10, 10751>18 leshort 65 DEC PDP-11, 10752>18 leshort 66 FX66, 10753>18 leshort 67 ST9+ 8/16 bit, 10754>18 leshort 68 ST7 8 bit, 10755>18 leshort 69 MC68HC16, 10756>18 leshort 70 MC68HC11, 10757>18 leshort 71 MC68HC08, 10758>18 leshort 72 MC68HC05, 10759>18 leshort 73 SGI SVx or Cray NV1, 10760>18 leshort 74 ST19 8 bit, 10761>18 leshort 75 Digital VAX, 10762>18 leshort 76 Axis cris, 10763>18 leshort 77 Infineon 32-bit embedded, 10764>18 leshort 78 Element 14 64-bit DSP, 10765>18 leshort 79 LSI Logic 16-bit DSP, 10766>18 leshort 80 MMIX, 10767>18 leshort 81 Harvard machine-independent, 10768>18 leshort 82 SiTera Prism, 10769>18 leshort 83 Atmel AVR 8-bit, 10770>18 leshort 84 Fujitsu FR30, 10771>18 leshort 85 Mitsubishi D10V, 10772>18 leshort 86 Mitsubishi D30V, 10773>18 leshort 87 NEC v850, 10774>18 leshort 88 Renesas M32R, 10775>18 leshort 89 Matsushita MN10300, 10776>18 leshort 90 Matsushita MN10200, 10777>18 leshort 91 picoJava, 10778>18 leshort 92 OpenRISC, 10779>18 leshort 93 Synopsys ARCompact ARC700 cores, 10780>18 leshort 94 Tensilica Xtensa, 10781>18 leshort 95 Alphamosaic VideoCore, 10782>18 leshort 96 Thompson Multimedia, 10783>18 leshort 97 NatSemi 32k, 10784>18 leshort 98 Tenor Network TPC, 10785>18 leshort 99 Trebia SNP 1000, 10786>18 leshort 100 STMicroelectronics ST200, 10787>18 leshort 101 Ubicom IP2022, 10788>18 leshort 102 MAX Processor, 10789>18 leshort 103 NatSemi CompactRISC, 10790>18 leshort 104 Fujitsu F2MC16, 10791>18 leshort 105 TI msp430, 10792>18 leshort 106 Analog Devices Blackfin, 10793>18 leshort 107 S1C33 Family of Seiko Epson, 10794>18 leshort 108 Sharp embedded, 10795>18 leshort 109 Arca RISC, 10796>18 leshort 110 PKU-Unity Ltd., 10797>18 leshort 111 eXcess: 16/32/64-bit, 10798>18 leshort 112 Icera Deep Execution Processor, 10799>18 leshort 113 Altera Nios II, 10800>18 leshort 114 NatSemi CRX, 10801>18 leshort 115 Motorola XGATE, 10802>18 leshort 116 Infineon C16x/XC16x, 10803>18 leshort 117 Renesas M16C series, 10804>18 leshort 118 Microchip dsPIC30F, 10805>18 leshort 119 Freescale RISC core, 10806>18 leshort 120 Renesas M32C series, 10807>18 leshort 131 Altium TSK3000 core, 10808>18 leshort 132 Freescale RS08, 10809>18 leshort 134 Cyan Technology eCOG2, 10810>18 leshort 135 Sunplus S+core7 RISC, 10811>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 10812>18 leshort 137 Broadcom VideoCore III, 10813>18 leshort 138 LatticeMico32, 10814>18 leshort 139 Seiko Epson C17 family, 10815>18 leshort 140 TI TMS320C6000 DSP family, 10816>18 leshort 141 TI TMS320C2000 DSP family, 10817>18 leshort 142 TI TMS320C55x DSP family, 10818>18 leshort 144 TI Programmable Realtime Unit 10819>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 10820>18 leshort 161 Cypress M8C, 10821>18 leshort 162 Renesas R32C series, 10822>18 leshort 163 NXP TriMedia family, 10823>18 leshort 164 QUALCOMM DSP6, 10824>18 leshort 165 Intel 8051 and variants, 10825>18 leshort 166 STMicroelectronics STxP7x family, 10826>18 leshort 167 Andes embedded RISC, 10827>18 leshort 168 Cyan eCOG1X family, 10828>18 leshort 169 Dallas MAXQ30, 10829>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 10830>18 leshort 171 M2000 Reconfigurable RISC, 10831>18 leshort 172 Cray NV2 vector architecture, 10832>18 leshort 173 Renesas RX family, 10833>18 leshort 174 META, 10834>18 leshort 175 MCST Elbrus, 10835>18 leshort 176 Cyan Technology eCOG16 family, 10836>18 leshort 177 NatSemi CompactRISC, 10837>18 leshort 178 Freescale Extended Time Processing Unit, 10838>18 leshort 179 Infineon SLE9X, 10839>18 leshort 180 Intel L1OM, 10840>18 leshort 181 Intel K1OM, 10841>18 leshort 183 ARM aarch64, 10842>18 leshort 185 Atmel 32-bit family, 10843>18 leshort 186 STMicroeletronics STM8 8-bit, 10844>18 leshort 187 Tilera TILE64, 10845>18 leshort 188 Tilera TILEPro, 10846>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 10847>18 leshort 190 NVIDIA CUDA architecture, 10848>18 leshort 191 Tilera TILE-Gx, 10849>18 leshort 195 Synopsys ARCv2/HS3x/HS4x cores, 10850>18 leshort 197 Renesas RL78 family, 10851>18 leshort 199 Renesas 78K0R, 10852>18 leshort 200 Freescale 56800EX, 10853>18 leshort 201 Beyond BA1, 10854>18 leshort 202 Beyond BA2, 10855>18 leshort 203 XMOS xCORE, 10856>18 leshort 204 Microchip 8-bit PIC(r), 10857>18 leshort 210 KM211 KM32, 10858>18 leshort 211 KM211 KMX32, 10859>18 leshort 212 KM211 KMX16, 10860>18 leshort 213 KM211 KMX8, 10861>18 leshort 214 KM211 KVARC, 10862>18 leshort 215 Paneve CDP, 10863>18 leshort 216 Cognitive Smart Memory, 10864>18 leshort 217 iCelero CoolEngine, 10865>18 leshort 218 Nanoradio Optimized RISC, 10866>18 leshort 243 UCB RISC-V, 10867# only for 32-bit 10868>>4 byte 1 10869>>>36 use elf-riscv 10870# only for 64-bit 10871>>4 byte 2 10872>>>48 use elf-riscv 10873>18 leshort 244 Lanai 32-bit processor, 10874>18 leshort 245 CEVA Processor Architecture Family, 10875>18 leshort 246 CEVA X2 Processor Family, 10876>18 leshort 247 eBPF, 10877>18 leshort 248 Graphcore Intelligent Processing Unit, 10878>18 leshort 249 Imagination Technologies, 10879>18 leshort 250 Netronome Flow Processor, 10880>18 leshort 251 NEC Vector Engine, 10881>18 leshort 252 C-SKY processor family, 10882>18 leshort 253 Synopsys ARCv3 64-bit ISA/HS6x cores, 10883>18 leshort 254 MOS Technology MCS 6502 processor, 10884>18 leshort 255 Synopsys ARCv3 32-bit, 10885>18 leshort 256 Kalray VLIW core of the MPPA family, 10886>18 leshort 257 WDC 65816/65C816, 10887>18 leshort 258 Loongson Loongarch, 10888>18 leshort 259 ChipON KungFu32, 10889>18 leshort 0x1057 AVR (unofficial), 10890>18 leshort 0x1059 MSP430 (unofficial), 10891>18 leshort 0x1223 Adapteva Epiphany (unofficial), 10892>18 leshort 0x2530 Morpho MT (unofficial), 10893>18 leshort 0x3330 FR30 (unofficial), 10894>18 leshort 0x3426 OpenRISC (obsolete), 10895>18 leshort 0x4688 Infineon C166 (unofficial), 10896>18 leshort 0x5441 Cygnus FRV (unofficial), 10897>18 leshort 0x5aa5 DLX (unofficial), 10898>18 leshort 0x7650 Cygnus D10V (unofficial), 10899>18 leshort 0x7676 Cygnus D30V (unofficial), 10900>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 10901>18 leshort 0x8472 OpenRISC (obsolete), 10902>18 leshort 0x9025 Cygnus PowerPC (unofficial), 10903>18 leshort 0x9026 Alpha (unofficial), 10904>18 leshort 0x9041 Cygnus M32R (unofficial), 10905>18 leshort 0x9080 Cygnus V850 (unofficial), 10906>18 leshort 0xa390 IBM S/390 (obsolete), 10907>18 leshort 0xabc7 Old Xtensa (unofficial), 10908>18 leshort 0xad45 xstormy16 (unofficial), 10909>18 leshort 0xbaab Old MicroBlaze (unofficial),, 10910>18 leshort 0xbeef Cygnus MN10300 (unofficial), 10911>18 leshort 0xdead Cygnus MN10200 (unofficial), 10912>18 leshort 0xf00d Toshiba MeP (unofficial), 10913>18 leshort 0xfeb0 Renesas M32C (unofficial), 10914>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 10915>18 leshort 0xfebb NIOS (unofficial), 10916>18 leshort 0xfeed Moxie (unofficial), 10917>18 default x 10918>>18 leshort x *unknown arch 0x%x* 10919>20 lelong 0 invalid version 10920>20 lelong 1 version 1 10921 109220 string \177ELF ELF 10923!:strength *2 10924>4 byte 0 invalid class 10925>4 byte 1 32-bit 10926>4 byte 2 64-bit 10927>5 byte 0 invalid byte order 10928>5 byte 1 LSB 10929>>0 use elf-le 10930>5 byte 2 MSB 10931>>0 use \^elf-le 10932>7 byte 0 (SYSV) 10933>7 byte 1 (HP-UX) 10934>7 byte 2 (NetBSD) 10935>7 byte 3 (GNU/Linux) 10936>7 byte 4 (GNU/Hurd) 10937>7 byte 5 (86Open) 10938>7 byte 6 (Solaris) 10939>7 byte 7 (Monterey) 10940>7 byte 8 (IRIX) 10941>7 byte 9 (FreeBSD) 10942>7 byte 10 (Tru64) 10943>7 byte 11 (Novell Modesto) 10944>7 byte 12 (OpenBSD) 10945>7 byte 13 (OpenVMS) 10946>7 byte 14 (HP NonStop Kernel) 10947>7 byte 15 (AROS Research Operating System) 10948>7 byte 16 (FenixOS) 10949>7 byte 17 (Nuxi CloudABI) 10950>7 byte 97 (ARM) 10951>7 byte 202 (Cafe OS) 10952>7 byte 255 (embedded) 10953 10954#------------------------------------------------------------------------------ 10955# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $ 10956# encore: file(1) magic for Encore machines 10957# 10958# XXX - needs to have the byte order specified (NS32K was little-endian, 10959# dunno whether they run the 88K in little-endian mode or not). 10960# 109610 short 0x154 Encore 10962>20 short 0x107 executable 10963>20 short 0x108 pure executable 10964>20 short 0x10b demand-paged executable 10965>20 short 0x10f unsupported executable 10966>12 long >0 not stripped 10967>22 short >0 - version %d 10968>22 short 0 - 10969#>4 date x stamp %s 109700 short 0x155 Encore unsupported executable 10971>12 long >0 not stripped 10972>22 short >0 - version %d 10973>22 short 0 - 10974#>4 date x stamp %s 10975 10976#------------------------------------------------------------------------------ 10977# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 10978# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 10979# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 10980# Useful information for improving this file can be found at: 10981# http://software.frodo.looijaard.name/psiconv/formats/Index.html 10982#------------------------------------------------------------------------------ 109830 lelong 0x10000037 Psion Series 5 10984>4 lelong 0x10000039 font file 10985>4 lelong 0x1000003A printer driver 10986>4 lelong 0x1000003B clipboard 10987>4 lelong 0x10000042 multi-bitmap image 10988!:mime image/x-epoc-mbm 10989>4 lelong 0x1000006A application information file 10990>4 lelong 0x1000006D 10991>>8 lelong 0x1000007D Sketch image 10992!:mime image/x-epoc-sketch 10993>>8 lelong 0x1000007E voice note 10994>>8 lelong 0x1000007F Word file 10995!:mime application/x-epoc-word 10996>>8 lelong 0x10000085 OPL program (TextEd) 10997!:mime application/x-epoc-opl 10998>>8 lelong 0x10000087 Comms settings 10999>>8 lelong 0x10000088 Sheet file 11000!:mime application/x-epoc-sheet 11001>>8 lelong 0x100001C4 EasyFax initialisation file 11002>4 lelong 0x10000073 OPO module 11003!:mime application/x-epoc-opo 11004>4 lelong 0x10000074 OPL application 11005!:mime application/x-epoc-app 11006>4 lelong 0x1000008A exported multi-bitmap image 11007>4 lelong 0x1000016D 11008>>8 lelong 0x10000087 Comms names 11009 110100 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 11011 110120 lelong 0x10000050 Psion Series 5 11013>4 lelong 0x1000006D database 11014>>8 lelong 0x10000084 Agenda file 11015!:mime application/x-epoc-agenda 11016>>8 lelong 0x10000086 Data file 11017!:mime application/x-epoc-data 11018>>8 lelong 0x10000CEA Jotter file 11019!:mime application/x-epoc-jotter 11020>4 lelong 0x100000E4 ini file 11021 110220 lelong 0x10000079 Psion Series 5 binary: 11023>4 lelong 0x00000000 DLL 11024>4 lelong 0x10000049 comms hardware library 11025>4 lelong 0x1000004A comms protocol library 11026>4 lelong 0x1000005D OPX 11027>4 lelong 0x1000006C application 11028>4 lelong 0x1000008D DLL 11029>4 lelong 0x100000AC logical device driver 11030>4 lelong 0x100000AD physical device driver 11031>4 lelong 0x100000E5 file transfer protocol 11032>4 lelong 0x100000E5 file transfer protocol 11033>4 lelong 0x10000140 printer definition 11034>4 lelong 0x10000141 printer definition 11035 110360 lelong 0x1000007A Psion Series 5 executable 11037 11038#------------------------------------------------------------------------------ 11039# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $ 11040# erlang: file(1) magic for Erlang JAM and BEAM files 11041# URL: https://www.erlang.org/faq/x779.html#AEN812 11042 11043# OTP R3-R4 110440 string \0177BEAM! Old Erlang BEAM file 11045>6 short >0 - version %d 11046 11047# OTP R5 and onwards 110480 string FOR1 11049>8 string BEAM Erlang BEAM file 11050 11051# 4.2 version may have a copyright notice! 110524 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 1105379 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 11054 110554 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 11056 110570 bequad 0x0000000000ABCDEF Erlang DETS file 11058 11059# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $ 11060# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif 11061# URL: https://github.com/arendst/Sonoff-Tasmota/ 11062# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/ 11063# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h 11064# From: Joerg Jenderek 11065# 11066# cfg_holder=4617=0x1209 110670 uleshort 4617 11068# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e 11069>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266) 11070!:mime application/x-tasmota-dmp 11071!:ext dmp 11072# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262 11073>>11 ubyte^0x65 x \b, version %u 11074>>10 ubyte^0x64 x \b.%u 11075>>9 ubyte^0x63 x \b.%u 11076>>8 ubyte^0x62 x \b.%u 11077#>8 ubelong x (0x%x) 11078# hostname[33] XORed 11079>>0x165 ubyte^0x1BF x \b, hostname %c 11080>>0x166 ubyte^0x1C0 >037 \b%c 11081>>0x167 ubyte^0x1C1 >037 \b%c 11082>>0x168 ubyte^0x1C2 >037 \b%c 11083>>0x169 ubyte^0x1C3 >037 \b%c 11084>>0x16A ubyte^0x1C4 >037 \b%c 11085>>0x16B ubyte^0x1C5 >037 \b%c 11086>>0x16C ubyte^0x1C6 >037 \b%c 11087>>0x16D ubyte^0x1C7 >037 \b%c 11088>>0x16E ubyte^0x1C8 >037 \b%c 11089>>0x16F ubyte^0x1C9 >037 \b%c 11090>>0x170 ubyte^0x1CA >037 \b%c 11091>>0x171 ubyte^0x1CB >037 \b%c 11092>>0x172 ubyte^0x1CC >037 \b%c 11093>>0x173 ubyte^0x1CD >037 \b%c 11094>>0x174 ubyte^0x1CE >037 \b%c 11095>>0x175 ubyte^0x1CF >037 \b%c 11096>>0x176 ubyte^0x1D0 >037 \b%c 11097>>0x177 ubyte^0x1D1 >037 \b%c 11098>>0x178 ubyte^0x1D2 >037 \b%c 11099>>0x179 ubyte^0x1D3 >037 \b%c 11100>>0x17A ubyte^0x1D4 >037 \b%c 11101>>0x17B ubyte^0x1D5 >037 \b%c 11102>>0x17C ubyte^0x1D6 >037 \b%c 11103>>0x17D ubyte^0x1D7 >037 \b%c 11104>>0x17E ubyte^0x1D8 >037 \b%c 11105>>0x17F ubyte^0x1D9 >037 \b%c 11106>>0x180 ubyte^0x1DA >037 \b%c 11107>>0x181 ubyte^0x1DB >037 \b%c 11108>>0x182 ubyte^0x1DC >037 \b%c 11109>>0x183 ubyte^0x1DD >037 \b%c 11110>>0x184 ubyte^0x1DE >037 \b%c 11111>>0x185 ubyte^0x1DF >037 \b%c 11112#>>0x165 string x (%.33s) 11113 11114 11115 11116#------------------------------------------------------------------------------ 11117# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $ 11118# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 11119# Based on info from 11120# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 111210 belong 9994 ESRI Shapefile 11122>4 belong =0 11123>8 belong =0 11124>12 belong =0 11125>16 belong =0 11126>20 belong =0 11127>28 lelong x version %d 11128>24 belong x length %d 11129>32 lelong =0 type Null Shape 11130>32 lelong =1 type Point 11131>32 lelong =3 type PolyLine 11132>32 lelong =5 type Polygon 11133>32 lelong =8 type MultiPoint 11134>32 lelong =11 type PointZ 11135>32 lelong =13 type PolyLineZ 11136>32 lelong =15 type PolygonZ 11137>32 lelong =18 type MultiPointZ 11138>32 lelong =21 type PointM 11139>32 lelong =23 type PolyLineM 11140>32 lelong =25 type PolygonM 11141>32 lelong =28 type MultiPointM 11142>32 lelong =31 type MultiPatch 11143 11144#------------------------------------------------------------------------------ 11145# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 11146# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 11147# From Roger Leigh <roger@whinlatter.uklinux.net> 111480 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 111490 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 111500 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 11151 11152#------------------------------------------------------------------------------ 11153# $File: filesystems,v 1.140 2021/02/23 00:51:10 christos Exp $ 11154# filesystems: file(1) magic for different filesystems 11155# 111560 name partid 11157>0 ubyte 0x00 Unused 11158>0 ubyte 0x01 12-bit FAT 11159>0 ubyte 0x02 XENIX / 11160>0 ubyte 0x03 XENIX /usr 11161>0 ubyte 0x04 16-bit FAT, less than 32M 11162>0 ubyte 0x05 extended partition 11163>0 ubyte 0x06 16-bit FAT, more than 32M 11164>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 11165>0 ubyte 0x08 AIX or os, or etc. 11166>0 ubyte 0x09 AIX boot partition or Coherent 11167>0 ubyte 0x0a O/2 boot manager or Coherent swap 11168>0 ubyte 0x0b 32-bit FAT 11169>0 ubyte 0x0c 32-bit FAT, LBA-mapped 11170>0 ubyte 0x0d 7XXX, LBA-mapped 11171>0 ubyte 0x0e 16-bit FAT, LBA-mapped 11172>0 ubyte 0x0f extended partition, LBA-mapped 11173>0 ubyte 0x10 OPUS 11174>0 ubyte 0x11 OS/2 DOS 12-bit FAT 11175>0 ubyte 0x12 Compaq diagnostics 11176>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 11177>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 11178>0 ubyte 0x17 OS/2 hidden IFS 11179>0 ubyte 0x18 AST Windows swapfile 11180>0 ubyte 0x19 Willowtech Photon coS 11181>0 ubyte 0x1b hidden win95 fat 32 11182>0 ubyte 0x1c hidden win95 fat 32 lba 11183>0 ubyte 0x1d hidden win95 fat 16 lba 11184>0 ubyte 0x20 Willowsoft OFS1 11185>0 ubyte 0x21 reserved 11186>0 ubyte 0x23 reserved 11187>0 ubyte 0x24 NEC DOS 11188>0 ubyte 0x26 reserved 11189>0 ubyte 0x31 reserved 11190>0 ubyte 0x32 Alien Internet Services NOS 11191>0 ubyte 0x33 reserved 11192>0 ubyte 0x34 reserved 11193>0 ubyte 0x35 JFS on OS2 11194>0 ubyte 0x36 reserved 11195>0 ubyte 0x38 Theos 11196>0 ubyte 0x39 Plan 9, or Theos spanned 11197>0 ubyte 0x3a Theos ver 4 4gb partition 11198>0 ubyte 0x3b Theos ve 4 extended partition 11199>0 ubyte 0x3c PartitionMagic recovery 11200>0 ubyte 0x3d Hidden Netware 11201>0 ubyte 0x40 VENIX 286 or LynxOS 11202>0 ubyte 0x41 PReP 11203>0 ubyte 0x42 linux swap sharing DRDOS disk 11204>0 ubyte 0x43 linux sharing DRDOS disk 11205>0 ubyte 0x44 GoBack change utility 11206>0 ubyte 0x45 Boot US Boot manager 11207>0 ubyte 0x46 EUMEL/Elan or Ergos 3 11208>0 ubyte 0x47 EUMEL/Elan or Ergos 3 11209>0 ubyte 0x48 EUMEL/Elan or Ergos 3 11210>0 ubyte 0x4a ALFX/THIN filesystem for DOS 11211>0 ubyte 0x4c Oberon partition 11212>0 ubyte 0x4d QNX4.x 11213>0 ubyte 0x4e QNX4.x 2nd part 11214>0 ubyte 0x4f QNX4.x 3rd part 11215>0 ubyte 0x50 DM (disk manager) 11216>0 ubyte 0x51 DM6 Aux1 (or Novell) 11217>0 ubyte 0x52 CP/M or Microport SysV/AT 11218>0 ubyte 0x53 DM6 Aux3 11219>0 ubyte 0x54 DM6 DDO 11220>0 ubyte 0x55 EZ-Drive (disk manager) 11221>0 ubyte 0x56 Golden Bow (disk manager) 11222>0 ubyte 0x57 Drive PRO 11223>0 ubyte 0x5c Priam Edisk (disk manager) 11224>0 ubyte 0x61 SpeedStor 11225>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 11226>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 11227>0 ubyte 0x65 Novell Netware 3.xx 11228>0 ubyte 0x66 Novell 386 Netware 11229>0 ubyte 0x67 Novell 11230>0 ubyte 0x68 Novell 11231>0 ubyte 0x69 Novell 11232>0 ubyte 0x70 DiskSecure Multi-Boot 11233>0 ubyte 0x71 reserved 11234>0 ubyte 0x73 reserved 11235>0 ubyte 0x74 reserved 11236>0 ubyte 0x75 PC/IX 11237>0 ubyte 0x76 reserved 11238>0 ubyte 0x77 M2FS/M2CS partition 11239>0 ubyte 0x78 XOSL boot loader filesystem 11240>0 ubyte 0x80 MINIX until 1.4a 11241>0 ubyte 0x81 MINIX since 1.4b 11242>0 ubyte 0x82 Linux swap or Solaris 11243>0 ubyte 0x83 Linux native 11244>0 ubyte 0x84 OS/2 hidden C: drive 11245>0 ubyte 0x85 Linux extended partition 11246>0 ubyte 0x86 NT FAT volume set 11247>0 ubyte 0x87 NTFS volume set or HPFS mirrored 11248>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 11249>0 ubyte 0x8b Legacy Fault tolerant FAT32 11250>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 11251>0 ubyte 0x8d Hidden free FDISK FAT12 11252>0 ubyte 0x8e Linux Logical Volume Manager 11253>0 ubyte 0x90 Hidden free FDISK FAT16 11254>0 ubyte 0x91 Hidden free FDISK DOS EXT 11255>0 ubyte 0x92 Hidden free FDISK FAT16 Big 11256>0 ubyte 0x93 Amoeba filesystem 11257>0 ubyte 0x94 Amoeba bad block table 11258>0 ubyte 0x95 MIT EXOPC native partitions 11259>0 ubyte 0x97 Hidden free FDISK FAT32 11260>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 11261>0 ubyte 0x99 Mylex EISA SCSI 11262>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 11263>0 ubyte 0x9b Hidden free FDISK EXT LBA 11264>0 ubyte 0x9f BSDI? 11265>0 ubyte 0xa0 IBM Thinkpad hibernation 11266>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 11267>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 11268>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 11269>0 ubyte 0xa5 386BSD partition type 11270>0 ubyte 0xa6 OpenBSD partition type 11271>0 ubyte 0xa7 NeXTSTEP 486 11272>0 ubyte 0xa8 Apple UFS 11273>0 ubyte 0xa9 NetBSD partition type 11274>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 11275>0 ubyte 0xab Apple Boot 11276>0 ubyte 0xae SHAG OS filesystem 11277>0 ubyte 0xaf Apple HFS 11278>0 ubyte 0xb0 BootStar Dummy 11279>0 ubyte 0xb1 reserved 11280>0 ubyte 0xb3 reserved 11281>0 ubyte 0xb4 reserved 11282>0 ubyte 0xb6 reserved 11283>0 ubyte 0xb7 BSDI BSD/386 filesystem 11284>0 ubyte 0xb8 BSDI BSD/386 swap 11285>0 ubyte 0xbb Boot Wizard Hidden 11286>0 ubyte 0xbe Solaris 8 partition type 11287>0 ubyte 0xbf Solaris partition type 11288>0 ubyte 0xc0 CTOS 11289>0 ubyte 0xc1 DRDOS/sec (FAT-12) 11290>0 ubyte 0xc2 Hidden Linux 11291>0 ubyte 0xc3 Hidden Linux swap 11292>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 11293>0 ubyte 0xc5 DRDOS/sec (EXT) 11294>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 11295>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 11296>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 11297>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 11298>0 ubyte 0xca Reserved for DR-DOS 8.0+ 11299>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 11300>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 11301>0 ubyte 0xcd CTOS Memdump 11302>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 11303>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 11304>0 ubyte 0xd0 REAL/32 secure big partition 11305>0 ubyte 0xd1 Old Multiuser DOS FAT12 11306>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 11307>0 ubyte 0xd5 Old Multiuser DOS Extended 11308>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 11309>0 ubyte 0xd8 CP/M 86 11310>0 ubyte 0xdb CP/M or Concurrent CP/M 11311>0 ubyte 0xdd Hidden CTOS Memdump 11312>0 ubyte 0xde Dell PowerEdge Server utilities 11313>0 ubyte 0xdf DG/UX virtual disk manager 11314>0 ubyte 0xe0 STMicroelectronics ST AVFS 11315>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 11316>0 ubyte 0xe3 DOS R/O or Storage Dimensions 11317>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 11318>0 ubyte 0xe5 reserved 11319>0 ubyte 0xe6 reserved 11320>0 ubyte 0xeb BeOS 11321>0 ubyte 0xee GPT Protective MBR 11322>0 ubyte 0xef EFI system partition 11323>0 ubyte 0xf0 Linux PA-RISC boot loader 11324>0 ubyte 0xf1 SpeedStor or Storage Dimensions 11325>0 ubyte 0xf2 DOS 3.3+ Secondary 11326>0 ubyte 0xf3 reserved 11327>0 ubyte 0xf4 SpeedStor large partition 11328>0 ubyte 0xf5 Prologue multi-volumen partition 11329>0 ubyte 0xf6 reserved 11330>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 11331>0 ubyte 0xfa Bochs x86 emulator 11332>0 ubyte 0xfb VMware File System 11333>0 ubyte 0xfc VMware Swap 11334>0 ubyte 0xfd Linux RAID partition persistent sb 11335>0 ubyte 0xfe LANstep or IBM PS/2 IML 11336>0 ubyte 0xff Xenix Bad Block Table 11337 113380 string \366\366\366\366 PC formatted floppy with no filesystem 11339# Sun disk labels 11340# From /usr/include/sun/dklabel.h: 113410774 beshort 0xdabe 11342# modified by Joerg Jenderek, because original test 11343# succeeds for Cabinet archive dao360.dl_ with negative blocks 11344>0770 long >0 Sun disk label 11345>>0 string x '%s 11346>>>31 string >\0 \b%s 11347>>>>63 string >\0 \b%s 11348>>>>>95 string >\0 \b%s 11349>>0 string x \b' 11350>>0734 short >0 %d rpm, 11351>>0736 short >0 %d phys cys, 11352>>0740 short >0 %d alts/cyl, 11353>>0746 short >0 %d interleave, 11354>>0750 short >0 %d data cyls, 11355>>0752 short >0 %d alt cyls, 11356>>0754 short >0 %d heads/partition, 11357>>0756 short >0 %d sectors/track, 11358>>0764 long >0 start cyl %d, 11359>>0770 long x %d blocks 11360# Is there a boot block written 1 sector in? 11361>512 belong&077777777 0600407 \b, boot block present 11362 11363# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 11364# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 113650 string SBMBAKUP_ Smart Boot Manager backup file 11366>9 string x \b, version %-5.5s 11367>>14 string =_ 11368>>>15 string x %-.1s 11369>>>>16 string =_ \b. 11370>>>>>17 string x \b%-.1s 11371>>>>>>18 string =_ \b. 11372>>>>>>>19 string x \b%-.1s 11373>>>22 ubyte 0 11374>>>>21 ubyte x \b, from drive 0x%x 11375>>>22 ubyte >0 11376>>>>21 string x \b, from drive %s 11377>>>535 search/17 \x55\xAA 11378>>>>&-512 indirect x \b; contains 11379 11380# updated by Joerg Jenderek at Nov 2012 11381# DOS Emulator image is 128 byte, null right padded header + harddisc image 113820 string DOSEMU\0 11383>0x27E leshort 0xAA55 11384#offset is 128 11385>>19 ubyte 128 11386>>>(19.b-1) ubyte 0x0 DOS Emulator image 11387>>>>7 ulelong >0 \b, %u heads 11388>>>>11 ulelong >0 \b, %d sectors/track 11389>>>>15 ulelong >0 \b, %d cylinders 11390>>>>128 indirect x \b; contains 11391 11392# added by Joerg Jenderek at Nov 2012 11393# http://www.thenakedpc.com/articles/v04/08/0408-05.html 11394# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 113950 string PNCIHISK\0 Norton Utilities disc image data 11396# real x86 boot sector with jump instruction 11397>509 search/1026 \x55\xAA\xeb 11398>>&-1 indirect x \b; contains 11399# http://file-extension.net/seeker/file_extension_dat 114000 string PNCIUNDO Norton Disk Doctor UnDo file 11401# 11402 11403# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 11404# for any allowed sector sizes 1140530 search/481 \x55\xAA 11406# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 11407# DOS BPB information (70) and after DOS floppy (120) like in previous file version 11408!:strength +65 11409# for sector sizes < 512 Bytes 11410>11 uleshort <512 11411>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 11412# for sector sizes with 512 or more Bytes 11413>0x1FE leshort 0xAA55 DOS/MBR boot sector 11414 11415# ExFAT 114163 string/w =EXFAT 11417>0x1FE leshort 0xAA55 11418>>0x6E ubyte 1 11419>>>0x6F ubyte 0x80 11420>>>0 ubyte 0xEB DOS/MBR boot sector, 11421>>>0x69 ubyte x ExFAT Filesystem version %d. 11422>>>0x68 ubyte x \b%d 11423>>>0x6d ubyte x \b, (1<<%d) sectors per cluster 11424>>>0x48 ulequad x \b, sectors %lld 11425>>>0x64 ulelong x \b, serial number 0x%x 11426 11427# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 11428# only for sector sizes with 512 or more Bytes 114290x1FE leshort 0xAA55 DOS/MBR boot sector 11430# 11431# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 11432!:strength +65 11433>2 string OSBS OS/BS MBR 11434# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ 11435# and https://en.wikipedia.org/wiki/Master_Boot_Record 11436# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 11437# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 11438>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 11439# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 11440# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 11441>>8 ubequad 0x8bf45007501ffbfc 11442# https://thestarman.pcministry.com/asm/mbr/200MBR.htm 11443>>>0x16 ubyte 0xF3 \b,DOS 2 11444>>>>219 regex Author\ -\ Author: 11445# found "David Litton" , "A Pehrsson " 11446>>>>>&0 string x "%s" 11447>>>0x16 ubyte 0xF2 11448# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 11449# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 11450>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 11451# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 11452>>>>0x22 default x \b,D0S version 3.3-7.0 11453# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 11454# where nn is string offset varying for different languages 11455# "Invalid partition table" nn=0x8b for english version 11456>>>>>(0x49.b) string Invalid\ partition\ table english 11457>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 11458>>>>>(0x49.b) string Table\ de\ partition\ invalide french 11459>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 11460>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 11461>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 11462>>>>>0x49 ubyte >0 at offset 0x%x 11463>>>>>>(0x49.b) string >\0 "%s" 11464# "Error loading operating system" nn=0xa3 for english version 11465# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 11466# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 11467# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 11468# "Error al cargar sistema operativo" nn=0xa8 for spanish version 11469# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 11470>>>>>0x74 ubyte >0 at offset 0x%x 11471>>>>>>(0x74.b) string >\0 "%s" 11472# "Missing operating system" nn=0xc2 for english version 11473# "Betriebssystem fehlt" nn=0xcd for german version 11474# "Syst\212me d'exploitation absent" nn=0xd2 for french version 11475# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 11476# "Falta sistema operativo" nn=0xca for spanish version 11477# "Sistema operativo mancante" nn=0xe2 for italian version 11478>>>>>0x79 ubyte >0 at offset 0x%x 11479>>>>>>(0x79.b) string >\0 "%s" 11480# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 11481# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 11482>>8 ubequad 0x5007501ffcbe1b7c 11483# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 11484>>>24 ubequad 0xf3a4cbbebe07b104 9M 11485# "Invalid partition table" nn=0x10F for english version 11486# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 11487# "Table de partition erron\202e" nn=0x10F for french version 11488# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 11489>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 11490>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 11491>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 11492>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 11493>>>>0x3C ubyte x at offset 0x%x+0xFF 11494>>>>(0x3C.b+0x0FF) string >\0 "%s" 11495# "Error loading operating system" nn=0x127 for english version 11496# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 11497# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 11498# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 11499>>>>0xBD ubyte x at offset 0x1%x 11500>>>>(0xBD.b+0x100) string >\0 "%s" 11501# "Missing operating system" nn=0x146 for english version 11502# "Betriebssystem fehlt" nn=0x151 for german version 11503# "Syst\212me d'exploitation manquant" nn=0x15e for french version 11504# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 11505>>>>0xA9 ubyte x at offset 0x1%x 11506>>>>(0xA9.b+0x100) string >\0 "%s" 11507# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 11508# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 11509>>>24 ubequad 0xf3a4cbbdbe07b104 XP 11510# where xxyyzz are lower bits from offsets of error messages varying for different languages 11511>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 11512>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 11513# "Invalid partition table" xx=0x12C for english version 11514# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 11515>>>>0x1b5 ubyte >0 at offset 0x1%x 11516>>>>(0x1b5.b+0x100) string >\0 "%s" 11517# "Error loading operating system" yy=0x144 for english version 11518# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 11519>>>>0x1b6 ubyte >0 at offset 0x1%x 11520>>>>(0x1b6.b+0x100) string >\0 "%s" 11521# "Missing operating system" zz=0x163 for english version 11522# "Betriebssystem nicht vorhanden" zz=0x16e for german version 11523>>>>0x1b7 ubyte >0 at offset 0x1%x 11524>>>>(0x1b7.b+0x100) string >\0 "%s" 11525# Microsoft Windows Vista or 7 11526# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 11527>>8 ubequad 0xc08ed8be007cbf00 11528# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 11529# assembler instructions: jnz 0729;cmp ebx,"TCPA" 11530>>>0xEC ubequad 0x753b6681fb544350 Vista 11531# where xxyyzz are lower bits from offsets of error messages varying for different languages 11532>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 11533#>>>>0x1B4 ubelong&0x00FFFFFF ? german 11534# "Invalid partition table" xx=0x162 for english version 11535# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 11536>>>>0x1b5 ubyte >0 at offset 0x1%x 11537>>>>(0x1b5.b+0x100) string >\0 "%s" 11538# "Error loading operating system" yy=0x17a for english version 11539# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 11540>>>>0x1b6 ubyte >0 at offset 0x1%x 11541>>>>(0x1b6.b+0x100) string >\0 "%s" 11542# "Missing operating system" zz=0x199 for english version 11543# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 11544>>>>0x1b7 ubyte >0 at offset 0x1%x 11545>>>>(0x1b7.b+0x100) string >\0 "%s" 11546# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 11547# assembler instructions: cmp ebx,"TCPA";cmp 11548>>>0xEC ubequad 0x6681fb5443504175 Windows 7 11549# where xxyyzz are lower bits from offsets of error messages varying for different languages 11550>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 11551#>>>>0x1B4 ubelong&0x00FFFFFF ? german 11552# "Invalid partition table" xx=0x163 for english version 11553# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 11554>>>>0x1b5 ubyte >0 at offset 0x1%x 11555>>>>(0x1b5.b+0x100) string >\0 "%s" 11556# "Error loading operating system" yy=0x17b for english version 11557# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 11558>>>>0x1b6 ubyte >0 at offset 0x1%x 11559>>>>(0x1b6.b+0x100) string >\0 "%s" 11560# "Missing operating system" zz=0x19a for english version 11561# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 11562>>>>0x1b7 ubyte >0 at offset 0x1%x 11563>>>>(0x1b7.b+0x100) string >\0 "%s" 11564# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 11565# https://en.wikipedia.org/wiki/MBR_disk_signature#ID 11566>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 11567# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm 11568>>0xDA uleshort 0 11569>>>0xDC ulelong >0 \b, created 11570# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 11571>>>>0xDC ubyte x with driveID 0x%x 11572# hours, minutes and seconds 11573>>>>0xDf ubyte x at %x 11574>>>>0xDe ubyte x \b:%x 11575>>>>0xDd ubyte x \b:%x 11576# special case for Microsoft MS-DOS 3.21 spanish 11577# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 11578>0 ubequad 0xfab830008ed0bc00 11579# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 11580>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 11581# Microsoft MBR IPL end 11582 11583# dr-dos with some upper-, lowercase variants 11584>0x9D string Invalid\ partition\ table$ 11585>>181 string No\ Operating\ System$ 11586>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 11587>0x9D string Invalid\ partition\ table$ 11588>>181 string No\ operating\ system$ 11589>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 11590>342 string Invalid\ partition\ table$ 11591>>366 string No\ operating\ system$ 11592>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 11593>295 string NEWLDR\0 11594>>302 string Bad\ PT\ $ 11595>>>310 string No\ OS\ $ 11596>>>>317 string OS\ load\ err$ 11597>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 11598>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 11599>>>>>>>387 string Copyright\ (c)\ 1984,1998 11600>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 11601# 11602# tests for different MS-DOS Master Boot Records (MBR) moved and merged 11603# 11604#>0x145 string Default:\ F \b, FREE-DOS MBR 11605#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 11606>0x145 search/7 Default:\ F \b, FREE-DOS MBR 11607#>>313 string F0\ .\ .\ . 11608#>>>322 string disk\ 1 11609#>>>>382 string FAT3 11610>64 string no\ active\ partition\ found 11611>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 11612# Ranish Partition Manager http://www.ranish.com/part/ 11613>387 search/4 \0\ Error!\r 11614>>378 search/7 Virus! 11615>>>397 search/4 Booting\040 11616>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 11617>>>>>416 string Writing\ changes... \b2.37 11618>>>>>>438 ubyte x \b,0x%x dots 11619>>>>>>440 ubyte >0 \b,virus check 11620>>>>>>441 ubyte >0 \b,partition %c 11621#2.38,2.42,2.44 11622>>>>>416 string !Writing\ changes... \b 11623>>>>>>418 ubyte 1 \bvirus check, 11624>>>>>>419 ubyte x \b0x%x seconds 11625>>>>>>420 ubyte&0x0F >0 \b,partition 11626>>>>>>>420 ubyte&0x0F <5 \b %x 11627>>>>>>>420 ubyte&0x0F 0Xf \b ask 11628>>>>>420 ubyte x \b) 11629# 11630# SYSLINUX MBR moved 11631# https://www.acronis.de/ 11632>362 string MBR\ Error\ \0\r 11633>>376 string ress\ any\ key\ to\040 11634>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 11635# added by Joerg Jenderek 11636# https://www.visopsys.org/ 11637# https://partitionlogic.org.uk/ 11638>309 string No\ bootable\ partition\ found\r 11639>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 11640>349 string No\ bootable\ partition\ found\r 11641>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 11642# bootloader, bootmanager 11643>0x40 string SBML 11644# label with 11 characters of FAT 12 bit filesystem 11645>>43 string SMART\ BTMGR 11646>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 11647# OEM-ID not always "SBM" 11648#>>>>3 strings SBM 11649>>>>6 string >\0 \b, version %s 11650>382 string XOSLLOADXCF \b, eXtended Operating System Loader 11651>6 string LILO \b, LInux i386 boot LOader 11652>>120 string LILO \b, version 22.3.4 SuSe 11653>>172 string LILO \b, version 22.5.8 Debian 11654# updated by Joerg Jenderek at Oct 2008 11655# variables according to grub-0.97/stage1/stage1.S or 11656# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 11657# usual values are marked with comments to get only information of strange GRUB loaders 11658>342 search/60 \0Geom\0 11659#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 11660>>0x41 ubyte <2 11661>>>0x3E ubyte >2 \b; GRand Unified Bootloader 11662# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 11663>>>>0x3E ubyte x \b, stage1 version 0x%x 11664#If it is 0xFF, use a drive passed by BIOS 11665>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 11666# in most case 0,1,0x2e for GRUB 0.5.95 11667>>>>0x41 ubyte >0 \b, LBA flag 0x%x 11668>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 11669#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 11670>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 11671#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 11672>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 11673>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 11674#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 11675>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 11676>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 11677>>>>>394 string stage1 \b, GRUB version 0.5.95 11678>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 11679>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 11680>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 11681>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 11682>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 11683>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 11684>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 11685>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 11686# unknown version 11687>>>343 string Geom\0Read\0\ Error\0 11688>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 11689>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 11690>>>>374 string GRUB\ \0 \b, GRUB version n.m 11691# SYSLINUX bootloader moved 11692>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 11693# http://www.bcdwb.de/bcdw/index_e.htm 11694>3 string BCDL 11695>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 11696# mbr partition table entries updated by Joerg Jenderek at Sep 2013 11697# skip Norton Utilities disc image data 11698>3 string !IHISK 11699# skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax; 11700>>0 belong !0xb8c0078e 11701# not Linux kernel 11702>>>514 string !HdrS 11703# not BeOS 11704>>>>422 string !Be\ Boot\ Loader 11705# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 11706>>>>>0 ubelong&0xFD000000 =0xE9000000 11707# AdvanceMAME mbr 11708>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 11709>>>>>>>446 use partition-table 11710# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 11711>>>>>0 ubelong&0xFD000000 !0xE9000000 11712# skip FSInfosector 11713>>>>>>0 string !RRaA 11714# skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 11715# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 11716>>>>>>>0 ubequad !0xfa660fb64610668b 11717# skip 13rd sector of MS x86 bootloader 11718>>>>>>>>0 ubequad !0x660fb64610668b4e 11719# skip sector starting with DOS new line 11720>>>>>>>>>0 string !\r\n 11721# allowed active flag 0,80h-FFh 11722>>>>>>>>>>446 ubyte 0 11723>>>>>>>>>>>446 use partition-table 11724>>>>>>>>>>446 ubyte >0x7F 11725>>>>>>>>>>>446 use partition-table 11726# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 11727# mbr partition table entries end 11728# https://www.acronis.de/ 11729#FAT label=ACRONIS\ SZ 11730#OEM-ID=BOOTWIZ0 11731>442 string Non-system\ disk,\040 11732>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 11733# updated by Joerg Jenderek at Nov 2012, Sep 2013 11734# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 11735# display 1 space 11736>>>447 ubyte x \b 11737>>>477 use DOS-filename 11738# 11739>185 string FDBOOT\ Version\040 11740>>204 string \rNo\ Systemdisk.\040 11741>>>220 string Booting\ from\ harddisk.\n\r 11742>>>245 string Cannot\ load\ from\ harddisk.\n\r 11743>>>>273 string Insert\ Systemdisk\040 11744>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 11745>>>>>>200 string >\0 \b, version %-3s 11746>242 string Bootsector\ from\ C.H.\ Hochst\204 11747# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 11748# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 11749# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 11750>242 search/127 Bootsector\ from\ C.H.\ Hochst 11751>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 11752# followed by variants with point,CR-NL or NL-CR 11753>>>208 search/261 Cannot\ load\ from\ harddisk. 11754# followed by variants CR-NL or NL-CR 11755>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 11756# followed by variants with point,CR-NL or NL-CR 11757>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 11758# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 11759>>>>>>&0 string x \b, version %-4.4s 11760>(1.b+2) ubyte 0xe 11761>>(1.b+3) ubyte 0x1f 11762>>>(1.b+4) ubyte 0xbe 11763# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 11764>>>>(1.b+5) ubyte&0xd3 0x53 11765>>>>>(1.b+6) ubyte 0x7c 11766# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 11767>>>>>>(1.b+7) ubyte 0xac 11768>>>>>>>(1.b+8) ubyte 0x22 11769>>>>>>>>(1.b+9) ubyte 0xc0 11770>>>>>>>>>(1.b+10) ubyte 0x74 11771>>>>>>>>>>(1.b+11) ubyte 0x0b 11772>>>>>>>>>>>(1.b+12) ubyte 0x56 11773>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 11774# FAT1X version 11775>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 11776>>>>>>>>>>>>>>0x5b string >\0 "%-s" 11777# FAT32 version 11778>>>>>>>>>>>>>(1.b+5) ubyte 0x77 11779>>>>>>>>>>>>>>0x77 string >\0 "%-s" 11780>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 11781#>>244 string from\ dosemu-freedos-*-bin.tgz\r 11782#>>>170 string Sorry,\ could\ not\ load\ an\040 11783#>>>>195 string operating\ system.\r\n 11784# 11785>103 string This\ is\ not\ a\ bootable\ disk.\040 11786>>132 string Please\ insert\ a\ bootable\040 11787>>>157 string floppy\ and\r\n 11788>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 11789# 11790>66 string Solaris\ Boot\ Sector 11791>>99 string Incomplete\ MDBoot\ load. 11792>>>89 string Version \b, Sun Solaris Bootloader 11793>>>>97 byte x version %c 11794# 11795>408 string OS/2\ !!\ SYS01475\r\0 11796>>429 string OS/2\ !!\ SYS02025\r\0 11797>>>450 string OS/2\ !!\ SYS02027\r\0 11798>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 11799# 11800>409 string OS/2\ !!\ SYS01475\r\0 11801>>430 string OS/2\ !!\ SYS02025\r\0 11802>>>451 string OS/2\ !!\ SYS02027\r\0 11803>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 11804>112 string This\ disk\ is\ not\ bootable\r 11805>>142 string If\ you\ wish\ to\ make\ it\ bootable 11806>>>176 string run\ the\ DOS\ program\ SYS\040 11807>>>200 string after\ the\r 11808>>>>216 string system\ has\ been\ loaded\r\n 11809>>>>>242 string Please\ insert\ a\ DOS\ diskette\040 11810>>>>>271 string into\r\n\ the\ drive\ and\040 11811>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 11812# XP 11813>430 string NTLDR\ is\ missing\xFF\r\n 11814>>449 string Disk\ error\xFF\r\n 11815>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 11816# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 11817>>>>417 ubyte&0xDF >0 11818>>>>>417 string x %-.5s 11819>>>>>>422 ubyte&0xDF >0 11820>>>>>>>422 string x \b%-.3s 11821>>>>>425 ubyte&0xDF >0 11822>>>>>>425 string >\ \b.%-.3s 11823# 11824>>>>371 ubyte >0x20 11825>>>>>368 ubyte&0xDF >0 11826>>>>>>368 string x %-.5s 11827>>>>>>>373 ubyte&0xDF >0 11828>>>>>>>>373 string x \b%-.3s 11829>>>>>>376 ubyte&0xDF >0 11830>>>>>>>376 string x \b.%-.3s 11831# 11832>430 string NTLDR\ nicht\ gefunden\xFF\r\n 11833>>453 string Datentr\204gerfehler\xFF\r\n 11834>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 11835>>>>417 ubyte&0xDF >0 11836>>>>>417 string x %-.5s 11837>>>>>>422 ubyte&0xDF >0 11838>>>>>>>422 string x \b%-.3s 11839>>>>>425 ubyte&0xDF >0 11840>>>>>>425 string >\ \b.%-.3s 11841# offset variant 11842>>>>379 string \0 11843>>>>>368 ubyte&0xDF >0 11844>>>>>>368 string x %-.5s 11845>>>>>>>373 ubyte&0xDF >0 11846>>>>>>>>373 string x \b%-.3s 11847# 11848>430 string NTLDR\ fehlt\xFF\r\n 11849>>444 string Datentr\204gerfehler\xFF\r\n 11850>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 11851>>>>417 ubyte&0xDF >0 11852>>>>>417 string x %-.5s 11853>>>>>>422 ubyte&0xDF >0 11854>>>>>>>422 string x \b%-.3s 11855>>>>>425 ubyte&0xDF >0 11856>>>>>>425 string >\ \b.%-.3s 11857# variant 11858>>>>371 ubyte >0x20 11859>>>>>368 ubyte&0xDF >0 11860>>>>>>368 string x %-.5s 11861>>>>>>>373 ubyte&0xDF >0 11862>>>>>>>>373 string x \b%-.3s 11863>>>>>>376 ubyte&0xDF >0 11864>>>>>>>376 string x \b.%-.3s 11865# 11866>430 string NTLDR\ fehlt\xFF\r\n 11867>>444 string Medienfehler\xFF\r\n 11868>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 11869>>>>371 ubyte >0x20 11870>>>>>368 ubyte&0xDF >0 11871>>>>>>368 string x %-.5s 11872>>>>>>>373 ubyte&0xDF >0 11873>>>>>>>>373 string x \b%-.3s 11874>>>>>>376 ubyte&0xDF >0 11875>>>>>>>376 string x \b.%-.3s 11876# variant 11877>>>>417 ubyte&0xDF >0 11878>>>>>417 string x %-.5s 11879>>>>>>422 ubyte&0xDF >0 11880>>>>>>>422 string x \b%-.3s 11881>>>>>425 ubyte&0xDF >0 11882>>>>>>425 string >\ \b.%-.3s 11883# 11884>430 string Datentr\204ger\ entfernen\xFF\r\n 11885>>454 string Medienfehler\xFF\r\n 11886>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 11887>>>>379 string \0 11888>>>>>368 ubyte&0xDF >0 11889>>>>>>368 string x %-.5s 11890>>>>>>>373 ubyte&0xDF >0 11891>>>>>>>>373 string x \b%-.3s 11892>>>>>>376 ubyte&0xDF >0 11893>>>>>>>376 string x \b.%-.3s 11894# variant 11895>>>>417 ubyte&0xDF >0 11896>>>>>417 string x %-.5s 11897>>>>>>422 ubyte&0xDF >0 11898>>>>>>>422 string x \b%-.3s 11899>>>>>425 ubyte&0xDF >0 11900>>>>>>425 string >\ \b.%-.3s 11901# 11902 11903#>3 string NTFS\ \ \ \040 11904>389 string Fehler\ beim\ Lesen\040 11905>>407 string des\ Datentr\204gers 11906>>>426 string NTLDR\ fehlt 11907>>>>440 string NTLDR\ ist\ komprimiert 11908>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 11909#>3 string NTFS\ \ \ \040 11910>313 string A\ disk\ read\ error\ occurred.\r 11911>>345 string A\ kernel\ file\ is\ missing\040 11912>>>370 string from\ the\ disk.\r 11913>>>>484 string NTLDR\ is\ compressed 11914>>>>>429 string Insert\ a\ system\ diskette\040 11915>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 11916# DOS loader variants different languages,offsets 11917>472 ubyte&0xDF >0 11918>>389 string Invalid\ system\ disk\xFF\r\n 11919>>>411 string Disk\ I/O\ error 11920>>>>428 string Replace\ the\ disk,\ and\040 11921>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 11922#IO.SYS 11923>>>>>>472 ubyte&0xDF >0 11924>>>>>>>472 string x \b %-.2s 11925>>>>>>>>474 ubyte&0xDF >0 11926>>>>>>>>>474 string x \b%-.5s 11927>>>>>>>>>>479 ubyte&0xDF >0 11928>>>>>>>>>>>479 string x \b%-.1s 11929>>>>>>>480 ubyte&0xDF >0 11930>>>>>>>>480 string x \b.%-.3s 11931#MSDOS.SYS 11932>>>>>>>483 ubyte&0xDF >0 \b+ 11933>>>>>>>>483 string x \b%-.5s 11934>>>>>>>>>488 ubyte&0xDF >0 11935>>>>>>>>>>488 string x \b%-.3s 11936>>>>>>>>491 ubyte&0xDF >0 11937>>>>>>>>>491 string x \b.%-.3s 11938# 11939>>390 string Invalid\ system\ disk\xFF\r\n 11940>>>412 string Disk\ I/O\ error\xFF\r\n 11941>>>>429 string Replace\ the\ disk,\ and\040 11942>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 11943>>388 string Ungueltiges\ System\ \xFF\r\n 11944>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 11945>>>>427 string Datentraeger\ wechseln\ und\040 11946>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 11947#WINBOOT.SYS only not spaces (0xDF) 11948>>>>>>497 ubyte&0xDF >0 11949>>>>>>>497 string x %-.5s 11950>>>>>>>>502 ubyte&0xDF >0 11951>>>>>>>>>502 string x \b%-.1s 11952>>>>>>>>>>503 ubyte&0xDF >0 11953>>>>>>>>>>>503 string x \b%-.1s 11954>>>>>>>>>>>>504 ubyte&0xDF >0 11955>>>>>>>>>>>>>504 string x \b%-.1s 11956>>>>>>505 ubyte&0xDF >0 11957>>>>>>>505 string x \b.%-.3s 11958#IO.SYS 11959>>>>>>472 ubyte&0xDF >0 or 11960>>>>>>>472 string x \b %-.2s 11961>>>>>>>>474 ubyte&0xDF >0 11962>>>>>>>>>474 string x \b%-.5s 11963>>>>>>>>>>479 ubyte&0xDF >0 11964>>>>>>>>>>>479 string x \b%-.1s 11965>>>>>>>480 ubyte&0xDF >0 11966>>>>>>>>480 string x \b.%-.3s 11967#MSDOS.SYS 11968>>>>>>>483 ubyte&0xDF >0 \b+ 11969>>>>>>>>483 string x \b%-.5s 11970>>>>>>>>>488 ubyte&0xDF >0 11971>>>>>>>>>>488 string x \b%-.3s 11972>>>>>>>>491 ubyte&0xDF >0 11973>>>>>>>>>491 string x \b.%-.3s 11974# 11975>>390 string Ungueltiges\ System\ \xFF\r\n 11976>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 11977>>>>429 string Datentraeger\ wechseln\ und\040 11978>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 11979#WINBOOT.SYS only not spaces (0xDF) 11980>>>>>>497 ubyte&0xDF >0 11981>>>>>>>497 string x %-.7s 11982>>>>>>>>504 ubyte&0xDF >0 11983>>>>>>>>>504 string x \b%-.1s 11984>>>>>>505 ubyte&0xDF >0 11985>>>>>>>505 string x \b.%-.3s 11986#IO.SYS 11987>>>>>>472 ubyte&0xDF >0 or 11988>>>>>>>472 string x \b %-.2s 11989>>>>>>>>474 ubyte&0xDF >0 11990>>>>>>>>>474 string x \b%-.6s 11991>>>>>>>480 ubyte&0xDF >0 11992>>>>>>>>480 string x \b.%-.3s 11993#MSDOS.SYS 11994>>>>>>>483 ubyte&0xDF >0 \b+ 11995>>>>>>>>483 string x \b%-.5s 11996>>>>>>>>>488 ubyte&0xDF >0 11997>>>>>>>>>>488 string x \b%-.3s 11998>>>>>>>>491 ubyte&0xDF >0 11999>>>>>>>>>491 string x \b.%-.3s 12000# 12001>>389 string Ungueltiges\ System\ \xFF\r\n 12002>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 12003>>>>428 string Datentraeger\ wechseln\ und\040 12004>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 12005# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 12006>>>>>>472 string x %-.2s 12007>>>>>>>474 ubyte&0xDF >0 12008>>>>>>>>474 string x \b%-.5s 12009>>>>>>>>479 ubyte&0xDF >0 12010>>>>>>>>>479 string x \b%-.1s 12011>>>>>>480 ubyte&0xDF >0 12012>>>>>>>480 string x \b.%-.3s 12013>>>>>>483 ubyte&0xDF >0 \b+ 12014>>>>>>>483 string x \b%-.5s 12015>>>>>>>488 ubyte&0xDF >0 12016>>>>>>>>488 string x \b%-.2s 12017>>>>>>>>490 ubyte&0xDF >0 12018>>>>>>>>>490 string x \b%-.1s 12019>>>>>>>491 ubyte&0xDF >0 12020>>>>>>>>491 string x \b.%-.3s 12021>479 ubyte&0xDF >0 12022>>416 string Kein\ System\ oder\040 12023>>>433 string Laufwerksfehler 12024>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 12025#IO.SYS 12026>>>>>479 string x \b %-.2s 12027>>>>>>481 ubyte&0xDF >0 12028>>>>>>>481 string x \b%-.6s 12029>>>>>487 ubyte&0xDF >0 12030>>>>>>487 string x \b.%-.3s 12031#MSDOS.SYS 12032>>>>>>490 ubyte&0xDF >0 \b+ 12033>>>>>>>490 string x \b%-.5s 12034>>>>>>>>495 ubyte&0xDF >0 12035>>>>>>>>>495 string x \b%-.3s 12036>>>>>>>498 ubyte&0xDF >0 12037>>>>>>>>498 string x \b.%-.3s 12038# 12039>376 search/41 Non-System\ disk\ or\040 12040>>395 search/41 disk\ error\r 12041>>>407 search/41 Replace\ and\040 12042>>>>419 search/41 press\ \b, 12043>>>>419 search/41 strike\ \b, old 12044>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 12045#449 Disk\ Boot\ failure\r MS 3.21 12046#466 Boot\ Failure\r MS 3.30 12047>>>>>468 search/18 \0 12048#IO.SYS,IBMBIO.COM 12049>>>>>>&0 string x \b %-.2s 12050>>>>>>>&-20 ubyte&0xDF >0 12051>>>>>>>>&-1 string x \b%-.4s 12052>>>>>>>>>&-16 ubyte&0xDF >0 12053>>>>>>>>>>&-1 string x \b%-.2s 12054>>>>>>&8 ubyte&0xDF >0 \b. 12055>>>>>>>&-1 string x \b%-.3s 12056#MSDOS.SYS,IBMDOS.COM 12057>>>>>>&11 ubyte&0xDF >0 \b+ 12058>>>>>>>&-1 string x \b%-.5s 12059>>>>>>>>&-6 ubyte&0xDF >0 12060>>>>>>>>>&-1 string x \b%-.1s 12061>>>>>>>>>>&-5 ubyte&0xDF >0 12062>>>>>>>>>>>&-1 string x \b%-.2s 12063>>>>>>>&7 ubyte&0xDF >0 \b. 12064>>>>>>>>&-1 string x \b%-.3s 12065>441 string Cannot\ load\ from\ harddisk.\n\r 12066>>469 string Insert\ Systemdisk\040 12067>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 12068#>43 string \224R-LOADER\ \ SYS =label 12069>54 string SYS 12070>>324 string VASKK 12071>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 12072# 12073>98 string Press\ a\ key\ to\ retry\0\r 12074>>120 string Cannot\ find\ file\ \0\r 12075>>>139 string Disk\ read\ error\0\r 12076>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 12077#DRBIOS.SYS 12078>>>>>44 ubyte&0xDF >0 12079>>>>>>44 string x \b %-.6s 12080>>>>>>>50 ubyte&0xDF >0 12081>>>>>>>>50 string x \b%-.2s 12082>>>>>>52 ubyte&0xDF >0 12083>>>>>>>52 string x \b.%-.3s 12084# 12085>70 string IBMBIO\ \ COM 12086>>472 string Cannot\ load\ DOS!\040 12087>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 12088>>471 string Cannot\ load\ DOS\040 12089>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 12090#?? 12091>444 string KERNEL\ \ SYS 12092>>314 string BOOT\ error! \b, FREE-DOS Bootloader 12093>499 string KERNEL\ \ SYS 12094>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 12095>449 string KERNEL\ \ SYS 12096>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 12097# 12098>449 string Loading\ FreeDOS 12099>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 12100>>>497 ubyte&0xDF >0 12101>>>>497 string x \b %-.6s 12102>>>>>503 ubyte&0xDF >0 12103>>>>>>503 string x \b%-.1s 12104>>>>>>>504 ubyte&0xDF >0 12105>>>>>>>>504 string x \b%-.1s 12106>>>>505 ubyte&0xDF >0 12107>>>>>505 string x \b.%-.3s 12108# 12109>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 12110# 12111>125 string Loading\ FreeDOS...\r 12112>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 12113>>>441 ubyte&0xDF >0 12114>>>>441 string x \b %-.6s 12115>>>>>447 ubyte&0xDF >0 12116>>>>>>447 string x \b%-.1s 12117>>>>>>>448 ubyte&0xDF >0 12118>>>>>>>>448 string x \b%-.1s 12119>>>>449 ubyte&0xDF >0 12120>>>>>449 string x \b.%-.3s 12121>124 string FreeDOS\0 12122>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 12123# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 12124>>>497 ubyte&0xDF >0 12125>>>>497 string x \b %-.6s 12126>>>>>503 ubyte&0xDF >0 12127>>>>>>503 string x \b%-.1s 12128>>>>>>>504 ubyte&0xDF >0 12129>>>>>>>>504 string x \b%-.1s 12130>>>>505 ubyte&0xDF >0 12131>>>>>505 string x \b.%-.3s 12132>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 12133>>>497 ubyte&0xDF >0 12134>>>>497 string x \b %-.6s 12135>>>>>503 ubyte&0xDF >0 12136>>>>>>503 string x \b%-.1s 12137>>>>>>>504 ubyte&0xDF >0 12138>>>>>>>>504 string x \b%-.1s 12139>>>>505 ubyte&0xDF >0 12140>>>>>505 string x \b.%-.3s 12141>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 12142>>>497 ubyte&0xDF >0 12143>>>>497 string x \b %-.6s 12144>>>>>503 ubyte&0xDF >0 12145>>>>>>503 string x \b%-.1s 12146>>>>>>>504 ubyte&0xDF >0 12147>>>>>>>>504 string x \b%-.1s 12148>>>>505 ubyte&0xDF >0 12149>>>>>505 string x \b.%-.3s 12150>336 string Error!\040 12151>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 12152>>>497 ubyte&0xDF >0 12153>>>>497 string x \b %-.6s 12154>>>>>503 ubyte&0xDF >0 12155>>>>>>503 string x \b%-.1s 12156>>>>>>>504 ubyte&0xDF >0 12157>>>>>>>>504 string x \b%-.1s 12158>>>>505 ubyte&0xDF >0 12159>>>>>505 string x \b.%-.3s 12160# added by Joerg Jenderek 12161# https://www.visopsys.org/ 12162# https://partitionlogic.org.uk/ 12163# OEM-ID=Visopsys 12164>478 ulelong 0 12165>>(1.b+326) string I/O\ Error\ reading\040 12166>>>(1.b+344) string Visopsys\ loader\r 12167>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 12168# http://alexfru.chat.ru/epm.html#bootprog 12169>494 ubyte >0x4D 12170>>495 string >E 12171>>>495 string <S 12172#OEM-ID is not reliable 12173>>>>3 string BootProg 12174# It just looks for a program file name at the root directory 12175# and loads corresponding file with following execution. 12176# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 12177>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 12178>>>>>499 use DOS-filename 12179#If the boot sector fails to read any other sector, 12180#it prints a very short message ("RE") to the screen and hangs the computer. 12181#If the boot sector fails to find needed program in the root directory, 12182#it also hangs with another message ("NF"). 12183>>>>>492 string RENF \b, FAT (12 bit) 12184>>>>>495 string RENF \b, FAT (16 bit) 12185#If the boot sector fails to read any other sector, 12186#it prints a very short message ("RE") to the screen and hangs the computer. 12187# x86 bootloader end 12188 12189# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 12190# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 12191>0 string RRaA 12192>>0x1E4 string rrAa \b, FSInfosector 12193#>>0x1FC uleshort =0 SHOULD BE ZERO 12194>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 12195>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 12196 12197# updated by Joerg Jenderek at Sep 2007 12198>3 ubyte 0 12199#no active flag 12200>>446 ubyte 0 12201# partition 1 not empty 12202>>>450 ubyte >0 12203# partitions 3,4 empty 12204>>>>482 ubyte 0 12205>>>>>498 ubyte 0 12206# partition 2 ID=0,5,15 12207>>>>>>466 ubyte <0x10 12208>>>>>>>466 ubyte 0x05 \b, extended partition table 12209>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 12210>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 12211 12212# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 12213 12214>0x200 lelong 0x82564557 \b, BSD disklabel 12215 12216# by Joerg Jenderek at Apr 2013 12217# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 12218# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 122190 name DOS-filename 12220# space=0x20 (00100000b) means empty 12221>0 ubyte&0xDF >0 12222>>0 ubyte x \b%c 12223>>>1 ubyte&0xDF >0 12224>>>>1 ubyte x \b%c 12225>>>>>2 ubyte&0xDF >0 12226>>>>>>2 ubyte x \b%c 12227>>>>>>>3 ubyte&0xDF >0 12228>>>>>>>>3 ubyte x \b%c 12229>>>>>>>>>4 ubyte&0xDF >0 12230>>>>>>>>>>4 ubyte x \b%c 12231>>>>>>>>>>>5 ubyte&0xDF >0 12232>>>>>>>>>>>>5 ubyte x \b%c 12233>>>>>>>>>>>>>6 ubyte&0xDF >0 12234>>>>>>>>>>>>>>6 ubyte x \b%c 12235>>>>>>>>>>>>>>>7 ubyte&0xDF >0 12236>>>>>>>>>>>>>>>>7 ubyte x \b%c 12237# DOS filename extension 12238>>8 ubyte&0xDF >0 \b. 12239>>>8 ubyte x \b%c 12240>>>>9 ubyte&0xDF >0 12241>>>>>9 ubyte x \b%c 12242>>>>>>10 ubyte&0xDF >0 12243>>>>>>>10 ubyte x \b%c 12244# Print 2 following DOS filenames from directory entry form 12245# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 122460 name 2xDOS-filename 12247# display 1 space 12248>0 ubyte x \b 12249>0 use DOS-filename 12250>11 ubyte x \b+ 12251>11 use DOS-filename 12252 12253# https://en.wikipedia.org/wiki/Master_boot_record#PTE 12254# display standard partition table 122550 name partition-table 12256#>0 ubyte x PARTITION-TABLE 12257# test and display 1st til 4th partition table entry 12258>0 use partition-entry-test 12259>16 use partition-entry-test 12260>32 use partition-entry-test 12261>48 use partition-entry-test 12262# test for entry of partition table 122630 name partition-entry-test 12264# partition type ID > 0 12265>4 ubyte >0 12266# active flag 0 12267>>0 ubyte 0 12268>>>0 use partition-entry 12269# active flag 0x80, 0x81, ... 12270>>0 ubyte >0x7F 12271>>>0 use partition-entry 12272# Print entry of partition table 122730 name partition-entry 12274# partition type ID > 0 12275>4 ubyte >0 \b; partition 12276>>64 leshort 0xAA55 1 12277>>48 leshort 0xAA55 2 12278>>32 leshort 0xAA55 3 12279>>16 leshort 0xAA55 4 12280>>4 ubyte x : ID=0x%x 12281>>0 ubyte&0x80 0x80 \b, active 12282>>0 ubyte >0x80 0x%x 12283>>1 ubyte x \b, start-CHS ( 12284>>1 use partition-chs 12285>>5 ubyte x \b), end-CHS ( 12286>>5 use partition-chs 12287>>8 ulelong x \b), startsector %u 12288>>12 ulelong x \b, %u sectors 12289# Print cylinder,head,sector (CHS) of partition entry 122900 name partition-chs 12291# cylinder 12292>1 ubyte x \b0x 12293>1 ubyte&0xC0 0x40 \b1 12294>1 ubyte&0xC0 0x80 \b2 12295>1 ubyte&0xC0 0xC0 \b3 12296>2 ubyte x \b%x 12297# head 12298>0 ubyte x \b,%u 12299# sector 12300>1 ubyte&0x3F x \b,%u 12301 12302# FATX 123030 string FATX FATX filesystem data 12304 12305# romfs filesystems - Juan Cespedes <cespedes@debian.org> 123060 string -rom1fs- romfs filesystem, version 1 12307>8 belong x %d bytes, 12308>16 string x named %s. 12309 12310# netboot image - Juan Cespedes <cespedes@debian.org> 123110 lelong 0x1b031336L Netboot image, 12312>4 lelong&0xFFFFFF00 0 12313>>4 lelong&0x100 0x000 mode 2 12314>>4 lelong&0x100 0x100 mode 3 12315>4 lelong&0xFFFFFF00 !0 unknown mode 12316 123170x18b string OS/2 OS/2 Boot Manager 12318 12319# updated by Joerg Jenderek at Oct 2008 and Sep 2012 12320# https://syslinux.zytor.com/iso.php 12321# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 12322# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 123230 ulequad&0x909000007cc0eafa 0x909000007c40eafa 12324>631 search/689 ISOLINUX\ isolinux Loader 12325>>&0 string x (version %-4.4s) 12326# https://syslinux.zytor.com/pxe.php 12327# assembler instructions: jmp 7C05 123280 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 12329# assembler instructions: pushfd;pushad 123300 ulelong 0x60669c66 pxelinux loader 12331# assembler instructions: jmp 05 123320 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 12333# https://syslinux.zytor.com/wiki/index.php/SYSLINUX 123340 string LDLINUX\ SYS\ SYSLINUX loader 12335>12 string x (older version %-4.4s) 123360 string \r\nSYSLINUX\ SYSLINUX loader 12337>11 string x (version %-4.4s) 12338# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 12339# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 123400 ulelong&0x80909bEB 0x009018EB 12341# OEM-ID not always "SYSLINUX" 12342>434 search/47 Boot\ failed 12343# followed by \r\n\0 or :\ 12344>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 12345>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 12346>459 search/30 Boot\ error\r\n\0 12347>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 12348# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 12349# assembler instructions: mov di,0600h;mov cx,0100h 1235016 search/4 \xbf\x00\x06\xb9\x00\x01 12351# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 12352!:strength +36 12353>94 search/249 Missing\ operating\ system 12354# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 12355# skip Ranish MBR 12356>>408 search/4 HD1/\0 12357>>408 default x 12358>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 12359# followed by "ing " or space 12360>>>>292 search/98 error 12361>>>>>&0 string \r (version 3.35 or older) 12362>>>>>&0 string .\r (version 3.52 or newer) 12363>>>>>&0 default x (version 3.36-3.51 ) 12364>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 12365>>156 search/10 \0Boot\ partition\ not\ found\r\n 12366>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 12367>>174 search/10 \0Missing\ OS\r\n 12368>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 12369# SYSLINUX END 12370 12371# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 12372# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 123730 ubequad 0x31c08ed0bc007c8e 12374# mbr_bootsel magic before partition table not reliable with small ipl fragments 12375#>444 uleshort 0xb5e1 12376>0004 uleshort x 12377# ERRorTeXT 12378>>181 search/166 Error\ \0\r\n NetBSD mbr 12379# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 12380>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 12381# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 12382>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 12383# BOOT_EXTENDED definitions contains assembler instructions: 12384# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 12385>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 12386# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 12387>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 12388# not TERSE_ERROR 12389>>>196 search/106 No\ active\ partition\0 12390>>>>&0 string Disk\ read\ error\0 12391>>>>>&0 string No\ operating\ system\0 \b,verbose 12392# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 12393>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 12394# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 12395>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 12396# assembler instructions: movw nametab,bx 12397>>>0x26 search/21 \xBB\x94\x07 12398# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 12399>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 12400>>>>>181 search/166 Error\ \0 12401# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 12402>>>>>>&3 string x \b,"%s" 12403>>>446 use partition-table 12404# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 12405# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 12406# assembler instructions: jmp short 0x58;nop;ASCII 124070 ubequad&0xeb58908000000000 0xeb58900000000000 12408# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 12409>(1.b+2) ubequad 0xfa31c08ed88ec08e 12410# Error messages at end of code 12411>>376 string No\ operating\ system\r\n\0 12412>>>398 string Disk\ error\r\n\0FDD\0HDD\0 12413>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 12414 12415# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ 12416# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 12417# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 12418# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 124190 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 12420# pointer to the data starting with Neil Turton signature string 12421>(0x1BC.s) string NDTmbr 12422>>&-14 string 1234F\0 Turton mbr ( 12423# parameters also viewed by install-mbr --list 12424>>>(0x1BC.s+7) ubyte x \b%u<= 12425>>>(0x1BC.s+9) ubyte x \bVersion<=%u 12426#>>>(0x1BC.s+8) ubyte x asm_flag_%x 12427>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 12428# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode 12429>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 12430#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 12431#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 12432#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 12433#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 12434# for older versions 12435>>>(0x1BC.s+9) ubyte <2 12436#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 12437>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 12438# floppy A: or B: 12439>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 12440>>>>(0x1BC.s+13) ubyte >1 12441# 1st hard disc 12442#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 12443# not 1st hard disc 12444>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 12445# for version >= 2 maximal timeout can be 65534 12446>>>(0x1BC.s+9) ubyte >1 12447#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 12448>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 12449# floppy A: or B: 12450>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 12451>>>>(0x1BC.s+14) ubyte >1 12452# 1st hard disc 12453#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 12454# not 1st hard disc 12455>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 12456>>>0 ubyte x \b) 12457 12458# added by Joerg Jenderek 12459# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 12460# grub-1.94/kern/i386/pc/startup.S 12461# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 12462# usual values are marked with comments to get only information of strange GRUB loaders 124630x200 uleshort 0x70EA 12464# found only version 3.{1,2} 12465>0x206 ubeshort >0x0300 12466# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 12467>>0x212 ubyte >0x29 12468>>>0x213 ubyte >0x29 12469# not iso9660_stage1_5 12470#>>>0 ulelong&0x00BE5652 0x00BE5652 12471>>>>0x213 ubyte >0x29 GRand Unified Bootloader 12472# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 12473>>>>0x217 ubyte 0xFF stage1_5 12474>>>>0x217 ubyte <0xFF stage2 12475>>>>0x206 ubyte x \b version %u 12476>>>>0x207 ubyte x \b.%u 12477# module_size for 1.94 12478>>>>0x208 ulelong <0xffffff \b, installed partition %u 12479#>>>>0x208 ulelong =0xffffff \b, %lu (default) 12480>>>>0x208 ulelong >0xffffff \b, installed partition %u 12481# GRUB 0.5.95 unofficial 12482>>>>0x20C ulelong&0x2E300000 0x2E300000 12483# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 12484>>>>>0x20C ubyte x \b, identifier 0x%x 12485#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 12486>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 12487# GRUB version as string 12488>>>>>0x20E string >\0 \b, GRUB version %-s 12489# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 12490>>>>>>0x215 ulong 0xffffffff 12491>>>>>>>0x219 string >\0 \b, configuration file %-s 12492>>>>>>0x215 ulong !0xffffffff 12493>>>>>>>0x215 string >\0 \b, configuration file %-s 12494# newer GRUB versions 12495>>>>0x20C ulelong&0x2E300000 !0x2E300000 12496##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 12497>>>>>0x20C ulelong >0 \b, saved entry %d 12498# for 1.94 contains kernel image size 12499# for 0.93,0.94,0.96,0.97 12500# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 12501>>>>>0x210 ubyte x \b, identifier 0x%x 12502# The flag for LBA forcing is in most cases 0 12503#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 12504>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 12505# GRUB version as string 12506>>>>>0x212 string >\0 \b, GRUB version %-s 12507# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 12508>>>>>0x217 ulong 0xffffffff 12509>>>>>>0x21b string >\0 \b, configuration file %-s 12510>>>>>0x217 ulong !0xffffffff 12511>>>>>>0x217 string >\0 \b, configuration file %-s 12512 12513# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 12514# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 12515# over BIOS parameter block (BPB) 12516# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 12517# older drives may use Near JuMP instruction E9 xx xx 12518# minimal short forward jump found 0x29 for bootloaders or 0x0 12519# maximal short forward jump is 0x7f 12520# OEM-ID is empty or contain readable bytes 125210 ulelong&0x804000E9 0x000000E9 12522!:strength +60 12523# mtools-3.9.8/msdos.h 12524# usual values are marked with comments to get only information of strange FAT systems 12525# valid sectorsize must be a power of 2 from 32 to 32768 12526>11 uleshort&0x001f 0 12527>>11 uleshort <32769 12528>>>11 uleshort >31 12529>>>>21 ubyte&0xf0 0xF0 12530>>>>>0 ubyte 0xEB DOS/MBR boot sector 12531>>>>>>1 ubyte x \b, code offset 0x%x+2 12532>>>>>0 ubyte 0xE9 12533>>>>>>1 uleshort x \b, code offset 0x%x+3 12534>>>>>3 string >\0 \b, OEM-ID "%-.8s" 12535#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 12536>>>>>>8 string IHC \b cached by Windows 9M 12537>>>>>11 uleshort >512 \b, Bytes/sector %u 12538#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 12539>>>>>11 uleshort <512 \b, Bytes/sector %u 12540>>>>>13 ubyte >1 \b, sectors/cluster %u 12541#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 12542# for lazy FAT32 implementation like Transcend digital photo frame PF830 12543>>>>>82 string/c fat32 12544>>>>>>14 uleshort !32 \b, reserved sectors %u 12545#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 12546>>>>>82 string/c !fat32 12547>>>>>>14 uleshort >1 \b, reserved sectors %u 12548#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 12549#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 12550>>>>>16 ubyte >2 \b, FATs %u 12551#>>>>>16 ubyte =2 \b, FATs %u (usual) 12552>>>>>16 ubyte =1 \b, FAT %u 12553>>>>>16 ubyte >0 12554>>>>>17 uleshort >0 \b, root entries %u 12555#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 12556>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 12557#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 12558>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 12559#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 12560>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 12561>>>>>22 uleshort >0 \b, sectors/FAT %u 12562#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 12563>>>>>24 uleshort x \b, sectors/track %u 12564>>>>>26 ubyte >2 \b, heads %u 12565#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 12566>>>>>26 ubyte =1 \b, heads %u 12567# valid only for sector sizes with more then 32 Bytes 12568>>>>>11 uleshort >32 12569# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 12570# skip for values 2,2Ah,70h,73h,DFh 12571# and continue for extended boot signature values 0,28h,29h,80h 12572>>>>>>38 ubyte&0x56 =0 12573>>>>>>>28 ulelong >0 \b, hidden sectors %u 12574#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 12575>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 12576#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 12577# FAT<32 bit specific 12578>>>>>>>82 string/c !fat32 12579#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 12580#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 12581>>>>>>>>36 ubyte !0x80 12582>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 12583# VGA-copy CRC or 12584# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 12585>>>>>>>>37 ubyte >0 \b, reserved 0x%x 12586#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 12587# extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others 12588>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 12589>>>>>>>>38 ubyte&0xFE =0x28 12590>>>>>>>>>39 ulelong x \b, serial number 0x%x 12591>>>>>>>>38 ubyte =0x29 12592>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 12593>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 12594>>>>>>>>>43 string =NO\ NAME \b, unlabeled 12595# there exist some old floppies without word FAT at offset 54 12596# a word like "FATnm " is only a hint for a FAT size on nm-bits 12597# Normally the number of clusters is calculated by the values of BPP. 12598# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 12599# otherwise FAT is 16 bit. 12600# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 12601>>>>>82 string/c !fat32 12602>>>>>>54 string FAT12 \b, FAT (12 bit) 12603>>>>>>54 string FAT16 \b, FAT (16 bit) 12604>>>>>>54 default x 12605# determinate FAT bit size by media descriptor 12606# small floppies implies FAT12 12607>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 12608# with media descriptor F0h floppy or maybe superfloppy with FAT16 12609>>>>>>>21 ubyte =0xF0 12610# superfloppy (many sectors) implies FAT16 12611>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 12612# no superfloppy with media descriptor F0h implies FAT12 12613>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 12614# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 12615>>>>>>>21 ubyte =0xF8 12616# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 12617>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 12618# hard disc with FAT12 or FAT16 12619>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 12620# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 12621>>>>>>>21 ubyte =0xFA 12622# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 12623>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 12624# RAM disc with FAT12 or FAT16 or Tandy hard disc 12625>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 12626# others are floppy 12627>>>>>>>21 default x \b, FAT (12 bit by descriptor) 12628# FAT32 bit specific 12629>>>>>82 string/c fat32 \b, FAT (32 bit) 12630>>>>>>36 ulelong x \b, sectors/FAT %u 12631# https://technet.microsoft.com/en-us/library/cc977221.aspx 12632>>>>>>40 uleshort >0 \b, extension flags 0x%x 12633#>>>>>>40 uleshort =0 \b, extension flags %hu 12634>>>>>>42 uleshort >0 \b, fsVersion %u 12635#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 12636>>>>>>44 ulelong >2 \b, rootdir cluster %u 12637#>>>>>>44 ulelong =2 \b, rootdir cluster %u 12638#>>>>>>44 ulelong =1 \b, rootdir cluster %u 12639>>>>>>48 uleshort >1 \b, infoSector %u 12640#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 12641>>>>>>48 uleshort <1 \b, infoSector %u 12642# 0 or 0xFFFF instead of usual 6 means no backup sector 12643>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 12644>>>>>>50 uleshort =0 \b, no Backup boot sector 12645#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 12646>>>>>>50 default x 12647>>>>>>>50 uleshort x \b, Backup boot sector %u 12648# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 12649>>>>>>52 ulelong >0 \b, reserved1 0x%x 12650>>>>>>56 ulelong >0 \b, reserved2 0x%x 12651>>>>>>60 ulelong >0 \b, reserved3 0x%x 12652# same structure as FAT1X 12653#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 12654#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 12655>>>>>>64 ubyte !0x80 12656>>>>>>>64 ubyte >0 \b, physical drive 0x%x 12657# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 12658>>>>>>65 ubyte >0 \b, reserved 0x%x 12659>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 12660>>>>>>66 ubyte =0x29 12661>>>>>>>67 ulelong x \b, serial number 0x%x 12662>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 12663>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 12664>>>>>>>71 string =NO\ NAME \b, unlabeled 12665# additional tests for floppy image added by Joerg Jenderek 12666# no fixed disk 12667>>>>>21 ubyte !0xF8 12668# floppy media with 12 bit FAT 12669>>>>>>54 string !FAT16 12670# test for FAT after bootsector 12671>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 12672# floppy image 12673!:mime application/x-ima 12674# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 12675# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 12676# 0 FATs 12677>>>>>16 ubyte =0 12678# 0 root entries 12679>>>>>>17 uleshort =0 12680# 0 DOS sectors 12681>>>>>>>19 uleshort =0 12682# 0 sectors/FAT 12683# dos < 4.0 BootSector value found is 0x80 12684#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 12685>>>>>>>>22 uleshort =0 \b; NTFS 12686>>>>>>>>>24 uleshort >0 \b, sectors/track %u 12687>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 12688>>>>>>>>>40 ulequad >0 \b, sectors %lld 12689>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 12690>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 12691# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 12692# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 12693>>>>>>>>>64 lelong <256 12694>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 12695>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 12696# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 12697# Values 128 to 255 represent index block sizes of 2^(256-N) byte 12698>>>>>>>>>68 ulelong <256 12699>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 12700#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 12701>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 12702>>>>>>>>>72 ulequad x \b, serial number 0%llx 12703>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 12704#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 12705# unicode loadername size jump 12706>>>>>>>>>(0x200.s*2) ubyte x 12707# in next sector loadername terminated by unicode CTRL-D and $ 12708>>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains 12709# if 2nd NTFS sectors is found then assume whole filesystem 12710#!:mime application/x-raw-disk-image 12711!:ext img/bin/ntfs 12712>>>>>>>>>>>0x200 use ntfs-sector2 12713 12714# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 12715# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 12716# unused assembler instructions short JMP y2;NOP;NOP 127170x056 ulelong&0xFFFF0FFF 0x909002EB NTFS 12718#!:mime application/octet-stream 12719!:ext bin 12720>0 use ntfs-sector2 12721# https://memory.dataram.com/products-and-services/software/ramdisk 12722# assembler instructions JMP C000;NOP 127230x056 ulelong 0x9000c0e9 NTFS 12724#!:mime application/octet-stream 12725!:ext bin 12726>0 use ntfs-sector2 12727# check for characteristics of second NTFS sector and then display loader name 127280 name ntfs-sector2 12729# number of utf16 characters of loadername 12730>0 uleshort <8 12731# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP 12732>>0x056 ulelong&0xFF0000FD 0x900000E9 12733# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 12734>>>0x002 lestring16 x bootstrap %-5.5s 12735# check for 7 character length of loader name like BOOTMGR 12736>>>0 uleshort 7 12737>>>>0x0c lestring16 x \b%-2.2s 12738### DOS,NTFS boot sectors end 12739 12740# ntfsclone-image is a special save format for NTFS volumes, 12741# created and restored by the ntfsclone program 127420 string \0ntfsclone-image ntfsclone image, 12743>0x10 byte x version %d. 12744>0x11 byte x \b%d, 12745>0x12 lelong x cluster size %d, 12746>0x16 lequad x device size %lld, 12747>0x1e lequad x %lld total clusters, 12748>0x26 lequad x %lld clusters in use 12749 127509564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 12751>8404 string x last mounted on %s, 12752#>9504 ledate x last checked at %s, 12753>8224 ledate x last written at %s, 12754>8401 byte x clean flag %d, 12755>8228 lelong x number of blocks %d, 12756>8232 lelong x number of data blocks %d, 12757>8236 lelong x number of cylinder groups %d, 12758>8240 lelong x block size %d, 12759>8244 lelong x fragment size %d, 12760>8252 lelong x minimum percentage of free blocks %d, 12761>8256 lelong x rotational delay %dms, 12762>8260 lelong x disk rotational speed %drps, 12763>8320 lelong 0 TIME optimization 12764>8320 lelong 1 SPACE optimization 12765 1276642332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 12767>&-1164 string x last mounted on %s, 12768>&-696 string >\0 volume name %s, 12769>&-304 leqldate x last written at %s, 12770>&-1167 byte x clean flag %d, 12771>&-1168 byte x readonly flag %d, 12772>&-296 lequad x number of blocks %lld, 12773>&-288 lequad x number of data blocks %lld, 12774>&-1332 lelong x number of cylinder groups %d, 12775>&-1328 lelong x block size %d, 12776>&-1324 lelong x fragment size %d, 12777>&-180 lelong x average file size %d, 12778>&-176 lelong x average number of files in dir %d, 12779>&-272 lequad x pending blocks to free %lld, 12780>&-264 lelong x pending inodes to free %d, 12781>&-664 lequad x system-wide uuid %0llx, 12782>&-1316 lelong x minimum percentage of free blocks %d, 12783>&-1248 lelong 0 TIME optimization 12784>&-1248 lelong 1 SPACE optimization 12785 1278666908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 12787>&-1164 string x last mounted on %s, 12788>&-696 string >\0 volume name %s, 12789>&-304 leqldate x last written at %s, 12790>&-1167 byte x clean flag %d, 12791>&-1168 byte x readonly flag %d, 12792>&-296 lequad x number of blocks %lld, 12793>&-288 lequad x number of data blocks %lld, 12794>&-1332 lelong x number of cylinder groups %d, 12795>&-1328 lelong x block size %d, 12796>&-1324 lelong x fragment size %d, 12797>&-180 lelong x average file size %d, 12798>&-176 lelong x average number of files in dir %d, 12799>&-272 lequad x pending blocks to free %lld, 12800>&-264 lelong x pending inodes to free %d, 12801>&-664 lequad x system-wide uuid %0llx, 12802>&-1316 lelong x minimum percentage of free blocks %d, 12803>&-1248 lelong 0 TIME optimization 12804>&-1248 lelong 1 SPACE optimization 12805 128069564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 12807>7168 belong 0x4c41424c Apple UFS Volume 12808>>7186 string x named %s, 12809>>7176 belong x volume label version %d, 12810>>7180 bedate x created on %s, 12811>8404 string x last mounted on %s, 12812#>9504 bedate x last checked at %s, 12813>8224 bedate x last written at %s, 12814>8401 byte x clean flag %d, 12815>8228 belong x number of blocks %d, 12816>8232 belong x number of data blocks %d, 12817>8236 belong x number of cylinder groups %d, 12818>8240 belong x block size %d, 12819>8244 belong x fragment size %d, 12820>8252 belong x minimum percentage of free blocks %d, 12821>8256 belong x rotational delay %dms, 12822>8260 belong x disk rotational speed %drps, 12823>8320 belong 0 TIME optimization 12824>8320 belong 1 SPACE optimization 12825 1282642332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 12827>&-1164 string x last mounted on %s, 12828>&-696 string >\0 volume name %s, 12829>&-304 beqldate x last written at %s, 12830>&-1167 byte x clean flag %d, 12831>&-1168 byte x readonly flag %d, 12832>&-296 bequad x number of blocks %lld, 12833>&-288 bequad x number of data blocks %lld, 12834>&-1332 belong x number of cylinder groups %d, 12835>&-1328 belong x block size %d, 12836>&-1324 belong x fragment size %d, 12837>&-180 belong x average file size %d, 12838>&-176 belong x average number of files in dir %d, 12839>&-272 bequad x pending blocks to free %lld, 12840>&-264 belong x pending inodes to free %d, 12841>&-664 bequad x system-wide uuid %0llx, 12842>&-1316 belong x minimum percentage of free blocks %d, 12843>&-1248 belong 0 TIME optimization 12844>&-1248 belong 1 SPACE optimization 12845 1284666908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 12847>&-1164 string x last mounted on %s, 12848>&-696 string >\0 volume name %s, 12849>&-304 beqldate x last written at %s, 12850>&-1167 byte x clean flag %d, 12851>&-1168 byte x readonly flag %d, 12852>&-296 bequad x number of blocks %lld, 12853>&-288 bequad x number of data blocks %lld, 12854>&-1332 belong x number of cylinder groups %d, 12855>&-1328 belong x block size %d, 12856>&-1324 belong x fragment size %d, 12857>&-180 belong x average file size %d, 12858>&-176 belong x average number of files in dir %d, 12859>&-272 bequad x pending blocks to free %lld, 12860>&-264 belong x pending inodes to free %d, 12861>&-664 bequad x system-wide uuid %0llx, 12862>&-1316 belong x minimum percentage of free blocks %d, 12863>&-1248 belong 0 TIME optimization 12864>&-1248 belong 1 SPACE optimization 12865 128660 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), 12867>0x90 lelong+1 x volume %d 12868>0x94 lelong x (of %d), 12869>0x50 string x name %s, 12870>0x98 ulelong x version %u, 12871>0xa0 ulelong x flags 0x%x 12872 12873# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 12874# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 12875# volume label and UUID Russell Coker 12876# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 128770x438 leshort 0xEF53 Linux 12878>0x44c lelong x rev %d 12879>0x43e leshort x \b.%d 12880# No journal? ext2 12881>0x45c lelong ^0x0000004 ext2 filesystem data 12882>>0x43a leshort ^0x0000001 (mounted or unclean) 12883# Has a journal? ext3 or ext4 12884>0x45c lelong &0x0000004 12885# and small INCOMPAT? 12886>>0x460 lelong <0x0000040 12887# and small RO_COMPAT? 12888>>>0x464 lelong <0x0000008 ext3 filesystem data 12889# else large RO_COMPAT? 12890>>>0x464 lelong >0x0000007 ext4 filesystem data 12891# else large INCOMPAT? 12892>>0x460 lelong >0x000003f ext4 filesystem data 12893>0x468 belong x \b, UUID=%08x 12894>0x46c beshort x \b-%04x 12895>0x46e beshort x \b-%04x 12896>0x470 beshort x \b-%04x 12897>0x472 belong x \b-%08x 12898>0x476 beshort x \b%04x 12899>0x478 string >0 \b, volume name "%s" 12900# General flags for any ext* fs 12901>0x460 lelong &0x0000004 (needs journal recovery) 12902>0x43a leshort &0x0000002 (errors) 12903# INCOMPAT flags 12904>0x460 lelong &0x0000001 (compressed) 12905#>0x460 lelong &0x0000002 (filetype) 12906#>0x460 lelong &0x0000010 (meta bg) 12907>0x460 lelong &0x0000040 (extents) 12908>0x460 lelong &0x0000080 (64bit) 12909#>0x460 lelong &0x0000100 (mmp) 12910#>0x460 lelong &0x0000200 (flex bg) 12911# RO_INCOMPAT flags 12912#>0x464 lelong &0x0000001 (sparse super) 12913>0x464 lelong &0x0000002 (large files) 12914>0x464 lelong &0x0000008 (huge files) 12915#>0x464 lelong &0x0000010 (gdt checksum) 12916#>0x464 lelong &0x0000020 (many subdirs) 12917#>0x463 lelong &0x0000040 (extra isize) 12918 12919# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> 129200x400 lelong 0xF2F52010 F2FS filesystem 12921>0x46c belong x \b, UUID=%08x 12922>0x470 beshort x \b-%04x 12923>0x472 beshort x \b-%04x 12924>0x474 beshort x \b-%04x 12925>0x476 belong x \b-%08x 12926>0x47a beshort x \b%04x 12927>0x147c lestring16 x \b, volume name "%s" 12928 12929# Minix filesystems - Juan Cespedes <cespedes@debian.org> 129300x410 leshort 0x137f 12931!:strength / 2 12932>0x402 beshort < 100 12933>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones 12934>0x1e string minix \b, bootable 129350x410 beshort 0x137f 12936!:strength / 2 12937>0x402 beshort < 100 12938>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 12939>0x1e string minix \b, bootable 129400x410 leshort 0x138f 12941!:strength / 2 12942>0x402 beshort < 100 12943>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 12944>0x1e string minix \b, bootable 129450x410 beshort 0x138f 12946!:strength / 2 12947>0x402 beshort < 100 12948>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 12949>0x1e string minix \b, bootable 12950# Weak Magic: this is $x 12951#0x410 leshort 0x2468 12952#>0x402 beshort < 100 12953#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names 12954#>0x1e string minix \b, bootable 12955#0x410 beshort 0x2468 12956#>0x402 beshort < 100 12957#>0x402 beshort > -1 Minix filesystem, V2 (big endian) 12958#>0x1e string minix \b, bootable 12959#0x410 leshort 0x2478 12960#>0x402 beshort < 100 12961#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 12962#>0x1e string minix \b, bootable 12963#0x410 leshort 0x2478 12964#>0x402 beshort < 100 12965#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 12966#>0x1e string minix \b, bootable 12967#0x410 beshort 0x2478 12968#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) 12969#>0x1e string minix \b, bootable 12970# Weak Magic! this is MD 12971#0x418 leshort 0x4d5a 12972#>0x402 beshort <100 12973#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names 12974 12975# SGI disk labels - Nathan Scott <nathans@debian.org> 129760 belong 0x0BE5A941 SGI disk label (volume header) 12977 12978# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 129790 belong 0x58465342 SGI XFS filesystem data 12980>0x4 belong x (blksz %d, 12981>0x68 beshort x inosz %d, 12982>0x64 beshort ^0x2004 v1 dirs) 12983>0x64 beshort &0x2004 v2 dirs) 12984 12985############################################################################ 12986# Minix-ST kernel floppy 129870x800 belong 0x46fc2700 Atari-ST Minix kernel image 12988# https://en.wikipedia.org/wiki/BIOS_parameter_block 12989# floppies with valid BPB and any instruction at beginning 12990>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 12991>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 12992 12993############################################################################ 12994# Hmmm, is this a better way of detecting _standard_ floppy images ? 1299519 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 12996>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1299719 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 12998>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1299919 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 13000>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 13001 1300219 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 13003>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1300419 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 13005>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 13006 1300719 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 1300819 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 13009# | | | | | 13010# | | | | heads 13011# | | | sectors/track 13012# | | sectors/FAT 13013# | media descriptor 13014# BPB: sectors 13015 13016# Valid media descriptor bytes for MS-DOS: 13017# 13018# Byte Capacity Media Size and Type 13019# ------------------------------------------------- 13020# 13021# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 13022# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 13023# F9 720K 3.5-inch, 2-sided, 9-sector 13024# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 13025# FD 360K 5.25-inch, 2-sided, 9-sector 13026# FF 320K 5.25-inch, 2-sided, 8-sector 13027# FC 180K 5.25-inch, 1-sided, 9-sector 13028# FE 160K 5.25-inch, 1-sided, 8-sector 13029# FE 250K 8-inch, 1-sided, single-density 13030# FD 500K 8-inch, 2-sided, single-density 13031# FE 1.2 MB 8-inch, 2-sided, double-density 13032# F8 ----- Fixed disk 13033# 13034# FC xxxK Apricot 70x1x9 boot disk. 13035# 13036# Originally a bitmap: 13037# xxxxxxx0 Not two sided 13038# xxxxxxx1 Double sided 13039# xxxxxx0x Not 8 SPT 13040# xxxxxx1x 8 SPT 13041# xxxxx0xx Not Removable drive 13042# xxxxx1xx Removable drive 13043# 11111xxx Must be one. 13044# 13045# But now it's rather random: 13046# 111111xx Low density disk 13047# 00 SS, Not 8 SPT 13048# 01 DS, Not 8 SPT 13049# 10 SS, 8 SPT 13050# 11 DS, 8 SPT 13051# 13052# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 13053# 11110000 High density 3 1/2 floppy disk 13054# 11111000 Hard disk any format 13055# 13056 13057# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 13058# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 13059# Too Weak. 13060#512 ubelong&0xE0ffff00 0xE0ffff00 13061# without valid Media descriptor in place of BPB, cases with are done at other places 13062#>21 ubyte <0xE5 floppy with old FAT filesystem 13063# but valid Media descriptor at begin of FAT 13064#>>512 ubyte =0xed 720k 13065#>>512 ubyte =0xf0 1440k 13066#>>512 ubyte =0xf8 720k 13067#>>512 ubyte =0xf9 1220k 13068#>>512 ubyte =0xfa 320k 13069#>>512 ubyte =0xfb 640k 13070#>>512 ubyte =0xfc 180k 13071# look like an old DOS directory entry 13072#>>>0xA0E ubequad 0 13073#>>>>0xA00 ubequad !0 13074#!:mime application/x-ima 13075#>>512 ubyte =0xfd 13076# look for 2nd FAT at different location to distinguish between 360k and 500k 13077#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 13078#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 13079#>>>0xA0E ubequad 0 13080#!:mime application/x-ima 13081#>>512 ubyte =0xfe 13082#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 13083#>>>>0x60E ubequad 0 13084#>>>>>0x600 ubequad !0 13085#!:mime application/x-ima 13086#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 13087#>>512 ubyte =0xff 320k 13088#>>>0x60E ubequad 0 13089#>>>>0x600 ubequad !0 13090#!:mime application/x-ima 13091#>>512 ubyte x \b, Media descriptor 0x%x 13092# without x86 jump instruction 13093#>>0 ulelong&0x804000E9 !0x000000E9 13094# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 13095#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 13096# IOSYS.COM+MSDOS.COM 13097#>>>>0xc4 use 2xDOS-filename 13098#>>0 ulelong&0x804000E9 =0x000000E9 13099# only x86 short jump instruction found 13100#>>>0 ubyte =0xEB 13101#>>>>1 ubyte x \b, code offset 0x%x+2 13102# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm 13103# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 13104#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 13105# ibmbio.com+ibmdos.com 13106#>>>>>0x176 use DOS-filename 13107#>>>>>0x181 ubyte x \b+ 13108#>>>>>0x182 use DOS-filename 13109# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm 13110# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 13111#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 13112# ibmbio.com+ibmdos.com 13113#>>>>>0x18b use DOS-filename 13114#>>>>>0x196 ubyte x \b+ 13115#>>>>>0x197 use DOS-filename 13116# https://en.wikipedia.org/wiki/Zenith_Data_Systems 13117# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 13118#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 13119# IO.SYS+MSDOS.SYS 13120#>>>>>0x20 use 2xDOS-filename 13121# https://en.wikipedia.org/wiki/Corona_Data_Systems 13122# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 13123#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 13124# IO.SYS+MSDOS.SYS 13125#>>>>>0x69 use 2xDOS-filename 13126# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 13127#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 13128# defect IO.SYS+MSDOS.SYS ? 13129#>>>>>0x162 use 2xDOS-filename 13130 131310 name cdrom 13132>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 13133!:mime application/x-iso9660-image 13134!:ext iso/iso9660 13135>38913 string NSR0 UDF filesystem data 13136!:mime application/x-iso9660-image 13137!:ext iso/udf 13138>>38917 string 1 (version 1.0) 13139>>38917 string 2 (version 1.5) 13140>>38917 string 3 (version 2.0) 13141>>38917 byte >0x33 (unknown version, ID 0x%X) 13142>>38917 byte <0x31 (unknown version, ID 0x%X) 13143# The next line is not necessary because the MBR staff is done looking for boot signature 13144>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 13145# "application id" which appears to be used as a volume label 13146>32808 string/T >\0 '%.32s' 13147>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 1314837633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 13149!:mime application/x-iso9660-image 1315032777 string CDROM High Sierra CD-ROM filesystem data 13151# "application id" which appears to be used as a volume label 13152>32816 string/T >\0 '%.32s' 13153 13154 13155# CDROM Filesystems 13156# https://en.wikipedia.org/wiki/ISO_9660 13157# Modified for UDF by gerardo.cacciari@gmail.com 1315832769 string CD001 13159# mime line at that position does not work 13160# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 13161#!:strength -11 13162# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 13163!:strength +35 13164>0 use cdrom 13165 13166# URL: https://en.wikipedia.org/wiki/NRG_(file_format) 13167# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ 13168# 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh 13169# From: Joerg Jenderek 13170# Note: Only for nero disc with once (DAO) type after 300 KB header 13171339969 string CD001 Nero CD image at 0x4B000 13172!:mime application/x-nrg 13173!:ext nrg 13174>307200 use cdrom 13175 13176# .cso files 13177# Reference: https://pismotec.com/ciso/ciso.h 13178# NOTE: There are two other formats with the same magic but 13179# completely incompatible specifications: 13180# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h 13181# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 131820 string CISO 13183# Other fields are used to determine what type of CISO this is: 13184# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 13185# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 13186# - 0x10 == 0x00004000: For >2GB files using maxcso... 13187# https://github.com/unknownbrackets/maxcso/issues/26 13188# - None of the above: Compact ISO. 13189>4 lelong !0 13190>>4 lelong !0x200000 13191>>>16 lelong !0x800 13192>>>>16 lelong !0x4000 Compressed ISO CD image 13193 13194# cramfs filesystem - russell@coker.com.au 131950 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 13196>4 lelong x size %u 13197>8 lelong &1 version #2 13198>8 lelong &2 sorted_dirs 13199>8 lelong &4 hole_support 13200>32 lelong x CRC 0x%x, 13201>36 lelong x edition %u, 13202>40 lelong x %u blocks, 13203>44 lelong x %u files 13204 132050 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 13206>4 belong x size %u 13207>8 belong &1 version #2 13208>8 belong &2 sorted_dirs 13209>8 belong &4 hole_support 13210>32 belong x CRC 0x%x, 13211>36 belong x edition %u, 13212>40 belong x %u blocks, 13213>44 belong x %u files 13214 13215# reiserfs - russell@coker.com.au 132160x10034 string ReIsErFs ReiserFS V3.5 132170x10034 string ReIsEr2Fs ReiserFS V3.6 132180x10034 string ReIsEr3Fs ReiserFS V3.6.19 13219>0x1002c leshort x block size %d 13220>0x10032 leshort &2 (mounted or unclean) 13221>0x10000 lelong x num blocks %d 13222>0x10040 lelong 1 tea hash 13223>0x10040 lelong 2 yura hash 13224>0x10040 lelong 3 r5 hash 13225 13226# EST flat binary format (which isn't, but anyway) 13227# From: Mark Brown <broonie@sirena.org.uk> 132280 string ESTFBINR EST flat binary 13229 13230# Aculab VoIP firmware 13231# From: Mark Brown <broonie@sirena.org.uk> 132320 string VoIP\ Startup\ and Aculab VoIP firmware 13233>35 string x format %s 13234 13235# From: Mark Brown <broonie@sirena.org.uk> [old] 13236# From: Behan Webster <behanw@websterwood.com> 132370 belong 0x27051956 u-boot legacy uImage, 13238>32 string x %s, 13239>28 byte 0 Invalid os/ 13240>28 byte 1 OpenBSD/ 13241>28 byte 2 NetBSD/ 13242>28 byte 3 FreeBSD/ 13243>28 byte 4 4.4BSD/ 13244>28 byte 5 Linux/ 13245>28 byte 6 SVR4/ 13246>28 byte 7 Esix/ 13247>28 byte 8 Solaris/ 13248>28 byte 9 Irix/ 13249>28 byte 10 SCO/ 13250>28 byte 11 Dell/ 13251>28 byte 12 NCR/ 13252>28 byte 13 LynxOS/ 13253>28 byte 14 VxWorks/ 13254>28 byte 15 pSOS/ 13255>28 byte 16 QNX/ 13256>28 byte 17 Firmware/ 13257>28 byte 18 RTEMS/ 13258>28 byte 19 ARTOS/ 13259>28 byte 20 Unity OS/ 13260>28 byte 21 INTEGRITY/ 13261>29 byte 0 \bInvalid CPU, 13262>29 byte 1 \bAlpha, 13263>29 byte 2 \bARM, 13264>29 byte 3 \bIntel x86, 13265>29 byte 4 \bIA64, 13266>29 byte 5 \bMIPS, 13267>29 byte 6 \bMIPS 64-bit, 13268>29 byte 7 \bPowerPC, 13269>29 byte 8 \bIBM S390, 13270>29 byte 9 \bSuperH, 13271>29 byte 10 \bSparc, 13272>29 byte 11 \bSparc 64-bit, 13273>29 byte 12 \bM68K, 13274>29 byte 13 \bNios-32, 13275>29 byte 14 \bMicroBlaze, 13276>29 byte 15 \bNios-II, 13277>29 byte 16 \bBlackfin, 13278>29 byte 17 \bAVR32, 13279>29 byte 18 \bSTMicroelectronics ST200, 13280>29 byte 19 \bSandbox architecture, 13281>29 byte 20 \bANDES Technology NDS32, 13282>29 byte 21 \bOpenRISC 1000, 13283>29 byte 22 \bARM 64-bit, 13284>29 byte 23 \bDesignWare ARC, 13285>29 byte 24 \bx86_64, 13286>29 byte 25 \bXtensa, 13287>29 byte 26 \bRISC-V, 13288>30 byte 0 Invalid Image 13289>30 byte 1 Standalone Program 13290>30 byte 2 OS Kernel Image 13291>30 byte 3 RAMDisk Image 13292>30 byte 4 Multi-File Image 13293>30 byte 5 Firmware Image 13294>30 byte 6 Script File 13295>30 byte 7 Filesystem Image (any type) 13296>30 byte 8 Binary Flat Device Tree BLOB 13297>31 byte 0 (Not compressed), 13298>31 byte 1 (gzip), 13299>31 byte 2 (bzip2), 13300>31 byte 3 (lzma), 13301>12 belong x %d bytes, 13302>8 bedate x %s, 13303>16 belong x Load Address: 0x%08X, 13304>20 belong x Entry Point: 0x%08X, 13305>4 belong x Header CRC: 0x%08X, 13306>24 belong x Data CRC: 0x%08X 13307 13308# JFFS2 file system 133090 leshort 0x1984 Linux old jffs2 filesystem data little endian 133100 beshort 0x1984 Linux old jffs2 filesystem data big endian 133110 leshort 0x1985 Linux jffs2 filesystem data little endian 133120 beshort 0x1985 Linux jffs2 filesystem data big endian 13313 13314# Squashfs 133150 name squashfs 13316>28 beshort x version %d. 13317>30 beshort x \b%d, 13318>20 beshort 0 uncompressed, 13319>20 beshort 1 zlib 13320>20 beshort 2 lzma 13321>20 beshort 3 lzo 13322>20 beshort 4 xz 13323>20 beshort 5 lz4 13324>20 beshort 6 zstd 13325>20 beshort >0 compressed, 13326>28 beshort <3 13327>>8 belong x %d bytes, 13328>28 beshort >2 13329>>28 beshort <4 13330>>>63 bequad x %lld bytes, 13331>>28 beshort >3 13332>>>40 bequad x %lld bytes, 13333#>>67 belong x %d bytes, 13334>4 belong x %d inodes, 13335>28 beshort <2 13336>>32 beshort x blocksize: %d bytes, 13337>28 beshort >1 13338>>28 beshort <4 13339>>>51 belong x blocksize: %d bytes, 13340>>28 beshort >3 13341>>>12 belong x blocksize: %d bytes, 13342>28 beshort <4 13343>>39 bedate x created: %s 13344>28 beshort >3 13345>>8 bedate x created: %s 13346 133470 string sqsh Squashfs filesystem, big endian, 13348>0 use squashfs 13349 133500 string hsqs Squashfs filesystem, little endian, 13351>0 use \^squashfs 13352 13353# AFS Dump Magic 13354# From: Ty Sarna <tsarna@sarna.org> 133550 string \x01\xb3\xa1\x13\x22 AFS Dump 13356>&0 belong x (v%d) 13357>>&0 byte 0x76 13358>>>&0 belong x Vol %d, 13359>>>>&0 byte 0x6e 13360>>>>>&0 string x %s 13361>>>>>>&1 byte 0x74 13362>>>>>>>&0 beshort 2 13363>>>>>>>>&4 bedate x on: %s 13364>>>>>>>>&0 bedate =0 full dump 13365>>>>>>>>&0 bedate !0 incremental since: %s 13366 13367#---------------------------------------------------------- 13368#delta ISO Daniel Novotny (dnovotny@redhat.com) 133690 string DISO Delta ISO data 13370!:strength +50 13371>4 belong x version %d 13372 13373# VMS backup savesets - gerardo.cacciari@gmail.com 13374# 133754 string \x01\x00\x01\x00\x01\x00 13376>(0.s+16) string \x01\x01 13377>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 13378>>>40 lelong x (block size %d, 13379>>>49 string >\0 original name '%s', 13380>>>2 short 1024 VAX generated) 13381>>>2 short 2048 AXP generated) 13382>>>2 short 4096 I64 generated) 13383 13384# Summary: Oracle Clustered Filesystem 13385# Created by: Aaron Botsis <redhat@digitalmafia.org> 133868 string OracleCFS Oracle Clustered Filesystem, 13387>4 long x rev %d 13388>0 long x \b.%d, 13389>560 string x label: %.64s, 13390>136 string x mountpoint: %.128s 13391 13392# Summary: Oracle ASM tagged volume 13393# Created by: Aaron Botsis <redhat@digitalmafia.org> 1339432 string ORCLDISK Oracle ASM Volume, 13395>40 string x Disk Name: %0.12s 1339632 string ORCLCLRD Oracle ASM Volume (cleared), 13397>40 string x Disk Name: %0.12s 13398 13399# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 134008 string OracleCFS Oracle Clustered Filesystem, 13401>4 long x rev %d 13402>0 long x \b.%d, 13403>560 string x label: %.64s, 13404>136 string x mountpoint: %.128s 13405 13406# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 1340732 string ORCLDISK Oracle ASM Volume, 13408>40 string x Disk Name: %0.12s 1340932 string ORCLCLRD Oracle ASM Volume (cleared), 13410>40 string x Disk Name: %0.12s 13411 13412# Compaq/HP RILOE floppy image 13413# From: Dirk Jagdmann <doj@cubic.org> 134140 string CPQRFBLO Compaq/HP RILOE floppy image 13415 13416#------------------------------------------------------------------------------ 13417# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 13418# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 13419# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 13420# 134211008 string DECFILE11 Files-11 On-Disk Structure 13422>525 byte x (ODS-%d); 13423>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 13424>1017 string B 13425>>525 byte 2 VAX/VMS or OpenVMS file system; 13426>>525 byte 5 OpenVMS Alpha or Itanium file system; 13427>984 string x volume label is '%-12.12s' 13428 13429# From: Thomas Klausner <wiz@NetBSD.org> 13430# https://filext.com/file-extension/DAA 13431# describes the daa file format. The magic would be: 134320 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 13433 13434# From Albert Cahalan <acahalan@gmail.com> 13435# really le32 operation,destination,payloadsize (but quite predictable) 13436# 01 00 00 00 00 00 00 c0 00 02 00 00 134370 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 13438 13439# From Eric Sandeen 13440# GFS2 134410x10000 belong 0x01161970 13442>0x10018 belong 0x0000051d GFS1 Filesystem 13443>>0x10024 belong x (blocksize %d, 13444>>0x10060 string >\0 lockproto %s) 13445>0x10018 belong 0x00000709 GFS2 Filesystem 13446>>0x10024 belong x (blocksize %d, 13447>>0x10060 string >\0 lockproto %s) 13448 13449# Russell Coker <russell@coker.com.au> 134500x10040 string _BHRfS_M BTRFS Filesystem 13451>0x1012b string >\0 label "%s", 13452>0x10090 lelong x sectorsize %d, 13453>0x10094 lelong x nodesize %d, 13454>0x10098 lelong x leafsize %d, 13455>0x10020 belong x UUID=%08x- 13456>0x10024 beshort x \b%04x- 13457>0x10026 beshort x \b%04x- 13458>0x10028 beshort x \b%04x- 13459>0x1002a beshort x \b%04x 13460>0x1002c belong x \b%08x, 13461>0x10078 lequad x %lld/ 13462>0x10070 lequad x \b%lld bytes used, 13463>0x10088 lequad x %lld devices 13464 13465# dvdisaster's .ecc 13466# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 134670 string *dvdisaster* dvdisaster error correction file 13468 13469# xfs metadump image 13470# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 13471# but can we do the << ? For now it's always 512 (0x200) anyway. 134720 string XFSM 13473>0x200 string XFSB XFS filesystem metadump image 13474 13475# Type: CROM filesystem 13476# From: Werner Fink <werner@suse.de> 134770 string CROMFS CROMFS 13478>6 string >\0 \b version %2.2s, 13479>8 ulequad >0 \b block data at %lld, 13480>16 ulequad >0 \b fblock table at %lld, 13481>24 ulequad >0 \b inode table at %lld, 13482>32 ulequad >0 \b root at %lld, 13483>40 ulelong >0 \b fblock size = %d, 13484>44 ulelong >0 \b block size = %d, 13485>48 ulequad >0 \b bytes = %lld 13486 13487# Type: xfs metadump image 13488# From: Daniel Novotny <dnovotny@redhat.com> 13489# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 13490# but can we do the << ? For now it's always 512 (0x200) anyway. 134910 string XFSM 13492>0x200 string XFSB XFS filesystem metadump image 13493 13494# Type: delta ISO 13495# From: Daniel Novotny <dnovotny@redhat.com> 134960 string DISO Delta ISO data, 13497>4 belong x version %d 13498 13499# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 13500# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 13501# From: Adam Buchbinder <adam.buchbinder@gmail.com> 135020x8000 string JFS1 13503# Because it's text-only magic, check a binary value (version) to be sure. 13504# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 13505# mountable. 13506>&0 lelong <3 JFS2 filesystem image 13507# Label is followed by a UUID; we have to limit string length to avoid 13508# appending the UUID in the case of a 16-byte label. 13509>>&144 regex [\x20-\x7E]{1,16} (label "%s") 13510>>&0 lequad x \b, %lld blocks 13511>>&8 lelong x \b, blocksize %d 13512>>&32 lelong&0x00000006 >0 (dirty) 13513>>&36 lelong >0 (compressed) 13514 13515# LFS 135160 lelong 0x070162 LFS filesystem image 13517>4 lelong 1 version 1, 13518>>8 lelong x \b blocks %u, 13519>>12 lelong x \b blocks per segment %u, 13520>4 lelong 2 version 2, 13521>>8 lelong x \b fragments %u, 13522>>12 lelong x \b bytes per segment %u, 13523>16 lelong x \b disk blocks %u, 13524>20 lelong x \b block size %u, 13525>24 lelong x \b fragment size %u, 13526>28 lelong x \b fragments per block %u, 13527>32 lelong x \b start for free list %u, 13528>36 lelong x \b number of free blocks %d, 13529>40 lelong x \b number of files %u, 13530>44 lelong x \b blocks available for writing %d, 13531>48 lelong x \b inodes in cache %d, 13532>52 lelong x \b inode file disk address 0x%x, 13533>56 lelong x \b inode file inode number %u, 13534>60 lelong x \b address of last segment written 0x%x, 13535>64 lelong x \b address of next segment to write 0x%x, 13536>68 lelong x \b address of current segment written 0x%x 13537 135380 string td\000 floppy image data (TeleDisk, compressed) 135390 string TD\000 floppy image data (TeleDisk) 13540 135410 string CQ\024 floppy image data (CopyQM, 13542>16 leshort x %d sectors, 13543>18 leshort x %d heads.) 13544 135450 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 13546 135470 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 135480 beshort 0xAA59 floppy image data (IBM SaveDskF) 135490 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 13550 135510 string \074CPM_Disk\076 disk image data (YAZE) 13552 13553# ReFS 13554# Richard W.M. Jones <rjones@redhat.com> 135550 string \0\0\0ReFS\0 ReFS filesystem image 13556 13557# EFW encase image file format: 13558# Gregoire Passault 13559# http://www.forensicswiki.org/wiki/Encase_image_file_format 135600 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 13561 13562# UBIfs 13563# Linux kernel sources: fs/ubifs/ubifs-media.h 135640 lelong 0x06101831 13565>0x16 leshort 0 UBIfs image 13566>0x08 lequad x \b, sequence number %llu 13567>0x10 leshort x \b, length %u 13568>0x04 lelong x \b, CRC 0x%08x 13569 135700 lelong 0x23494255 13571>0x04 leshort <2 13572>0x05 string \0\0\0 13573>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13574>0x04 leshort x UBI image, version %u 13575 13576# NEC PC-88 2D disk image 13577# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 135780x20 ulelong&0xFFFFFEFF 0x2A0 13579>0x10 string \0\0\0\0\0\0\0\0\0\0 13580>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 13581>>>0x1A ubyte&0xEF 0 13582>>>>0x1B ubyte&0x8F 0 13583>>>>>0x1B ubyte&70 <0x40 13584>>>>>>0x1C ulelong >0x21 13585>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 13586>>>>>>>>0x1B ubyte 0 \b, media=2D 13587>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 13588>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 13589>>>>>>>>0x1B ubyte 0x30 \b, media=1D 13590>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 13591>>>>>>>>0x1A ubyte 0x10 \b, write-protected 13592 13593# HDD Raw Copy Tool disk image, file extension: .imgc 13594# From Benjamin Vanheuverzwijn <bvanheu@gmail.com> 135950 pstring HDD\ Raw\ Copy\ Tool %s 13596>0x100 pstring x %s 13597>0x200 pstring x - HD model: %s 13598#>0x300 pstring x unknown %s 13599>0x400 pstring x serial: %s 13600#>0x500 pstring x unknown: %s 13601!:ext imgc 13602 13603# http://martin.hinner.info/fs/bfs/bfs-structure.html 136040 lelong 0x1BADFACE SCO UnixWare BFS filesystem 13605 13606# https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/ 1360732 lelong 0x42465331 BE/OS BFS1 filesystem 13608>36 lelong x \b, byte order %d 13609>40 lelong x \b, block size %d 13610>44 lelong x \b, block shift %d 13611>48 lequad x \b, total blocks %lld 13612>56 lequad x \b, used blocks %lld 13613 13614 136150 name next 13616>0 lelong x \b, size %d 13617>4 string x \b, label %s 13618 13619# https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\ 13620# /IONeXTPartitionScheme.h 136210 string NeXT NeXT version 1 disklabel 13622>12 use next 136230 string dlV1 NeXT version 2 disklabel 13624>12 use next 136250 string dlV2 NeXT version 3 disklabel 13626>12 use next 13627 13628#------------------------------------------------------------------------------ 13629# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $ 13630# fingerprint: file(1) magic for fingerprint data 13631# XPM bitmaps) 13632# 13633 13634# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 13635 136360 string FP1 libfprint fingerprint data V1 13637>3 beshort x \b, driver_id %x 13638>5 belong x \b, devtype %x 13639 136400 string FP2 libfprint fingerprint data V2 13641>3 beshort x \b, driver_id %x 13642>5 belong x \b, devtype %x 13643 13644#------------------------------------------------------------------------------ 13645# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $ 13646# flash: file(1) magic for Macromedia Flash file format 13647# 13648# See 13649# 13650# https://www.macromedia.com/software/flash/open/ 13651# https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 13652# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 13653# 13654 136550 name swf-details 13656 13657>0 string F 13658>>8 byte&0xfd 0x08 Macromedia Flash data 13659!:mime application/x-shockwave-flash 13660>>>3 byte x \b, version %d 13661>>8 byte&0xfe 0x10 Macromedia Flash data 13662!:mime application/x-shockwave-flash 13663>>>3 byte x \b, version %d 13664>>8 byte 0x18 Macromedia Flash data 13665!:mime application/x-shockwave-flash 13666>>>3 byte x \b, version %d 13667>>8 beshort&0xff87 0x2000 Macromedia Flash data 13668!:mime application/x-shockwave-flash 13669>>>3 byte x \b, version %d 13670>>8 beshort&0xffe0 0x3000 Macromedia Flash data 13671!:mime application/x-shockwave-flash 13672>>>3 byte x \b, version %d 13673>>8 byte&0x7 0 13674>>>8 ubyte >0x2f 13675>>>>9 ubyte <0x20 Macromedia Flash data 13676!:mime application/x-shockwave-flash 13677>>>>>3 byte x \b, version %d 13678 13679>0 string C 13680>>8 byte 0x78 Macromedia Flash data (compressed) 13681!:mime application/x-shockwave-flash 13682>>>3 byte x \b, version %d 13683 13684>0 string Z 13685>>8 byte 0x5d Macromedia Flash data (lzma compressed) 13686!:mime application/x-shockwave-flash 13687>>>3 byte x \b, version %d 13688 13689 136901 string WS 13691>4 ulelong >14 13692>>3 ubyte !0 13693>>>0 use swf-details 13694 13695# From: Cal Peake <cp@absolutedigital.net> 136960 string FLV\x01 Macromedia Flash Video 13697!:mime video/x-flv 13698 13699# 13700# Yosu Gomez 137010 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 137020 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 13703# From Dave Wilson 137040 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 13705 13706#------------------------------------------------------------------------------ 13707# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $ 13708# flif: Magic data for file(1) command. 13709# FLIF (Free Lossless Image Format) 13710 137110 string FLIF FLIF 13712>4 string <H image data 13713>>6 beshort x \b, %u 13714>>8 beshort x \bx%u 13715>>5 string 1 \b, 8-bit/color, 13716>>5 string 2 \b, 16-bit/color, 13717>>4 string 1 \b, grayscale, non-interlaced 13718>>4 string 3 \b, RGB, non-interlaced 13719>>4 string 4 \b, RGBA, non-interlaced 13720>>4 string A \b, grayscale 13721>>4 string C \b, RGB, interlaced 13722>>4 string D \b, RGBA, interlaced 13723>4 string >H \b, animation data 13724>>5 ubyte <255 \b, %i frames 13725>>>7 beshort x \b, %u 13726>>>9 beshort x \bx%u 13727>>>6 string =1 \b, 8-bit/color 13728>>>6 string =2 \b, 16-bit/color 13729>>5 ubyte 0xFF 13730>>>6 beshort x \b, %i frames, 13731>>>9 beshort x \b, %u 13732>>>11 beshort x \bx%u 13733>>>8 string =1 \b, 8-bit/color 13734>>>8 string =2 \b, 16-bit/color 13735>>4 string =Q \b, grayscale, non-interlaced 13736>>4 string =S \b, RGB, non-interlaced 13737>>4 string =T \b, RGBA, non-interlaced 13738>>4 string =a \b, grayscale 13739>>4 string =c \b, RGB, interlaced 13740>>4 string =d \b, RGBA, interlaced 13741 13742#------------------------------------------------------------------------------ 13743# $File: fonts,v 1.45 2021/01/03 21:00:11 christos Exp $ 13744# fonts: file(1) magic for font data 13745# 137460 search/1 FONT ASCII vfont text 137470 short 0436 Berkeley vfont data 137480 short 017001 byte-swapped Berkeley vfont data 13749 13750# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 137510 string %!PS-AdobeFont-1. PostScript Type 1 font text 13752>20 string >\0 (%s) 137536 string %!PS-AdobeFont-1. PostScript Type 1 font program data 13754>26 string >\0 (%s) 137550 string %!FontType1 PostScript Type 1 font program data 137566 string %!FontType1 PostScript Type 1 font program data 137570 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 13758 13759# Summary: PostScript Type 1 Printer Font Metrics 13760# URL: https://en.wikipedia.org/wiki/PostScript_fonts 13761# Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf 13762# Modified by: Joerg Jenderek 13763# Note: moved from ./msdos magic 13764# dfVersion 256=0100h 137650 uleshort 0x0100 13766# GRR: line above is too general as it catches also TrueType font, 13767# raw G3 data FAX, WhatsApp encrypted and Panorama database 13768# dfType 129=0081h 13769>66 uleshort 0x0081 13770# dfVertRes 300=012Ch not needed as additional test 13771#>>70 uleshort 0x012c 13772# dfHorizRes 300=012Ch 13773#>>>72 uleshort 0x012c 13774# dfDriverInfo points to postscript information section 13775>>(101.l) string/c Postscript Printer Font Metrics 13776# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID 13777!:mime application/x-font-pfm 13778# AppleShare Print Server 13779#!:apple ASPS???? 13780!:ext pfm 13781# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking 13782#>>>6 string >\060 - %-.60s 13783# dfDriverInfo 13784>>>139 ulelong >0 13785# often abbreviated and same as filename 13786>>>>(139.l) string x %s 13787# dfSize 13788>>>2 ulelong x \b, %d bytes 13789# dfFace 210=D2h 9Eh 13790>>>105 ulelong >0 13791# Windows font name 13792>>>>(105.l) string x \b, %s 13793# dfItalic 13794>>>80 ubyte 1 italic 13795# dfUnderline 13796>>>81 ubyte 1 underline 13797# dfStrikeOut 13798>>>82 ubyte 1 strikeout 13799# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc 13800>>>83 uleshort >699 bold 13801# dfPitchAndFamily 16 17 48 49 64 65 13802>>>90 ubyte 16 serif 13803>>>90 ubyte 17 serif proportional 13804#>>>90 ubyte 48 other 13805>>>90 ubyte 49 proportional 13806>>>90 ubyte 64 script 13807>>>90 ubyte 65 script proportional 13808 13809# X11 font files in SNF (Server Natural Format) format 13810# updated by Joerg Jenderek at Feb 2013 13811# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 138120 belong 00000004 X11 SNF font data, MSB first 13813#>104 belong 00000004 X11 SNF font data, MSB first 13814!:mime application/x-font-sfn 13815# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 138160 lelong 00000004 13817>104 lelong 00000004 X11 SNF font data, LSB first 13818!:mime application/x-font-sfn 13819 13820# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 138210 search/1 STARTFONT\ X11 BDF font text 13822 13823# From: Joerg Jenderek 13824# URL: https://grub.gibibit.com/New_font_format 13825# Reference: util/grub-mkfont.c 13826# include/grub/fontformat.h 13827# FONT_FORMAT_SECTION_NAMES_FILE 138280 string FILE 13829# FONT_FORMAT_PFF2_MAGIC 13830>8 string PFF2 13831# leng 4 only at the moment 13832>>4 ubelong 4 13833# FONT_FORMAT_SECTION_NAMES_FONT_NAME 13834>>>12 string NAME GRUB2 font 13835!:mime application/x-font-pf2 13836!:ext pf2 13837# length of font_name 13838>>>>16 ubelong >0 13839# font_name 13840>>>>>20 string >\0 "%-s" 13841 13842# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 13843# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 138440 string \001fcp X11 Portable Compiled Font data, 13845>12 lelong ^0x08 bit: LSB, 13846>12 lelong &0x08 bit: MSB, 13847>12 lelong ^0x04 byte: LSB first 13848>12 lelong &0x04 byte: MSB first 138490 string D1.0\015 X11 Speedo font data 13850 13851#------------------------------------------------------------------------------ 13852# FIGlet fonts and controlfiles 13853# From figmagic supplied with Figlet version 2.2 13854# "David E. O'Brien" <obrien@FreeBSD.ORG> 138550 string flf FIGlet font 13856>3 string >2a version %-2.2s 138570 string flc FIGlet controlfile 13858>3 string >2a version %-2.2s 13859 13860# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 13861# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 138620 belong 0x14025919 libGrx font data, 13863>8 leshort x %dx 13864>10 leshort x \b%d 13865>40 string x %s 13866# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 13867# Update: Joerg Jenderek 13868# URL: http://fileformats.archiveteam.org/wiki/CPI 13869# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html 138700 belong 0xff464f4e DOS code page font data collection 13871!:mime font/x-dos-cpi 13872!:ext cpi 138730 string \x7fDRFONT DR-DOS code page font data collection 13874!:mime font/x-drdos-cpi 13875!:ext cpi 138767 belong 0x00454741 DOS code page font data 138777 belong 0x00564944 DOS code page font data (from Linux?) 138784098 string DOSFONT DOSFONT2 encrypted font data 13879 13880# From: Joerg Jenderek 13881# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font 13882# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt 13883# 13884# usual case with lightening mask and skewing mask 5555h~UU 13885#62 ulelong 0x55555555 13886# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72 13887#>2 uleshort <73 13888#>>0 use gdos-font 13889# BOX18.GFT COWBOY30.GFT ROYALK30.GFT 13890#62 ulelong 0 13891# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size 13892#>2 uleshort >2 13893# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72 13894#>>2 uleshort <73 13895# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE 13896#>>>4 ulelong >0x001F1f1F 13897# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data 13898#>>>>76 ulelong >83 13899#>>>>>0 use gdos-font 139000 name gdos-font 13901>0 uleshort x GEM GDOS font 13902!:mime application/x-font-gdos 13903# also .eps found like AA070GEP.EPS AI360GEP.EPS 13904!:ext fnt/gtf 13905# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE 13906>4 string x %.32s 13907# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT 13908>2 uleshort x %u 13909# face ID (must be unique) 13910>0 uleshort x \b, ID 0x%4.4x 13911# lowest character index in face (4 but usually 32 for disk-loaded fonts) 13912#>36 uleshort !32 \b, unusual character index %u 13913# width of the widest character like 0 8 10 12 16 24 32 13914#>50 uleshort x \b, %u char width 13915# width of the widest character cell like 8 11 12 14 15 16 33 67 13916#>52 uleshort x \b, %u cell width 13917# thickening size in pixel like 0 1 2 3 4 5 6 7 8 13918#>58 uleshort x \b, %u thick 13919# lightening mask to eliminate pixels, usually 5555h 13920>62 uleshort !0x5555 \b, lightening mask 0x%x 13921# skewing mask to determine when to perform additional rotation when skewing, usually 5555h 13922>64 uleshort !0x5555 \b, skewing mask 0x%x 13923# offset to optional horizontal offset table 0 58h~88 5eh 252h 13924#>68 ulelong x \b, 0x%x horizontal table offset 13925# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h 13926#>72 ulelong x \b, 0x%x coffset 13927# offset to font data like 116h 118h 158 20Ah 20Eh 13928>76 ulelong x \b, 0x%x foffset 13929# form width in bytes like 58 67 156 190 227 317 345 13930#>80 uleshort x \b, %u fwidth 13931# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150 13932#>82 uleshort x \b, %u fheight 13933# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h 13934#>84 ulelong x \b, 0x%x noffset 13935 13936# downloadable fonts for browser (prints type) anthon@mnt.org 13937# https://tools.ietf.org/html/rfc3073 139380 string PFR1 Portable Font Resource font data (new) 13939>102 string >0 \b: %s 139400 string PFR0 Portable Font Resource font data (old) 13941>4 beshort >0 version %d 13942 13943# True Type fonts 13944# Modified by: Joerg Jenderek 13945# URL: https://en.wikipedia.org/wiki/TrueType 13946# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/ 13947# 13948# sfnt version "typ1" used by some Apple, but no example found 139490 string typ1 13950>0 use sfnt-font 13951>0 use sfnt-names 13952# sfnt version "true" used by some Apple 139530 string true 13954>0 use sfnt-font 13955>0 use sfnt-names 13956# GRR: below test is too general 13957# sfnt version often 0x00010000 139580 string \000\001\000\000 13959>0 use sfnt-font 13960>0 use sfnt-names 13961# validate and display sfnt font data like number of tables 139620 name sfnt-font 13963# file 5.30 version assumes 00FFh as maximal number of tables 13964#>4 ubeshort <0x0100 13965# maximal 27 tables found like in Skia.ttf 13966# 46 different table names mentioned on Apple specification 13967# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number 13968>4 ubeshort <47 13969# skip bad examples with garbage table names like in a5.show HYPERC MAC 13970# tag names consist of up to four characters padded with spaces at end like 13971# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ... 13972>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] 13973#>>>0 ubelong x \b, sfnt version 0x%x 13974>>>0 ubelong !0x4f54544f TrueType 13975!:mime font/sfnt 13976!:apple ????tfil 13977# .ttf for TrueType font 13978# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe 13979!:ext ttf/tte 13980# sfnt version 4F54544Fh~OTTO 13981>>>0 ubelong =0x4f54544f OpenType 13982!:mime font/otf 13983!:apple ????OTTO 13984!:ext otf 13985>>>0 ubelong x Font data 13986# DSIG=44454947h table name implies a digitally signed font 13987# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432 13988>>>12 search/432 DSIG \b, digitally signed 13989>>>4 ubeshort x \b, %d tables 13990# minimal 9 tables found like in NISC18030.ttf 13991#>>>4 ubeshort <10 TMIN 13992#>>>4 ubeshort >24 TBIG 13993# table directory entries 13994>>>12 string x \b, 1st "%4.4s" 13995 13996# search and display 1st name in sfnt font which is often copyright text 13997# does not work inside font collections 139980 name sfnt-names 13999# search for naming table 14000>12 search/432/s name 14001# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf 14002#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET 14003>>&8 ubelong >0x00100000 14004# offset of name table 14005>>>&-4 ubelong x \b, name offset 0x%x 14006# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h 14007>>&8 ubelong <0x00100000 14008>>>&-16 ubelong x 14009# name table 14010>>>>(&8.L) ubequad x 14011# invalid format selector 14012#>>>>>&-8 ubeshort !0 \b, invalid selector %x 14013# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf 14014# maximal 1227 name records found like in Apple Chancery.ttf 14015#>>>>>&-6 ubeshort <0x4 mincount 14016#>>>>>&-6 ubeshort >130 maxcount 14017>>>>>&-6 ubeshort x \b, %d names 14018# offset to start of string storage from start of table 14019#>>>>>&-4 ubeshort x \b, record offset %d 14020# 1st name record 14021# string offset from start of storage area 14022#>>>>>&8 ubeshort x \b, string offset %d 14023# string length 14024#>>>>>&6 ubeshort x \b, string length %d 14025# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf 14026# also found 0 like in SWZCONLN.TTF 14027#>>>>>&6 ubeshort <8 MIN STRING 14028# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf 14029#>>>>>&6 ubeshort >805 MAX STRING 14030# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft 14031#>>>>>&-2 ubeshort >3 BAD PLATFORM 14032>>>>>&-2 ubeshort 0 \b, Unicode 14033>>>>>&-2 ubeshort 1 \b, Macintosh 14034>>>>>&-2 ubeshort 3 \b, Microsoft 14035# languageID (0~english Macintosh, 0409h~english Microsoft, ...) 14036>>>>>&2 ubeshort >0 \b, language 0x%x 14037# name identifiers 14038# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ... 14039>>>>>&4 ubeshort >0 \b, type %d string 14040# platform specific encoding: 14041# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0 14042#>>>>>&0 ubeshort x \b, %d encoding 14043>>>>>&0 ubeshort 0 14044# handle only name string offset 0 because do not know how to add 2 relative offsets 14045>>>>>>&6 ubeshort 0 14046>>>>>>>&(&-14.S-18) ubyte !0 14047# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h 14048# often copyright string that starts like \251 2006 The Monotype Corporation 14049>>>>>>>>&-1 string x \b, %-11.96s 14050# test for unicode string 14051>>>>>>>&(&-14.S-18) ubyte 0 14052>>>>>>>>&0 lestring16 x \b, %-11.96s 14053# unicode encoding 14054>>>>>&0 ubeshort >0 14055>>>>>>&6 ubeshort 0 14056>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s 14057 140580 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 140590 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 14060 14061# TrueType/OpenType font collections (.ttc) 14062# URL: https://en.wikipedia.org/wiki/OpenType 14063# https://www.microsoft.com/typography/otspec/otff.htm 14064# Modified by: Joerg Jenderek 14065# Note: container for TrueType, OpenType font 140660 string ttcf 14067# skip ASCII text 14068>4 ubyte 0 14069# sfnt version often 0x00010000 of 1st table is TrueType 14070>>(12.L) ubelong !0x4f54544f TrueType 14071!:mime font/ttf 14072!:apple ????tfil 14073!:ext ttc 14074# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 14075>>(12.L) ubelong =0x4f54544f OpenType 14076!:mime font/otf 14077!:apple ????OTTO 14078# no example found for otc 14079!:ext ttc/otc 14080>>4 ubyte x font collection data 14081#!:mime font/collection 14082# TCC version 14083>>4 belong 0x00010000 \b, 1.0 14084>>4 belong 0x00020000 \b, 2.0 14085>>8 ubelong >0 \b, %d fonts 14086# array offset size = fonts * offsetsize = fonts * 4 14087>>(8.L*4) ubequad x 14088# 0x44454947 = 'DSIG' 14089>>>&4 belong 0x44534947 \b, digitally signed 14090# offset to 1st font 14091>>12 ubelong x \b, at 0x%x 14092# point to 1st font that starts with sfnt version 14093>>(12.L) use sfnt-font 14094 14095# Opentype font data from Avi Bercovich 140960 string OTTO OpenType font data 14097!:mime application/vnd.ms-opentype 14098 14099# From: Alex Myczko <alex@aiei.ch> 141000 string SplineFontDB: Spline Font Database 14101!:mime application/vnd.font-fontforge-sfd 14102>14 string x version %s 14103 14104# EOT 141050x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 14106>0x22 string LP Embedded OpenType (EOT) 14107# workaround until there's lepstring16 14108# >>0x52 lepstring16/h >\0 \b, %s family 14109>>0x52 short !0 14110>>>0x54 lestring16 x \b, %s family 14111!:mime application/vnd.ms-fontobject 14112 14113# Web Open Font Format (.woff) 141140 name woff 14115>4 belong 0x00010000 \b, TrueType 14116>4 belong 0x4F54544F \b, CFF 14117>4 belong 0x74727565 \b, TrueType 14118>4 default x 14119>>4 belong x \b, flavor %d 14120>8 belong x \b, length %d 14121#>12 beshort x \b, numTables %d 14122#>14 beshort x \b, reserved %d 14123#>16 belong x \b, totalSfntSize %d 14124 14125# https://www.w3.org/TR/WOFF/ 141260 string wOFF Web Open Font Format 14127!:mime font/woff 14128>0 use woff 14129>20 beshort x \b, version %d 14130>22 beshort x \b.%d 14131# https://www.w3.org/TR/WOFF2/ 141320 string wOF2 Web Open Font Format (Version 2) 14133!:mime font/woff2 14134>0 use woff 14135#>20 belong x \b, totalCompressedSize %d 14136>24 beshort x \b, version %d 14137>26 beshort x \b.%d 14138 14139#------------------------------------------------------------------------------ 14140# $File: forth,v 1.3 2020/12/12 20:01:47 christos Exp $ 14141# forth: file(1) magic for various Forth environments 14142# From: Lubomir Rintel <lkundrak@v3.sk> 14143# 14144 14145# Has a FORTH stack diagram and something that looks very much like a FORTH 14146# multi-line word definition. Probably a FORTH source. 141470 regex \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\) 14148>0 regex \^:\[[:space:]] 14149>>0 regex \^;$ FORTH program 14150!:mime text/x-forth 14151 14152# Inline word definition complete with a stack diagram 141530 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program 14154!:mime text/x-forth 14155 14156# Various dictionary images used by OpenFirware FORTH environment 14157 141580 lelong 0xe1a00000 14159>8 lelong 0xe1a00000 14160# skip raspberry pi kernel image kernel7.img by checking for positive text length 14161>>24 lelong >0 ARM OpenFirmware FORTH Dictionary, 14162>>>24 lelong x Text length: %d bytes, 14163>>>28 lelong x Data length: %d bytes, 14164>>>32 lelong x Text Relocation Table length: %d bytes, 14165>>>36 lelong x Data Relocation Table length: %d bytes, 14166>>>40 lelong x Entry Point: 0x%08X, 14167>>>44 lelong x BSS length: %d bytes 14168 141690 string MP 14170>28 lelong 1 x86 OpenFirmware FORTH Dictionary, 14171>>4 leshort x %d blocks 14172>>2 leshort x + %d bytes, 14173>>6 leshort x %d relocations, 14174>>8 leshort x Header length: %d paragraphs, 14175>>10 leshort x Data Size: %d 14176>>12 leshort x - %d 4K pages, 14177>>14 lelong x Initial Stack Pointer: 0x%08X, 14178>>20 lelong x Entry Point: 0x%08X, 14179>>24 lelong x First Relocation Item: %d, 14180>>26 lelong x Overlay Number: %d, 14181>>18 leshort x Checksum: 0x%08X 14182 141830 belong 0x48000020 PowerPC OpenFirmware FORTH Dictionary, 14184>4 belong x Text length: %d bytes, 14185>8 belong x Data length: %d bytes, 14186>12 belong x BSS length: %d bytes, 14187>16 belong x Symbol Table length: %d bytes, 14188>20 belong x Entry Point: 0x%08X, 14189>24 belong x Text Relocation Table length: %d bytes, 14190>28 belong x Data Relocation Table length: %d bytes 14191 141920 lelong 0x10000007 MIPS OpenFirmware FORTH Dictionary, 14193>4 lelong x Text length: %d bytes, 14194>8 lelong x Data length: %d bytes, 14195>12 lelong x BSS length: %d bytes, 14196>16 lelong x Symbol Table length: %d bytes, 14197>20 lelong x Entry Point: 0x%08X, 14198>24 lelong x Text Relocation Table length: %d bytes, 14199>28 lelong x Data Relocation Table length: %d bytes 14200 14201# Dictionary images used by minimal C FORTH environments, any platform, 14202# using native byte order. 14203 14204# Weak. 14205#0 short 0x5820 cForth 16-bit Dictionary, 14206#>2 short x Serial: 0x%08X, 14207#>4 short x Dictionary Start: 0x%08X, 14208#>6 short x Dictionary Size: %d bytes, 14209#>8 short x User Area Start: 0x%08X, 14210#>10 short x User Area Size: %d bytes, 14211#>12 short x Entry Point: 0x%08X 14212 142130 long 0x581120 cForth 32-bit Dictionary, 14214>4 long x Serial: 0x%08X, 14215>8 long x Dictionary Start: 0x%08X, 14216>12 long x Dictionary Size: %d bytes, 14217>16 long x User Area Start: 0x%08X, 14218>20 long x User Area Size: %d bytes, 14219>24 long x Entry Point: 0x%08X 14220 14221#------------------------------------------------------------------------------ 14222# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $ 14223# FORTRAN source 14224# Check that the first 100 lines start with C or whitespace first. 142250 regex/100l !\^[^Cc\ \t].*$ 14226>0 regex/100l \^[Cc][\ \t] FORTRAN program text 14227!:mime text/x-fortran 14228!:strength - 5 14229 14230#------------------------------------------------------------------------------ 14231# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $ 14232# frame: file(1) magic for FrameMaker files 14233# 14234# This stuff came on a FrameMaker demo tape, most of which is 14235# copyright, but this file is "published" as witness the following: 14236# 14237# Note that this is the Framemaker Maker Interchange Format, not the 14238# Normal format which would be application/vnd.framemaker. 14239# 142400 string \<MakerFile FrameMaker document 14241!:mime application/x-mif 14242>11 string 5.5 (5.5 14243>11 string 5.0 (5.0 14244>11 string 4.0 (4.0 14245>11 string 3.0 (3.0 14246>11 string 2.0 (2.0 14247>11 string 1.0 (1.0 14248>14 byte x %c) 14249# URL: http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format 14250# Reference: https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf 14251# Update: Joerg Jenderek 2019 Nov 142520 string \<MIFFile FrameMaker MIF (ASCII) file 14253# https://www.iana.org/assignments/media-types/application/vnd.mif 14254!:mime application/vnd.mif 14255# mif most but also find bookTOC.framemif 14256!:ext mif/framemif 14257# followed by space~20h 14258#>8 ubyte 0x20 \b, space before version 14259# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ... 14260>9 string x (%.3s 14261# if not greater sign then display 4th character of version 14262>12 ubyte =0x3e \b) 14263>12 ubyte !0x3e \b%c) 14264# comment starting with # shows the name+version number of generating program 14265>13 search/3 # 14266>>&0 string x "%s" 142670 search/1 \<MakerDictionary FrameMaker Dictionary text 14268!:mime application/x-mif 14269>17 string 3.0 (3.0) 14270>17 string 2.0 (2.0) 14271>17 string 1.0 (1.x) 142720 string \<MakerScreenFont FrameMaker Font file 14273!:mime application/x-mif 14274>17 string 1.01 (%s) 142750 string \<MML FrameMaker MML file 14276!:mime application/x-mif 142770 string \<BookFile FrameMaker Book file 14278!:mime application/x-mif 14279>10 string 3.0 (3.0 14280>10 string 2.0 (2.0 14281>10 string 1.0 (1.0 14282>13 byte x %c) 14283# XXX - this book entry should be verified, if you find one, uncomment this 14284#0 string \<Book\040 FrameMaker Book (ASCII) file 14285#!:mime application/x-mif 14286#>6 string 3.0 (3.0) 14287#>6 string 2.0 (2.0) 14288#>6 string 1.0 (1.0) 142890 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file 14290!:mime application/x-mif 14291 14292#------------------------------------------------------------------------------ 14293# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 14294# freebsd: file(1) magic for FreeBSD objects 14295# 14296# All new-style FreeBSD magic numbers are in host byte order (i.e., 14297# little-endian on x86). 14298# 14299# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 14300# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 14301# schemes for distinguishing between executable images, shared libraries, 14302# and object files. 14303# 14304# FreeBSD says: 14305# 14306# Regardless of whether it's pure, demand-paged, or none of the 14307# above: 14308# 14309# if the entry point is < 4096, then it's a shared library if 14310# the "has run-time loader information" bit is set, and is 14311# position-independent if the "is position-independent" bit 14312# is set; 14313# 14314# if the entry point is >= 4096 (or >4095, same thing), then it's 14315# an executable, and is dynamically-linked if the "has run-time 14316# loader information" bit is set. 14317# 14318# On x86, NetBSD says: 14319# 14320# If it's neither pure nor demand-paged: 14321# 14322# if it has the "has run-time loader information" bit set, it's 14323# a dynamically-linked executable; 14324# 14325# if it doesn't have that bit set, then: 14326# 14327# if it has the "is position-independent" bit set, it's 14328# position-independent; 14329# 14330# if the entry point is non-zero, it's an executable, otherwise 14331# it's an object file. 14332# 14333# If it's pure: 14334# 14335# if it has the "has run-time loader information" bit set, it's 14336# a dynamically-linked executable, otherwise it's just an 14337# executable. 14338# 14339# If it's demand-paged: 14340# 14341# if it has the "has run-time loader information" bit set, 14342# then: 14343# 14344# if the entry point is < 4096, it's a shared library; 14345# 14346# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 14347# it's a dynamically-linked executable); 14348# 14349# if it doesn't have the "has run-time loader information" bit 14350# set, then it's just an executable. 14351# 14352# (On non-x86, NetBSD does much the same thing, except that it uses 14353# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 14354# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 14355# had 8K pages; dunno about MIPS.) 14356# 14357# I suspect the two will differ only in perverse and uninteresting cases 14358# ("shared" libraries that aren't demand-paged and whose pages probably 14359# won't actually be shared, executables with entry points <4096). 14360# 14361# I leave it to those more familiar with FreeBSD and NetBSD to figure out 14362# what the right answer is (although using ">4095", FreeBSD-style, is 14363# probably better than separately checking for "=4096" and ">4096", 14364# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 14365# executables using the NetBSD technique.) 14366# 143670 lelong&0377777777 041400407 FreeBSD/i386 14368>20 lelong <4096 14369>>3 byte&0xC0 &0x80 shared library 14370>>3 byte&0xC0 0x40 PIC object 14371>>3 byte&0xC0 0x00 object 14372>20 lelong >4095 14373>>3 byte&0x80 0x80 dynamically linked executable 14374>>3 byte&0x80 0x00 executable 14375>16 lelong >0 not stripped 14376 143770 lelong&0377777777 041400410 FreeBSD/i386 pure 14378>20 lelong <4096 14379>>3 byte&0xC0 &0x80 shared library 14380>>3 byte&0xC0 0x40 PIC object 14381>>3 byte&0xC0 0x00 object 14382>20 lelong >4095 14383>>3 byte&0x80 0x80 dynamically linked executable 14384>>3 byte&0x80 0x00 executable 14385>16 lelong >0 not stripped 14386 143870 lelong&0377777777 041400413 FreeBSD/i386 demand paged 14388>20 lelong <4096 14389>>3 byte&0xC0 &0x80 shared library 14390>>3 byte&0xC0 0x40 PIC object 14391>>3 byte&0xC0 0x00 object 14392>20 lelong >4095 14393>>3 byte&0x80 0x80 dynamically linked executable 14394>>3 byte&0x80 0x00 executable 14395>16 lelong >0 not stripped 14396 143970 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 14398>20 lelong <4096 14399>>3 byte&0xC0 &0x80 shared library 14400>>3 byte&0xC0 0x40 PIC object 14401>>3 byte&0xC0 0x00 object 14402>20 lelong >4095 14403>>3 byte&0x80 0x80 dynamically linked executable 14404>>3 byte&0x80 0x00 executable 14405>16 lelong >0 not stripped 14406 14407# XXX gross hack to identify core files 14408# cores start with a struct tss; we take advantage of the following: 14409# byte 7: highest byte of the kernel stack pointer, always 0xfe 14410# 8/9: kernel (ring 0) ss value, always 0x0010 14411# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 14412# 28: low order byte of the current PTD entry, always 0 since the 14413# PTD is page-aligned 14414# 144157 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 14416>1039 string >\0 from '%s' 14417 14418# /var/run/ld.so.hints 14419# What are you laughing about? 144200 lelong 011421044151 ld.so hints file (Little Endian 14421>4 lelong >0 \b, version %d) 14422>4 belong <1 \b) 144230 belong 011421044151 ld.so hints file (Big Endian 14424>4 belong >0 \b, version %d) 14425>4 belong <1 \b) 14426 14427# 14428# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 14429# 144300 string SCRSHOT_ scrshot(1) screenshot, 14431>8 byte x version %d, 14432>9 byte 2 %d bytes in header, 14433>>10 byte x %d chars wide by 14434>>11 byte x %d chars high 14435 14436#------------------------------------------------------------------------------ 14437# $File: fsav,v 1.21 2021/02/23 00:51:10 christos Exp $ 14438# fsav: file(1) magic for datafellows fsav virus definition files 14439# Anthon van der Neut (anthon@mnt.org) 14440 14441# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 144420 beshort 0x1575 fsav macro virus signatures 14443>8 leshort >0 (%d- 14444>11 byte >0 \b%02d- 14445>10 byte >0 \b%02d) 14446# ftp://ftp.f-prot.com/pub/sign.zip 14447#10 ubyte <12 14448#>9 ubyte <32 14449#>>8 ubyte 0x0a 14450#>>>12 ubyte 0x07 14451#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 14452#>>>>10 byte 0 \b01- 14453#>>>>10 byte 1 \b02- 14454#>>>>10 byte 2 \b03- 14455#>>>>10 byte 3 \b04- 14456#>>>>10 byte 4 \b05- 14457#>>>>10 byte 5 \b06- 14458#>>>>10 byte 6 \b07- 14459#>>>>10 byte 7 \b08- 14460#>>>>10 byte 8 \b09- 14461#>>>>10 byte 9 \b10- 14462#>>>>10 byte 10 \b11- 14463#>>>>10 byte 11 \b12- 14464#>>>>9 ubyte >0 \b%02d) 14465# ftp://ftp.f-prot.com/pub/sign2.zip 14466#0 ubyte 0x62 14467#>1 ubyte 0xF5 14468#>>2 ubyte 0x1 14469#>>>3 ubyte 0x1 14470#>>>>4 ubyte 0x0e 14471#>>>>>13 ubyte >0 fsav virus signatures 14472#>>>>>>11 ubyte x size 0x%02x 14473#>>>>>>12 ubyte x \b%02x 14474#>>>>>>13 ubyte x \b%02x bytes 14475 14476# Joerg Jenderek: joerg dot jenderek at web dot de 14477# clamav-0.100.2\docs\html\node60.html 14478# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf 14479# ClamAV virus database files start with a 512 bytes colon separated header 14480# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 14481# + gzipped (optional) tarball files 14482# output can often be verified by `sigtool --info=FILE` 144830 string ClamAV-VDB: Clam AntiVirus 14484# padding spaces implies database 14485>511 ubyte =0x20 database 14486!:mime application/x-clamav-database 14487# empty build time 14488>>10 string =:: (unsigned) 14489# sigtool(1) man page 14490!:ext cud 14491# display some text to avoid error like: 14492# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type 14493# file: could not find any valid magic files! (No error) 14494>>10 default x (with buildtime) 14495#>>10 default x 14496# clamtmp is used for temporarily database like update process 14497# for pure tar database only cld extension found 14498!:ext cld/cvd/clamtmp/cud 14499>511 default x file 14500!:mime application/x-clamav 14501!:ext info 14502>11 string >\0 14503# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE` 14504>>11 regex \^[^:]{0,23} \b, %s 14505# version like 25170 14506>>>&1 regex \^[^:]{1,6} \b, version %s 14507# signaturesNumbers like 4566249 14508>>>>&1 regex \^[^:]{1,10} \b, %s signatures 14509# functionalityLevelRequired like 60 14510>>>>>&1 regex \^[^:]{1,4} \b, level %s 14511# X for nothing or MD5 14512#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s" 14513>>>>>>&1 regex \^[^:]{1,32} 14514# X for nothing or digital signature starting like AIzk/LYbX 14515#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s" 14516>>>>>>>&1 regex \^[^:]{1,255} 14517# builder like neo 14518>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s 14519# buildTime like 1506611558 14520#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s 14521>>>>>>>>>&1 regex \^[^:]{1,10} 14522# padding with spaces 14523#>>>>>>>>>>&1 ubequad x \b, padding 0x%16.16llx 14524>510 ubyte =0x20 14525# inspect real database content 14526#>>512 ubeshort x \b, database MAGIC 0x%x 14527# ./archive handle pure tar archives 14528>>1012 quad =0 \b, with 14529>>>512 use tar-file 14530# not pure tar 14531>>1012 quad !0 14532# one space at the end of text and then handles gzipped archives by ./compress 14533>>>512 string \037\213 \b, with 14534>>>>512 indirect x 14535 14536# Type: Grisoft AVG AntiVirus 14537# From: David Newgas <david@newgas.net> 145380 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 14539 145400 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 14541>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 14542 14543# From: Joerg Jenderek 14544# URL: https://www.avira.com/ 14545# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows) 14546# tested with version 15.0.43.23 at November 2019 145470 string AntiVir\ Qua Avira AntiVir quarantined 14548!:mime application/x-avira-qua 14549#!:mime application/octet-stream 14550!:ext qua 14551>156 string SUSPICIOUS_FILE 14552# file path of suspicious file 14553>>220 lestring16 x %s 14554>156 string !SUSPICIOUS_FILE 14555# file path of virus file 14556>>228 lestring16 x %s 14557# quarantined date 14558>60 ldate x at %s 14559# virus/danger name 14560>156 string !SUSPICIOUS_FILE 14561>>156 string x \b, category "%s" 14562 14563 14564#------------------------------------------------------------------------------ 14565# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 14566# fusecompress: file(1) magic for fusecompress 145670 string \037\135\211 FuseCompress(ed) data 14568>3 byte 0x00 (none format) 14569>3 byte 0x01 (bz2 format) 14570>3 byte 0x02 (gz format) 14571>3 byte 0x03 (lzo format) 14572>3 byte 0x04 (xor format) 14573>3 byte >0x04 (unknown format) 14574>4 long x uncompressed size: %d 14575 14576#------------------------------------------------------------------------------ 14577# $File: games,v 1.22 2021/02/23 00:51:10 christos Exp $ 14578# games: file(1) for games 14579 14580# Fabio Bonelli <fabiobonelli@libero.it> 14581# Quake II - III data files 145820 string IDP2 Quake II 3D Model file, 14583>20 long x %u skin(s), 14584>8 long x (%u x 14585>12 long x %u), 14586>40 long x %u frame(s), 14587>16 long x Frame size %u bytes, 14588>24 long x %u vertices/frame, 14589>28 long x %u texture coordinates, 14590>32 long x %u triangles/frame 14591 145920 string IBSP Quake 14593>4 long 0x26 II Map file (BSP) 14594>4 long 0x2E III Map file (BSP) 14595 145960 string IDS2 Quake II SP2 sprite file 14597 14598#--------------------------------------------------------------------------- 14599# Doom and Quake 14600# submitted by Nicolas Patrois 14601 146020 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 14603# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 14604 1460524 string LxD\ 203 Linuxdoom save 14606>0 string x , name=%s 14607>44 string x , world=%s 14608 14609# Quake 14610 14611# Update: Joerg Jenderek 14612# URL: http://fileformats.archiveteam.org/wiki/PAK 14613# reference: https://quakewiki.org/wiki/.pak 14614# GRR: line below is too general as it matches also Acorn PackDir compressed Archive 14615# and Git pack ./revision 146160 string PACK 14617# real Quake examples like pak0.pak have only some hundreds like 150 files 14618# So test for few files 14619>8 ulelong <0x01000000 14620# in file version 5.32 test for null terminator is only true for 14621# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 14622# look for null terminator of 1st entry name 14623>>(4.l+55) ubyte 0 Quake I or II world or extension 14624!:mime application/x-dzip 14625!:ext pak 14626#>>>8 ulelong x \b, table size %u 14627# dividing this by entry size (64) gives number of files 14628>>>8 ulelong/64 x \b, %u files 14629# offset to the beginning of the file table 14630>>>4 ulelong x \b, offset 0x%x 14631# 1st file entry 14632>>>(4.l) use pak-entry 14633# 2nd file entry 14634#>>>4 ulelong+64 x \b, offset 0x%x 14635#>>>(4.l+64) use pak-entry 14636# 14637# display file table entry of Quake PAK archive 146380 name pak-entry 14639# normally entry start after header which implies offset 12 or higher 14640>56 ulelong >11 14641# the offset from the beginning of pak to beginning of this entry file contents 14642>>56 ulelong x at 0x%x 14643# the size of file for this entry 14644>>60 ulelong x %u bytes 14645# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp 14646>>0 string x '%-.56s' 14647# inspect entry content by jumping to entry offset 14648>>(56) indirect x \b: 14649 14650#0 string -1\x0a Quake I demo 14651#>30 string x version %.4s 14652#>61 string x level %s 14653 14654#0 string 5\x0a Quake I save 14655 14656# The levels 14657 14658# Quake 1 14659 146600 string 5\x0aIntroduction Quake I save: start Introduction 146610 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 146620 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 146630 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 146640 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 146650 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 146660 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 146670 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 146680 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 146690 string 5\x0athe_Installation Quake I save: e2m1 The installation 146700 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 146710 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 146720 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 146730 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 146740 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 146750 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 146760 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 146770 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 146780 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 146790 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 146800 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 146810 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 146820 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 146830 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 146840 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 146850 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 146860 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 146870 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 146880 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 146890 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 146900 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 146910 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 14692 14693# Quake DeathMatch levels 14694 146950 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 146960 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 146970 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 146980 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 146990 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 147000 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 14701 14702# Scourge of Armagon 14703 147040 string 5\x0aCommand_HQ Quake I save: start Command HQ 147050 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 147060 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 147070 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 147080 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 147090 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 147100 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 147110 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 147120 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 147130 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 147140 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 147150 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 147160 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 147170 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 147180 string 5\x0aLimbo Quake I save: hip3m3 Limbo 147190 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 147200 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 147210 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 14722 14723# Malice 14724 147250 string 5\x0aThe_Academy Quake I save: start The academy 147260 string 5\x0aThe_Lab Quake I save: d1 The lab 147270 string 5\x0aArea_33 Quake I save: d1b Area 33 147280 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 147290 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 147300 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 147310 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 147320 string 5\x0aArea44 Quake I save: d1c Area 44 147330 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 147340 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 147350 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 147360 string 5\x0aThe_Flood Quake I save: d5 The flood 147370 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 147380 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 147390 string 5\x0aThe_Foundry Quake I save: d7b The foundry 147400 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 147410 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 147420 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 147430 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 147440 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 147450 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 14746 14747# Malice DeathMatch levels 14748 147490 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 147500 string 5\x0aSub_Station Quake I save: ddm2 Sub station 147510 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 147520 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 147530 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 147540 string 5\x0aDOMINO Quake I save: ddm6 Domino 147550 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 14756 14757 147580 string MComprHD MAME CHD compressed hard disk image, 14759>12 belong x version %u 14760 14761# doom - submitted by Jon Dowland 14762 147630 string =IWAD doom main IWAD data 14764>4 lelong x containing %d lumps 147650 string =PWAD doom patch PWAD data 14766>4 lelong x containing %d lumps 14767 14768# Build engine group files (Duke Nukem, Shadow Warrior, ...) 14769# Extension: .grp 14770# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 147710 string KenSilverman Build engine group file 14772>12 lelong x containing %d files 14773 14774# Summary: Warcraft 3 save 14775# Extension: .w3g 14776# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 147770 string Warcraft\ III\ recorded\ game %s 14778 14779 14780# Summary: Warcraft 3 map 14781# Extension: .w3m 14782# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 147830 string HM3W Warcraft III map file 14784 14785 14786# Summary: SGF Smart Game Format 14787# Extension: .sgf 14788# Reference: https://www.red-bean.com/sgf/ 14789# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 14790# Modified by (1): Abel Cheung (regex, more game format) 14791# FIXME: Some games don't have GM (game type) 147920 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 14793>2 search/0x200/b GM[ 14794>>&0 string 1] (Go) 14795>>&0 string 2] (Othello) 14796>>&0 string 3] (chess) 14797>>&0 string 4] (Gomoku+Renju) 14798>>&0 string 5] (Nine Men's Morris) 14799>>&0 string 6] (Backgammon) 14800>>&0 string 7] (Chinese chess) 14801>>&0 string 8] (Shogi) 14802>>&0 string 9] (Lines of Action) 14803>>&0 string 10] (Ataxx) 14804>>&0 string 11] (Hex) 14805>>&0 string 12] (Jungle) 14806>>&0 string 13] (Neutron) 14807>>&0 string 14] (Philosopher's Football) 14808>>&0 string 15] (Quadrature) 14809>>&0 string 16] (Trax) 14810>>&0 string 17] (Tantrix) 14811>>&0 string 18] (Amazons) 14812>>&0 string 19] (Octi) 14813>>&0 string 20] (Gess) 14814>>&0 string 21] (Twixt) 14815>>&0 string 22] (Zertz) 14816>>&0 string 23] (Plateau) 14817>>&0 string 24] (Yinsh) 14818>>&0 string 25] (Punct) 14819>>&0 string 26] (Gobblet) 14820>>&0 string 27] (hive) 14821>>&0 string 28] (Exxit) 14822>>&0 string 29] (Hnefatal) 14823>>&0 string 30] (Kuba) 14824>>&0 string 31] (Tripples) 14825>>&0 string 32] (Chase) 14826>>&0 string 33] (Tumbling Down) 14827>>&0 string 34] (Sahara) 14828>>&0 string 35] (Byte) 14829>>&0 string 36] (Focus) 14830>>&0 string 37] (Dvonn) 14831>>&0 string 38] (Tamsk) 14832>>&0 string 39] (Gipf) 14833>>&0 string 40] (Kropki) 14834 14835############################################## 14836# NetImmerse/Gamebryo game engine entries 14837 14838# Summary: Gamebryo game engine file 14839# Extension: .nif, .kf 14840# Created by: Abel Cheung <abelcheung@gmail.com> 148410 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 14842>&0 regex [0-9a-z.]+ \b, version %s 14843 14844# Summary: Gamebryo game engine file 14845# Extension: .kfm 14846# Created by: Abel Cheung <abelcheung@gmail.com> 148470 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 14848>&0 regex [0-9a-z.]+ \b, version %s 14849 14850# Summary: NetImmerse game engine file 14851# Extension .nif 14852# Created by: Abel Cheung <abelcheung@gmail.com> 148530 string NetImmerse\ File\ Format,\ Version 14854>&0 string n\ NetImmerse game engine file 14855>>&0 regex [0-9a-z.]+ \b, version %s 14856 14857# Type: SGF Smart Game Format 14858# URL: https://www.red-bean.com/sgf/ 14859# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 148602 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 14861>2 regex/c GM\\[1\\] - Go Game 14862>2 regex/c GM\\[6\\] - BackGammon Game 14863>2 regex/c GM\\[11\\] - Hex Game 14864>2 regex/c GM\\[18\\] - Amazons Game 14865>2 regex/c GM\\[19\\] - Octi Game 14866>2 regex/c GM\\[20\\] - Gess Game 14867>2 regex/c GM\\[21\\] - twix Game 14868 14869# Epic Games/Unreal Engine Package 14870# 148710 lelong 0x9E2A83C1 Unreal Engine Package, 14872>4 leshort x version: %i 14873>12 lelong !0 \b, names: %i 14874>28 lelong !0 \b, imports: %i 14875>20 lelong !0 \b, exports: %i 14876 148770 string ESVG 14878>4 lelong 0x00160000 14879>10 string TOC\020 Empire Deluxe for DOS saved game 14880 14881# Sid Meier's Civilization V/VI 14882# From: Benjamin Lowry <ben@ben.gmbh> 148830 string CIV5 14884>4 byte 0x08 Sid Meier's Civilization V saved game, 14885>>12 regex [0-9a-z.]+ saved by game version %s 14886>4 byte 0x01 Sid Meier's Civilization V replay data, 14887>>12 regex [0-9a-z.]+ saved by game version %s 14888 148890 string CIV6 Sid Meier's Civilization VI saved game 14890 14891# https://syzygy-tables.info/ 14892# From Michel Van den Bergh 148930 string \327f\f\245 Syzygy DTZ tablebase 14894!:mime application/syzygy 148950 string q\350#] Syzygy WDL tablebase 14896!:mime application/syzygy 14897 14898#------------------------------------------------------------------------------ 14899# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $ 14900# gcc: file(1) magic for GCC special files 14901# 149020 string gpch GCC precompiled header 14903 14904# The version field is annoying. It's 3 characters, not zero-terminated. 14905>5 byte x (version %c 14906>6 byte x \b%c 14907>7 byte x \b%c) 14908 14909# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 14910>4 byte 67 for C 14911>4 byte 111 for Objective-C 14912>4 byte 43 for C++ 14913>4 byte 79 for Objective-C++ 14914 14915#------------------------------------------------------------------------------ 14916# $File: gconv 14917# gconv: file(1) magic for iconv/gconv module configuration cache 14918# 14919# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC 14920# 14921# From: Marek Cermak <macermak@redhat.com> 14922# 149230 lelong 0x20010324 gconv module configuration cache data 14924 14925#------------------------------------------------------------------------------ 14926# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $ 14927# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 14928 14929###################################################################### 14930# 14931# Acoustic Doppler Current Profilers (ADCP) 14932# 14933###################################################################### 14934 149350 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 14936 14937###################################################################### 14938# 14939# Metadata 14940# 14941###################################################################### 14942 149430 string Identification_Information FGDC ASCII metadata 14944 14945###################################################################### 14946# 14947# Seimsic / Subbottom 14948# 14949###################################################################### 14950 14951# Knudsen subbottom chirp profiler - Binary File Format: B9 14952# KEB D409-03167 V1.75 Huffman 149530 string KEB\ Knudsen seismic KEL binary (KEB) - 14954>4 regex [-A-Z0-9]* Software: %s 14955>>&1 regex V[0-9]*\.[0-9]* version %s 14956 14957###################################################################### 14958# 14959# LIDAR - Laser altimetry or bathy 14960# 14961###################################################################### 14962 14963 14964# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 149650 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 14966>4 regex [0-9]*\.[0-9]* version %s 14967 149680 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 14969>3 byte x version %d . 14970>4 byte x %d 14971 14972 14973###################################################################### 14974# 14975# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 14976# 14977###################################################################### 14978 14979# GeoAcoustics - GeoSwath Plus 149804 beshort 0x2002 GeoSwath RDF 149810 string Start:- GeoSwatch auf text file 14982 14983# Seabeam 2100 14984# mbsystem code mb41 149850 string SB2100 SeaBeam 2100 multibeam sonar 149860 string SB2100DR SeaBeam 2100 DR multibeam sonar 149870 string SB2100PR SeaBeam 2100 PR multibeam sonar 14988 14989# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 14990# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 149910 string $HSF XSE multibeam 14992 14993# mb121 https://www.saic.com/maritime/gsf/ 149948 string GSF-v SAIC generic sensor format (GSF) sonar data, 14995>&0 regex [0-9]*\.[0-9]* version %s 14996 14997# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 14998# mb161 149999 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 15000 15001# MBSystem processing caches the mbinfo output 150021 string Swath\ Data\ File: mbsystem info cache 15003 15004# Caris John Hughes Clark format 150050 string HDCS Caris multibeam sonar related data 150061 string Start/Stop\ parameter\ header: Caris ASCII project summary 15007 15008###################################################################### 15009# 15010# Visualization and 3D modeling 15011# 15012###################################################################### 15013 15014# IVS - IVS3d.com Tagged Data Represetation 150150 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 15016 15017# http://www.ecma-international.org/publications/standards/Ecma-363.htm 15018# 3D in PDFs 150190 string U3D ECMA-363, Universal 3D 15020 15021###################################################################### 15022# 15023# Support files 15024# 15025###################################################################### 15026 15027# https://midas.psi.ch/elog/ 150280 string $@MID@$ elog journal entry 15029 15030# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm 150310 string DSBB Surfer 6 binary grid file 15032>4 leshort x \b, %d 15033>6 leshort x \bx%d 15034>8 ledouble x \b, minx=%g 15035>16 ledouble x \b, maxx=%g 15036>24 ledouble x \b, miny=%g 15037>32 ledouble x \b, maxy=%g 15038>40 ledouble x \b, minz=%g 15039>48 ledouble x \b, maxz=%g 15040 15041# magic for LAS format files 15042# alex myczko <alex@aiei.ch> 15043# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf 150440 string LASF LIDAR point data records 15045>24 byte >0 \b, version %u 15046>25 byte >0 \b.%u 15047>26 string >\0 \b, SYSID %s 15048>58 string >\0 \b, Generating Software %s 15049 15050# magic for PCD format files 15051# alex myczko <alex@aiei.ch> 15052# http://pointclouds.org/documentation/tutorials/pcd_file_format.php 150530 string #\ .PCD Point Cloud Data 15054 15055#------------------------------------------------------------------------------ 15056# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 15057# GEOS files (Vidar Madsen, vidar@gimp.org) 15058# semi-commonly used in embedded and handheld systems. 150590 belong 0xc745c153 GEOS 15060>40 byte 1 executable 15061>40 byte 2 VMFile 15062>40 byte 3 binary 15063>40 byte 4 directory label 15064>40 byte <1 unknown 15065>40 byte >4 unknown 15066>4 string >\0 \b, name "%s" 15067#>44 short x \b, version %d 15068#>46 short x \b.%d 15069#>48 short x \b, rev %d 15070#>50 short x \b.%d 15071#>52 short x \b, proto %d 15072#>54 short x \br%d 15073#>168 string >\0 \b, copyright "%s" 15074 15075#------------------------------------------------------------------------------ 15076# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $ 15077# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 15078# by Federico Mena <federico@nuclecu.unam.mx> 15079 150800 string/t GIMP\ Gradient GIMP gradient data 15081#!:mime text/plain 15082!:mime text/x-gimp-ggr 15083!:ext ggr 15084 15085# GIMP palette (.gpl) 15086# From: Markus Heidelberg <markus.heidelberg@web.de> 150870 string/t GIMP\ Palette GIMP palette data 15088# URL: https://docs.gimp.org/en/gimp-concepts-palettes.html 15089# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Palette 15090#!:mime text/plain 15091!:mime text/x-gimp-gpl 15092!:ext gpl 15093 15094#------------------------------------------------------------------------------ 15095# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 15096# by Spencer Kimball and Peter Mattis 15097# ('Bucky' LaDieu, nega@vt.edu) 15098 15099# URL: https://en.wikipedia.org/wiki/XCF_(file_format) 15100# Reference: https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt 151010 string gimp\ xcf GIMP XCF image data, 15102!:mime image/x-xcf 15103!:ext xcf 15104>9 string file version 0, 15105>9 string v version 15106>>10 string >\0 %s, 15107>14 belong x %u x 15108>18 belong x %u, 15109>22 belong 0 RGB Color 15110>22 belong 1 Greyscale 15111>22 belong 2 Indexed Color 15112>22 belong >2 Unknown Image Type. 15113 15114#------------------------------------------------------------------------------ 15115# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 15116# by Spencer Kimball and Peter Mattis 15117# ('Bucky' LaDieu, nega@vt.edu) 15118 15119# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Pattern 1512020 string GPAT GIMP pattern data, 15121>24 string x %s 15122!:mime image/x-gimp-pat 15123!:ext pat 15124 15125#------------------------------------------------------------------------------ 15126# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 15127# by Spencer Kimball and Peter Mattis 15128# ('Bucky' LaDieu, nega@vt.edu) 15129 1513020 string GIMP GIMP brush data 15131# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Brush 15132!:mime image/x-gimp-gbr 15133# some sources also list gpb 15134!:ext gbr 15135 15136# From: Joerg Jenderek 15137# URL: https://docs.gimp.org/en/gimp-using-animated-brushes.html 15138# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush 15139# share\gimp\2.0\brushes\Legacy\confetti.gih 151400 search/21/b \040ncells: GIMP animated brush data 15141!:mime image/x-gimp-gih 15142!:ext gih 15143 15144# GIMP Curves File 15145# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 151460 string #\040GIMP\040Curves\040File GIMP curve file 15147#!:mime text/plain 15148!:mime text/x-gimp-curve 15149!:ext /txt 15150 15151 15152#------------------------------------------------------------------------------ 15153# $File: git,v 1.2 2020/08/09 16:57:15 christos Exp $ 15154# git: file(1) magic for Git objects 15155 151560 string blob\040 15157>5 regex [0-9a-f]+ Git blob %s 15158 151590 string tree\040 15160>5 regex [0-9a-f]+ Git tree %s 15161 151620 string commit\040 15163>7 regex [0-9a-f]+ Git commit %s 15164 15165#------------------------------------------------------------------------------ 15166# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $ 15167# glibc locale files 15168# 15169# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32 15170 151710 belong 0x20070920 glibc locale file LC_CTYPE 151720 belong 0x14110320 glibc locale file LC_NUMERIC 151730 belong 0x17110320 glibc locale file LC_TIME 151740 belong 0x17100520 glibc locale file LC_COLLATE 151750 belong 0x11110320 glibc locale file LC_MONETARY 151760 belong 0x10110320 glibc locale file LC_MESSAGES 151770 belong 0x13110320 glibc locale file LC_ALL 151780 belong 0x12110320 glibc locale file LC_PAPER 151790 belong 0x1d110320 glibc locale file LC_NAME 151800 belong 0x1c110320 glibc locale file LC_ADDRESS 151810 belong 0x1f110320 glibc locale file LC_TELEPHONE 151820 belong 0x1e110320 glibc locale file LC_MEASUREMENT 151830 belong 0x19110320 glibc locale file LC_IDENTIFICATION 15184 15185 15186#------------------------------------------------------------------------------ 15187# $File: gnome,v 1.7 2020/06/23 16:17:08 christos Exp $ 15188# GNOME related files 15189 15190# Contributed by Josh Triplett 15191# FIXME: Could be simplified if pstring supported two-byte counts 151920 string GnomeKeyring\n\r\0\n GNOME keyring 15193>&0 ubyte 0 \b, major version 0 15194>>&0 ubyte 0 \b, minor version 0 15195>>>&0 ubyte 0 \b, crypto type 0 (AES) 15196>>>&0 ubyte >0 \b, crypto type %u (unknown) 15197>>>&1 ubyte 0 \b, hash type 0 (MD5) 15198>>>&1 ubyte >0 \b, hash type %u (unknown) 15199>>>&2 ubelong 0xFFFFFFFF \b, name NULL 15200>>>&2 ubelong !0xFFFFFFFF 15201>>>>&-4 ubelong >255 \b, name too long for file's pstring type 15202>>>>&-4 ubelong <256 15203>>>>>&-1 pstring x \b, name "%s" 15204>>>>>>&0 ubeqdate x \b, last modified %s 15205>>>>>>&8 ubeqdate x \b, created %s 15206>>>>>>&16 ubelong &1 15207>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 15208>>>>>>&16 ubelong ^1 \b, not locked if idle 15209>>>>>>&24 ubelong x \b, hash iterations %u 15210>>>>>>&28 ubequad x \b, salt %llu 15211>>>>>>&52 ubelong x \b, %u item(s) 15212 15213# From: Alex Beregszaszi <alex@fsn.hu> 152144 string gtktalog GNOME Catalogue (gtktalog) 15215>13 string >\0 version %s 15216 15217# Summary: GStreamer binary registry 15218# Extension: .bin 15219# Submitted by: Josh Triplett <josh@joshtriplett.org> 152200 belong 0xc0def00d GStreamer binary registry 15221>4 string x \b, version %s 15222 15223# GVariant Database file 15224# By Elan Ruusamae <glen@delfi.ee> 15225# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 15226# It's always "GVariant", it's byte swapped on incompatible archs 15227# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 15228# file_builder_serialise() 15229# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 152300 string GVariant GVariant Database file, 15231# version is never filled. probably future extension 15232>8 lelong x version %d 15233# not sure are these usable, so commented out 15234#>>16 lelong x start %d, 15235#>>>20 lelong x end %d 15236 15237# G-IR database made by gobject-introspect toolset, 15238# https://live.gnome.org/GObjectIntrospection 152390 string GOBJ\nMETADATA\r\n\032 G-IR binary database 15240>16 byte x \b, v%d 15241>17 byte x \b.%d 15242>20 short x \b, %d entries 15243>22 short x \b/%d local 15244 15245#------------------------------------------------------------------------------ 15246# $File: gnu,v 1.23 2021/02/23 00:51:10 christos Exp $ 15247# gnu: file(1) magic for various GNU tools 15248# 15249# GNU nlsutils message catalog file format 15250# 15251# GNU message catalog (.mo and .gmo files) 15252 15253# Update: Joerg Jenderek 15254# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 15255# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/ 15256# gettext-0.19.8.1/gettext-runtime/intl/gmo.h 15257# Note: maybe call it like "GNU translation gettext machine object" 152580 string \336\22\4\225 GNU message catalog (little endian), 15259#0 ulelong 0x950412DE GNU-format message catalog data 15260# TODO: write lines in such a way that code can also be called for big endian variant 15261#>0 use gettext-object 15262#0 name gettext-object 15263>4 ulelong x revision 15264!:mime application/x-gettext-translation 15265# mo extension is also used for Easeus Partition Master PE32 executable module 15266# like ConvertFatToNTFS.mo 15267!:ext gmo/mo 15268# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit 15269# major revision 15270>4 ulelong/0xFFff x %u. 15271# minor revision 15272>4 ulelong&0x0000FFff x \b%u 15273>>8 ulelong x \b, %u message 15274# plural s 15275>>8 ulelong >1 \bs 15276# size of hashing table 15277#>20 ulelong x \b, %u hash 15278#>20 ulelong >1 \bes 15279#>24 ulelong x at 0x%x 15280# for revision x.0 offset of table with originals is 1Ch if directly after header 15281>4 ulelong&0x0000FFff =0 15282>>12 ulelong !0x1C \b, at 0x%x string table 15283# but for x.1 table offset i found is 30h. That means directly after bigger header 15284>4 ulelong&0x0000FFff >0 15285>>12 ulelong !0x30 \b, at 0x%x string table 15286# The following variables are only used in .mo files with minor revision >= 1 15287# number of system dependent segments 15288#>>28 ulelong x \b, %u segment 15289#>>28 ulelong >1 \bs 15290# offset of table describing system dependent segments 15291#>>32 ulelong x at 0x%x 15292# number of system dependent strings pairs 15293>>36 ulelong x \b, %u sysdep message 15294>>36 ulelong >1 \bs 15295# offset of table with start offsets of original sysdep strings 15296#>>40 ulelong x \b, at 0x%x sysdep strings 15297# offset of table with start offsets of translated sysdep strings 15298#>>44 ulelong x \b, at 0x%x sysdep translations 15299# >>(44.l) ulelong x 0x%x chars 15300# >>>&0 ulelong x at 0x%x 15301# >>>>(&-4) string x "%s" 15302# string table after big header 15303#>>48 ubequad x \b, string table 0x%llx 15304# 15305# 0th string length seems to be always 0 15306#>(12.l) ulelong x \b, %u chars 15307#>>&0 ulelong x at 0x%x 15308# if 1st string length positive inspect offset and string 15309#>(12.l+8) ulelong >0 \b, %u chars 15310#>>&0 ulelong x at 0x%x 15311# if 2nd string length positive inspect offset and string 15312# >(12.l+16) ulelong >0 \b, %u chars 15313# >>&0 ulelong x at 0x%x 15314# skip newline byte 15315#>>>(&-4) ubyte =0x0A 15316#>>>>&0 string x "%s" 15317#>>>(&-4) ubyte !0x0A 15318#>>>>&-1 string x '%s' 15319# offset of table with translation strings 15320#>16 ulelong x \b, at 0x%x translation table 15321# check translation 0 length and offset 15322>(16.l) ulelong >0 15323>>&0 ulelong x 15324# translation 0 seems to be often Project-Id with name and version 15325>>>(&-4) string x \b, %s 15326# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL 15327>(16.l+8) ulelong >1 15328>>&0 ulelong x 15329>>>(&-4) ubyte !0x0A 15330>>>>&-1 string x '%s' 15331# 1 New Line like in tar-1.29\po\de.gmo 15332>>>(&-4) ubyte =0x0A 15333>>>>&0 ubyte !0x0A 15334>>>>>&-1 string x '%s' 15335# 2nd New Line like in parted-3.1\po\de.gmo 15336>>>>&0 ubyte =0x0A 15337>>>>>&0 string x '%s' 15338 153390 string \225\4\22\336 GNU message catalog (big endian), 15340#0 ubelong 0x950412DE GNU-format message catalog data 15341!:mime application/x-gettext-translation 15342!:ext gmo/mo 15343# TODO: for big endian use same code as for little endian 15344#>0 use \^gettext-object 15345# DEBUG code 15346#>16 ubelong x \b, at 0x%x translation table 15347#>(16.L) ubelong x 0x%x chars 15348#>>&0 ubelong x at 0x%x 15349# unexpected value HERE! 15350#>>>(&-4) ubequad x 0x%llx 15351# 15352>4 beshort x revision %d. 15353>6 beshort >0 \b%d, 15354>>8 belong x %d messages, 15355>>36 belong x %d sysdep messages 15356>6 beshort =0 \b%d, 15357>>8 belong x %d messages 15358 15359 15360# GnuPG 15361# The format is very similar to pgp 153620 string \001gpg GPG key trust database 15363>4 byte x version %d 15364# Note: magic.mime had 0x8501 for the next line instead of 0x8502 153650 beshort 0x8502 GPG encrypted data 15366!:mime text/PGP # encoding: data 15367 15368# Update: Joerg Jenderek 15369# Note: PGP and GPG use same data structure. 15370# So recognition is now done by ./pgp with start test for byte 0x99 15371# This magic is not particularly good, as the keyrings don't have true 15372# magic. Nevertheless, it covers many keyrings. 15373# 0 ubeshort-0x9901 <2 15374# >3 byte 4 15375# >>4 bedate x GPG key public ring, created %s 15376# !:mime application/x-gnupg-keyring 15377 15378# Symmetric encryption 153790 leshort 0x0d8c 15380>4 leshort 0x0203 15381>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 15382>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 15383>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 15384>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 15385>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 15386>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 15387>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 15388>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 15389>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 15390>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 15391 15392 15393# GnuPG Keybox file 15394# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 15395# From: Philipp Hahn <hahn@univention.de> 153960 belong 32 15397>4 byte 1 15398>>8 string KBXf GPG keybox database 15399>>>5 byte 1 version %d 15400>>>16 bedate x \b, created-at %s 15401>>>20 bedate x \b, last-maintained %s 15402 15403 15404# From: James Youngman <jay@gnu.org> 15405# gnu find magic 154060 string \0LOCATE GNU findutils locate database data 15407>7 string >\0 \b, format %s 15408>7 string 02 \b (frcode) 15409 15410# Files produced by GNU gettext 15411 15412# gettext message catalogue 154130 search/1024 \nmsgid 15414>&0 search/1024 \nmsgstr GNU gettext message catalogue text 15415!:strength +100 15416!:mime text/x-po 15417 15418#------------------------------------------------------------------------------ 15419# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 15420# gnumeric: file(1) magic for Gnumeric spreadsheet 15421# This entry is only semi-helpful, as Gnumeric compresses its files, so 15422# they will ordinarily reported as "compressed", but at least -z helps 1542339 string =<gmr:Workbook Gnumeric spreadsheet 15424!:mime application/x-gnumeric 15425 15426#------------------------------------------------------------------------------ 15427# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $ 15428# 15429# GPT Partition table patterns. 15430# Author: Rogier Goossens (goossens.rogier@gmail.com) 15431# Note that a GPT-formatted disk must contain an MBR as well. 15432# 15433 15434# The initial segment (up to >>>>>>>>422) was copied from the X86 15435# partition table code (aka MBR). 15436# This is kept separate, so that MBR partitions are not reported as well. 15437# (use -k if you do want them as well) 15438 15439# First, detect the MBR partition table 15440# If more than one GPT protective MBR partition exists, don't print anything 15441# (the other MBR detection code will then just print the MBR partition table) 154420x1FE leshort 0xAA55 15443>3 string !MS 15444>>3 string !SYSLINUX 15445>>>3 string !MTOOL 15446>>>>3 string !NEWLDR 15447>>>>>5 string !DOS 15448# not FAT (32 bit) 15449>>>>>>82 string !FAT32 15450#not Linux kernel 15451>>>>>>>514 string !HdrS 15452#not BeOS 15453>>>>>>>>422 string !Be\ Boot\ Loader 15454# GPT with protective MBR entry in partition 1 (only) 15455>>>>>>>>>450 ubyte 0xee 15456>>>>>>>>>>466 ubyte !0xee 15457>>>>>>>>>>>482 ubyte !0xee 15458>>>>>>>>>>>>498 ubyte !0xee 15459#>>>>>>>>>>>>>446 use gpt-mbr-partition 15460>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 15461>>>>>>>>>>>>>>0 use gpt-mbr-type 15462>>>>>>>>>>>>>>&-8 use gpt-table 15463>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15464>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 15465>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 15466>>>>>>>>>>>>>>>0 use gpt-mbr-type 15467>>>>>>>>>>>>>>>&-8 use gpt-table 15468>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15469>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 15470>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 15471>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15472>>>>>>>>>>>>>>>>&-8 use gpt-table 15473>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15474>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 15475>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 15476>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15477>>>>>>>>>>>>>>>>>&-8 use gpt-table 15478>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15479>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 15480>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 15481>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15482>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15483>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15484# GPT with protective MBR entry in partition 2 (only) 15485>>>>>>>>>450 ubyte !0xee 15486>>>>>>>>>>466 ubyte 0xee 15487>>>>>>>>>>>482 ubyte !0xee 15488>>>>>>>>>>>>498 ubyte !0xee 15489#>>>>>>>>>>>>>462 use gpt-mbr-partition 15490>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 15491>>>>>>>>>>>>>>0 use gpt-mbr-type 15492>>>>>>>>>>>>>>&-8 use gpt-table 15493>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15494>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 15495>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 15496>>>>>>>>>>>>>>>0 use gpt-mbr-type 15497>>>>>>>>>>>>>>>&-8 use gpt-table 15498>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15499>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 15500>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 15501>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15502>>>>>>>>>>>>>>>>&-8 use gpt-table 15503>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15504>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 15505>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 15506>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15507>>>>>>>>>>>>>>>>>&-8 use gpt-table 15508>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15509>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 15510>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 15511>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15512>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15513>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15514# GPT with protective MBR entry in partition 3 (only) 15515>>>>>>>>>450 ubyte !0xee 15516>>>>>>>>>>466 ubyte !0xee 15517>>>>>>>>>>>482 ubyte 0xee 15518>>>>>>>>>>>>498 ubyte !0xee 15519#>>>>>>>>>>>>>478 use gpt-mbr-partition 15520>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 15521>>>>>>>>>>>>>>0 use gpt-mbr-type 15522>>>>>>>>>>>>>>&-8 use gpt-table 15523>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15524>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 15525>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 15526>>>>>>>>>>>>>>>0 use gpt-mbr-type 15527>>>>>>>>>>>>>>>&-8 use gpt-table 15528>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15529>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 15530>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 15531>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15532>>>>>>>>>>>>>>>>&-8 use gpt-table 15533>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15534>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 15535>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 15536>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15537>>>>>>>>>>>>>>>>>&-8 use gpt-table 15538>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15539>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 15540>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 15541>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15542>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15543>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15544# GPT with protective MBR entry in partition 4 (only) 15545>>>>>>>>>450 ubyte !0xee 15546>>>>>>>>>>466 ubyte !0xee 15547>>>>>>>>>>>482 ubyte !0xee 15548>>>>>>>>>>>>498 ubyte 0xee 15549#>>>>>>>>>>>>>494 use gpt-mbr-partition 15550>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 15551>>>>>>>>>>>>>>0 use gpt-mbr-type 15552>>>>>>>>>>>>>>&-8 use gpt-table 15553>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 15554>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 15555>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 15556>>>>>>>>>>>>>>>0 use gpt-mbr-type 15557>>>>>>>>>>>>>>>&-8 use gpt-table 15558>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 15559>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 15560>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 15561>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15562>>>>>>>>>>>>>>>>&-8 use gpt-table 15563>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 15564>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 15565>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 15566>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15567>>>>>>>>>>>>>>>>>&-8 use gpt-table 15568>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 15569>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 15570>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 15571>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 15572>>>>>>>>>>>>>>>>>>&-8 use gpt-table 15573>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 15574 15575# The following code does GPT detection and processing, including 15576# sector size detection. 15577# It has to be duplicated above because the top-level pattern 15578# (i.e. not called using 'use') must print *something* for file 15579# to count it as a match. Text only printed in named patterns is 15580# not counted, and causes file to continue, and try and match 15581# other patterns. 15582# 15583# Unfortunately, when assuming sector sizes >=16k, if the sector size 15584# happens to be 512 instead, we may find confusing data after the GPT 15585# table... If the GPT table has less than 128 entries, this may even 15586# happen for assumed sector sizes as small as 4k 15587# This could be solved by checking for the presence of the backup GPT 15588# header as well, but that makes the logic extremely complex 15589##0 name gpt-mbr-partition 15590##>(8.l*8192) string EFI\ PART 15591##>>(8.l*8192) use gpt-mbr-type 15592##>>&-8 use gpt-table 15593##>>0 ubyte x of 8192 bytes 15594##>(8.l*8192) string !EFI\ PART 15595##>>(8.l*4096) string EFI\ PART GPT partition table 15596##>>>0 use gpt-mbr-type 15597##>>>&-8 use gpt-table 15598##>>>0 ubyte x of 4096 bytes 15599##>>(8.l*4096) string !EFI\ PART 15600##>>>(8.l*2048) string EFI\ PART GPT partition table 15601##>>>>0 use gpt-mbr-type 15602##>>>>&-8 use gpt-table 15603##>>>>0 ubyte x of 2048 bytes 15604##>>>(8.l*2048) string !EFI\ PART 15605##>>>>(8.l*1024) string EFI\ PART GPT partition table 15606##>>>>>0 use gpt-mbr-type 15607##>>>>>&-8 use gpt-table 15608##>>>>>0 ubyte x of 1024 bytes 15609##>>>>(8.l*1024) string !EFI\ PART 15610##>>>>>(8.l*512) string EFI\ PART GPT partition table 15611##>>>>>>0 use gpt-mbr-type 15612##>>>>>>&-8 use gpt-table 15613##>>>>>>0 ubyte x of 512 bytes 15614 15615# Print details of MBR type for a GPT-disk 15616# Calling code ensures that there is only one 0xee partition. 156170 name gpt-mbr-type 15618# GPT with protective MBR entry in partition 1 15619>450 ubyte 0xee 15620>>454 ulelong 1 15621>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15622>>454 ulelong !1 \b (nonstandard: not at LBA 1) 15623# GPT with protective MBR entry in partition 2 15624>466 ubyte 0xee 15625>>470 ulelong 1 15626>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 15627>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15628>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15629>>470 ulelong !1 \b (nonstandard: not at LBA 1) 15630# GPT with protective MBR entry in partition 3 15631>482 ubyte 0xee 15632>>486 ulelong 1 15633>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 15634>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15635>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15636>>486 ulelong !1 \b (nonstandard: not at LBA 1) 15637# GPT with protective MBR entry in partition 4 15638>498 ubyte 0xee 15639>>502 ulelong 1 15640>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 15641>>502 ulelong !1 \b (nonstandard: not at LBA 1) 15642 15643# Print the information from a GPT partition table structure 156440 name gpt-table 15645>10 uleshort x \b, version %u 15646>8 uleshort x \b.%u 15647>56 ulelong x \b, GUID: %08x 15648>60 uleshort x \b-%04x 15649>62 uleshort x \b-%04x 15650>64 ubeshort x \b-%04x 15651>66 ubeshort x \b-%04x 15652>68 ubelong x \b%08x 15653#>80 uleshort x \b, %d partition entries 15654>32 ulequad+1 x \b, disk size: %lld sectors 15655 15656# In case a GPT data-structure is at LBA 0, report it as well 15657# This covers systems which are not GPT-aware, and which show 15658# and allow access to the protective partition. This code will 15659# detect the contents of such a partition. 156600 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 15661>0 use gpt-table 15662>0 ubyte x (sector size unknown) 15663 15664 15665 15666#------------------------------------------------------------------------------ 15667# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $ 15668# gpu: file(1) magic for GPU input files 15669 15670# Standard Portable Intermediate Representation (SPIR) 15671# Documentation: https://www.khronos.org/spir 15672# Typical file extension: .spv 15673 156740 belong 0x07230203 Khronos SPIR-V binary, big-endian 15675>4 belong x \b, version 0x%08x 15676>8 belong x \b, generator 0x%08x 15677 156780 lelong 0x07230203 Khronos SPIR-V binary, little-endian 15679>4 lelong x \b, version 0x%08x 15680>8 lelong x \b, generator 0x%08x 15681 15682# Vulkan Trace file 15683# Documentation: 15684# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\ 15685# vktrace_trace_packet_identifiers.h 15686# Typical file extension: .vktrace 15687 156888 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian 15689>0 leshort x \b, version %d 15690 156918 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian 15692>0 beshort x \b, version %d 15693 15694#------------------------------------------------------------------------------ 15695# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 15696# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 15697# 15698# ACE/gr binary 156990 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 15700>39 byte >0 - version %c 15701# ACE/gr ascii 157020 string #\ xvgr\ parameter\ file ACE/gr ascii file 157030 string #\ xmgr\ parameter\ file ACE/gr ascii file 157040 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 15705# Grace projects 157060 string #\ Grace\ project\ file Grace project file 15707>23 string @version\ (version 15708>>32 byte >0 %c 15709>>33 string >\0 \b.%.2s 15710>>35 string >\0 \b.%.2s) 15711# ACE/gr fit description files 157120 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 15713# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 15714 15715#------------------------------------------------------------------------------ 15716# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $ 15717# graphviz: file(1) magic for https://www.graphviz.org/ 15718 15719# FIXME: These patterns match too generally. For example, the first 15720# line matches a LaTeX file containing the word "graph" (with a { 15721# following later) and the second line matches this file. 15722#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 15723#!:mime text/vnd.graphviz 15724#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 15725#!:mime text/vnd.graphviz 15726 15727#------------------------------------------------------------------------------ 15728# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $ 15729# gringotts: file(1) magic for Gringotts 15730# http://devel.pluto.linux.it/projects/Gringotts/ 15731# author: Germano Rizzo <mano@pluto.linux.it> 15732#GRG3????Y 157330 string GRG Gringotts data file 15734#file format 1 15735>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 15736#file format 2 15737>3 string 2 v.2, MCRYPT S2K, 15738>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 15739>>8 byte&0x70 0x10 SERPENT crypt, 15740>>8 byte&0x70 0x20 TWOFISH crypt, 15741>>8 byte&0x70 0x30 CAST-256 crypt, 15742>>8 byte&0x70 0x40 SAFER+ crypt, 15743>>8 byte&0x70 0x50 LOKI97 crypt, 15744>>8 byte&0x70 0x60 3DES crypt, 15745>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 15746>>8 byte&0x08 0x00 SHA1 hash, 15747>>8 byte&0x08 0x08 RIPEMD-160 hash, 15748>>8 byte&0x04 0x00 ZLib 15749>>8 byte&0x04 0x04 BZip2 15750>>8 byte&0x03 0x00 lvl.0 15751>>8 byte&0x03 0x01 lvl.3 15752>>8 byte&0x03 0x02 lvl.6 15753>>8 byte&0x03 0x03 lvl.9 15754#file format 3 15755>3 string 3 v.3, OpenPGP S2K, 15756>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 15757>>8 byte&0x70 0x10 SERPENT crypt, 15758>>8 byte&0x70 0x20 TWOFISH crypt, 15759>>8 byte&0x70 0x30 CAST-256 crypt, 15760>>8 byte&0x70 0x40 SAFER+ crypt, 15761>>8 byte&0x70 0x50 LOKI97 crypt, 15762>>8 byte&0x70 0x60 3DES crypt, 15763>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 15764>>8 byte&0x08 0x00 SHA1 hash, 15765>>8 byte&0x08 0x08 RIPEMD-160 hash, 15766>>8 byte&0x04 0x00 ZLib 15767>>8 byte&0x04 0x04 BZip2 15768>>8 byte&0x03 0x00 lvl.0 15769>>8 byte&0x03 0x01 lvl.3 15770>>8 byte&0x03 0x02 lvl.6 15771>>8 byte&0x03 0x03 lvl.9 15772#file format >3 15773>3 string >3 v.%.1s (unknown details) 15774 15775#------------------------------------------------------------------------------ 15776# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $ 15777# Guile file magic from <dalepsmith@gmail.com> 15778# https://www.gnu.org/s/guile/ 15779# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 15780 157810 string GOOF---- Guile Object 15782>8 string LE \b, little endian 15783>8 string BE \b, big endian 15784>11 string 4 \b, 32bit 15785>11 string 8 \b, 64bit 15786>13 regex .\.. \b, bytecode v%s 15787 15788#------------------------------------------------------------------------------ 15789# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $ 15790# hardware magic 15791 15792# EDID 15793# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data 157940 string \x00\xFF\xFF\xFF\xFF\xFF\xFF\x00 15795>19 byte x 15796>>18 byte x EDID data, version %u. 15797>>19 byte x \b%u 15798#>>17 ubyte+1990 <255 \b, manufactured %u 15799 15800#------------------------------------------------------------------------------ 15801# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $ 15802# hitach-sh: file(1) magic for Hitachi Super-H 15803# 15804# Super-H COFF 15805# 15806# updated by Joerg Jenderek at Oct 2015 15807# https://en.wikipedia.org/wiki/COFF 15808# https://de.wikipedia.org/wiki/Common_Object_File_Format 15809# http://www.delorie.com/djgpp/doc/coff/filhdr.html 15810# below test line conflicts with 2nd NTFS filesystem sector 15811# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 15812# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/) 158130 beshort 0x0500 15814# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 15815>18 ubeshort&0x8E80 0 15816# use big endian variant of subroutine to display name+variables+flags 15817# for common object formatted files 15818>>0 use \^display-coff 15819!:strength -10 15820 158210 leshort 0x0550 15822# test for unused flag bits in f_flags 15823>18 uleshort&0x8E80 0 15824# use little endian variant of subroutine to 15825# display name+variables+flags for common object formatted files 15826>>0 use display-coff 15827!:strength -10 15828 15829 15830#------------------------------------------------------------------------------ 15831# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $ 15832# hp: file(1) magic for Hewlett Packard machines (see also "printer") 15833# 15834# XXX - somebody should figure out whether any byte order needs to be 15835# applied to the "TML" stuff; I'm assuming the Apollo stuff is 15836# big-endian as it was mostly 68K-based. 15837# 15838# I think the 500 series was the old stack-based machines, running a 15839# UNIX environment atop the "SUN kernel"; dunno whether it was 15840# big-endian or little-endian. 15841# 15842# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 15843# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 15844# HP magic is useful for reference, but using "long" magic is a better 15845# practice in order to avoid collisions. 15846# 15847# Guy Harris (guy@netapp.com): some additions to this list came from 15848# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 15849# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 15850# "/etc/magic", though, except for the "archive file relocatable library" 15851# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 15852# used in executables, or have they just not yet updated "/etc/magic" 15853# completely? 15854# 15855# 0 beshort 200 hp200 (68010) BSD binary 15856# 0 beshort 300 hp300 (68020+68881) BSD binary 15857# 0 beshort 0x20c hp200/300 HP-UX binary 15858# 0 beshort 0x20d hp400 (68030) HP-UX binary 15859# 0 beshort 0x20e hp400 (68040?) HP-UX binary 15860# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 15861# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 15862# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 15863# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 15864 15865# 15866# The "misc" stuff needs a byte order; the archives look suspiciously 15867# like the old 177545 archives (0xff65 = 0177545). 15868# 15869#### Old Apollo stuff 158700 beshort 0627 Apollo m68k COFF executable 15871>18 beshort ^040000 not stripped 15872>22 beshort >0 - version %d 158730 beshort 0624 apollo a88k COFF executable 15874>18 beshort ^040000 not stripped 15875>22 beshort >0 - version %d 158760 long 01203604016 TML 0123 byte-order format 158770 long 01702407010 TML 1032 byte-order format 158780 long 01003405017 TML 2301 byte-order format 158790 long 01602007412 TML 3210 byte-order format 15880#### PA-RISC 1.1 158810 belong 0x02100106 PA-RISC1.1 relocatable object 158820 belong 0x02100107 PA-RISC1.1 executable 15883>168 belong &0x00000004 dynamically linked 15884>(144) belong 0x054ef630 dynamically linked 15885>96 belong >0 - not stripped 15886 158870 belong 0x02100108 PA-RISC1.1 shared executable 15888>168 belong&0x4 0x4 dynamically linked 15889>(144) belong 0x054ef630 dynamically linked 15890>96 belong >0 - not stripped 15891 158920 belong 0x0210010b PA-RISC1.1 demand-load executable 15893>168 belong&0x4 0x4 dynamically linked 15894>(144) belong 0x054ef630 dynamically linked 15895>96 belong >0 - not stripped 15896 158970 belong 0x0210010e PA-RISC1.1 shared library 15898>96 belong >0 - not stripped 15899 159000 belong 0x0210010d PA-RISC1.1 dynamic load library 15901>96 belong >0 - not stripped 15902 15903#### PA-RISC 2.0 159040 belong 0x02140106 PA-RISC2.0 relocatable object 15905 159060 belong 0x02140107 PA-RISC2.0 executable 15907>168 belong &0x00000004 dynamically linked 15908>(144) belong 0x054ef630 dynamically linked 15909>96 belong >0 - not stripped 15910 159110 belong 0x02140108 PA-RISC2.0 shared executable 15912>168 belong &0x00000004 dynamically linked 15913>(144) belong 0x054ef630 dynamically linked 15914>96 belong >0 - not stripped 15915 159160 belong 0x0214010b PA-RISC2.0 demand-load executable 15917>168 belong &0x00000004 dynamically linked 15918>(144) belong 0x054ef630 dynamically linked 15919>96 belong >0 - not stripped 15920 159210 belong 0x0214010e PA-RISC2.0 shared library 15922>96 belong >0 - not stripped 15923 159240 belong 0x0214010d PA-RISC2.0 dynamic load library 15925>96 belong >0 - not stripped 15926 15927#### 800 159280 belong 0x020b0106 PA-RISC1.0 relocatable object 15929 159300 belong 0x020b0107 PA-RISC1.0 executable 15931>168 belong&0x4 0x4 dynamically linked 15932>(144) belong 0x054ef630 dynamically linked 15933>96 belong >0 - not stripped 15934 159350 belong 0x020b0108 PA-RISC1.0 shared executable 15936>168 belong&0x4 0x4 dynamically linked 15937>(144) belong 0x054ef630 dynamically linked 15938>96 belong >0 - not stripped 15939 159400 belong 0x020b010b PA-RISC1.0 demand-load executable 15941>168 belong&0x4 0x4 dynamically linked 15942>(144) belong 0x054ef630 dynamically linked 15943>96 belong >0 - not stripped 15944 159450 belong 0x020b010e PA-RISC1.0 shared library 15946>96 belong >0 - not stripped 15947 159480 belong 0x020b010d PA-RISC1.0 dynamic load library 15949>96 belong >0 - not stripped 15950 15951#### 500 159520 long 0x02080106 HP s500 relocatable executable 15953>16 long >0 - version %d 15954 159550 long 0x02080107 HP s500 executable 15956>16 long >0 - version %d 15957 159580 long 0x02080108 HP s500 pure executable 15959>16 long >0 - version %d 15960 15961#### 200 159620 belong 0x020c0108 HP s200 pure executable 15963>4 beshort >0 - version %d 15964>8 belong &0x80000000 save fp regs 15965>8 belong &0x40000000 dynamically linked 15966>8 belong &0x20000000 debuggable 15967>36 belong >0 not stripped 15968 159690 belong 0x020c0107 HP s200 executable 15970>4 beshort >0 - version %d 15971>8 belong &0x80000000 save fp regs 15972>8 belong &0x40000000 dynamically linked 15973>8 belong &0x20000000 debuggable 15974>36 belong >0 not stripped 15975 159760 belong 0x020c010b HP s200 demand-load executable 15977>4 beshort >0 - version %d 15978>8 belong &0x80000000 save fp regs 15979>8 belong &0x40000000 dynamically linked 15980>8 belong &0x20000000 debuggable 15981>36 belong >0 not stripped 15982 159830 belong 0x020c0106 HP s200 relocatable executable 15984>4 beshort >0 - version %d 15985>6 beshort >0 - highwater %d 15986>8 belong &0x80000000 save fp regs 15987>8 belong &0x20000000 debuggable 15988>8 belong &0x10000000 PIC 15989 159900 belong 0x020a0108 HP s200 (2.x release) pure executable 15991>4 beshort >0 - version %d 15992>36 belong >0 not stripped 15993 159940 belong 0x020a0107 HP s200 (2.x release) executable 15995>4 beshort >0 - version %d 15996>36 belong >0 not stripped 15997 159980 belong 0x020c010e HP s200 shared library 15999>4 beshort >0 - version %d 16000>6 beshort >0 - highwater %d 16001>36 belong >0 not stripped 16002 160030 belong 0x020c010d HP s200 dynamic load library 16004>4 beshort >0 - version %d 16005>6 beshort >0 - highwater %d 16006>36 belong >0 not stripped 16007 16008#### MISC 160090 long 0x0000ff65 HP old archive 160100 long 0x020aff65 HP s200 old archive 160110 long 0x020cff65 HP s200 old archive 160120 long 0x0208ff65 HP s500 old archive 16013 160140 long 0x015821a6 HP core file 16015 160160 long 0x4da7eee8 HP-WINDOWS font 16017>8 byte >0 - version %d 160180 string Bitmapfile HP Bitmapfile 16019 160200 string IMGfile CIS compimg HP Bitmapfile 16021# XXX - see "lif" 16022#0 short 0x8000 lif file 160230 long 0x020c010c compiled Lisp 16024 160250 string msgcat01 HP NLS message catalog, 16026>8 long >0 %d messages 16027 16028# Summary: HP-48/49 calculator 16029# Created by: phk@data.fls.dk 16030# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 16031# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 160320 string HPHP HP 16033>4 string 48 48 binary 16034>4 string 49 49 binary 16035>7 byte >64 - Rev %c 16036>8 leshort 0x2911 (ADR) 16037>8 leshort 0x2933 (REAL) 16038>8 leshort 0x2955 (LREAL) 16039>8 leshort 0x2977 (COMPLX) 16040>8 leshort 0x299d (LCOMPLX) 16041>8 leshort 0x29bf (CHAR) 16042>8 leshort 0x29e8 (ARRAY) 16043>8 leshort 0x2a0a (LNKARRAY) 16044>8 leshort 0x2a2c (STRING) 16045>8 leshort 0x2a4e (HXS) 16046>8 leshort 0x2a74 (LIST) 16047>8 leshort 0x2a96 (DIR) 16048>8 leshort 0x2ab8 (ALG) 16049>8 leshort 0x2ada (UNIT) 16050>8 leshort 0x2afc (TAGGED) 16051>8 leshort 0x2b1e (GROB) 16052>8 leshort 0x2b40 (LIB) 16053>8 leshort 0x2b62 (BACKUP) 16054>8 leshort 0x2b88 (LIBDATA) 16055>8 leshort 0x2d9d (PROG) 16056>8 leshort 0x2dcc (CODE) 16057>8 leshort 0x2e48 (GNAME) 16058>8 leshort 0x2e6d (LNAME) 16059>8 leshort 0x2e92 (XLIB) 16060 160610 string %%HP: HP text 16062>6 string T(0) - T(0) 16063>6 string T(1) - T(1) 16064>6 string T(2) - T(2) 16065>6 string T(3) - T(3) 16066>10 string A(D) A(D) 16067>10 string A(R) A(R) 16068>10 string A(G) A(G) 16069>14 string F(.) F(.); 16070>14 string F(,) F(,); 16071 16072 16073# Summary: HP-38/39 calculator 16074# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 160750 string HP3 16076>3 string 8 HP 38 16077>3 string 9 HP 39 16078>4 string Bin binary 16079>4 string Asc ASCII 16080>7 string A (Directory List) 16081>7 string B (Zaplet) 16082>7 string C (Note) 16083>7 string D (Program) 16084>7 string E (Variable) 16085>7 string F (List) 16086>7 string G (Matrix) 16087>7 string H (Library) 16088>7 string I (Target List) 16089>7 string J (ASCII Vector specification) 16090>7 string K (wildcard) 16091 16092# Summary: HP-38/39 calculator 16093# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 160940 string HP3 16095>3 string 8 HP 38 16096>3 string 9 HP 39 16097>4 string Bin binary 16098>4 string Asc ASCII 16099>7 string A (Directory List) 16100>7 string B (Zaplet) 16101>7 string C (Note) 16102>7 string D (Program) 16103>7 string E (Variable) 16104>7 string F (List) 16105>7 string G (Matrix) 16106>7 string H (Library) 16107>7 string I (Target List) 16108>7 string J (ASCII Vector specification) 16109>7 string K (wildcard) 16110 16111# hpBSD magic numbers 161120 beshort 200 hp200 (68010) BSD 16113>2 beshort 0407 impure binary 16114>2 beshort 0410 read-only binary 16115>2 beshort 0413 demand paged binary 161160 beshort 300 hp300 (68020+68881) BSD 16117>2 beshort 0407 impure binary 16118>2 beshort 0410 read-only binary 16119>2 beshort 0413 demand paged binary 16120# 16121# From David Gero <dgero@nortelnetworks.com> 16122# HP-UX 10.20 core file format from /usr/include/sys/core.h 16123# Unfortunately, HP-UX uses corehead blocks without specifying the order 16124# There are four we care about: 16125# CORE_KERNEL, which starts with the string "HP-UX" 16126# CORE_EXEC, which contains the name of the command 16127# CORE_PROC, which contains the signal number that caused the core dump 16128# CORE_FORMAT, which contains the version of the core file format (== 1) 16129# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 16130# but we include all 6 variations of the order of the first 3, and 16131# assume that PROC will always be last 16132# Order 1: KERNEL, EXEC, FORMAT, PROC 161330x10 string HP-UX 16134>0 belong 2 16135>>0xC belong 0x3C 16136>>>0x4C belong 0x100 16137>>>>0x58 belong 0x44 16138>>>>>0xA0 belong 1 16139>>>>>>0xAC belong 4 16140>>>>>>>0xB0 belong 1 16141>>>>>>>>0xB4 belong 4 core file 16142>>>>>>>>>0x90 string >\0 from '%s' 16143>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16144>>>>>>>>>0xC4 belong 4 - received SIGILL 16145>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16146>>>>>>>>>0xC4 belong 6 - received SIGABRT 16147>>>>>>>>>0xC4 belong 7 - received SIGEMT 16148>>>>>>>>>0xC4 belong 8 - received SIGFPE 16149>>>>>>>>>0xC4 belong 10 - received SIGBUS 16150>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16151>>>>>>>>>0xC4 belong 12 - received SIGSYS 16152>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16153>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16154# Order 2: KERNEL, FORMAT, EXEC, PROC 16155>>>0x4C belong 1 16156>>>>0x58 belong 4 16157>>>>>0x5C belong 1 16158>>>>>>0x60 belong 0x100 16159>>>>>>>0x6C belong 0x44 16160>>>>>>>>0xB4 belong 4 core file 16161>>>>>>>>>0xA4 string >\0 from '%s' 16162>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16163>>>>>>>>>0xC4 belong 4 - received SIGILL 16164>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16165>>>>>>>>>0xC4 belong 6 - received SIGABRT 16166>>>>>>>>>0xC4 belong 7 - received SIGEMT 16167>>>>>>>>>0xC4 belong 8 - received SIGFPE 16168>>>>>>>>>0xC4 belong 10 - received SIGBUS 16169>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16170>>>>>>>>>0xC4 belong 12 - received SIGSYS 16171>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16172>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16173# Order 3: FORMAT, KERNEL, EXEC, PROC 161740x24 string HP-UX 16175>0 belong 1 16176>>0xC belong 4 16177>>>0x10 belong 1 16178>>>>0x14 belong 2 16179>>>>>0x20 belong 0x3C 16180>>>>>>0x60 belong 0x100 16181>>>>>>>0x6C belong 0x44 16182>>>>>>>>0xB4 belong 4 core file 16183>>>>>>>>>0xA4 string >\0 from '%s' 16184>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16185>>>>>>>>>0xC4 belong 4 - received SIGILL 16186>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16187>>>>>>>>>0xC4 belong 6 - received SIGABRT 16188>>>>>>>>>0xC4 belong 7 - received SIGEMT 16189>>>>>>>>>0xC4 belong 8 - received SIGFPE 16190>>>>>>>>>0xC4 belong 10 - received SIGBUS 16191>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16192>>>>>>>>>0xC4 belong 12 - received SIGSYS 16193>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16194>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16195# Order 4: EXEC, KERNEL, FORMAT, PROC 161960x64 string HP-UX 16197>0 belong 0x100 16198>>0xC belong 0x44 16199>>>0x54 belong 2 16200>>>>0x60 belong 0x3C 16201>>>>>0xA0 belong 1 16202>>>>>>0xAC belong 4 16203>>>>>>>0xB0 belong 1 16204>>>>>>>>0xB4 belong 4 core file 16205>>>>>>>>>0x44 string >\0 from '%s' 16206>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16207>>>>>>>>>0xC4 belong 4 - received SIGILL 16208>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16209>>>>>>>>>0xC4 belong 6 - received SIGABRT 16210>>>>>>>>>0xC4 belong 7 - received SIGEMT 16211>>>>>>>>>0xC4 belong 8 - received SIGFPE 16212>>>>>>>>>0xC4 belong 10 - received SIGBUS 16213>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16214>>>>>>>>>0xC4 belong 12 - received SIGSYS 16215>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16216>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16217# Order 5: FORMAT, EXEC, KERNEL, PROC 162180x78 string HP-UX 16219>0 belong 1 16220>>0xC belong 4 16221>>>0x10 belong 1 16222>>>>0x14 belong 0x100 16223>>>>>0x20 belong 0x44 16224>>>>>>0x68 belong 2 16225>>>>>>>0x74 belong 0x3C 16226>>>>>>>>0xB4 belong 4 core file 16227>>>>>>>>>0x58 string >\0 from '%s' 16228>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16229>>>>>>>>>0xC4 belong 4 - received SIGILL 16230>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16231>>>>>>>>>0xC4 belong 6 - received SIGABRT 16232>>>>>>>>>0xC4 belong 7 - received SIGEMT 16233>>>>>>>>>0xC4 belong 8 - received SIGFPE 16234>>>>>>>>>0xC4 belong 10 - received SIGBUS 16235>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16236>>>>>>>>>0xC4 belong 12 - received SIGSYS 16237>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16238>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16239# Order 6: EXEC, FORMAT, KERNEL, PROC 16240>0 belong 0x100 16241>>0xC belong 0x44 16242>>>0x54 belong 1 16243>>>>0x60 belong 4 16244>>>>>0x64 belong 1 16245>>>>>>0x68 belong 2 16246>>>>>>>0x74 belong 0x2C 16247>>>>>>>>0xB4 belong 4 core file 16248>>>>>>>>>0x44 string >\0 from '%s' 16249>>>>>>>>>0xC4 belong 3 - received SIGQUIT 16250>>>>>>>>>0xC4 belong 4 - received SIGILL 16251>>>>>>>>>0xC4 belong 5 - received SIGTRAP 16252>>>>>>>>>0xC4 belong 6 - received SIGABRT 16253>>>>>>>>>0xC4 belong 7 - received SIGEMT 16254>>>>>>>>>0xC4 belong 8 - received SIGFPE 16255>>>>>>>>>0xC4 belong 10 - received SIGBUS 16256>>>>>>>>>0xC4 belong 11 - received SIGSEGV 16257>>>>>>>>>0xC4 belong 12 - received SIGSYS 16258>>>>>>>>>0xC4 belong 33 - received SIGXCPU 16259>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 16260 16261 16262 16263#------------------------------------------------------------------------------ 16264# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 16265# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 16266# Magic too short! 16267#0 string HU Human68k 16268#>68 string LZX LZX compressed 16269#>>72 string >\0 (version %s) 16270#>(8.L+74) string LZX LZX compressed 16271#>>(8.L+78) string >\0 (version %s) 16272#>60 belong >0 binded 16273#>(8.L+66) string #HUPAIR hupair 16274#>0 string HU X executable 16275#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 16276#>4 belong >0 - base address 0x%x 16277#>28 belong >0 not stripped 16278#>32 belong >0 with debug information 16279#0 beshort 0x601a Human68k Z executable 16280#0 beshort 0x6000 Human68k object file 16281#0 belong 0xd1000000 Human68k ar binary archive 16282#0 belong 0xd1010000 Human68k ar ascii archive 16283#0 beshort 0x0068 Human68k lib archive 16284#4 string LZX Human68k LZX compressed 16285#>8 string >\0 (version %s) 16286#>4 string LZX R executable 16287#2 string #HUPAIR Human68k hupair R executable 16288 16289#------------------------------------------------------------------------------ 16290# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $ 16291# ibm370: file(1) magic for IBM 370 and compatibles. 16292# 16293# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 16294# What the heck *is* "USS/370"? 16295# AIX 4.1's "/etc/magic" has 16296# 16297# 0 short 0535 370 sysV executable 16298# >12 long >0 not stripped 16299# >22 short >0 - version %d 16300# >30 long >0 - 5.2 format 16301# 0 short 0530 370 sysV pure executable 16302# >12 long >0 not stripped 16303# >22 short >0 - version %d 16304# >30 long >0 - 5.2 format 16305# 16306# instead of the "USS/370" versions of the same magic numbers. 16307# 163080 beshort 0537 370 XA sysV executable 16309>12 belong >0 not stripped 16310>22 beshort >0 - version %d 16311>30 belong >0 - 5.2 format 163120 beshort 0532 370 XA sysV pure executable 16313>12 belong >0 not stripped 16314>22 beshort >0 - version %d 16315>30 belong >0 - 5.2 format 163160 beshort 054001 370 sysV pure executable 16317>12 belong >0 not stripped 163180 beshort 055001 370 XA sysV pure executable 16319>12 belong >0 not stripped 163200 beshort 056401 370 sysV executable 16321>12 belong >0 not stripped 163220 beshort 057401 370 XA sysV executable 16323>12 belong >0 not stripped 163240 beshort 0531 SVR2 executable (Amdahl-UTS) 16325>12 belong >0 not stripped 16326>24 belong >0 - version %d 163270 beshort 0534 SVR2 pure executable (Amdahl-UTS) 16328>12 belong >0 not stripped 16329>24 belong >0 - version %d 163300 beshort 0530 SVR2 pure executable (USS/370) 16331>12 belong >0 not stripped 16332>24 belong >0 - version %d 163330 beshort 0535 SVR2 executable (USS/370) 16334>12 belong >0 not stripped 16335>24 belong >0 - version %d 16336 16337# NETDATA (https://en.wikipedia.org/wiki/NETDATA) 16338# -\INMR01 In EBCDIC 163390 string \x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1 IBM NETDATA file 16340 16341#------------------------------------------------------------------------------ 16342# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $ 16343# ibm6000: file(1) magic for RS/6000 and the RT PC. 16344# 163450 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 16346>12 belong >0 not stripped 16347# Breaks sun4 statically linked execs. 16348#0 beshort 0x0103 executable (RT Version 2) or obj module 16349#>2 byte 0x50 pure 16350#>28 belong >0 not stripped 16351#>6 beshort >0 - version %ld 163520 beshort 0x0104 shared library 163530 beshort 0x0105 ctab data 163540 beshort 0xfe04 structured file 163550 string 0xabcdef AIX message catalog 163560 belong 0x000001f9 AIX compiled message catalog 163570 string \<aiaff> archive 163580 string \<bigaf> archive (big format) 163590 belong 0x09006bea AIX backup/restore format file 163600 belong 0x09006fea AIX backup/restore format file 16361 163620 beshort 0x01f7 64-bit XCOFF executable or object module 16363>20 belong 0 not stripped 16364# GRR: this test is still too general as it catches also many FATs of DOS filesystems 163654 belong &0x0feeddb0 16366# real core dump could not be 32-bit and 64-bit together 16367>7 byte&0x03 !3 AIX core file 16368>>1 byte &0x01 fulldump 16369>>7 byte &0x01 32-bit 16370>>>0x6e0 string >\0 \b, %s 16371>>7 byte &0x02 64-bit 16372>>>0x524 string >\0 \b, %s 16373 16374#------------------------------------------------------------------------------ 16375# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $ 16376# icc: file(1) magic for International Color Consortium file formats 16377 16378# 16379# Color profiles as per the ICC's "Image technology colour management - 16380# Architecture, profile format, and data structure" specification. 16381# See 16382# 16383# http://www.color.org/specification/ICC1v43_2010-12.pdf 16384# 16385# for Specification ICC.1:2010 (Profile version 4.3.0.0). 16386# URL: http://fileformats.archiveteam.org/wiki/ICC_profile 16387# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf 16388# Update: Joerg Jenderek 16389# 16390# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 16391# bytes 40 to 43 "may be used to identify the primary platform/operating 16392# system framework for which the profile was created". 16393# 16394# check and display ICC/ICM color profile 163950 name color-profile 16396>36 string acsp 16397# skip ASCII like Cognacspirit.txt by month <= 12 16398>>26 ubeshort <13 16399# platform/operating system. Only 5 mentioned 16400 16401# 16402# This appears to be what's used for Apple ColorSync profiles. 16403# Instead of adding that, Apple just changed the generic "acsp" entry 16404# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 16405# Management System, ICC Profile". 16406# Yes, it's "APPL", not "AAPL"; see the spec. 16407>>>40 string APPL ColorSync 16408 16409# Microsoft ICM color profile 16410>>>40 string MSFT Microsoft 16411 16412# Yes, that's a blank after "SGI". 16413>>>40 string SGI\ SGI 16414 16415# XXX - is this what's used for the Sun KCMS or not? The standard file 16416# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 16417# and there *is* an identified "primary platform" value of SUNW. 16418>>>40 string SUNW Sun KCMS 16419 16420# 5th platform 16421>>>40 string TGNT Taligent 16422 16423# remaining "l" "e" of "color profile" printed later to avoid error 16424>>>40 string x color profi 16425#>>>40 string x (%.4s) 16426!:mime application/vnd.iccprofile 16427# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found 16428>>>8 ubyte =2 16429# do not use empty message text to avoid error like 16430# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type 16431# file.exe: could not find any valid magic files! 16432>>>>9 ubyte !0 \ble 16433!:ext icc/icm 16434# minor version 16435>>>>9 ubyte =0 \bl 16436# Kodak colour management system 16437>>>>>4 string =KCMS \be 16438!:ext icc/icm/cc 16439>>>>>4 string !KCMS \be 16440!:ext icc/icm 16441>>>8 ubyte !2 \ble 16442!:ext icc 16443# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h) 16444>>>8 ubyte x %u 16445>>>9 ubyte/16 x \b.%u 16446# reserved and shall be null but 205.205 in umx1220u.icm 16447>>>10 ubyte >0 \b.%u 16448>>>>11 ubyte >0 \b.%u 16449# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF " 16450# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm 16451>>>4 string >\ \b, type %.2s 16452>>>>6 string >\ \b%.1s 16453>>>>>7 string >\ \b%.1s 16454# colour space "XYZ " "Lab " "RGB " CMYK GRAY ... 16455>>>16 string x \b, %.3s 16456>>>19 string >\ \b%.1s 16457# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes 16458# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc 16459>>>20 string >\0 \b/%.3s 16460>>>>23 string >\ \b%.1s 16461# eleven device classes 16462>>>12 string x \b-%.4s device 16463# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm 16464>>>52 string >\040 16465# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm" 16466>>>>52 ubelong !0x6e6f6e65 16467# device manufacturer field like "HP " "IBM " EPSO 16468>>>>>48 string x \b, %.2s 16469>>>>>50 string >\ \b%.1s 16470>>>>>51 string >\ \b%.1s 16471# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC 16472>>>>>52 string >\ \ \b/%.3s 16473>>>>>>55 string >\ \b%.1s 16474>>>>>52 string x model 16475# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm 16476>>>80 string >\0 by %.2s 16477>>>>82 string >\ \b%.1s 16478>>>>>83 string >\ \b%.1s 16479# profile size 16480>>>0 ubelong x \b, %u bytes 16481# skip invalid date 0 like in linearSRGB.icc 16482>>>24 ubequad !0 16483# datetime dd-mm-yyyy hh:mm:ss 16484>>>>28 ubeshort x \b, %u 16485# month <= 12 16486>>>>26 ubeshort x \b-%u 16487# year 16488>>>>24 ubeshort x \b-%u 16489# do not display midnight time like in CNHP8308.ICC 16490>>>>30 ubequad&0xFFffFFffFFff0000 !0 16491# hour <= 24 16492>>>>>30 ubeshort x %u 16493# minutes <= 59 16494>>>>>32 ubeshort x \b:%.2u 16495# seconds <= 59 16496>>>>>34 ubeshort x \b:%.2u 16497# vendor specific flags like 2 in HPCLJ5.ICM 16498>>>44 ubeshort >0 \b, 0x%x vendor flags 16499# profile flags bits 0-2 of least 16 used by ICC 16500#>>>44 ubelong >0 \b, 0x%x flags 16501# icEmbeddedProfileTrue 16502>>>44 ubelong &1 \b, embedded 16503# icEmbeddedProfileFalse 16504#>>>44 ubelong ^1 \b, not embedded 16505# icUseWithEmbeddedDataOnly 16506>>>44 ubelong &2 \b, dependently 16507# icUseAnywhere 16508#>>>44 ubelong ^2 \b, independently 16509>>>44 ubelong &4 \b, MCS 16510#>>>44 ubelong ^4 \b, no MCS 16511# vendor specific device attributes 1~srgb.icc 16512# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM 16513>>>56 ubelong >0 \b, 0x%x vendor attribute 16514# ICC device attributes bits 0-7 used 16515#>>>60 ubelong x \b, 0x%x attribute 16516# http://www.color.org/icc34.h 16517>>>60 ubelong &0x01 \b, transparent 16518#>>>60 ubelong ^0x01 \b, reflective 16519>>>60 ubelong &0x02 \b, matte 16520#>>>60 ubelong ^0x02 \b, glossy 16521>>>60 ubelong &0x04 \b, negative 16522#>>>60 ubelong ^0x04 \b, positive 16523>>>60 ubelong &0x08 \b, black&white 16524#>>>60 ubelong ^0x08 \b, colour 16525>>>60 ubelong &0x10 \b, non-paper 16526#>>>60 ubelong ^0x10 \b, paper 16527>>>60 ubelong &0x20 \b, non-textured 16528#>>>60 ubelong ^0x20 \b, textured 16529>>>60 ubelong &0x40 \b, non-isotropic 16530#>>>60 ubelong ^0x40 \b, isotropic 16531>>>60 ubelong &0x80 \b, self-luminous 16532#>>>60 ubelong ^0x80 \b, non-self-luminous 16533# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM 16534>>>64 ubelong >3 \b, 0x%x rendering intent 16535#>>>64 ubelong =0 \b, perceptual 16536>>>64 ubelong =1 \b, relative colorimetric 16537>>>64 ubelong =2 \b, saturation 16538>>>64 ubelong =3 \b, absolute colorimetric 16539# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d 16540>>>71 ubequad !0xd6000100000000d3 \b, PCS 16541# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found 16542# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm 16543>>>>68 ubelong !0x0000f6d5 X=0x%x 16544# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm 16545>>>>72 ubelong !0x00010000 Y=0x%x 16546# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found 16547# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm 16548>>>>76 ubelong !0x0000d32d Z=0x%x 16549# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321. 16550>>>84 ubequad >0 \b, 0x%llx MD5 16551# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD 16552#>>100 ubequad x \b 0x%llx reserved 16553# tag table 16554# 6 <= tags count <= 43 16555#>>>128 ubelong >43 \b, %u tags 16556>>>128 ubelong x 16557# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt" 16558# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508 16559>>>>132 search/508 cprt 16560# but no copyright tag in linearSRGB.icc 16561# beneath /System/Library/Frameworks/WebKit.framework/ 16562# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources 16563>>>>132 default x \b, no copyright tag 16564# 1st tag 16565#>>>132 string x \b, 1st tag %.4s 16566#>>>136 ubelong x 0x%x offset 16567#>>>140 ubelong x 0x%x len 16568# 2nd tag,... 16569# look also for profileDescriptionTag "desc" 16570>>>132 search/508 desc 16571# look further for TextDescriptionType "desc" signature 16572>>>>(&0.L) string =desc 16573>>>>>&4 pstring/l x "%s" 16574# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc 16575>>>>(&0.L) string =mluc 16576>>>>>&(&8.L) ubequad x 16577>>>>>>&4 bestring16 x '%s' 16578 16579# Any other profile. 16580# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 16581# and use "acsp" for everything else and dump the "primary platform" 16582# string in those cases? 1658336 string acsp 16584>0 use color-profile 16585 16586 16587 16588#------------------------------------------------------------------------------ 16589# $File: iff,v 1.17 2021/02/23 01:07:32 christos Exp $ 16590# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 16591# 16592# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 16593# Arts for file interchange. It has also been used by Apple, SGI, and 16594# especially Commodore-Amiga. 16595# 16596# IFF files begin with an 8 byte FORM header, followed by a 4 character 16597# FORM type, which is followed by the first chunk in the FORM. 16598 165990 string FORM IFF data 16600#>4 belong x \b, FORM is %d bytes long 16601# audio formats 16602>8 string AIFF \b, AIFF audio 16603!:mime audio/x-aiff 16604>8 string AIFC \b, AIFF-C compressed audio 16605!:mime audio/x-aiff 16606>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 16607!:mime audio/x-aiff 16608>8 string 16SV \b, 16SV 16-bit sampled sound voice 16609>8 string SAMP \b, SAMP sampled audio 16610>8 string MAUD \b, MAUD MacroSystem audio 16611>8 string SMUS \b, SMUS simple music 16612>8 string CMUS \b, CMUS complex music 16613# image formats 16614>8 string ILBMBMHD \b, ILBM interleaved image 16615>>20 beshort x \b, %d x 16616>>22 beshort x %d 16617>8 string RGBN \b, RGBN 12-bit RGB image 16618>8 string RGB8 \b, RGB8 24-bit RGB image 16619>8 string DEEP \b, DEEP TVPaint/XiPaint image 16620>8 string DR2D \b, DR2D 2-D object 16621>8 string TDDD \b, TDDD 3-D rendering 16622>8 string LWOB \b, LWOB 3-D object 16623>8 string LWO2 \b, LWO2 3-D object, v2 16624>8 string LWLO \b, LWLO 3-D layered object 16625>8 string REAL \b, REAL Real3D rendering 16626>8 string MC4D \b, MC4D MaxonCinema4D rendering 16627>8 string ANIM \b, ANIM animation 16628>8 string YAFA \b, YAFA animation 16629>8 string SSA\ \b, SSA super smooth animation 16630>8 string FANT \b, Fantavision animation 16631>8 string ACBM \b, ACBM continuous image 16632>8 string FAXX \b, FAXX fax image 16633>8 string STFX \b, ST-Fax image 16634# other formats 16635>8 string FTXT \b, FTXT formatted text 16636>8 string CTLG \b, CTLG message catalog 16637>8 string PREF \b, PREF preferences 16638>8 string DTYP \b, DTYP datatype description 16639>8 string PTCH \b, PTCH binary patch 16640>8 string AMFF \b, AMFF AmigaMetaFile format 16641>8 string WZRD \b, WZRD StormWIZARD resource 16642>8 string DOC\040 \b, DOC desktop publishing document 16643>8 string SWRT \b, SWRT Final Copy/Writer document 16644>8 string WORD \b, ProWrite document 16645>8 string WTXT \b, WTXT Wordworth document 16646>8 string WOWO \b, WOWO Wordworth document 16647>8 string WVQA \b, Westwood Studios VQA Multimedia, 16648>>24 leshort x %d video frames, 16649>>26 leshort x %d x 16650>>28 leshort x %d 16651>8 string MOVE \b, Wing Commander III Video 16652>>12 string _PC_ \b, PC version 16653>>12 string 3DO_ \b, 3DO version 16654 16655# These go at the end of the iff rules 16656# 16657# David Griffith <dave@661.org> 16658# I don't see why these might collide with anything else. 16659# 16660# Interactive Fiction related formats 16661# 16662>8 string IFRS \b, Blorb Interactive Fiction 16663>>24 string Exec with executable chunk 16664>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 16665!:mime application/x-blorb 16666 16667#------------------------------------------------------------------------------ 16668# $File: images,v 1.194 2021/02/09 22:59:38 christos Exp $ 16669# images: file(1) magic for image formats (see also "iff", and "c-lang" for 16670# XPM bitmaps) 16671# 16672# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 16673# additions by janl@ifi.uio.no as well as others. Jan also suggested 16674# merging several one- and two-line files into here. 16675# 16676# little magic: PCX (first byte is 0x0a) 16677 16678# Targa - matches `povray', `ppmtotga' and `xv' outputs 16679# by Philippe De Muyter <phdm@macqel.be> 16680# URL: http://justsolve.archiveteam.org/wiki/TGA 16681# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf 16682# Update: Joerg Jenderek 16683# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 16684# ,32 or 33 (both not observed) 16685# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 16686# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications 16687# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 16688# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 16689# `tgatoppm' recognizes a superset (Index may be anything) 16690# 16691# test of Color Map Type 0~no 1~color map 16692# and Image Type 1 2 3 9 10 11 32 33 16693# and Color Map Entry Size 0 15 16 24 32 166940 ubequad&0x00FeC400000000C0 0 16695# Conflict with MPEG sequences. 16696!:strength -40 16697# Prevent conflicts with CRI ADX. 16698#>(2.S-2) belong !0x28632943 16699# above line does not work for rgb32_top_left_rle.tga 16700# skip some MPEG sequence *.vob and some CRI ADX audio with improbable interleave bits 16701>17 ubyte&0xC0 !0xC0 16702# skip more garbage like *.iso by looking for positive image type 16703>>2 ubyte >0 16704# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33 16705>>>2 ubyte <34 16706# skip some MPEG sequence *.vob HV001T01.EVO winnicki.mpg with unacceptable alpha channel depth 11 16707>>>>17 ubyte&0x0F !11 16708# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32 16709>>>>>16 ubyte 1 16710>>>>>>0 use tga-image 16711>>>>>16 ubyte 8 16712>>>>>>0 use tga-image 16713>>>>>16 ubyte 15 16714>>>>>>0 use tga-image 16715>>>>>16 ubyte 16 16716>>>>>>0 use tga-image 16717>>>>>16 ubyte 24 16718>>>>>>0 use tga-image 16719>>>>>16 ubyte 32 16720>>>>>>0 use tga-image 16721# display tga bitmap image information 167220 name tga-image 16723>2 ubyte <34 Targa image data 16724!:mime image/x-tga 16725!:apple ????TPIC 16726# normal extension .tga but some Truevision products used others: 16727# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that) 16728!:ext tga/tpic/icb/vda/vst 16729# image type 1 2 3 9 10 11 32 33 16730>2 ubyte&0xF7 1 - Map 16731>2 ubyte&0xF7 2 - RGB 16732# alpha channel 16733>>17 ubyte&0x0F >0 \bA 16734>2 ubyte&0xF7 3 - Mono 16735# type not found, but by http://www.fileformat.info/format/tga/corion.htm 16736# Compressed color-mapped data, using Huffman, Delta, and runlength encoding 16737>2 ubyte 32 - Color 16738# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process 16739>2 ubyte 33 - Color 16740# Color Map Type 0~no 1~color map 16741>1 ubyte 1 ( 16742# first color map entry, 0 normal 16743>>3 uleshort >0 \b%d- 16744# color map length 0 2 1dh 3bh d9h 100h 16745>>5 uleshort x \b%d) 16746# 8~run length encoding bit 16747>2 ubyte&0x08 8 - RLE 16748# gimp can create big pictures! 16749>12 uleshort >0 %d x 16750>12 uleshort =0 65536 x 16751# image height. 0 interpreted as 65536 16752>14 uleshort >0 %d 16753>14 uleshort =0 65536 16754# Image Pixel depth 1 8 15 16 24 32 16755>16 ubyte x x %d 16756# X origin of image. 0 normal 16757>8 uleshort >0 +%d 16758# Y origin of image. 0 normal; positive for top 16759>10 uleshort >0 +%d 16760# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction 16761# alpha depth like: 1 8 16762>17 ubyte&0x0F >0 - %d-bit alpha 16763# bits 5-4 give direction. normal bottom left 16764>17 ubyte &0x20 - top 16765#>17 ubyte ^0x20 - bottom 16766>17 ubyte &0x10 - right 16767#>17 ubyte ^0x10 - left 16768# some info say other bits 6-7 should be zero 16769# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 16770# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved 16771#>17 ubyte&0xC0 0x00 - no interleave 16772>17 ubyte&0xC0 0x40 - interleave 16773>17 ubyte&0xC0 0x80 - four way interleave 16774>17 ubyte&0xC0 0xC0 - reserved 16775# positive length implies identification field 16776>0 ubyte >0 16777>>18 string x "%s" 16778# last 18 bytes of newer tga file footer signature 16779>18 search/4261301/s TRUEVISION-XFILE.\0 16780# extension area offset if not 0 16781>>&-8 ulelong >0 16782# length of the extension area. normal 495 for version 2.0 16783>>>(&-4.l) uleshort 0x01EF 16784# AuthorName[41] 16785>>>>&0 string >\0 - author "%-.40s" 16786# Comment[324]=4 * 80 null terminated 16787>>>>&41 string >\0 - comment "%-.80s" 16788# date 16789>>>>&365 ubequad&0xffffFFFFffff0000 !0 16790# Day 16791>>>>>&-6 uleshort x %d 16792# Month 16793>>>>>&-8 uleshort x \b-%d 16794# Year 16795>>>>>&-4 uleshort x \b-%d 16796# time 16797>>>>&371 ubequad&0xffffFFFFffff0000 !0 16798# hour 16799>>>>>&-8 uleshort x %d 16800# minutes 16801>>>>>&-6 uleshort x \b:%.2d 16802# second 16803>>>>>&-4 uleshort x \b:%.2d 16804# JobName[41] 16805>>>>&377 string >\0 - job "%-.40s" 16806# JobHour Jobminute Jobsecond 16807>>>>&418 ubequad&0xffffFFFFffff0000 !0 16808>>>>>&-8 uleshort x %d 16809>>>>>&-6 uleshort x \b:%.2d 16810>>>>>&-4 uleshort x \b:%.2d 16811# SoftwareId[41] 16812>>>>&424 string >\0 - %-.40s 16813# SoftwareVersionNumber 16814>>>>&424 ubyte >0 16815>>>>>&40 uleshort/100 x %d 16816>>>>>&40 uleshort%100 x \b.%d 16817# VersionLetter 16818>>>>>&42 ubyte >0x20 \b%c 16819# KeyColor 16820>>>>&468 ulelong >0 - keycolor 0x%8.8x 16821# Denominator of Pixel ratio. 0~no pixel aspect 16822>>>>&474 uleshort >0 16823# Numerator 16824>>>>>&-4 uleshort >0 - aspect %d 16825>>>>>&-2 uleshort x \b/%d 16826# Denominator of Gamma ratio. 0~no Gamma value 16827>>>>&478 uleshort >0 16828# Numerator 16829>>>>>&-4 uleshort >0 - gamma %d 16830>>>>>&-2 uleshort x \b/%d 16831# ColorOffset 16832#>>>>&480 ulelong x - col offset 0x%8.8x 16833# StampOffset 16834#>>>>&484 ulelong x - stamp offset 0x%8.8x 16835# ScanOffset 16836#>>>>&488 ulelong x - scan offset 0x%8.8x 16837# AttributesType 16838#>>>>&492 ubyte x - Attributes 0x%x 16839## EndOfTGA 16840 16841# PBMPLUS images 16842# URL: https://en.wikipedia.org/wiki/Netpbm 16843# The next byte following the magic is always whitespace. 16844# adding 65 to strength so that Netpbm images comes before "x86 boot sector" or 16845# "DOS/MBR boot sector" identified by ./filesystems is probably not needed 16846# because files are different 168470 name netpbm 16848>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data 16849>>&0 regex =[0-9]{1,50} \b, size = %s x 16850>>>&0 regex =[0-9]{1,50} \b %s 16851 168520 search/1 P1 16853# test for whitespace after 2 byte magic 16854>2 regex/2 [\040\t\f\r\n] 16855# skip DROID x-fmt-164-signature-id-583.pbm with ten 0 digits 16856>>3 string !000000000 16857>>>0 use netpbm 16858>>>0 string x \b, bitmap 16859#!:strength + 65 16860!:mime image/x-portable-bitmap 16861!:ext pbm 16862# check for character # starting a comment line 16863>>>3 ubyte =0x23 16864>>>>4 string x %s 16865 168660 search/1 P2 16867>0 regex/4 P2[\040\t\f\r\n] 16868>>0 use netpbm 16869>>0 string x \b, greymap 16870#!:strength + 65 16871# american spelling gray 16872!:mime image/x-portable-graymap 16873!:ext pgm 16874 168750 search/1 P3 16876>0 regex/4 P3[\040\t\f\r\n] 16877>>0 use netpbm 16878>>0 string x \b, pixmap 16879#!:strength + 65 16880!:mime image/x-portable-pixmap 16881!:ext ppm 16882 168830 string P4 16884>0 regex/4 P4[\040\t\f\r\n] 16885>>0 use netpbm 16886>>0 string x \b, rawbits, bitmap 16887#!:strength + 65 16888!:mime image/x-portable-bitmap 16889!:ext pbm 16890 168910 string P5 16892>0 regex/4 P5[\040\t\f\r\n] 16893>>0 use netpbm 16894>>0 string x \b, rawbits, greymap 16895#!:strength + 65 16896!:mime image/x-portable-greymap 16897!:ext pgm 16898 168990 string P6 16900>0 regex/4 P6[\040\t\f\r\n] 16901>>0 use netpbm 16902>>0 string x \b, rawbits, pixmap 16903#!:strength + 65 16904!:mime image/x-portable-pixmap 16905!:ext ppm/pnm 16906 16907# URL: https://en.wikipedia.org/wiki/Netpbm#PAM_graphics_format 16908# Reference: http://fileformats.archiveteam.org/wiki/Portable_Arbitrary_Map 16909# Update: Joerg Jenderek 169100 string P7 16911# skip DROID fmt-405-signature-id-589.pam by looking for character like New Line 16912>2 ubyte !0xAB 16913#>2 ubyte =0x0A 16914>>3 search/256/b WIDTH Netpbm PAM image file, size = 16915!:mime image/x-portable-arbitrarymap 16916!:ext pam 16917>>>&1 string x %s 16918>>>3 search/256/b HEIGHT x 16919>>>>&1 string x %s 16920# at offset 2 a New Line character (0xA) should appear 16921>>>2 ubyte !0x0A \b, 0x%x at offset 2 instead new line 16922 16923# From: bryanh@giraffe-data.com (Bryan Henderson) 169240 string \117\072 Solitaire Image Recorder format 16925>4 string \013 MGI Type 11 16926>4 string \021 MGI Type 17 169270 string .MDA MicroDesign data 16928>21 byte 48 version 2 16929>21 byte 51 version 3 169300 string .MDP MicroDesign page data 16931>21 byte 48 version 2 16932>21 byte 51 version 3 16933 16934# NIFF (Navy Interchange File Format, a modification of TIFF) images 16935# [GRR: this *must* go before TIFF] 169360 string IIN1 NIFF image data 16937!:mime image/x-niff 16938 16939# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 16940# (CIFF) file. These are apparently all little-endian. 16941# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16942# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 169430 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 16944!:mime image/x-canon-crw 16945>16 leshort x \b, version %d. 16946>14 leshort x \b%d 16947 16948# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 16949# number. Put this above the TIFF test to make sure we detect them. 16950# These are apparently all little-endian. 16951# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16952# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2 169530 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 16954!:mime image/x-canon-cr2 16955!:strength +80 16956>10 byte x \b, version %d. 16957>11 byte x \b%d 16958 16959# Fujifilm RAF RAW image files with embedded JPEG data and compressed 16960# or uncompressed CFA RAW data. Byte order: Big Endian. 16961# URL: https://libopenraw.freedesktop.org/formats/raf/ 169620 string FUJIFILMCCD-RAW Fujifilm RAF raw image data 16963!:mime image/x-fuji-raf 16964 16965# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 16966# The second word of TIFF files is the TIFF version number, 42, which has 16967# never changed. The TIFF specification recommends testing for it. 169680 string MM\x00\x2a TIFF image data, big-endian 16969!:strength +70 16970!:mime image/tiff 16971!:ext tif,tiff 16972>(4.L) use \^tiff_ifd 169730 string II\x2a\x00 TIFF image data, little-endian 16974!:mime image/tiff 16975!:strength +70 16976!:ext tif,tiff 16977>(4.l) use tiff_ifd 16978 169790 name tiff_ifd 16980>0 leshort x \b, direntries=%d 16981>2 use tiff_entry 16982 169830 name tiff_entry 16984# NewSubFileType 16985>0 leshort 0xfe 16986>>12 use tiff_entry 16987>0 leshort 0x100 16988>>4 lelong 1 16989>>>12 use tiff_entry 16990>>>8 leshort x \b, width=%d 16991>0 leshort 0x101 16992>>4 lelong 1 16993>>>8 leshort x \b, height=%d 16994>>>12 use tiff_entry 16995>0 leshort 0x102 16996>>8 leshort x \b, bps=%d 16997>>12 use tiff_entry 16998>0 leshort 0x103 16999>>4 lelong 1 \b, compression= 17000>>>8 leshort 1 \bnone 17001>>>8 leshort 2 \bhuffman 17002>>>8 leshort 3 \bbi-level group 3 17003>>>8 leshort 4 \bbi-level group 4 17004>>>8 leshort 5 \bLZW 17005>>>8 leshort 6 \bJPEG (old) 17006>>>8 leshort 7 \bJPEG 17007>>>8 leshort 8 \bdeflate 17008>>>8 leshort 9 \bJBIG, ITU-T T.85 17009>>>8 leshort 0xa \bJBIG, ITU-T T.43 17010>>>8 leshort 0x7ffe \bNeXT RLE 2-bit 17011>>>8 leshort 0x8005 \bPackBits (Macintosh RLE) 17012>>>8 leshort 0x8029 \bThunderscan RLE 17013>>>8 leshort 0x807f \bRasterPadding (CT or MP) 17014>>>8 leshort 0x8080 \bRLE (Line Work) 17015>>>8 leshort 0x8081 \bRLE (High-Res Cont-Tone) 17016>>>8 leshort 0x8082 \bRLE (Binary Line Work) 17017>>>8 leshort 0x80b2 \bDeflate (PKZIP) 17018>>>8 leshort 0x80b3 \bKodak DCS 17019>>>8 leshort 0x8765 \bJBIG 17020>>>8 leshort 0x8798 \bJPEG2000 17021>>>8 leshort 0x8799 \bNikon NEF Compressed 17022>>>8 default x 17023>>>>8 leshort x \b(unknown 0x%x) 17024>>>12 use tiff_entry 17025>0 leshort 0x106 \b, PhotometricIntepretation= 17026>>8 clear x 17027>>8 leshort 0 \bWhiteIsZero 17028>>8 leshort 1 \bBlackIsZero 17029>>8 leshort 2 \bRGB 17030>>8 leshort 3 \bRGB Palette 17031>>8 leshort 4 \bTransparency Mask 17032>>8 leshort 5 \bCMYK 17033>>8 leshort 6 \bYCbCr 17034>>8 leshort 8 \bCIELab 17035>>8 default x 17036>>>8 leshort x \b(unknown=0x%x) 17037>>12 use tiff_entry 17038# FillOrder 17039>0 leshort 0x10a 17040>>4 lelong 1 17041>>>12 use tiff_entry 17042# DocumentName 17043>0 leshort 0x10d 17044>>(8.l) string x \b, name=%s 17045>>>12 use tiff_entry 17046# ImageDescription 17047>0 leshort 0x10e 17048>>(8.l) string x \b, description=%s 17049>>>12 use tiff_entry 17050# Make 17051>0 leshort 0x10f 17052>>(8.l) string x \b, manufacturer=%s 17053>>>12 use tiff_entry 17054# Model 17055>0 leshort 0x110 17056>>(8.l) string x \b, model=%s 17057>>>12 use tiff_entry 17058# StripOffsets 17059>0 leshort 0x111 17060>>12 use tiff_entry 17061# Orientation 17062>0 leshort 0x112 \b, orientation= 17063>>8 leshort 1 \bupper-left 17064>>8 leshort 3 \blower-right 17065>>8 leshort 6 \bupper-right 17066>>8 leshort 8 \blower-left 17067>>8 leshort 9 \bundefined 17068>>8 default x 17069>>>8 leshort x \b[*%d*] 17070>>12 use tiff_entry 17071# XResolution 17072>0 leshort 0x11a 17073>>8 lelong x \b, xresolution=%d 17074>>12 use tiff_entry 17075# YResolution 17076>0 leshort 0x11b 17077>>8 lelong x \b, yresolution=%d 17078>>12 use tiff_entry 17079# ResolutionUnit 17080>0 leshort 0x128 17081>>8 leshort x \b, resolutionunit=%d 17082>>12 use tiff_entry 17083# Software 17084>0 leshort 0x131 17085>>(8.l) string x \b, software=%s 17086>>12 use tiff_entry 17087# Datetime 17088>0 leshort 0x132 17089>>(8.l) string x \b, datetime=%s 17090>>12 use tiff_entry 17091# HostComputer 17092>0 leshort 0x13c 17093>>(8.l) string x \b, hostcomputer=%s 17094>>12 use tiff_entry 17095# WhitePoint 17096>0 leshort 0x13e 17097>>12 use tiff_entry 17098# PrimaryChromaticities 17099>0 leshort 0x13f 17100>>12 use tiff_entry 17101# YCbCrCoefficients 17102>0 leshort 0x211 17103>>12 use tiff_entry 17104# YCbCrPositioning 17105>0 leshort 0x213 17106>>12 use tiff_entry 17107# ReferenceBlackWhite 17108>0 leshort 0x214 17109>>12 use tiff_entry 17110# Copyright 17111>0 leshort 0x8298 17112>>(8.l) string x \b, copyright=%s 17113>>12 use tiff_entry 17114# ExifOffset 17115>0 leshort 0x8769 17116>>12 use tiff_entry 17117# GPS IFD 17118>0 leshort 0x8825 \b, GPS-Data 17119>>12 use tiff_entry 17120 17121#>0 leshort x \b, unknown=0x%x 17122#>>12 use tiff_entry 17123 171240 string MM\x00\x2b Big TIFF image data, big-endian 17125!:mime image/tiff 171260 string II\x2b\x00 Big TIFF image data, little-endian 17127!:mime image/tiff 17128 17129# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 17130# (Greg Roelofs, newt@uchicago.edu) 17131# (Albert Cahalan, acahalan@cs.uml.edu) 17132# 17133# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ... 17134# 17135 17136# IHDR parser 171370 name png-ihdr 17138>0 belong x \b, %d x 17139>4 belong x %d, 17140>8 byte x %d-bit 17141>9 byte 0 grayscale, 17142>9 byte 2 \b/color RGB, 17143>9 byte 3 colormap, 17144>9 byte 4 gray+alpha, 17145>9 byte 6 \b/color RGBA, 17146#>10 byte 0 deflate/32K, 17147>12 byte 0 non-interlaced 17148>12 byte 1 interlaced 17149 17150# Standard PNG image. 171510 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data 17152!:mime image/png 17153!:ext png 17154!:strength +10 17155>16 use png-ihdr 17156 17157# Apple CgBI PNG image. 171580 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI 17159>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI) 17160!:mime image/png 17161!:ext png 17162!:strength +10 17163>>32 use png-ihdr 17164 17165# possible GIF replacements; none yet released! 17166# (Greg Roelofs, newt@uchicago.edu) 17167# 17168# GRR 950115: this was mine ("Zip GIF"): 171690 string GIF94z ZIF image (GIF+deflate alpha) 17170!:mime image/x-unknown 17171# 17172# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 17173# 171740 string FGF95a FGF image (GIF+deflate beta) 17175!:mime image/x-unknown 17176# 17177# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 17178# (best; not yet implemented): 17179# 171800 string PBF PBF image (deflate compression) 17181!:mime image/x-unknown 17182 17183# GIF 17184# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65) 171850 string GIF8 GIF image data 17186!:strength +80 17187!:mime image/gif 17188!:apple 8BIMGIFf 17189!:ext gif 17190>4 string 7a \b, version 8%s, 17191>4 string 9a \b, version 8%s, 17192>6 leshort >0 %d x 17193>8 leshort >0 %d 17194#>10 byte &0x80 color mapped, 17195#>10 byte&0x07 =0x00 2 colors 17196#>10 byte&0x07 =0x01 4 colors 17197#>10 byte&0x07 =0x02 8 colors 17198#>10 byte&0x07 =0x03 16 colors 17199#>10 byte&0x07 =0x04 32 colors 17200#>10 byte&0x07 =0x05 64 colors 17201#>10 byte&0x07 =0x06 128 colors 17202#>10 byte&0x07 =0x07 256 colors 17203 17204# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 17205# 1 plane, no encoding. 172060 string \361\0\100\273 CMU window manager raster image data 17207>4 lelong >0 %d x 17208>8 lelong >0 %d, 17209>12 lelong >0 %d-bit 17210 17211# Magick Image File Format 17212# URL: https://imagemagick.org/script/miff.php 17213# Reference: http://fileformats.archiveteam.org/wiki/MIFF 17214# Update: Joerg Jenderek 17215# http://www.nationalarchives.gov.uk/pronom/fmt/930 172160 search/256/bc id=imagemagick 17217# skip bad ASCII text by following new line~0x0A or space~0x20 character 17218#>&0 ubyte x \b, next character 0x%x 17219# called by TriD ImageMagick Machine independent File Format bitmap 17220>&0 ubyte&0xD5 0 MIFF image data 17221# https://reposcope.com/mimetype/image/miff 17222#!:mime image/miff 17223!:mime image/x-miff 17224!:ext miff/mif 17225# examples with standard file(1) magic 17226#>>0 string =id=ImageMagick with standard magic 17227# examples with unusual file(1) magic like 17228>>0 string !id=ImageMagick starting with 17229# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF 17230>>>0 ubyte =0x7b comment 17231# skip second character which is often a newline and show comment 17232>>>>2 string x "%s" 17233# does not start with comment, probably letters with other case like Id=ImageMagick 17234# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff 17235>>>0 ubyte !0x7b 17236>>>>0 string >\0 '%-.14s' 17237# URL: https://imagemagick.org/ 17238# Reference: https://imagemagick.org/script/magick-vector-graphics.php 17239# From: Joerg Jenderek 17240# Note: all white-spaces between commands are ignored 172410 string push 17242# skip some white spaces 17243>5 search/3 graphic-context ImageMagick Vector Graphic 17244# TODO: look for dangerous commands like CVE-2016-3715 17245#!:mime text/plain 17246!:mime image/x-mvg 17247!:ext mvg 17248 17249# Artisan 172500 long 1123028772 Artisan image data 17251>4 long 1 \b, rectangular 24-bit 17252>4 long 2 \b, rectangular 8-bit with colormap 17253>4 long 3 \b, rectangular 32-bit (24-bit with matte) 17254 17255# FIG (Facility for Interactive Generation of figures), an object-based format 172560 search/1 #FIG FIG image text 17257>5 string x \b, version %.3s 17258 17259# PHIGS 172600 string ARF_BEGARF PHIGS clear text archive 172610 string @(#)SunPHIGS SunPHIGS 17262# version number follows, in the form m.n 17263>40 string SunBin binary 17264>32 string archive archive 17265 17266# GKS (Graphics Kernel System) 172670 string GKSM GKS Metafile 17268>24 string SunGKS \b, SunGKS 17269 17270# CGM image files 172710 string BEGMF clear text Computer Graphics Metafile 17272 17273# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 172740 string yz MGR bitmap, modern format, 8-bit aligned 172750 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 172760 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 172770 string yx MGR bitmap, modern format, squeezed 17278 17279# Fuzzy Bitmap (FBM) images 172800 string %bitmap\0 FBM image data 17281>30 long 0x31 \b, mono 17282>30 long 0x33 \b, color 17283 17284# facsimile data 172851 string PC\ Research,\ Inc group 3 fax data 17286>29 byte 0 \b, normal resolution (204x98 DPI) 17287>29 byte 1 \b, fine resolution (204x196 DPI) 17288# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 172890 string Sfff structured fax file 17290 17291# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 17292# most files with the extension .EPA and some with .BMP 172930 string \x11\x06 Award BIOS Logo, 136 x 84 17294!:mime image/x-award-bioslogo 172950 string \x11\x09 Award BIOS Logo, 136 x 126 17296!:mime image/x-award-bioslogo 17297#0 string \x07\x1f BIOS Logo corrupted? 17298# http://www.blackfiveservices.co.uk/awbmtools.shtml 17299# http://biosgfx.narod.ru/v3/ 17300# http://biosgfx.narod.ru/abr-2/ 173010 string AWBM 17302>4 leshort <1981 Award BIOS bitmap 17303!:mime image/x-award-bmp 17304# image width is a multiple of 4 17305>>4 leshort&0x0003 0 17306>>>4 leshort x \b, %d 17307>>>6 leshort x x %d 17308>>4 leshort&0x0003 >0 \b, 17309>>>4 leshort&0x0003 =1 17310>>>>4 leshort x %d+3 17311>>>4 leshort&0x0003 =2 17312>>>>4 leshort x %d+2 17313>>>4 leshort&0x0003 =3 17314>>>>4 leshort x %d+1 17315>>>6 leshort x x %d 17316# at offset 8 starts imagedata followed by "RGB " marker 17317 17318# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 17319# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 17320# 28bitmap_information_header.29 17321# Note: variant starting direct with DIB header see 17322# http://fileformats.archiveteam.org/wiki/BMP 17323# verified by ImageMagick version 6.8.9-8 command `identify *.dib` 173240 leshort 40 17325# skip bad samples like GAME by looking for valid number of color planes 17326>12 uleshort 1 Device independent bitmap graphic 17327!:mime image/x-ms-bmp 17328!:apple ????BMPp 17329!:ext dib 17330>>4 lelong x \b, %d x 17331>>8 lelong x %d x 17332>>14 leshort x %d 17333# number of color planes (must be 1) 17334#>>12 uleshort >1 \b, %u color planes 17335# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D 17336#>>16 ulelong 3 \b, Huffman 1D compression 17337>>16 ulelong >0 \b, %u compression 17338# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 17339>>20 ulelong x \b, image size %u 17340# horizontal and vertical resolution of the image (pixel per metre, signed integer) 17341>>24 lelong >0 \b, resolution %d x 17342>>>28 lelong x %d px/m 17343# number of colors in palette, or 0 to default to 2**n 17344#>>32 ulelong >0 \b, %u colors 17345# number of important colors used, or 0 when every color is important 17346>>36 ulelong >0 \b, %u important colors 173470 string BM 17348>14 leshort 12 PC bitmap, OS/2 1.x format 17349!:mime image/x-ms-bmp 17350>>18 leshort x \b, %d x 17351>>20 leshort x %d 17352>14 leshort 64 PC bitmap, OS/2 2.x format 17353!:mime image/x-ms-bmp 17354!:apple ????BMPp 17355!:ext bmp 17356# image width and height fields are unsigned integers for OS/2 17357>>18 ulelong x \b, %u x 17358>>22 ulelong x %u 17359# number of bits per pixel (color depth); found 1 4 8 17360>>28 uleshort >1 x %u 17361# x, y coordinates of the hotspot 17362>>6 uleshort >0 \b, hotspot %ux 17363>>>8 uleshort x \b%u 17364>>26 uleshort >1 \b, %u color planes 17365# cbSize; size of file or headers 17366>>2 ulelong x \b, cbSize %u 17367#>>2 ulelong x \b, cbSize 0x%x 17368# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh 17369>>10 ulelong x \b, bits offset %u 17370#>>10 ulelong x \b, bits offset 0x%x 17371#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 17372# BITMAPV2INFOHEADER adds RGB bit masks 17373>14 leshort 52 PC bitmap, Adobe Photoshop 17374!:mime image/x-ms-bmp 17375!:apple ????BMPp 17376!:ext bmp 17377>>18 lelong x \b, %d x 17378>>22 lelong x %d x 17379>>28 leshort x %d 17380# BITMAPV3INFOHEADER adds alpha channel bit mask 17381>14 leshort 56 PC bitmap, Adobe Photoshop with alpha channel mask 17382!:mime image/x-ms-bmp 17383!:apple ????BMPp 17384!:ext bmp 17385>>18 lelong x \b, %d x 17386>>22 lelong x %d x 17387>>28 leshort x %d 17388>14 leshort 40 17389# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib 17390# broken for large bitmaps 17391#>>(2.l-4) ulong x PC bitmap, Windows 3.x format 17392>>14 leshort 40 PC bitmap, Windows 3.x format 17393!:mime image/x-ms-bmp 17394!:apple ????BMPp 17395>>>18 lelong x \b, %d x 17396>>>22 lelong x %d 17397# 320 x 400 https://en.wikipedia.org/wiki/LOGO.SYS 17398>>>18 ulequad =0x0000019000000140 x 17399!:ext bmp/sys 17400>>>18 ulequad !0x0000019000000140 17401# compression method 2~RLE 4-bit/pixel implies also extension rle 17402>>>>30 ulelong 2 x 17403!:ext bmp/rle 17404>>>>30 default x x 17405!:ext bmp 17406# number of bits per pixel (color depth); found 1 2 4 8 16 24 32 17407>>>28 leshort x %d 17408# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0 17409#>>>6 uleshort >0 \b, hotspot %ux 17410#>>>>8 uleshort x \b%u 17411# number of color planes (must be 1), except badplanes.bmp for testing 17412#>>>26 uleshort >1 \b, %u color planes 17413# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks 17414#>>>30 ulelong 3 \b, Huffman 1D compression 17415>>>30 ulelong >0 \b, %u compression 17416# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 17417>>>34 ulelong >0 \b, image size %u 17418# horizontal and vertical resolution of the image (pixel per metre, signed integer) 17419>>>38 lelong >0 \b, resolution %d x 17420>>>>42 lelong x %d px/m 17421# number of colors in palette 16 256, or 0 to default to 2**n 17422#>>>46 ulelong >0 \b, %u colors 17423# number of important colors used, or 0 when every color is important 17424>>>50 ulelong >0 \b, %u important colors 17425# cbSize; often size of file 17426>>>2 ulelong x \b, cbSize %u 17427#>>>2 ulelong x \b, cbSize 0x%x 17428# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h 17429>>>10 ulelong x \b, bits offset %u 17430#>>>10 ulelong x \b, bits offset 0x%x 17431#>>>(10.l) ubequad !0 \b, bits 0x%16.16llxd 17432>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 17433!:mime image/x-ms-bmp 17434>>18 lelong x \b, %d x 17435>>22 lelong x %d x 17436>>28 leshort x %d 17437>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 17438!:mime image/x-ms-bmp 17439>>18 lelong x \b, %d x 17440>>22 lelong x %d x 17441>>28 leshort x %d 17442>14 leshort 128 PC bitmap, Windows NT/2000 format 17443!:mime image/x-ms-bmp 17444>>18 lelong x \b, %d x 17445>>22 lelong x %d x 17446>>28 leshort x %d 17447# Update: Joerg Jenderek 17448# URL: http://fileformats.archiveteam.org/wiki/OS/2_Icon 17449# Reference: http://www.fileformat.info 17450# /format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm 17451# Note: verified by command like `deark -l -d3 OS2MEMU.ICO` 174520 string IC 17453# skip Lotus smart icon *.smi by looking for valid hotspot coordinates 17454>6 ulelong&0xFF00FF00 =0 OS/2 icon 17455# jump 4 bytes before end of header/file and test for accessibility 17456#>>(2.l-4) ubelong x End of header is OK! 17457!:mime image/x-os2-ico 17458!:ext ico 17459# cbSize; size of header or file in bytes like 1ah 120h 420h 17460>>2 ulelong x \b, cbSize %u 17461# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32 17462>>6 uleshort x \b, hotspot %ux 17463>>8 uleshort x \b%u 17464# offBits; offset in bytes to the beginning of the bit-map pel data like 20h 17465>>10 ulelong x \b, bits offset %u 17466#>>(10.l) ubequad x \b, bits 0x%16.16llx 17467#0 string PI PC pointer image data 17468#0 string CI PC color icon data 174690 string CI 17470# test also for valid dib header sizes 12 or 64 17471>14 ulelong <65 OS/2 17472# test also for valid hotspot coordinates 17473#>>6 ulelong&0xFE00FE00 =0 OS/2 17474!:mime image/x-os2-ico 17475!:ext ico 17476>>14 ulelong 12 1.x color icon 17477# image width and height fields are unsigned integers for OS/2 17478>>>18 uleshort x %u x 17479# stored height = 2 * real height 17480>>>20 uleshort/2 x %u 17481# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 17482>>>24 uleshort >1 x %u 17483# color planes; must be 1 17484#>>>22 uleshort >1 \b, %u color planes 17485>>14 ulelong 64 2.x color icon 17486# image width and height 17487>>>18 ulelong x %u x 17488# stored height = 2 * real height 17489>>>22 ulelong/2 x %u 17490# number of bits per pixel (color depth). only 1 found 17491>>>28 uleshort >1 x %u 17492#>>>26 uleshort >1 \b, %u color planes 17493# compression method: 0~no 3~Huffman 1D 17494>>>30 ulelong 3 \b, Huffman 1D compression 17495#>>>30 ulelong >0 \b, %u compression 17496# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64 17497>>6 uleshort x \b, hotspot %ux 17498>>8 uleshort x \b%u 17499# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh 17500>>2 ulelong x \b, cbSize %u 17501#>>2 ulelong x \b, cbSize %x 17502# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h 17503>>10 ulelong x \b, bits offset %u 17504#>>10 ulelong x \b, bits offset 0x%x 17505#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 17506# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 17507#>>14 ulelong x \b, dib header size %u 17508#0 string CP PC color pointer image data 17509# URL: http://fileformats.archiveteam.org/wiki/OS/2_Pointer 17510# Reference: http://www.fileformat.info/format/os2bmp/egff.htm 175110 string CP 17512# skip many Corel Photo-Paint image "CPT9FILE" by checking for positive bits offset 17513>10 ulelong >0 17514# skip CPU-Z Report by checking for valid dib header sizes 12 or 64 17515>>14 ulelong =12 17516>>>0 use os2-ptr 17517>>14 ulelong =64 17518>>>0 use os2-ptr 17519# display information of OS/2 pointer bitmaps 175200 name os2-ptr 17521>14 ulelong x OS/2 17522# http://extension.nirsoft.net/PTR 17523!:mime image/x-ibm-pointer 17524!:ext ptr 17525>>14 ulelong 12 1.x color pointer 17526# image width and height fields are unsigned integers for OS/2 17527>>>18 uleshort x %u x 17528# stored height = 2 * real height 17529>>>20 uleshort/2 x %u 17530# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 17531>>>24 uleshort >1 x %u 17532# color planes; must be 1 17533#>>>22 uleshort >1 \b, %u color planes 17534>>14 ulelong 64 2.x color pointer 17535# image width and height 17536>>>18 ulelong x %u x 17537# stored height = 2 * real height 17538>>>22 ulelong/2 x %u 17539# number of bits per pixel (color depth). only 1 found 17540>>>28 uleshort >1 x %u 17541#>>>26 uleshort >1 \b, %u color planes 17542# compression method: 0~no 3~Huffman 1D 17543>>>30 ulelong 3 \b, Huffman 1D compression 17544#>>>30 ulelong >0 \b, %u compression 17545# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31 17546>>6 uleshort x \b, hotspot %ux 17547>>8 uleshort x \b%u 17548# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 17549>>2 ulelong x \b, cbSize %u 17550#>>2 ulelong x \b, cbSize %x 17551# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h 17552>>10 ulelong x \b, bits offset %u 17553#>>10 ulelong x \b, bits offset 0x%x 17554#>>(10.l) ubequad !0 \b, bits 0x%16.16llx 17555# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 17556#>>14 ulelong x \b, dib header size %u 17557# Conflicts with other entries [BABYL] 17558# URL: http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array 17559# Note: container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM" 17560#0 string BA PC bitmap array data 175610 string BA 17562# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size 17563>2 ulelong <0x004c5942 OS/2 graphic array 17564!:mime image/x-os2-graphics 17565#!:apple ????BMPf 17566# cbSize; size of header like 28h 5Ch 17567>>2 ulelong x \b, cbSize %u 17568#>>2 ulelong x \b, cbSize 0x%x 17569# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h 17570>>6 ulelong >0 \b, data offset %u 17571#>>6 ulelong >0 \b, data offset 0x%x 17572#>>(6.l) ubequad !0 \b, data 0x%16.16llx 17573# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768 17574>>10 uleshort >0 \b, display %u 17575>>>12 uleshort >0 x %u 17576# usType of first array element 17577#>>14 string x \b, usType %2.2s 17578# 1 space char after "1st" 17579# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342 17580>>14 string BM \b; 1st 17581!:ext bmp/bga 17582>>14 string CI \b; 1st 17583!:ext ico 17584>>14 string CP \b; 1st 17585!:ext ico 17586>>14 string IC \b; 1st 17587!:ext ico 17588# no white-black pointer found 17589#>>14 string PT \b; 1st 17590#!:ext 17591>>14 indirect x 17592 17593# XPM icons (Greg Roelofs, newt@uchicago.edu) 175940 search/1 /*\ XPM\ */ X pixmap image text 17595!:mime image/x-xpmi 17596 17597# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 175980 leshort 0xcc52 RLE image data, 17599>6 leshort x %d x 17600>8 leshort x %d 17601>2 leshort >0 \b, lower left corner: %d 17602>4 leshort >0 \b, lower right corner: %d 17603>10 byte&0x1 =0x1 \b, clear first 17604>10 byte&0x2 =0x2 \b, no background 17605>10 byte&0x4 =0x4 \b, alpha channel 17606>10 byte&0x8 =0x8 \b, comment 17607>11 byte >0 \b, %d color channels 17608>12 byte >0 \b, %d bits per pixel 17609>13 byte >0 \b, %d color map channels 17610 17611# image file format (Robert Potter, potter@cs.rochester.edu) 176120 string Imagefile\ version- iff image data 17613# this adds the whole header (inc. version number), informative but longish 17614>10 string >\0 %s 17615 17616# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 176170 belong 0x59a66a95 Sun raster image data 17618>4 belong >0 \b, %d x 17619>8 belong >0 %d, 17620>12 belong >0 %d-bit, 17621#>16 belong >0 %d bytes long, 17622>20 belong 0 old format, 17623#>20 belong 1 standard, 17624>20 belong 2 compressed, 17625>20 belong 3 RGB, 17626>20 belong 4 TIFF, 17627>20 belong 5 IFF, 17628>20 belong 0xffff reserved for testing, 17629>24 belong 0 no colormap 17630>24 belong 1 RGB colormap 17631>24 belong 2 raw colormap 17632#>28 belong >0 colormap is %d bytes long 17633 17634# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 17635# 17636# See 17637# http://reality.sgi.com/grafica/sgiimage.html 17638# 176390 beshort 474 SGI image data 17640#>2 byte 0 \b, verbatim 17641>2 byte 1 \b, RLE 17642#>3 byte 1 \b, normal precision 17643>3 byte 2 \b, high precision 17644>4 beshort x \b, %d-D 17645>6 beshort x \b, %d x 17646>8 beshort x %d 17647>10 beshort x \b, %d channel 17648>10 beshort !1 \bs 17649>80 string >0 \b, "%s" 17650 176510 string IT01 FIT image data 17652>4 belong x \b, %d x 17653>8 belong x %d x 17654>12 belong x %d 17655# 176560 string IT02 FIT image data 17657>4 belong x \b, %d x 17658>8 belong x %d x 17659>12 belong x %d 17660# 176612048 string PCD_IPI Kodak Photo CD image pack file 17662>0xe02 byte&0x03 0x00 , landscape mode 17663>0xe02 byte&0x03 0x01 , portrait mode 17664>0xe02 byte&0x03 0x02 , landscape mode 17665>0xe02 byte&0x03 0x03 , portrait mode 176660 string PCD_OPA Kodak Photo CD overview pack file 17667 17668# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 17669# FITS is the Flexible Image Transport System, the de facto standard for 17670# data and image transfer, storage, etc., for the astronomical community. 17671# (FITS floating point formats are big-endian.) 176720 string SIMPLE\ \ = FITS image data 17673!:mime image/fits 17674!:ext fits/fts 17675>109 string 8 \b, 8-bit, character or unsigned binary integer 17676>108 string 16 \b, 16-bit, two's complement binary integer 17677>107 string \ 32 \b, 32-bit, two's complement binary integer 17678>107 string -32 \b, 32-bit, floating point, single precision 17679>107 string -64 \b, 64-bit, floating point, double precision 17680 17681# other images 176820 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 17683 17684# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 17685# stuff. 17686# 176870 beshort 0x1010 PEX Binary Archive 17688 17689# DICOM medical imaging data 17690# URL: https://en.wikipedia.org/wiki/DICOM#Data_format 17691# Note: "dcm" is the official file name extension 17692# XnView mention also "dc3" and "acr" as file name extension 17693128 string DICM DICOM medical imaging data 17694!:mime application/dicom 17695!:ext dcm/dicom/dic 17696 17697# XWD - X Window Dump file. 17698# As described in /usr/X11R6/include/X11/XWDFile.h 17699# used by the xwd program. 17700# Bradford Castalia, idaeim, 1/01 17701# updated by Adam Buchbinder, 2/09 17702# The following assumes version 7 of the format; the first long is the length 17703# of the header, which is at least 25 4-byte longs, and the one at offset 8 17704# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 17705# which is a maximum of 32. 177060 belong >100 17707>8 belong <3 17708>>12 belong <33 17709>>>4 belong 7 XWD X Window Dump image data 17710!:mime image/x-xwindowdump 17711>>>>100 string >\0 \b, "%s" 17712>>>>16 belong x \b, %dx 17713>>>>20 belong x \b%dx 17714>>>>12 belong x \b%d 17715 17716# PDS - Planetary Data System 17717# These files use Parameter Value Language in the header section. 17718# Unfortunately, there is no certain magic, but the following 17719# strings have been found to be most likely. 177200 string NJPL1I00 PDS (JPL) image data 177212 string NJPL1I PDS (JPL) image data 177220 string CCSD3ZF PDS (CCSD) image data 177232 string CCSD3Z PDS (CCSD) image data 177240 string PDS_ PDS image data 177250 string LBLSIZE= PDS (VICAR) image data 17726 17727# pM8x: ATARI STAD compressed bitmap format 17728# 17729# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 17730# p M 8 5/6 xx yy zz data... 17731# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 17732# bytes either run horizontally (pM85) or vertically (pM86). yy is the 17733# most frequent byte, xx and zz are runlength escape codes, where xx is 17734# used for runs of yy. 17735# 177360 string pM85 Atari ST STAD bitmap image data (hor) 17737>5 byte 0x00 (white background) 17738>5 byte 0xFF (black background) 177390 string pM86 Atari ST STAD bitmap image data (vert) 17740>5 byte 0x00 (white background) 17741>5 byte 0xFF (black background) 17742 17743# From: Alex Myczko <alex@aiei.ch> 17744# https://www.atarimax.com/jindroush.atari.org/afmtatr.html 177450 leshort 0x0296 Atari ATR image 17746 17747# XXX: 17748# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 17749# magic. 17750# SGI RICE image file <mpruett@sgi.com> 17751#0 beshort 0x5249 RICE image 17752#>2 beshort x v%d 17753#>4 beshort x (%d x 17754#>6 beshort x %d) 17755#>8 beshort 0 8 bit 17756#>8 beshort 1 10 bit 17757#>8 beshort 2 12 bit 17758#>8 beshort 3 13 bit 17759#>10 beshort 0 4:2:2 17760#>10 beshort 1 4:2:2:4 17761#>10 beshort 2 4:4:4 17762#>10 beshort 3 4:4:4:4 17763#>12 beshort 1 RGB 17764#>12 beshort 2 CCIR601 17765#>12 beshort 3 RP175 17766#>12 beshort 4 YUV 17767 17768# PCX image files 17769# From: Dan Fandrich <dan@coneharvesters.com> 17770# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX 17771# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 17772# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 17773# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 177740 ubelong&0xffF8fe00 0x0a000000 17775# for PCX bit depth > 0 17776>3 ubyte >0 17777# test for valid versions 17778>>1 ubyte <6 17779>>>1 ubyte !1 PCX 17780!:mime image/x-pcx 17781#!:mime image/pcx 17782>>>>1 ubyte 0 ver. 2.5 image data 17783>>>>1 ubyte 2 ver. 2.8 image data, with palette 17784>>>>1 ubyte 3 ver. 2.8 image data, without palette 17785>>>>1 ubyte 4 for Windows image data 17786>>>>1 ubyte 5 ver. 3.0 image data 17787>>>>4 uleshort x bounding box [%d, 17788>>>>6 uleshort x %d] - 17789>>>>8 uleshort x [%d, 17790>>>>10 uleshort x %d], 17791>>>>65 ubyte >1 %d planes each of 17792>>>>3 ubyte x %d-bit 17793>>>>68 byte 1 colour, 17794>>>>68 byte 2 grayscale, 17795# this should not happen 17796>>>>68 default x image, 17797>>>>12 leshort >0 %d x 17798>>>>>14 uleshort x %d dpi, 17799>>>>2 byte 0 uncompressed 17800>>>>2 byte 1 RLE compressed 17801 17802# Adobe Photoshop 17803# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 178040 string 8BPS Adobe Photoshop Image 17805!:mime image/vnd.adobe.photoshop 17806!:ext psd 17807>4 beshort 2 (PSB) 17808>18 belong x \b, %d x 17809>14 belong x %d, 17810>24 beshort 0 bitmap 17811>24 beshort 1 grayscale 17812>>12 beshort 2 with alpha 17813>24 beshort 2 indexed 17814>24 beshort 3 RGB 17815>>12 beshort 4 \bA 17816>24 beshort 4 CMYK 17817>>12 beshort 5 \bA 17818>24 beshort 7 multichannel 17819>24 beshort 8 duotone 17820>24 beshort 9 lab 17821>12 beshort > 1 17822>>12 beshort x \b, %dx 17823>12 beshort 1 \b, 17824>22 beshort x %d-bit channel 17825>12 beshort > 1 \bs 17826 17827# XV thumbnail indicator (ThMO) 17828# URL: https://en.wikipedia.org/wiki/Xv_(software) 17829# Reference: http://fileformats.archiveteam.org/wiki/XV_thumbnail 17830# Update: Joerg Jenderek 178310 string P7\ 332 XV thumbnail image data 17832#0 string P7\ 332 XV "thumbnail file" (icon) data 17833!:mime image/x-xv-thumbnail 17834# thumbnail .xvpic/foo.bar for graphic foo.bar 17835!:ext p7/gif/tif/xpm/jpg 17836 17837# NITF is defined by United States MIL-STD-2500A 178380 string NITF National Imagery Transmission Format 17839>25 string >\0 dated %.14s 17840 17841# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 17842# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 17843# Update: Joerg Jenderek 17844# See http://fileformats.archiveteam.org/wiki/GEM_Raster 17845# For variations, also see: 17846# https://www.seasip.info/Gem/ff_img.html (Ventura) 17847# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 17848# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 17849# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 178500 beshort 0x0001 17851# header_size 17852>2 beshort 0x0008 17853>>0 use gem_info 17854>2 beshort 0x0009 17855>>0 use gem_info 17856# no example for NOSIG 17857>2 beshort 24 17858>>0 use gem_info 17859# no example for HYPERPAINT 17860>2 beshort 25 17861>>0 use gem_info 1786216 string XIMG\0 17863>0 use gem_info 17864# no example 1786516 string STTT\0\x10 17866>0 use gem_info 17867# no example or description 1786816 string TIMG\0 17869>0 use gem_info 17870 178710 name gem_info 17872# version is 2 for some XIMG and 1 for all others 17873>0 beshort <0x0003 GEM 17874# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt 17875!:mime image/x-gem 17876# header_size 24 25 27 59 779 words for colored bitmaps 17877>>2 beshort >9 17878>>>16 string STTT\0\x10 STTT 17879>>>16 string TIMG\0 TIMG 17880# HYPERPAINT or NOSIG variant 17881>>>16 string \0\x80 17882>>>>2 beshort =24 NOSIG 17883>>>>2 beshort !24 HYPERPAINT 17884# NOSIG or XIMG variant 17885>>>16 default x 17886>>>>16 string !XIMG\0 NOSIG 17887>>16 string =XIMG\0 XIMG Image data 17888!:ext img/ximg 17889# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type 17890>>16 string !XIMG\0 Image data 17891!:ext img 17892# header_size is 9 for Ventura files and 8 for other GEM Paint files 17893>>2 beshort 9 (Ventura) 17894#>>2 beshort 8 (Paint) 17895>>12 beshort x %d x 17896>>14 beshort x %d, 17897# 1 4 8 17898>>4 beshort x %d planes, 17899# in tenths of a millimetre 17900>>8 beshort x %d x 17901>>10 beshort x %d pixelsize 17902# pattern_size 1-8. 2 for GEM Paint 17903>>6 beshort !2 \b, pattern size %d 17904 17905# GEM Metafile (Wolfram Kleff) 179060 lelong 0x0018FFFF GEM Metafile data 17907>4 leshort x version %d 17908 17909# 17910# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 17911# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 17912# 179130 string \0\nSMJPEG SMJPEG 17914>8 belong x %d.x data 17915# According to the specification you could find any number of _TXT 17916# headers here, but I can't think of any way of handling that. None of 17917# the SMJPEG files I tried it on used this feature. Even if such a 17918# file is encountered the output should still be reasonable. 17919>16 string _SND \b, 17920>>24 beshort >0 %d Hz 17921>>26 byte 8 8-bit 17922>>26 byte 16 16-bit 17923>>28 string NONE uncompressed 17924# >>28 string APCM ADPCM compressed 17925>>27 byte 1 mono 17926>>28 byte 2 stereo 17927# Help! Isn't there any way to avoid writing this part twice? 17928>>32 string _VID \b, 17929# >>>48 string JFIF JPEG 17930>>>40 belong >0 %d frames 17931>>>44 beshort >0 (%d x 17932>>>46 beshort >0 %d) 17933>16 string _VID \b, 17934# >>32 string JFIF JPEG 17935>>24 belong >0 %d frames 17936>>28 beshort >0 (%d x 17937>>30 beshort >0 %d) 17938 179390 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 17940 17941# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 179420 string KiSS KISS/GS 17943>4 byte 16 color 17944>>5 byte x %d bit 17945>>8 leshort x %d colors 17946>>10 leshort x %d groups 17947>4 byte 32 cell 17948>>5 byte x %d bit 17949>>8 leshort x %d x 17950>>10 leshort x %d 17951>>12 leshort x +%d 17952>>14 leshort x +%d 17953 17954# Webshots (www.webshots.com), by John Harrison 179550 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 17956 17957# Hercules DASD image files 17958# From Jan Jaeger <jj@septa.nl> 179590 string CKD_P370 Hercules CKD DASD image file 17960>8 long x \b, %d heads per cylinder 17961>12 long x \b, track size %d bytes 17962>16 byte x \b, device type 33%2.2X 17963 179640 string CKD_C370 Hercules compressed CKD DASD image file 17965>8 long x \b, %d heads per cylinder 17966>12 long x \b, track size %d bytes 17967>16 byte x \b, device type 33%2.2X 17968 179690 string CKD_S370 Hercules CKD DASD shadow file 17970>8 long x \b, %d heads per cylinder 17971>12 long x \b, track size %d bytes 17972>16 byte x \b, device type 33%2.2X 17973 17974# Squeak images and programs - etoffi@softhome.net 179750 string \146\031\0\0 Squeak image data 179760 search/1 'From\040Squeak Squeak program text 17977 17978# partimage: file(1) magic for PartImage files (experimental, incomplete) 17979# Author: Hans-Joachim Baader <hjb@pro-linux.de> 179800 string PaRtImAgE-VoLuMe PartImage 17981>0x0020 string 0.6.1 file version %s 17982>>0x0060 lelong >-1 volume %d 17983#>>0x0064 8 byte identifier 17984#>>0x007c reserved 17985>>0x0200 string >\0 type %s 17986>>0x1400 string >\0 device %s, 17987>>0x1600 string >\0 original filename %s, 17988# Some fields omitted 17989>>0x2744 lelong 0 not compressed 17990>>0x2744 lelong 1 gzip compressed 17991>>0x2744 lelong 2 bzip2 compressed 17992>>0x2744 lelong >2 compressed with unknown algorithm 17993>0x0020 string >0.6.1 file version %s 17994>0x0020 string <0.6.1 file version %s 17995 17996# DCX is multi-page PCX, using a simple header of up to 1024 17997# offsets for the respective PCX components. 17998# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 179990 lelong 987654321 DCX multi-page PCX image data 18000 18001# Simon Walton <simonw@matteworld.com> 18002# Kodak Cineon format for scanned negatives 18003# http://www.kodak.com/US/en/motion/support/dlad/ 180040 lelong 0xd75f2a80 Cineon image data 18005>200 belong >0 \b, %d x 18006>204 belong >0 %d 18007 18008 18009# Bio-Rad .PIC is an image format used by microscope control systems 18010# and related image processing software used by biologists. 18011# From: Vebjorn Ljosa <vebjorn@ljosa.com> 18012# BOOL values are two-byte integers; use them to rule out false positives. 18013# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 18014# Samples: https://www.loci.wisc.edu/software/sample-data 1801514 leshort <2 18016>62 leshort <2 18017>>54 leshort 12345 Bio-Rad .PIC Image File 18018>>>0 leshort >0 %d x 18019>>>2 leshort >0 %d, 18020>>>4 leshort =1 1 image in file 18021>>>4 leshort >1 %d images in file 18022 18023# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 18024# The description of *.mrw format can be found at 18025# http://www.dalibor.cz/minolta/raw_file_format.htm 180260 string \000MRM Minolta Dimage camera raw image data 18027 18028# Summary: DjVu image / document 18029# Extension: .djvu 18030# Reference: http://djvu.org/docs/DjVu3Spec.djvu 18031# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 18032# Modified by (1): Abel Cheung <abelcheung@gmail.com> 180330 string AT&TFORM 18034>12 string DJVM DjVu multiple page document 18035!:mime image/vnd.djvu 18036>12 string DJVU DjVu image or single page document 18037!:mime image/vnd.djvu 18038>12 string DJVI DjVu shared document 18039!:mime image/vnd.djvu 18040>12 string THUM DjVu page thumbnails 18041!:mime image/vnd.djvu 18042 18043# Originally by Marc Espie 18044# Modified by Robert Minsk <robertminsk at yahoo.com> 18045# https://www.openexr.com/openexrfilelayout.pdf 180460 lelong 20000630 OpenEXR image data, 18047!:mime image/x-exr 18048>4 lelong&0x000000ff x version %d, 18049>4 lelong ^0x00000200 storage: scanline 18050>4 lelong &0x00000200 storage: tiled 18051>8 search/0x1000 compression\0 \b, compression: 18052>>&16 byte 0 none 18053>>&16 byte 1 rle 18054>>&16 byte 2 zips 18055>>&16 byte 3 zip 18056>>&16 byte 4 piz 18057>>&16 byte 5 pxr24 18058>>&16 byte 6 b44 18059>>&16 byte 7 b44a 18060>>&16 byte 8 dwaa 18061>>&16 byte 9 dwab 18062>>&16 byte >9 unknown 18063>8 search/0x1000 dataWindow\0 \b, dataWindow: 18064>>&10 lelong x (%d 18065>>&14 lelong x %d)- 18066>>&18 lelong x \b(%d 18067>>&22 lelong x %d) 18068>8 search/0x1000 displayWindow\0 \b, displayWindow: 18069>>&10 lelong x (%d 18070>>&14 lelong x %d)- 18071>>&18 lelong x \b(%d 18072>>&22 lelong x %d) 18073>8 search/0x1000 lineOrder\0 \b, lineOrder: 18074>>&14 byte 0 increasing y 18075>>&14 byte 1 decreasing y 18076>>&14 byte 2 random y 18077>>&14 byte >2 unknown 18078 18079# SMPTE Digital Picture Exchange Format, SMPTE DPX 18080# 18081# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 18082# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 18083# Robert Minsk <robertminsk at yahoo.com> 18084# Modified by Harry Mallon <hjmallon at gmail.com> 180850 string SDPX DPX image data, big-endian, 18086!:mime image/x-dpx 18087>0 use dpx_info 180880 string XPDS DPX image data, little-endian, 18089!:mime image/x-dpx 18090>0 use \^dpx_info 18091 180920 name dpx_info 18093>768 beshort <4 18094>>772 belong x %dx 18095>>776 belong x \b%d, 18096>768 beshort >3 18097>>776 belong x %dx 18098>>772 belong x \b%d, 18099>768 beshort 0 left to right/top to bottom 18100>768 beshort 1 right to left/top to bottom 18101>768 beshort 2 left to right/bottom to top 18102>768 beshort 3 right to left/bottom to top 18103>768 beshort 4 top to bottom/left to right 18104>768 beshort 5 top to bottom/right to left 18105>768 beshort 6 bottom to top/left to right 18106>768 beshort 7 bottom to top/right to left 18107 18108# From: Tom Hilinski <tom.hilinski@comcast.net> 18109# https://www.unidata.ucar.edu/packages/netcdf/ 181100 string CDF\001 NetCDF Data Format data 18111# 64-bit offset netcdf Classic https://www.unidata.ucar.edu/software/netcdf/docs/file_format_specifications 181120 string CDF\002 NetCDF Data Format data (64-bit offset) 18113 18114#----------------------------------------------------------------------- 18115# Hierarchical Data Format, used to facilitate scientific data exchange 18116# specifications at http://hdf.ncsa.uiuc.edu/ 181170 belong 0x0e031301 Hierarchical Data Format (version 4) data 18118!:mime application/x-hdf 181190 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 18120!:mime application/x-hdf 18121512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 18122!:mime application/x-hdf 181231024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 18124!:mime application/x-hdf 181252048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 18126!:mime application/x-hdf 181274096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 18128!:mime application/x-hdf 18129 18130 18131# From: Tobias Burnus <burnus@net-b.de> 18132# Xara (for a while: Corel Xara) is a graphic package, see 18133# http://www.xara.com/ for Windows and as GPL application for Linux 181340 string XARA\243\243 Xara graphics file 18135 18136# From: Joerg Jenderek 18137# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 18138# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bmf-corel.trid.xml 18139# Note: called "Corel Binary Material Format" by TrID and 18140# "Corel Flow" by XnView 181410 string @CorelBMF\n\rCorel\040Corporation Corel GALLERY Clipart 18142!:mime image/x-corel-bmf 18143!:ext bmf 18144 18145# https://www.cartesianinc.com/Tech/ 18146# Reference: http://fileformats.archiveteam.org/wiki/Cartesian_Perceptual_Compression 181470 string CPC\262 Cartesian Perceptual Compression image 18148!:mime image/x-cpi 18149!:ext cpi/cpc 18150 18151# From Albert Cahalan <acahalan@gmail.com> 18152# puredigital used it for the CVS disposable camcorder 18153#8 lelong 4 ZBM bitmap image data 18154#>4 leshort x %u x 18155#>6 leshort x %u 18156 18157# From Albert Cahalan <acahalan@gmail.com> 18158# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 181590 string C565 OLPC firmware icon image data 18160>4 leshort x %u x 18161>6 leshort x %u 18162 18163# Applied Images - Image files from Cytovision 18164# Gustavo Junior Alves <gjalves@gjalves.com.br> 181650 string \xce\xda\xde\xfa Cytovision Metaphases file 181660 string \xed\xad\xef\xac Cytovision Karyotype file 181670 string \x0b\x00\x03\x00 Cytovision FISH Probe file 181680 string \xed\xfe\xda\xbe Cytovision FLEX file 181690 string \xed\xab\xed\xfe Cytovision FLEX file 181700 string \xad\xfd\xea\xad Cytovision RATS file 18171 18172# Wavelet Scalar Quantization format used in gray-scale fingerprint images 18173# From Tano M Fotang <mfotang@quanteq.com> 181740 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 18175 18176# Type: PCO B16 image files 18177# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 18178# From: Florian Philipp <florian.philipp@binarywings.net> 18179# Extension: .b16 18180# Description: Pixel image format produced by PCO Camware, typically used 18181# together with PCO cameras. 18182# Note: Different versions exist for e.g. 8 bit and 16 bit images. 18183# Documentation is incomplete. 181840 string/b PCO- PCO B16 image data 18185>12 lelong x \b, %dx 18186>16 lelong x \b%d 18187>20 lelong 0 \b, short header 18188>20 lelong -1 \b, extended header 18189>>24 lelong 0 \b, grayscale 18190>>>36 lelong 0 linear LUT 18191>>>36 lelong 1 logarithmic LUT 18192>>>28 lelong x [%d 18193>>>32 lelong x \b,%d] 18194>>24 lelong 1 \b, color 18195>>>64 lelong 0 linear LUT 18196>>>64 lelong 1 logarithmic LUT 18197>>>40 lelong x r[%d 18198>>>44 lelong x \b,%d] 18199>>>48 lelong x g[%d 18200>>>52 lelong x \b,%d] 18201>>>56 lelong x b[%d 18202>>>60 lelong x \b,%d] 18203 18204# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 18205# From: Markus Heidelberg <markus.heidelberg at web.de> 182060 string/t [BitmapInfo2] Polar Monitor Bitmap text 18207!:mime image/x-polar-monitor-bitmap 18208 18209# From: Rick Richardson <rickrich@gmail.com> 18210# updated by: Joerg Jenderek 18211# URL: http://techmods.net/nuvi/ 182120 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 18213# extension is also used for 18214# Sony SRF raw image (image/x-sony-srf) 18215# SRF map 18216# Terragen Surface Map (https://www.planetside.co.uk/terragen) 18217# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro) 18218!:ext srf 18219#!:mime image/x-garmin-srf 18220# version 1.00,2.00,2.10,2.40,2.50 18221>0x2f string >0 \b, version %4.4s 18222# width (2880,2881,3240) 18223>0x55 uleshort >0 \b, %dx 18224# height (80,90) 18225>>0x53 uleshort x \b%d 18226 18227# Type: Ulead Photo Explorer5 (.pe5) 18228# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 18229# From: Simon Horman <horms@debian.org> 182300 string IIO2H Ulead Photo Explorer5 18231 18232# Type: X11 cursor 18233# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 18234# From: Mathias Brodala <info@noctus.net> 182350 string Xcur X11 cursor 18236 18237# Type: Olympus ORF raw images. 18238# URL: https://libopenraw.freedesktop.org/wiki/Olympus_ORF 18239# From: Adam Buchbinder <adam.buchbinder@gmail.com> 182400 string MMOR Olympus ORF raw image data, big-endian 18241!:mime image/x-olympus-orf 182420 string IIRO Olympus ORF raw image data, little-endian 18243!:mime image/x-olympus-orf 182440 string IIRS Olympus ORF raw image data, little-endian 18245!:mime image/x-olympus-orf 18246 18247# Type: files used in modern AVCHD camcoders to store clip information 18248# Extension: .cpi 18249# From: Alexander Danilov <alexander.a.danilov@gmail.com> 182500 string HDMV0100 AVCHD Clip Information 18251 18252# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18253# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 18254# Radiance HDR; usually has .pic or .hdr extension. 182550 string #?RADIANCE\n Radiance HDR image data 18256#!mime image/vnd.radiance 18257 18258# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18259# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 18260# Used by the pfstools packages. The regex matches for the image size could 18261# probably use some work. The MIME type is made up; if there's one in 18262# actual common use, it should replace the one below. 182630 string PFS1\x0a PFS HDR image data 18264#!mime image/x-pfs 18265>1 regex [0-9]*\ \b, %s 18266>>1 regex \ [0-9]{4} \bx%s 18267 18268# Type: Foveon X3F 18269# URL: https://www.photofo.com/downloads/x3f-raw-format.pdf 18270# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18271# Note that the MIME type isn't defined anywhere that I can find; if 18272# there's a canonical type for this format, it should replace this one. 182730 string FOVb Foveon X3F raw image data 18274!:mime image/x-x3f 18275>6 leshort x \b, version %d. 18276>4 leshort x \b%d 18277>28 lelong x \b, %dx 18278>32 lelong x \b%d 18279 18280# Paint.NET file 18281# From Adam Buchbinder <adam.buchbinder@gmail.com> 182820 string PDN3 Paint.NET image data 18283!:mime image/x-paintnet 18284 18285# Not really an image. 18286# From: "Tano M. Fotang" <mfotang@quanteq.com> 182870 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 18288 18289# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 18290# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 1829190 bequad 0x574D50484F544F00 JPEG-XR Image 18292>98 byte&0x08 =0x08 \b, hard tiling 18293>99 byte&0x80 =0x80 \b, tiling present 18294>99 byte&0x40 =0x40 \b, codestream present 18295>99 byte&0x38 x \b, spatial xform= 18296>99 byte&0x38 0x00 \bTL 18297>99 byte&0x38 0x08 \bBL 18298>99 byte&0x38 0x10 \bTR 18299>99 byte&0x38 0x18 \bBR 18300>99 byte&0x38 0x20 \bBT 18301>99 byte&0x38 0x28 \bRB 18302>99 byte&0x38 0x30 \bLT 18303>99 byte&0x38 0x38 \bLB 18304>100 byte&0x80 =0x80 \b, short header 18305>>102 beshort+1 x \b, %d 18306>>104 beshort+1 x \bx%d 18307>100 byte&0x80 =0x00 \b, long header 18308>>102 belong+1 x \b, %x 18309>>106 belong+1 x \bx%x 18310>101 beshort&0xf x \b, bitdepth= 18311>>101 beshort&0xf 0x0 \b1-WHITE=1 18312>>101 beshort&0xf 0x1 \b8 18313>>101 beshort&0xf 0x2 \b16 18314>>101 beshort&0xf 0x3 \b16-SIGNED 18315>>101 beshort&0xf 0x4 \b16-FLOAT 18316>>101 beshort&0xf 0x5 \b(reserved 5) 18317>>101 beshort&0xf 0x6 \b32-SIGNED 18318>>101 beshort&0xf 0x7 \b32-FLOAT 18319>>101 beshort&0xf 0x8 \b5 18320>>101 beshort&0xf 0x9 \b10 18321>>101 beshort&0xf 0xa \b5-6-5 18322>>101 beshort&0xf 0xb \b(reserved %d) 18323>>101 beshort&0xf 0xc \b(reserved %d) 18324>>101 beshort&0xf 0xd \b(reserved %d) 18325>>101 beshort&0xf 0xe \b(reserved %d) 18326>>101 beshort&0xf 0xf \b1-BLACK=1 18327>101 beshort&0xf0 x \b, colorfmt= 18328>>101 beshort&0xf0 0x00 \bYONLY 18329>>101 beshort&0xf0 0x10 \bYUV240 18330>>101 beshort&0xf0 0x20 \bYWV422 18331>>101 beshort&0xf0 0x30 \bYWV444 18332>>101 beshort&0xf0 0x40 \bCMYK 18333>>101 beshort&0xf0 0x50 \bCMYKDIRECT 18334>>101 beshort&0xf0 0x60 \bNCOMPONENT 18335>>101 beshort&0xf0 0x70 \bRGB 18336>>101 beshort&0xf0 0x80 \bRGBE 18337>>101 beshort&0xf0 >0x80 \b(reserved 0x%x) 18338 18339# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 18340# 18341# BPG (Better Portable Graphics) format 18342# https://bellard.org/bpg/ 18343# http://fileformats.archiveteam.org/wiki/BPG 18344# 183450 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 18346!:mime image/bpg 18347 18348# From: Joerg Jenderek 18349# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format 183500 string icns Mac OS X icon 18351!:mime image/x-icns 18352!:apple ????icns 18353!:ext icns 18354>4 ubelong >0 18355# file size 18356>>4 ubelong x \b, %d bytes 18357# icon type 18358>>8 string x \b, "%4.4s" type 18359 18360# TIM images 183610 lelong 0x00000010 TIM image, 18362>4 lelong 0x8 4-Bit, 18363>4 lelong 0x9 8-Bit, 18364>4 lelong 0x2 15-Bit, 18365>4 lelong 0x3 24-Bit, 18366>4 lelong &8 18367>>(8.l+12) leshort x Pixel at (%d, 18368>>(8.l+14) leshort x \b%d) 18369>>(8.l+16) leshort x Size=%dx 18370>>(8.l+18) leshort x \b%d, 18371>>4 lelong 0x8 16 CLUT Entries at 18372>>4 lelong 0x9 256 CLUT Entries at 18373>>12 leshort x (%d, 18374>>14 leshort x \b%d) 18375>4 lelong ^8 18376>>12 leshort x Pixel at (%d, 18377>>14 leshort x \b%d) 18378>>16 leshort x Size=%dx 18379>>18 leshort x \b%d 18380 18381# MDEC streams 183820 lelong 0x80010160 MDEC video stream, 18383>16 leshort x %dx 18384>18 leshort x \b%d 18385#>8 lelong x %d frames 18386#>4 leshort x secCount=%d; 18387#>6 leshort x nSectors=%d; 18388#>12 lelong x frameSize=%d; 18389 18390# BS encoded bitstreams 183912 leshort 0x3800 BS image, 18392>6 leshort x Version %d, 18393>4 leshort x Quantization %d, 18394>0 leshort x (Decompresses to %d words) 18395 18396# Type: farbfeld image. 18397# Url: http://tools.suckless.org/farbfeld/ 18398# From: Ian D. Scott <ian@iandouglasscott.com> 18399# 184000 string farbfeld farbfeld image data, 18401>8 ubelong x %dx 18402>12 ubelong x \b%d 18403 18404# Type: Microsoft DirectDraw Surface (common data) 18405# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 18406# From: Morten Hustveit <morten@debian.org> 18407# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 184080 name ms-directdraw-surface 18409>0x10 ulelong x %u x 18410>0x0C ulelong x %u 18411# Color depth. 18412>0x58 ulelong >0 \b, %u-bit color 18413# Determine the pixel format. 18414>0x50 ulelong&0x4 4 18415# FIXME: Handle DX10 and XBOX formats. 18416>>0x54 string x \b, compressed using %.4s 18417>0x50 ulelong&0x2 0x2 \b, alpha only 18418>0x50 ulelong&0x200 0x200 \b, YUV 18419>0x50 ulelong&0x20000 0x20000 \b, luminance 18420# RGB pixel format 18421>0x50 ulelong&0x40 0x40 18422 18423# Determine the RGB format using the color masks. 18424# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB 18425 18426>>0x58 ulelong 16 18427 18428# NOTE: 15-bit color formats usually have 16-bit listed as the color depth. 18429>>>0x5C ulequad 0x000003E000007C00 18430>>>>0x64 ulequad 0x000000000000001F \b, RGB555 18431>>>0x5C ulequad 0x000003E000001F00 18432>>>>0x64 ulequad 0x000000000000007C \b, BGR555 18433 18434>>>0x5C ulequad 0x000007E00000F800 18435>>>>0x64 ulequad 0x000000000000001F \b, RGB565 18436>>>0x5C ulequad 0x000007E000001F00 18437>>>>0x64 ulequad 0x00000000000000F8 \b, BGR565 18438 18439>>>0x5C ulequad 0x000000F000000F00 18440>>>>0x64 ulequad 0x0000F0000000000F \b, ARGB4444 18441>>>0x5C ulequad 0x000000F00000000F 18442>>>>0x64 ulequad 0x0000F00000000F00 \b, ABGR4444 18443 18444>>>0x5C ulequad 0x00000F000000F000 18445>>>>0x64 ulequad 0x0000000F000000F0 \b, RGBA4444 18446>>>0x5C ulequad 0x00000F00000000F0 18447>>>>0x64 ulequad 0x0000000F0000F000 \b, BGRA4444 18448 18449>>>0x5C ulequad 0x000000F000000F00 18450>>>>0x64 ulequad 0x000000000000000F \b, xRGB4444 18451>>>0x5C ulequad 0x000000F00000000F 18452>>>>0x64 ulequad 0x0000000000000F00 \b, xBGR4444 18453 18454>>>0x5C ulequad 0x00000F000000F000 18455>>>>0x64 ulequad 0x00000000000000F0 \b, RGBx4444 18456>>>0x5C ulequad 0x00000F00000000F0 18457>>>>0x64 ulequad 0x000000000000F000 \b, BGRx4444 18458 18459>>>0x5C ulequad 0x000003E000007C00 18460>>>>0x64 ulequad 0x000080000000001F \b, ARGB1555 18461>>>0x5C ulequad 0x000003E000001F00 18462>>>>0x64 ulequad 0x000080000000007C \b, ABGR1555 18463>>>0x5C ulequad 0x000007C00000F800 18464>>>>0x64 ulequad 0x000000010000003E \b, RGBA5551 18465>>>0x5C ulequad 0x000007C00000003E 18466>>>>0x64 ulequad 0x000000010000F800 \b, BGRA5551 18467 18468>>88 ulelong 24 18469>>>0x5C ulequad 0x0000FF0000FF0000 18470>>>>0x64 ulequad 0x00000000000000FF \b, RGB888 18471>>>0x5C ulequad 0x0000FF00000000FF 18472>>>>0x64 ulequad 0x0000000000FF0000 \b, BGR888 18473 18474>>88 ulelong 32 18475>>>0x5C ulequad 0x0000FF0000FF0000 18476>>>>0x64 ulequad 0xFF000000000000FF \b, ARGB8888 18477>>>0x5C ulequad 0x0000FF00000000FF 18478>>>>0x64 ulequad 0xFF00000000FF0000 \b, ABGR8888 18479 18480>>>0x5C ulequad 0x00FF0000FF000000 18481>>>>0x64 ulequad 0x000000FF0000FF00 \b, RGBA8888 18482>>>0x5C ulequad 0x00FF00000000FF00 18483>>>>0x64 ulequad 0x000000FFFF000000 \b, BGBA8888 18484 18485>>>0x5C ulequad 0x0000FF0000FF0000 18486>>>>0x64 ulequad 0x00000000000000FF \b, xRGB8888 18487>>>0x5C ulequad 0x0000FF00000000FF 18488>>>>0x64 ulequad 0x0000000000FF0000 \b, xBGR8888 18489 18490>>>0x5C ulequad 0x00FF0000FF000000 18491>>>>0x64 ulequad 0x000000000000FF00 \b, RGBx8888 18492>>>0x5C ulequad 0x00FF00000000FF00 18493>>>>0x64 ulequad 0x00000000FF000000 \b, BGBx8888 18494 18495# Less common 32-bit color formats. 18496>>>0x5C ulequad 0xFFFF00000000FFFF 18497>>>>0x64 ulequad 0x0000000000000000 \b, G16R16 18498>>>0x5C ulequad 0x0000FFFFFFFF0000 18499>>>>0x64 ulequad 0x0000000000000000 \b, R16G16 18500 18501>>>0x5C ulequad 0x000FFC003FF00000 18502>>>>0x64 ulequad 0xC0000000000003FF \b, A2R10G10B10 18503>>>0x5C ulequad 0x000FFC00000003FF 18504>>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10 18505 18506# Type: Microsoft DirectDraw Surface 18507# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 18508# From: Morten Hustveit <morten@debian.org> 18509# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 185100 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS): 18511>0 use ms-directdraw-surface 18512 18513# Type: Sega PVR image. 18514# From: David Korth <gerbilsoft@gerbilsoft.com> 18515# References: 18516# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt 18517# - https://github.com/yazgoo/pvrx2png 18518# - https://github.com/nickworonekin/puyotools 18519 18520# Sega PVR header. 185210 name sega-pvr-image-header 18522>0x0C leshort x %u x 18523>0x0E leshort x %u 18524# Image format. 18525>0x08 byte 0 \b, ARGB1555 18526>0x08 byte 1 \b, RGB565 18527>0x08 byte 2 \b, ARGB4444 18528>0x08 byte 3 \b, YUV442 18529>0x08 byte 4 \b, Bump 18530>0x08 byte 5 \b, 4bpp 18531>0x08 byte 6 \b, 8bpp 18532# Image data type. 18533>0x09 byte 0x01 \b, square twiddled 18534>0x09 byte 0x02 \b, square twiddled & mipmap 18535>0x09 byte 0x03 \b, VQ 18536>0x09 byte 0x04 \b, VQ & mipmap 18537>0x09 byte 0x05 \b, 8-bit CLUT twiddled 18538>0x09 byte 0x06 \b, 4-bit CLUT twiddled 18539>0x09 byte 0x07 \b, 8-bit direct twiddled 18540>0x09 byte 0x08 \b, 4-bit direct twiddled 18541>0x09 byte 0x09 \b, rectangle 18542>0x09 byte 0x0B \b, rectangular stride 18543>0x09 byte 0x0D \b, rectangular twiddled 18544>0x09 byte 0x10 \b, small VQ 18545>0x09 byte 0x11 \b, small VQ & mipmap 18546>0x09 byte 0x12 \b, square twiddled & mipmap 18547 18548# Sega PVR image. 185490 string PVRT 18550>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 18551>>0x20 use ms-directdraw-surface 18552>0x10 belong !0x44445320 Sega PVR image: 18553>>0 use sega-pvr-image-header 18554 18555# Sega PVR image with GBIX. 185560 string GBIX 18557>0x10 string PVRT 18558>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 18559>>>0x20 use ms-directdraw-surface 18560>>0x10 belong !0x44445320 Sega PVR image: 18561>>>0x10 use sega-pvr-image-header 18562>>0x08 lelong x \b, global index = %u 18563 18564# Sega GVR header. 185650 name sega-gvr-image-header 18566>0x0C beshort x %u x 18567>0x0E beshort x %u 18568# Image data format. 18569>0x0B byte 0 \b, I4 18570>0x0B byte 1 \b, I8 18571>0x0B byte 2 \b, IA4 18572>0x0B byte 3 \b, IA8 18573>0x0B byte 4 \b, RGB565 18574>0x0B byte 5 \b, RGB5A3 18575>0x0B byte 6 \b, ARGB8888 18576>0x0B byte 8 \b, CI4 18577>0x0B byte 9 \b, CI8 18578>0x0B byte 14 \b, DXT1 18579 18580# Sega GVR image. 185810 string GVRT Sega GVR image: 18582>0x10 use sega-gvr-image-header 18583 18584# Sega GVR image with GBIX. 185850 string GBIX 18586>0x10 string GVRT Sega GVR image: 18587>>0x10 use sega-gvr-image-header 18588>>0x08 belong x \b, global index = %u 18589 18590# Sega GVR image with GCIX. (Wii) 185910 string GCIX 18592>0x10 string GVRT Sega GVR image: 18593>>0x10 use sega-gvr-image-header 18594>>0x08 belong x \b, global index = %u 18595 18596# Light Field Picture 18597# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx 18598# Typical file extensions: .lfp .lfr .lfx 18599 186000 belong 0x894C4650 18601>4 belong 0x0D0A1A0A 18602>12 belong 0x00000000 Lytro Light Field Picture 18603>8 belong x \b, version %d 18604 18605# Type: Vision Research Phantom CINE Format 18606# URL: https://www.phantomhighspeed.com/ 18607# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk 18608# From: Harry Mallon <hjmallon at gmail.com> 18609# 18610# This has a short "CI" code but the 44 is the size of the struct which is 18611# stable 186120 string CI 18613>2 leshort 44 Vision Research CINE Video, 18614>>4 leshort 0 Grayscale, 18615>>4 leshort 1 JPEG Compressed, 18616>>4 leshort 2 RAW, 18617>>6 leshort x version %d, 18618>>20 lelong x %d frames, 18619>>48 lelong x %dx 18620>>52 lelong x \b%d 18621 18622# Type: ARRI Raw Image 18623# Info: SMPTE RDD30:2014 18624# From: Harry Mallon <hjmallon at gmail.com> 186250 string ARRI ARRI ARI image data, 18626>4 lelong 0x78563412 little-endian, 18627>4 lelong 0x12345678 big-endian, 18628>12 lelong x version %d, 18629>20 lelong x %dx 18630>24 lelong x \b%d 18631 18632# Type: Khronos KTX texture. 18633# From: David Korth <gerbilsoft@gerbilsoft.com> 18634# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/ 18635 18636# glEnum decoding. 18637# NOTE: Only the most common formats are listed here. 186380 name khronos-ktx-glEnum 18639>0 lelong 0x1907 \b, RGB 18640>0 lelong 0x1908 \b, RGBA 18641>0 lelong 0x1909 \b, LUMINANCE 18642>0 lelong 0x190A \b, LUMINANCE_ALPHA 18643>0 lelong 0x80E1 \b, BGR 18644>0 lelong 0x80E2 \b, BGRA 18645>0 lelong 0x83A0 \b, RGB_S3TC 18646>0 lelong 0x83A1 \b, RGB4_S3TC 18647>0 lelong 0x83A2 \b, RGBA_S3TC 18648>0 lelong 0x83A3 \b, RGBA4_S3TC 18649>0 lelong 0x83A4 \b, RGBA_DXT5_S3TC 18650>0 lelong 0x83A5 \b, RGBA4_DXT5_S3TC 18651>0 lelong 0x83F0 \b, COMPRESSED_RGB_S3TC_DXT1_EXT 18652>0 lelong 0x83F1 \b, COMPRESSED_RGBA_S3TC_DXT1_EXT 18653>0 lelong 0x83F2 \b, COMPRESSED_RGBA_S3TC_DXT3_EXT 18654>0 lelong 0x83F3 \b, COMPRESSED_RGBA_S3TC_DXT5_EXT 18655>0 lelong 0x8D64 \b, ETC1_RGB8_OES 18656>0 lelong 0x9270 \b, COMPRESSED_R11_EAC 18657>0 lelong 0x9271 \b, COMPRESSED_SIGNED_R11_EAC 18658>0 lelong 0x9272 \b, COMPRESSED_RG11_EAC 18659>0 lelong 0x9273 \b, COMPRESSED_SIGNED_RG11_EAC 18660>0 lelong 0x9274 \b, COMPRESSED_RGB8_ETC2 18661>0 lelong 0x9275 \b, COMPRESSED_SRGB8_ETC2 18662>0 lelong 0x9276 \b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2 18663>0 lelong 0x9277 \b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2 18664>0 lelong 0x9278 \b, COMPRESSED_RGBA2_ETC2_EAC 18665>0 lelong 0x9279 \b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC 18666>0 lelong 0x93B0 \b, COMPRESSED_RGBA_ASTC_4x4_KHR 18667>0 lelong 0x93B1 \b, COMPRESSED_RGBA_ASTC_5x4_KHR 18668>0 lelong 0x93B2 \b, COMPRESSED_RGBA_ASTC_5x5_KHR 18669>0 lelong 0x93B3 \b, COMPRESSED_RGBA_ASTC_6x5_KHR 18670>0 lelong 0x93B4 \b, COMPRESSED_RGBA_ASTC_6x6_KHR 18671>0 lelong 0x93B5 \b, COMPRESSED_RGBA_ASTC_8x5_KHR 18672>0 lelong 0x93B6 \b, COMPRESSED_RGBA_ASTC_8x6_KHR 18673>0 lelong 0x93B7 \b, COMPRESSED_RGBA_ASTC_8x8_KHR 18674>0 lelong 0x93B8 \b, COMPRESSED_RGBA_ASTC_10x5_KHR 18675>0 lelong 0x93B9 \b, COMPRESSED_RGBA_ASTC_10x6_KHR 18676>0 lelong 0x93BA \b, COMPRESSED_RGBA_ASTC_10x8_KHR 18677>0 lelong 0x93BB \b, COMPRESSED_RGBA_ASTC_10x10_KHR 18678>0 lelong 0x93BC \b, COMPRESSED_RGBA_ASTC_12x10_KHR 18679>0 lelong 0x93BD \b, COMPRESSED_RGBA_ASTC_12x12_KHR 18680>0 lelong 0x93D0 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR 18681>0 lelong 0x93D1 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR 18682>0 lelong 0x93D2 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR 18683>0 lelong 0x93D3 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR 18684>0 lelong 0x93D4 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR 18685>0 lelong 0x93D5 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR 18686>0 lelong 0x93D6 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR 18687>0 lelong 0x93D7 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR 18688>0 lelong 0x93D8 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR 18689>0 lelong 0x93D9 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR 18690>0 lelong 0x93DA \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR 18691>0 lelong 0x93DB \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR 18692>0 lelong 0x93DC \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR 18693>0 lelong 0x93DD \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR 18694 18695# Endian-specific KTX header. 18696# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE) 186970 name khronos-ktx-endian-header 18698>20 lelong x \b, %u 18699>24 lelong >1 x %u 18700>28 lelong >1 x %u 18701>8 lelong >0 18702>>8 use khronos-ktx-glEnum 18703>8 lelong 0 18704>>12 use khronos-ktx-glEnum 18705 18706# Main KTX header. 18707# Determine endianness, then check the rest of the header. 187080 string \xABKTX\ 11\xBB\r\n\x1A\n Khronos KTX texture 18709>12 lelong 0x04030201 (little-endian) 18710>>16 use khronos-ktx-endian-header 18711>12 belong 0x04030201 (big-endian) 18712>>16 use \^khronos-ktx-endian-header 18713 18714# Type: Khronos KTX2 texture. 18715# From: David Korth <gerbilsoft@gerbilsoft.com> 18716# Based on draft19. 18717# Reference: http://github.khronos.org/KTX-Specification/ 18718 18719# Supercompression enum. 187200 name khronos-ktx2-supercompression 18721>0 lelong 1 BasisLZ 18722>0 lelong 2 Zstandard 18723>0 lelong 3 ZLIB 18724 18725# Vulkan format identifier. 18726# NOTE: Formats prohibited from KTX2 are commented out. 187270 name khronos-ktx2-vkFormat 18728>0 lelong 0 UNDEFINED 18729>0 lelong 1 R4G4_UNORM_PACK8 18730>0 lelong 2 R4G4B4A4_UNORM_PACK16 18731>0 lelong 3 B4G4R4A4_UNORM_PACK16 18732>0 lelong 4 R5G6B5_UNORM_PACK16 18733>0 lelong 5 B5G6R5_UNORM_PACK16 18734>0 lelong 6 R5G5B5A1_UNORM_PACK16 18735>0 lelong 7 B5G5R5A1_UNORM_PACK16 18736>0 lelong 8 A1R5G5B5_UNORM_PACK16 18737>0 lelong 9 R8_UNORM 18738>0 lelong 10 R8_SNORM 18739#>0 lelong 11 R8_USCALED 18740#>0 lelong 12 R8_SSCALED 18741>0 lelong 13 R8_UINT 18742>0 lelong 14 R8_SINT 18743>0 lelong 15 R8_SRGB 18744>0 lelong 16 R8G8_UNORM 18745>0 lelong 17 R8G8_SNORM 18746#>0 lelong 18 R8G8_USCALED 18747#>0 lelong 19 R8G8_SSCALED 18748>0 lelong 20 R8G8_UINT 18749>0 lelong 21 R8G8_SINT 18750>0 lelong 22 R8G8_SRGB 18751>0 lelong 23 R8G8B8_UNORM 18752>0 lelong 24 R8G8B8_SNORM 18753#>0 lelong 25 R8G8B8_USCALED 18754#>0 lelong 26 R8G8B8_SSCALED 18755>0 lelong 27 R8G8B8_UINT 18756>0 lelong 28 R8G8B8_SINT 18757>0 lelong 29 R8G8B8_SRGB 18758>0 lelong 30 B8G8R8_UNORM 18759>0 lelong 31 B8G8R8_SNORM 18760#>0 lelong 32 B8G8R8_USCALED 18761#>0 lelong 33 B8G8R8_SSCALED 18762>0 lelong 34 B8G8R8_UINT 18763>0 lelong 35 B8G8R8_SINT 18764>0 lelong 36 B8G8R8_SRGB 18765>0 lelong 37 R8G8B8A8_UNORM 18766>0 lelong 38 R8G8B8A8_SNORM 18767#>0 lelong 39 R8G8B8A8_USCALED 18768#>0 lelong 40 R8G8B8A8_SSCALED 18769>0 lelong 41 R8G8B8A8_UINT 18770>0 lelong 42 R8G8B8A8_SINT 18771>0 lelong 43 R8G8B8A8_SRGB 18772>0 lelong 44 B8G8R8A8_UNORM 18773>0 lelong 45 B8G8R8A8_SNORM 18774#>0 lelong 46 B8G8R8A8_USCALED 18775#>0 lelong 47 B8G8R8A8_SSCALED 18776>0 lelong 48 B8G8R8A8_UINT 18777>0 lelong 49 B8G8R8A8_SINT 18778>0 lelong 50 B8G8R8A8_SRGB 18779#>0 lelong 51 A8B8G8R8_UNORM_PACK32 18780#>0 lelong 52 A8B8G8R8_SNORM_PACK32 18781#>0 lelong 53 A8B8G8R8_USCALED_PACK32 18782#>0 lelong 54 A8B8G8R8_SSCALED_PACK32 18783#>0 lelong 55 A8B8G8R8_UINT_PACK32 18784#>0 lelong 56 A8B8G8R8_SINT_PACK32 18785#>0 lelong 57 A8B8G8R8_SRGB_PACK32 18786>0 lelong 58 A2R10G10B10_UNORM_PACK32 18787>0 lelong 59 A2R10G10B10_SNORM_PACK32 18788#>0 lelong 60 A2R10G10B10_USCALED_PACK32 18789#>0 lelong 61 A2R10G10B10_SSCALED_PACK32 18790>0 lelong 62 A2R10G10B10_UINT_PACK32 18791>0 lelong 63 A2R10G10B10_SINT_PACK32 18792>0 lelong 64 A2B10G10R10_UNORM_PACK32 18793>0 lelong 65 A2B10G10R10_SNORM_PACK32 18794#>0 lelong 66 A2B10G10R10_USCALED_PACK32 18795#>0 lelong 67 A2B10G10R10_SSCALED_PACK32 18796>0 lelong 68 A2B10G10R10_UINT_PACK32 18797>0 lelong 69 A2B10G10R10_SINT_PACK32 18798>0 lelong 70 R16_UNORM 18799>0 lelong 71 R16_SNORM 18800#>0 lelong 72 R16_USCALED 18801#>0 lelong 73 R16_SSCALED 18802>0 lelong 74 R16_UINT 18803>0 lelong 75 R16_SINT 18804>0 lelong 76 R16_SFLOAT 18805>0 lelong 77 R16G16_UNORM 18806>0 lelong 78 R16G16_SNORM 18807#>0 lelong 79 R16G16_USCALED 18808#>0 lelong 80 R16G16_SSCALED 18809>0 lelong 81 R16G16_UINT 18810>0 lelong 82 R16G16_SINT 18811>0 lelong 83 R16G16_SFLOAT 18812>0 lelong 84 R16G16B16_UNORM 18813>0 lelong 85 R16G16B16_SNORM 18814#>0 lelong 86 R16G16B16_USCALED 18815#>0 lelong 87 R16G16B16_SSCALED 18816>0 lelong 88 R16G16B16_UINT 18817>0 lelong 89 R16G16B16_SINT 18818>0 lelong 90 R16G16B16_SFLOAT 18819>0 lelong 91 R16G16B16A16_UNORM 18820>0 lelong 92 R16G16B16A16_SNORM 18821#>0 lelong 93 R16G16B16A16_USCALED 18822#>0 lelong 94 R16G16B16A16_SSCALED 18823>0 lelong 95 R16G16B16A16_UINT 18824>0 lelong 96 R16G16B16A16_SINT 18825>0 lelong 97 R16G16B16A16_SFLOAT 18826>0 lelong 98 R32_UINT 18827>0 lelong 99 R32_SINT 18828>0 lelong 100 R32_SFLOAT 18829>0 lelong 101 R32G32_UINT 18830>0 lelong 102 R32G32_SINT 18831>0 lelong 103 R32G32_SFLOAT 18832>0 lelong 104 R32G32B32_UINT 18833>0 lelong 105 R32G32B32_SINT 18834>0 lelong 106 R32G32B32_SFLOAT 18835>0 lelong 107 R32G32B32A32_UINT 18836>0 lelong 108 R32G32B32A32_SINT 18837>0 lelong 109 R32G32B32A32_SFLOAT 18838>0 lelong 110 R64_UINT 18839>0 lelong 111 R64_SINT 18840>0 lelong 112 R64_SFLOAT 18841>0 lelong 113 R64G64_UINT 18842>0 lelong 114 R64G64_SINT 18843>0 lelong 115 R64G64_SFLOAT 18844>0 lelong 116 R64G64B64_UINT 18845>0 lelong 117 R64G64B64_SINT 18846>0 lelong 118 R64G64B64_SFLOAT 18847>0 lelong 119 R64G64B64A64_UINT 18848>0 lelong 120 R64G64B64A64_SINT 18849>0 lelong 121 R64G64B64A64_SFLOAT 18850>0 lelong 122 B10G11R11_UFLOAT_PACK32 18851>0 lelong 123 E5B9G9R9_UFLOAT_PACK32 18852>0 lelong 124 D16_UNORM 18853>0 lelong 125 X8_D24_UNORM_PACK32 18854>0 lelong 126 D32_SFLOAT 18855>0 lelong 127 S8_UINT 18856>0 lelong 128 D16_UNORM_S8_UINT 18857>0 lelong 129 D24_UNORM_S8_UINT 18858>0 lelong 130 D32_SFLOAT_S8_UINT 18859 18860>0 lelong 131 BC1_RGB_UNORM_BLOCK 18861>0 lelong 132 BC1_RGB_SRGB_BLOCK 18862>0 lelong 133 BC1_RGBA_UNORM_BLOCK 18863>0 lelong 134 BC1_RGBA_SRGB_BLOCK 18864>0 lelong 135 BC2_UNORM_BLOCK 18865>0 lelong 136 BC2_SRGB_BLOCK 18866>0 lelong 137 BC3_UNORM_BLOCK 18867>0 lelong 138 BC3_SRGB_BLOCK 18868>0 lelong 139 BC4_UNORM_BLOCK 18869>0 lelong 140 BC4_SNORM_BLOCK 18870>0 lelong 141 BC5_UNORM_BLOCK 18871>0 lelong 142 BC5_SNORM_BLOCK 18872>0 lelong 143 BC6H_UFLOAT_BLOCK 18873>0 lelong 144 BC6H_SFLOAT_BLOCK 18874>0 lelong 145 BC7_UNORM_BLOCK 18875>0 lelong 146 BC7_SRGB_BLOCK 18876 18877>0 lelong 147 ETC2_R8G8B8_UNORM_BLOCK 18878>0 lelong 148 ETC2_R8G8B8_SRGB_BLOCK 18879>0 lelong 149 ETC2_R8G8B8A1_UNORM_BLOCK 18880>0 lelong 150 ETC2_R8G8B8A1_SRGB_BLOCK 18881>0 lelong 151 ETC2_R8G8B8A8_UNORM_BLOCK 18882>0 lelong 152 ETC2_R8G8B8A8_SRGB_BLOCK 18883 18884>0 lelong 153 EAC_R11_UNORM_BLOCK 18885>0 lelong 154 EAC_R11_SNORM_BLOCK 18886>0 lelong 155 EAC_R11G11_UNORM_BLOCK 18887>0 lelong 156 EAC_R11G11_SNORM_BLOCK 18888 18889>0 lelong 157 ASTC_4x4_UNORM_BLOCK 18890>0 lelong 158 ASTC_4x4_SRGB_BLOCK 18891>0 lelong 159 ASTC_5x4_UNORM_BLOCK 18892>0 lelong 160 ASTC_5x4_SRGB_BLOCK 18893>0 lelong 161 ASTC_5x5_UNORM_BLOCK 18894>0 lelong 162 ASTC_5x5_SRGB_BLOCK 18895>0 lelong 163 ASTC_6x5_UNORM_BLOCK 18896>0 lelong 164 ASTC_6x5_SRGB_BLOCK 18897>0 lelong 165 ASTC_6x6_UNORM_BLOCK 18898>0 lelong 166 ASTC_6x6_SRGB_BLOCK 18899>0 lelong 167 ASTC_8x5_UNORM_BLOCK 18900>0 lelong 168 ASTC_8x5_SRGB_BLOCK 18901>0 lelong 169 ASTC_8x6_UNORM_BLOCK 18902>0 lelong 170 ASTC_8x6_SRGB_BLOCK 18903>0 lelong 171 ASTC_8x8_UNORM_BLOCK 18904>0 lelong 172 ASTC_8x8_SRGB_BLOCK 18905>0 lelong 173 ASTC_10x5_UNORM_BLOCK 18906>0 lelong 174 ASTC_10x5_SRGB_BLOCK 18907>0 lelong 175 ASTC_10x6_UNORM_BLOCK 18908>0 lelong 176 ASTC_10x6_SRGB_BLOCK 18909>0 lelong 177 ASTC_10x8_UNORM_BLOCK 18910>0 lelong 178 ASTC_10x8_SRGB_BLOCK 18911>0 lelong 179 ASTC_10x10_UNORM_BLOCK 18912>0 lelong 180 ASTC_10x10_SRGB_BLOCK 18913>0 lelong 181 ASTC_12x10_UNORM_BLOCK 18914>0 lelong 182 ASTC_12x10_SRGB_BLOCK 18915>0 lelong 183 ASTC_12x12_UNORM_BLOCK 18916>0 lelong 184 ASTC_12x12_SRGB_BLOCK 18917 18918>0 lelong 1000156000 G8B8G8R8_422_UNORM 18919>0 lelong 1000156001 B8G8R8G8_422_UNORM 18920>0 lelong 1000156002 G8_B8_R8_3PLANE_420_UNORM 18921>0 lelong 1000156003 G8_B8R8_2PLANE_420_UNORM 18922>0 lelong 1000156004 G8_B8_R8_3PLANE_422_UNORM 18923>0 lelong 1000156005 G8_B8R8_2PLANE_422_UNORM 18924>0 lelong 1000156006 G8_B8_R8_3PLANE_444_UNORM 18925>0 lelong 1000156007 R10X6_UNORM_PACK16 18926>0 lelong 1000156008 R10X6G10X6_UNORM_2PACK16 18927>0 lelong 1000156009 R10X6G10X6B10X6A10X6_UNORM_4PACK16 18928>0 lelong 1000156010 G10X6B10X6G10X6R10X6_422_UNORM_4PACK16 18929>0 lelong 1000156011 B10X6G10X6R10X6G10X6_422_UNORM_4PACK16 18930>0 lelong 1000156012 G10X6_B10X6_R10X6_3PLANE_420_UNORM_3PACK16 18931>0 lelong 1000156013 G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16 18932>0 lelong 1000156014 G10X6_B10X6_R10X6_3PLANE_422_UNORM_3PACK16 18933>0 lelong 1000156015 G10X6_B10X6R10X6_2PLANE_422_UNORM_3PACK16 18934>0 lelong 1000156016 G10X6_B10X6_R10X6_3PLANE_444_UNORM_3PACK16 18935>0 lelong 1000156017 R12X4_UNORM_PACK16 18936>0 lelong 1000156018 R12X4G12X4_UNORM_2PACK16 18937>0 lelong 1000156019 R12X4G12X4B12X4A12X4_UNORM_4PACK16 18938>0 lelong 1000156020 G12X4B12X4G12X4R12X4_422_UNORM_4PACK16 18939>0 lelong 1000156021 B12X4G12X4R12X4G12X4_422_UNORM_4PACK16 18940>0 lelong 1000156022 G12X4_B12X4_R12X4_3PLANE_420_UNORM_3PACK16 18941>0 lelong 1000156023 G12X4_B12X4R12X4_2PLANE_420_UNORM_3PACK16 18942>0 lelong 1000156024 G12X4_B12X4_R12X4_3PLANE_422_UNORM_3PACK16 18943>0 lelong 1000156025 G12X4_B12X4R12X4_2PLANE_422_UNORM_3PACK16 18944>0 lelong 1000156026 G12X4_B12X4_R12X4_3PLANE_444_UNORM_3PACK16 18945>0 lelong 1000156027 G16B16G16R16_422_UNORM 18946>0 lelong 1000156028 B16G16R16G16_422_UNORM 18947>0 lelong 1000156029 G16_B16_R16_3PLANE_420_UNORM 18948>0 lelong 1000156030 G16_B16R16_2PLANE_420_UNORM 18949>0 lelong 1000156031 G16_B16_R16_3PLANE_422_UNORM 18950>0 lelong 1000156032 G16_B16R16_2PLANE_422_UNORM 18951>0 lelong 1000156033 G16_B16_R16_3PLANE_444_UNORM 18952 18953>0 lelong 1000054000 PVRTC1_2BPP_UNORM_BLOCK_IMG 18954>0 lelong 1000054001 PVRTC1_4BPP_UNORM_BLOCK_IMG 18955>0 lelong 1000054002 PVRTC2_2BPP_UNORM_BLOCK_IMG 18956>0 lelong 1000054003 PVRTC2_4BPP_UNORM_BLOCK_IMG 18957>0 lelong 1000054004 PVRTC1_2BPP_SRGB_BLOCK_IMG 18958>0 lelong 1000054005 PVRTC1_4BPP_SRGB_BLOCK_IMG 18959>0 lelong 1000054006 PVRTC2_2BPP_SRGB_BLOCK_IMG 18960>0 lelong 1000054007 PVRTC2_4BPP_SRGB_BLOCK_IMG 18961 18962>0 lelong 1000066000 ASTC_4x4_SFLOAT_BLOCK_EXT 18963>0 lelong 1000066001 ASTC_5x4_SFLOAT_BLOCK_EXT 18964>0 lelong 1000066002 ASTC_5x5_SFLOAT_BLOCK_EXT 18965>0 lelong 1000066003 ASTC_6x5_SFLOAT_BLOCK_EXT 18966>0 lelong 1000066004 ASTC_6x6_SFLOAT_BLOCK_EXT 18967>0 lelong 1000066005 ASTC_8x5_SFLOAT_BLOCK_EXT 18968>0 lelong 1000066006 ASTC_8x6_SFLOAT_BLOCK_EXT 18969>0 lelong 1000066007 ASTC_8x8_SFLOAT_BLOCK_EXT 18970>0 lelong 1000066008 ASTC_10x5_SFLOAT_BLOCK_EXT 18971>0 lelong 1000066009 ASTC_10x6_SFLOAT_BLOCK_EXT 18972>0 lelong 1000066010 ASTC_10x8_SFLOAT_BLOCK_EXT 18973>0 lelong 1000066011 ASTC_10x10_SFLOAT_BLOCK_EXT 18974>0 lelong 1000066012 ASTC_12x10_SFLOAT_BLOCK_EXT 18975>0 lelong 1000066013 ASTC_12x12_SFLOAT_BLOCK_EXT 18976 18977# Main KTX2 header. 189780 string \xABKTX\ 20\xBB\r\n\x1A\n Khronos KTX2 texture 18979>20 lelong x \b, %u 18980>24 lelong >1 x %u 18981>28 lelong >1 x %u 18982>32 lelong >1 \b, %u layers 18983>36 lelong >1 \b, %u faces 18984>40 lelong >1 \b, %u mipmaps 18985>44 lelong >0 \b, 18986>>44 use khronos-ktx2-supercompression 18987>12 lelong >0 \b, 18988>>12 use khronos-ktx2-vkFormat 18989 18990# Type: Valve VTF texture. 18991# From: David Korth <gerbilsoft@gerbilsoft.com> 18992# References: 18993# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format 18994 18995# VTF image formats. 189960 name vtf-image-format 18997>0 lelong 0 RGBA8888 18998>0 lelong 1 ABGR8888 18999>0 lelong 2 RGB888 19000>0 lelong 3 BGR888 19001>0 lelong 4 RGB565 19002>0 lelong 5 I8 19003>0 lelong 6 IA88 19004>0 lelong 7 P8 19005>0 lelong 8 A8 19006>0 lelong 9 RGB888 (bluescreen) 19007>0 lelong 10 BGR888 (bluescreen) 19008>0 lelong 11 ARGB8888 19009>0 lelong 12 BGRA8888 19010>0 lelong 13 DXT1 19011>0 lelong 14 DXT3 19012>0 lelong 15 DXT5 19013>0 lelong 16 BGRx8888 19014>0 lelong 17 BGR565 19015>0 lelong 18 BGRx5551 19016>0 lelong 19 BGRA4444 19017>0 lelong 20 DXT1+A1 19018>0 lelong 21 BGRA5551 19019>0 lelong 22 UV88 19020>0 lelong 23 UVWQ8888 19021>0 lelong 24 RGBA16161616F 19022>0 lelong 25 RGBA16161616 19023>0 lelong 26 UVLX8888 19024 19025# Main VTF header. 190260 string VTF\0 Valve Texture Format 19027>4 lelong x v%u 19028>8 lelong x \b.%u 19029>0x10 leshort x \b, %u 19030>0x12 leshort >1 x %u 19031>4 lequad 0x0000000700000002 19032>>0x3F leshort >1 x %u 19033>0x18 leshort >1 \b, %u frames 19034>0x38 byte x \b, mipmaps: %u 19035>0x34 lelong >-1 \b, 19036>>0x34 use vtf-image-format 19037 19038# Type: Valve VTF3 (PS3) texture. 19039# From: David Korth <gerbilsoft@gerbilsoft.com> 190400 string VTF3 Valve Texture Format (PS3) 19041>0x14 beshort x \b, %u 19042>0x16 beshort x \b x %u 19043>0x10 belong&0x2000 0 \b, DXT1 19044>0x10 belong&0x2000 0x2000 \b, DXT5 19045 19046# Type: ASTC texture. 19047# From: David Korth <gerbilsoft@gerbilsoft.com> 19048# References: 19049# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header 19050# - https://stackoverflow.com/a/22682244 190510 lelong 0x5ca1ab13 ASTC 19052>4 byte x %u 19053>5 byte x \bx%u 19054>6 byte >1 \bx%u 19055# X, Y, and Z dimensions are stored as 24-bit LE. 19056# Pretend it's 32-bit and mask off the high byte. 19057>7 lelong&0x00FFFFFF x texture, %u 19058>10 lelong&0x00FFFFFF x x %u 19059>13 lelong&0x00FFFFFF >1 x %u 19060 19061# Zebra Metafile graphic 19062# http://www.fileformat.info/format/zbr/egff.htm 190630 beshort 0x9a02 Zebra Metafile graphic 19064>2 leshort 1 (version 1.x) 19065>2 leshort 2 (version 1.1x or 1.2x) 19066>2 leshort 3 (version 1.49) 19067>2 leshort 4 (version 1.50) 19068>4 string x (comment = %s) 19069 19070# Microsoft Paint graphic 19071# http://www.fileformat.info/format/mspaint/egff.htm 190720 string DanM icrosoft Paint image data (version 1.x) 19073>4 leshort x (%d 19074>>6 leshort x x %d) 190750 string LinS Microsoft Paint image data (version 2.0) 19076>4 leshort x (%d 19077>>6 leshort x x %d) 19078 19079# reMarkable tablet internal file format (https://www.remarkable.com/) 19080# https://github.com/ax3l/lines-are-beautiful 19081# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\ 19082# reMarkable-lines-file-format.html#what-to-do-next 19083# from Axel Huebl 190840 string reMarkable 19085>11 string lines 19086>>17 string with 19087>>>22 string selections 19088>>>>33 string and 19089>>>>>37 string layers 19090>>>>>>43 lelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s) 19091 19092# newer per-page files for the reMarkable 190930 string reMarkable 19094>11 string .lines 19095>>18 string file, 19096>>>24 string version= 19097>>>>32 byte x reMarkable tablet page (v%c), 1404 x 1872, 19098>>>>>43 lelong x %d layer(s) 19099 19100# Type: PVR3 texture. 19101# From: David Korth <gerbilsoft@gerbilsoft.com> 19102# References: 19103# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf 19104 19105# PVR3 pixel formats. 191060 name pvr3-pixel-format 19107>0 ulelong 0 PVRTC 2bpp RGB 19108>0 ulelong 1 PVRTC 2bpp RGBA 19109>0 ulelong 2 PVRTC 4bpp RGB 19110>0 ulelong 3 PVRTC 4bpp RGBA 19111>0 ulelong 4 PVRTC-II 2bpp 19112>0 ulelong 5 PVRTC-II 4bpp 19113>0 ulelong 6 ETC1 19114>0 ulelong 7 DXT1 19115>0 ulelong 8 DXT2 19116>0 ulelong 9 DXT3 19117>0 ulelong 10 DXT4 19118>0 ulelong 11 DXT5 19119>0 ulelong 12 BC4 19120>0 ulelong 13 BC5 19121>0 ulelong 14 BC6 19122>0 ulelong 15 BC7 19123>0 ulelong 16 UYVY 19124>0 ulelong 17 YUY2 19125>0 ulelong 18 BW1bpp 19126>0 ulelong 19 R9G9B9E5 Shared Exponent 19127>0 ulelong 20 RGBG8888 19128>0 ulelong 21 GRGB8888 19129>0 ulelong 22 ETC2 RGB 19130>0 ulelong 23 ETC2 RGBA 19131>0 ulelong 24 ETC2 RGB A1 19132>0 ulelong 25 EAC R11 19133>0 ulelong 26 EAC RG11 19134>0 ulelong 27 ASTC_4x4 19135>0 ulelong 28 ASTC_5x4 19136>0 ulelong 29 ASTC_5x5 19137>0 ulelong 30 ASTC_6x5 19138>0 ulelong 31 ASTC_6x6 19139>0 ulelong 32 ASTC_8x5 19140>0 ulelong 33 ASTC_8x6 19141>0 ulelong 34 ASTC_8x8 19142>0 ulelong 35 ASTC_10x5 19143>0 ulelong 36 ASTC_10x6 19144>0 ulelong 37 ASTC_10x8 19145>0 ulelong 38 ASTC_10x10 19146>0 ulelong 39 ASTC_12x10 19147>0 ulelong 40 ASTC_12x12 19148>0 ulelong 41 ASTC_3x3x3 19149>0 ulelong 42 ASTC_4x3x3 19150>0 ulelong 43 ASTC_4x4x3 19151>0 ulelong 44 ASTC_4x4x4 19152>0 ulelong 45 ASTC_5x4x4 19153>0 ulelong 46 ASTC_5x5x4 19154>0 ulelong 47 ASTC_5x5x5 19155>0 ulelong 48 ASTC_6x5x5 19156>0 ulelong 49 ASTC_6x6x5 19157>0 ulelong 50 ASTC_6x6x6 19158 191590 string PVR\x03 PowerVR 3.0 texture: 19160>0x18 ulelong x %u x 19161>0x1C ulelong x %u 19162>0x20 ulelong >1 x %u 19163>0x08 byte x \b, 19164>0x0C ulelong 0 19165>>0x08 use pvr3-pixel-format 19166>0x0C ulelong !0 19167>>0x08 byte !0 %c 19168>>>0x0C byte !0 \b%u 19169>>0x09 byte !0 \b%c 19170>>>0x0D byte !0 \b%u 19171>>0x0A byte !0 \b%c 19172>>>0x0E byte !0 \b%u 19173>>0x0B byte !0 \b%c 19174>>>0x0F byte !0 \b%u 19175>0x10 ulelong 1 \b, sRGB 19176>0x04 ulelong&0x02 0x02 \b, premultiplied alpha 19177 191780 string \x03RVP PowerVR 3.0 texture: BE, 19179>0x18 ubelong x %u x 19180>0x1C ubelong x %u 19181>0x20 ubelong >1 x %u 19182>0x08 byte x \b, 19183>0x0C ubelong 0 19184>>0x08 use pvr3-pixel-format 19185>0x0C ubelong !0 19186>>0x0B byte !0 %c 19187>>>0x0F byte !0 \b%u 19188>>0x0A byte !0 \b%c 19189>>>0x0E byte !0 \b%u 19190>>0x09 byte !0 \b%c 19191>>>0x0D byte !0 \b%u 19192>>0x08 byte !0 \b%c 19193>>>0x0C byte !0 \b%u 19194>0x10 ubelong 1 \b, sRGB 19195>0x04 ubelong&0x02 0x02 \b, premultiplied alpha 19196 19197# Type: Microsoft Xbox XPR0 texture. 19198# From: David Korth <gerbilsoft@gerbilsoft.com> 19199# References: 19200# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h 19201 19202# XPR pixel formats. 192030 name xbox-xpr-pixel-format 19204>0 byte 0x00 L8 19205>0 byte 0x01 AL8 19206>0 byte 0x02 ARGB1555 19207>0 byte 0x03 RGB555 19208>0 byte 0x04 ARGB4444 19209>0 byte 0x05 RGB565 19210>0 byte 0x06 ARGB8888 19211>0 byte 0x07 xRGB8888 19212>0 byte 0x0B P8 19213>0 byte 0x0C DXT1 19214>0 byte 0x0E DXT2 19215>0 byte 0x0F DXT4 19216>0 byte 0x10 Linear ARGB1555 19217>0 byte 0x11 Linear RGB565 19218>0 byte 0x12 Linear ARGB8888 19219>0 byte 0x13 Linear L8 19220>0 byte 0x16 Linear R8B8 19221>0 byte 0x17 Linear G8B8 19222>0 byte 0x19 A8 19223>0 byte 0x1A A8L8 19224>0 byte 0x1B Linear AL8 19225>0 byte 0x1C Linear RGB555 19226>0 byte 0x1D Linear ARGB4444 19227>0 byte 0x1E Linear xRGB8888 19228>0 byte 0x1F Linear A8 19229>0 byte 0x20 Linear A8L8 19230>0 byte 0x24 YUY2 19231>0 byte 0x25 UYVY 19232>0 byte 0x27 L6V5U5 19233>0 byte 0x28 V8U8 19234>0 byte 0x29 R8B8 19235>0 byte 0x2A D24S8 19236>0 byte 0x2B F24S8 19237>0 byte 0x2C D16 19238>0 byte 0x2D F16 19239>0 byte 0x2E Linear D24S8 19240>0 byte 0x2F Linear F24S8 19241>0 byte 0x30 Linear D16 19242>0 byte 0x31 Linear F16 19243>0 byte 0x32 L16 19244>0 byte 0x33 V16U16 19245>0 byte 0x35 Linear L16 19246>0 byte 0x36 Linear V16U16 19247>0 byte 0x37 Linear L6V5U5 19248>0 byte 0x38 RGBA5551 19249>0 byte 0x39 RGBA4444 19250>0 byte 0x3A QWVU8888 19251>0 byte 0x3B BGRA8888 19252>0 byte 0x3C RGBA8888 19253>0 byte 0x3D Linear RGBA5551 19254>0 byte 0x3E Linear RGBA4444 19255>0 byte 0x3F Linear ABGR8888 19256>0 byte 0x40 Linear BGRA8888 19257>0 byte 0x41 Linear RGBA8888 19258>0 byte 0x64 Vertex Data 19259 192600 string XPR0 Microsoft Xbox XPR0 texture 19261>0x19 byte x \b, format: 19262>>0x19 use xbox-xpr-pixel-format 19263 19264# ILDA Image Data Transfer Format 19265# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf 19266# 19267# Updated by Chuck Hein (laser@geekdude.com) 19268# 192690 string ILDA ILDA Image Data Transfer Format 19270>7 byte 0x00 3D Coordinates with Indexed Color 19271>7 byte 0x01 2D Coordinates with Indexed Color 19272>7 byte 0x02 Color Palette 19273>7 byte 0x04 3D Coordinates with True Color 19274>7 byte 0x05 2D Coordinates with True Color 19275>8 string >0 \b, palette %s 19276>16 string >0 \b, company %s 19277>24 beshort >0 \b, number of records %d 19278>>26 beshort x \b, palette number %d 19279>>28 beshort >0 \b, number of frames %d 19280>>30 byte >0 \b, projector number %d 19281 19282# Dropbox "lepton" compressed jpeg format 19283# https://github.com/dropbox/lepton 192840 belong&0xfffff0ff 0xcf84005a Lepton image file 19285>2 byte x (version %d) 19286 19287# Apple QuickTake camera raw images 19288# https://en.wikipedia.org/wiki/Apple_QuickTake 19289# dcraw can decode them 192900 name quicktake 19291>4 belong 8 19292>>544 beshort x \b, %dx 19293>>546 beshort x \b%d 19294>4 belong 4 19295>>546 beshort x \b, %dx 19296>>544 beshort x \b%d 19297 192980 string qktk Apple QuickTake 100 Raw Image 19299>0 use quicktake 19300 193010 string qktn 19302>4 byte 0 Apple QuickTake 150 Raw Image 19303>4 byte >0 Apple QuickTake 200 Raw Image 19304>0 use quicktake 19305 19306# From: Joerg Jenderek 19307# URL: http://fileformats.archiveteam.org/wiki/Corel_Photo-Paint_image 19308# Reference: http://blog.argasinski.eu/wp-content/uploads/2011/08/cpt-specification-0.01.pdf 193090 string CPT 19310>4 string FILE Corel Photo-Paint image, version 19311# version like 7, 9 or 8 19312>>3 ubyte x %c, 19313!:mime image/x-corel-cpt 19314!:ext cpt 19315# if blocks_array_offset available jump blockNumber*8 bytes 19316>>0x34 ulelong >0 19317>>>(0x28.l*8) ubyte x 19318# jump additional stored blocks_array_offset bytes forward to object block 19319>>>>&(0x34.l-1) ulelong x %u 19320# object height in pixels 19321>>>>>&0 ulelong x x %u 19322# if no blocks_array_offset available jump blockNumber*8 bytes 19323>>0x34 ulelong =0 19324>>>(0x28.l*8) ubyte x 19325# jump additional 0x13C bytes forward to object block 19326>>>>&0x13B ulelong x %u 19327>>>>>&0 ulelong x x %u 19328# image color model used 19329>>0x8 ulelong x 19330>>>0x8 ulelong 0x1 RGB 24 bits 19331>>>0x8 ulelong 0x3 CMYK 24 bits 19332>>>0x8 ulelong 0x5 greyscale 8 bits 19333>>>0x8 ulelong 0x6 black and white 1 bit 19334>>>0x8 ulelong 0xA RGB 8 bits 19335# palette_length number of colors * 3 in case of 8-bit RGB paletted image 19336# 0 otherwise. Allowed values: 0 or [1..256] * 3 19337#>>0xC ulelong >0 \b, palette length %u 19338>>>>0xC ulelong/3 <256 \b, %u colors 19339>>>0x8 ulelong 0xB LAB 19340>>>0x8 ulelong 0xC RGB 48 bits 19341>>>0x8 ulelong 0xE greyscale 16 bits 19342# this should not happen 19343>>>0x8 default x color model 19344>>>>0x8 ulelong x 0x%x 19345# bit 1 in CPT file flags: UCS-2 file comment present 19346>>0x31 ubyte &0x02 19347# look for comment marker 19348>>>0x100 search/0xc9d \4\2\0\0 19349# UCS-2 file comment 19350>>>>&0 lestring16 x "%s" 19351# if no UCS-2 is present show ANSI file comment[112] if available 19352>>0x31 ubyte&0x02 =0 19353>>>0x3C string >\0 "%-.112s" 19354# reserved seems to be always 0 19355#>>0x10 ulelong >0 \b, reserved1 %u 19356# horizontal real dpi = dpi_h * 25.4 / 10**6 19357>>0x18 ulelong x \b, %u micro dots/mm 19358# image vertical DPI in CPT DPI unit 19359#>>0x1C ulelong x \b, %u micro dots/mm 19360# reserved seems to be always 0 19361#>>0x20 ulelong >0 \b, reserved2 %u 19362#>>0x24 ulelong >0 \b, reserved3 %u 19363# blocks_count; number of CPT_Block blocks. Allowed values: > 0 19364>>0x28 ulelong x \b, %u block 19365# plural s 19366>>0x28 ulelong !1 \bs 19367# CPT file flags 19368# lower byte of CPT file flags: 0x94~CPT9FILE 0x01~often CPT7FILE 0x8C~CPT8FILE 19369#>>0x30 ubyte x \b, lower flags 0x%x 19370# upper byte of CPT file flags: 19371#>>0x31 ubyte >0 \b, upper flags 0x%x 19372# bit 2 in CPT file flags: unknown 19373#>>0x31 ubyte &0x04 \b, with UNKNOWN 19374# bits 3-7 in CPT file flags: unknown, seem to be often 0 19375# show unusual flag combinations 19376>>0x31 ubyte&0xFC >0 19377>>>0x30 uleshort x \b, flags 0x%4.4x 19378# reserved seems to be always 0 19379#>>0x32 uleshort >0 \b, reserved4 0x%x 19380# blocks_array_offset is always 0 for CPT7 and CPT8 files created by PP7-PP8 19381# typical values like: 13Ch 154h 43Ch 4F0h DA8h 19382>>0x34 ulelong x \b, array offset 0x%x 19383# reserved seems to be often 0 19384>>0x38 ulelong >0 \b, reserved5 0x%x 19385# possible next master block 19386#>>0x100 ubequad !0 \b, next block=0x%llx... 19387# bit 0: ICC profile block present 19388>>0x31 ubyte &0x01 \b, with ICC profile 19389# check for characteristic string acsp of color profile for DEBUGGING 19390#>>>0x178 string x icc=%.4s 19391# display ICC/ICM color profile by ./icc 19392#>>>0x154 use color-profile 19393 19394# Type: Crunch compressed texture. 19395# From: David Korth <gerbilsoft@gerbilsoft.com> 19396# References: 19397# - https://github.com/BinomialLLC/crunch/blob/44c8402e24441c7524ca364941fd224ab3b971e9/inc/crn_decomp.h#L267 193980 ubelong 0x4878004A Crunch compressed texture: 19399>0x0C ubeshort x %u x 19400>0x0E ubeshort x %u 19401>0x12 ubyte 0 \b, DXT1 19402>0x12 ubyte 1 \b, DXT3 19403>0x12 ubyte 2 \b, DXT5 19404>0x12 ubyte 3 \b, DXT5 CCxY 19405>0x12 ubyte 4 \b, DXT5 xGxR 19406>0x12 ubyte 5 \b, DXT5 xGBR 19407>0x12 ubyte 6 \b, DXT5 AGBR 19408>0x12 ubyte 7 \b, DXn XY 19409>0x12 ubyte 8 \b, DXn YX 19410>0x12 ubyte 9 \b, DXT5 Alpha 19411>0x12 ubyte 10 \b, ETC1 19412>0x10 ubyte >1 \b, %u images 19413>0x11 ubyte >1 \b, %u faces 19414# TODO: Flags at 0x13? (ubeshort) 19415 19416# Type: BasisLZ compressed texture. 19417# From: David Korth <gerbilsoft@gerbilsoft.com> 19418# References: 19419# - https://github.com/BinomialLLC/basis_universal/blob/master/spec/basis_spec.txt 194200 uleshort 0x4273 19421>0x04 uleshort 0x4D BasisLZ 19422>>0x02 uleshort x v%x compressed texture: 19423>>0x14 ubyte 0 ETC1S 19424>>0x14 ubyte 1 UASTC 4x4 19425>>0x0E ulelong&0xFFFFFF >1 \b, %u slices 19426>>0x11 ulelong&0xFFFFFF >1 \b, %u images 19427>>0x15 uleshort&0x02 2 \b, Y-flipped 19428 19429# MIME registration: https://www.iana.org/assignments/media-types/model/e57 19430# Sample files: http://www.libe57.org/data.html 19431# Reference implementation: http://www.libe57.org/ 19432# https://www.ri.cmu.edu/pub_files/2011/1/2011-huber-e57-v3.pdf 194330 string ASTM-E57 ASTM E57 three-dimensional model 19434!:mime model/e57 19435!:ext e57 19436 19437#------------------------------------------------------------------------------ 19438# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 19439# inform: file(1) magic for Inform interactive fiction language 19440 19441# URL: http://www.inform-fiction.org/ 19442# From: Reuben Thomas <rrt@sc3d.org> 19443 194440 search/100/cW constant\ story Inform source text 19445 19446#------------------------------------------------------------------------------ 19447# $File: intel,v 1.19 2020/12/12 20:01:47 christos Exp $ 19448# intel: file(1) magic for x86 Unix 19449# 19450# Various flavors of x86 UNIX executable/object (other than Xenix, which 19451# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 19452# Windows as well. 19453# 19454# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 19455# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 19456# as well, if, as, and when IBM makes it portable. 19457# 19458# The `versions' should be un-commented if they work for you. 19459# (Was the problem just one of endianness?) 19460# 194610 leshort 0502 basic-16 executable 19462>12 lelong >0 not stripped 19463#>22 leshort >0 - version %d 194640 leshort 0503 basic-16 executable (TV) 19465>12 lelong >0 not stripped 19466#>22 leshort >0 - version %d 194670 leshort 0510 x86 executable 19468>12 lelong >0 not stripped 194690 leshort 0511 x86 executable (TV) 19470>12 lelong >0 not stripped 194710 leshort =0512 iAPX 286 executable small model (COFF) 19472>12 lelong >0 not stripped 19473#>22 leshort >0 - version %d 194740 leshort =0522 iAPX 286 executable large model (COFF) 19475>12 lelong >0 not stripped 19476#>22 leshort >0 - version %d 19477# updated by Joerg Jenderek at Oct 2015 19478# https://de.wikipedia.org/wiki/Common_Object_File_Format 19479# http://www.delorie.com/djgpp/doc/coff/filhdr.html 19480# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file" 19481# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" 19482# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 194830 leshort =0514 19484# use subroutine to display name+flags+variables for common object formatted files 19485>0 use display-coff 19486#>12 lelong >0 not stripped 19487# no hint found, that at offset 22 is version 19488#>22 leshort >0 - version %d 194890 leshort 0x0200 19490>0 use display-coff 194910 leshort 0x8664 19492>0 use display-coff 19493 19494# rom: file(1) magic for BIOS ROM Extensions found in intel machines 19495# mapped into memory between 0xC0000 and 0xFFFFF 19496# From: Alex Myczko <alex@aiei.ch> 19497# updated by Joerg Jenderek 19498# https://en.wikipedia.org/wiki/Option_ROM 194990 beshort 0x55AA BIOS (ia32) ROM Ext. 19500!:mime application/octet-stream 19501!:ext rom/bin 19502>5 string USB USB 19503>7 string LDR UNDI image 19504>30 string IBM IBM comp. Video 19505>26 string Adaptec Adaptec 19506>28 string Adaptec Adaptec 19507>42 string PROMISE Promise 19508>2 byte x (%d*512) 19509 19510# Flash descriptors for Intel SPI flash roms. 19511# From Dr. Jesus <j@hug.gs> 195120 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1951316 lelong 0x0ff0a55a Intel serial flash for PCH ROM 19514 19515# From: Joerg Jenderek 19516# URL: https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface 19517# Reference: https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf 19518# Note: generated for example by `cat /sys/firmware/acpi/tables/DSDT MyDSDT.aml` 195190 string DSDT 19520>0 use acpi-table 19521# not tested or other file format 195220 string APIC 19523>0 use acpi-table 19524#0 string ASF! 19525#>0 use acpi-table 195260 string FACP 19527>0 use acpi-table 19528#0 string FACS 19529#>0 use acpi-table 195300 string MCFG 19531>0 use acpi-table 195320 string SLIC 19533>0 use acpi-table 195340 string SSDT 19535>0 use acpi-table 195360 name acpi-table 19537# skip ASCII text starting with DSDT by looking for valid "low" revision 19538>8 ubyte <17 ACPI Machine Language file 19539# assume that ACPI tables size are lower than 16 MiB 19540#>4 ulelong <0x01000000 19541# DSDT for Differentiated System Description Table 19542>>0 string x '%.4s' 19543#!:mime application/octet-stream 19544!:mime application/x-intel-aml 19545!:ext aml 19546# the manufacture model ID like: VBOXBIOS BXDSDT 19547>>16 string >\0 %.8s 19548# OEM revision of DSDT for supplied OEM Table ID like: 0 1 2 20090511 19549>>>24 ulelong x %x 19550# OEM ID like: INTEL VBOX (VirtualBox) BXDSDT (qemu) MEDION or \030\001\0\0 for s3pt.aml 19551>>10 ubyte >040 by %c 19552>>>11 ubyte >040 \b%c 19553>>>>12 ubyte >040 \b%c 19554>>>>>13 ubyte >040 \b%c 19555>>>>>>14 ubyte >040 \b%c 19556>>>>>>>15 ubyte >040 \b%c 19557# This field also sets the global integer width for the AML interpreter. 19558# Values less than two will cause the interpreter to use 32-bit. 19559# Values of two and greater will cause the interpreter to use full 64-bit. 19560# 16 for asf!.aml, 67 fo rsdp.aml 19561>>8 ubyte x \b, revision %u 19562# length, in bytes, of the entire DSDT (including the header) 19563>>4 ulelong x \b, %u bytes 19564# entire table must sum to zero 19565#>>9 ubyte x \b, checksum 0x%x 19566# vendor ID for the ASL Compiler like: INTL MSFT ... 19567>>28 string >\0 \b, created by %.4s 19568# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ... 19569>>>32 ulelong x %x 19570 19571 19572#------------------------------------------------------------------------------ 19573# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 19574# interleaf: file(1) magic for InterLeaf TPS: 19575# 195760 string =\210OPS Interleaf saved data 195770 string =<!OPS Interleaf document text 19578>5 string ,\ Version\ = \b, version 19579>>17 string >\0 %.3s 19580 19581#------------------------------------------------------------------------------ 19582# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 19583# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 19584# "/etc/magic": 19585# From: guy@netapp.com (Guy Harris) 19586# 195874 string pgscriptver IslandWrite document 1958813 string DrawFile IslandDraw document 19589 19590 19591#------------------------------------------------------------------------------ 19592# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 19593# ispell: file(1) magic for ispell 19594# 19595# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 19596# will match 0x9600 through 0x9603 in *both* little endian and big endian. 19597# (No other current magic entries collide.) 19598# 19599# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 19600# 196010 leshort&0xFFFC 0x9600 little endian ispell 19602>0 byte 0 hash file (?), 19603>0 byte 1 3.0 hash file, 19604>0 byte 2 3.1 hash file, 19605>0 byte 3 hash file (?), 19606>2 leshort 0x00 8-bit, no capitalization, 26 flags 19607>2 leshort 0x01 7-bit, no capitalization, 26 flags 19608>2 leshort 0x02 8-bit, capitalization, 26 flags 19609>2 leshort 0x03 7-bit, capitalization, 26 flags 19610>2 leshort 0x04 8-bit, no capitalization, 52 flags 19611>2 leshort 0x05 7-bit, no capitalization, 52 flags 19612>2 leshort 0x06 8-bit, capitalization, 52 flags 19613>2 leshort 0x07 7-bit, capitalization, 52 flags 19614>2 leshort 0x08 8-bit, no capitalization, 128 flags 19615>2 leshort 0x09 7-bit, no capitalization, 128 flags 19616>2 leshort 0x0A 8-bit, capitalization, 128 flags 19617>2 leshort 0x0B 7-bit, capitalization, 128 flags 19618>2 leshort 0x0C 8-bit, no capitalization, 256 flags 19619>2 leshort 0x0D 7-bit, no capitalization, 256 flags 19620>2 leshort 0x0E 8-bit, capitalization, 256 flags 19621>2 leshort 0x0F 7-bit, capitalization, 256 flags 19622>4 leshort >0 and %d string characters 196230 beshort&0xFFFC 0x9600 big endian ispell 19624>1 byte 0 hash file (?), 19625>1 byte 1 3.0 hash file, 19626>1 byte 2 3.1 hash file, 19627>1 byte 3 hash file (?), 19628>2 beshort 0x00 8-bit, no capitalization, 26 flags 19629>2 beshort 0x01 7-bit, no capitalization, 26 flags 19630>2 beshort 0x02 8-bit, capitalization, 26 flags 19631>2 beshort 0x03 7-bit, capitalization, 26 flags 19632>2 beshort 0x04 8-bit, no capitalization, 52 flags 19633>2 beshort 0x05 7-bit, no capitalization, 52 flags 19634>2 beshort 0x06 8-bit, capitalization, 52 flags 19635>2 beshort 0x07 7-bit, capitalization, 52 flags 19636>2 beshort 0x08 8-bit, no capitalization, 128 flags 19637>2 beshort 0x09 7-bit, no capitalization, 128 flags 19638>2 beshort 0x0A 8-bit, capitalization, 128 flags 19639>2 beshort 0x0B 7-bit, capitalization, 128 flags 19640>2 beshort 0x0C 8-bit, no capitalization, 256 flags 19641>2 beshort 0x0D 7-bit, no capitalization, 256 flags 19642>2 beshort 0x0E 8-bit, capitalization, 256 flags 19643>2 beshort 0x0F 7-bit, capitalization, 256 flags 19644>4 beshort >0 and %d string characters 19645# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 19646# Ispell 4.0 196470 string ISPL ispell 19648>4 long x hash file version %d, 19649>8 long x lexletters %d, 19650>12 long x lexsize %d, 19651>16 long x hashsize %d, 19652>20 long x stblsize %d 19653 19654#------------------------------------------------------------------------------ 19655# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $ 19656# ISO Zipped file format 19657# https://www.ezbsystems.com/isz/iszspec.txt 196580 string IsZ! ISO Zipped file 19659>4 byte x \b, header size %u 19660>5 byte x \b, version %u 19661>8 lelong x \b, serial %u 19662#12 leshort x \b, sector size %u 19663#>16 lelong x \b, total sectors %u 19664>17 byte >0 \b, password protected 19665#>24 lequad x \b, segment size %llu 19666#>32 lelong x \b, blocks %u 19667#>36 lelong x \b, block size %u 19668 19669#------------------------------------------------------------ 19670# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 19671# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 19672# same magic number, 0xcafebabe, so they are both handled 19673# in the entry called "cafebabe". 19674#------------------------------------------------------------ 19675# Java serialization 19676# From Martin Pool (m.pool@pharos.com.au) 196770 beshort 0xaced Java serialization data 19678>2 beshort >0x0004 \b, version %d 19679 196800 belong 0xfeedfeed Java KeyStore 19681!:mime application/x-java-keystore 196820 belong 0xcececece Java JCE KeyStore 19683!:mime application/x-java-jce-keystore 19684 19685# Java source 196860 regex \^import.*;$ Java source 19687!:mime text/x-java 19688 19689# Java HPROF dumps 19690# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 196910 string JAVA\x20PROFILE\x201.0. 19692>0x12 byte 0 19693>>0x11 ubyte-0x31 <2 Java HPROF dump, 19694>>>0x17 beqdate/1000 x created %s 19695 19696# Java jmod module 19697# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 19698# Grr. 2 byte magic "JM", really? In 2019? 196990 belong 0x4a4d0100 Java jmod module version 1.0 19700!:mime application/x-java-jmod 19701 19702# Java jlinked image 19703# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 197040 belong 0xcafedada Java module image (big endian) 19705>4 beshort >0x00 \b, version %d 19706>6 beshort x \b.%d 19707!:mime application/x-java-image 19708 197090 lelong 0xcafedada Java module image (little endian) 19710>6 leshort >0x00 \b, version %d 19711>4 leshort x \b.%d 19712!:mime application/x-java-image 19713 19714#------------------------------------------------------------------------------ 19715# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $ 19716# javascript: magic for javascript and node.js scripts. 19717# 197180 search/1/w #!/bin/node Node.js script text executable 19719!:mime application/javascript 197200 search/1/w #!/usr/bin/node Node.js script text executable 19721!:mime application/javascript 197220 search/1/w #!/bin/nodejs Node.js script text executable 19723!:mime application/javascript 197240 search/1/w #!/usr/bin/nodejs Node.js script text executable 19725!:mime application/javascript 197260 search/1 #!/usr/bin/env\ node Node.js script text executable 19727!:mime application/javascript 197280 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 19729!:mime application/javascript 19730# Hermes by Facebook https://hermesengine.dev/ 19731# https://github.com/facebook/hermes/blob/master/include/hermes/\ 19732# BCGen/HBC/BytecodeFileFormat.h#L24 197330 lequad 0x1F1903C103BC1FC6 Hermes JavaScript bytecode 19734>8 lelong x \b, version %d 19735 19736#------------------------------------------------------------------------------ 19737# $File: jpeg,v 1.33 2021/03/21 15:04:50 christos Exp $ 19738# JPEG images 19739# SunOS 5.5.1 had 19740# 19741# 0 string \377\330\377\340 JPEG file 19742# 0 string \377\330\377\356 JPG file 19743# 19744# both of which turn into "JPEG image data" here. 19745# 197460 beshort 0xffd8 JPEG image data 19747!:mime image/jpeg 19748!:apple 8BIMJPEG 19749!:strength *3 19750!:ext jpeg/jpg/jpe/jfif 19751>6 string JFIF \b, JFIF standard 19752# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 19753# in a vain attempt to add image size reporting for JFIF. Note that these 19754# tests are not fool-proof since some perfectly valid JPEGs are currently 19755# impossible to specify in magic(4) format. 19756# First, a little JFIF version info: 19757>>11 byte x \b %d. 19758>>12 byte x \b%02d 19759# Next, the resolution or aspect ratio of the image: 19760>>13 byte 0 \b, aspect ratio 19761>>13 byte 1 \b, resolution (DPI) 19762>>13 byte 2 \b, resolution (DPCM) 19763>>14 beshort x \b, density %dx 19764>>16 beshort x \b%d 19765>>4 beshort x \b, segment length %d 19766# Next, show thumbnail info, if it exists: 19767>>18 byte !0 \b, thumbnail %dx 19768>>>19 byte x \b%d 19769>6 string Exif \b, Exif standard: [ 19770>>12 indirect/r x 19771>>12 string x \b] 19772 19773# Jump to the first segment 19774>(4.S+4) use jpeg_segment 19775 19776# This uses recursion... 197770 name jpeg_segment 19778>0 beshort 0xFFFE 19779# Recursion handled by FFE0 19780#>>(2.S+2) use jpeg_segment 19781>>2 pstring/HJ x \b, comment: "%s" 19782 19783>0 beshort 0xFFC0 19784>>(2.S+2) use jpeg_segment 19785>>4 byte x \b, baseline, precision %d 19786>>7 beshort x \b, %dx 19787>>5 beshort x \b%d 19788>>9 byte x \b, components %d 19789 19790>0 beshort 0xFFC1 19791>>(2.S+2) use jpeg_segment 19792>>4 byte x \b, extended sequential, precision %d 19793>>7 beshort x \b, %dx 19794>>5 beshort x \b%d 19795>>9 byte x \b, components %d 19796 19797>0 beshort 0xFFC2 19798>>(2.S+2) use jpeg_segment 19799>>4 byte x \b, progressive, precision %d 19800>>7 beshort x \b, %dx 19801>>5 beshort x \b%d 19802>>9 byte x \b, components %d 19803 19804# Define Huffman Tables 19805>0 beshort 0xFFC4 19806>>(2.S+2) use jpeg_segment 19807 19808>0 beshort 0xFFE1 19809# Recursion handled by FFE0 19810#>>(2.S+2) use jpeg_segment 19811>>4 string Exif \b, Exif Standard: [ 19812>>>10 indirect/r x 19813>>>10 string x \b] 19814 19815# Application specific markers 19816>0 beshort&0xFFE0 =0xFFE0 19817>>(2.S+2) use jpeg_segment 19818 19819# DB: Define Quantization tables 19820# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 19821# D8: Start of image 19822# D9: End of image 19823# Dn: Restart 19824>0 beshort&0xFFD0 =0xFFD0 19825>>0 beshort&0xFFE0 !0xFFE0 19826>>>(2.S+2) use jpeg_segment 19827 19828#>0 beshort x unknown 0x%x 19829#>>(2.S+2) use jpeg_segment 19830 19831# HSI is Handmade Software's proprietary JPEG encoding scheme 198320 string hsi1 JPEG image data, HSI proprietary 19833 19834# From: David Santinoli <david@santinoli.com> 198350 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 19836# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 19837# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 19838# https://github.com/bitsgalore/jp2kMagic 19839# 19840# Now read value of 'Brand' field, which yields a few possibilities: 19841>20 string \x6a\x70\x32\x20 Part 1 (JP2) 19842!:mime image/jp2 19843>20 string \x6a\x70\x78\x20 Part 2 (JPX) 19844!:mime image/jpx 19845>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 19846!:mime image/jpm 19847>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 19848!:mime video/mj2 19849 19850# Type: JPEG 2000 codesream 19851# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 198520 belong 0xff4fff51 JPEG 2000 codestream 1985345 beshort 0xff52 19854 19855# JPEG extended range 198560 string \x49\x49\xbc 19857>3 byte 1 19858>>4 lelong%2 0 JPEG-XR 19859!:mime image/jxr 19860!:ext jxr 19861 19862# JPEG XL 19863# From: Ian Tester 198640 string \xff\x0a JPEG XL codestream 19865!:mime image/jxl 19866!:ext jxl 19867 19868# JPEG XL (transcoded JPEG file) 198690 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container 19870!:mime image/jxl 19871!:ext jxl 19872 19873#------------------------------------------------------------------------------ 19874# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ 19875# karma: file(1) magic for Karma data files 19876# 19877# From <rgooch@atnf.csiro.au> 19878 198790 string KarmaRHD\040Version Karma Data Structure Version 19880>16 belong x %u 19881 19882#------------------------------------------------------------------------------ 19883# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 19884# kde: file(1) magic for KDE 19885 198860 string/t [KDE\ Desktop\ Entry] KDE desktop entry 19887!:mime application/x-kdelnk 198880 string/t #\ KDE\ Config\ File KDE config file 19889!:mime application/x-kdelnk 198900 string/t #\ xmcd xmcd database file for kscd 19891!:mime text/x-xmcd 19892 19893#------------------------------------------------------------------------------ 19894# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $ 19895# keepass: file(1) magic for KeePass file 19896# 19897# Keepass Password Safe: 19898# * original one: https://keepass.info/ 19899# * *nix port: https://www.keepassx.org/ 19900# * android port: https://code.google.com/p/keepassdroid/ 19901 199020 lelong 0x9AA2D903 Keepass password database 19903>4 lelong 0xB54BFB65 1.x KDB 19904>>48 lelong >0 \b, %d groups 19905>>52 lelong >0 \b, %d entries 19906>>8 lelong&0x0f 1 \b, SHA-256 19907>>8 lelong&0x0f 2 \b, AES 19908>>8 lelong&0x0f 4 \b, RC4 19909>>8 lelong&0x0f 8 \b, Twofish 19910>>120 lelong >0 \b, %d key transformation rounds 19911>4 lelong 0xB54BFB67 2.x KDBX 19912 19913#------------------------------------------------------------------------------ 19914# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $ 19915# kerberos: MIT kerberos file binary formats 19916# 19917 19918# This magic entry is for demonstration purposes and could be improved 19919# if the following features were implemented in file: 19920# 19921# Strings inside [[ .. ]] in the descriptions have special meanings and 19922# are not printed. 19923# 19924# - Provide some form of iteration in number of components 19925# [[${counter}=%d]] in the description 19926# then append 19927# [${counter}--] in the offset of the entries 19928# - Provide a way to round the next offset 19929# Add [R:4] after the offset? 19930# - Provide a way to have optional entries 19931# XXX: Syntax: 19932# - Provide a way to "save" entries to print them later. 19933# if the description is [[${name}=%s]], then nothing is 19934# printed and a subsequent entry in the same magic file 19935# can refer to ${name} 19936# - Provide a way to format strings as hex values 19937# 19938# https://www.gnu.org/software/shishi/manual/html_node/\ 19939# The-Keytab-Binary-File-Format.html 19940# 19941 199420 name keytab_entry 19943#>0 beshort x \b, size=%d 19944#>2 beshort x \b, components=%d 19945>4 pstring/H x \b, realm=%s 19946>>&0 pstring/H x \b, principal=%s/ 19947>>>&0 pstring/H x \b%s 19948>>>>&0 belong x \b, type=%d 19949>>>>>&0 bedate x \b, date=%s 19950>>>>>>&0 byte x \b, kvno=%u 19951#>>>>>>>&0 pstring/H x 19952#>>>>>>>>&0 belong x 19953#>>>>>>>>>>&0 use keytab_entry 19954 199550 belong 0x05020000 Kerberos Keytab file 19956>4 use keytab_entry 19957 19958#------------------------------------------------------------------------------ 19959# $File: kicad,v 1.2 2020/05/06 14:03:28 christos Exp $ 19960# kicad: file(1) magic for KiCad files 19961# 19962# See 19963# 19964# http://kicad-pcb.org 19965# 19966 19967# KiCad Schematic Document 199680 string (kicad_sch 19969>10 byte 0x20 KiCad Schematic Document 19970!:ext kicad_sch/kicad_sch-bak 19971>>11 string (version 19972>>>19 byte 0x20 19973>>>>20 regex [0-9.]+ (Version %s) 19974 19975# KiCad Schematic Document (Legacy) 199760 string EESchema 19977>8 byte 0x20 19978>>9 string Schematic 19979>>>18 byte 0x20 KiCad Schematic Document (Legacy) 19980!:ext sch/bak 19981>>>>24 string Version 19982>>>>>31 byte 0x20 19983>>>>>>32 string x (Version %s) 19984 19985# KiCad Symbol Library 199860 string (kicad_symbol_lib 19987>17 byte 0x20 KiCad Symbol Library 19988!:ext kicad_sym 19989>>18 string (version 19990>>>26 byte 0x20 19991>>>>27 regex [0-9.]+ (Version %s) 19992 19993# KiCad Symbol Library (Legacy) 199940 string EESchema-LIBRARY 19995>16 byte 0x20 KiCad Symbol Library (Legacy) 19996!:ext lib 19997>>17 string Version 19998>>>24 byte 0x20 19999>>>>25 string x (Version %s) 20000 20001# KiCad Symbol Library Documentation (Legacy) 200020 string EESchema-DOCLIB 20003>15 byte 0x20 KiCad Symbol Library Documentation (Legacy) 20004!:ext dcm 20005>>17 string Version 20006>>>24 byte 0x20 20007>>>>25 string x (Version %s) 20008 20009# KiCad Board Layout 200100 string (kicad_pcb 20011>10 byte 0x20 KiCad Board Layout 20012!:ext kicad_pcb/kicad_pcb-bak 20013>>11 string (version 20014>>>19 byte 0x20 20015>>>>20 regex [0-9.]+ (Version %s) 20016 20017# KiCad Footprint 200180 string (module 20019>7 byte 0x20 KiCad Footprint 20020!:ext kicad_mod 20021 20022# KiCad Footprint (Legacy) 200230 string PCBNEW-LibModule-V1 KiCad Footprint (Legacy) 20024!:ext mod 20025 20026# KiCad Netlist 200270 string (export 20028>7 byte 0x20 KiCad Netlist 20029!:ext net 20030 20031# KiCad Symbol Library Table 200320 string (sym_lib_table 20033>14 byte 0xA KiCad Symbol Library Table 20034>14 byte 0xD KiCad Symbol Library Table 20035>14 byte 0x20 KiCad Symbol Library Table 20036 20037# KiCad Footprint Library Table 200380 string (fp_lib_table 20039>13 byte 0xA KiCad Footprint Library Table 20040>13 byte 0xD KiCad Footprint Library Table 20041>13 byte 0x20 KiCad Footprint Library Table 20042 20043#------------------------------------------------------------------------------ 20044# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $ 20045# Type: Google KML, formerly Keyhole Markup Language 20046# Future development of this format has been handed 20047# over to the Open Geospatial Consortium. 20048# https://www.opengeospatial.org/standards/kml/ 20049# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 200500 string/t \<?xml 20051>20 search/400 \ xmlns= 20052>>&0 regex ['"]http://earth.google.com/kml Google KML document 20053!:mime application/vnd.google-earth.kml+xml 20054>>>&1 string 2.0' \b, version 2.0 20055>>>&1 string 2.1' \b, version 2.1 20056>>>&1 string 2.2' \b, version 2.2 20057 20058#------------------------------------------------------------------------------ 20059# Type: OpenGIS KML, formerly Keyhole Markup Language 20060# This standard is maintained by the 20061# Open Geospatial Consortium. 20062# https://www.opengeospatial.org/standards/kml/ 20063# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 20064>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 20065!:mime application/vnd.google-earth.kml+xml 20066>>>&1 string/t 2.2 \b, version 2.2 20067 20068#------------------------------------------------------------------------------ 20069# Type: Google KML Archive (ZIP based) 20070# https://code.google.com/apis/kml/documentation/kml_tut.html 20071# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 200720 string PK\003\004 20073>4 byte 0x14 20074>>30 string doc.kml Compressed Google KML Document, including resources. 20075!:mime application/vnd.google-earth.kmz 20076#------------------------------------------------------------------------------ 20077# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $ 20078# 20079 20080# Magic file patterns for use with file(1) for the 20081# LAMMPS molecular dynamics simulation software. 20082# https://lammps.sandia.gov 20083# 20084# Updated: 2021-03-14 by akohlmey@gmail.com 20085 20086# Binary restart file for the LAMMPS MD code 200870 string LammpS\ RestartT LAMMPS binary restart file 20088>0x14 long x (rev %d), 20089>>0x20 string x Version %s, 20090>>>0x10 lelong 0x0001 Little Endian 20091>>>0x10 lelong 0x1000 Big Endian 20092 20093# Atom style binary dump file for the LAMMPS MD code 20094# written on a little endian machine 200950 lequad -8 20096>0x08 string DUMPATOM LAMMPS atom style binary dump 20097>>0x14 long x (rev %d), 20098>>>0x10 lelong 0x0001 Little Endian, 20099>>>>0x18 lequad x First time step: %lld 20100 20101# written on a big endian machine 201020 bequad -8 20103>0x08 string DUMPATOM LAMMPS atom style binary dump 20104>>0x14 belong x (rev %d), 20105>>>0x10 lelong 0x1000 Big Endian, 20106>>>>0x18 bequad x First time step: %lld 20107 20108# Atom style binary dump file for the LAMMPS MD code 20109# written on a little endian machine 201100 lequad -10 20111>0x08 string DUMPCUSTOM LAMMPS custom style binary dump 20112>>0x16 lelong x (rev %d), 20113>>>0x12 lelong 0x0001 Little Endian, 20114>>>>0x1a lequad x First time step: %lld 20115 20116# written on a big endian machine 201170 bequad -10 20118>0x08 string DUMPCUSTOM LAMMPS custom style binary dump 20119>>0x16 belong x (rev %d), 20120>>>0x12 lelong 0x1000 Big Endian, 20121>>>>0x1a bequad x First time step: %lld 20122 20123# LAMMPS log file 201240 string LAMMPS\ ( LAMMPS log file 20125>8 regex/16 [0-9]+\ [A-Za-z]+\ [0-9]+ written by version %s 20126 20127# Data file written either by LAMMPS, msi2lmp or VMD/TopoTools 201280 string LAMMPS\ data\ file LAMMPS data file 20129>0x12 string CGCMM\ style written by TopoTools 20130>0x12 string msi2lmp written by msi2lmp 20131>0x11 string via\ write_data written by LAMMPS 20132 20133# LAMMPS data file written by OVITO 201340 string #\ LAMMPS\ data\ file LAMMPS data file 20135>0x13 string written\ by\ OVITO written by OVITO 20136 20137# LAMMPS text mode dump file 201380 string ITEM:\ TIMESTEP LAMMPS text mode dump, 20139>15 regex/16 [0-9]+ First time step: %s 20140 20141#------------------------------------------------------------------------------ 20142# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 20143# DEC SRC Virtual Paper: Lectern files 20144# Karl M. Hegbloom <karlheg@inetarena.com> 201450 string lect DEC SRC Virtual Paper Lectern file 20146 20147#------------------------------------------------------------------------------ 20148# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 20149# lex: file(1) magic for lex 20150# 20151# derived empirically, your offsets may vary! 201520 search/100 yyprevious C program text (from lex) 20153>3 search/1 >\0 for %s 20154# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 201550 search/100 generated\ by\ flex C program text (from flex) 20156# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 201570 search/1 %{ lex description text 20158 20159#------------------------------------------------------------------------------ 20160# $File: lif,v 1.9 2021/02/26 03:13:48 christos Exp $ 20161# lif: file(1) magic for lif 20162# 20163# (Daniel Quinlan <quinlan@yggdrasil.com>) 20164# 20165# Modified by: Joerg Jenderek 20166# URL: https://www.hp9845.net/9845/projects/hpdir/ 20167# https://github.com/bug400/lifutils 20168# Reference: https://www.hp9845.net/9845/downloads/manuals/LIF_excerpt_64941-90906_flpRef_Jan84.pdf 20169# Note: called by TrID "HP Logical Interchange Format disk image" 201700 beshort 0x8000 20171# GRR: line above is too general as it catches also compressed DEGAS low-res bitmap *.pc1 20172# skip many compressed DEGAS low-res bitmap *.pc1 by test for unused bytes 20173>14 beshort =0 20174# skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number 20175>>20 ubeshort <0x0100 20176# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name 20177#>>>2 ubelong >0x2020201F 20178>>>0 use lif-file 201790 name lif-file 20180# LIF ID 20181>0 beshort x lif file 20182!:mime application/x-lif-disk 20183# lif used by Tony Duell LIF utilities; enhanced version by Joachim Siebold use also dat; hpi used by hpdir 20184!:ext lif/hpi/dat 20185# volume label; A-Z 0-9 _ ; default are 6 spaces 20186>2 string x "%.6s" 20187# version number; 0 for systems without extensions or 1 for model 64000 20188>20 ubeshort x \b, version %u 20189# LIF identifier; 010000 for system 3000 20190>12 beshort !0x1000 \b, LIF identifier 0x%x 20191# directory start address in units like: 2 20192>8 ubelong x \b, directory 20193>8 ubelong !2 start address %u 20194# length of directory like: 2 4 7 10 12 14 (for model 64000) 16 18 20 24 30 50 57 77 80 20195>16 ubelong x length %u 20196# level 1 extensions 20197>20 beshort =0 20198>>24 ubequad !0 \b, for extensions 0x%llx... 20199>20 beshort >0 20200>>24 ubequad !0 \b, extensions 0x%llx... 20201# word 21-126 reserved for extensions and future use; set to nil 20202>42 ubequad !0 \b, RESERVED 0x%llx 20203# lif first file name for standard directory; 0xffff... means uninitialized 20204>8 ubelong 2 20205>>512 string <\xff\xff \b, 1st file %-.10s 20206 20207 20208#------------------------------------------------------------------------------ 20209# $File: linux,v 1.77 2021/02/24 23:05:02 christos Exp $ 20210# linux: file(1) magic for Linux files 20211# 20212# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 20213# The following basic Linux magic is useful for reference, but using 20214# "long" magic is a better practice in order to avoid collisions. 20215# 20216# 2 leshort 100 Linux/i386 20217# >0 leshort 0407 impure executable (OMAGIC) 20218# >0 leshort 0410 pure executable (NMAGIC) 20219# >0 leshort 0413 demand-paged executable (ZMAGIC) 20220# >0 leshort 0314 demand-paged executable (QMAGIC) 20221# 202220 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 20223>16 lelong 0 \b, stripped 202240 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 20225>16 lelong 0 \b, stripped 202260 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 20227>16 lelong 0 \b, stripped 202280 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 20229>16 lelong 0 \b, stripped 20230# 202310 string \007\001\000 Linux/i386 object file 20232>20 lelong >0x1020 \b, DLL library 20233# Linux-8086 stuff: 202340 string \01\03\020\04 Linux-8086 impure executable 20235>28 long !0 not stripped 202360 string \01\03\040\04 Linux-8086 executable 20237>28 long !0 not stripped 20238# 202390 string \243\206\001\0 Linux-8086 object file 20240# 202410 string \01\03\020\20 Minix-386 impure executable 20242>28 long !0 not stripped 202430 string \01\03\040\20 Minix-386 executable 20244>28 long !0 not stripped 202450 string \01\03\04\20 Minix-386 NSYM/GNU executable 20246>28 long !0 not stripped 20247# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 20248216 lelong 0421 Linux/i386 core file 20249!:strength / 2 20250>220 string >\0 of '%s' 20251>200 lelong >0 (signal %d) 20252# 20253# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 20254# this can be overridden by the DOS executable (COM) entry 202552 string LILO Linux/i386 LILO boot/chain loader 20256# 20257# Linux make config build file, from Ole Aamot <oka@oka.no> 20258# Updated by Ken Sharp 2025928 string make\ config Linux make config build file (old) 2026049 search/70 Kernel\ Configuration Linux make config build file 20261 20262# 20263# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 20264# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 20265# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 202660 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 20267>2 byte&0x01 0 256 characters, 20268>2 byte&0x01 !0 512 characters, 20269>2 byte&0x02 0 no directory, 20270>2 byte&0x02 !0 Unicode directory, 20271>3 byte >0 8x%d 202720 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 20273>16 lelong x %d characters, 20274>12 lelong&0x01 0 no directory, 20275>12 lelong&0x01 !0 Unicode directory, 20276>24 lelong x %d 20277>28 lelong x \bx%d 20278 20279# Linux swap and hibernate files 20280# Linux kernel: include/linux/swap.h 20281# util-linux: libblkid/src/superblocks/swap.c 20282 20283# format v0, unsupported since 2002 202840xff6 string SWAP-SPACE Linux old swap file, 4k page size 202850x1ff6 string SWAP-SPACE Linux old swap file, 8k page size 202860x3ff6 string SWAP-SPACE Linux old swap file, 16k page size 202870x7ff6 string SWAP-SPACE Linux old swap file, 32k page size 202880xfff6 string SWAP-SPACE Linux old swap file, 64k page size 20289 20290# format v1, supported since 1998 202910 name linux-swap 20292>0x400 lelong 1 little endian, version %u, 20293>>0x404 lelong x size %u pages, 20294>>0x408 lelong x %u bad pages, 20295>0x400 belong 1 big endian, version %u, 20296>>0x404 belong x size %u pages, 20297>>0x408 belong x %u bad pages, 20298>0x41c string \0 no label, 20299>0x41c string >\0 LABEL=%s, 20300>0x40c belong x UUID=%08x 20301>0x410 beshort x \b-%04x 20302>0x412 beshort x \b-%04x 20303>0x414 beshort x \b-%04x 20304>0x416 belong x \b-%08x 20305>0x41a beshort x \b%04x 20306 203070xff6 string SWAPSPACE2 Linux swap file, 4k page size, 20308>0 use linux-swap 203090x1ff6 string SWAPSPACE2 Linux swap file, 8k page size, 20310>0 use linux-swap 203110x3ff6 string SWAPSPACE2 Linux swap file, 16k page size, 20312>0 use linux-swap 203130x7ff6 string SWAPSPACE2 Linux swap file, 32k page size, 20314>0 use linux-swap 203150xfff6 string SWAPSPACE2 Linux swap file, 64k page size, 20316>0 use linux-swap 20317 203180 name linux-hibernate 20319>0 string S1SUSPEND \b, with SWSUSP1 image 20320>0 string S2SUSPEND \b, with SWSUSP2 image 20321>0 string ULSUSPEND \b, with uswsusp image 20322>0 string LINHIB0001 \b, with compressed hibernate image 20323>0 string \xed\xc3\x02\xe9\x98\x56\xe5\x0c \b, with tuxonice image 20324>0 default x \b, with unknown hibernate image 20325 203260xfec string SWAPSPACE2 Linux swap file, 4k page size, 20327>0 use linux-swap 20328>0xff6 use linux-hibernate 203290x1fec string SWAPSPACE2 Linux swap file, 8k page size, 20330>0 use linux-swap 20331>0x1ff6 use linux-hibernate 203320x3fec string SWAPSPACE2 Linux swap file, 16k page size, 20333>0 use linux-swap 20334>0x3ff6 use linux-hibernate 203350x7fec string SWAPSPACE2 Linux swap file, 32k page size, 20336>0 use linux-swap 20337>0x7ff6 use linux-hibernate 203380xffec string SWAPSPACE2 Linux swap file, 64k page size, 20339>0 use linux-swap 20340>0xfff6 use linux-hibernate 20341 20342# 20343# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 20344# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 20345# and Nicolas Lichtmaier <nick@debian.org> 20346# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 20347# Linux kernel boot images (i386 arch) (Wolfram Kleff) 20348# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt 20349514 string HdrS Linux kernel 20350!:strength + 55 20351# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes 20352# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin 20353# DamnSmallLinux 1.5 damnsmll.lnx 20354!:ext /dat/bin/lnx 20355>510 leshort 0xAA55 x86 boot executable 20356>>518 leshort >0x1ff 20357>>>529 byte 0 zImage, 20358>>>529 byte 1 bzImage, 20359>>>526 lelong >0 20360>>>>(526.s+0x200) string >\0 version %s, 20361>>498 leshort 1 RO-rootFS, 20362>>498 leshort 0 RW-rootFS, 20363>>508 leshort >0 root_dev 0x%X, 20364>>502 leshort >0 swap_dev 0x%X, 20365>>504 leshort >0 RAMdisksize %u KB, 20366>>506 leshort 0xFFFF Normal VGA 20367>>506 leshort 0xFFFE Extended VGA 20368>>506 leshort 0xFFFD Prompt for Videomode 20369>>506 leshort >0 Video mode %d 20370# This also matches new kernels, which were caught above by "HdrS". 203710 belong 0xb8c0078e Linux kernel 20372>0x1e3 string Loading version 1.3.79 or older 20373>0x1e9 string Loading from prehistoric times 20374 20375# System.map files - Nicolas Lichtmaier <nick@debian.org> 203768 search/1 \ A\ _text Linux kernel symbol map text 20377 20378# LSM entries - Nicolas Lichtmaier <nick@debian.org> 203790 search/1 Begin3 Linux Software Map entry text 203800 search/1 Begin4 Linux Software Map entry text (new format) 20381 20382# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 203830 belong 0x4f4f4f4d User-mode Linux COW file 20384>4 belong <3 \b, version %d 20385>>8 string >\0 \b, backing file %s 20386>4 belong >2 \b, version %d 20387>>32 string >\0 \b, backing file %s 20388 20389############################################################################ 20390# Linux kernel versions 20391 203920 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 20393>497 leshort 0 x86 boot sector 20394>>514 belong 0x8e of a kernel from the dawn of time! 20395>>514 belong 0x908ed8b4 version 0.99-1.1.42 20396>>514 belong 0x908ed8b8 for memtest86 20397 20398>497 leshort !0 x86 kernel 20399>>504 leshort >0 RAMdisksize=%u KB 20400>>502 leshort >0 swap=0x%X 20401>>508 leshort >0 root=0x%X 20402>>>498 leshort 1 \b-ro 20403>>>498 leshort 0 \b-rw 20404>>506 leshort 0xFFFF vga=normal 20405>>506 leshort 0xFFFE vga=extended 20406>>506 leshort 0xFFFD vga=ask 20407>>506 leshort >0 vga=%d 20408>>514 belong 0x908ed881 version 1.1.43-1.1.45 20409>>514 belong 0x15b281cd 20410>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 20411>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 20412>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 20413>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 20414>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 20415>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 20416>>514 string HdrS 20417>>>518 leshort >0x1FF 20418>>>>529 byte 0 \b, zImage 20419>>>>529 byte 1 \b, bzImage 20420>>>>(526.s+0x200) string >\0 \b, version %s 20421 20422# Linux boot sector thefts. 204230 belong 0xb8c0078e Linux 20424>0x1e6 belong 0x454c4b53 ELKS Kernel 20425>0x1e6 belong !0x454c4b53 style boot sector 20426 20427############################################################################ 20428# Linux S390 kernel image 20429# Created by: Jan Kaluza <jkaluza@redhat.com> 204308 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 20431>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 20432# 64bit 20433>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 20434>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 20435>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 20436>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 20437# 32bit 20438>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 20439>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 20440>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 20441>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 20442 20443############################################################################ 20444# Linux ARM compressed kernel image 20445# From: Kevin Cernekee <cernekee@gmail.com> 20446# Update: Joerg Jenderek 204470x24 lelong 0x016f2818 Linux kernel ARM boot executable zImage 20448# There are three possible situations: LE, BE with LE bootloader and pure BE. 20449# In order to aid telling these apart a new endian flag was added. In order 20450# to support kernels before the flag and BE with LE bootloader was added we'll 20451# do a negative check against the BE variant of the flag when we see a LE magic. 20452>0x30 belong !0x04030201 (little-endian) 20453# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin" 20454!:ext img/bin 20455>0x30 belong 0x04030201 (big-endian) 204560x24 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 20457 20458############################################################################ 20459# Linux AARCH64 kernel image 204600x38 lelong 0x644d5241 Linux kernel ARM64 boot executable Image 20461>0x18 lelong ^1 \b, little-endian 20462>0x18 lelong &1 \b, big-endian 20463>0x18 lelong &2 \b, 4K pages 20464>0x18 lelong &4 \b, 16K pages 20465>0x18 lelong &6 \b, 32K pages 20466 20467############################################################################ 20468# Linux 8086 executable 204690 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 20470>5 string . 20471>>4 string >\0 \b, libc version %s 20472 204730 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 20474>2 byte&0x01 !0 \b, unmapped zero page 20475>2 byte&0x20 0 \b, impure 20476>2 byte&0x20 !0 20477>>2 byte&0x10 !0 \b, A_EXEC 20478>2 byte&0x02 !0 \b, A_PAL 20479>2 byte&0x04 !0 \b, A_NSYM 20480>2 byte&0x08 !0 \b, A_STAND 20481>2 byte&0x40 !0 \b, A_PURE 20482>2 byte&0x80 !0 \b, A_TOVLY 20483>28 long !0 \b, not stripped 20484>37 string . 20485>>36 string >\0 \b, libc version %s 20486 20487# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 20488# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 20489# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 20490# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 20491 20492# SYSLINUX boot logo files (from 'ppmtolss16' sources) 20493# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 20494# file extension .lss .16 204950 lelong =0x1413f33d SYSLINUX' LSS16 image data 20496# syslinux-4.05/mime/image/x-lss16.xml 20497!:mime image/x-lss16 20498>4 leshort x \b, width %d 20499>6 leshort x \b, height %d 20500 205010 string OOOM User-Mode-Linux's Copy-On-Write disk image 20502>4 belong x version %d 20503 20504# SE Linux policy database 20505# From: Mike Frysinger <vapier@gentoo.org> 205060 lelong 0xf97cff8c SE Linux policy 20507>16 lelong x v%d 20508>20 lelong 1 MLS 20509>24 lelong x %d symbols 20510>28 lelong x %d ocons 20511 20512# Linux Logical Volume Manager (LVM) 20513# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 20514# 20515# System ID, UUID and volume group name are 128 bytes long 20516# but they should never be full and initialized with zeros... 20517# 20518# LVM1 20519# 205200x0 string/b HM\001 LVM1 (Linux Logical Volume Manager), version 1 20521>0x12c string/b >\0 , System ID: %s 20522 205230x0 string/b HM\002 LVM1 (Linux Logical Volume Manager), version 2 20524>0x12c string/b >\0 , System ID: %s 20525 20526# LVM2 20527# 20528# It seems that the label header can be in one the four first sector 20529# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 20530# 20531# 0x200 seems to be the common case 205320 name lvm2 20533# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 20534>0x0 string >\x2f \b, UUID: %.6s 20535>0x6 string >\x2f \b-%.4s 20536>0xa string >\x2f \b-%.4s 20537>0xe string >\x2f \b-%.4s 20538>0x12 string >\x2f \b-%.4s 20539>0x16 string >\x2f \b-%.4s 20540>0x1a string >\x2f \b-%.6s 20541>0x20 lequad x \b, size: %lld 20542 20543 20544# read the offset to add to the start of the header, and the header 20545# start in 0x200 205460x218 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20547>&(&-12.l-0x20) use lvm2 20548 205490x018 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20550>&(&-12.l-0x20) use lvm2 20551 205520x418 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20553>&(&-12.l-0x20) use lvm2 20554 205550x618 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 20556>&(&-12.l-0x20) use lvm2 20557 20558# LVM snapshot 20559# from Jason Farrel 205600 string SnAp LVM Snapshot (CopyOnWrite store) 20561>4 lelong !0 - valid, 20562>4 lelong 0 - invalid, 20563>8 lelong x version %d, 20564>12 lelong x chunk_size %d 20565 20566# SE Linux policy database 205670 lelong 0xf97cff8c SE Linux policy 20568>16 lelong x v%d 20569>20 lelong 1 MLS 20570>24 lelong x %d symbols 20571>28 lelong x %d ocons 20572 20573# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 20574# Anthon van der Neut (anthon@mnt.org) 205750 string LUKS\xba\xbe LUKS encrypted file, 20576>6 beshort x ver %d 20577>8 string x [%s, 20578>40 string x %s, 20579>72 string x %s] 20580>168 string x UUID: %s 20581 20582 20583# Summary: Xen saved domain file 20584# Created by: Radek Vokal <rvokal@redhat.com> 205850 string LinuxGuestRecord Xen saved domain 20586>20 search/256 (name 20587>>&1 string x (name %s) 20588 20589# Type: Xen, the virtual machine monitor 20590# From: Radek Vokal <rvokal@redhat.com> 205910 string LinuxGuestRecord Xen saved domain 20592#>2 regex \(name\ [^)]*\) %s 20593>20 search/256 (name (name 20594>>&1 string x %s...) 20595 20596# Systemd journald files 20597# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/. 20598# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 20599 20600# check magic 206010 string LPKSHHRH 20602# check that state is one of known values 20603>16 ubyte&252 0 20604# check that each half of three unique id128s is non-zero 20605>>24 ubequad >0 20606>>>32 ubequad >0 20607>>>>40 ubequad >0 20608>>>>>48 ubequad >0 20609>>>>>>56 ubequad >0 20610>>>>>>>64 ubequad >0 Journal file 20611!:mime application/octet-stream 20612# provide more info 20613>>>>>>>>184 leqdate 0 empty 20614>>>>>>>>16 ubyte 0 \b, offline 20615>>>>>>>>16 ubyte 1 \b, online 20616>>>>>>>>16 ubyte 2 \b, archived 20617>>>>>>>>8 ulelong&1 1 \b, sealed 20618>>>>>>>>12 ulelong&1 1 \b, compressed 20619 20620# BCache backing and cache devices 20621# From: Gabriel de Perthuis <g2p.code@gmail.com> 206220x1008 lequad 8 20623>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 20624>>0x1010 ulequad 0 cache device 20625>>0x1010 ulequad 1 backing device 20626>>0x1010 ulequad 3 cache device 20627>>0x1010 ulequad 4 backing device 20628>>0x1048 string >0 \b, label "%.32s" 20629>>0x1028 ubelong x \b, uuid %08x 20630>>0x102c ubeshort x \b-%04x 20631>>0x102e ubeshort x \b-%04x 20632>>0x1030 ubeshort x \b-%04x 20633>>0x1032 ubelong x \b-%08x 20634>>0x1036 ubeshort x \b%04x 20635>>0x1038 ubelong x \b, set uuid %08x 20636>>0x103c ubeshort x \b-%04x 20637>>0x103e ubeshort x \b-%04x 20638>>0x1040 ubeshort x \b-%04x 20639>>0x1042 ubelong x \b-%08x 20640>>0x1046 ubeshort x \b%04x 20641 20642# Linux device tree: 20643# File format description can be found in the Linux kernel sources at 20644# Documentation/devicetree/booting-without-of.txt 20645# From Christoph Biedl 206460 belong 0xd00dfeed 20647# structure must be within blob, strings are omitted to handle devicetrees > 1M 20648>&(8.L) byte x 20649>>20 belong >1 Device Tree Blob version %d 20650>>>4 belong x \b, size=%d 20651>>>20 belong >1 20652>>>>28 belong x \b, boot CPU=%d 20653>>>20 belong >2 20654>>>>32 belong x \b, string block size=%d 20655>>>20 belong >16 20656>>>>36 belong x \b, DT structure block size=%d 20657 20658# glibc locale archive as defined in glibc locale/locarchive.h 206590 lelong 0xde020109 locale archive 20660>24 lelong x %d strings 20661 20662# Linux Software RAID (mdadm) 20663# Russell Coker <russell@coker.com.au> 206640 name linuxraid 20665>16 belong x UUID=%8x: 20666>20 belong x \b%8x: 20667>24 belong x \b%8x: 20668>28 belong x \b%8x 20669>32 string x name=%s 20670>72 lelong x level=%d 20671>92 lelong x disks=%d 20672 206734096 lelong 0xa92b4efc Linux Software RAID 20674>4100 lelong x version 1.2 (%d) 20675>4096 use linuxraid 20676 206770 lelong 0xa92b4efc Linux Software RAID 20678>4 lelong x version 1.1 (%d) 20679>0 use linuxraid 20680 20681# Summary: Database file for mlocate 20682# Description: A database file as used by mlocate, a fast implementation 20683# of locate/updatedb. It uses merging to reuse the existing 20684# database and avoid rereading most of the filesystem. It's 20685# the default version of locate on Arch Linux (and others). 20686# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 20687# Site: https://fedorahosted.org/mlocate/ 20688# Format docs: https://linux.die.net/man/5/mlocate.db 20689# Type: mlocate database file 20690# URL: https://fedorahosted.org/mlocate/ 20691# From: Wander Nauta <info@wandernauta.nl> 206920 string \0mlocate mlocate database 20693>12 byte x \b, version %d 20694>13 byte 1 \b, require visibility 20695>16 string x \b, root %s 20696 20697# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL: 20698# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 20699# From: Pavel Emelyanov <xemul@parallels.com> 207000 lelong 0x45311224 iproute2 routes dump 207010 lelong 0x47361222 iproute2 addresses dump 20702 20703# Image and service files for CRIU tool. 20704# URL: https://criu.org 20705# From: Pavel Emelyanov <xemul@parallels.com> 207060 lelong 0x54564319 CRIU image file v1.1 207070 lelong 0x55105940 CRIU service file 207080 lelong 0x58313116 CRIU inventory 20709 20710# Kdump compressed dump files 20711# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 20712 207130 string KDUMP Kdump compressed dump 20714>8 long x v%d 20715>12 string >\0 \b, system %s 20716>77 string >\0 \b, node %s 20717>142 string >\0 \b, release %s 20718>207 string >\0 \b, version %s 20719>272 string >\0 \b, machine %s 20720>337 string >\0 \b, domain %s 20721 20722# Device Tree files 207230 search/1024 /dts-v1/ Device Tree File (v1) 20724# beat c code 20725!:strength +14 20726 20727 20728# e2fsck undo file 20729# David Gilman <davidgilman1@gmail.com> 207300 string E2UNDO02 e2fsck undo file, version 2 20731>44 lelong x \b, undo file is 20732>>44 lelong&1 0 not finished 20733>>44 lelong&1 1 finished 20734>48 lelong x \b, undo file features: 20735>>48 lelong&1 0 lacks filesystem offset 20736>>48 lelong&1 1 has filesystem offset 20737>>>64 lequad x at 0x%llx 20738 20739# ansible vault (does not really belong here) 207400 string $ANSIBLE_VAULT; Ansible Vault 20741>&0 regex [0-9]*\.[0-9]* \b, version %s 20742>>&0 string ; 20743>>>&0 regex [A-Z0-9]* \b, encryption %s 20744 20745#------------------------------------------------------------------------------ 20746# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $ 20747# lisp: file(1) magic for lisp programs 20748# 20749# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 20750 20751# updated by Joerg Jenderek 20752# GRR: This lot is too weak 20753#0 string ;; 20754# windows INF files often begin with semicolon and use CRLF as line end 20755# lisp files are mainly created on unix system with LF as line end 20756#>2 search/4096 !\r Lisp/Scheme program text 20757#>2 search/4096 \r Windows INF file 20758 207590 search/4096 (setq\ Lisp/Scheme program text 20760!:mime text/x-lisp 207610 search/4096 (defvar\ Lisp/Scheme program text 20762!:mime text/x-lisp 207630 search/4096 (defparam\ Lisp/Scheme program text 20764!:mime text/x-lisp 207650 search/4096 (defun\ Lisp/Scheme program text 20766!:mime text/x-lisp 207670 search/4096 (autoload\ Lisp/Scheme program text 20768!:mime text/x-lisp 207690 search/4096 (custom-set-variables\ Lisp/Scheme program text 20770!:mime text/x-lisp 20771 20772# URL: https://en.wikipedia.org/wiki/Emacs_Lisp 20773# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz 20774# Update: Joerg Jenderek 20775# Emacs 18 - this is always correct, but not very magical. 207760 string \012( 20777# look for emacs lisp keywords 20778# GRR: split regex because it is too long or get error like 20779# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|' 20780>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data 20781!:mime application/x-elc 20782# https://searchcode.com/codesearch/view/2173420/ 20783# not really pure text 20784!:apple EMAxTEXT 20785!:ext elc 20786# remaining regex 20787>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data 20788!:mime application/x-elc 20789!:apple EMAxTEXT 20790!:ext elc 20791# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;; 20792 20793# Emacs 19+ - ver. recognition added by Ian Springer 20794# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 20795# - Chris Chittleborough <cchittleborough@yahoo.com.au> 20796# Update: Joerg Jenderek 207970 string ;ELC 20798# version\0\0\0 20799>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data 20800# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015 20801#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 20802!:mime application/x-elc 20803!:apple EMAxTEXT 20804!:ext elc 20805 20806# Files produced by GNU/Emacs pdumper 208070 string DUMPEDGNUEMACS GNU/Emacs pdumper image 20808 20809# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 208100 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 208110 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 20812 208130 long 0x70768BD2 CLISP memory image data 208140 long 0xD28B7670 CLISP memory image data, other endian 20815 20816#.com and .bin for MIT scheme 208170 string \372\372\372\372 MIT scheme (library?) 20818 20819# From: David Allouche <david@allouche.net> 208200 search/1 \<TeXmacs| TeXmacs document text 20821!:mime text/texmacs 20822 20823#------------------------------------------------------------------------------ 20824# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $ 20825# llvm: file(1) magic for LLVM byte-codes 20826# URL: https://llvm.org/docs/BitCodeFormat.html 20827# From: Al Stone <ahs3@fc.hp.com> 20828 208290 string llvm LLVM byte-codes, uncompressed 208300 string llvc0 LLVM byte-codes, null compression 208310 string llvc1 LLVM byte-codes, gzip compression 208320 string llvc2 LLVM byte-codes, bzip2 compression 20833 208340 lelong 0x0b17c0de LLVM bitcode, wrapper 20835# Are these Mach-O ABI values? They appear to be. 20836>16 lelong 0x01000007 x86_64 20837>16 lelong 0x00000007 i386 20838>16 lelong 0x00000012 ppc 20839>16 lelong 0x01000012 ppc64 20840>16 lelong 0x0000000c arm 20841 208420 string BC\xc0\xde LLVM IR bitcode 20843 20844#------------------------------------------------------------------------------ 20845# $File: locoscript,v 1.1 2021/01/03 20:56:25 christos Exp $ 20846# locoscript: file(1) magic for LocoScript documents and related files 20847# 20848# See http://fileformats.archiveteam.org/wiki/LocoScript 208490 string JOY\x01\x01 LocoScript 1 document 208500 string JOY\x01\x02 LocoScript 2 document 208510 string JOY\x01\x04 LocoScript 3 document 208520 string JOY\x01\x06 LocoScript 4 document 208530 string DOC\x01\x01 LocoScript PC document 208540 string DOC\x01\x03 LocoScript Professional document 20855 20856#------------------------------------------------------------------------------ 20857# $File: lua,v 1.8 2020/10/08 23:23:56 christos Exp $ 20858# lua: file(1) magic for Lua scripting language 20859# URL: https://www.lua.org/ 20860# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 20861 20862# Lua scripts 208630 search/1/w #!\ /usr/bin/lua Lua script text executable 20864!:mime text/x-lua 208650 search/1/w #!\ /usr/local/bin/lua Lua script text executable 20866!:mime text/x-lua 208670 search/1 #!/usr/bin/env\ lua Lua script text executable 20868!:mime text/x-lua 208690 search/1 #!\ /usr/bin/env\ lua Lua script text executable 20870!:mime text/x-lua 20871 20872# Lua bytecode 208730 string \033Lua Lua bytecode, 20874# 2.4 uses 0x23 as its version byte because it shares the format 20875# with 2.3 (which was never released publicly). 20876>4 byte 0x23 version 2.4 20877>4 byte 0x25 version 2.5/3.0 20878>4 byte 0x31 version 3.1 20879>4 byte 0x32 version 3.2 20880>4 byte 0x40 version 4.0 20881>4 byte 0x50 version 5.0 20882>4 byte 0x51 version 5.1 20883>4 byte 0x52 version 5.2 20884>4 byte 0x53 version 5.3 20885>4 byte 0x54 version 5.4 20886 20887#------------------------------------------------------------------------------ 20888# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 20889# luks: file(1) magic for Linux Unified Key Setup 20890# URL: http://luks.endorphin.org/spec 20891# From: Anthon van der Neut <anthon@mnt.org> 20892 208930 string LUKS\xba\xbe LUKS encrypted file, 20894>6 beshort x ver %d 20895>8 string x [%s, 20896>40 string x %s, 20897>72 string x %s] 20898>168 string x UUID: %s 20899#------------------------------------------------------------------------------ 20900# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $ 20901# make: file(1) magic for M4 scripts 20902# 209030 search/8192 dnl 20904>0 regex \^dnl\ M4 macro processor script text 20905!:mime text/x-m4 209060 search/8192 AC_DEFUN 20907>0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text 20908!:strength + 15 20909!:mime text/x-m4 20910 20911#------------------------------------------------------------ 20912# $File: mach,v 1.28 2020/12/12 20:01:47 christos Exp $ 20913# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 20914# Unfortunately the first, cafebabe, is shared with 20915# Java ByteCode, so they are both handled in the file "cafebabe". 20916# The "feedface" ones are handled herein. 20917#------------------------------------------------------------ 20918# if set, it's for the 64-bit version of the architecture 20919# yes, this is separate from the low-order magic number bit 20920# it's also separate from the "64-bit libraries" bit in the 20921# upper 8 bits of the CPU subtype 20922 20923# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 20924# include/mach-o/loader.h 20925# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 209260 name mach-o-cpu 20927>0 belong&0xff000000 0 20928# 20929# 32-bit ABIs. 20930# 20931# 1 vax 20932>>0 belong&0x00ffffff 1 20933>>>4 belong&0x00ffffff 0 vax 20934>>>4 belong&0x00ffffff 1 vax11/780 20935>>>4 belong&0x00ffffff 2 vax11/785 20936>>>4 belong&0x00ffffff 3 vax11/750 20937>>>4 belong&0x00ffffff 4 vax11/730 20938>>>4 belong&0x00ffffff 5 uvaxI 20939>>>4 belong&0x00ffffff 6 uvaxII 20940>>>4 belong&0x00ffffff 7 vax8200 20941>>>4 belong&0x00ffffff 8 vax8500 20942>>>4 belong&0x00ffffff 9 vax8600 20943>>>4 belong&0x00ffffff 10 vax8650 20944>>>4 belong&0x00ffffff 11 vax8800 20945>>>4 belong&0x00ffffff 12 uvaxIII 20946>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 20947>>0 belong&0x00ffffff 2 romp 20948>>0 belong&0x00ffffff 3 architecture=3 20949>>0 belong&0x00ffffff 4 ns32032 20950>>0 belong&0x00ffffff 5 ns32332 20951>>0 belong&0x00ffffff 6 m68k 20952# 7 x86 20953>>0 belong&0x00ffffff 7 20954>>>4 belong&0x0000000f 3 i386 20955>>>4 belong&0x0000000f 4 i486 20956>>>>4 belong&0x00fffff0 0 20957>>>>4 belong&0x00fffff0 0x80 \bsx 20958>>>4 belong&0x0000000f 5 i586 20959>>>4 belong&0x0000000f 6 20960>>>>4 belong&0x00fffff0 0 p6 20961>>>>4 belong&0x00fffff0 0x10 pentium_pro 20962>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 20963>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 20964>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 20965>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 20966>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 20967>>>4 belong&0x0000000f 7 celeron 20968>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 20969>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 20970>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 20971>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 20972>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 20973>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 20974>>>>4 belong&0x00fffff0 0x60 20975>>>>4 belong&0x00fffff0 0x70 \b_mobile 20976>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 20977>>>4 belong&0x0000000f 8 pentium_3 20978>>>>4 belong&0x00fffff0 0x00 20979>>>>4 belong&0x00fffff0 0x10 \b_m 20980>>>>4 belong&0x00fffff0 0x20 \b_xeon 20981>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 20982>>>4 belong&0x0000000f 9 pentiumM 20983>>>>4 belong&0x00fffff0 0x00 20984>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 20985>>>4 belong&0x0000000f 10 pentium_4 20986>>>>4 belong&0x00fffff0 0x00 20987>>>>4 belong&0x00fffff0 0x10 \b_m 20988>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20989>>>4 belong&0x0000000f 11 itanium 20990>>>>4 belong&0x00fffff0 0x00 20991>>>>4 belong&0x00fffff0 0x10 \b_2 20992>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20993>>>4 belong&0x0000000f 12 xeon 20994>>>>4 belong&0x00fffff0 0x00 20995>>>>4 belong&0x00fffff0 0x10 \b_mp 20996>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 20997>>>4 belong&0x0000000f >12 ia32 family=%d 20998>>>>4 belong&0x00fffff0 0x00 20999>>>>4 belong&0x00fffff0 >0x00 model=%x 21000>>0 belong&0x00ffffff 8 mips 21001>>>4 belong&0x00ffffff 1 R2300 21002>>>4 belong&0x00ffffff 2 R2600 21003>>>4 belong&0x00ffffff 3 R2800 21004>>>4 belong&0x00ffffff 4 R2000a 21005>>>4 belong&0x00ffffff 5 R2000 21006>>>4 belong&0x00ffffff 6 R3000a 21007>>>4 belong&0x00ffffff 7 R3000 21008>>>4 belong&0x00ffffff >7 subarchitecture=%d 21009>>0 belong&0x00ffffff 9 ns32532 21010>>0 belong&0x00ffffff 10 mc98000 21011>>0 belong&0x00ffffff 11 hppa 21012>>>4 belong&0x00ffffff 0 7100 21013>>>4 belong&0x00ffffff 1 7100LC 21014>>>4 belong&0x00ffffff >1 subarchitecture=%d 21015>>0 belong&0x00ffffff 12 arm 21016>>>4 belong&0x00ffffff 0 21017>>>4 belong&0x00ffffff 1 subarchitecture=%d 21018>>>4 belong&0x00ffffff 2 subarchitecture=%d 21019>>>4 belong&0x00ffffff 3 subarchitecture=%d 21020>>>4 belong&0x00ffffff 4 subarchitecture=%d 21021>>>4 belong&0x00ffffff 5 \bv4t 21022>>>4 belong&0x00ffffff 6 \bv6 21023>>>4 belong&0x00ffffff 7 \bv5tej 21024>>>4 belong&0x00ffffff 8 \bxscale 21025>>>4 belong&0x00ffffff 9 \bv7 21026>>>4 belong&0x00ffffff 10 \bv7f 21027>>>4 belong&0x00ffffff 11 \bv7s 21028>>>4 belong&0x00ffffff 12 \bv7k 21029>>>4 belong&0x00ffffff 13 \bv8 21030>>>4 belong&0x00ffffff 14 \bv6m 21031>>>4 belong&0x00ffffff 15 \bv7m 21032>>>4 belong&0x00ffffff 16 \bv7em 21033>>>4 belong&0x00ffffff >16 subarchitecture=%d 21034# 13 m88k 21035>>0 belong&0x00ffffff 13 21036>>>4 belong&0x00ffffff 0 mc88000 21037>>>4 belong&0x00ffffff 1 mc88100 21038>>>4 belong&0x00ffffff 2 mc88110 21039>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 21040>>0 belong&0x00ffffff 14 SPARC 21041>>0 belong&0x00ffffff 15 i860g 21042>>0 belong&0x00ffffff 16 alpha 21043>>0 belong&0x00ffffff 17 rs6000 21044>>0 belong&0x00ffffff 18 ppc 21045>>>4 belong&0x00ffffff 0 21046>>>4 belong&0x00ffffff 1 \b_601 21047>>>4 belong&0x00ffffff 2 \b_602 21048>>>4 belong&0x00ffffff 3 \b_603 21049>>>4 belong&0x00ffffff 4 \b_603e 21050>>>4 belong&0x00ffffff 5 \b_603ev 21051>>>4 belong&0x00ffffff 6 \b_604 21052>>>4 belong&0x00ffffff 7 \b_604e 21053>>>4 belong&0x00ffffff 8 \b_620 21054>>>4 belong&0x00ffffff 9 \b_750 21055>>>4 belong&0x00ffffff 10 \b_7400 21056>>>4 belong&0x00ffffff 11 \b_7450 21057>>>4 belong&0x00ffffff 100 \b_970 21058>>>4 belong&0x00ffffff >100 subarchitecture=%d 21059>>0 belong&0x00ffffff >18 architecture=%d 21060>0 belong&0xff000000 0x01000000 21061# 21062# 64-bit ABIs. 21063# 21064>>0 belong&0x00ffffff 0 64-bit architecture=%d 21065>>0 belong&0x00ffffff 1 64-bit architecture=%d 21066>>0 belong&0x00ffffff 2 64-bit architecture=%d 21067>>0 belong&0x00ffffff 3 64-bit architecture=%d 21068>>0 belong&0x00ffffff 4 64-bit architecture=%d 21069>>0 belong&0x00ffffff 5 64-bit architecture=%d 21070>>0 belong&0x00ffffff 6 64-bit architecture=%d 21071>>0 belong&0x00ffffff 7 x86_64 21072>>>4 belong&0x00ffffff 0 subarchitecture=%d 21073>>>4 belong&0x00ffffff 1 subarchitecture=%d 21074>>>4 belong&0x00ffffff 2 subarchitecture=%d 21075>>>4 belong&0x00ffffff 3 21076>>>4 belong&0x00ffffff 4 \b_arch1 21077>>>4 belong&0x00ffffff 8 \b_haswell 21078>>>4 belong&0x00ffffff >4 subarchitecture=%d 21079>>0 belong&0x00ffffff 8 64-bit architecture=%d 21080>>0 belong&0x00ffffff 9 64-bit architecture=%d 21081>>0 belong&0x00ffffff 10 64-bit architecture=%d 21082>>0 belong&0x00ffffff 11 64-bit architecture=%d 21083>>0 belong&0x00ffffff 12 arm64 21084>>>4 belong&0x00ffffff 0 21085>>>4 belong&0x00ffffff 1 \bv8 21086>>>4 belong&0x00ffffff 2 \be 21087>>>>7 ubyte&0xff >0 (caps: 21088>>>>7 ubyte&0xff <0x80 0x%02x 21089>>>>7 ubyte&0xc0 0x80 PAC 21090>>>>>7 ubyte&0x3f x \b%02d 21091>>>>7 ubyte&0xc0 0xc0 PAK 21092>>>>>7 ubyte&0x3f x \b%02d 21093>>>>7 ubyte&0xff x \b) 21094>>>4 belong&0x00ffffff >2 subarchitecture=%d 21095>>0 belong&0x00ffffff 13 64-bit architecture=%d 21096>>0 belong&0x00ffffff 14 64-bit architecture=%d 21097>>0 belong&0x00ffffff 15 64-bit architecture=%d 21098>>0 belong&0x00ffffff 16 64-bit architecture=%d 21099>>0 belong&0x00ffffff 17 64-bit architecture=%d 21100>>0 belong&0x00ffffff 18 ppc64 21101>>>4 belong&0x00ffffff 0 21102>>>4 belong&0x00ffffff 1 \b_601 21103>>>4 belong&0x00ffffff 2 \b_602 21104>>>4 belong&0x00ffffff 3 \b_603 21105>>>4 belong&0x00ffffff 4 \b_603e 21106>>>4 belong&0x00ffffff 5 \b_603ev 21107>>>4 belong&0x00ffffff 6 \b_604 21108>>>4 belong&0x00ffffff 7 \b_604e 21109>>>4 belong&0x00ffffff 8 \b_620 21110>>>4 belong&0x00ffffff 9 \b_650 21111>>>4 belong&0x00ffffff 10 \b_7400 21112>>>4 belong&0x00ffffff 11 \b_7450 21113>>>4 belong&0x00ffffff 100 \b_970 21114>>>4 belong&0x00ffffff >100 subarchitecture=%d 21115>>0 belong&0x00ffffff >18 64-bit architecture=%d 21116>0 belong&0xff000000 0x02000000 21117# 21118# 64_32-bit ABIs. 21119# 21120>>0 belong&0x00ffffff 0 64_32-bit architecture=%d 21121>>0 belong&0x00ffffff 1 64_32-bit architecture=%d 21122>>0 belong&0x00ffffff 2 64_32-bit architecture=%d 21123>>0 belong&0x00ffffff 3 64_32-bit architecture=%d 21124>>0 belong&0x00ffffff 4 64_32-bit architecture=%d 21125>>0 belong&0x00ffffff 5 64_32-bit architecture=%d 21126>>0 belong&0x00ffffff 6 64_32-bit architecture=%d 21127>>0 belong&0x00ffffff 7 64_32-bit architecture=%d 21128>>0 belong&0x00ffffff 8 64_32-bit architecture=%d 21129>>0 belong&0x00ffffff 9 64_32-bit architecture=%d 21130>>0 belong&0x00ffffff 10 64_32-bit architecture=%d 21131>>0 belong&0x00ffffff 11 64_32-bit architecture=%d 21132>>0 belong&0x00ffffff 12 64_32-bit arm 21133>>>4 belong&0x00ffffff 0 21134>>>4 belong&0x00ffffff 1 \bv8 21135>>>4 belong&0x00ffffff >1 subarchitecture=%d 21136>>0 belong&0x00ffffff 13 64_32-bit architecture=%d 21137>>0 belong&0x00ffffff 14 64_32-bit architecture=%d 21138>>0 belong&0x00ffffff 15 64_32-bit architecture=%d 21139>>0 belong&0x00ffffff 16 64_32-bit architecture=%d 21140>>0 belong&0x00ffffff 17 64_32-bit architecture=%d 21141>>0 belong&0x00ffffff 18 64_32-bit architecture=%d 21142>>0 belong&0x00ffffff >18 64_32-bit architecture=%d 21143 211440 name mach-o-be 21145>0 byte 0xcf 64-bit 21146>4 use mach-o-cpu 21147>12 belong 1 object 21148# GRR: Does not work for Mach-O with 2 architectures; instead display oo 21149#!:ext o 21150!:ext o/ 21151>12 belong 2 executable 21152# the executables normally have no file extension like perl, 21153# but exceptions like perl5.18 perl5.16 21154!:ext 16/18/ 21155>12 belong 3 fixed virtual memory shared library 21156>12 belong 4 core 21157>12 belong 5 preload executable 21158>12 belong 6 dynamically linked shared library 21159# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib 21160#!:ext dylib 21161!:ext dylib/ 21162>12 belong 7 dynamic linker 21163>12 belong 8 bundle 21164# normally name extension bundle; but exceptions like: AMDil_r700.dylib 21165!:ext bundle/dylib/ 21166>12 belong 9 dynamically linked shared library stub 21167>12 belong 10 dSYM companion file 21168>12 belong 11 kext bundle 21169>12 belong >11 21170>>12 belong x filetype=%d 21171>24 belong >0 \b, flags:< 21172>>24 belong &0x00000001 \bNOUNDEFS 21173>>24 belong &0x00000002 \b|INCRLINK 21174>>24 belong &0x00000004 \b|DYLDLINK 21175>>24 belong &0x00000008 \b|BINDATLOAD 21176>>24 belong &0x00000010 \b|PREBOUND 21177>>24 belong &0x00000020 \b|SPLIT_SEGS 21178>>24 belong &0x00000040 \b|LAZY_INIT 21179>>24 belong &0x00000080 \b|TWOLEVEL 21180>>24 belong &0x00000100 \b|FORCE_FLAT 21181>>24 belong &0x00000200 \b|NOMULTIDEFS 21182>>24 belong &0x00000400 \b|NOFIXPREBINDING 21183>>24 belong &0x00000800 \b|PREBINDABLE 21184>>24 belong &0x00001000 \b|ALLMODSBOUND 21185>>24 belong &0x00002000 \b|SUBSECTIONS_VIA_SYMBOLS 21186>>24 belong &0x00004000 \b|CANONICAL 21187>>24 belong &0x00008000 \b|WEAK_DEFINES 21188>>24 belong &0x00010000 \b|BINDS_TO_WEAK 21189>>24 belong &0x00020000 \b|ALLOW_STACK_EXECUTION 21190>>24 belong &0x00040000 \b|ROOT_SAFE 21191>>24 belong &0x00080000 \b|SETUID_SAFE 21192>>24 belong &0x00100000 \b|NO_REEXPORTED_DYLIBS 21193>>24 belong &0x00200000 \b|PIE 21194>>24 belong &0x00400000 \b|DEAD_STRIPPABLE_DYLIB 21195>>24 belong &0x00800000 \b|HAS_TLV_DESCRIPTORS 21196>>24 belong &0x01000000 \b|NO_HEAP_EXECUTION 21197>>24 belong &0x02000000 \b|APP_EXTENSION_SAFE 21198>>24 belong &0x04000000 \b|NLIST_OUTOFSYNC_WITH_DYLDINFO 21199>>24 belong &0x08000000 \b|SIM_SUPPORT 21200>>24 belong &0x80000000 \b|DYLIB_IN_CACHE 21201>>24 belong x \b> 21202 21203# 212040 lelong&0xfffffffe 0xfeedface Mach-O 21205!:strength +1 21206!:mime application/x-mach-binary 21207>0 use \^mach-o-be 21208 212090 belong&0xfffffffe 0xfeedface Mach-O 21210!:strength +1 21211!:mime application/x-mach-binary 21212>0 use mach-o-be 21213 21214#------------------------------------------------------------------------------ 21215# $File: macintosh,v 1.31 2020/12/12 20:01:47 christos Exp $ 21216# macintosh description 21217# 21218# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 21219# Daniel Quinlan, quinlan@yggdrasil.com 21220# Update: Joerg Jenderek 21221# URL: https://en.wikipedia.org/wiki/BinHex 21222# Reference: http://fileformats.archiveteam.org/wiki/BinHex 21223# Note: only tested with version 4.0 and hqx extension 21224# Any text/binary before the characteristic comment sentence is to be ignored like in 21225# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 212260 search/1602 (This\ file\ 21227>&0 use binhex 21228# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 212290 search/2652/b (This\ file\ 21230>&0 use binhex 212310 name binhex 21232# keep split search string format similar like in version 5.37 21233>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version 21234# http://www.macdisk.com/binhexen.php3 21235!:apple BNHQTEXT 21236# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ 21237>>&0 string 1.0 1.0 21238!:mime application/mac-binhex 21239!:ext hex 21240>>&0 string 2.0 2.0 21241!:mime application/mac-binhex 21242!:ext hcx 21243# BinHex 3.0 never existed 21244>>&0 string 4.0 4.0 21245!:mime application/mac-binhex40 21246!:ext hqx 21247# BinHex 5.0 also MacBinary I 21248>>&0 string 5.0 5.0 21249!:mime application/mac-binhex40 21250!:ext hqx 21251# this should never happen 21252>>&0 default x 21253>>>&0 string x %.3s 21254!:mime application/mac-binhex 21255!:ext hqx 21256 21257# Stuffit archives are the de facto standard of compression for Macintosh 21258# files obtained from most archives. (franklsm@tuns.ca) 212590 string SIT! StuffIt Archive (data) 21260!:mime application/x-stuffit 21261!:apple SIT!SIT! 21262>2 string x : %s 212630 string SITD StuffIt Deluxe (data) 21264>2 string x : %s 212650 string Seg StuffIt Deluxe Segment (data) 21266>2 string x : %s 21267 21268# Newer StuffIt archives (grant@netbsd.org) 212690 string StuffIt StuffIt Archive 21270!:mime application/x-stuffit 21271!:apple SIT!SIT! 21272#>162 string >0 : %s 21273 21274# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 21275# GRR: Too weak 21276#0 string APPL Macintosh Application (data) 21277#>2 string x \b: %s 21278 21279# Macintosh System files (franklsm@tuns.ca) 21280# GRR: Too weak 21281#0 string zsys Macintosh System File (data) 21282#0 string FNDR Macintosh Finder (data) 21283#0 string libr Macintosh Library (data) 21284#>2 string x : %s 21285#0 string shlb Macintosh Shared Library (data) 21286#>2 string x : %s 21287#0 string cdev Macintosh Control Panel (data) 21288#>2 string x : %s 21289#0 string INIT Macintosh Extension (data) 21290#>2 string x : %s 21291#0 string FFIL Macintosh Truetype Font (data) 21292#>2 string x : %s 21293#0 string LWFN Macintosh Postscript Font (data) 21294#>2 string x : %s 21295 21296# Additional Macintosh Files (franklsm@tuns.ca) 21297# GRR: Too weak 21298#0 string PACT Macintosh Compact Pro Archive (data) 21299#>2 string x : %s 21300#0 string ttro Macintosh TeachText File (data) 21301#>2 string x : %s 21302#0 string TEXT Macintosh TeachText File (data) 21303#>2 string x : %s 21304#0 string PDF Macintosh PDF File (data) 21305#>2 string x : %s 21306 21307# MacBinary format (Eric Fischer, enf@pobox.com) 21308# Update: Joerg Jenderek 21309# URL: https://en.wikipedia.org/wiki/MacBinary 21310# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt 21311# 21312# Unfortunately MacBinary doesn't really have a magic number prior 21313# to the MacBinary III format. 21314# 21315 21316# old version number, must be kept at zero for compatibility 213170 byte 0 21318# length of filename (must be in the range 1-63) 21319>1 ubyte >0 21320# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 21321>>1 ubyte <64 21322# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 21323# by looking for printable characters at beginning of file name 21324>>>2 ubelong >0x1F000000 21325# zero fill, must be zero for compatibility 21326>>>>74 byte 0 21327# zero fill, must be zero for compatibility 21328>>>>>82 byte 0 21329# MacBinary I test for valid version numbers 21330>>>>>>122 ubeshort 0 21331# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 21332#>>>>>>>91 ubelong >0x7c25b07F 21333# additional check for undefined header fields in MacBinary I 21334#>>>>>>>101 ulong 0 21335>>>>>>>0 use mac-bin 21336# MacBinary II the newer versions begins at 129 21337>>>>>>122 ubeshort 0x8181 21338>>>>>>>0 use mac-bin 21339# MacBinary III with MacBinary II to read 21340>>>>>122 ubeshort 0x8281 21341>>>>>>0 use mac-bin 21342 21343# display information of MacBinary file 213440 name mac-bin 21345>122 ubyte x MacBinary 21346# versions for MacBinary II/III 21347>122 ubyte 129 II 21348>122 ubyte 130 III 21349# only in MacBinary III 21350>>102 string !mBIN with surprising version 21351!:mime application/x-macbinary 21352!:apple PSPTBINA 21353!:ext bin/macbin 21354# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 21355#>1 ubyte >63 \b, name length %u too BIG! 21356#>122 ubeshort x \b, version 0x%x 21357# Finder flags if not 0 21358# >73 byte !0 \b, flags 0x 21359# >73 byte =0 21360# >>101 byte !0 \b, flags 0x 21361# # original Finder flags (Bits 8-15) 21362# >73 byte !0 \b%x 21363# # finder flags, bits 0-7 21364# >101 byte !0 \b%x 21365>73 byte &0x01 \b, inited 21366>73 byte &0x02 \b, changed 21367>73 byte &0x04 \b, busy 21368>73 byte &0x08 \b, bozo 21369>73 byte &0x10 \b, system 21370>73 byte &0x20 \b, bundle 21371>73 byte &0x40 \b, invisible 21372>73 byte &0x80 \b, locked 21373 21374# 75 beshort # vertical posn in window 21375#>75 beshort !0 \b, v.pos %u 21376# 77 beshort # horiz posn in window 21377#>77 beshort !0 \b, h.pos %u 21378# 79 beshort # window or folder ID 21379>79 ubeshort !0 \b, ID 0x%x 21380# protected flag 21381>81 byte !0 \b, protected 0x%x 21382# length of comment after resource 21383>99 ubeshort !0 \b, comment length %u 21384# char. code of file name 21385>106 ubyte !0 \b, char. code 0x%x 21386# still more Finder flags 21387>107 ubyte !0 \b, more flags 0x%x 21388# length of total files when unpacked only used when pack and unpack on the fly 21389>116 ubelong !0 \b, total length %u 21390# 120 beshort # length of add'l header 21391>120 ubeshort !0 \b, 2nd header length %u 21392# 124 beshort # checksum 21393#>124 ubeshort !0 \b, CRC 0x%x 21394# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 21395>91 beldate-0x7C25B080 x \b, %s 21396# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 21397>91 ubelong <0x7c25b080 INVALID date 21398#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 21399# last modified date 21400>95 beldate-0x7C25B080 x \b, modified %s 21401# Apple creator+typ if not null 21402# file creator (normally expressed as four characters) 21403>69 ulong !0 \b, creator 21404# instead 4 character code display full creator name 21405>>69 use apple-creator 21406# file type (normally expressed as four characters) 21407>65 ulong !0 \b, type 21408>>65 use apple-type 21409# length of data segment 21410>83 ubelong !0 \b, %u bytes 21411# filename (in the range 1-63) 21412>1 pstring x "%s" 21413# print 1 space and then at offset 128 inspect data fork content if it has one 21414>83 ubelong !0 \b 21415>>128 indirect x 21416# Afterwards resource fork if length of resource segment not zero 21417>87 ubelong !0 21418# calculate resource fork offset 21419>>83 ubelong+128 x \b, at 0x%x 21420# length of resource segment 21421>>87 ubelong !0 %u bytes 21422>>(83.S+128) ubequad x resource 21423# further resource fork content inspection 21424>>>&-8 indirect x 21425 21426# Apple Type/Creator Database 21427# URL: https://en.wikipedia.org/wiki/Type_code 21428# Reference: https://www.lacikam.co.il/tcdb/ 21429# https://www.macdisk.com/macsigen.php 21430# Note: classic Mac OS files have two 4 character codes for type and creator. 21431# Thereby the Finder attach documents types to applications. 21432 21433#>65 string x \b, type "%4.4s" 21434 21435# display information about apple type 214360 name apple-type 21437>0 string 8BIM PhotoShop 21438>0 string ALB3 PageMaker 3 21439>0 string ALB4 PageMaker 4 21440>0 string ALT3 PageMaker 3 21441>0 string APPL application 21442>0 string AWWP AppleWorks word processor 21443>0 string CIRC simulated circuit 21444>0 string DRWG MacDraw 21445>0 string EPSF Encapsulated PostScript 21446>0 string FFIL font suitcase 21447>0 string FKEY function key 21448>0 string FNDR Macintosh Finder 21449>0 string GIFf GIF image 21450>0 string Gzip GNU gzip 21451>0 string INIT system extension 21452>0 string LIB\ library 21453>0 string LWFN PostScript font 21454>0 string MSBC Microsoft BASIC 21455>0 string PACT Compact Pro archive 21456>0 string PDF\ Portable Document Format 21457>0 string PICT picture 21458>0 string PNTG MacPaint picture 21459>0 string PREF preferences 21460>0 string PROJ Think C project 21461>0 string QPRJ Think Pascal project 21462>0 string SCFL Defender scores 21463>0 string SCRN startup screen 21464>0 string SITD StuffIt Deluxe 21465>0 string SPn3 SuperPaint 21466>0 string STAK HyperCard stack 21467>0 string Seg\ StuffIt segment 21468>0 string TARF Unix tar archive 21469>0 string TEXT ASCII 21470>0 string TIFF TIFF image 21471>0 string TOVF Eudora table of contents 21472>0 string WDBN Microsoft Word word processor 21473>0 string WORD MacWrite word processor 21474>0 string XLS\ Microsoft Excel 21475>0 string ZIVM compress (.Z) 21476>0 string ZSYS Pre-System 7 system file 21477>0 string acf3 Aldus FreeHand 21478>0 string cdev control panel 21479>0 string dfil Desk Accessory suitcase 21480>0 string libr library 21481>0 string nX^d WriteNow word processor 21482>0 string nX^w WriteNow dictionary 21483>0 string rsrc resource 21484>0 string scbk Scrapbook 21485>0 string shlb shared library 21486>0 string ttro SimpleText read-only 21487>0 string zsys system file 21488 21489# additional types added in Dec 2017 21490>0 string BINA binary file 21491>0 string BMPp BMP image 21492>0 string JPEG JPEG image 21493#>0 string W4BN Microsoft Word x.y word processor? 21494# if type name is not known display 4 character identifier 21495>0 default x 21496>>0 string x '%4.4s' 21497 21498#>69 string x \b, creator "%4.4s" 21499 21500# Now Apple has no repository of registered Creator IDs any more. These are 21501# just the ones that I happened to have files from and was able to identify. 21502 21503# display information about apple creator 215040 name apple-creator 21505>0 string 8BIM Adobe Photoshop 21506>0 string ALD3 PageMaker 3 21507>0 string ALD4 PageMaker 4 21508>0 string ALFA Alpha editor 21509>0 string APLS Apple Scanner 21510>0 string APSC Apple Scanner 21511>0 string BRKL Brickles 21512>0 string BTFT BitFont 21513>0 string CCL2 Common Lisp 2 21514>0 string CCL\ Common Lisp 21515>0 string CDmo The Talking Moose 21516>0 string CPCT Compact Pro 21517>0 string CSOm Eudora 21518>0 string DMOV Font/DA Mover 21519>0 string DSIM DigSim 21520>0 string EDIT Macintosh Edit 21521>0 string ERIK Macintosh Finder 21522>0 string EXTR self-extracting archive 21523>0 string Gzip GNU gzip 21524>0 string KAHL Think C 21525>0 string LWFU LaserWriter Utility 21526>0 string LZIV compress 21527>0 string MACA MacWrite 21528>0 string MACS Macintosh operating system 21529>0 string MAcK MacKnowledge terminal emulator 21530>0 string MLND Defender 21531>0 string MPNT MacPaint 21532>0 string MSBB Microsoft BASIC (binary) 21533>0 string MSWD Microsoft Word 21534>0 string NCSA NCSA Telnet 21535>0 string PJMM Think Pascal 21536>0 string PSAL Hunt the Wumpus 21537#>0 string PSI2 Apple File Exchange 21538>0 string R*ch BBEdit 21539>0 string RMKR Resource Maker 21540>0 string RSED Resource Editor 21541>0 string Rich BBEdit 21542>0 string SIT! StuffIt 21543>0 string SPNT SuperPaint 21544>0 string Unix NeXT Mac filesystem 21545>0 string VIM! Vim editor 21546>0 string WILD HyperCard 21547>0 string XCEL Microsoft Excel 21548>0 string aCa2 Fontographer 21549>0 string aca3 Aldus FreeHand 21550>0 string dosa Macintosh MS-DOS file system 21551>0 string movr Font/DA Mover 21552>0 string nX^n WriteNow 21553>0 string pdos Apple ProDOS file system 21554>0 string scbk Scrapbook 21555>0 string ttxt SimpleText 21556>0 string ufox Foreign File Access 21557# additional creators added in Dec 2017 21558# Claris/Apple Works 21559>0 string BOBO Apple Works 21560# CU-SeeMe_0.87b3_(68K).bin 21561#>0 string CUce bar 21562>0 string PSPT Apple File Exchange 21563# Disk_Copy_4.2.sea.bin 21564#>0 string NCse foo 21565# probably StuffIt/Aladdin by Smith Micro Software, Inc. 21566>0 string STi0 stuffit 21567# MacGzip-1.1.3.sea.bin 21568#>0 string aust bar 21569# D-Disk_Copy_6.3.3.smi.bin 21570>0 string oneb Disk Copy Self Mounting 21571# if creator name is not known display 4 character identifier 21572>0 default x 21573>>0 string x '%4.4s' 21574 21575# sas magic from Bruce Foster (bef@nwu.edu) 21576# 21577#0 string SAS SAS 21578#>8 string x %s 215790 string SAS SAS 21580>24 string DATA data file 21581>24 string CATALOG catalog 21582>24 string INDEX data file index 21583>24 string VIEW data view 21584# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 21585# 215860x54 string SAS SAS 7+ 21587>0x9C string DATA data file 21588>0x9C string CATALOG catalog 21589>0x9C string INDEX data file index 21590>0x9C string VIEW data view 21591 21592# spss magic for SPSS system and portable files, 21593# from Bruce Foster (bef@nwu.edu). 21594 215950 long 0xc1e2c3c9 SPSS Portable File 21596>40 string x %s 21597 215980 string $FL2 SPSS System File 21599>24 string x %s 21600 216010 string $FL3 SPSS System File 21602>24 string x %s 21603 21604# Macintosh filesystem data 21605# From "Tom N Harris" <telliamed@mac.com> 21606# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 21607# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 21608# entries depend on the data arithmetic added after v.35 21609# There's also some Pascal strings in here, ditto... 21610 21611# The boot block signature, according to IM:Files, is 21612# "for HFS volumes, this field always contains the value 0x4C4B." 21613# But if this is true for MFS or HFS+ volumes, I don't know. 21614# Alternatively, the boot block is supposed to be zeroed if it's 21615# unused, so a simply >0 should suffice. 21616 216170x400 beshort 0xD2D7 Macintosh MFS data 21618>0 beshort 0x4C4B (bootable) 21619>0x40a beshort &0x8000 (locked) 21620>0x402 beldate-0x7C25B080 x created: %s, 21621>0x406 beldate-0x7C25B080 >0 last backup: %s, 21622>0x414 belong x block size: %d, 21623>0x412 beshort x number of blocks: %d, 21624>0x424 pstring x volume name: %s 21625 21626# *.hfs updated by Joerg Jenderek 21627# https://en.wikipedia.org/wiki/Hierarchical_File_System 21628# "BD" gives many false positives 216290x400 beshort 0x4244 21630# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 21631# first block of volume bit map (always 3) 21632>0x40e ubeshort 0x0003 21633# maximal length of volume name is 27 21634>>0x424 ubyte <28 Macintosh HFS data 21635!:mime application/x-apple-diskimage 21636#!:apple hfsdINIT 21637#!:apple MACSdisk 21638# https://www.macdisk.com/macsigen.php 21639#!:apple ddskdevi 21640!:apple ????devi 21641# https://en.wikipedia.org/wiki/Apple_Disk_Image 21642!:ext hfs/dmg 21643>>>0 beshort 0x4C4B (bootable) 21644#>>>0 beshort 0x0000 (not bootable) 21645>>>0x40a beshort &0x8000 (locked) 21646>>>0x40a beshort ^0x0100 (mounted) 21647>>>0x40a beshort &0x0200 (spared blocks) 21648>>>0x40a beshort &0x0800 (unclean) 21649>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 21650# https://www.epochconverter.com/ 21651# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 21652# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 21653# construct not working 21654#>>>0x402 beldate-0x7C25B080 x created: %s, 21655#>>>0x406 beldate-0x7C25B080 x last modified: %s, 21656#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 21657# found block sizes 200h,1200h,2800h 21658>>>0x414 belong x block size: %d, 21659>>>0x412 beshort x number of blocks: %d, 21660>>>0x424 pstring x volume name: %s 21661 216620x400 beshort 0x482B Macintosh HFS Extended 21663>&0 beshort x version %d data 21664>0 beshort 0x4C4B (bootable) 21665>0x404 belong ^0x00000100 (mounted) 21666>&2 belong &0x00000200 (spared blocks) 21667>&2 belong &0x00000800 (unclean) 21668>&2 belong &0x00008000 (locked) 21669>&6 string x last mounted by: '%.4s', 21670# really, that should be treated as a belong and we print a string 21671# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 21672>&14 beldate-0x7C25B080 x created: %s, 21673# only the creation date is local time, all other timestamps in HFS+ are UTC. 21674>&18 bedate-0x7C25B080 x last modified: %s, 21675>&22 bedate-0x7C25B080 >0 last backup: %s, 21676>&26 bedate-0x7C25B080 >0 last checked: %s, 21677>&38 belong x block size: %d, 21678>&42 belong x number of blocks: %d, 21679>&46 belong x free blocks: %d 21680 21681## AFAIK, only the signature is different 21682# same as Apple Partition Map 21683# GRR: This magic is too weak, it is just "TS" 21684#0x200 beshort 0x5453 Apple Old Partition data 21685#>0x2 beshort x block size: %d, 21686#>0x230 string x first type: %s, 21687#>0x210 string x name: %s, 21688#>0x254 belong x number of blocks: %d, 21689#>0x400 beshort 0x504D 21690#>>0x430 string x second type: %s, 21691#>>0x410 string x name: %s, 21692#>>0x454 belong x number of blocks: %d, 21693#>>0x800 beshort 0x504D 21694#>>>0x830 string x third type: %s, 21695#>>>0x810 string x name: %s, 21696#>>>0x854 belong x number of blocks: %d, 21697#>>>0xa00 beshort 0x504D 21698#>>>>0xa30 string x fourth type: %s, 21699#>>>>0xa10 string x name: %s, 21700#>>>>0xa54 belong x number of blocks: %d 21701 21702# From: Remi Mommsen <mommsen@slac.stanford.edu> 217030 string BOMStore Mac OS X bill of materials (BOM) file 21704 21705# From: Adam Buchbinder <adam.buchbinder@gmail.com> 21706# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 21707# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 21708# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 21709# don't know what they mean. 217100 belong 0x100 21711>(0x4.L+24) beshort x 21712>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 21713>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 21714>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 21715>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 21716 21717#------------------------------------------------------------------------------ 21718# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 21719# MacOS files 21720# 21721 217220 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 21723 21724#------------------------------------------------------------------------------ 21725# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 21726# magic: file(1) magic for magic files 21727# 217280 string/t #\ Magic magic text file for file(1) cmd 217290 lelong 0xF11E041C magic binary file for file(1) cmd 21730>4 lelong x (version %d) (little endian) 217310 belong 0xF11E041C magic binary file for file(1) cmd 21732>4 belong x (version %d) (big endian) 21733#------------------------------------------------------------------------------ 21734# $File: mail.news,v 1.27 2021/04/05 16:36:14 christos Exp $ 21735# mail.news: file(1) magic for mail and news 21736# 21737# Unfortunately, saved netnews also has From line added in some news software. 21738#0 string From mail text 217390 string/t Relay-Version: old news text 21740!:mime message/rfc822 217410 string/t #!\ rnews batched news text 21742!:mime message/rfc822 217430 string/t N#!\ rnews mailed, batched news text 21744!:mime message/rfc822 217450 string/t Forward\ to mail forwarding text 21746!:mime message/rfc822 217470 string/t Pipe\ to mail piping text 21748!:mime message/rfc822 217490 string/tc delivered-to: SMTP mail text 21750!:mime message/rfc822 217510 string/tc return-path: SMTP mail text 21752!:mime message/rfc822 217530 string/t Path: news text 21754!:mime message/news 217550 string/t Xref: news text 21756!:mime message/news 217570 string/t From: news or mail text 21758!:mime message/rfc822 217590 string/t Article saved news text 21760!:mime message/news 21761# Reference: http://quimby.gnus.org/notes/BABYL 21762# Update: Joerg Jenderek 21763# Note: used by Rmail in Emacs version 22 and before 21764# is not text because of characters like Control-L Control-_ 217650 string/b BABYL\ OPTIONS: Emacs RMAIL 21766#0 string/t BABYL Emacs RMAIL text 21767# https://reposcope.com/mimetype/message/x-gnu-rmail 21768!:mime message/x-gnu-rmail 21769# ~/RMAIL 21770!:ext / 217710 string/t Received: RFC 822 mail text 21772!:mime message/rfc822 217730 string/t MIME-Version: MIME entity text 21774#0 string/t Content- MIME entity text 21775 21776# TNEF files... 217770 lelong 0x223E9F78 Transport Neutral Encapsulation Format 21778!:mime application/vnd.ms-tnef 21779 21780# From: Kevin Sullivan <ksulliva@psc.edu> 217810 string *mbx* MBX mail folder 21782 21783# From: Simon Matter <simon.matter@invoca.ch> 217840 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 217850 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 21786 21787# JAM(mbp) Fidonet message area databases 21788# JHR file 217890 string JAM\0 JAM message area header file 21790>12 leshort >0 (%d messages) 21791 21792# Squish Fidonet message area databases 21793# SQD file (requires at least one message in the area) 21794# XXX: Weak magic 21795#256 leshort 0xAFAE4453 Squish message area data file 21796#>4 leshort >0 (%d messages) 21797 21798#0 string \<!--\ MHonArc text/html; x-type=mhonarc 21799 21800# Cyrus: file(1) magic for compiled Cyrus sieve scripts 21801# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 21802# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 21803# From: Philipp Hahn <hahn@univention.de> 21804 21805# Compiled Cyrus sieve script 218060 string CyrSBytecode Cyrus sieve bytecode data, 21807>12 belong =1 version 1, big-endian 21808>12 lelong =1 version 1, little-endian 21809>12 belong x version %d, network-endian 21810 21811# Dovecot mail server, version 2.2 and later. 21812# Dovecot mailing list: dovecot@dovecot.org 21813# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format 21814# From: Stephen Gildea 218150 string CRYPTED\003\007 Dovecot encrypted message 21816>9 byte x \b, dcrypt version %d 21817#------------------------------------------------------------------------------ 21818# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $ 21819# make: file(1) magic for makefiles 21820# 21821# URL: https://en.wikipedia.org/wiki/Make_(software) 218220 regex/100l \^CFLAGS makefile script text 21823!:mime text/x-makefile 218240 regex/100l \^VPATH makefile script text 21825!:mime text/x-makefile 218260 regex/100l \^LDFLAGS makefile script text 21827!:mime text/x-makefile 218280 regex/100l \^all: makefile script text 21829!:mime text/x-makefile 218300 regex/100l \^\\.PRECIOUS makefile script text 21831!:mime text/x-makefile 21832# Update: Joerg Jenderek 21833# Reference: https://www.freebsd.org/cgi/man.cgi?make(1) 21834# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST" 21835# by additional escaping point character 218360 regex/100l \^\\.BEGIN BSD makefile script text 21837!:mime text/x-makefile 21838!:ext /mk 21839!:strength +10 21840# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT" 21841# and NSIS script with "!include" by additional escaping point character 218420 regex/100l \^\\.include BSD makefile script text 21843!:mime text/x-makefile 21844!:ext /mk 21845!:strength +10 218460 regex/100l \^\\.endif BSD makefile script text 21847!:mime text/x-makefile 21848!:ext /mk 21849!:strength +10 218500 regex/100l \^SUBDIRS automake makefile script text 21851!:mime text/x-makefile 21852!:strength +10 21853 21854 21855#------------------------------------------------------------------------------ 21856# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $ 21857# map: file(1) magic for Map data 21858# 21859 21860# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 218618 string .FIT FIT Map data 21862>15 byte 0 21863>>35 belong x \b, unit id %d 21864>>39 lelong x \b, serial %u 21865# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 21866# 20 years after unix epoch 21867# TZ=GMT date -d '1989-12-31 0:00' +%s 21868>>43 leldate+631065600 x \b, %s 21869 21870>>47 leshort x \b, manufacturer %d 21871>>47 leshort 1 \b (garmin) 21872>>49 leshort x \b, product %d 21873>>53 byte x \b, type %d 21874>>53 byte 1 \b (Device) 21875>>53 byte 2 \b (Settings) 21876>>53 byte 3 \b (Sports/Cycling) 21877>>53 byte 4 \b (Activity) 21878>>53 byte 8 \b (Elevations) 21879>>53 byte 10 \b (Totals) 21880 21881# Summary: Garmin map 21882# From: Joerg Jenderek 21883# URL: https://en.wikipedia.org/wiki/Garmin_.img 21884# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 21885# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf 21886# GRR: similar to MBR boot sector handled by ./filesystems 218870x1FE leshort =0xAA55 21888# look for valid map signature 21889>0x13 string =IMG\0 21890>>0 use garmin-map 218910 name garmin-map 21892>0 ubyte x Garmin 21893!:mime application/x-garmin-map 21894# If non-zero, every byte of the entire .img file is to be XORed with this value 21895>0 ubyte !0 \b, 0x%x XORed 21896# goto block before FAT 21897>(0x40.b*512) ubyte x 21898# 1st fat name "DLLINFO TXT" only found for vpm 21899>>&512 string =DLLINFO\ TXT map (Voice Processing) 21900# there exist 2 other Garmin VPM formats; see ./audio 21901!:ext vpm 21902# Deutsch__Yannick_D4481-00_0210.vpm 21903#>>>512 search/0x0116da60/s RIFF \b; with 21904# determine type voice type by ./riff 21905#>>>>&0 indirect x \b 21906>>&512 string !DLLINFO\ TXT map 21907!:ext img 21908# 9 zeros 21909>1 ubelong !0 \b, zeroes 0x%x 21910# Map's version major 21911>8 ubyte x v%u 21912# Map's version minor 21913>9 ubyte x \b.%.2u 21914# Map description[20], 0x20 padded 21915>0x49 string x %.20s 21916# Map name, continued (0x20 padded, \0 terminated) 21917>0x65 string >\ \b%.31s 21918# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62) 21919>0xB ubyte x \b, updated 21920>>0xB ubyte >0x62 21921>>>0xB ubyte-100 x 20%.2u 21922>>0xB ubyte <0x63 21923>>>0xB ubyte x 20%.2u 21924# Update month (0-11) 21925>0xA ubyte x \b-%.2u 21926# All zeroes 21927>0xc uleshort !0 \b, zeroes 0x%x 21928# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport 21929#>0xE ubyte !0 \b, Mapsource flag 0x%x 21930>0xE ubyte 1 \b, Mapsource 21931# Checksum, sum of all bytes modulo 256 should be 0 21932#>0xF ubyte x \b, Checksum 0x%x 21933# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map 21934>0x10 string !DSKIMG \b, signature "%.7s" 21935>0x39 use garmin-date 21936# Map file identifier like GARMIN\0 21937>0x41 string !GARMIN \b, id "%.7s" 21938# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes 21939>0x61 ubyte !0x09 \b, E1=%u 21940# Block size exponent, E2 ; file blocksize=2**(E1+E2) 21941>>0x62 ubyte x \b, E2=%u 21942>0x61 ubyte =0x09 \b, blocksize 21943>>0x62 ubyte 0 512 21944>>0x62 ubyte 1 1024 21945>>0x62 ubyte 2 2048 21946>>0x62 ubyte 3 4096 21947>>0x62 ubyte 4 8192 21948>>0x62 ubyte 5 16384 21949>>0x62 default x 21950>>>0x62 ubyte x E2=%u 21951# MBR signature 21952>0x1FE leshort !0xAA55 \b, invalid MBR 21953# 512 zeros 21954>0x200 uquad !0 \b, zeroes 0x%llx 21955# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file! 21956>0x40C ulelong >0 \b, at 0x%x 21957# sub-file Header length 21958#>>(0x40C.l) uleshort x \b, header len 0x%x 21959>>(0x40C.l) uleshort x %u bytes 21960# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc. 21961>>(0x40C.l+2) ubyte >0x1F 21962>>>(0x40C.l+2) ubyte <0xFF 21963>>>>(0x40C.l+2) string x "%.10s" 21964# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.) 21965>>>>(0x40C.l+13) ubyte >0 \b, locked 0x%x 21966# Block sequence numbers like 0000 0100 0200 ... FFFF 21967# >0x420 ubequad >0 \b, seq. 0x%16.16llx 21968# >>0x428 ubequad >0 \b%16.16llx 21969# >>>0x430 ubequad >0 \b%16.16llx 21970# >>>>0x438 ubequad >0 \b%16.16llx 21971# >>>>>0x440 ubequad >0 \b%16.16llx 21972# >>>>>>0x448 ubequad >0 \b%16.16llx 21973# >>>>>>>0x450 ubequad >0 \b%16.16llx 21974# >>>>>>>>0x458 ubequad >0 \b%16.16llx 21975# >>>>>>>>>0x460 ubequad >0 \b%16.16llx 21976# >>>>>>>>>>0x468 ubequad >0 \b%16.16llx 21977# >>>>>>>>>>>0x470 ubequad >0 \b%16.16llx 21978# >>>>>>>>>>>>0x478 ubequad >0 \b%16.16llx 21979# >>>>>>>>>>>>>0x480 ubequad >0 \b%16.16llx 21980# >>>>>>>>>>>>>>0x488 ubequad >0 \b%16.16llx 21981# >>>>>>>>>>>>>>>0x490 ubequad >0 \b%16.16llx 21982# >>>>>>>>>>>>>>>>0x498 ubequad >0 \b%16.16llx 21983# >>>>>>>>>>>>>>>>>0x4A0 ubequad >0 \b%16.16llx 21984# >>>>>>>>>>>>>>>>>>0x4A8 ubequad >0 \b%16.16llx 21985# look for end of FAT 21986#>>0x420 search/512/s \xff\xff FAT END 21987# Physical block number of FAT header 21988#>0x40 ubyte x \b, FAT at phy. block %u 21989>0x40 ubyte x 21990>>(0x40.b*512) ubyte x 21991# 1st FAT block 21992>>>&511 use garmin-fat 21993# 2nd FAT block 21994>>>&1023 use garmin-fat 21995# 3th FAT block 21996>>>&1535 use garmin-fat 21997# 4th FAT block 21998>>>&2047 use garmin-fat 21999# ... xth FAT block 22000# 22001# 314 zeros but not in vpm and also gmaptz.img 22002>0x84 uquad !0 \b, at 0x84 0x%llx 22003# display FileAllocationTable block entry in garmin map 220040 name garmin-fat 22005>0 ubyte x \b; 22006# sub file part; 0x0003 seems to be garbage 22007>0x10 uleshort !0 next 0x%4.4x 22008>0x10 uleshort =0 22009# fat flag 0~dummy block 1~true sub file 22010>>0 ubyte !1 flag %u 22011>>0 ubyte =1 22012# sub-file name like MAKEGMAP 12345678 22013>>>0x1 string x %.8s 22014# sub-file typ like RGN TRE MDR LBL 22015>>>0x9 string x \b.%.3s 22016# size of sub file 22017>>>0xC ulelong x \b, %u bytes 22018# 32-bit block sequence numbers 22019#>>>0x20 ubequad x \b, seq. 0x%16.16llx 22020 22021# display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss 220220 name garmin-date 22023# year like 2018 22024>0 uleshort x \b, created %u 22025# month (0-11) 22026>2 ubyte x \b-%.2u 22027# day (1-31) 22028>3 ubyte x \b-%.2u 22029# hour (0-23) 22030>4 ubyte x %u 22031# minute (0-59) 22032>5 ubyte x \b:%.2u 22033# second (0-59) 22034>6 ubyte x \b:%.2u 22035 22036# Summary: Garmin Map subfiles 22037# From: Joerg Jenderek 22038# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 22039# Garmin Common Header 220402 string GARMIN\ 22041# skip ASCII text by checking for low header length 22042>0 uleshort <0x1000 Garmin map, 22043# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format 22044>>9 string GMP subtile 22045!:mime application/x-garmin-gpm 22046!:ext gmp 22047# copyright message 22048>>>(0.s) string x %s 22049>>>0x0E use garmin-date 22050# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format 22051# This contains the searchable address table used for finding routing destinations 22052>>9 string MDR address table 22053!:mime application/x-garmin-mdr 22054!:ext mdr 22055# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format 22056# http://svn.parabola.me.uk/display/trunk/doc/nod.txt 22057# This contains the routing information 22058>>9 string NOD routing 22059!:mime application/x-garmin-nod 22060!:ext nod 22061>>>0x0E use garmin-date 22062#>>>0x15 ulelong x \b, at 0x%x 22063#>>>0x19 ulelong x 0x%x bytes NOD1 22064#>>>0x25 ulelong x \b, at 0x%x 22065#>>>0x29 ulelong x 0x%x bytes NOD2 22066#>>>0x31 ulelong x \b, at 0x%x 22067#>>>0x35 ulelong x 0x%x bytes NOD3 22068# URL: http://www.pinns.co.uk/osm/net.html 22069# routable highways (length, direction, allowed speed,house address information) 22070>>9 string NET highways 22071!:mime application/x-garmin-net 22072!:ext net 22073#>>>0x15 ulelong x \b, at 0x%x 22074#>>>0x19 ulelong x 0x%x bytes NET1 22075#>>>0x22 ulelong >0 22076#>>>>0x1E ulelong x \b, at 0x%x 22077#>>>>0x22 ulelong x 0x%x bytes NET2 22078#>>>0x2B ulelong >0 22079#>>>>0x27 ulelong x \b, at 0x%x 22080#>>>>0x2B ulelong x 0x%x bytes NET3 22081# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format 22082>>9 string LBL labels 22083!:mime application/x-garmin-lbl 22084!:ext lbl 22085>>>(0.s) string x %s 22086# Label coding type 6h 9h and ah 22087>>>0x1E ubyte x \b, coding type 0x%x 22088#>>>0x15 ulelong x \b, at 0x%x 22089#>>>0x19 ulelong x 0x%x bytes LBL1 22090#>>>0x1F ulelong x \b, at 0x%x 22091#>>>0x23 ulelong x 0x%x bytes LBL2 22092#>>>0x2D ulelong x \b, at 0x%x 22093#>>>0x31 ulelong x 0x%x bytes LBL3 22094# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format 22095# A lookup table of the chars in the map's codepage, and their collating sequence 22096>>9 string SRT sort table 22097!:mime application/x-garmin-srt 22098!:ext srt 22099>>>0x0E use garmin-date 22100# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format 22101>>9 string TRE tree 22102!:mime application/x-garmin-tre 22103!:ext tre 22104# title like City Nav Europe NTU 2019.2 Basemap 22105# or OSM Street map 22106>>>(0.s) string x %s 22107# 2nd title like Copyright 1995-2018 by GARMIN Corporation. 22108# or http://www.openstreetmap.org/ 22109>>>>&1 string x %s 22110>>>0x0E use garmin-date 22111#>>>0x21 ulelong x \b, at 0x%x 22112#>>>0x25 ulelong x 0x%x bytes TRE1 22113#>>>0x29 ulelong x \b, at 0x%x 22114#>>>0x2D ulelong x 0x%x bytes TRE2 22115#>>>0x31 ulelong x \b, at 0x%x 22116#>>>0x35 ulelong x 0x%x bytes TRE3 22117# Copyright record size 22118#>>>0x39 uleshort x \b, copyright record size %u 22119# Map ID 22120>>>0x74 ulelong x \b, ID 0x%x 22121# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html 22122# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps 22123>>9 string TRF traffic, 22124!:mime application/x-garmin-trf 22125!:ext trf 22126# city/region like Preitenegg 22127>>>(0.s+1) string x 1st %s 22128# highway part like L606/L148 22129>>>>&1 string x %s 22130# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format 22131# Reference: http://www.pinns.co.uk/osm/typformat.html 22132# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps 22133>>9 string TYP types 22134!:mime application/x-garmin-typ 22135!:ext typ 22136>>>0x0E use garmin-date 22137# character set 1252 65001~UTF8 22138>>>0x15 uleshort x \b, code page %u 22139# POIs 22140#>>>0x17 ulelong x \b, at 0x%x 22141#>>>0x1B ulelong x 0x%x bytes TYP1 22142# extra pois 22143#>>>0x5B ulelong x \b, at 0x%x 22144#>>>0x5F ulelong x 0x%x bytes TYP8 22145# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format 22146# http://www.pinns.co.uk/osm/RGN.html 22147# region data used by the Garmin software 22148>>9 string RGN region 22149!:mime application/x-garmin-rgn 22150!:ext rgn 22151# POIs,Indexed POIs,Polylines or Polygons or first map level 22152#>>>0x15 ulelong x \b, at 0x%x 22153#>>>0x19 ulelong x 0x%x bytes RGN1 22154# polygons with extended types 22155#>>>0x21 ulelong >0 22156#>>>>0x1D ulelong x \b, at 0x%x 22157#>>>>0x21 ulelong x 0x%x bytes RGN2 22158# polylines with extended types 22159#>>>0x3D ulelong >0 22160#>>>>0x39 ulelong x \b, at 0x%x 22161#>>>>0x3D ulelong x 0x%x bytes RGN3 22162# extended POIs 22163#>>>0x59 ulelong >0 22164#>>>>0x55 ulelong x \b, at 0x%x 22165#>>>>0x59 ulelong x 0x%x bytes RGN3 22166#>>9 default x unknown map type 22167# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h, 22168# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh 22169>>0 uleshort x \b, header length 0x%x 22170 22171# URL: https://www.memotech.franken.de/FileFormats/ 22172# Reference: https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf 22173# From: Joerg Jenderek 221740 string KpGr Garmin update 22175# format version like: 0064h~1.0 22176>0x4 uleshort !0x0064 22177>>4 uleshort/100 x \b, version %u 22178>>4 uleshort%100 x \b.%u 22179# 1st Garmin entry 22180>6 use garmin-entry 22181# 2nd Garmin entry 22182>(0x6.l+10) ubyte x 22183>>&0 use garmin-entry 22184# 3rd entry 22185>(0x6.l+10) ubyte x 22186>>&(&0.l+4) ubyte x 22187>>>&0 use garmin-entry 22188# look again at version to use default clause 22189>0x4 uleshort x 22190# test for region content by looking for 22191# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales" 22192# 1 space after equal sign 22193>>0x3a search/5/s GARMIN\ BITMAP \b= 22194!:mime image/x-garmin-exe 22195!:ext exe 22196>>>&0 indirect x 22197# if not bitmap *.srf then region; 1 space after equal sign 22198>>0x3a default x \b= 22199!:mime application/x-garmin-rgn 22200!:ext rgn 22201# recursiv embedded 22202>>>0x3a search/5/s KpGrd 22203>>>>&0 indirect x 22204# look for ZIP or JAR archive by ./archive and ./zip 22205>>>0x3a search/5/s PK\003\004 22206>>>>&0 indirect x 22207# TODO: other garmin RGN record content like foo 22208#>>0x3a search/5/s bar BAR 22209# display information of Garmin RGN record 222100 name garmin-entry 22211# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region 22212#>0 ulelong x \b, length 0x%x 22213# data record (ID='D') with version content like 0064h~1.0 22214>4 ubyte =0x44 22215>>5 uleshort !0x0064 \b; Data 22216>>>5 uleshort/100 x \b, version %u 22217>>>5 uleshort%100 x \b.%u 22218# Application Record (ID='A') 22219>4 ubyte =0x41 \b; App 22220# version content like 00c8h~2.0 22221>>5 uleshort !0x00C8 22222>>>5 uleshort/100 x \b, version %u 22223>>>5 uleshort%100 x \b.%u 22224# builder name like: SQA sqa build hales 22225>>7 string x \b, build by %s 22226# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009 22227>>>&1 string x %s 22228# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01 22229>>>>&1 string x %s 22230# region record (ID='R') 22231>4 ubyte =0x52 \b; Region 22232# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP 22233>>5 uleshort x ID=%u 22234# delay in ms: like 0, 500 22235>>7 ulelong !0 \b, %u ms 22236# region size (is record length - 10) 22237#>>11 ulelong x \b, length 0x%x 22238# region content like: 22239# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive 22240#>>15 string x \b, content "%s" 22241>>15 ubequad x \b, content 0x%llx... 22242# This does NOT WORK! 22243#>>15 indirect x \b; contains 22244>4 default x \b; other 22245# garmin Record ID Identifies the record content like: D A R 22246>>4 ubyte x ID '%c' 22247 22248# TOM TOM GPS watches ttbin files: 22249# https://github.com/ryanbinns/ttwatch/tree/master/ttbin 22250# From: Daniel Lenski 222510 byte 0x20 22252>1 leshort 0x0007 22253>>0x76 byte 0x20 22254>>>0x77 leshort 0x0075 TomTom activity file, v7 22255>>>>8 leldate x (%s, 22256>>>>3 byte x device firmware %d. 22257>>>>4 byte x \b%d. 22258>>>>5 byte x \b%d, 22259>>>>6 leshort x product ID %04d) 22260 22261 22262#------------------------------------------------------------------------------ 22263# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $ 22264# maple: file(1) magic for maple files 22265# "H. Nanosecond" <aldomel@ix.netcom.com> 22266# Maple V release 4, a multi-purpose math program 22267# 22268 22269# maple library .lib 222700 string \000MVR4\nI MapleVr4 library 22271 22272# .ind 22273# no magic for these :-( 22274# they are compiled indexes for maple files 22275 22276# .hdb 222770 string \000\004\000\000 Maple help database 22278 22279# .mhp 22280# this has the form <PACKAGE=name> 222810 string \<PACKAGE= Maple help file 222820 string \<HELP\ NAME= Maple help file 222830 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 22284#0 string #\ Newton Maple help file, old style 222850 string #\ daub Maple help file, old style 22286#0 string #=========== Maple help file, old style 22287 22288# .mws 222890 string \000\000\001\044\000\221 Maple worksheet 22290#this is anomalous 222910 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 22292# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 22293# that is {VERSION major_version miunor_version computer_type version_string} 222940 string {VERSION\ Maple worksheet 22295>9 string >\0 version %.1s. 22296>>11 string >\0 %.1s 22297 22298# .mps 222990 string \0\0\001$ Maple something 22300# from byte 4 it is either 'nul E' or 'soh R' 22301# I think 'nul E' means a file that was saved as a different name 22302# a sort of revision marking 22303# 'soh R' means new 22304>4 string \000\105 An old revision 22305>4 string \001\122 The latest save 22306 22307# .mpl 22308# some of these are the same as .mps above 22309#0000000 000 000 001 044 000 105 same as .mps 22310#0000000 000 000 001 044 001 122 same as .mps 22311 223120 string #\n##\ <SHAREFILE= Maple something 223130 string \n#\n##\ <SHAREFILE= Maple something 223140 string ##\ <SHAREFILE= Maple something 223150 string #\r##\ <SHAREFILE= Maple something 223160 string \r#\r##\ <SHAREFILE= Maple something 223170 string #\ \r##\ <DESCRIBE> Maple something anomalous. 22318#-------------------------------------------- 22319# marc21: file(1) magic for MARC 21 Format 22320# 22321# Kevin Ford (kefo@loc.gov) 22322# 22323# MARC21 formats are for the representation and communication 22324# of bibliographic and related information in machine-readable 22325# form. For more info, see https://www.loc.gov/marc/ 22326 22327 22328# leader position 20-21 must be 45 22329# and 22-23 also 00 so far, but we check that later. 2233020 string 45 22331>0 search/2048 \x1e 22332 22333# leader starts with 5 digits, followed by codes specific to MARC format 22334>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 22335!:mime application/marc 22336>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 22337!:mime application/marc 22338>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 22339!:mime application/marc 22340>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 22341!:mime application/marc 22342>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 22343!:mime application/marc 22344 22345# leader position 22-23, should be "00" but is it? 22346>>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 22347!:mime application/marc 22348 22349#------------------------------------------------------------------------------ 22350# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 22351# mathcad: file(1) magic for Mathcad documents 22352# URL: http://www.mathsoft.com/ 22353# From: Josh Triplett <josh@freedesktop.org> 22354 223550 string .MCAD\t Mathcad document 22356 22357#------------------------------------------------------------------------------ 22358# $File: mathematica,v 1.11 2021/02/23 00:51:10 christos Exp $ 22359# mathematica: file(1) magic for mathematica files 22360# "H. Nanosecond" <aldomel@ix.netcom.com> 22361# Mathematica a multi-purpose math program 22362# versions 2.2 and 3.0 22363 22364#mathematica .mb 223650 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 22366!:ext mb 223670 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 22368!:ext mb 22369 22370# .ma 22371# multiple possibilities: 22372 223730 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 22374#>41 string >\0 %s 22375!:ext mb 22376 22377#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 22378 22379#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 22380#>675 string >\0 %s #doesn't work well 22381 22382# there may be 'cr' instead of 'nl' in some does this matter? 22383 22384# generic: 223850 string (*^\r\r::[\011 Mathematica notebook version 2.x 22386!:ext mb 223870 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 22388!:ext mb 223890 string (*^\015 Mathematica notebook version 2.x 22390!:ext mb 223910 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 22392!:ext mb 223930 string (*^\r::[\011 Mathematica notebook version 2.x 22394!:ext mb 223950 string (*^\r\n::[\011 Mathematica notebook version 2.x 22396!:ext mb 223970 string (*^\n\n::[\011 Mathematica notebook version 2.x 22398!:ext mb 223990 string (*^\n::[\011 Mathematica notebook version 2.x 22400!:ext mb 22401 22402 22403# Mathematica .mx files 22404 22405#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 224060 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 22407#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 22408# >71... is optional 22409>88 string >\0 from %s 22410 22411 22412# Mathematica files PBF: 22413# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 224140 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 22415 22416# .ml files These are menu resources I think 22417# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 22418# how to put that into a magic rule? 224194 string \ A~ MAthematica .ml file 22420 22421# .nb files 22422#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 224230 string (*********************** Mathematica 3.0 notebook 22424 22425# other (* matches it is a comment start in these langs 22426# GRR: Too weak; also matches other languages e.g. ML 22427#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 22428 22429######################### 22430# MatLab v5 224310 string MATLAB Matlab v5 mat-file 22432>126 short 0x494d (big endian) 22433>>124 beshort x version 0x%04x 22434>126 short 0x4d49 (little endian) 22435>>124 leshort x version 0x%04x 22436 22437 22438#------------------------------------------------------------------------------ 22439# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $ 22440# matroska: file(1) magic for Matroska files 22441# 22442# See https://www.matroska.org/ 22443# 22444 22445# EBML id: 224460 belong 0x1a45dfa3 22447# DocType id: 22448>4 search/4096 \x42\x82 22449# DocType contents: 22450>>&1 string webm WebM 22451!:mime video/webm 22452>>&1 string matroska Matroska data 22453!:mime video/x-matroska 22454 22455#------------------------------------------------------------------------------ 22456# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 22457# Mavroyanopoulos Nikos <nmav@hellug.gr> 22458# mcrypt: file(1) magic for mcrypt 2.2.x; 224590 string \0m\3 mcrypt 2.5 encrypted data, 22460>4 string >\0 algorithm: %s, 22461>>&1 leshort >0 keysize: %d bytes, 22462>>>&0 string >\0 mode: %s, 22463 224640 string \0m\2 mcrypt 2.2 encrypted data, 22465>3 byte 0 algorithm: blowfish-448, 22466>3 byte 1 algorithm: DES, 22467>3 byte 2 algorithm: 3DES, 22468>3 byte 3 algorithm: 3-WAY, 22469>3 byte 4 algorithm: GOST, 22470>3 byte 6 algorithm: SAFER-SK64, 22471>3 byte 7 algorithm: SAFER-SK128, 22472>3 byte 8 algorithm: CAST-128, 22473>3 byte 9 algorithm: xTEA, 22474>3 byte 10 algorithm: TWOFISH-128, 22475>3 byte 11 algorithm: RC2, 22476>3 byte 12 algorithm: TWOFISH-192, 22477>3 byte 13 algorithm: TWOFISH-256, 22478>3 byte 14 algorithm: blowfish-128, 22479>3 byte 15 algorithm: blowfish-192, 22480>3 byte 16 algorithm: blowfish-256, 22481>3 byte 100 algorithm: RC6, 22482>3 byte 101 algorithm: IDEA, 22483>4 byte 0 mode: CBC, 22484>4 byte 1 mode: ECB, 22485>4 byte 2 mode: CFB, 22486>4 byte 3 mode: OFB, 22487>4 byte 4 mode: nOFB, 22488>5 byte 0 keymode: 8bit 22489>5 byte 1 keymode: 4bit 22490>5 byte 2 keymode: SHA-1 hash 22491>5 byte 3 keymode: MD5 hash 22492 22493#------------------------------------------------------------------------------ 22494# $File: measure,v 1.3 2021/03/25 17:30:10 christos Exp $ 22495# measure: file(1) magic for measurement data 22496 22497# DIY-Thermocam raw data 224980 name diy-thermocam-parser 22499>0 beshort x scale %d- 22500>2 beshort x \b%d, 22501>4 lefloat x spot sensor temperature %f, 22502>9 ubyte 0 unit celsius, 22503>9 ubyte 1 unit fahrenheit, 22504>8 ubyte x color scheme %d 22505>10 ubyte 1 \b, show spot sensor 22506>11 ubyte 1 \b, show scale bar 22507>12 ubyte &1 \b, minimum point enabled 22508>12 ubyte &2 \b, maximum point enabled 22509>13 lefloat x \b, calibration: offset %f, 22510>17 lefloat x slope %f 22511 225120 name diy-thermocam-checker 22513>9 ubyte <2 22514>>10 ubyte <2 22515>>>11 ubyte <2 22516>>>>12 ubyte <4 22517>>>>>17 lefloat >0.0001 DIY-Thermocam raw data 22518 22519# V2 and Leption 3.x: 2252038408 ubyte <19 22521>38400 use diy-thermocam-checker 22522>>38400 default x (Lepton 3.x), 22523>>>38400 use diy-thermocam-parser 22524 22525# V1 or Lepton 2.x 225269608 ubyte <19 22527>9600 use diy-thermocam-checker 22528>>9600 default x (Lepton 2.x), 22529>>>9600 use diy-thermocam-parser 22530 22531# Becker & Hickl Photon Counting (PMS) data file 22532# format documentation: https://www.becker-hickl.com/wp-content/uploads/2018/11/opm-pms400-v01.pdf (page 57) 22533(0x02.l) string *IDENTIFICATION Becker & Hickl PMS Data File 22534>0x12 short x (%d data blocks) 22535!:ext sdt 22536 22537#------------------------------------------------------------------------------ 22538# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $ 22539# mercurial: file(1) magic for Mercurial changeset bundles 22540# https://www.selenic.com/mercurial/wiki/ 22541# 22542# Jesse Glick (jesse.glick@sun.com) 22543# 22544 225450 string HG10 Mercurial changeset bundle 22546>4 string UN (uncompressed) 22547>4 string GZ (gzip compressed) 22548>4 string BZ (bzip2 compressed) 22549 22550#------------------------------------------------------------------------------ 22551# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $ 22552# metastore: file(1) magic for metastore files 22553# From: Thomas Wissen 22554# see https://david.hardeman.nu/software.php#metastore 225550 string MeTaSt00r3 Metastore data file, 22556>10 bequad x version %0llx 22557 22558#------------------------------------------------------------------------------ 22559# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $ 22560# rinex: file(1) magic for RINEX files 22561# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 22562# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 22563# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 2256460 string RINEX 22565>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 22566>>&32 string x \b, date %15.15s 22567>>5 string x \b, version %6.6s 22568!:mime rinex/broadcast 22569>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 22570>>&32 string x \b, date %15.15s 22571>>5 string x \b, version %6.6s 22572!:mime rinex/observation 22573>80 search/256 XXRINEXC RINEX Data, Clock 22574>>&32 string x \b, date %15.15s 22575>>5 string x \b, version %6.6s 22576!:mime rinex/clock 22577>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 22578>>&32 string x \b, date %15.15s 22579>>5 string x \b, version %6.6s 22580!:mime rinex/navigation 22581>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 22582>>&32 string x \b, date %15.15s 22583>>5 string x \b, version %6.6s 22584!:mime rinex/navigation 22585>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 22586>>&32 string x \b, date %15.15s 22587>>5 string x \b, version %6.6s 22588!:mime rinex/navigation 22589>80 search/256 XXRINEXM RINEX Data, Meteorological 22590>>&32 string x \b, date %15.15s 22591>>5 string x \b, version %6.6s 22592!:mime rinex/meteorological 22593>80 search/256 XXRINEXN RINEX Data, Navigation 22594>>&32 string x \b, date %15.15s 22595>>5 string x \b, version %6.6s 22596!:mime rinex/navigation 22597>80 search/256 XXRINEXO RINEX Data, Observation 22598>>&32 string x \b, date %15.15s 22599>>5 string x \b, version %6.6s 22600!:mime rinex/observation 22601 22602# https://en.wikipedia.org/wiki/GRIB 226030 string GRIB 22604>7 byte =1 Gridded binary (GRIB) version 1 22605>7 byte =2 Gridded binary (GRIB) version 2 22606 22607#------------------------------------------------------------------------------ 22608# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $ 22609# Micro Focus COBOL data files. 22610 22611# https://documentation.microfocus.com/help/index.jsp?topic=\ 22612# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html 22613# http://www.cobolproducts.com/datafile/data-viewer.html 22614# https://github.com/miracle2k/mfcobol-export 22615 226160 string \x30\x00\x00\x7C 22617>36 string \x00\x3E Micro Focus File with Header (DAT) 22618!:mime application/octet-stream 22619 226200 string \x30\x7E\x00\x00 22621>36 string \x00\x3E Micro Focus File with Header (DAT) 22622!:mime application/octet-stream 22623 2262439 string \x02 22625>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX) 22626!:mime application/octet-stream 22627 22628#------------------------------------------------------------------------------ 22629# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $ 22630# mime: file(1) magic for MIME encoded files 22631# 226320 string/t Content-Type:\040 22633>14 string >\0 %s 226340 string/t Content-Type: 22635>13 string >\0 %s 22636 22637#------------------------------------------------------------------------------ 22638# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $ 22639# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 22640# and DEC Ultrix 22641# 226420 beshort 0x0160 MIPSEB ECOFF executable 22643>20 beshort 0407 (impure) 22644>20 beshort 0410 (swapped) 22645>20 beshort 0413 (paged) 22646>8 belong >0 not stripped 22647>8 belong 0 stripped 22648>22 byte x - version %d 22649>23 byte x \b.%d 22650# 226510 beshort 0x0162 MIPSEL-BE ECOFF executable 22652>20 beshort 0407 (impure) 22653>20 beshort 0410 (swapped) 22654>20 beshort 0413 (paged) 22655>8 belong >0 not stripped 22656>8 belong 0 stripped 22657>23 byte x - version %d 22658>22 byte x \b.%d 22659# 226600 beshort 0x6001 MIPSEB-LE ECOFF executable 22661>20 beshort 03401 (impure) 22662>20 beshort 04001 (swapped) 22663>20 beshort 05401 (paged) 22664>8 belong >0 not stripped 22665>8 belong 0 stripped 22666>23 byte x - version %d 22667>22 byte x \b.%d 22668# 226690 beshort 0x6201 MIPSEL ECOFF executable 22670>20 beshort 03401 (impure) 22671>20 beshort 04001 (swapped) 22672>20 beshort 05401 (paged) 22673>8 belong >0 not stripped 22674>8 belong 0 stripped 22675>23 byte x - version %d 22676>22 byte x \b.%d 22677# 22678# MIPS 2 additions 22679# 226800 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 22681>20 beshort 0407 (impure) 22682>20 beshort 0410 (swapped) 22683>20 beshort 0413 (paged) 22684>8 belong >0 not stripped 22685>8 belong 0 stripped 22686>22 byte x - version %d 22687>23 byte x \b.%d 22688# 226890 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 22690>20 beshort 0407 (impure) 22691>20 beshort 0410 (swapped) 22692>20 beshort 0413 (paged) 22693>8 belong >0 not stripped 22694>8 belong 0 stripped 22695>22 byte x - version %d 22696>23 byte x \b.%d 22697# 226980 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 22699>20 beshort 03401 (impure) 22700>20 beshort 04001 (swapped) 22701>20 beshort 05401 (paged) 22702>8 belong >0 not stripped 22703>8 belong 0 stripped 22704>23 byte x - version %d 22705>22 byte x \b.%d 22706# 227070 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 22708>20 beshort 03401 (impure) 22709>20 beshort 04001 (swapped) 22710>20 beshort 05401 (paged) 22711>8 belong >0 not stripped 22712>8 belong 0 stripped 22713>23 byte x - version %d 22714>22 byte x \b.%d 22715# 22716# MIPS 3 additions 22717# 227180 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 22719>20 beshort 0407 (impure) 22720>20 beshort 0410 (swapped) 22721>20 beshort 0413 (paged) 22722>8 belong >0 not stripped 22723>8 belong 0 stripped 22724>22 byte x - version %d 22725>23 byte x \b.%d 22726# 227270 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 22728>20 beshort 0407 (impure) 22729>20 beshort 0410 (swapped) 22730>20 beshort 0413 (paged) 22731>8 belong >0 not stripped 22732>8 belong 0 stripped 22733>22 byte x - version %d 22734>23 byte x \b.%d 22735# 227360 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 22737>20 beshort 03401 (impure) 22738>20 beshort 04001 (swapped) 22739>20 beshort 05401 (paged) 22740>8 belong >0 not stripped 22741>8 belong 0 stripped 22742>23 byte x - version %d 22743>22 byte x \b.%d 22744# 227450 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 22746>20 beshort 03401 (impure) 22747>20 beshort 04001 (swapped) 22748>20 beshort 05401 (paged) 22749>8 belong >0 not stripped 22750>8 belong 0 stripped 22751>23 byte x - version %d 22752>22 byte x \b.%d 22753# 227540 beshort 0x180 MIPSEB Ucode 227550 beshort 0x182 MIPSEL-BE Ucode 22756 22757#------------------------------------------------------------------------------ 22758# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 22759# mirage: file(1) magic for Mirage executables 22760# 22761# XXX - byte order? 22762# 227630 long 31415 Mirage Assembler m.out executable 22764 22765#----------------------------------------------------------------------------- 22766# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $ 22767# misctools: file(1) magic for miscellaneous UNIX tools. 22768# 227690 search/1 %%!! X-Post-It-Note text 227700 string/c BEGIN:VCALENDAR vCalendar calendar file 22771!:mime text/calendar 22772# updated by Joerg Jenderek at Apr 2015 22773# Extension: .vcf 22774# https://en.wikipedia.org/wiki/VCard 227750 string/c BEGIN:VCARD vCard visiting card 22776# deprecated 22777#!:mime text/x-vcard 22778!:mime text/vcard 22779# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere 22780>12 search/14000/c VERSION: 22781# VERSION 2.1 , 3.0 or 4.0 22782>>&0 string x \b, version %-.3s 22783 22784# Summary: Libtool library file 22785# Extension: .la 22786# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 227870 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 22788 22789# Summary: Libtool object file 22790# Extension: .lo 22791# Submitted by: Abel Cheung <abelcheung@gmail.com> 227920 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 22793 22794# From: Daniel Novotny <dnovotny@redhat.com> 22795# Update: Joerg Jenderek 22796# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps 22797# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx 22798# 22799# "Windows Minidump" by TrID 22800# ./misctools (version 5.25) labeled the entry as "MDMP crash report data" 228010 string MDMP Mini DuMP crash report 22802# https://filext.com/file-extension/DMP 22803!:mime application/x-dmp 22804!:ext dmp/mdmp 22805# The high-order word is an internal value that is implementation specific. 22806# The low-order word is MINIDUMP_VERSION 0xA793 22807>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x 22808# NumberOfStreams 8,9,10,13 22809>8 ulelong x \b, %d streams 22810# StreamDirectoryRva 0x20 22811>12 ulelong !0x20 \b, 0x%8.8x RVA 22812# CheckSum 0 22813>16 ulelong !0 \b, CheckSum 0x%8.8x 22814# Reserved or TimeDateStamp 22815>20 ledate x \b, %s 22816# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx 22817# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800 22818>24 ulelong x \b, 0x%x type 22819# >24 ulelong >0 \b; include 22820# >>24 ulelong &0x00000001 \b data sections, 22821# >>24 ulelong &0x00000020 \b list of unloaded modules, 22822# >>24 ulelong &0x00000100 \b process and thread information, 22823# >>24 ulelong &0x00000800 \b memory information, 22824 22825# Summary: abook addressbook file 22826# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 228270 string #\x20abook\x20addressbook\x20file abook address book 22828!:mime application/x-abook-addressbook 22829 22830#------------------------------------------------------------------------------ 22831# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 22832# mkid: file(1) magic for mkid(1) databases 22833# 22834# ID is the binary tags database produced by mkid(1). 22835# 22836# XXX - byte order? 22837# 228380 string \311\304 ID tags data 22839>2 short >0 version %d 22840 22841#------------------------------------------------------------------------------ 22842# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 22843# mlssa: file(1) magic for MLSSA datafiles 22844# 228450 lelong 0xffffabcd MLSSA datafile, 22846>4 leshort x algorithm %d, 22847>10 lelong x %d samples 22848 22849#------------------------------------------------------------------------------ 22850# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 22851# mmdf: file(1) magic for MMDF mail files 22852# 228530 string \001\001\001\001 MMDF mailbox 22854 22855#------------------------------------------------------------------------------ 22856# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $ 22857# modem: file(1) magic for modem programs 22858# 22859# From: Florian La Roche <florian@knorke.saar.de> 228601 string PC\ Research,\ Inc Digifax-G3-File 22861>29 byte 1 \b, fine resolution 22862>29 byte 0 \b, normal resolution 22863 22864# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header). 22865# Modified by: Joerg Jenderek 22866# URL: https://de.wikipedia.org/wiki/Fax 22867# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm 22868# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others 228690 short 0x0100 22870# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER 22871>2 search/9 \0\0 22872# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 22873>2 default x 22874# skip IRCAM file (VAX big-endian) ./audio 22875>>0 belong !0x0001a364 22876# skip GEM Image data ./images 22877>>>2 beshort !0x0008 22878# look for first keyword of Panorama database *.pan 22879>>>>11 search/262 \x06DESIGN 22880# skip Panorama database 22881>>>>11 default x 22882# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files 22883>>>>>27118 search/1864 DreamWorld 22884>>>>>27118 default x 22885# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom 22886>>>>>>8 ubequad !0x2e01010454010203 22887# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom 22888>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded 22889# version 5.25 labeled the entry above "raw G3 data, byte-padded" 22890!:mime image/g3fax 22891#!:apple ????TIFF 22892!:ext g3 22893# unusual image starting with black pixel 22894#0 short 0x1300 raw G3 (Group 3) FAX 228950 short 0x1400 22896# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom 22897>2 search/9 \0\0 22898# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 22899>2 default x raw G3 (Group 3) FAX 22900# version 5.25 labeled the above entry as "raw G3 data" 22901!:mime image/g3fax 22902!:ext g3 22903# unusual image with black pixel near beginning 22904#0 short 0x1900 raw G3 (Group 3) FAX 22905 22906# 22907# Magic data for vgetty voice formats 22908# (Martin Seine & Marc Eberhard) 22909 22910# 22911# raw modem data version 1 22912# 229130 string RMD1 raw modem data 22914>4 string >\0 (%s / 22915>20 short >0 compression type 0x%04x) 22916 22917# 22918# portable voice format 1 22919# 229200 string PVF1\n portable voice format 22921>5 string >\0 (binary %s) 22922 22923# 22924# portable voice format 2 22925# 229260 string PVF2\n portable voice format 22927>5 string >\0 (ascii %s) 22928 22929# From: Bernd Nuernberger <bernd.nuernberger@web.de> 22930# Brooktrout G3 fax data incl. 128 byte header 22931# Common suffixes: 3??, BRK, BRT, BTR 229320 leshort 0x01bb 22933>2 leshort 0x0100 Brooktrout 301 fax image, 22934>>9 leshort x %d x 22935>>0x2d leshort x %d 22936>>6 leshort 200 \b, fine resolution 22937>>6 leshort 100 \b, normal resolution 22938>>11 byte 1 \b, G3 compression 22939>>11 byte 2 \b, G32D compression 22940 22941#------------------------------------------------------------------------------ 22942# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $ 22943# modulefile: file(1) magic for user's environment modulefile 22944# URL: http://modules.sourceforge.net/ 22945# Reference: https://modules.readthedocs.io/en/stable/modulefile.html 22946# From: Xavier Delaruelle <xavier.delaruelle@cea.fr> 229470 string #%Module modulefile 22948!:mime text/x-modulefile 22949 22950#------------------------------------------------------------------------------ 22951# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $ 22952# motorola: file(1) magic for Motorola 68K and 88K binaries 22953# 22954# 68K 22955# 229560 beshort 0520 mc68k COFF 22957>18 beshort ^00000020 object 22958>18 beshort &00000020 executable 22959>12 belong >0 not stripped 22960>168 string .lowmem Apple toolbox 22961>20 beshort 0407 (impure) 22962>20 beshort 0410 (pure) 22963>20 beshort 0413 (demand paged) 22964>20 beshort 0421 (standalone) 229650 beshort 0521 mc68k executable (shared) 22966>12 belong >0 not stripped 229670 beshort 0522 mc68k executable (shared demand paged) 22968>12 belong >0 not stripped 22969# 22970# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 22971# 229720 beshort 0554 68K BCS executable 22973# 22974# 88K 22975# 22976# Motorola/88Open BCS 22977# 229780 beshort 0555 88K BCS executable 22979# 22980# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 229810 string S0 Motorola S-Record; binary data in text format 22982 22983# ATARI ST relocatable PRG 22984# 22985# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 22986# (according to Roland Waldi, Oct 21, 1987) 22987# besides the magic 0x601a, the text segment size is checked to be 22988# not larger than 1 MB (which is a lot on ST). 22989# The additional 0x601b distinction I took from Doug Lee's magic. 229900 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 22991>2 belong x (txt=%d, 22992>6 belong x dat=%d, 22993>10 belong x bss=%d, 22994>14 belong x sym=%d) 229950 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 22996>2 belong x (txt=%d, 22997>6 belong x dat=%d, 22998>10 belong x bss=%d, 22999>14 belong x sym=%d) 23000 23001# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 230020 beshort 0x601A Atari 68xxx executable, 23003>2 belong x text len %u, 23004>6 belong x data len %u, 23005>10 belong x BSS len %u, 23006>14 belong x symboltab len %u, 23007>18 belong 0 23008>22 belong &0x01 fastload flag, 23009>22 belong &0x02 may be loaded to alternate RAM, 23010>22 belong &0x04 malloc may be from alternate RAM, 23011>22 belong x flags: 0x%X, 23012>26 beshort 0 no relocation tab 23013>26 beshort !0 + relocation tab 23014>30 string SFX [Self-Extracting LZH SFX archive] 23015>38 string SFX [Self-Extracting LZH SFX archive] 23016>44 string ZIP! [Self-Extracting ZIP SFX archive] 23017 230180 beshort 0x0064 Atari 68xxx CPX file 23019>8 beshort x (version %04x) 23020 23021#------------------------------------------------------------------------------ 23022# $File: mozilla,v 1.11 2020/12/12 20:01:47 christos Exp $ 23023# mozilla: file(1) magic for Mozilla XUL fastload files 23024# (XUL.mfasl and XPC.mfasl) 23025# URL: https://www.mozilla.org/ 23026# From: Josh Triplett <josh@freedesktop.org> 23027 230280 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 23029# Probably the next magic line contains misspelled "mozLz40\0" 230300 string mozLz4a Mozilla lz4 compressed bookmark data 23031# From: Joerg Jenderek 23032# URL: https://lz4.github.io/lz4/ 23033# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/ 23034# dejsonlz4-master\src\dejsonlz4.c 23035# Note: mostly JSON compressed with a non-standard LZ4 header 23036# can be unpacked by dejsonlz4 but not lz4 program. 230370 string mozLz40\0 Mozilla lz4 compressed data 23038!:mime application/x-lz4+json 23039# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks 23040!:ext jsonlz4/mozlz4 23041# decomp_size 23042>8 ulelong x \b, originally %u bytes 23043# lz4 data 23044#>12 ubequad x \b, lz4 data 0x%16.16llx 23045 23046# From: Joerg Jenderek 23047# URL: https://en.wikipedia.org/wiki/Firefox_4 23048# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT 23049# Note: Most ZIP utilities are able to extract such archives 23050# maybe only partly or after some warnings. Example: 23051# zip -FF omni.ja --out omni.zip 230524 string PK\001\002 Mozilla archive omni.ja 23053!:mime application/x-zip 23054!:ext ja 23055# TODO: 23056#>4 use zip-dir-entry 23057 23058#------------------------------------------------------------------------------ 23059# $File: msdos,v 1.145 2021/02/23 00:51:10 christos Exp $ 23060# msdos: file(1) magic for MS-DOS files 23061# 23062 23063# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 23064# updated by Joerg Jenderek at Oct 2008,Apr 2011 230650 string/t @ 23066>1 string/cW \ echo\ off DOS batch file text 23067!:mime text/x-msdos-batch 23068!:ext bat 23069>1 string/cW echo\ off DOS batch file text 23070!:mime text/x-msdos-batch 23071!:ext bat 23072>1 string/cW rem DOS batch file text 23073!:mime text/x-msdos-batch 23074!:ext bat 23075>1 string/cW set\ DOS batch file text 23076!:mime text/x-msdos-batch 23077!:ext bat 23078 23079 23080# OS/2 batch files are REXX. the second regex is a bit generic, oh well 23081# the matched commands seem to be common in REXX and uncommon elsewhere 23082100 search/0xffff rxfuncadd 23083>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 23084100 search/0xffff say 23085>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 23086 23087# updated by Joerg Jenderek at Oct 2015 23088# https://de.wikipedia.org/wiki/Common_Object_File_Format 23089# http://www.delorie.com/djgpp/doc/coff/filhdr.html 23090# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 23091#0 leshort 0x14c MS Windows COFF Intel 80386 object file 23092#>4 ledate x stamp %s 230930 leshort 0x166 MS Windows COFF MIPS R4000 object file 23094#>4 ledate x stamp %s 230950 leshort 0x184 MS Windows COFF Alpha object file 23096#>4 ledate x stamp %s 230970 leshort 0x268 MS Windows COFF Motorola 68000 object file 23098#>4 ledate x stamp %s 230990 leshort 0x1f0 MS Windows COFF PowerPC object file 23100#>4 ledate x stamp %s 231010 leshort 0x290 MS Windows COFF PA-RISC object file 23102#>4 ledate x stamp %s 23103 23104# Tests for various EXE types. 23105# 23106# Many of the compressed formats were extracted from IDARC 1.23 source code. 23107# 231080 string/b MZ 23109# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 23110>0x18 leshort <0x40 MS-DOS executable 23111!:mime application/x-dosexec 23112# Windows and later versions of DOS will allow .EXEs to be named with a .COM 23113# extension, mostly for compatibility's sake. 23114# URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM 23115# Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml 23116!:ext exe/com/vlm 23117# These traditional tests usually work but not always. When test quality support is 23118# implemented these can be turned on. 23119#>>0x18 leshort 0x1c (Borland compiler) 23120#>>0x18 leshort 0x1e (MS compiler) 23121 23122# Maybe it's a PE? 23123>(0x3c.l) string PE\0\0 PE 23124!:mime application/x-dosexec 23125>>(0x3c.l+24) leshort 0x010b \b32 executable 23126>>(0x3c.l+24) leshort 0x020b \b32+ executable 23127>>(0x3c.l+24) leshort 0x0107 ROM image 23128>>(0x3c.l+24) default x Unknown PE signature 23129>>>&0 leshort x 0x%x 23130>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 23131>>(0x3c.l+92) leshort 1 23132# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 23133# drivers in Windows/System32/drivers/*.sys. 23134>>>(0x3c.l+22) leshort&0x2000 >0 (native) 23135!:ext dll/sys 23136>>>(0x3c.l+22) leshort&0x2000 0 (native) 23137!:ext exe/sys 23138>>(0x3c.l+92) leshort 2 23139>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 23140# These could probably be at least partially distinguished from one another by 23141# looking for specific exported functions. 23142# CPL: Control Panel item 23143# TLB: Type library 23144# OCX: OLE/ActiveX control 23145# ACM: Audio compression manager codec 23146# AX: DirectShow source filter 23147# IME: Input method editor 23148!:ext dll/cpl/tlb/ocx/acm/ax/ime 23149>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 23150# Screen savers typically include code from the scrnsave.lib static library, but 23151# that's not guaranteed. 23152!:ext exe/scr 23153>>(0x3c.l+92) leshort 3 23154>>>(0x3c.l+22) leshort&0x2000 >0 (console) 23155!:ext dll/cpl/tlb/ocx/acm/ax/ime 23156>>>(0x3c.l+22) leshort&0x2000 0 (console) 23157!:ext exe/com 23158# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format 23159>>(0x3c.l+92) leshort 7 (POSIX) 23160>>(0x3c.l+92) leshort 9 (Windows CE) 23161>>(0x3c.l+92) leshort 10 (EFI application) 23162>>(0x3c.l+92) leshort 11 (EFI boot service driver) 23163>>(0x3c.l+92) leshort 12 (EFI runtime driver) 23164>>(0x3c.l+92) leshort 13 (EFI ROM) 23165>>(0x3c.l+92) leshort 14 (XBOX) 23166>>(0x3c.l+92) leshort 15 (Windows boot application) 23167>>(0x3c.l+92) default x (Unknown subsystem 23168>>>&0 leshort x 0x%x) 23169>>(0x3c.l+4) leshort 0x14c Intel 80386 23170>>(0x3c.l+4) leshort 0x166 MIPS R4000 23171>>(0x3c.l+4) leshort 0x168 MIPS R10000 23172>>(0x3c.l+4) leshort 0x184 Alpha 23173>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 23174>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP 23175>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5 23176>>(0x3c.l+4) leshort 0x169 MIPS WCE v2 23177>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 23178>>(0x3c.l+4) leshort 0x1c0 ARM 23179>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 23180>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 23181>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33 23182>>(0x3c.l+4) leshort 0x1f0 PowerPC 23183>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU 23184>>(0x3c.l+4) leshort 0x1f2 PowerPC (big-endian) 23185>>(0x3c.l+4) leshort 0x200 Intel Itanium 23186>>(0x3c.l+4) leshort 0x266 MIPS16 23187>>(0x3c.l+4) leshort 0x268 Motorola 68000 23188>>(0x3c.l+4) leshort 0x290 PA-RISC 23189>>(0x3c.l+4) leshort 0x366 MIPSIV 23190>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 23191>>(0x3c.l+4) leshort 0xebc EFI byte code 23192>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit 23193>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit 23194>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit 23195>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R 23196>>(0x3c.l+4) leshort 0x8664 x86-64 23197>>(0x3c.l+4) leshort 0xaa64 Aarch64 23198>>(0x3c.l+4) leshort 0xc0ee MSIL 23199>>(0x3c.l+4) default x Unknown processor type 23200>>>&0 leshort x 0x%x 23201>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 23202>>(0x3c.l+22) leshort&0x1000 >0 system file 23203>>(0x3c.l+24) leshort 0x010b 23204>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 23205>>(0x3c.l+24) leshort 0x020b 23206>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 23207 23208# hooray, there's a DOS extender using the PE format, with a valid PE 23209# executable inside (which just prints a message and exits if run in win) 23210>>(8.s*16) string 32STUB \b, 32rtm DOS extender 23211>>(8.s*16) string !32STUB \b, for MS Windows 23212>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 23213>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 23214>>(0x3c.l+0xf8) search/0x140 UPX2 23215>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 23216>>(0x3c.l+0xf8) search/0x140 .idata 23217>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 23218>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 23219>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 23220>>(0x3c.l+0xf8) search/0x140 .rsrc 23221>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 23222>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 23223>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 23224>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 23225>>(0x3c.l+0xf8) search/0x140 .data 23226>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 23227>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 23228>>>(0x3c.l+0xf7) byte x 23229>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 23230>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 23231>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 23232>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 23233>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 23234>>0x30 string Inno \b, InnoSetup self-extracting archive 23235 23236# If the relocation table is 0x40 or more bytes into the file, it's definitely 23237# not a DOS EXE. 23238>0x18 leshort >0x3f 23239 23240# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 23241# must be one of the unusual subformats. 23242>>(0x3c.l) string !PE\0\0 MS-DOS executable 23243!:mime application/x-dosexec 23244 23245>>(0x3c.l) string NE \b, NE 23246!:mime application/x-dosexec 23247>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 23248>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 23249>>>(0x3c.l+0x36) byte 3 for MS-DOS 23250>>>(0x3c.l+0x36) byte 4 for Windows 386 23251>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 23252>>>(0x3c.l+0x36) default x 23253>>>>(0x3c.l+0x36) byte x (unknown OS %x) 23254>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 23255>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 23256# DRV: Driver 23257# 3GR: Grabber device driver 23258# CPL: Control Panel Item 23259# VBX: Visual Basic Extension 23260# FON: Bitmap font 23261# FOT: Font resource file 23262!:ext dll/drv/3gr/cpl/vbx/fon/fot 23263>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 23264!:ext exe/scr 23265>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 23266>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 23267 23268>>(0x3c.l) string LX\0\0 \b, LX 23269!:mime application/x-dosexec 23270>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 23271>>>(0x3c.l+0x0a) leshort 1 for OS/2 23272>>>(0x3c.l+0x0a) leshort 2 for MS Windows 23273>>>(0x3c.l+0x0a) leshort 3 for DOS 23274>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 23275>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 23276>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 23277>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 23278>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 23279>>>(0x3c.l+0x08) leshort 1 i80286 23280>>>(0x3c.l+0x08) leshort 2 i80386 23281>>>(0x3c.l+0x08) leshort 3 i80486 23282>>>(8.s*16) string emx \b, emx 23283>>>>&1 string x %s 23284>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 23285 23286# MS Windows system file, supposedly a collection of LE executables 23287>>(0x3c.l) string W3 \b, W3 for MS Windows 23288!:mime application/x-dosexec 23289 23290>>(0x3c.l) string LE\0\0 \b, LE executable 23291!:mime application/x-dosexec 23292>>>(0x3c.l+0x0a) leshort 1 23293# some DOS extenders use LE files with OS/2 header 23294>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 23295>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 23296>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 23297>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 23298>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 23299>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 23300>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 23301# this is a wild guess; hopefully it is a specific signature 23302>>>>&0x24 lelong <0x50 23303>>>>>(&0x4c.l) string \xfc\xb8WATCOM 23304>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 23305# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 23306#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 23307# fails with DOS-Extenders. 23308>>>(0x3c.l+0x0a) leshort 2 for MS Windows 23309>>>(0x3c.l+0x0a) leshort 3 for DOS 23310>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 23311# VXD: VxD for Windows 95/98/Me 23312# 386: VxD for Windows 2.10, 3.0, 3.1x 23313# PDR: Port driver 23314# MPD: Miniport driver (?) 23315!:ext vxd/386/pdr/mpd 23316>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 23317>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 23318 23319# looks like ASCII, probably some embedded copyright message. 23320# and definitely not NE/LE/LX/PE 23321>>0x3c lelong >0x20000000 23322>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 23323!:mime application/x-dosexec 23324!:ext exe/com 23325# header data too small for extended executable 23326>2 long !0 23327>>0x18 leshort <0x40 23328>>>(4.s*512) leshort !0x014c 23329 23330>>>>&(2.s-514) string !LE 23331>>>>>&-2 string !BW \b, MZ for MS-DOS 23332!:mime application/x-dosexec 23333>>>>&(2.s-514) string LE \b, LE 23334>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 23335# educated guess since indirection is still not capable enough for complex offset 23336# calculations (next embedded executable would be at &(&2*512+&0-2) 23337# I suspect there are only LE executables in these multi-exe files 23338>>>>&(2.s-514) string BW 23339>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 23340>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 23341 23342# This sequence skips to the first COFF segment, usually .text 23343>(4.s*512) leshort 0x014c \b, COFF 23344!:mime application/x-dosexec 23345>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 23346>>(8.s*16) string emx 23347>>>&1 string x for DOS, Win or OS/2, emx %s 23348>>&(&0x42.l-3) byte x 23349>>>&0x26 string UPX \b, UPX compressed 23350# and yet another guess: small .text, and after large .data is unusual, could be 32lite 23351>>&0x2c search/0xa0 .text 23352>>>&0x0b lelong <0x2000 23353>>>>&0 lelong >0x6000 \b, 32lite compressed 23354 23355>(8.s*16) string $WdX \b, WDos/X DOS extender 23356 23357# By now an executable type should have been printed out. The executable 23358# may be a self-uncompressing archive, so look for evidence of that and 23359# print it out. 23360# 23361# Some signatures below from Greg Roelofs, newt@uchicago.edu. 23362# 23363>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 23364>0xe7 string LH/2\ Self-Extract \b, %s 23365>0x1c string UC2X \b, UCEXE compressed 23366>0x1c string WWP\ \b, WWPACK compressed 23367>0x1c string RJSX \b, ARJ self-extracting archive 23368>0x1c string diet \b, diet compressed 23369>0x1c string LZ09 \b, LZEXE v0.90 compressed 23370>0x1c string LZ91 \b, LZEXE v0.91 compressed 23371>0x1c string tz \b, TinyProg compressed 23372>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 23373!:mime application/zip 23374# Yes, this really is "Copr", not "Corp." 23375>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 23376!:mime application/zip 23377# winarj stores a message in the stub instead of the sig in the MZ header 23378>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 23379>0x20 string AIN 23380>>0x23 string 2 \b, AIN 2.x compressed 23381>>0x23 string <2 \b, AIN 1.x compressed 23382>>0x23 string >2 \b, AIN 1.x compressed 23383>0x24 string LHa's\ SFX \b, LHa self-extracting archive 23384!:mime application/x-lha 23385>0x24 string LHA's\ SFX \b, LHa self-extracting archive 23386!:mime application/x-lha 23387>0x24 string \ $ARX \b, ARX self-extracting archive 23388>0x24 string \ $LHarc \b, LHarc self-extracting archive 23389>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 23390>0x40 string aPKG \b, aPackage self-extracting archive 23391>0x64 string W\ Collis\0\0 \b, Compack compressed 23392>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 23393>>&0xf4 search/0x140 \x0\x40\x1\x0 23394>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 23395>1638 string -lh5- \b, LHa self-extracting archive v2.13S 23396>0x17888 string Rar! \b, RAR self-extracting archive 23397 23398# Skip to the end of the EXE. This will usually work fine in the PE case 23399# because the MZ image is hardcoded into the toolchain and almost certainly 23400# won't match any of these signatures. 23401>(4.s*512) long x 23402>>&(2.s-517) byte x 23403>>>&0 string PK\3\4 \b, ZIP self-extracting archive 23404>>>&0 string Rar! \b, RAR self-extracting archive 23405>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 23406>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 23407>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 23408>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 23409>>>&7 search/400 **ACE** \b, ACE self-extracting archive 23410>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 23411 23412# a few unknown ZIP sfxes, no idea if they are needed or if they are 23413# already captured by the generic patterns above 23414>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 23415# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 23416# 23417 23418# TELVOX Teleinformatica CODEC self-extractor for OS/2: 23419>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 23420>>49824 leshort =1 \b, 1 file 23421>>49824 leshort >1 \b, %u files 23422 23423# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 23424# and https://www.freedos.org/software/?prog=kpdos 23425# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 234260 string/b KCF FreeDOS KEYBoard Layout collection 23427# only version=0x100 found 23428>3 uleshort x \b, version 0x%x 23429# length of string containing author,info and special characters 23430>6 ubyte >0 23431#>>6 pstring x \b, name=%s 23432>>7 string >\0 \b, author=%-.14s 23433>>7 search/254 \xff \b, info= 23434#>>>&0 string x \b%-s 23435>>>&0 string x \b%-.15s 23436# for FreeDOS *.KL files 234370 string/b KLF FreeDOS KEYBoard Layout file 23438# only version=0x100 or 0x101 found 23439>3 uleshort x \b, version 0x%x 23440# stringlength 23441>5 ubyte >0 23442>>8 string x \b, name=%-.2s 234430 string \xffKEYB\ \ \ \0\0\0\0 23444>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 23445 23446# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020 23447# URL: http://fileformats.archiveteam.org/wiki/DOS_device_driver 23448# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html 23449# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 234500 ulequad&0x07a0ffffffff 0xffffffff 23451# skip OS/2 INI ./os2 23452>4 ubelong !0x14000000 23453>>0 use msdos-driver 234540 name msdos-driver DOS executable ( 23455#!:mime application/octet-stream 23456!:mime application/x-dosdriver 23457# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 23458# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used? 23459# PROTMAN.DOS ELNKPL.DOS 23460!:ext sys/dev/bin/dos 23461# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device" 23462>40 search/7 UPX! \bUPX compressed\040 23463# DOS device driver attributes 23464>4 uleshort&0x8000 0x0000 \bblock device driver 23465# character device 23466>4 uleshort&0x8000 0x8000 \b 23467# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$" 23468>>4 uleshort&0x0008 0x0008 \bclock\040 23469# fast video output by int 29h 23470# 1 space char after "fast" to get phrase like "fast standard input/output character device driver" 23471>>4 uleshort&0x0010 0x0010 \bfast\040 23472# standard input/output device 23473# 1 space char after "standard" to get phrase like "standard input/output character device driver" 23474>>4 uleshort&0x0003 >0 \bstandard\040 23475>>>4 uleshort&0x0001 0x0001 \binput 23476>>>4 uleshort&0x0003 0x0003 \b/ 23477# 1 space char after "output" to get phrase like "input/output character device driver" 23478>>>4 uleshort&0x0002 0x0002 \boutput\040 23479>>4 uleshort&0x8000 0x8000 \bcharacter device driver 23480>0 ubyte x 23481# upx compressed device driver has garbage instead of real in name field of header 23482>>40 search/7 UPX! 23483>>40 default x 23484# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 23485# 1 space char before device driver name to get phrase like "device driver PROTMAN$" 23486>>>12 ubyte >0x2E \b\040 23487>>>>10 ubyte >0x20 23488>>>>>10 ubyte !0x2E 23489>>>>>>10 ubyte !0x2A \b%c 23490>>>>11 ubyte >0x20 23491>>>>>11 ubyte !0x2E \b%c 23492>>>>12 ubyte >0x20 23493>>>>>12 ubyte !0x39 23494>>>>>>12 ubyte !0x2E \b%c 23495>>>13 ubyte >0x20 23496>>>>13 ubyte !0x2E \b%c 23497>>>>14 ubyte >0x20 23498>>>>>14 ubyte !0x2E \b%c 23499>>>>15 ubyte >0x20 23500>>>>>15 ubyte !0x2E \b%c 23501>>>>16 ubyte >0x20 23502>>>>>16 ubyte !0x2E 23503>>>>>>16 ubyte <0xCB \b%c 23504>>>>17 ubyte >0x20 23505>>>>>17 ubyte !0x2E 23506>>>>>>17 ubyte <0x90 \b%c 23507# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 23508>>>12 ubyte <0x2F 23509# they have their real name at offset 22 23510# also block device drivers like DUMBDRV.SYS 23511>>>>22 string >\056 %-.6s 23512>4 uleshort&0x8000 0x0000 23513# 32 bit sector addressing ( > 32 MB) for block devices 23514>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 23515# support by driver functions 13h, 17h, 18h 23516>4 uleshort&0x0040 0x0040 \b,IOCTL- 23517# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 23518>4 uleshort&0x0800 0x0800 \b,close media- 23519# output until busy support by int 10h for character device driver 23520>4 uleshort&0x8000 0x8000 23521>>4 uleshort&0x2000 0x2000 \b,until busy- 23522# direct read/write support by driver functions 03h,0Ch 23523>4 uleshort&0x4000 0x4000 \b,control strings- 23524>4 uleshort&0x8000 0x8000 23525>>4 uleshort&0x6840 >0 \bsupport 23526>4 uleshort&0x8000 0x0000 23527>>4 uleshort&0x4842 >0 \bsupport 23528>0 ubyte x \b) 23529>0 ulelong !0xffffffff with pointer 0x%x 23530# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 235310 ulequad 0x0513c00000000012 23532>0 use msdos-driver 23533# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 235340 ulequad 0x32f28000ffff0016 23535>0 use msdos-driver 235360 ulequad 0x007f00000000ffff 23537>0 use msdos-driver 23538# https://www.uwe-sieber.de/files/cfg_echo.zip 235390 ulequad 0x001600000000ffff 23540>0 use msdos-driver 23541# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 235420 ulequad 0x0bf708c2ffffffff 23543>0 use msdos-driver 235440 ulequad 0x07bd08c2ffffffff 23545>0 use msdos-driver 23546# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS 235470 ulequad 0x027ac0c0ffffffff 23548>0 use msdos-driver 23549# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS 235500 ulequad 0x00228880ffffffff 23551>0 use msdos-driver 23552 23553# updated by Joerg Jenderek 23554# GRR: line below too general as it catches also 23555# rt.lib DYADISKS.PIC and many more 23556# start with assembler instruction MOV 235570 ubyte 0x8c 23558# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 23559>4 string !O==== 23560# skip some unknown basic binaries like RocketRnger.SHR 23561>>5 string !MAIN 23562# skip "GPG symmetrically encrypted data" ./gnu 23563# skip "PGP symmetric key encrypted data" ./pgp 23564# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 23565>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 23566# the remaining files should be DOS *.COM executables 23567# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 23568# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 23569# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 23570# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 23571# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 23572# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 23573# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 23574# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 23575!:mime application/x-dosexec 23576!:ext com 23577 23578# updated by Joerg Jenderek at Oct 2008 235790 ulelong 0xffff10eb DR-DOS executable (COM) 23580# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 235810 ubeshort&0xeb8d >0xeb00 23582# DR-DOS STACKER.COM SCREATE.SYS missed 23583 235840 name msdos-com 23585>0 byte x DOS executable (COM) 23586!:mime application/x-dosexec 23587!:ext com 23588>6 string SFX\ of\ LHarc \b, %s 23589>0x1FE leshort 0xAA55 \b, boot code 23590>85 string UPX \b, UPX compressed 23591>4 string \ $ARX \b, ARX self-extracting archive 23592>4 string \ $LHarc \b, LHarc self-extracting archive 23593>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 23594 23595# JMP 8bit 235960 byte 0xeb 23597# allow forward jumps only 23598>1 byte >-1 23599# that offset must be accessible 23600>>(1.b+2) byte x 23601>>>0 use msdos-com 23602 23603# JMP 16bit 236040 byte 0xe9 23605# forward jumps 23606>1 short >-1 23607# that offset must be accessible 23608>>(1.s+3) byte x 23609>>>0 use msdos-com 23610# negative offset, must not lead into PSP 23611>1 short <-259 23612# that offset must be accessible 23613>>(1,s+65539) byte x 23614>>>0 use msdos-com 23615 23616# updated by Joerg Jenderek at Oct 2008,2015 23617# following line is too general 236180 ubyte 0xb8 23619# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 23620>0 string !\xb8\xc0\x07\x8e 23621# modified by Joerg Jenderek 23622# syslinux COM32 or COM32R executable 23623>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 23624# https://www.syslinux.org/wiki/index.php/Comboot_API 23625# Since version 5.00 c32 modules switched from the COM32 object format to ELF 23626!:mime application/x-c32-comboot-syslinux-exec 23627!:ext c32 23628# https://syslinux.zytor.com/comboot.php 23629# older syslinux version ( <4 ) 23630# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 23631# start with assembler instructions mov eax,21cd4cffh 23632>>>1 lelong 0x21CD4CFf \b) 23633# syslinux:doc/comboot.txt 23634# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 23635# eax,21cd4cfeh) as a magic number. 23636# syslinux version (4.x) 23637# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 23638>>>1 lelong 0x21CD4CFe \b, relocatable) 23639# Hajin Jang <hajin_jang@worksmobile.com>: 23640# Disable simplest COM signature to prevent false positive on some EUC-KR text files. 23641## remaining are DOS COM executables starting with assembler instruction MOV 23642## like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 23643## MS-DOS SYS.COM RESTART.COM 23644## SYSLINUX.COM (version 1.40 - 2.13) 23645## GFXBOOT.COM (version 3.75) 23646## COPYBS.COM POWEROFF.COM INT18.COM 23647#>>1 default x COM executable for DOS 23648#!:mime application/x-dosexec 23649##!:mime application/x-ms-dos-executable 23650##!:mime application/x-msdos-program 23651#!:ext com 23652 23653# URL: https://en.wikipedia.org/wiki/UPX 23654# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/ 23655# src/stub/src/i086-dos16.com.S 23656# Update: Joerg Jenderek 23657# assembler instructions: cmp sp, offset sp_limit 236580 string/b \x81\xfc 23659#>2 uleshort x \b, sp_limit=0x%x 23660# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy 23661>4 string \x77\x02\xcd\x20\xb9 23662#>9 uleshort x \b, [bytes_to_copy]=0x%x 23663# at different offsets assembler instructions: push di; jump decomp_start_n2b 23664>0x1e search/3 \x57\xe9 23665#>>&0 uleshort x \b, decomp_start_n2b=0x%x 23666# src/stub/src/include/header.S; UPX_MAGIC_LE32 23667>>&2 string UPX! FREE-DOS executable (COM), UPX 23668!:mime application/x-dosexec 23669# UPX compressed *.CPI; See ./fonts 23670>>>&21 string =FONT compressed DOS code page font 23671!:ext cpx 23672>>>&21 string !FONT compressed 23673!:ext com 23674# compressed size? 23675#>>>&14 uleshort+152 x \b, %u bytes 23676# uncompressed len 23677>>>&12 uleshort x \b, uncompressed %u bytes 23678252 string Must\ have\ DOS\ version DR-DOS executable (COM) 23679!:mime application/x-dosexec 23680!:ext com 23681# GRR search is not working 23682#2 search/28 \xcd\x21 COM executable for MS-DOS 23683#WHICHFAT.cOM 236842 string \xcd\x21 COM executable for DOS 23685!:mime application/x-dosexec 23686!:ext com 23687#DELTREE.cOM DELTREE2.cOM 236884 string \xcd\x21 COM executable for DOS 23689!:mime application/x-dosexec 23690!:ext com 23691#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 236925 string \xcd\x21 COM executable for DOS 23693!:mime application/x-dosexec 23694!:ext com 23695#DELTMP.COm HASFAT32.cOM 236967 string \xcd\x21 23697>0 byte !0xb8 COM executable for DOS 23698!:mime application/x-dosexec 23699!:ext com 23700#COMP.cOM MORE.COm 2370110 string \xcd\x21 23702>5 string !\xcd\x21 COM executable for DOS 23703!:mime application/x-dosexec 23704!:ext com 23705#comecho.com 2370613 string \xcd\x21 COM executable for DOS 23707!:mime application/x-dosexec 23708!:ext com 23709#HELP.COm EDIT.coM 2371018 string \xcd\x21 COM executable for MS-DOS 23711!:mime application/x-dosexec 23712!:ext com 23713#NWRPLTRM.COm 2371423 string \xcd\x21 COM executable for MS-DOS 23715!:mime application/x-dosexec 23716!:ext com 23717#LOADFIX.cOm LOADFIX.cOm 2371830 string \xcd\x21 COM executable for MS-DOS 23719!:mime application/x-dosexec 23720!:ext com 23721#syslinux.com 3.11 2372270 string \xcd\x21 COM executable for DOS 23723!:mime application/x-dosexec 23724!:ext com 23725# many compressed/converted COMs start with a copy loop instead of a jump 237260x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 23727!:mime application/x-dosexec 23728!:ext com 237290x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 23730!:mime application/x-dosexec 23731!:ext com 23732>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 237330x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 23734!:mime application/x-dosexec 23735!:ext com 23736# FIXME: missing diet .com compression 23737 23738# miscellaneous formats 237390 string/b LZ MS-DOS executable (built-in) 23740#0 byte 0xf0 MS-DOS program library data 23741# 23742 23743# AAF files: 23744# <stuartc@rd.bbc.co.uk> Stuart Cunningham 237450 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 23746>30 byte 9 (512B sectors) 23747>30 byte 12 (4kB sectors) 237480 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 23749>30 byte 9 (512B sectors) 23750>30 byte 12 (4kB sectors) 23751 23752# Popular applications 23753# 23754# Update: Joerg Jenderek 23755# URL: http://fileformats.archiveteam.org/wiki/DOC 23756# Reference: https://web.archive.org/web/20170206041048/ 23757# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 23758# wIdent+dty 237590 belong 0x31be0000 23760# skip droid skeleton like x-fmt-274-signature-id-488.doc 23761>128 ubyte >0 Microsoft 23762>>96 uleshort =0 Word 23763!:mime application/msword 23764!:apple MSWDWDBN 23765# DCX is used in the Unix version. 23766!:ext doc/dcx 23767>>>0x6E ulequad =0 1.0-4.0 23768>>>0x6E ulequad !0 5.0-6.0 23769>>>0x6E ulequad x (DOS) Document 23770# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt 23771>>96 uleshort !0 Write 3.0 (Windows) Document 23772!:mime application/x-mswrite 23773!:apple MSWDWDBN 23774# sometimes also doc like in splitter.doc srchtest.doc 23775!:ext wri/doc 23776# wTool must be 0125400 octal 23777#>>4 uleshort !0xAB00 \b, wTool %o 23778# reserved; must be zero 23779#>>6 ulelong !0 \b, reserved %u 23780# block pointer to the block containing optional file manager information 23781#>>0x1C uleshort x \b, at 0x%x info block 23782# jump to File manager information block 23783>>(0x1C.s*128) uleshort x 23784# test for valid information start; maybe also 0012h 23785>>>&-2 uleshort =0x0014 23786# Document ASCIIZ name 23787>>>>&0x12 string x %s 23788# author name 23789>>>>>&1 string x \b, author %s 23790# reviser name 23791>>>>>>&1 string x \b, reviser %s 23792# keywords 23793>>>>>>>&1 string x \b, keywords %s 23794# comment 23795>>>>>>>>&1 string x \b, comment %s 23796# version number 23797>>>>>>>>>&1 string x \b, version %s 23798# date of last change MM/DD/YY 23799>>>>>>>>>>&1 string x \b, %-.8s 23800# creation date MM/DD/YY 23801>>>>>>>>>>&9 string x created %-.8s 23802# file name of print format like NORMAL.STY 23803>>0x1E string >0 \b, formatted by %-.66s 23804# count of pages in whole file for write variant; maybe some times wrong 23805>>96 uleshort >0 \b, %u pages 23806# name of the printer driver like HPLASMS 23807>>0x62 string >0 \b, %-.8s printer 23808# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 23809>>0x6A uleshort >0 \b, %u blocks 23810# bit field for corrected text areas 23811#>>0x6C uleshort x \b, 0x%x bit field 23812# text of document; some times start with 4 non printable characters like CR LF 23813>>128 ubyte x \b, 23814>>>128 ubyte >0x1F 23815>>>>128 string x %s 23816>>>128 ubyte <0x20 23817>>>>129 ubyte >0x1F 23818>>>>>129 string x %s 23819>>>>129 ubyte <0x20 23820>>>>>130 ubyte >0x1F 23821>>>>>>130 string x %s 23822>>>>>130 ubyte <0x20 23823>>>>>>131 ubyte >0x1F 23824>>>>>>>131 string x %s 23825>>>>>>131 ubyte <0x20 23826>>>>>>>132 ubyte >0x1F 23827>>>>>>>>132 string x %s 23828>>>>>>>132 ubyte <0x20 23829>>>>>>>>133 ubyte >0x1F 23830>>>>>>>>>133 string x %s 23831# 238320 string/b PO^Q` Microsoft Word 6.0 Document 23833!:mime application/msword 23834# 238354 long 0 23836>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 23837!:mime application/msword 23838!:ext mcw 23839>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 23840!:mime application/msword 23841!:ext mcw 23842>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 23843!:mime application/msword 23844!:ext mcw 23845>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 23846!:mime application/msword 23847!:ext mcw 23848 238490 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 23850!:mime application/msword 23851!:ext doc 23852# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 23853#512 string/b \354\245\301 Microsoft Word Document 23854#!:mime application/msword 23855 23856# 238570 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 23858!:mime application/msword 23859# 238600 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 23861!:mime application/msword 23862 23863# 238640 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 23865!:mime application/vnd.ms-excel 23866# https://www.macdisk.com/macsigen.php 23867!:apple XCELXLS4 23868!:ext xls 23869# 23870# Update: Joerg Jenderek 23871# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 23872# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 23873# Note: newer Lotus versions >2 use longer BOF record 23874# record type (BeginningOfFile=0000h) + length (001Ah) 238750 belong 0x00001a00 23876# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 23877#>18 uleshort&0x73E0 0 23878# Lotus Multi Byte Character Set (LMBCS=1-31) 23879>20 ubyte >0 23880>>20 ubyte <32 Lotus 1-2-3 23881#!:mime application/x-123 23882!:mime application/vnd.lotus-1-2-3 23883!:apple ????L123 23884# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 23885>>>4 uleshort 0x1000 WorKsheet, version 3 23886!:ext wk3 23887# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 23888>>>4 uleshort 0x1002 WorKsheet, version 4 23889# also worksheet template 4 (.wt4) 23890!:ext wk4/wt4 23891# no example or documentation for wk5 23892#>>4 uleshort 0x???? WorKsheet, version 4 23893#!:ext wk5 23894# only MacrotoScript.123 example 23895>>>4 uleshort 0x1003 WorKsheet, version 97 23896# also worksheet template Smartmaster (.12M)? 23897!:ext 123 23898# only Set_Y2K.123 example 23899>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 23900!:ext 123 23901# no example for this version 23902>>>4 uleshort 0x8001 FoRMatting data 23903!:ext frm 23904# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 23905# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 23906>>>4 uleshort 0x8007 ForMatting data, version 3 23907!:ext fm3 23908>>>4 default x unknown 23909# file revision sub code 0004h for worksheets 23910>>>>6 uleshort =0x0004 worksheet 23911!:ext wXX 23912>>>>6 uleshort !0x0004 formatting data 23913!:ext fXX 23914# main revision number 23915>>>>4 uleshort x \b, revision 0x%x 23916>>>6 uleshort =0x0004 \b, cell range 23917# active cellcoord range (start row, page,column ; end row, page, column) 23918# start values normally 0~1st sheet A1 23919>>>>8 ulelong !0 23920>>>>>10 ubyte >0 \b%d* 23921>>>>>8 uleshort x \b%d, 23922>>>>>11 ubyte x \b%d- 23923# end page mostly 0 23924>>>>14 ubyte >0 \b%d* 23925# end raw, column normally not 0 23926>>>>12 uleshort x \b%d, 23927>>>>15 ubyte x \b%d 23928# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 23929>>>>20 ubyte >1 \b, character set 0x%x 23930# flags 23931>>>>21 ubyte x \b, flags 0x%x 23932>>>6 uleshort !0x0004 23933# record type (FONTNAME=00AEh) 23934>>>>30 search/29 \0\xAE 23935# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 23936>>>>>&4 string >\0 \b, 1st font "%s" 23937# 23938# Update: Joerg Jenderek 23939# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 23940# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 23941# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 23942# record type (BeginningOfFile=0000h) + length (0002h) 239430 belong 0x00000200 23944# GRR: line above is too general as it catches also MS Windows CURsor 23945# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 23946!:strength -1 23947# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 23948>7 ubyte 0 23949# skip Windows cursors with image width 256 and keep Lotus with positive opcode 23950>>6 ubyte >0 Lotus 23951# !:mime application/x-123 23952!:mime application/vnd.lotus-1-2-3 23953!:apple ????L123 23954# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 23955# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 23956>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 23957!:ext cnf 23958>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 23959!:ext cnf 23960>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 23961!:ext cnf 23962>>>4 uleshort 0x0802 Symphony CoNFiguration 23963!:ext cnf 23964>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 23965!:ext cnf 23966>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 23967!:ext cnf 23968>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 23969!:ext cnf 23970>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 23971!:ext cnf 23972# (version 5.26) labeled the entry as "Lotus 123" 23973# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 23974>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 23975# extension "wks" also for Microsoft Works document 23976!:ext wks 23977# (version 5.26) labeled the entry as "Lotus 123" 23978# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 23979>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 23980!:ext wrk/wr1 23981# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 23982# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 23983>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 23984# Symphony (.wr1) 23985!:ext wk1/wr1 23986# no example for this japan version 23987>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 23988!:ext wj1 23989# no example or documentation for wk2 23990#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 23991#!:ext wk2 23992# undocumented japan version 23993>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 23994!:ext wj3 23995# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 23996>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 23997# japan version 2.4J (fj3) 23998!:ext fmt/fj3 23999# no example for this version 24000>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 24001!:ext frm 24002# (version 5.26) labeled the entry as "Lotus 1-2-3" 24003>>>4 default x unknown worksheet or configuration 24004!:ext cnf 24005>>>>4 uleshort x \b, revision 0x%x 24006# 2nd record for most worksheets describes cells range 24007>>>6 use lotus-cells 24008# 3rd record for most japan worksheets describes cells range 24009>>>(8.s+10) use lotus-cells 24010# check and then display Lotus worksheet cells range 240110 name lotus-cells 24012# look for type (RANGE=0006h) + length (0008h) at record begin 24013>0 ubelong 0x06000800 \b, cell range 24014# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 24015>>4 ulong !0 24016>>>4 uleshort x \b%d, 24017>>>6 uleshort x \b%d- 24018# end of cell range 24019>>8 uleshort x \b%d, 24020>>10 uleshort x \b%d 24021# EndOfLotus123 240220 string/b WordPro\0 Lotus WordPro 24023!:mime application/vnd.lotus-wordpro 240240 string/b WordPro\r\373 Lotus WordPro 24025!:mime application/vnd.lotus-wordpro 24026 24027 24028# Summary: Script used by InstallScield to uninstall applications 24029# Extension: .isu 24030# Submitted by: unknown 24031# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 240320 string \x71\xa8\x00\x00\x01\x02 24033>12 string Stirling\ Technologies, InstallShield Uninstall Script 24034 24035# Winamp .avs 24036#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 240370 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 24038 24039# Windows Metafile .WMF 240400 string/b \327\315\306\232 Windows metafile 24041!:mime image/wmf 24042!:ext wmf 240430 string/b \002\000\011\000 Windows metafile 24044!:mime image/wmf 24045!:ext wmf 240460 string/b \001\000\011\000 Windows metafile 24047!:mime image/wmf 24048!:ext wmf 24049 24050#tz3 files whatever that is (MS Works files) 240510 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 240520 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 240530 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 24054 24055# PGP sig files .sig 24056#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 240570 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 240580 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 240590 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 240600 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 240610 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 240620 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 24063 24064# windows zips files .dmf 240650 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 24066 24067# Windows icons 24068# Update: Joerg Jenderek 24069# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 24070# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 240710 belong 0x00000100 24072>9 byte 0 24073>>0 byte x 24074>>0 use cur-ico-dir 24075>9 ubyte 0xff 24076>>0 byte x 24077>>0 use cur-ico-dir 24078# displays number of icons and information for icon or cursor 240790 name cur-ico-dir 24080# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 24081# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 24082>18 ulelong &0x00000006 24083# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 24084>>(18.l) ulelong x MS Windows 24085>>>0 ubelong 0x00000100 icon resource 24086# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 24087!:mime image/vnd.microsoft.icon 24088#!:mime image/x-icon 24089!:ext ico 24090>>>>4 uleshort x - %d icon 24091# plural s 24092>>>>4 uleshort >1 \bs 24093# 1st icon 24094>>>>0x06 use ico-entry 24095# 2nd icon 24096>>>>4 uleshort >1 24097>>>>>0x16 use ico-entry 24098>>>0 ubelong 0x00000200 cursor resource 24099#!:mime image/x-cur 24100!:mime image/x-win-bitmap 24101!:ext cur 24102>>>>4 uleshort x - %d icon 24103>>>>4 uleshort >1 \bs 24104# 1st cursor 24105>>>>0x06 use cur-entry 24106#>>>>0x16 use cur-entry 24107# display information of one cursor entry 241080 name cur-entry 24109>0 use cur-ico-entry 24110>4 uleshort x \b, hotspot @%dx 24111>6 uleshort x \b%d 24112# display information of one icon entry 241130 name ico-entry 24114>0 use cur-ico-entry 24115# normally 0 1 but also found 14 24116>4 uleshort >1 \b, %d planes 24117# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 24118>6 uleshort >1 \b, %d bits/pixel 24119# display shared information of cursor or icon entry 241200 name cur-ico-entry 24121>0 byte =0 \b, 256x 24122>0 byte !0 \b, %dx 24123>1 byte =0 \b256 24124>1 byte !0 \b%d 24125# number of colors in palette 24126>2 ubyte !0 \b, %d colors 24127# reserved 0 FFh 24128#>3 ubyte x \b, reserved %x 24129#>8 ulelong x \b, image size %d 24130# offset of PNG or DIB image 24131#>12 ulelong x \b, offset 0x%x 24132# PNG header (\x89PNG) 24133>(12.l) ubelong =0x89504e47 24134# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 24135>>&-4 indirect x \b with\040 24136# DIB image 24137>(12.l) ubelong !0x89504e47 24138#>>&-4 use dib-image 24139 24140# Windows non-animated cursors 24141# Update: Joerg Jenderek 24142# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 24143# Note: similar to Windows ICOn. container for BMP ( only DIB part) 24144# GRR: line below is too general as it catches also Lotus 1-2-3 files 241450 belong 0x00000200 24146>9 byte 0 24147>>0 use cur-ico-dir 24148>9 ubyte 0xff 24149>>0 use cur-ico-dir 24150 24151# .chr files 241520 string/b PK\010\010BGI Borland font 24153>4 string >\0 %s 24154# then there is a copyright notice 24155 24156 24157# .bgi files 241580 string/b pk\010\010BGI Borland device 24159>4 string >\0 %s 24160# then there is a copyright notice 24161 24162 24163# Windows Recycle Bin record file (named INFO2) 24164# By Abel Cheung (abelcheung AT gmail dot com) 24165# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 24166# Since Vista uses another structure, INFO2 structure probably won't change 24167# anymore. Detailed analysis in: 24168# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 241690 lelong 0x00000004 24170>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 24171 241720 lelong 0x00000005 24173>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 24174 24175# From Doug Lee via a FreeBSD pr 241769 string GERBILDOC First Choice document 241779 string GERBILDB First Choice database 241789 string GERBILCLIP First Choice database 241790 string GERBIL First Choice device file 241809 string RABBITGRAPH RabbitGraph file 241810 string DCU1 Borland Delphi .DCU file 241820 string =!<spell> MKS Spell hash list (old format) 241830 string =!<spell2> MKS Spell hash list 24184# Too simple - MPi 24185#0 string AH Halo(TM) bitmapped font file 241860 lelong 0x08086b70 TurboC BGI file 241870 lelong 0x08084b50 TurboC Font file 24188 24189# Debian#712046: The magic below identifies "Delphi compiled form data". 24190# An additional source of information is available at: 24191# http://www.woodmann.com/fravia/dafix_t1.htm 241920 string TPF0 24193>4 pstring >\0 Delphi compiled form '%s' 24194 24195# tests for DBase files moved, updated and merged to database 24196 241970 string PMCC Windows 3.x .GRP file 241981 string RDC-meg MegaDots 24199>8 byte >0x2F version %c 24200>9 byte >0x2F \b.%c file 242010 lelong 0x4C 24202>4 lelong 0x00021401 Windows shortcut file 24203 24204# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 24205# only for windows versions equal or greater 3.0 242060x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 24207!:mime application/x-dosexec 24208!:ext pif 24209#>2 string >\0 \b, Title:%.30s 24210>0x24 string >\0 \b for %.63s 24211>0x65 string >\0 \b, directory=%.64s 24212>0xA5 string >\0 \b, parameters=%.64s 24213#>0x181 leshort x \b, offset %x 24214#>0x183 leshort x \b, offsetdata %x 24215#>0x185 leshort x \b, section length %x 24216>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 24217>>&0x5e ubyte >0 24218>>>&-1 string <PIFMGR.DLL \b, icon=%s 24219#>>>&-1 string PIFMGR.DLL \b, icon=%s 24220>>>&-1 string >PIFMGR.DLL \b, icon=%s 24221>>&0xF0 ubyte >0 24222>>>&-1 string <Terminal \b, font=%.32s 24223#>>>&-1 string =Terminal \b, font=%.32s 24224>>>&-1 string >Terminal \b, font=%.32s 24225>>&0x110 ubyte >0 24226>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 24227#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 24228>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 24229#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 24230#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 24231>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 24232#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 24233>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 24234#>>&06 string x \b:%s 24235>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 24236#>>&06 string x \b:%s 24237 24238# DOS EPS Binary File Header 24239# From: Ed Sznyter <ews@Black.Market.NET> 242400 belong 0xC5D0D3C6 DOS EPS Binary File 24241!:mime image/x-eps 24242>4 long >0 Postscript starts at byte %d 24243>>8 long >0 length %d 24244>>>12 long >0 Metafile starts at byte %d 24245>>>>16 long >0 length %d 24246>>>20 long >0 TIFF starts at byte %d 24247>>>>24 long >0 length %d 24248 24249# TNEF magic From "Joomy" <joomy@se-ed.net> 24250# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 242510 lelong 0x223e9f78 TNEF 24252!:mime application/vnd.ms-tnef 24253 24254# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 24255# of http://www.davep.org/norton-guides/ng2h-105.tgz 24256# https://en.wikipedia.org/wiki/Norton_Guides 242570 string NG\0\001 24258# only value 0x100 found at offset 2 24259>2 ulelong 0x00000100 Norton Guide 24260!:mime application/x-norton-guide 24261# often like NORTON.NG but some times like NC.HLP 24262!:ext ng/hlp 24263# Title[40] 24264>>8 string >\0 "%-.40s" 24265#>>6 uleshort x \b, MenuCount=%u 24266# szCredits[5][66] 24267>>48 string >\0 \b, %-.66s 24268>>114 string >\0 %-.66s 24269 24270# URL: https://en.wikipedia.org/wiki/Norton_Commander 24271# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml 24272# From: Joerg Jenderek 24273# Note: Message file is used by executable with same main name. 24274# Only tested with version 5.50 (english) and 2.01 (Windows) 242750 string Abort 24276# \0 or i 24277#>5 ubyte x %x 24278# skip ASCII Abort text by looking for error message like in NCVIEW.MSG 24279>6 search/7089 Non-DOS\ disk Norton Commander module message 24280!:mime application/x-norton-msg 24281!:ext msg 24282 24283# URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 24284# Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml 24285# From: Joerg Jenderek 242860 string DOS\ Client\ Message\ File: Novell DOS client message 24287#!:mime application/octet-stream 24288#!:mime application/x-novell-msg 24289!:ext msg 24290# look for second letter instead space character 24291>26 ubyte >0x20 24292# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr 24293>>25 ubyte !0x20 %c 24294>>>26 ubyte !0x20 \b%c 24295>>>>27 ubyte !0x20 \b%c 24296>>>>>28 ubyte !0x20 \b%c 24297>>>>>>29 ubyte !0x20 \b%c 24298>>>>>>>30 ubyte !0x20 \b%c 24299>>>>>>>>31 ubyte !0x20 \b%c 24300>>>>>>>>>32 ubyte !0x20 \b%c 24301>>>>>>>>>>33 ubyte !0x20 \b%c 24302>>>>>>>>>>>34 ubyte !0x20 \b%c 24303>>>>>>>>>>>>35 ubyte !0x20 \b%c 24304>>>>>>>>>>>>>36 ubyte !0x20 \b%c 24305# followed by string like: 0 v.10 V1.20 24306# 24307# followed by ,\040Tran\040 24308>28 search/14 ,\040Tran\040 24309# probably translated version string like: 0 v1.00 24310>>&0 string x \b, tran version %s 24311# followed by Ctrl-J Ctrl-Z 24312>>>&0 ubyte !0xa \b, terminated by 0x%2.2x 24313>>>>&0 ubyte x \b%2.2x 24314# Ctrl-Z 24315>0x65 ubyte !0x1A \b, at 0x65 0x%x 24316# one 24317>0x66 ubyte !0x01 \b, at 0x66 0x%x 24318# URL: https://en.wikipedia.org/wiki/NetWare 24319# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml 24320# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html 24321# From: Joerg Jenderek 243220 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data 24323#>35 string Version\ 1.00 24324#>49 string COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc. 24325#>83 string \ \ All\ Rights\ Reserved 24326#!:mime application/octet-stream 24327#!:mime application/x-novell-msg 24328!:ext msg 24329#!:ext msg/dat 24330# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 24331# of https://www.4dos.info/ 24332# pointer,HelpID[8]=4DHnnnmm 243330 ulelong 0x48443408 4DOS help file 24334>4 string x \b, version %-4.4s 24335 24336# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 243370 ulequad 0x3a000000024e4c MS Advisor help file 24338 24339# HtmlHelp files (.chm) 243400 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 24341 24342# GFA-BASIC (Wolfram Kleff) 243432 string/b GFA-BASIC3 GFA-BASIC 3 data 24344 24345#------------------------------------------------------------------------------ 24346# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 24347# Update: Joerg Jenderek 24348# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 24349# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 24350# Note: verified by `7z l *.cab` 24351# Microsoft Cabinet files 243520 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 24353# 24354# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 24355# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 24356# because some archive does not have *.diag* as 1st or 2nd archive member like 24357# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 24358# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 24359>0x2c search/980/c .diag \b, Diagnostic 24360!:mime application/vnd.ms-cab-compressed 24361!:ext diagcab 24362# http://fileformats.archiveteam.org/wiki/PUZ 24363# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 24364# bundles a Publisher document *PNG.pub with all links into a CAB 24365>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 24366!:mime application/vnd.ms-cab-compressed 24367!:ext puz 24368# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 24369>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 24370!:mime application/vnd.ms-powerpoint 24371#!:mime application/mspowerpoint 24372!:ext ppz 24373# URL: https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets 24374# Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/ 24375# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget 24376>0x2c search/968/c gadget.xml \b, Windows Desktop Gadget 24377#!:mime application/vnd.ms-cab-compressed 24378# http://extension.nirsoft.net/gadget 24379!:mime application/x-windows-gadget 24380!:ext gadget 24381# http://www.incredimail.com/ 24382# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 24383>0x2c search/3369/c content.ini\0 \b, IncrediMail 24384!:mime application/x-incredimail 24385# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 24386>>0x2c search/83/c Flavor.htm\0 ecard 24387!:ext imf 24388# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 24389>>0x2c search/211/c .swf\0 skin 24390!:ext ims 24391# member anim.im3 implies IncrediMail animation like in letter_fold.ima 24392>>0x2c search/92/c anim.im3\0 animation 24393!:ext ima 24394# other IncrediMail cab archive 24395>>0x2c default x 24396>>>0x2c search/116/c thumb ecard, image, notifier or skin 24397!:ext imf/imi/imn/ims 24398# http://file-extension.net/seeker/file_extension_ime 24399>>>0x2c default x emoticons or sound 24400!:ext ime/imw 24401# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail 24402>0x2c default x 24403# look for 1st member name 24404>>(16.l+16) ubyte x 24405# https://en.wikipedia.org/wiki/SNP_file_format 24406>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 24407!:mime application/msaccess 24408!:ext snp 24409# https://en.wikipedia.org/wiki/Microsoft_InfoPath 24410>>>&-1 string manifest.xsf \b, InfoPath Form Template 24411!:mime application/vnd.ms-cab-compressed 24412#!:mime application/vnd.ms-infopath 24413!:ext xsn 24414# https://www.cabextract.org.uk/wince_cab_format/ 24415# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 24416>>>&7 string =.000 \b, WinCE install 24417!:mime application/vnd.ms-cab-compressed 24418!:ext cab 24419 24420# https://support.microsoft.com/kb/934307/en-US 24421# All inspected MSU contain a file with name WSUSSCAN.cab 24422# that is called "Windows Update meta data" by Microsoft 24423>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 24424!:mime application/vnd.ms-cab-compressed 24425!:ext msu 24426>>>&-1 default x 24427# look at point character of 1st archive member name for file name extension 24428>>>>&-1 search/255 . 24429# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 24430# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 24431# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 24432>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 24433!:mime application/vnd.ms-powerpoint 24434#!:mime application/mspowerpoint 24435!:ext ppz 24436# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 24437# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 24438# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 24439>>>>>&0 string/c theme \b, Windows 24440!:mime application/x-windows-themepack 24441# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 24442# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 24443# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 24444>>>>>>(16.l+16) string =Panoram 8 24445!:ext deskthemepack 24446>>>>>>(16.l+16) string !Panoram 7 or 8 24447!:ext themepack/deskthemepack 24448>>>>>>(16.l+16) ubyte x Theme Pack 24449>>>>>&0 default x 24450# look for null terminator of 1st member name 24451>>>>>>&0 search/255 \0 24452# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 24453>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 24454!:mime application/vnd.ms-cab-compressed 24455!:ext msu 24456>>>>>>>&16 default x 24457# archive with more then one file need some output in version 5.32 to avoid error message like 24458# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 24459# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 24460# file: could not find any valid magic files! 24461>>>>>>>>28 uleshort >1 \b, many 24462!:mime application/vnd.ms-cab-compressed 24463!:ext cab 24464# remaining archives with just one file 24465>>>>>>>>28 uleshort =1 24466# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 24467>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 24468# cut of last char of source extension and add underscore to generate extension 24469# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 24470!:mime application/vnd.ms-cab-compressed 24471!:ext _/?_/??_ 24472# archive need some output like "single" in version 5.32 to avoid error messages 24473>>>>>>>>>30 uleshort !0x0000 \b, single 24474!:mime application/vnd.ms-cab-compressed 24475!:ext cab 24476# TODO: additional extensions like 24477# .xtp InfoPath Template Part 24478# .lvf Logitech Video Effects Face Accessory 24479>8 ulelong x \b, %u bytes 24480>28 uleshort 1 \b, 1 file 24481>28 uleshort >1 \b, %u files 24482# Reserved fields, set to zero 24483#>4 belong !0 \b, reserved1 %x 24484#>12 belong !0 \b, reserved2 %x 24485# offset of the first CFFILE entry coffFiles: minimal 2Ch 24486>16 ulelong x \b, at 0x%x 24487>(16.l) use cab-file 24488# at least also 2nd member 24489>28 uleshort >1 24490>>(16.l+16) ubyte x 24491>>>&0 search/255 \0 24492# second member info 24493>>>>&0 use cab-file 24494#>20 belong !0 \b, reserved %x 24495# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 24496>24 ubeshort !0x0301 \b version 0x%x 24497# number of CFFOLDER entries 24498>26 uleshort >1 \b, %u cffolders 24499# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 24500# only found for flags 0 1 2 3 4 not 7 24501>30 uleshort >0 \b, flags 0x%x 24502# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 24503# default is zero, however, the -i option of cabarc can be used to set this field 24504>32 uleshort >0 \b, ID %u 24505# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 24506#>34 uleshort x \b, iCabinet %u 24507# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 24508>34 uleshort+1 x \b, number %u 24509>30 uleshort &0x0004 \b, extra bytes 24510# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 24511>>36 uleshort >0 %u in head 24512# cbCFFolder is optional size of per-folder reserved area 24513>>38 ubyte >0 %u in folder 24514# cbCFData is optional size of per-datablock reserved area 24515>>39 ubyte >0 %u in data block 24516# optional per-cabinet reserved area abReserve[cbCFHeader] 24517>>36 uleshort >0 24518# 1st CFFOLDER after reserved area in header 24519>>>(36.s+40) use cab-folder 24520# no reserved area in header 24521>30 uleshort ^0x0004 24522# no previous and next cab archive 24523>>30 uleshort =0x0000 24524>>>36 use cab-folder 24525# only previous cab archive 24526>>30 uleshort =0x0001 \b, previous 24527>>>36 use cab-anchor 24528# only next cab archive 24529>>30 uleshort =0x0002 \b, next 24530>>>36 use cab-anchor 24531# previous+next cab archive 24532# can not use sub routine cab-anchor to display previous and next cabinet together 24533#>>>36 use cab-anchor 24534#>>>>&0 use cab-anchor 24535>>30 uleshort =0x0003 \b, previous 24536>>>36 string x %s 24537# optional name of previous disk szDisk* 24538>>>>&1 string x disk %s 24539>>>>>&1 string x \b, next %s 24540# optional name of previous disk szDisk* 24541>>>>>>&1 string x disk %s 24542>>>>>>>&1 use cab-folder 24543# display filename and disk name of previous or next cabinet 245440 name cab-anchor 24545# optional name of previous/next cabinet file szCabinet*[255] 24546>&0 string x %s 24547# optional name of previous/next disk szDisk*[255] 24548>>&1 string x disk %s 24549# display folder structure CFFOLDER information like compression of cabinet 245500 name cab-folder 24551# offset of the CFDATA block in this folder 24552#>0 ulelong x \b, coffCabStart 0x%x 24553# number of CFDATA blocks in folder 24554>4 uleshort x \b, %u datablock 24555# plural s 24556>4 uleshort >1 \bs 24557# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 24558>6 uleshort x \b, 0x%x compression 24559# optional per-folder reserved area 24560#>8 ubequad x \b, abReserve 0x%llx 24561# display member structure CFFILE information like member name of cabinet 245620 name cab-file 24563# cbFile is uncompressed size of file in bytes 24564#>0 ulelong x \b, cbFile %u 24565# uoffFolderStart is uncompressed offset of file in folder 24566#>4 ulelong >0 \b, uoffFolderStart 0x%x 24567# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 24568# define ifoldCONTINUED_FROM_PREV (0xFFFD) 24569# define ifoldCONTINUED_TO_NEXT (0xFFFE) 24570# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 24571>8 uleshort >0 \b, iFolder 0x%x 24572# date stamp for file 24573#>10 uleshort x \b, date 0x%x 24574# time stamp for file 24575#>12 uleshort x \b, time 0x%x 24576# attribs is attribute flags for file 24577# define _A_RDONLY (0x01) file is read-only 24578# define _A_HIDDEN (0x02) file is hidden 24579# define _A_SYSTEM (0x04) file is a system file 24580# define _A_ARCH (0x20) file modified since last backup 24581# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 24582# define _A_EXEC (0x40) run after extraction 24583# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 24584# define UNKNOWN (0x0100) undocumented or accident 24585#>14 uleshort x \b, attribs 0x%x 24586>14 uleshort >0 + 24587>>14 uleshort &0x0001 \bR 24588>>14 uleshort &0x0002 \bH 24589>>14 uleshort &0x0004 \bS 24590>>14 uleshort &0x0020 \bA 24591>>14 uleshort &0x0040 \bX 24592>>14 uleshort &0x0080 \bUtf 24593# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 24594>>14 uleshort &0x0100 \b? 24595# szName is name of archive member 24596>16 string x "%s" 24597# next archive member name if more files 24598#>>&17 string >\0 \b, NEXT NAME %-.50s 24599 24600# InstallShield Cabinet files 246010 string/b ISc( InstallShield Cabinet archive data 24602>5 byte&0xf0 =0x60 version 6, 24603>5 byte&0xf0 !0x60 version 4/5, 24604>(12.l+40) lelong x %u files 24605 24606# Windows CE package files 246070 string/b MSCE\0\0\0\0 Microsoft WinCE install header 24608>20 lelong 0 \b, architecture-independent 24609>20 lelong 103 \b, Hitachi SH3 24610>20 lelong 104 \b, Hitachi SH4 24611>20 lelong 0xA11 \b, StrongARM 24612>20 lelong 4000 \b, MIPS R4000 24613>20 lelong 10003 \b, Hitachi SH3 24614>20 lelong 10004 \b, Hitachi SH3E 24615>20 lelong 10005 \b, Hitachi SH4 24616>20 lelong 70001 \b, ARM 7TDMI 24617>52 leshort 1 \b, 1 file 24618>52 leshort >1 \b, %u files 24619>56 leshort 1 \b, 1 registry entry 24620>56 leshort >1 \b, %u registry entries 24621 24622 24623# Windows Enhanced Metafile (EMF) 24624# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 24625# for further information. 246260 ulelong 1 24627>40 string \ EMF Windows Enhanced Metafile (EMF) image data 24628>>44 ulelong x version 0x%x 24629 24630 246310 string/b \224\246\056 Microsoft Word Document 24632!:mime application/msword 24633 24634# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 24635# Magic type for Dell's BIOS .hdr files 24636# Dell's .hdr 246370 string/b $RBU 24638>23 string Dell %s system BIOS 24639>5 byte 2 24640>>48 byte x version %d. 24641>>49 byte x \b%d. 24642>>50 byte x \b%d 24643>5 byte <2 24644>>48 string x version %.3s 24645 24646# Type: Microsoft Document Imaging Format (.mdi) 24647# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 24648# From: Daniele Sempione <scrows@oziosi.org> 24649# Too weak (EP) 24650#0 short 0x5045 Microsoft Document Imaging Format 24651 24652# MS eBook format (.lit) 246530 string/b ITOLITLS Microsoft Reader eBook Data 24654>8 lelong x \b, version %u 24655!:mime application/x-ms-reader 24656 24657# Windows CE Binary Image Data Format 24658# From: Dr. Jesus <j@hug.gs> 246590 string/b B000FF\n Windows Embedded CE binary image 24660 24661# The second byte of these signatures is a file version; I don't know what, 24662# if anything, produced files with version numbers 0-2. 24663# From: John Elliott <johne@seasip.demon.co.uk> 246640 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 246650 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 246660 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 246670 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 24668 246690 string MIOPEN Mallard BASIC Jetsam data 246700 string Jetsam0 Mallard BASIC Jetsam index data 24671 24672# DOS backup 2.0 to 3.2 24673 24674# backupid.@@@ 24675 24676# plausibility check for date 246770x3 ushort >1979 24678>0x5 ubyte-1 <31 24679>>0x6 ubyte-1 <12 24680# actually 121 nul bytes 24681>>>0x7 string \0\0\0\0\0\0\0\0 24682>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 24683!:ext @@@ 24684>>>>0x0 ubyte 0xff \b, last disk 24685 24686# backed up file 24687 24688# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 24689# by looking for trailing nul of maximal file name string 246900x52 ubyte 0 24691# test for flag byte: FFh~complete file, 00h~split file 24692# FFh -127 = -1 -127 = -128 24693# 00h -127 = 0 -127 = -127 24694>0 byte-127 <-126 24695# plausibility check for file name length 24696>>0x53 ubyte-1 <78 24697# looking for terminating nul of file name string 24698>>>(0x53.b+4) ubyte 0 24699# looking if last char of string is valid DOS file name 24700>>>>(0x53.b+3) ubyte >0x1F 24701# actually 44 nul bytes 24702# but sometimes garbage according to Ralf Quint. So can not be used as test 24703#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 24704# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 24705# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 24706>>>>>5 ubyte&0x8C 0x0C 24707# ./msdos (version 5.30) labeled the entry as 24708# "DOS 2.0 backed up file %s, split file, sequence %d" or 24709# "DOS 2.0 backed up file %s, complete file" 24710>>>>>>0 ubyte x DOS 2.0-3.2 backed up 24711#>>>>>>0 ubyte 0xff complete 24712>>>>>>0 ubyte 0 24713>>>>>>>1 uleshort x sequence %d of 24714# full file name with path but without drive letter and colon stored from 0x05 til 0x52 24715>>>>>>0x5 string x file %s 24716# backup name is original filename 24717#!:ext * 24718# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 24719# file: line 1169: Bad magic entry ' *' 24720# after header original file content 24721>>>>>>128 indirect x \b;\040 24722 24723 24724# DOS backup 3.3 to 5.x 24725 24726# CONTROL.nnn files 247270 string \x8bBACKUP\x20 24728# actually 128 nul bytes 24729>0xa string \0\0\0\0\0\0\0\0 24730>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 24731>>0x8a ubyte 0xff \b, last disk 24732 24733# NB: The BACKUP.nnn files consist of the files backed up, 24734# concatenated. 24735 24736#------------------------------------------------------------------------------ 24737# $File: msooxml,v 1.15 2020/09/05 22:59:14 christos Exp $ 24738# msooxml: file(1) magic for Microsoft Office XML 24739# From: Ralf Brown <ralf.brown@gmail.com> 24740 24741# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 24742# archive. The first member file is normally "[Content_Types].xml". 24743# but some libreoffice generated files put this later. Perhaps skip 24744# the "[Content_Types].xml" test? 24745# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 24746# file of ePub or OpenDocument, we'll have to scan for a filename 24747# which can distinguish between the three types 24748 247490 name msooxml 24750>0 string word/ Microsoft Word 2007+ 24751!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 24752>0 string ppt/ Microsoft PowerPoint 2007+ 24753!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 24754>0 string xl/ Microsoft Excel 2007+ 24755!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 24756>0 string visio/ Microsoft Visio 2013+ 24757!:mime application/vnd.ms-visio.drawing.main+xml 24758 24759# start by checking for ZIP local file header signature 247600 string PK\003\004 24761!:strength +10 24762# make sure the first file is correct 24763>0x1E use msooxml 24764>0x1E default x 24765>>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps 24766# skip to the second local file header 24767# since some documents include a 520-byte extra field following the file 24768# header, we need to scan for the next header 24769>>>(18.l+49) search/6000 PK\003\004 24770# now skip to the *third* local file header; again, we need to scan due to a 24771# 520-byte extra field following the file header 24772>>>>&26 search/6000 PK\003\004 24773# and check the subdirectory name to determine which type of OOXML 24774# file we have. Correct the mimetype with the registered ones: 24775# https://technet.microsoft.com/en-us/library/cc179224.aspx 24776>>>>>&26 use msooxml 24777>>>>>&26 default x 24778# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file 24779>>>>>>&26 search/6000 PK\003\004 24780>>>>>>>&26 use msooxml 24781>>>>>>>&26 default x Microsoft OOXML 24782>>>>>&26 default x Microsoft OOXML 24783 24784#------------------------------------------------------------------------------ 24785# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $ 24786# msvc: file(1) magic for msvc 24787# "H. Nanosecond" <aldomel@ix.netcom.com> 24788# Microsoft visual C 24789# 24790# I have version 1.0 24791 24792# .aps 247930 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 24794 24795# .ide 24796#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 247970 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 24798 24799# .res 248000 string \000\000\000\000\040\000\000\000\377 MSVC .res 248010 string \377\003\000\377\001\000\020\020\350 MSVC .res 248020 string \377\003\000\377\001\000\060\020\350 MSVC .res 24803 24804#.lib 248050 string \360\015\000\000 Microsoft Visual C library 248060 string \360\075\000\000 Microsoft Visual C library 248070 string \360\175\000\000 Microsoft Visual C library 24808 24809#.pch 248100 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 24811 24812# Summary: Symbol Table / Debug info used by Microsoft compilers 24813# URL: https://en.wikipedia.org/wiki/Program_database 24814# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 24815# Update: Joerg Jenderek 24816# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 24817# info does only applies partly for older files like msvbvm50.pdb about year 2001 248180 string Microsoft\ C/C++\040 24819# "Microsoft Program DataBase" by TrID 24820>24 search/14 \r\n\x1A MSVC program database 24821!:mime application/x-ms-pdb 24822!:ext pdb 24823# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 24824>>16 regex \([0-9.]+\) ver %s 24825#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 24826# "MSF 7.00" variant 24827>>0x1e leshort 0 24828# PageSize 400h 1000h 24829>>>0x20 lelong x \b, %d 24830# Page Count 24831>>>0x28 lelong x \b*%d bytes 24832# "program database 2.00" variant 24833>>0x1e leshort !0 24834# PageSize 400h 24835>>>0x2c lelong x \b, %d 24836# Page Count for msoo-dll.pdb 4379h 24837>>>0x32 leshort x \b*%d bytes 24838 24839# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d 248400 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Roslyn C# debugging symbols version 1.0 24841 24842#.sbr 248430 string \000\002\000\007\000 MSVC .sbr 24844>5 string >\0 %s 24845 24846#.bsc 248470 string \002\000\002\001 MSVC .bsc 24848 24849#.wsp 248500 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 24851# these seem to start with the version and contain menus 24852 24853#------------------------------------------------------------------------------ 24854# msx: file(1) magic for the MSX Home Computer 24855# v1.3 24856# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 24857 24858############## MSX Music file formats ############## 24859 24860# Gigamix MGSDRV music file 248610 string/b MGS MSX Gigamix MGSDRV3 music file, 24862>6 ubeshort 0x0D0A 24863>>3 byte x \bv%c 24864>>4 byte x \b.%c 24865>>5 byte x \b%c 24866>>8 string >\0 \b, title: %s 24867 248681 string/b mgs2\ MSX Gigamix MGSDRV2 music file 24869>6 uleshort 0x80 24870>>0x2E uleshort 0 24871>>>0x30 string >\0 \b, title: %s 24872 24873# KSS music file 248740 string/b KSCC KSS music file v1.03 24875>0xE byte 0 24876>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 24877>>0xF byte&0x02 2 \b, soundchip(s): SN76489 24878>>>0xF byte&0x04 4 stereo 24879>>0xF byte&0x01 1 \b, YM2413 24880>>0xF byte&0x08 8 \b, Y8950 24881 248820 string/b KSSX KSS music file v1.20 24883>0xE byte&0xEF 0 24884>>0xF byte&0x40 0x00 \b, 60Hz 24885>>0xF byte&0x40 0x40 \b, 50Hz 24886>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 24887>>0xF byte&0x02 0x02 \b, soundchips: SN76489 24888>>>0xF byte&0x04 0x04 stereo 24889>>0xF byte&0x01 0x01 \b, 24890>>>0xF byte&0x18 0x00 \bYM2413 24891>>>0xF byte&0x18 0x08 \bYM2413, Y8950 24892>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 24893>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 24894 24895# Moonblaster for Moonsound 248960 string/b MBMS 24897>4 byte 0x10 MSX Moonblaster for MoonSound music 24898 24899# Music Player K-kaz 249000 string/b MPK MSX Music Player K-kaz song 24901>6 ubeshort 0x0D0A 24902>>3 byte x v%c 24903>>4 byte x \b.%c 24904>>5 byte x \b%c 24905 24906# I don't know why these don't work 24907#0 search/0xFFFF \r\n.FM9 24908#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 24909#0 search/0xFFFF \r\nFM1\ \= 24910#>0 search/0xFFFF \r\nPSG1\= 24911#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 24912 24913# OPX Music file 249140x35 beshort 0x0d0a 24915>0x7B beshort 0x0d0a 24916>>0x7D byte 0x1a 24917>>>0x87 uleshort 0 MSX OPX Music file 24918>>>>0x86 byte 0 v1.5 24919>>>>>0 string >\32 \b, title: %s 24920>>>>0x86 byte 1 v2.4 24921>>>>>0 string >\32 \b, title: %s 24922 24923# SCMD music file 249240x8B string/b SCMD 24925>0xCE uleshort 0 MSX SCMD Music file 24926#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 24927>>0x8F string >\0 \b, title: %s 24928 249290 search/0xFFFF \r\n@title 24930>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 24931 24932 24933############## MSX image file formats ############## 24934 24935# MSX raw VRAM dump 249360 ubyte 0xFE 24937>1 uleshort 0 24938>>5 uleshort 0 24939>>>3 uleshort 0x37FF MSX SC2/GRP raw image 24940>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 24941>>>3 uleshort >0x769E 24942>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 24943>>>>>3 uleshort 0x7FFF \b, with sprite patterns 24944>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 24945>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 24946 24947# Graph Saurus compressed images 249480 ubyte 0xFD 24949>1 uleshort 0 24950>>5 uleshort 0 24951>>>3 uleshort >0x013D MSX Graph Saurus compressed image 24952 24953# MSX G9B image file 249540 string/b G9B 24955>1 uleshort 11 24956>>3 uleshort >10 24957>>>5 ubyte >0 MSX G9B image, depth=%d 24958>>>>8 uleshort x \b, %dx 24959>>>>10 uleshort x \b%d 24960>>>>5 ubyte <9 24961>>>>>6 ubyte 0 24962>>>>>>7 ubyte x \b, codec=%d RGB color palettes 24963>>>>>6 ubyte 64 \b, codec=RGB fixed color 24964>>>>>6 ubyte 128 \b, codec=YJK 24965>>>>>6 ubyte 192 \b, codec=YUV 24966>>>>5 ubyte >8 codec=RGB fixed color 24967>>>>12 ubyte 0 \b, raw 24968>>>>12 ubyte 1 \b, bitbuster compression 24969 24970############## Other MSX file formats ############## 24971 24972# MSX internal ROMs 249730 ubeshort 0xF3C3 24974>2 uleshort <0x4000 24975>>8 ubyte 0xC3 24976>>>9 uleshort <0x4000 24977>>>>0x0B ubeshort 0x00C3 24978>>>>>0x0D uleshort <0x4000 24979>>>>>>0x0F ubeshort 0x00C3 24980>>>>>>>0x11 uleshort <0x4000 24981>>>>>>>>0x13 ubeshort 0x00C3 24982>>>>>>>>>0x15 uleshort <0x4000 24983>>>>>>>>>>0x50 ubyte 0xC3 24984>>>>>>>>>>>0x51 uleshort <0x4000 24985>>>>>>>>>>>>(9.s) ubyte 0xC3 24986>>>>>>>>>>>>>&0 uleshort >0x4000 24987>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC 24988>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d 24989>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+ 24990>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R 24991>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version 24992>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x 24993>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x 24994>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese 24995>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International 24996>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean 24997>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d 24998>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D 24999>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y 25000>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y 25001>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz 25002>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz 25003>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese 25004>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International 25005>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French 25006>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK 25007>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German 25008>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d 25009>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish 25010>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d 25011>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese 25012>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International 25013>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d 25014>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI 25015 25016 250170 string/b CD 25018>2 uleshort >0x10 25019>>2 uleshort <0x4000 25020>>>4 uleshort <0x4000 25021>>>>6 uleshort <0x4000 25022>>>>>8 ubyte 0xC3 25023>>>>>>9 uleshort <0x4000 25024>>>>>>>0x10 ubyte 0xC3 25025>>>>>>>>0x11 uleshort <0x4000 25026>>>>>>>>>0x14 ubyte 0xC3 25027>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM 25028 250290 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 25030>0x5F0 ubequad 0x8282828244380000 25031>>0x150 ubyte 0x38 25032>>>0x170 string \20\20\20 25033>>>>0x1E32 string ()) 25034>>>>>0x2130 ubequad 0xA5A5594924231807 25035>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font 25036 25037 25038 25039# MSX extension ROMs 250400 string/b AB 25041>2 uleshort 0x0010 MSX ROM 25042>>2 uleshort x \b, init=0x%4x 25043>>4 uleshort >0 \b, stahdl=0x%4x 25044>>6 uleshort >0 \b, devhdl=0x%4x 25045>>8 uleshort >0 \b, bas=0x%4x 25046>2 uleshort 0x4010 MSX ROM 25047>>2 uleshort x \b, init=0x%04x 25048>>4 uleshort >0 \b, stahdl=0x%04x 25049>>6 uleshort >0 \b, devhdl=0x%04x 25050>>8 uleshort >0 \b, bas=0x%04x 25051>2 uleshort 0x8010 MSX ROM 25052>>2 uleshort x \b, init=0x%04x 25053>>4 uleshort >0 \b, stahdl=0x%04x 25054>>6 uleshort >0 \b, devhdl=0x%04x 25055>>8 uleshort >0 \b, bas=0x%04x 250560 string/b AB\0\0 25057>6 uleshort 0 25058>>4 uleshort >0x400F MSX-BASIC extension ROM 25059>>>4 uleshort >0 \b, stahdl=0x%04x 25060>>>6 uleshort >0 \b, devhdl=0x%04x 25061>>>0x1C string OPLL \b, MSX-Music 25062>>>>0x18 string PAC2 \b (external) 25063>>>>0x18 string APRL \b (internal) 25064 250650 string/b AB\0\0\0\0 25066>6 uleshort >0x400F MSX device BIOS 25067>>6 uleshort >0 \b, devhdl=0x%04x 25068 25069 250700 string/b AB 25071#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 25072#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 25073#>3 string @3\x80IA862 Golvellius MSX1 ROM 25074>2 uleshort >15 25075>>2 uleshort <0xC000 25076>>>8 string \0\0\0\0\0\0\0\0 25077>>>>(2.s&0x3FFF) uleshort >0 MSX ROM 25078>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 25079>>>>>0x10 string CD \b, Konami RC- 25080>>>>>>0x12 ubyte x \b%d 25081>>>>>>0x13 ubyte/16 x \b%d 25082>>>>>>0x13 ubyte&0xF x \b%d 25083>>>>>0x10 string EF \b, Konami RC- 25084>>>>>>0x12 ubyte x \b%d 25085>>>>>>0x13 ubyte/16 x \b%d 25086>>>>>>0x13 ubyte&0xF x \b%d 25087>>>>>2 uleshort x \b, init=0x%04x 25088>>>>>4 uleshort >0 \b, stahdl=0x%04x 25089>>>>>6 uleshort >0 \b, devhdl=0x%04x 25090>>>>>8 uleshort >0 \b, bas=0x%04x 25091>>>2 uleshort 0 25092>>>>4 uleshort 0 25093>>>>>6 uleshort 0 25094>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 25095 250960x4000 string/b AB 25097>0x4002 uleshort >0x400F 25098>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 25099>>>0x4002 uleshort x \b, init=0x%04x 25100>>>0x4004 uleshort >0 \b, stahdl=0x%04x 25101>>>0x4006 uleshort >0 \b, devhdl=0x%04x 25102>>>0x4008 uleshort >0 \b, bas=0x%04x 25103 251040x8000 string/b AB 25105>0x8002 uleshort >0x400F 25106>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 25107>>>0x8002 uleshort x \b, init=0x%04x 25108>>>0x8004 uleshort >0 \b, stahdl=0x%04x 25109>>>0x8006 uleshort >0 \b, devhdl=0x%04x 25110>>>0x8008 uleshort >0 \b, bas=0x%04x 25111 25112 251130x3C000 string/b AB 25114>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 25115>>0x3C002 uleshort x \b, init=0x%04x 25116>>0x3C004 uleshort >0 \b, stahdl=0x%04x 25117>>0x3C006 uleshort >0 \b, devhdl=0x%04x 25118>>0x3C008 uleshort >0 \b, bas=0x%04x 25119 25120# MSX BIN file 25121#0 byte 0xFE 25122#>1 uleshort >0x8000 25123#>>3 uleshort >0x8004 25124#>>>5 uleshort >0x8000 MSX BIN file 25125 25126# MSX-BASIC file 251270 byte 0xFF 25128>3 uleshort 0x000A 25129>>1 uleshort >0x8000 MSX-BASIC program 25130 25131# MSX .CAS file 251320 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 25133 25134# Mega-Assembler file 251350 byte 0xFE 25136>1 uleshort 0x0001 25137>>5 uleshort 0xffff 25138>>>6 byte 0x0A MSX Mega-Assembler source 25139 25140# Execrom Patchfile 251410 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 25142>0x12 ubyte/16 x v%d 25143>0x12 ubyte&0xF x \b.%d 25144>0x13 ubyte x \b, contains %d patches 25145 25146# Konami's King's Valley-2 custom stage (ELG file) 251474 uleshort 0x0900 25148>0xF byte 1 25149>>0x14 byte 0 25150>>>0x1E string \040\040\040 25151>>>>0x23 byte 1 25152>>>>>0x25 byte 0 25153>>>>>>0x15 string >\x30 25154>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 25155>>>>>>>>0x1D byte <32 \b, theme: %d 25156 25157# Metal Gear 1 savegame 25158#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 25159#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 25160#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 25161 25162# ------------------------------------------------------------------------ 25163# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $ 25164# mup: file(1) magic for Mup (Music Publisher) input file. 25165# 25166# From: Abel Cheung <abel (@) oaka.org> 25167# 25168# NOTE: This header is mainly proposed in the Arkkra mailing list, 25169# and is not a mandatory header because of old mup input file 25170# compatibility. Noteedit also use mup format, but is not forcing 25171# user to use any header as well. 25172# 251730 search/1 //!Mup Mup music publication program input text 25174>6 string -Arkkra (Arkkra) 25175>>13 string - 25176>>>16 string . 25177>>>>14 string x \b, need V%.4s 25178>>>15 string . 25179>>>>14 string x \b, need V%.3s 25180>6 string - 25181>>9 string . 25182>>>7 string x \b, need V%.4s 25183>>8 string . 25184>>>7 string x \b, need V%.3s 25185#------------------------------------------------------------------------------ 25186# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 25187# music: file (1) magic for music formats 25188 25189# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 25190# and Bagpipe Writer by Doug Wickstrom 25191# 251920 string Bagpipe Bagpipe 25193>8 string Reader Reader 25194>>15 string >\0 (version %.3s) 25195>8 string Music\ Writer Music Writer 25196>>20 string : 25197>>>21 string >\0 (version %.3s) 25198>>21 string Gold Gold 25199>>>25 string : 25200>>>>26 string >\0 (version %.3s) 25201 25202 25203#------------------------------------------------------------------------------ 25204# nasa: file(1) magic 25205 25206# From: Barry Carter <carter.barry@gmail.com> 252070 string DAF/SPK NASA SPICE file (binary format) 252080 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format) 25209 25210#----------------------------------------------------------------------------- 25211# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $ 25212# natinst: file(1) magic for National Instruments Code Files 25213 25214# 25215# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 25216# version 1 25217# Many formats still missing, we use, for the moment LabVIEW 25218# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 25219# 252200 string RSRC National Instruments, 25221# Check if it's a LabVIEW File 25222>8 string LV LabVIEW File, 25223# Check which kind of file it is 25224>>10 string SB Code Resource File, data 25225>>10 string IN Virtual Instrument Program, data 25226>>10 string AR VI Library, data 25227# This is for Menu Libraries 25228>8 string LMNULBVW Portable File Names, data 25229# This is for General Resources 25230>8 string rsc Resources File, data 25231# This is for VXI Package 252320 string VMAP National Instruments, VXI File, data 25233 25234#------------------------------------------------------------------------------ 25235# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $ 25236# ncr: file(1) magic for NCR Tower objects 25237# 25238# contributed by 25239# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 25240# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 25241# 252420 beshort 000610 Tower/XP rel 2 object 25243>12 belong >0 not stripped 25244>20 beshort 0407 executable 25245>20 beshort 0410 pure executable 25246>22 beshort >0 - version %d 252470 beshort 000615 Tower/XP rel 2 object 25248>12 belong >0 not stripped 25249>20 beshort 0407 executable 25250>20 beshort 0410 pure executable 25251>22 beshort >0 - version %d 252520 beshort 000620 Tower/XP rel 3 object 25253>12 belong >0 not stripped 25254>20 beshort 0407 executable 25255>20 beshort 0410 pure executable 25256>22 beshort >0 - version %d 252570 beshort 000625 Tower/XP rel 3 object 25258>12 belong >0 not stripped 25259>20 beshort 0407 executable 25260>20 beshort 0410 pure executable 25261>22 beshort >0 - version %d 252620 beshort 000630 Tower32/600/400 68020 object 25263>12 belong >0 not stripped 25264>20 beshort 0407 executable 25265>20 beshort 0410 pure executable 25266>22 beshort >0 - version %d 252670 beshort 000640 Tower32/800 68020 25268>18 beshort &020000 w/68881 object 25269>18 beshort &040000 compatible object 25270>18 beshort &060000 object 25271>20 beshort 0407 executable 25272>20 beshort 0413 pure executable 25273>12 belong >0 not stripped 25274>22 beshort >0 - version %d 252750 beshort 000645 Tower32/800 68010 25276>18 beshort &040000 compatible object 25277>18 beshort &060000 object 25278>20 beshort 0407 executable 25279>20 beshort 0413 pure executable 25280>12 belong >0 not stripped 25281>22 beshort >0 - version %d 25282 25283#------------------------------------------------------------ 25284# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $ 25285 25286# From: Mikhail Gusarov <dottedmag@dottedmag.net> 25287# NekoVM (https://nekovm.org/) bytecode 252880 string NEKO NekoVM bytecode 25289>4 lelong x (%d global symbols, 25290>8 lelong x %d global fields, 25291>12 lelong x %d bytecode ops) 25292!:mime application/x-nekovm-bytecode 25293 25294 25295#------------------------------------------------------------------------------ 25296# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $ 25297# netbsd: file(1) magic for NetBSD objects 25298# 25299# All new-style magic numbers are in network byte order. 25300# The old-style magic numbers are indistinguishable from the same magic 25301# numbers used in other systems, and are handled, for all those systems, 25302# in aout. 25303# 25304 253050 name netbsd-detail 25306>20 lelong x @%#x 25307>4 lelong >0 \b+T=%d 25308>8 lelong >0 \b+D=%d 25309>12 lelong >0 \b+B=%d 25310>16 lelong >0 \b+S=%d 25311>24 lelong >0 \b+TR=%d 25312>28 lelong >0 \b+TD=%d 25313 253140 name netbsd-4096 25315>0 byte &0x80 25316>>20 lelong <4096 shared library 25317>>20 lelong =4096 dynamically linked executable 25318>>20 lelong >4096 dynamically linked executable 25319>0 byte ^0x80 executable 25320>16 lelong >0 not stripped 25321 253220 name netbsd-8192 25323>0 byte &0x80 25324>>20 lelong <8192 shared library 25325>>20 lelong =8192 dynamically linked executable 25326>>20 lelong >8192 dynamically linked executable 25327>0 byte ^0x80 executable 25328>16 lelong >0 not stripped 25329>0 use netbsd-detail 25330 253310 name netbsd-normal 25332>0 byte &0x80 dynamically linked executable 25333>0 byte ^0x80 25334>>0 byte &0x40 position independent 25335>>20 lelong !0 executable 25336>>20 lelong =0 object file 25337>16 lelong >0 not stripped 25338>0 use netbsd-detail 25339 253400 name netbsd-pure 25341>0 byte &0x80 dynamically linked executable 25342>0 byte ^0x80 executable 25343>16 lelong >0 not stripped 25344>0 use netbsd-detail 25345 253460 name netbsd-core 25347>12 string >\0 from '%s' 25348>32 lelong !0 (signal %d) 25349 253500 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 25351>0 use netbsd-4096 25352 253530 belong&0377777777 041400410 a.out NetBSD/i386 pure 25354>0 use netbsd-pure 25355 253560 belong&0377777777 041400407 a.out NetBSD/i386 25357>0 use netbsd-normal 25358 253590 belong&0377777777 041400507 a.out NetBSD/i386 core 25360>0 use netbsd-core 25361 253620 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 25363>0 use \^netbsd-8192 25364 253650 belong&0377777777 041600410 a.out NetBSD/m68k pure 25366>0 use \^netbsd-pure 25367 253680 belong&0377777777 041600407 a.out NetBSD/m68k 25369>0 use \^netbsd-normal 25370 253710 belong&0377777777 041600507 a.out NetBSD/m68k core 25372>0 use \^netbsd-core 25373 253740 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 25375>0 use \^netbsd-4096 25376 253770 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 25378>0 use \^netbsd-pure 25379 253800 belong&0377777777 042000407 a.out NetBSD/m68k4k 25381>0 use \^netbsd-normal 25382 253830 belong&0377777777 042000507 a.out NetBSD/m68k4k core 25384>0 use \^netbsd-core 25385 253860 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 25387>0 use netbsd-4096 25388 253890 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 25390>0 use netbsd-pure 25391 253920 belong&0377777777 042200407 a.out NetBSD/ns32532 25393>0 use netbsd-normal 25394 253950 belong&0377777777 042200507 a.out NetBSD/ns32532 core 25396>0 use netbsd-core 25397 253980 belong&0377777777 045200507 a.out NetBSD/powerpc core 25399>0 use netbsd-core 25400 254010 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 25402>0 use \^netbsd-8192 25403 254040 belong&0377777777 042400410 a.out NetBSD/SPARC pure 25405>0 use \^netbsd-pure 25406 254070 belong&0377777777 042400407 a.out NetBSD/SPARC 25408>0 use \^netbsd-normal 25409 254100 belong&0377777777 042400507 a.out NetBSD/SPARC core 25411>0 use \^netbsd-core 25412 254130 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 25414>0 use netbsd-4096 25415 254160 belong&0377777777 042600410 a.out NetBSD/pmax pure 25417>0 use \^netbsd-pure 25418 254190 belong&0377777777 042600407 a.out NetBSD/pmax 25420>0 use netbsd-normal 25421 254220 belong&0377777777 042600507 a.out NetBSD/pmax core 25423>0 use netbsd-core 25424 254250 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 25426>0 use netbsd-4096 25427 254280 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 25429>0 use netbsd-pure 25430 254310 belong&0377777777 043000407 a.out NetBSD/vax 1k 25432>0 use netbsd-normal 25433 254340 belong&0377777777 043000507 a.out NetBSD/vax 1k core 25435>0 use netbsd-core 25436 254370 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 25438>0 use netbsd-4096 25439 254400 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 25441>0 use netbsd-pure 25442 254430 belong&0377777777 045400407 a.out NetBSD/vax 4k 25444>0 use netbsd-normal 25445 254460 belong&0377777777 045400507 a.out NetBSD/vax 4k core 25447>0 use netbsd-core 25448 25449# NetBSD/alpha does not support (and has never supported) a.out objects, 25450# so no rules are provided for them. NetBSD/alpha ELF objects are 25451# dealt with in "elf". 254520 lelong 0x00070185 ECOFF NetBSD/alpha binary 25453>10 leshort 0x0001 not stripped 25454>10 leshort 0x0000 stripped 254550 belong&0377777777 043200507 a.out NetBSD/alpha core 25456>12 string >\0 from '%s' 25457>32 lelong !0 (signal %d) 25458 254590 belong&0377777777 043400413 a.out NetBSD/mips demand paged 25460>0 use \^netbsd-8192 25461 25462>16 belong >0 not stripped 254630 belong&0377777777 043400410 a.out NetBSD/mips pure 25464>0 use netbsd-pure 25465 254660 belong&0377777777 043400407 a.out NetBSD/mips 25467>0 use netbsd-normal 25468 254690 belong&0377777777 043400507 a.out NetBSD/mips core 25470>0 use netbsd-core 25471 254720 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 25473>0 use netbsd-4096 25474 254750 belong&0377777777 043600410 a.out NetBSD/arm32 pure 25476>0 use netbsd-pure 25477 254780 belong&0377777777 043600407 a.out NetBSD/arm32 25479>0 use netbsd-normal 25480 25481# NetBSD/arm26 has always used ELF objects, but it shares a core file 25482# format with NetBSD/arm32. 254830 belong&0377777777 043600507 a.out NetBSD/arm core 25484>0 use netbsd-core 25485 25486# Kernel core dump format 254870 belong&0x0000ffff 0x00008fca NetBSD kernel core file 25488>0 belong&0x03ff0000 0x00000000 \b, Unknown 25489>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 25490>0 belong&0x03ff0000 0x00020000 \b, sun 68020 25491>0 belong&0x03ff0000 0x00640000 \b, 386 PC 25492>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 25493>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 25494>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 25495>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 25496>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 25497>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 25498>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 25499>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 25500>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 25501>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 25502>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 25503>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 25504>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 25505>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 25506>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 25507>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 25508>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 25509>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 25510>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 25511>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 25512>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 25513>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 25514>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 25515>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 25516>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 25517>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 25518>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 25519>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 25520>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 25521>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 25522>0 belong&0xfc000000 0x04000000 \b, CPU 25523>0 belong&0xfc000000 0x08000000 \b, DATA 25524>0 belong&0xfc000000 0x10000000 \b, STACK 25525>4 leshort x \b, (headersize = %d 25526>6 leshort x \b, segmentsize = %d 25527>8 lelong x \b, segments = %d) 25528 25529# little endian only for now. 255300 name ktrace 25531>4 leshort 7 25532>>6 leshort <3 NetBSD ktrace file version %d 25533>>>12 string x from %s 25534>>>56 string x \b, emulation %s 25535>>>8 lelong <65536 \b, pid=%d 25536 2553756 string netbsd 25538>0 use ktrace 2553956 string linux 25540>0 use ktrace 2554156 string sunos 25542>0 use ktrace 2554356 string hpux 25544>0 use ktrace 25545 25546#------------------------------------------------------------------------------ 25547# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $ 25548# netscape: file(1) magic for Netscape files 25549# "H. Nanosecond" <aldomel@ix.netcom.com> 25550# version 3 and 4 I think 25551# 25552 25553# Netscape Address book .nab 255540 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 25555 25556# Netscape Communicator address book 255570 string \000\017\102\111 Netscape Communicator address book 25558 25559# .snm Caches 255600 string #\ Netscape\ folder\ cache Netscape folder cache 255610 string \000\036\204\220\000 Netscape folder cache 25562# .n2p 25563# Net 2 Phone 25564#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 255650 string SX961999 Net2phone 25566 25567# 25568#This is files ending in .art, FIXME add more rules 255690 string JG\004\016\0\0\0\0 AOL ART image 255700 string JG\003\016\0\0\0\0 AOL ART image 25571 25572#------------------------------------------------------------------------------ 25573# $File: netware,v 1.5 2020/09/04 16:30:51 christos Exp $ 25574# netware: file(1) magic for NetWare Loadable Modules (NLMs) 25575# From: Mads Martin Joergensen <mmj@suse.de> 25576# URL: https://en.wikipedia.org/wiki/NetWare_Loadable_Module 25577 255780 string NetWare\ Loadable\ Module NetWare Loadable Module 25579#!:mime application/octet-stream 25580!:ext nlm 25581 25582 25583#------------------------------------------------------------------------------ 25584# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 25585# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 25586# 255870 string StartFontMetrics ASCII font metrics 255880 string StartFont ASCII font bits 255890 belong 0x137A2944 NeWS bitmap font 255900 belong 0x137A2947 NeWS font family 255910 belong 0x137A2950 scalable OpenFont binary 255920 belong 0x137A2951 encrypted scalable OpenFont binary 255938 belong 0x137A2B45 X11/NeWS bitmap font 255948 belong 0x137A2B48 X11/NeWS font family 25595 25596#------------------------------------------------------------------------------ 25597# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $ 25598# nitpicker: file(1) magic for Flowfiles. 25599# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de 256000 string NPFF NItpicker Flow File 25601>4 byte x V%d. 25602>5 byte x %d 25603>6 bedate x started: %s 25604>10 bedate x stopped: %s 25605>14 belong x Bytes: %u 25606>18 belong x Bytes1: %u 25607>22 belong x Flows: %u 25608>26 belong x Pkts: %u 25609 25610#------------------------------------------------------------------------------ 25611# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $ 25612# numpy: file(1) magic for NumPy array binary serialization format 25613# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html 256140 string \x93NUMPY NumPy array, 25615>6 ubyte x version %d 25616>7 ubyte x \b.%d, 25617>8 uleshort x header length %d 25618 25619#------------------------------------------------------------------------------ 25620# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $ 25621# OASIS 25622# Summary: OASIS stream file 25623# Long description: Open Artwork System Interchange Standard 25624# File extension: .oas 25625# Full name: Ben Cowley (bcowley@broadcom.com) 25626# Philip Dixon (pdixon@broadcom.com) 25627# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 25628# (see page 3) 256290 string %SEMI-OASIS\r\n OASIS Stream file 25630 25631#------------------------------------------------------------------------------ 25632# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 25633# ocaml: file(1) magic for Objective Caml files. 256340 string Caml1999 OCaml 25635>8 string X exec file 25636>8 string I interface file (.cmi) 25637>8 string O object file (.cmo) 25638>8 string A library file (.cma) 25639>8 string Y native object file (.cmx) 25640>8 string Z native library file (.cmxa) 25641>8 string M abstract syntax tree implementation file 25642>8 string N abstract syntax tree interface file 25643>9 string >\0 (Version %3.3s) 25644 25645#------------------------------------------------------------------------------ 25646# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 25647# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 256480 string Octave-1-L Octave binary data (little endian) 256490 string Octave-1-B Octave binary data (big endian) 25650 25651#------------------------------------------------------------------------------ 25652# $File: ole2compounddocs,v 1.10 2021/02/23 00:51:10 christos Exp $ 25653# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 25654# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 25655# Additional tests for OLE 2 Compound Documents should be under this recipe. 25656# reference: https://www.openoffice.org/sc/compdocfileformat.pdf 25657 256580 string \320\317\021\340\241\261\032\341 25659# https://digital-preservation.github.io/droid/ 25660# skip droid skeleton like fmt-39-signature-id-128.doc by valid version 25661>0x1A ushort !0xABAB OLE 2 Compound Document 25662#>0x1C uleshort x \b, endnian 0x%4.4x 25663# big endian not tested 25664>>0x1C ubeshort =0xfffe \b, big-endian 25665>>>546 string jbjb : Microsoft Word Document 25666!:mime application/msword 25667!:apple MSWDWDBN 25668!:ext doc 25669# Byte Order 0xFFFE means little-endian found in real world applications 25670#>>0x1C uleshort =0xfffe \b, little-endian 25671>>0x1C uleshort =0xfffe 25672# From: Joerg Jenderek 25673# Major Version 3 or 4 25674>>>0x1A uleshort x \b, v%u 25675# Minor Version 32h=50 3Bh=59 3Eh=62 25676>>>0x18 uleshort x \b.%u 25677# SecID of first sector of the directory stream is often 1 but high like 3144h 25678>>>48 ulelong x \b, SecID 0x%x 25679# Sector Shift Exponent in short-stream container stream: 6~64 bytes 25680>>>32 uleshort !6 \b, exponent of short stream %u 25681# total number of sectors used for the FAT 25682>>>44 ulelong >1 \b, %u FAT sectors 25683# SecID of first sector of the short-sector allocation table (Mini FAT) 25684# or -2 (End Of ChainSecID) if not extant 25685>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector 0x%x 25686# total number of sectors used for the short-sector allocation table 25687>>>64 ulelong !1 \b, %u Mini FAT sector 25688# plural s 25689>>>>64 ulelong >1 \bs 25690# SecID of first sector of the master sector allocation table (DIFAT) 25691# or -2 (End Of Chain SecID) if no additional sectors used 25692>>>68 ulelong !0xffFFffFE \b, DIFAT start sector 0x%x 25693# total number of sectors used for the master sector allocation table (DIFAT) 25694>>>72 ulelong >0 \b, %u DIFAT sectors 25695# First part of the master sector allocation table (DIFAT) containing 109 SecIDs 25696#>>>76 ubequad x \b, DIFAT=0x%16.16llx 25697#>>>84 ubequad x \b%16.16llx... 25698# pointer to root entry only works with standard configuration for SecID ~< 800h 25699# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls 25700# "ORLEN Factbook 2017.xls" XnView_metadata.doc 25701# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized 25702>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB 25703# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 25704>>>0x1E uleshort 0xc \b, blocksize 4096 25705# jump to one block (4096 bytes per block) before root storage block 25706>>>>(48.l*4096) ubyte x 25707>>>>>&4095 use ole2-directory 25708#>>>0x1E uleshort 9 \b, blocksize 512 25709>>>0x1E uleshort 9 25710# jump to one block (512 bytes per block) before root storage block 25711# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h 25712>>>>(48.l*512) ubyte x 25713>>>>>&511 use ole2-directory 25714# check directory entry structure and display types by GUID 257150 name ole2-directory 25716# directory entry name like "Root Entry" 25717#>0 lestring16 x \b, 1st %.10s 25718# type of the entry; 5~Root storage 25719#>66 ubyte x \b, type %x 25720# node colour of the entry: 00H ~ Red 01H ~ Black 25721#>67 ubyte x \b, color %x 25722# the DirIDs of the child nodes. Should both be -1 in the root storage entry 25723#>68 bequad !0xffffffffffffffff \b, DirIDs %llx 25724# second directory entry name like VisioDocument Control000 25725#>128 lestring16 x \b, 2nd %.20s 25726# third directory entry like WordDocument 25727#>256 lestring16 x \b, 3rd %.20s 25728# forth 25729#>384 lestring16 x \b, 4th %.10s 25730# 5th 25731#>512 lestring16 x \b, 5th %.10s 25732# 6th 25733#>640 lestring16 x \b, 6th %.10s 25734# 7th 25735#>768 lestring16 x \b, 7th %.10s 25736# https://wikileaks.org/ciav7p1/cms/page_13762814.html 25737# https://m.blog.naver.com/superman4u/40047693679 25738# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt 25739# http://www.windowstricks.in/online-windows-guid-converter 25740#>80 ubequad !0 \b, clsid 0x%16.16llx 25741#>>88 ubequad x \b%16.16llx 25742# test for "Root Entry" inside directory by type 5 value 25743>66 ubyte 5 25744# look for CLSID GUID 0 25745>>88 ubequad 0x0 25746>>>80 ubequad 0x0 25747# - Microstation V8 DGN files (www.bentley.com) 25748# URL: https://en.wikipedia.org/wiki/MicroStation 25749# Last update on 10/23/2006 by Lester Hightower 25750# 07/24/2019 by Joerg Jenderek 25751# Second directory entry name like Dgn~H Dgn~S 25752>>>>128 lestring16 Dgn~ : Microstation V8 CAD 25753#!:mime application/x-ole-storage 25754!:mime application/x-bentley-dgn 25755# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn 25756!:ext dgn 25757# 25758# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 25759# Second directory entry name PerfectOffice_ 25760>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic 25761!:mime application/vnd.wordperfect 25762# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 25763!:apple ????WPC7 25764!:ext mst/wpd/wpg 25765# 25766# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 25767# Second directory entry name MatOST_ 25768>>>>128 lestring16 MatOST : Microsoft Works 3.0 document 25769!:mime application/vnd.ms-works 25770!:apple ????AWWP 25771!:ext wps 25772# 25773# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet 25774# 3rd directory entry name WksSSWorkBook 25775>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet 25776!:mime application/vnd.ms-works 25777!:apple ????AWSS 25778!:ext xlr 25779# 25780# URL: http://fileformats.archiveteam.org/wiki/XLS 25781# what is the difference to {00020820-0000-0000-c000-000000000046} ? 25782# Second directory entry name Workbook 25783>>>>128 lestring16 Workbook 25784>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid 25785!:mime application/vnd.ms-excel 25786# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 25787!:apple ????XLS9 25788!:ext xls 25789# 25790# URL: http://fileformats.archiveteam.org/wiki/PPT 25791# Second directory entry name Object1 Object12 Object35 25792>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation 25793!:mime application/vnd.ms-powerpoint 25794# https://www.macdisk.com/macsigen.php 25795!:apple ????PPT3 25796!:ext ppt 25797# 25798# URL: https://www.msoutlook.info/question/164 25799# Second directory entry name __CollDataStm 25800>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings 25801#!:mime application/vnd.ms-outlook 25802!:mime application/x-ms-srs 25803# %APPDATA%\Microsoft\Outlook\Outlook.srs 25804!:ext srs 25805# 25806# URL: https://www.file-extensions.org/cag-file-extension 25807# Second directory entry name Category 25808>>>>128 lestring16 Category : Microsoft Clip Art Gallery 25809#!:mime application/x-ole-storage 25810!:mime application/x-ms-cag 25811!:apple MScgCGdb 25812!:ext cag/ 25813# 25814# URL: https://www.filesuffix.com/de/extension/rra 25815# 3rd directory entry name StrIndex_StringTable 25816>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer 25817#!:mime application/x-ole-storage 25818!:mime application/x-ms-rra 25819!:ext rra 25820# 25821# URL: https://www.forensicswiki.org/wiki/Jump_Lists 25822# 3rd directory entry name DestList 25823>>>>256 lestring16 DestList : Windows jump list 25824#!:mime application/x-ole-storage 25825!:mime application/x-ms-jumplist 25826# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 25827!:ext automaticDestinations-ms 25828# 25829# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache 25830# Second directory entry name 256_ 25831>>>>128 lestring16 256_ : Windows thumbnail database 256 25832#!:mime application/x-ole-storage 25833!:mime application/x-ms-thumbnail 25834# Thumbs.db 25835!:ext db 25836>>>>128 lestring16 96_ : Windows thumbnail database 96 25837!:mime application/x-ms-thumbnail 25838!:ext db 25839# 3rd directory entry name Catalog_ 25840>>>>256 lestring16 Catalog : Windows thumbnail database 25841!:mime application/x-ms-thumbnail 25842!:ext db 25843# 25844# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches 25845# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based 25846# Second directory entry name Control000 25847>>>>128 lestring16 Control000 : Microsoft old Systeminfo 25848#!:mime application/x-ole-storage 25849!:mime application/x-ms-info 25850!:ext nfo 25851# 25852# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House 25853# Second directory entry name Thumbnail 25854>>>>128 lestring16 Thumbnail : Corel PrintHouse image 25855#!:mime application/x-ole-storage 25856!:mime application/x-corel-cph 25857!:ext cph 25858# 3rd directory entry name Thumbnail 25859>>>>256 lestring16 Thumbnail : Corel PrintHouse image 25860!:mime application/x-corel-cph 25861!:ext cph 25862# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 25863# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album 25864# third directory entry name _INFO_ 25865>>>>256 lestring16 _INFO_ : Corel Gallery 25866# second directory entry name _ITEM_ or _DATA_ 25867# later directory entry names: _ALBUM_ _THUMBNAIL_ 25868#!:mime application/x-ole-storage 25869!:mime application/x-corel-gal 25870!:ext gal 25871# 25872# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) 25873# Note: "HWP Document File" signature found in FileHeader 25874# Second directory entry name FileHeader hint for Thinkfree Office document 25875>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File 25876#!:mime application/haansofthwp 25877!:mime application/x-hwp 25878# https://example-files.online-convert.com/document/hwp/example.hwp 25879!:ext hwp 25880# 25881# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ 25882# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 25883>>>>128 lestring16 dd2 : StarOffice Gallery view 25884#!:mime application/x-ole-storage 25885!:mime application/x-star-sdv 25886!:ext sdv 25887# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 25888# second directory entry name Current User 25889>>>>128 lestring16 Current\ User : SoftMaker 25890# third directory entry name SMNativeObjData 25891>>>>>256 lestring16 SMNativeObjData 25892# 5th directory entry name PowerPoint 25893>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template 25894!:mime application/vnd.ms-powerpoint 25895!:ext ppt/pps/pot 25896# 4th directory entry name PowerPoint 25897>>>>>384 lestring16 PowerPoint Presentations or template 25898# http://extension.nirsoft.net/prv 25899!:mime application/vnd.softmaker.presentations 25900!:ext prd/prv 25901# third directory entry name like Current User 25902>>>>256 lestring16 Current\ User : SoftMaker 25903# 5th directory entry name PowerPoint 25904>>>>>512 lestring16 PowerPoint Presentations or template 25905# http://extension.nirsoft.net/prd 25906!:mime application/vnd.softmaker.presentations 25907!:ext prd/prv 25908# 2nd directory entry name Pictures 25909>>>>>>128 lestring16 Pictures with pictures 25910# remaining null clsid 25911>>>>128 default x : UNKNOWN 25912# second directory entry name like VisioDocument Control000 25913>>>>>128 lestring16 x with names %.20s 25914# third directory entry like WordDocument 25915>>>>>256 lestring16 x %.20s 25916# forth 25917>>>>>384 lestring16 x %.20s 25918!:mime application/x-ole-storage 25919# look for known clsid GUID 25920# - Visio documents 25921# URL: http://fileformats.archiveteam.org/wiki/Visio 25922# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek 25923>>88 ubequad 0xc000000000000046 : Microsoft 25924>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template 25925!:mime application/vnd.visio 25926# VSD~Drawing VSS~Stencil VST~Template 25927!:ext vsd/vss/vst 25928>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template 25929!:mime application/vnd.visio 25930!:ext vsd/vss/vst 25931# 25932# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer 25933>>>80 ubequad 0x84100c0000000000 Windows Installer Package 25934!:mime application/x-msi 25935#!:mime application/x-ms-win-installer 25936!:ext msi 25937>>>80 ubequad 0x86100c0000000000 Windows Installer Patch 25938# ?? 25939!:mime application/x-wine-extension-msp 25940#!:mime application/x-ms-msp 25941!:ext msp 25942# 25943# URL: http://fileformats.archiveteam.org/wiki/DOC 25944>>>80 ubequad 0x0009020000000000 Word 6-95 document or template 25945!:mime application/msword 25946# for template MSWDW8TN 25947!:apple MSWDWDBN 25948!:ext doc/dot 25949>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template 25950!:mime application/msword 25951!:apple MSWDWDBN 25952# dot for template; no extension on Macintosh 25953!:ext doc/dot/ 25954# 25955# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 25956>>>80 ubequad 0x0213020000000000 Works 3-4 document or template 25957!:mime application/vnd.ms-works 25958!:apple ????AWWP 25959# ps for template https://filext.com/file-extension/PS bps for backup 25960!:ext wps/ps/bps 25961# 25962# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 25963>>>80 ubequad 0x0313020000000000 Works 3-4 database or template 25964!:mime application/vnd.ms-works-db 25965# https://www.macdisk.com/macsigen.php 25966!:apple ????AWDB 25967# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup 25968!:ext wdb/db/bdb 25969# 25970# URL: https://en.wikipedia.org/wiki/Microsoft_Excel 25971>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template 25972!:mime application/vnd.ms-excel 25973# https://www.macdisk.com/macsigen.php 25974!:apple ????XLS5 25975# worksheet/addin/template/no extension on Macintosh 25976!:ext xls/xla/xlt/ 25977# 25978>>>80 ubequad 0x2008020000000000 Excel 97-2003 25979!:mime application/vnd.ms-excel 25980# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 25981!:apple ????XLS9 25982# 3rd directory entry name 25983>>>>256 lestring16 _VBA_PROJECT_CUR addin 25984!:ext xla/ 25985# 4th directory entry name 25986>>>>384 lestring16 _VBA_PROJECT_CUR addin 25987!:ext xla 25988#!:ext xla/ 25989>>>>256 default x worksheet or template 25990!:ext xls/xlt 25991#!:ext xls/xlt/ 25992# 25993# URL: http://fileformats.archiveteam.org/wiki/OLE2 25994>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item 25995#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message 25996#!:mime application/vnd.ms-outlook 25997!:mime application/x-ms-msg 25998!:ext msg 25999# URL: https://wiki.fileformat.com/email/oft/ 26000>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template 26001#!:mime application/vnd.ms-outlook 26002!:mime application/x-ms-oft 26003!:ext oft 26004# 26005# URL: http://fileformats.archiveteam.org/wiki/PPT 26006>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation 26007!:mime application/vnd.ms-powerpoint 26008# https://www.macdisk.com/macsigen.php 26009!:apple ????PPT3 26010!:ext ppt 26011#?? 26012# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ 26013>>88 ubequad 0xa29a00aa004a1a72 : Microsoft 26014# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 26015>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document 26016!:mime application/vnd.ms-works 26017!:apple ????AWWP 26018!:ext wps 26019# 26020# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 26021>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database 26022!:mime application/vnd.ms-works-db 26023!:apple ????AWDB 26024!:ext wdb/bdb 26025#?? 26026>>88 ubequad 0xa40700c04fb932ba : Microsoft 26027# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 26028>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document 26029!:mime application/vnd.ms-works 26030!:apple ????AWWP 26031!:ext wps 26032#?? 26033# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher 26034>>88 ubequad 0x00c0000000000046 : Microsoft 26035>>>80 ubequad 0x0112020000000000 Publisher 26036!:mime application/vnd.ms-publisher 26037!:ext pub 26038# 26039# URL: http://fileformats.archiveteam.org/wiki/PPT 26040#?? 26041>>88 ubequad 0xa90300aa00510ea3 : Microsoft 26042>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation 26043!:mime application/vnd.ms-powerpoint 26044# https://www.macdisk.com/macsigen.php 26045!:apple ????PPT3 26046!:ext ppt/pot 26047#?? 26048>>88 ubequad 0x86ea00aa00b929e8 : Microsoft 26049>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template 26050!:mime application/vnd.ms-powerpoint 26051!:apple ????PPT3 26052# /autostart/template 26053!:ext ppt/pps/pot 26054# 26055# URL: https://en.wikipedia.org/wiki/Microsoft_Project 26056#?? 26057>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft 26058>>>80 ubequad 0x3a8fb774c8c8d111 Project 26059!:mime application/vnd.ms-project 26060!:ext mpp 26061# 26062# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) 26063#??? 26064>>88 ubequad 0x99ae04021c007002 : WordPerfect 26065>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation 26066!:mime application/x-corelpresentations 26067#!:mime application/x-shw-viewer 26068#!:mime image/x-presentations 26069!:ext shw 26070# 26071# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ 26072>>>80 ubequad 0x60fe2e4099191b10 9 Graphic 26073#!:mime application/x-wpg 26074#!:mime image/x-wordperfect-graphics 26075!:mime image/x-wpg 26076# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 26077!:apple ????WPC9 26078!:ext wpg 26079# 26080# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats 26081>>88 ubequad 0x996104021c007002 : StarOffice 26082>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template 26083# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html 26084!:mime application/x-starwriter 26085!:ext sdw/vor 26086# 26087>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template 26088!:mime application/x-starcalc 26089!:ext sdc/vor 26090# 26091>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template 26092!:mime application/x-starimpress 26093#!:mime application/x-stardraw 26094# sda ?? 26095!:ext sdd/sda/vor 26096#?? 26097>>88 ubequad 0x89cb008029e4b0b1 : StarOffice 26098>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template 26099!:mime application/x-starcalc 26100!:ext sdc/vor 26101# 26102>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template 26103!:mime application/vnd.stardivision.cal 26104!:ext sdc/vor 26105# 26106>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template 26107!:mime application/x-starimpress 26108!:ext sdd/vor 26109#?? 26110>>88 ubequad 0xb12a04021c007002 : StarOffice 26111>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 26112!:mime application/x-starmath 26113!:ext smf 26114#?? 26115>>88 ubequad 0x8e2c00001b4cc711 : StarOffice 26116>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 26117!:mime application/x-starchart 26118!:ext sds 26119#?? 26120>>88 ubequad 0xa45e00a0249d57b1 : StarOffice 26121>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template 26122!:mime application/x-starwriter 26123!:ext sdw/vor 26124#?? 26125>>88 ubequad 0x89ca008029e4b0b1 : StarOffice 26126>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 26127!:mime application/x-starmath 26128!:ext smf 26129# 26130>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 26131!:mime application/x-starchart 26132!:ext sds 26133#?? 26134>>88 ubequad 0xa53f00a0249d57b1 : StarOffice 26135>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document 26136!:mime application/x-starwriter-global 26137!:ext sgl 26138#?? 26139>>88 ubequad 0x89d0008029e4b0b1 : StarOffice 26140>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 26141!:mime application/vnd.stardivision.math 26142!:ext smf 26143# 26144>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template 26145!:mime application/vnd.stardivision.draw 26146!:ext sda/vor 26147# 26148>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template 26149!:mime application/vnd.stardivision.impress 26150# sda is used for what? 26151!:ext sdd/vor/sda 26152# 26153>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 26154!:mime application/vnd.stardivision.chart 26155!:ext sds 26156# ?? 26157>>88 ubequad 0xaab4006097da561a : StarOffice 26158>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template 26159!:mime application/vnd.stardivision.writer 26160!:ext sdw/vor 26161# 26162>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document 26163!:mime application/vnd.stardivision.writer-global 26164!:ext sgl 26165#?? 26166# URL: http://fileformats.archiveteam.org/wiki/FlashPix 26167>>88 ubequad 0x855300aa00a1f95b : Kodak 26168>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image 26169!:mime image/vnd.fpx 26170!:apple ????FPix 26171!:ext fpx 26172# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 26173>>88 ubequad 0x95f600a0cc3cca14 : PlanMaker 26174>>>80 ubequad 0x9174088a6452d411 document or template 26175!:mime application/vnd.softmaker.planmaker 26176# pmv for template https://www.file-extensions.org/pmv-file-extension 26177!:ext pmd/pmv 26178# remaining non null clsid 26179>>88 default x : UNKNOWN 26180!:mime application/x-ole-storage 26181>>>80 ubequad !0 \b, clsid 0x%16.16llx 26182>>>88 ubequad x \b%16.16llx 26183 26184 26185#------------------------------------------------------------------------------ 26186# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 26187# olf: file(1) magic for OLF executables 26188# 26189# We have to check the byte order flag to see what byte order all the 26190# other stuff in the header is in. 26191# 26192# MIPS R3000 may also be for MIPS R2000. 26193# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 26194# 26195# Created by Erik Theisen <etheisen@openbsd.org> 26196# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 261970 string \177OLF OLF 26198>4 byte 0 invalid class 26199>4 byte 1 32-bit 26200>4 byte 2 64-bit 26201>7 byte 0 invalid os 26202>7 byte 1 OpenBSD 26203>7 byte 2 NetBSD 26204>7 byte 3 FreeBSD 26205>7 byte 4 4.4BSD 26206>7 byte 5 Linux 26207>7 byte 6 SVR4 26208>7 byte 7 esix 26209>7 byte 8 Solaris 26210>7 byte 9 Irix 26211>7 byte 10 SCO 26212>7 byte 11 Dell 26213>7 byte 12 NCR 26214>5 byte 0 invalid byte order 26215>5 byte 1 LSB 26216>>16 leshort 0 no file type, 26217>>16 leshort 1 relocatable, 26218>>16 leshort 2 executable, 26219>>16 leshort 3 shared object, 26220# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 26221# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 26222>>16 leshort 4 core file 26223>>>(0x38+0xcc) string >\0 of '%s' 26224>>>(0x38+0x10) lelong >0 (signal %d), 26225>>16 leshort &0xff00 processor-specific, 26226>>18 leshort 0 no machine, 26227>>18 leshort 1 AT&T WE32100 - invalid byte order, 26228>>18 leshort 2 SPARC - invalid byte order, 26229>>18 leshort 3 Intel 80386, 26230>>18 leshort 4 Motorola 68000 - invalid byte order, 26231>>18 leshort 5 Motorola 88000 - invalid byte order, 26232>>18 leshort 6 Intel 80486, 26233>>18 leshort 7 Intel 80860, 26234>>18 leshort 8 MIPS R3000_BE - invalid byte order, 26235>>18 leshort 9 Amdahl - invalid byte order, 26236>>18 leshort 10 MIPS R3000_LE, 26237>>18 leshort 11 RS6000 - invalid byte order, 26238>>18 leshort 15 PA-RISC - invalid byte order, 26239>>18 leshort 16 nCUBE, 26240>>18 leshort 17 VPP500, 26241>>18 leshort 18 SPARC32PLUS, 26242>>18 leshort 20 PowerPC, 26243>>18 leshort 0x9026 Alpha, 26244>>20 lelong 0 invalid version 26245>>20 lelong 1 version 1 26246>>36 lelong 1 MathCoPro/FPU/MAU Required 26247>8 string >\0 (%s) 26248>5 byte 2 MSB 26249>>16 beshort 0 no file type, 26250>>16 beshort 1 relocatable, 26251>>16 beshort 2 executable, 26252>>16 beshort 3 shared object, 26253>>16 beshort 4 core file, 26254>>>(0x38+0xcc) string >\0 of '%s' 26255>>>(0x38+0x10) belong >0 (signal %d), 26256>>16 beshort &0xff00 processor-specific, 26257>>18 beshort 0 no machine, 26258>>18 beshort 1 AT&T WE32100, 26259>>18 beshort 2 SPARC, 26260>>18 beshort 3 Intel 80386 - invalid byte order, 26261>>18 beshort 4 Motorola 68000, 26262>>18 beshort 5 Motorola 88000, 26263>>18 beshort 6 Intel 80486 - invalid byte order, 26264>>18 beshort 7 Intel 80860, 26265>>18 beshort 8 MIPS R3000_BE, 26266>>18 beshort 9 Amdahl, 26267>>18 beshort 10 MIPS R3000_LE - invalid byte order, 26268>>18 beshort 11 RS6000, 26269>>18 beshort 15 PA-RISC, 26270>>18 beshort 16 nCUBE, 26271>>18 beshort 17 VPP500, 26272>>18 beshort 18 SPARC32PLUS, 26273>>18 beshort 20 PowerPC or cisco 4500, 26274>>18 beshort 21 cisco 7500, 26275>>18 beshort 24 cisco SVIP, 26276>>18 beshort 25 cisco 7200, 26277>>18 beshort 36 cisco 12000, 26278>>18 beshort 0x9026 Alpha, 26279>>20 belong 0 invalid version 26280>>20 belong 1 version 1 26281>>36 belong 1 MathCoPro/FPU/MAU Required 26282 26283#------------------------------------------------------------------------------ 26284# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $ 26285# openfs: file(1) magic for OpenFST (Weighted finite-state tranducer library) 26286 262870 long 0x7eb2fdd6 OpenFst binary FST data 26288>&0 pstring/l x \b, fst type: %s 26289>>&0 pstring/l x \b, arc type: %s 26290>>>&0 long x \b, version: %d 26291>>>>&20 quad x \b, num states: %lld 26292>>>>>&0 quad >0 \b, num arcs: %lld 26293 262940 long 0x56515c OpenFst binary FAR data, far type: stlist 26295>4 long x \b, version: %d 26296 262970 long 0x7eb2f35c OpenFst binary FAR data, far type: sttable 26298>4 long x \b, version: %d 26299 26300#------------------------------------------------------------ 26301# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $ 26302# OpenTimestamps related magic entries 26303# https://opentimestamps.org/ 26304# https://en.wikipedia.org/wiki/OpenTimestamps 26305# "Emanuele Cisbani" <emanuele.cisbani@gmail.com> 26306#------------------------------------------------------------ 26307 26308# OpenTimestamps Proof .ots format. 26309# Magic is defined here: 26310# https://github.com/opentimestamps/python-opentimestamps/\ 26311# blob/master/opentimestamps/core/timestamp.py#L273 26312 263130 string \x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps 26314>16 string \x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof 26315 26316#------------------------------------------------------------------------------ 26317# $File: os2,v 1.11 2020/08/30 16:22:20 christos Exp $ 26318# os2: file(1) magic for OS/2 files 26319# 26320 26321# Provided 1998/08/22 by 26322# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 263231 search/100 InternetShortcut MS Windows 95 Internet shortcut text 26324>17 search/100 URL= (URL=< 26325>>&0 string x \b%s>) 26326 26327# OS/2 URL objects 26328# Provided 1998/08/22 by 26329# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 26330#0 string http: OS/2 URL object text 26331#>5 string >\ (WWW) <http:%s> 26332#0 string mailto: OS/2 URL object text 26333#>7 string >\ (email) <%s> 26334#0 string news: OS/2 URL object text 26335#>5 string >\ (Usenet) <%s> 26336#0 string ftp: OS/2 URL object text 26337#>4 string >\ (FTP) <ftp:%s> 26338#0 string file: OS/2 URL object text 26339#>5 string >\ (Local file) <%s> 26340 26341# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 26342# URL: http://fileformats.archiveteam.org/wiki/INF/HLP_(OS/2) 26343# Reference: http://www.edm2.com/0308/inf.html 26344# Carl Hauser (chauser.parc@xerox.com) and 26345# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 26346# list the following header format in inf02a.doc: 26347# 26348# int16 ID; // ID magic word (5348h = "HS") 26349# int8 unknown1; // unknown purpose, could be third letter of ID 26350# int8 flags; // probably a flag word... 26351# // bit 0: set if INF style file 26352# // bit 4: set if HLP style file 26353# // patching this byte allows reading HLP files 26354# // using the VIEW command, while help files 26355# // seem to work with INF settings here as well. 26356# int16 hdrsize; // total size of header 26357# int16 unknown2; // unknown purpose 26358# 263590 string HSP\x01\x9b\x00 OS/2 INF 26360!:mime application/x-os2-inf 26361!:ext inf 26362>107 string >0 (%s) 263630 string HSP\x10\x9b\x00 OS/2 HLP 26364!:mime application/x-os2-hlp 26365!:ext hlp 26366>107 string >0 (%s) 26367 26368# From: Joerg Jenderek 26369# URL: http://fileformats.archiveteam.org/wiki/MSG_(OS/2) 26370# Reference: https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/blob/master/mkmsgf.h 26371# Note: created by MKMSGF.EXE. Text source can be recreated by E_MSGF 26372# example like OS001H.MSG 263730 string \xffMKMSGF\0 OS/2 help message 26374!:mime application/x-os2-msg 26375!:ext msg 26376# identifier[3] like: DOS NET REX SYS ... 26377>8 string x '%.3s' 26378# msgnumber: number of messages 26379>11 uleshort x \b, %u messages 26380# firstmsgnumber; number of the first message like: some times 0 often 1 169 1000 3502 26381>13 uleshort >1 \b, 1st number %u 26382# offset16bit; 1~Index table has 16-bit offsets (files<64k) 0~Index table has 32-bit offsets 26383>15 ubyte =0 \b, 32-bit 26384#>15 ubyte =1 \b, 16-bit 26385# version; file version: 2~new 0~old 26386>16 uleshort !2 \b, version %u 26387# indextaboffset; offset of index table: 1F~after header 0~no index table for version 0? 26388>18 uleshort >0 26389>>18 uleshort !0x1f \b, at 0x%x index 26390# 32-bit offset 26391>>15 ubyte =0 26392# offset with message table 26393>>>(18.s) ulelong x \b, at 0x%x 26394# 1st message 26395# http://www.os2museum.com/files/docs/os210ptk/os2-1.0-ptk-tools-1988.pdf 26396# message type: E~Error H~Help I~Information P~Prompt W~Warning ? 26397>>>>(&-4.l) ubyte x %c-type 26398>>>>>&0 string x %s 26399# 16-bit offset 26400>>15 ubyte =1 26401# msgnum; message number 26402>>>(18.s) uleshort x \b, number %u 26403# msgindex; offset of message from begin of file 26404>>>(18.s+2) uleshort x at 0x%x 26405# message type E H I P W ? 26406>>>>(&-2.s) ubyte x %c-type 26407# skip newline carriage return 26408>>>>>&0 ubeshort =0x0D0a 26409>>>>>>&0 string x %s 26410>>>>>&0 ubeshort !0x0D0a 26411>>>>>>&-2 string x %s 26412# for version 0 index table apparently at offset 1F 26413>16 uleshort 0 26414>>15 ubyte 1 26415# 1st message 16-bit 26416>>>0x1F uleshort x \b, at 0x%x 26417# message type: E~Error H~Help I~Information P~Prompt W~Warning ? 26418>>>>(0x1F.s) ubyte x %c-type 26419>>>>>&0 string x %s 26420# 2nd message 16-bit 26421>>>0x21 uleshort x \b, at 0x%x 26422>>>>(0x21.s) ubyte x %c-type 26423>>>>>&0 string x %s 26424# 3rd message 16-bit 26425>>>0x23 uleshort x \b, at 0x%x 26426>>>>(0x23.s) ubyte x %c-type 26427>>>>>&0 string x %s 26428# version 0 32-bit 26429>>15 ubyte 0 26430# 1st message 32-bit 26431>>>0x1f ulelong x \b, at 0x%x 26432>>>>(0x1F.l) ubyte x %c-type 26433>>>>>&0 string x %s 26434# 2nd message 32-bit 26435>>>0x23 ulelong x \b, at 0x%x 26436>>>>(0x23.l) ubyte x %c-type 26437>>>>>&0 string x %s 26438# 3rd message 32-bit 26439>>>0x27 ulelong x \b, AT 0x%x 26440>>>>(0x27.l) ubyte x %c-type 26441>>>>>&0 string x %s 26442# countryinfo; offset of country info block: 0 for version 0 26443>20 uleshort !0 \b, at 0x%x countryinfo 26444# nextcoutryinfo 26445>>22 uleshort >0 \b, at 0x%x next 26446# reserved[5]; Must be 0 26447>>25 ulelong !0 \b, RESERVED 0x%x 26448>>(20.s) use os2-msg-info 26449# display country info block of MKMSGF message file 264500 name os2-msg-info 26451# bytesperchar; bytes per char: 1~SBCS 2~DBCS 26452>0 ubyte >1 \b, %u bytes/char 26453# reserved; Not known 26454>1 uleshort !0 \b, reserved 0x%x 26455# langfamilyID; language family ID like: 0~? 1~Arabic ... 7~German ... 9~English ... 34~Slovene 26456>3 uleshort >0 \b, language %u 26457# langversionID; like: 7_1~German 7_2~Swiss German 12_1~French 12_3~Canadian French 26458>>5 uleshort x \b_%u 26459# langfamilyID too high. This should not happen 26460>3 uleshort >34 (invalid language) 26461# codepagesnumber; number of codepages like: 1 2 ... 16 26462>7 uleshort x \b, %u code page 26463# plural s 26464>7 uleshort >1 \bs 26465# too many number of codepages. This should not happen 26466>7 uleshort >16 (Too many) 26467# codepages[16]; codepages list like 437 850 ... 26468>7 uleshort <17 26469# 1st code page 26470>>9 uleshort >0 %u 26471# possible 2nd code page number 26472>>>7 uleshort >1 26473>>>>11 uleshort x %u 26474# filename[260]; name of file like: dbaseos2.msg dde4c01e.msg os2ldr.mgr xdfh.msg ... 26475>41 string x \b, %s 26476 26477# OS/2 INI (this is a guess) 264780 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 26479!:mime application/x-os2-ini 26480!:ext ini 26481 26482 26483#------------------------------------------------------------------------------ 26484# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 26485# os400: file(1) magic for IBM OS/400 files 26486# 26487# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 26488# In spite of its quite variable format (due to internal memory page 26489# length differences between CISC and RISC versions of the OS) the 26490# SAVF structure hasn't suitable offsets to identify the catalog 26491# header in the first descriptor where there are some useful infos, 26492# so we must search in a somewhat large area for a particular string 26493# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 26494# descriptor space) preceded by a two byte constant. 26495# 264961090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 26497>&212 byte 0x01 \b, created with SAVOBJ 26498>&212 byte 0x02 \b, created with SAVLIB 26499>&212 byte 0x07 \b, created with SAVCFG 26500>&212 byte 0x08 \b, created with SAVSECDTA 26501>&212 byte 0x0A \b, created with SAVSECDTA 26502>&212 byte 0x0B \b, created with SAVDLO 26503>&212 byte 0x0D \b, created with SAVLICPGM 26504>&212 byte 0x11 \b, created with SAVCHGOBJ 26505>&213 byte 0x44 \b, at least V5R4 to open 26506>&213 byte 0x43 \b, at least V5R3 to open 26507>&213 byte 0x42 \b, at least V5R2 to open 26508>&213 byte 0x41 \b, at least V5R1 to open 26509>&213 byte 0x40 \b, at least V4R5 to open 26510>&213 byte 0x3F \b, at least V4R4 to open 26511>&213 byte 0x3E \b, at least V4R3 to open 26512>&213 byte 0x3C \b, at least V4R2 to open 26513>&213 byte 0x3D \b, at least V4R1M4 to open 26514>&213 byte 0x3B \b, at least V4R1 to open 26515>&213 byte 0x3A \b, at least V3R7 to open 26516>&213 byte 0x35 \b, at least V3R6 to open 26517>&213 byte 0x36 \b, at least V3R2 to open 26518>&213 byte 0x34 \b, at least V3R1 to open 26519>&213 byte 0x31 \b, at least V3R0M5 to open 26520>&213 byte 0x30 \b, at least V2R3 to open 26521 26522#------------------------------------------------------------------------------ 26523# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $ 26524# 26525# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 26526# 26527# Redistribution and use in source and binary forms, with or without 26528# modification, are permitted provided that the following conditions 26529# are met: 26530# 1. Redistributions of source code must retain the above copyright 26531# notice, this list of conditions and the following disclaimer. 26532# 2. Redistributions in binary form must reproduce the above copyright 26533# notice, this list of conditions and the following disclaimer in the 26534# documentation and/or other materials provided with the distribution. 26535# 26536# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26537# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 26538# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 26539# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 26540# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 26541# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 26542# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 26543# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 26544# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 26545# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26546# 26547# 26548# 26549# OS9/6809 module descriptions: 26550# 265510 beshort 0x87CD OS9/6809 module: 26552# 26553>6 byte&0x0f 0x00 non-executable 26554>6 byte&0x0f 0x01 machine language 26555>6 byte&0x0f 0x02 BASIC I-code 26556>6 byte&0x0f 0x03 Pascal P-code 26557>6 byte&0x0f 0x04 C I-code 26558>6 byte&0x0f 0x05 COBOL I-code 26559>6 byte&0x0f 0x06 Fortran I-code 26560# 26561>6 byte&0xf0 0x10 program executable 26562>6 byte&0xf0 0x20 subroutine 26563>6 byte&0xf0 0x30 multi-module 26564>6 byte&0xf0 0x40 data module 26565# 26566>6 byte&0xf0 0xC0 system module 26567>6 byte&0xf0 0xD0 file manager 26568>6 byte&0xf0 0xE0 device driver 26569>6 byte&0xf0 0xF0 device descriptor 26570# 26571# OS9/m68k stuff (to be continued) 26572# 265730 beshort 0x4AFC OS9/68K module: 26574# 26575# attr 26576>0x14 byte&0x80 0x80 re-entrant 26577>0x14 byte&0x40 0x40 ghost 26578>0x14 byte&0x20 0x20 system-state 26579# 26580# lang: 26581# 26582>0x13 byte 1 machine language 26583>0x13 byte 2 BASIC I-code 26584>0x13 byte 3 Pascal P-code 26585>0x13 byte 4 C I-code 26586>0x13 byte 5 COBOL I-code 26587>0x13 byte 6 Fortran I-code 26588# 26589# 26590# type: 26591# 26592>0x12 byte 1 program executable 26593>0x12 byte 2 subroutine 26594>0x12 byte 3 multi-module 26595>0x12 byte 4 data module 26596>0x12 byte 11 trap library 26597>0x12 byte 12 system module 26598>0x12 byte 13 file manager 26599>0x12 byte 14 device driver 26600>0x12 byte 15 device descriptor 26601 26602#------------------------------------------------------------------------------ 26603# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 26604# 26605# Mach magic number info 26606# 266070 long 0xefbe OSF/Rose object 26608# I386 magic number info 26609# 266100 short 0565 i386 COFF object 26611 26612#------------------------------------------------------------------------------ 26613# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $ 26614# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 26615# 26616# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 26617 26618# These are weak, byte 59 is not guaranteed to be 0 and there are 26619# 8 character identifiers at byte 60, one I found for appl is BIGb. 26620# What are the possibilities and where is this documented? 26621 26622# The common header format for PalmOS .pdb/.prc files is 26623# { 26624# char name[ 32 ]; 26625# Word attributes; 26626# Word version; 26627# DWord creationDate; 26628# DWord modificationDate; 26629# DWord lastBackupDate; 26630# DWord modificationNumber; 26631# DWord appInfoID; 26632# DWord sortInfoID; 26633# char type[4]; 26634# char creator[4]; 26635# DWord uniqueIDSeed; 26636# RecordListType recordList; 26637# }; 26638# 26639# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 26640# or Unix/POSIX time + 2082844800. 26641 266420 name aportisdoc 26643# date is supposed to be big-endian seconds since 1 Jan 1904, but many 26644# files contain the timestamp in little-endian or a completely 26645# nonsensical value... 26646#>36 bedate-2082844800 >0 \b, created %s 26647# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 26648>(78.L) beshort =1 \b, uncompressed 26649# compressed 26650>(78.L) beshort >1 26651>>(78.L+4) belong x \b, %d bytes uncompressed 26652 26653# appl 26654#60 string appl PalmOS application 26655#>0 string >\0 "%s" 26656 26657# HACK 26658#60 string HACK HackMaster hack 26659#>0 string >\0 "%s" 26660 26661# iSiloX e-book 2666260 string SDocSilX iSiloX E-book 26663>0 string >\0 "%s" 26664 26665# Mobipocket (www.mobipocket.com), donated by Carl Witty 26666# expanded by Ralf Brown 2666760 string BOOKMOBI Mobipocket E-book 26668# MobiPocket stores a full title, pointed at by the belong at offset 26669# 0x54 in its header at (78.L), with length given by the belong at 26670# offset 0x58. 26671# there's no guarantee that the title string is null-terminated, but 26672# we currently can't specify a variable-length string where the length 26673# field is not at the start of the string; in practice, the data 26674# following the string always seems to start with a zero byte 26675>(78.L) belong x 26676>>&(&0x50.L-4) string >\0 "%s" 26677>0 use aportisdoc 26678>>(78.L+0x68) belong >0 \b, version %d 26679>>(78.L+0x1C) belong !0 \b, codepage %d 26680>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 26681 26682# AportisDoc/PalmDOC 2668360 string TEXtREAd AportisDoc/PalmDOC E-book 26684>0 string >\0 "%s" 26685>0 use aportisdoc 26686 26687# Variety of PalmOS document types 26688# Michael-John Turner <mj@debian.org> 26689# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 2669060 string BVokBDIC BDicty PalmOS document 26691>0 string >\0 "%s" 2669260 string DB99DBOS DB PalmOS document 26693>0 string >\0 "%s" 2669460 string vIMGView FireViewer/ImageViewer PalmOS document 26695>0 string >\0 "%s" 2669660 string PmDBPmDB HanDBase PalmOS document 26697>0 string >\0 "%s" 2669860 string InfoINDB InfoView PalmOS document 26699>0 string >\0 "%s" 2670060 string ToGoToGo iSilo PalmOS document 26701>0 string >\0 "%s" 2670260 string JfDbJBas JFile PalmOS document 26703>0 string >\0 "%s" 2670460 string JfDbJFil JFile Pro PalmOS document 26705>0 string >\0 "%s" 2670660 string DATALSdb List PalmOS document 26707>0 string >\0 "%s" 2670860 string Mdb1Mdb1 MobileDB PalmOS document 26709>0 string >\0 "%s" 2671060 string PNRdPPrs PeanutPress PalmOS document 26711>0 string >\0 "%s" 2671260 string DataPlkr Plucker PalmOS document 26713>0 string >\0 "%s" 2671460 string DataSprd QuickSheet PalmOS document 26715>0 string >\0 "%s" 2671660 string SM01SMem SuperMemo PalmOS document 26717>0 string >\0 "%s" 2671860 string TEXtTlDc TealDoc PalmOS document 26719>0 string >\0 "%s" 2672060 string InfoTlIf TealInfo PalmOS document 26721>0 string >\0 "%s" 2672260 string DataTlMl TealMeal PalmOS document 26723>0 string >\0 "%s" 2672460 string DataTlPt TealPaint PalmOS document 26725>0 string >\0 "%s" 2672660 string dataTDBP ThinkDB PalmOS document 26727>0 string >\0 "%s" 2672860 string TdatTide Tides PalmOS document 26729>0 string >\0 "%s" 2673060 string ToRaTRPW TomeRaider PalmOS document 26731>0 string >\0 "%s" 26732 26733# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 26734# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 26735# annotations. 26736# For other versions, just outputs version. 26737# 2673860 string zTXT A GutenPalm zTXT e-book 26739>0 string >\0 "%s" 26740>(0x4E.L) byte 0 26741>>(0x4E.L+1) byte x (v0.%02d) 26742>(0x4E.L) byte 1 26743>>(0x4E.L+1) byte x (v1.%02d) 26744>>>(0x4E.L+10) beshort >0 26745>>>>(0x4E.L+10) beshort <2 - 1 bookmark 26746>>>>(0x4E.L+10) beshort >1 - %d bookmarks 26747>>>(0x4E.L+14) beshort >0 26748>>>>(0x4E.L+14) beshort <2 - 1 annotation 26749>>>>(0x4E.L+14) beshort >1 - %d annotations 26750>(0x4E.L) byte >1 (v%d. 26751>>(0x4E.L+1) byte x %02d) 26752 26753# Palm OS .prc file types 2675460 string libr 26755# flags, only bit 0 or bit 6 26756# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 26757# https://web.mit.edu/tytso/www/pilot/prc-format.html 26758>0x20 beshort&0xffbe 0 26759>>0 string >\0 Palm OS dynamic library data "%s" 2676060 string ptch Palm OS operating system patch data 26761>0 string >\0 "%s" 26762 26763# Mobipocket (www.mobipocket.com), donated by Carl Witty 2676460 string BOOKMOBI Mobipocket E-book 26765>0 string >\0 "%s" 26766 26767#------------------------------------------------------------------------------ 26768# $File: parix,v 1.5 2020/03/08 22:18:32 christos Exp $ 26769# 26770# Parix COFF executables 26771# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 26772# 267730 beshort&0xefff 0x8ACE PARIX 26774>0 byte&0xf0 0x80 T800 26775>0 byte&0xf0 0x90 T9000 26776>19 byte&0x02 0x02 executable 26777>19 byte&0x02 0x00 object 26778>19 byte&0x0c 0x00 not stripped 26779#------------------------------------------------------------------------------ 26780# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $ 26781# parrot: file(1) magic for Parrot Virtual Machine 26782# URL: https://www.lua.org/ 26783# From: Lubomir Rintel <lkundrak@v3.sk> 26784 26785# Compiled Parrot byte code 267860 string \376PBC\r\n\032\n Parrot bytecode 26787>64 byte x %d. 26788>72 byte x \b%d, 26789>8 byte >0 %d byte words, 26790>16 byte 0 little-endian, 26791>16 byte 1 big-endian, 26792>32 byte 0 IEEE-754 8 byte double floats, 26793>32 byte 1 x86 12 byte long double floats, 26794>32 byte 2 IEEE-754 16 byte long double floats, 26795>32 byte 3 MIPS 16 byte long double floats, 26796>32 byte 4 AIX 16 byte long double floats, 26797>32 byte 5 4-byte floats, 26798>40 byte x Parrot %d. 26799>48 byte x \b%d. 26800>56 byte x \b%d 26801#------------------------------------------------------------------------------ 26802# $File: pascal,v 1.3 2020/06/07 18:10:26 christos Exp $ 26803# pascal: file(1) magic for Pascal source 26804# 268050 search/8192 (input, Pascal source text 26806!:mime text/x-pascal 26807#0 regex \^program Pascal source text 26808#!:mime text/x-pascal 26809#0 regex \^record Pascal source text 26810#!:mime text/x-pascal 26811 26812# Free Pascal 268130 string PPU Pascal unit 26814>3 string x \b, version %s 26815 26816#------------------------------------------------------------------------------ 26817# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $ 26818# file(1) magic(5) data for OpenStreetMap 26819 26820# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 26821# https://wiki.openstreetmap.org/wiki/PBF_Format 26822# From: Markus Heidelberg <markus.heidelberg@web.de> 268230 belong&0xfffffff0 0 26824>4 beshort 0x0A09 26825>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 26826 26827#------------------------------------------------------------------------------ 26828# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 26829# pbm: file(1) magic for Portable Bitmap files 26830# 26831# XXX - byte order? 26832# 268330 short 0x2a17 "compact bitmap" format (Poskanzer) 26834#------------------------------------------------------------------------------ 26835# pc88: file(1) magic for the NEC Home Computer 26836# v1.0 26837# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 26838 26839# PC88 2D disk image 268400x20 ulelong&0xFFFFFEFF 0x2A0 26841>0x10 string \0\0\0\0\0\0\0\0\0\0 26842>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 26843>>>0x1A ubyte&0xEF 0 26844>>>>0x1B ubyte&0x8F 0 26845>>>>>0x1B ubyte&70 <0x40 26846>>>>>>0x1C ulelong >0x21 26847>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 26848>>>>>>>>0x1B ubyte 0 \b, media=2D 26849>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 26850>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 26851>>>>>>>>0x1B ubyte 0x30 \b, media=1D 26852>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 26853>>>>>>>>0x1A ubyte 0x10 \b, write-protected 26854 26855 26856 26857 26858#------------------------------------------------------------------------------ 26859# pc98: file(1) magic for the MSX Home Computer 26860# v1.0 26861# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 26862 26863# Maki-chan v1 Graphic format 26864# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so 26865# http://www.jisyo.com/viewer/faq/maki_tech.htm 268660 string/b MAKI01 Maki-chan v1. 26867>6 ubyte|0x20 x \b%c image 26868>8 ubelong >0x40404040 \b, system ID: 26869>>8 byte x %c 26870>>9 byte x \b%c 26871>>10 byte x \b%c 26872>>11 byte x \b%c 26873>44 ubeshort x \b, %dx 26874>46 ubeshort x \b%d 26875>38 ubeshort&2 0 \b, 16 paletted RGB colors 26876>38 ubeshort&2 2 \b, 8 fixed RGB colors 26877>38 ubeshort&1 1 \b, 2:1 dot aspect ratio 26878 26879# Maki-chan v2 Graphic format 26880# http://www.jisyo.com/viewer/faq/mag_tech.htm 26881# https://mooncore.eu/bunny/txt/makichan.htm 26882# http://metanest.jp/mag/mag.xhtml 268830 string/b MAKI02\ \ Maki-chan v2 image, 26884>8 byte x system ID: %c 26885>9 byte x \b%c 26886>10 byte x \b%c 26887>11 byte x \b%c, 26888>13 search/0x200 \x1A 26889#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing: 26890#1) When offset1(ubeshort) !=0x0344: 26891# 1.1) And offset3(ubyte).b7=0: 26892# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1) 26893# - b1=number of colors: 0=16 colors, 1=8 colors 26894# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data 26895# 1.2) And offset3(ubyte).B7=1: 26896# - b0=256 paletted colors 26897# - b1=256 fixed colors using the MSX SCR8 palette 26898#2) When offset1(ubeshort) =0x0344: 26899# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored 26900>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors 26901>>&1 ubeshort !0x0344 26902>>>&5 uleshort+1 x %dx 26903>>>&7 uleshort+1 x \b%d, 26904>>>&0 ubyte&0x86 0x00 16 paletted RGB colors 26905>>>&0 ubyte&0x86 0x02 8 paletted RGB colors 26906>>>&0 ubyte&0x86 0x04 16 fixed RGB colors 26907>>>&0 ubyte&0x86 0x06 8 fixed RGB colors 26908>>>&0 ubyte&0x81 0x80 256 paletted RGB colors 26909>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors 26910>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio 26911 26912# XLD4 (Q4) picture 2691311 string/b MAJYO XLD4(Q4) picture 26914 26915# Yanagisawa Pi picture 26916#0 string Pi\x1A\0 Yanagisawa Pi picture 26917#>3 search/0x200 \x04 269180 string Pi 26919>2 search/0x200 \x1A 26920>>&0 ubyte 0 26921>>>&3 ubyte 4 Yanagisawa Pi 16 color picture, 26922>>>&4 byte x system ID: %c 26923>>>&5 byte x \b%c 26924>>>&6 byte x \b%c 26925>>>&7 byte x \b%c, 26926>>>&10 ubeshort x %dx 26927>>>&12 ubeshort x \b%d 26928>>>&3 ubyte 8 Yanagisawa Pi 256 color picture 26929>>>&4 byte x system ID: %c 26930>>>&5 byte x \b%c 26931>>>&6 byte x \b%c 26932>>>&7 byte x \b%c, 26933>>>&10 ubeshort x %dx 26934>>>&12 ubeshort x \b%d 26935 26936#------------------------------------------------------------------------------ 26937# $File: pcjr,v 1.1 2021/01/09 15:09:58 christos Exp $ 26938# pcjr: file(1) magic for PCjr Cartridge image file format 26939# From: Francis Laniel <laniel_francis@privacyrequired.com> 269400 string PCjr 26941>0x80 beshort 0x55aa PCjr Cartridge image 26942>0x200 beshort 0x55aa PCjr Cartridge image 26943 26944#------------------------------------------------------------------------------ 26945# $File: pdf,v 1.15 2020/08/23 00:30:45 christos Exp $ 26946# pdf: file(1) magic for Portable Document Format 26947# 26948 269490 name pdf 26950>8 search /Count 26951>>&0 regex [0-9]+ \b, %s pages 26952>8 search/512 /Filter/FlateDecode/ (password protected) 26953 269540 string %PDF- PDF document 26955!:mime application/pdf 26956!:strength +60 26957!:ext pdf 26958>5 byte x \b, version %c 26959>7 byte x \b.%c 26960>0 use pdf 26961 269620 string \012%PDF- PDF document 26963!:mime application/pdf 26964!:strength +60 26965!:ext pdf 26966>6 byte x \b, version %c 26967>8 byte x \b.%c 26968>0 use pdf 26969 269700 string \xef\xbb\xbf%PDF- PDF document (UTF-8) 26971!:mime application/pdf 26972!:strength +60 26973!:ext pdf 26974>6 byte x \b, version %c 26975>8 byte x \b.%c 26976>0 use pdf 26977 26978# From: Nick Schmalenberger <nick@schmalenberger.us> 26979# Forms Data Format 269800 string %FDF- FDF document 26981!:mime application/vnd.fdf 26982!:strength +60 26983!:ext pdf 26984>5 byte x \b, version %c 26985>7 byte x \b.%c 26986 269870 search/256 %PDF- PDF document 26988!:mime application/pdf 26989!:strength +60 26990!:ext pdf 26991>&0 byte x \b, version %c 26992>&2 byte x \b.%c 26993>0 use pdf 26994 26995#------------------------------------------------------------------------------ 26996# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $ 26997# pdp: file(1) magic for PDP-11 executable/object and APL workspace 26998# 269990 lelong 0101555 PDP-11 single precision APL workspace 270000 lelong 0101554 PDP-11 double precision APL workspace 27001# 27002# PDP-11 a.out 27003# 270040 leshort 0407 PDP-11 executable 27005>8 leshort >0 not stripped 27006>15 byte >0 - version %d 27007 27008# updated by Joerg Jenderek at Mar 2013 27009# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 270100 leshort 0401 27011# skip *.PNF with WinDirPathOffset 58h 27012>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 27013# skip *.PNF with high byte of InfVersionDatumCount zero 27014#>>15 byte !0 PDP-11 UNIX/RT ldp 270150 leshort 0405 PDP-11 old overlay 27016 270170 leshort 0410 PDP-11 pure executable 27018>8 leshort >0 not stripped 27019>15 byte >0 - version %d 27020 270210 leshort 0411 PDP-11 separate I&D executable 27022>8 leshort >0 not stripped 27023>15 byte >0 - version %d 27024 270250 leshort 0437 PDP-11 kernel overlay 27026 27027# These last three are derived from 2.11BSD file(1) 270280 leshort 0413 PDP-11 demand-paged pure executable 27029>8 leshort >0 not stripped 27030 270310 leshort 0430 PDP-11 overlaid pure executable 27032>8 leshort >0 not stripped 27033 270340 leshort 0431 PDP-11 overlaid separate executable 27035>8 leshort >0 not stripped 27036#------------------------------------------------------------------------------ 27037# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $ 27038# perl: file(1) magic for Larry Wall's perl language. 27039# 27040# The `eval' lines recognizes an outrageously clever hack. 27041# Keith Waclena <keith@cerberus.uchicago.edu> 27042# Send additions to <perl5-porters@perl.org> 270430 search/1024 eval\ "exec\ perl Perl script text 27044!:mime text/x-perl 270450 search/1024 eval\ "exec\ /bin/perl Perl script text 27046!:mime text/x-perl 270470 search/1024 eval\ "exec\ /usr/bin/perl Perl script text 27048!:mime text/x-perl 270490 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text 27050!:mime text/x-perl 270510 search/1024 eval\ 'exec\ perl Perl script text 27052!:mime text/x-perl 270530 search/1024 eval\ 'exec\ /bin/perl Perl script text 27054!:mime text/x-perl 270550 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text 27056!:mime text/x-perl 270570 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text 27058!:mime text/x-perl 270590 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 27060!:mime text/x-perl 270610 string #!/usr/bin/env\ perl Perl script text executable 27062!:mime text/x-perl 270630 string #!\ /usr/bin/env\ perl Perl script text executable 27064!:mime text/x-perl 270650 string #! 27066>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 27067!:mime text/x-perl 27068 27069# by Dmitry V. Levin and Alexey Tourbin 27070# check the first line 270710 search/8192 package 27072>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 27073!:strength + 40 27074# not 'p', check other lines 270750 search/8192 !p 27076>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 27077>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 27078!:strength + 75 27079 27080# Perl POD documents 27081# From: Tom Hukins <tom@eborcom.com> 270820 search/1024/W \=pod\n Perl POD document text 270830 search/1024/W \n\=pod\n Perl POD document text 270840 search/1024/W \=head1\ Perl POD document text 270850 search/1024/W \n\=head1\ Perl POD document text 270860 search/1024/W \=head2\ Perl POD document text 270870 search/1024/W \n\=head2\ Perl POD document text 270880 search/1024/W \=encoding\ Perl POD document text 270890 search/1024/W \n\=encoding\ Perl POD document text 27090 27091 27092# Perl Storable data files. 270930 string perl-store perl Storable (v0.6) data 27094>4 byte >0 (net-order %d) 27095>>4 byte &01 (network-ordered) 27096>>4 byte =3 (major 1) 27097>>4 byte =2 (major 1) 27098 270990 string pst0 perl Storable (v0.7) data 27100>4 byte >0 27101>>4 byte &01 (network-ordered) 27102>>4 byte =5 (major 2) 27103>>4 byte =4 (major 2) 27104>>5 byte >0 (minor %d) 27105 27106# This is Debian #742949 by Zefram <zefram@fysh.org>: 27107# ----------------------------------------------------------- 27108# The Perl module Hash::SharedMem 27109# <https://metacpan.org/release/Hash-SharedMem> defines a file format 27110# for a key/value store. Details of the file format are in the "DESIGN" 27111# file in the module distribution. Magic: 271120 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 27113>8 bequad <0x1000000 27114>>15 byte >2 \b, line size 2^%d byte 27115>>14 byte >2 \b, page size 2^%d byte 27116>>13 byte &1 27117>>>13 byte >1 \b, max fanout %d 271180 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 27119>8 lequad <0x1000000 27120>>8 byte >2 \b, line size 2^%d byte 27121>>9 byte >2 \b, page size 2^%d byte 27122>>10 byte &1 27123>>>10 byte >1 \b, max fanout %d 271240 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 27125>8 bequad <0x1000000 27126>>15 byte >2 \b, line size 2^%d byte 27127>>14 byte >2 \b, page size 2^%d byte 27128>>13 byte &1 27129>>>13 byte >1 \b, max fanout %d 271300 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 27131>8 lequad <0x1000000 27132>>8 byte >2 \b, line size 2^%d byte 27133>>9 byte >2 \b, page size 2^%d byte 27134>>10 byte &1 27135>>>10 byte >1 \b, max fanout %d 27136 27137#------------------------------------------------------------------------------ 27138# $File: pgf,v 1.3 2021/02/23 00:51:10 christos Exp $ 27139# pgf: file(1) magic for Progressive Graphics File (PGF) 27140# 27141# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 27142# 2013 by Philipp Hahn <pmhahn debian org> 271430 string PGF Progressive Graphics image data, 27144!:mime image/x-pgf 27145>3 string 2 version %s, 27146>3 string 4 version %s, 27147>3 string 5 version %s, 27148>3 string 6 version %s, 27149# PGFPreHeader 27150#>>4 lelong x header size %d, 27151# PGFHeader 27152>>8 lelong x %d x 27153>>12 lelong x %d, 27154>>16 byte x %d levels, 27155>>17 byte x compression level %d, 27156>>18 byte x %d bpp, 27157>>19 byte x %d channels, 27158>>20 clear x 27159>>20 byte 0 bitmap, 27160>>20 byte 1 gray scale, 27161>>20 byte 2 indexed color, 27162>>20 byte 3 RGB color, 27163>>20 byte 4 CMYK color, 27164>>20 byte 5 HSL color, 27165>>20 byte 6 HSB color, 27166>>20 byte 7 multi-channel, 27167>>20 byte 8 duo tone, 27168>>20 byte 9 LAB color, 27169>>20 byte 10 gray scale 16, 27170>>20 byte 11 RGB color 48, 27171>>20 byte 12 LAB color 48, 27172>>20 byte 13 CMYK color 64, 27173>>20 byte 14 deep multi-channel, 27174>>20 byte 15 duo tone 16, 27175>>20 byte 17 RGBA color, 27176>>20 byte 18 gray scale 32, 27177>>20 byte 19 RGB color 12, 27178>>20 byte 20 RGB color 16, 27179>>20 byte 255 unknown format, 27180>>20 default x format 27181>>>20 byte x \b %d, 27182>>21 byte x %d bpc 27183# PGFPostHeader 27184# Level-Sizes 27185#>>(4.l+4) lelong x level 0 size: %d 27186#>>(4.l+8) lelong x level 1 size: %d 27187#>>(4.l+12) lelong x level 2 size: %d 27188 27189#------------------------------------------------------------------------------ 27190# $File: pgp,v 1.24 2020/10/14 21:07:29 christos Exp $ 27191# pgp: file(1) magic for Pretty Good Privacy 27192 27193# Handling of binary PGP keys is in pgp-binary-keys. 27194# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 27195# 271960 beshort 0xa600 PGP encrypted data 27197#!:mime application/pgp-encrypted 27198#0 string -----BEGIN\040PGP text/PGP armored data 27199!:mime text/PGP # encoding: armored data 27200#>15 string PUBLIC\040KEY\040BLOCK- public key block 27201#>15 string MESSAGE- message 27202#>15 string SIGNED\040MESSAGE- signed message 27203#>15 string PGP\040SIGNATURE- signature 27204 27205# Update: Joerg Jenderek 27206# URL: http://en.wikipedia.org/wiki/Pretty_Good_Privacy 27207# Reference: https://reposcope.com/mimetype/application/pgp-keys 272082 string ---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK- PGP private key block 27209#!:mime text/PGP 27210!:mime application/pgp-keys 27211!:ext asc 272122 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 27213!:mime application/pgp-keys 27214!:ext asc 27215>10 search/100 \n\n 27216>>&0 use pgp 272170 string -----BEGIN\040PGP\040MESSAGE- PGP message 27218# https://reposcope.com/mimetype/application/pgp-encrypted 27219#!:mime application/pgp 27220!:mime application/pgp-encrypted 27221!:ext asc 27222#!:ext asc/pgp/gpg 27223>10 search/100 \n\n 27224>>&0 use pgp 27225# Reference: https://www.gnupg.org/gph/en/manual/x135.html 272260 string -----BEGIN\040PGP\040SIGNED\040MESSAGE- PGP signed message 27227#!:mime text/plain 27228!:mime text/PGP 27229#!:mime application/pgp 27230!:ext asc 272310 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 27232# https://reposcope.com/mimetype/application/pgp-signature 27233!:mime application/pgp-signature 27234!:ext asc 27235>10 search/100 \n\n 27236>>&0 use pgp 27237 27238# Decode the type of the packet based on it's base64 encoding. 27239# Idea from Mark Martinec 27240# The specification is in RFC 4880, section 4.2 and 4.3: 27241# https://tools.ietf.org/html/rfc4880#section-4.2 27242 272430 name pgp 27244>0 byte 0x67 Reserved (old) 27245>0 byte 0x68 Public-Key Encrypted Session Key (old) 27246>0 byte 0x69 Signature (old) 27247>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 27248>0 byte 0x6b One-Pass Signature (old) 27249>0 byte 0x6c Secret-Key (old) 27250>0 byte 0x6d Public-Key (old) 27251>0 byte 0x6e Secret-Subkey (old) 27252>0 byte 0x6f Compressed Data (old) 27253>0 byte 0x70 Symmetrically Encrypted Data (old) 27254>0 byte 0x71 Marker (old) 27255>0 byte 0x72 Literal Data (old) 27256>0 byte 0x73 Trust (old) 27257>0 byte 0x74 User ID (old) 27258>0 byte 0x75 Public-Subkey (old) 27259>0 byte 0x76 Unused (old) 27260>0 byte 0x77 27261>>1 byte&0xc0 0x00 Reserved 27262>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 27263>>1 byte&0xc0 0x80 Signature 27264>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 27265>0 byte 0x78 27266>>1 byte&0xc0 0x00 One-Pass Signature 27267>>1 byte&0xc0 0x40 Secret-Key 27268>>1 byte&0xc0 0x80 Public-Key 27269>>1 byte&0xc0 0xc0 Secret-Subkey 27270>0 byte 0x79 27271>>1 byte&0xc0 0x00 Compressed Data 27272>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 27273>>1 byte&0xc0 0x80 Marker 27274>>1 byte&0xc0 0xc0 Literal Data 27275>0 byte 0x7a 27276>>1 byte&0xc0 0x00 Trust 27277>>1 byte&0xc0 0x40 User ID 27278>>1 byte&0xc0 0x80 Public-Subkey 27279>>1 byte&0xc0 0xc0 Unused [z%x] 27280>0 byte 0x30 27281>>1 byte&0xc0 0x00 Unused [0%x] 27282>>1 byte&0xc0 0x40 User Attribute 27283>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 27284>>1 byte&0xc0 0xc0 Modification Detection Code 27285 27286# magic signatures to detect PGP crypto material (from stef) 27287# detects and extracts metadata from: 27288# - symmetric encrypted packet header 27289# - RSA (e=65537) secret (sub-)keys 27290 27291# 1024b RSA encrypted data 27292 272930 string \x84\x8c\x03 PGP RSA encrypted session key - 27294>3 belong x keyid: %08X 27295>7 belong x %08X 27296>11 byte 0x01 RSA (Encrypt or Sign) 1024b 27297>11 byte 0x02 RSA Encrypt-Only 1024b 27298>12 string \x04\x00 27299>12 string \x03\xff 27300>12 string \x03\xfe 27301>12 string \x03\xfd 27302>12 string \x03\xfc 27303>12 string \x03\xfb 27304>12 string \x03\xfa 27305>12 string \x03\xf9 27306>142 byte 0xd2 . 27307 27308# 2048b RSA encrypted data 27309 273100 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 27311>4 belong x keyid: %08X 27312>8 belong x %08X 27313>12 byte 0x01 RSA (Encrypt or Sign) 2048b 27314>12 byte 0x02 RSA Encrypt-Only 2048b 27315>13 string \x08\x00 27316>13 string \x07\xff 27317>13 string \x07\xfe 27318>13 string \x07\xfd 27319>13 string \x07\xfc 27320>13 string \x07\xfb 27321>13 string \x07\xfa 27322>13 string \x07\xf9 27323>271 byte 0xd2 . 27324 27325# 3072b RSA encrypted data 27326 273270 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 27328>4 belong x keyid: %08X 27329>8 belong x %08X 27330>12 byte 0x01 RSA (Encrypt or Sign) 3072b 27331>12 byte 0x02 RSA Encrypt-Only 3072b 27332>13 string \x0c\x00 27333>13 string \x0b\xff 27334>13 string \x0b\xfe 27335>13 string \x0b\xfd 27336>13 string \x0b\xfc 27337>13 string \x0b\xfb 27338>13 string \x0b\xfa 27339>13 string \x0b\xf9 27340>399 byte 0xd2 . 27341 27342# 4096b RSA encrypted data 27343 273440 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 27345>4 belong x keyid: %08X 27346>8 belong x %08X 27347>12 byte 0x01 RSA (Encrypt or Sign) 4096b 27348>12 byte 0x02 RSA Encrypt-Only 4096b 27349>13 string \x10\x00 27350>13 string \x0f\xff 27351>13 string \x0f\xfe 27352>13 string \x0f\xfd 27353>13 string \x0f\xfc 27354>13 string \x0f\xfb 27355>13 string \x0f\xfa 27356>13 string \x0f\xf9 27357>527 byte 0xd2 . 27358 27359# 8192b RSA encrypted data 27360 273610 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 27362>4 belong x keyid: %08X 27363>8 belong x %08X 27364>12 byte 0x01 RSA (Encrypt or Sign) 8192b 27365>12 byte 0x02 RSA Encrypt-Only 8192b 27366>13 string \x20\x00 27367>13 string \x1f\xff 27368>13 string \x1f\xfe 27369>13 string \x1f\xfd 27370>13 string \x1f\xfc 27371>13 string \x1f\xfb 27372>13 string \x1f\xfa 27373>13 string \x1f\xf9 27374>1039 byte 0xd2 . 27375 27376# 1024b Elgamal encrypted data 27377 273780 string \x85\x01\x0e\x03 PGP Elgamal encrypted session key - 27379>4 belong x keyid: %08X 27380>8 belong x %08X 27381>12 byte 0x10 Elgamal Encrypt-Only 1024b. 27382>13 string \x04\x00 27383>13 string \x03\xff 27384>13 string \x03\xfe 27385>13 string \x03\xfd 27386>13 string \x03\xfc 27387>13 string \x03\xfb 27388>13 string \x03\xfa 27389>13 string \x03\xf9 27390 27391# 2048b Elgamal encrypted data 27392 273930 string \x85\x02\x0e\x03 PGP Elgamal encrypted session key - 27394>4 belong x keyid: %08X 27395>8 belong x %08X 27396>12 byte 0x10 Elgamal Encrypt-Only 2048b. 27397>13 string \x08\x00 27398>13 string \x07\xff 27399>13 string \x07\xfe 27400>13 string \x07\xfd 27401>13 string \x07\xfc 27402>13 string \x07\xfb 27403>13 string \x07\xfa 27404>13 string \x07\xf9 27405 27406# 3072b Elgamal encrypted data 27407 274080 string \x85\x03\x0e\x03 PGP Elgamal encrypted session key - 27409>4 belong x keyid: %08X 27410>8 belong x %08X 27411>12 byte 0x10 Elgamal Encrypt-Only 3072b. 27412>13 string \x0c\x00 27413>13 string \x0b\xff 27414>13 string \x0b\xfe 27415>13 string \x0b\xfd 27416>13 string \x0b\xfc 27417>13 string \x0b\xfb 27418>13 string \x0b\xfa 27419>13 string \x0b\xf9 27420 27421# crypto algo mapper 27422 274230 name crypto 27424>0 byte 0x00 Plaintext or unencrypted data 27425>0 byte 0x01 IDEA 27426>0 byte 0x02 TripleDES 27427>0 byte 0x03 CAST5 (128 bit key) 27428>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 27429>0 byte 0x07 AES with 128-bit key 27430>0 byte 0x08 AES with 192-bit key 27431>0 byte 0x09 AES with 256-bit key 27432>0 byte 0x0a Twofish with 256-bit key 27433 27434# hash algo mapper 27435 274360 name hash 27437>0 byte 0x01 MD5 27438>0 byte 0x02 SHA-1 27439>0 byte 0x03 RIPE-MD/160 27440>0 byte 0x08 SHA256 27441>0 byte 0x09 SHA384 27442>0 byte 0x0a SHA512 27443>0 byte 0x0b SHA224 27444 27445# display public key algorithms as human readable text 274460 name key_algo 27447>0 byte 0x01 RSA (Encrypt or Sign) 27448# keep old look of version 5.28 without parentheses 27449>0 byte 0x02 RSA Encrypt-Only 27450>0 byte 0x03 RSA (Sign-Only) 27451>0 byte 16 ElGamal (Encrypt-Only) 27452>0 byte 17 DSA 27453>0 byte 18 Elliptic Curve 27454>0 byte 19 ECDSA 27455>0 byte 20 ElGamal (Encrypt or Sign) 27456>0 byte 21 Diffie-Hellman 27457>0 default x 27458>>0 ubyte <22 unknown (pub %d) 27459# this should never happen 27460>>0 ubyte >21 invalid (%d) 27461 27462# pgp symmetric encrypted data 27463 274640 byte 0x8c PGP symmetric key encrypted data - 27465>1 byte 0x0d 27466>1 byte 0x0c 27467>2 byte 0x04 27468>3 use crypto 27469>4 byte 0x01 salted - 27470>>5 use hash 27471>>14 byte 0xd2 . 27472>>14 byte 0xc9 . 27473>4 byte 0x03 salted & iterated - 27474>>5 use hash 27475>>15 byte 0xd2 . 27476>>15 byte 0xc9 . 27477 27478# encrypted keymaterial needs s2k & can be checksummed/hashed 27479 274800 name chkcrypto 27481>0 use crypto 27482>1 byte 0x00 Simple S2K 27483>1 byte 0x01 Salted S2K 27484>1 byte 0x03 Salted&Iterated S2K 27485>2 use hash 27486 27487# all PGP keys start with this prolog 27488# containing version, creation date, and purpose 27489 274900 name keyprolog 27491>0 byte 0x04 27492>1 beldate x created on %s - 27493>5 byte 0x01 RSA (Encrypt or Sign) 27494>5 byte 0x02 RSA Encrypt-Only 27495 27496# end of secret keys known signature 27497# contains e=65537 and the prolog to 27498# the encrypted parameters 27499 275000 name keyend 27501>0 string \x00\x11\x01\x00\x01 e=65537 27502>5 use crypto 27503>5 byte 0xff checksummed 27504>>6 use chkcrypto 27505>5 byte 0xfe hashed 27506>>6 use chkcrypto 27507 27508# PGP secret keys contain also the public parts 27509# these vary by bitsize of the key 27510 275110 name x1024 27512>0 use keyprolog 27513>6 string \x03\xfe 27514>6 string \x03\xff 27515>6 string \x04\x00 27516>136 use keyend 27517 275180 name x2048 27519>0 use keyprolog 27520>6 string \x80\x00 27521>6 string \x07\xfe 27522>6 string \x07\xff 27523>264 use keyend 27524 275250 name x3072 27526>0 use keyprolog 27527>6 string \x0b\xfe 27528>6 string \x0b\xff 27529>6 string \x0c\x00 27530>392 use keyend 27531 275320 name x4096 27533>0 use keyprolog 27534>6 string \x10\x00 27535>6 string \x0f\xfe 27536>6 string \x0f\xff 27537>520 use keyend 27538 27539# \x00|\x1f[\xfe\xff]).{1024})' 275400 name x8192 27541>0 use keyprolog 27542>6 string \x20\x00 27543>6 string \x1f\xfe 27544>6 string \x1f\xff 27545>1032 use keyend 27546 27547# depending on the size of the pkt 27548# we branch into the proper key size 27549# signatures defined as x{keysize} 27550 275510 name pgpkey 27552>0 string \x01\xd8 1024b 27553>>2 use x1024 27554>0 string \x01\xeb 1024b 27555>>2 use x1024 27556>0 string \x01\xfb 1024b 27557>>2 use x1024 27558>0 string \x01\xfd 1024b 27559>>2 use x1024 27560>0 string \x01\xf3 1024b 27561>>2 use x1024 27562>0 string \x01\xee 1024b 27563>>2 use x1024 27564>0 string \x01\xfe 1024b 27565>>2 use x1024 27566>0 string \x01\xf4 1024b 27567>>2 use x1024 27568>0 string \x02\x0d 1024b 27569>>2 use x1024 27570>0 string \x02\x03 1024b 27571>>2 use x1024 27572>0 string \x02\x05 1024b 27573>>2 use x1024 27574>0 string \x02\x15 1024b 27575>>2 use x1024 27576>0 string \x02\x00 1024b 27577>>2 use x1024 27578>0 string \x02\x10 1024b 27579>>2 use x1024 27580>0 string \x02\x04 1024b 27581>>2 use x1024 27582>0 string \x02\x06 1024b 27583>>2 use x1024 27584>0 string \x02\x16 1024b 27585>>2 use x1024 27586>0 string \x03\x98 2048b 27587>>2 use x2048 27588>0 string \x03\xab 2048b 27589>>2 use x2048 27590>0 string \x03\xbb 2048b 27591>>2 use x2048 27592>0 string \x03\xbd 2048b 27593>>2 use x2048 27594>0 string \x03\xcd 2048b 27595>>2 use x2048 27596>0 string \x03\xb3 2048b 27597>>2 use x2048 27598>0 string \x03\xc3 2048b 27599>>2 use x2048 27600>0 string \x03\xc5 2048b 27601>>2 use x2048 27602>0 string \x03\xd5 2048b 27603>>2 use x2048 27604>0 string \x03\xae 2048b 27605>>2 use x2048 27606>0 string \x03\xbe 2048b 27607>>2 use x2048 27608>0 string \x03\xc0 2048b 27609>>2 use x2048 27610>0 string \x03\xd0 2048b 27611>>2 use x2048 27612>0 string \x03\xb4 2048b 27613>>2 use x2048 27614>0 string \x03\xc4 2048b 27615>>2 use x2048 27616>0 string \x03\xc6 2048b 27617>>2 use x2048 27618>0 string \x03\xd6 2048b 27619>>2 use x2048 27620>0 string \x05X 3072b 27621>>2 use x3072 27622>0 string \x05k 3072b 27623>>2 use x3072 27624>0 string \x05{ 3072b 27625>>2 use x3072 27626>0 string \x05} 3072b 27627>>2 use x3072 27628>0 string \x05\x8d 3072b 27629>>2 use x3072 27630>0 string \x05s 3072b 27631>>2 use x3072 27632>0 string \x05\x83 3072b 27633>>2 use x3072 27634>0 string \x05\x85 3072b 27635>>2 use x3072 27636>0 string \x05\x95 3072b 27637>>2 use x3072 27638>0 string \x05n 3072b 27639>>2 use x3072 27640>0 string \x05\x7e 3072b 27641>>2 use x3072 27642>0 string \x05\x80 3072b 27643>>2 use x3072 27644>0 string \x05\x90 3072b 27645>>2 use x3072 27646>0 string \x05t 3072b 27647>>2 use x3072 27648>0 string \x05\x84 3072b 27649>>2 use x3072 27650>0 string \x05\x86 3072b 27651>>2 use x3072 27652>0 string \x05\x96 3072b 27653>>2 use x3072 27654>0 string \x07[ 4096b 27655>>2 use x4096 27656>0 string \x07\x18 4096b 27657>>2 use x4096 27658>0 string \x07+ 4096b 27659>>2 use x4096 27660>0 string \x07; 4096b 27661>>2 use x4096 27662>0 string \x07= 4096b 27663>>2 use x4096 27664>0 string \x07M 4096b 27665>>2 use x4096 27666>0 string \x073 4096b 27667>>2 use x4096 27668>0 string \x07C 4096b 27669>>2 use x4096 27670>0 string \x07E 4096b 27671>>2 use x4096 27672>0 string \x07U 4096b 27673>>2 use x4096 27674>0 string \x07. 4096b 27675>>2 use x4096 27676>0 string \x07> 4096b 27677>>2 use x4096 27678>0 string \x07@ 4096b 27679>>2 use x4096 27680>0 string \x07P 4096b 27681>>2 use x4096 27682>0 string \x074 4096b 27683>>2 use x4096 27684>0 string \x07D 4096b 27685>>2 use x4096 27686>0 string \x07F 4096b 27687>>2 use x4096 27688>0 string \x07V 4096b 27689>>2 use x4096 27690>0 string \x0e[ 8192b 27691>>2 use x8192 27692>0 string \x0e\x18 8192b 27693>>2 use x8192 27694>0 string \x0e+ 8192b 27695>>2 use x8192 27696>0 string \x0e; 8192b 27697>>2 use x8192 27698>0 string \x0e= 8192b 27699>>2 use x8192 27700>0 string \x0eM 8192b 27701>>2 use x8192 27702>0 string \x0e3 8192b 27703>>2 use x8192 27704>0 string \x0eC 8192b 27705>>2 use x8192 27706>0 string \x0eE 8192b 27707>>2 use x8192 27708>0 string \x0eU 8192b 27709>>2 use x8192 27710>0 string \x0e. 8192b 27711>>2 use x8192 27712>0 string \x0e> 8192b 27713>>2 use x8192 27714>0 string \x0e@ 8192b 27715>>2 use x8192 27716>0 string \x0eP 8192b 27717>>2 use x8192 27718>0 string \x0e4 8192b 27719>>2 use x8192 27720>0 string \x0eD 8192b 27721>>2 use x8192 27722>0 string \x0eF 8192b 27723>>2 use x8192 27724>0 string \x0eV 8192b 27725>>2 use x8192 27726 27727# PGP RSA (e=65537) secret (sub-)key header 27728 277290 byte 0x97 PGP Secret Sub-key - 27730>1 use pgpkey 277310 byte 0x9d 27732# Update: Joerg Jenderek 27733# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 27734# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 27735>1 ubeshort >0 27736#>1 ubeshort x \b, body length 0x%x 27737# next packet type often 88h,89h~(tag 2)~Signature Packet 27738#>>(1.S+3) ubyte x \b, next packet type 0x%x 27739# skip Dragon.SHR DEMO.INIT by looking for positive version 27740>>3 ubyte >0 27741# skip BUISSON.13 GUITAR1 by looking for low version number 27742>>>3 ubyte <5 PGP Secret Sub-key 27743# sub-key are normally part of secret key. So it does not occur as standalone file 27744#!:ext bin 27745# version 2,3~old 4~new . Comment following line for version 5.28 look 27746>>>>3 ubyte x (v%d) 27747>>>>3 ubyte x - 27748# old versions 2 or 3 but no real example found 27749>>>>3 ubyte <4 27750# 2 byte for key bits in version 5.28 look 27751>>>>>11 ubeshort x %db 27752>>>>>4 beldate x created on %s - 27753# old versions use 2 additional bytes after time stamp 27754#>>>>>8 ubeshort x 0x%x 27755# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 27756>>>>>10 use key_algo 27757>>>>>(11.S/8) ubequad x 27758# look after first key 27759>>>>>>&5 use keyend 27760# new version 27761>>>>3 ubyte >3 27762>>>>>9 ubeshort x %db 27763>>>>>4 beldate x created on %s - 27764# display key algorithm 27765>>>>>8 use key_algo 27766>>>>>(9.S/8) ubequad x 27767# look after first key for something like s2k 27768>>>>>>&3 use keyend 27769 27770#------------------------------------------------------------------------------ 27771# $File: pgp-binary-keys,v 1.1 2020/10/14 21:07:29 christos Exp $ 27772# pgp-binary-keys: This file handles pgp binary keys. 27773# 27774# An PGP certificate or message doesn't have a fixed header. Instead, 27775# they are sequences of packets: 27776# 27777# https://tools.ietf.org/html/rfc4880#section-4.3 27778# 27779# whose order conforms to a grammar: 27780# 27781# https://tools.ietf.org/html/rfc4880#section-11 27782# 27783# Happily most packets have a few fields that are constrained, which 27784# allow us to fingerprint them with relatively high certainty. 27785# 27786# A PGP packet is described by a single byte: the so-called CTB. The 27787# high-bit is always set. If bit 6 is set, then it is a so-called 27788# new-style CTB; if bit 6 is clear, then it is a so-called old-style 27789# CTB. Old-style CTBs have only four bits of type information; bits 27790# 1-0 are used to describe the length. New-style CTBs have 6 bits of 27791# type information. 27792# 27793# Following the CTB is the packet's length in bytes. If we blindly 27794# advance the file cursor by this amount past the end of the length 27795# information we come to the next packet. 27796# 27797# Data Structures 27798# =============== 27799# 27800# New Style CTB 27801# ------------- 27802# 27803# https://tools.ietf.org/html/rfc4880#section-4.2.2 27804# 27805# 76543210 27806# ||\----/ 27807# || tag 27808# |always 1 27809# always 1 27810# 27811# Tag bits 7 and 6 set 27812# 0 0xC0 -- Reserved - a packet tag MUST NOT have this value 27813# 1 0xC1 -- Public-Key Encrypted Session Key Packet 27814# 2 0xC2 -- Signature Packet 27815# 3 0xC3 -- Symmetric-Key Encrypted Session Key Packet 27816# 4 0xC4 -- One-Pass Signature Packet 27817# 5 0xC5 -- Secret-Key Packet 27818# 6 0xC6 -- Public-Key Packet 27819# 7 0xC7 -- Secret-Subkey Packet 27820# 8 0xC8 -- Compressed Data Packet 27821# 9 0xC9 -- Symmetrically Encrypted Data Packet 27822# 10 0xCA -- Marker Packet 27823# 11 0xCB -- Literal Data Packet 27824# 12 0xCC -- Trust Packet 27825# 13 0xCD -- User ID Packet 27826# 14 0xCE -- Public-Subkey Packet 27827# 17 0xD1 -- User Attribute Packet 27828# 18 0xD2 -- Sym. Encrypted and Integrity Protected Data Packet 27829# 19 0xD3 -- Modification Detection Code Packet 27830# 60 to 63 -- Private or Experimental Values 27831# 27832# The CTB is followed by the length header, which is densely encoded: 27833# 27834# if length[0] is: 27835# 0..191: one byte length (length[0]) 27836# 192..223: two byte length ((length[0] - 192) * 256 + length[2] + 192 27837# 224..254: four byte length (big endian interpretation of length[1..5]) 27838# 255: partial body encoding 27839# 27840# The partial body encoding is similar to HTTP's chunk encoding. It 27841# is only allowed for container packets (SEIP, Compressed Data and 27842# Literal). 27843# 27844# Old Style CTB 27845# ------------- 27846# 27847# https://tools.ietf.org/html/rfc4880#section-4.2.1 27848# 27849# CTB: 27850# 27851# 76543210 27852# ||\--/\/ 27853# || | length encoding 27854# || tag 27855# |always 0 27856# always 1 27857# 27858# Tag: 27859# 27860# Tag bit 7 set, bits 6, 1, 0 clear 27861# 0 0x80 -- Reserved - a packet tag MUST NOT have this value 27862# 1 0x84 -- Public-Key Encrypted Session Key Packet 27863# 2 0x88 -- Signature Packet 27864# 3 0x8C -- Symmetric-Key Encrypted Session Key Packet 27865# 4 0x90 -- One-Pass Signature Packet 27866# 5 0x94 -- Secret-Key Packet 27867# 6 0x98 -- Public-Key Packet 27868# 7 0x9C -- Secret-Subkey Packet 27869# 8 0xA0 -- Compressed Data Packet 27870# 9 0xA4 -- Symmetrically Encrypted Data Packet 27871# 10 0xA8 -- Marker Packet 27872# 11 0xAC -- Literal Data Packet 27873# 12 0xB0 -- Trust Packet 27874# 13 0xB4 -- User ID Packet 27875# 14 0xB8 -- Public-Subkey Packet 27876# 27877# Length encoding: 27878# 27879# Value 27880# 0 1 byte length (following byte is the length) 27881# 1 2 byte length (following two bytes are the length) 27882# 2 4 byte length (following four bytes are the length) 27883# 3 indeterminate length: natural end of packet, e.g., EOF 27884# 27885# An indeterminate length is only allowed for container packets 27886# (SEIP, Compressed Data and Literal). 27887# 27888# Certificates 27889# ------------ 27890# 27891# We check the first three packets to determine if a sequence of 27892# OpenPGP packets is likely to be a certificate. The grammar allows 27893# the following prefixes: 27894# 27895# [Primary Key] [SIG] (EOF or another certificate) 27896# [Primary Key] [SIG] [User ID] [SIG]... 27897# [Primary Key] [SIG] [User Attribute] [SIG]... 27898# [Primary Key] [SIG] [Subkey] [SIG]... 27899# [Primary Key] [User ID] [SIG]... 27900# [Primary Key] [User Attribute] [SIG]... 27901# [Primary Key] [Subkey] [SIG]... 27902# 27903# Any number of marker packets are also allowed between each packet, 27904# but they are not normally used and we don't currently check for 27905# them. 27906# 27907# The keys and subkeys may be public or private. 27908# 27909 27910# Key packets and signature packets are versioned. There are two 27911# packet versions that we need to worry about in practice: v3 and v4. 27912# v4 packets were introduced in RFC 2440, which was published in 1998. 27913# It also deprecated v3 packets. There are no actively used v3 27914# certificates (GnuPG removed the code to support them in November 27915# 2014). But there are v3 keys lying around and it is useful to 27916# identify them. The next version of OpenPGP will introduce v5 keys. 27917# The document has not yet been standardized so changes are still 27918# possible. But, for our purposes, it appears that v5 data structures 27919# will be identical to v4 data structures modulo the version number. 27920# 27921# https://tools.ietf.org/html/rfc2440 27922# https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html 27923# https://www.ietf.org/id/draft-ietf-openpgp-rfc4880bis-09.html#name-key-material-packet 27924 27925 27926 27927 27928# The first packet has to be a public key or a secret key. 27929# 27930# New-Style Public Key 279310 ubyte =0xC6 OpenPGP Public Key 27932>&0 use primary_key_length_new 27933# New-Style Secret Key 279340 ubyte =0xC5 OpenPGP Secret Key 27935>&0 use primary_key_length_new 27936# Old-Style Public Key 279370 ubyte&0xFC =0x98 OpenPGP Public Key 27938>&-1 use primary_key_length_old 27939# Old-Style Secret Key 279400 ubyte&0xFC =0x94 OpenPGP Secret Key 27941>&-1 use primary_key_length_old 27942 27943# Parse the length, check the packet's body and finally advance to the 27944# next packet. 27945 27946# There are 4 different new-style length encodings, but the partial 27947# body encoding is only acceptable for the SEIP, Compressed Data, and 27948# Literal packets, which isn't valid for any packets in a certificate 27949# so we ignore it. 279500 name primary_key_length_new 27951>&0 ubyte <192 27952#>>&0 ubyte x (1 byte length encoding, %d bytes) 27953>>&0 use pgp_binary_key_pk_check 27954>>>&(&-1.B) use sig_or_component_1 27955>&0 ubyte >191 27956>>&-1 ubyte <225 27957# offset = ((offset[0] - 192) << 8) + offset[1] + 192 (for the length header) 27958# raw - (192 * 256 - 192) 27959# = 48960 27960#>>>&0 ubeshort x (2 byte length encoding, %d bytes) 27961>>>&1 use pgp_binary_key_pk_check 27962>>>>&(&-2.S-48960) use sig_or_component_1 27963>&0 ubyte =255 27964#>>&0 belong x (5 byte length encoding, %d bytes) 27965>>&4 use pgp_binary_key_pk_check 27966>>>&(&-4.L) use sig_or_component_1 27967# Partial body encoding (only valid for container packets). 27968# >&0 ubyte >224 27969# >>&0 ubyte <255 partial body encoding 27970 27971# There are 4 different old-style length encodings, but the 27972# indeterminate length encoding is only acceptable for the SEIP, 27973# Compressed Data, and Literal packets, which isn't valid for any 27974# packets in a certificate. 279750 name primary_key_length_old 27976#>&0 ubyte x (ctb: %x) 27977>&0 ubyte&0x3 =0 27978#>>&0 ubyte x (1 byte length encoding, %d bytes) 27979>>&1 use pgp_binary_key_pk_check 27980>>>&(&-1.B) use sig_or_component_1 27981>&0 ubyte&0x3 =1 27982#>>&0 ubeshort x (2 byte length encoding, %d bytes) 27983>>&2 use pgp_binary_key_pk_check 27984>>>&(&-2.S) use sig_or_component_1 27985>&0 ubyte&0x3 =2 27986#>>&0 ubelong x (4 byte length encoding, %d bytes) 27987>>&4 use pgp_binary_key_pk_check 27988>>>&(&-4.L) use sig_or_component_1 27989 27990# Check the Key. 27991# 27992# https://tools.ietf.org/html/rfc4880#section-5.5.2 279930 name pgp_binary_key_pk_check 27994# Valid versions are: 2, 3, 4. 5 is proposed in RFC 4880bis. 27995# Anticipate a v6 / v7 format that like v5 is compatible with v4. 27996# key format in a decade or so :D. 27997>&0 ubyte >1 27998>>&-1 ubyte <8 27999>>>&-1 byte x Version %d 28000# Check that keys were created after 1990. 28001# (1990 - 1970) * 365.2524 * 24 * 60 * 60 = 631156147 28002>>>&0 bedate >631156147 \b, Created %s 28003>>>>&-5 ubyte >3 28004>>>>>&4 use pgp_binary_key_algo 28005>>>>&-5 ubyte <4 28006>>>>>&6 use pgp_binary_key_algo 28007 28008# Print out the key's algorithm and the number of bits, if this is 28009# relevant (ECC keys are a fixed size). 280100 name pgp_binary_key_algo 28011>0 clear x 28012>&0 ubyte =1 \b, RSA (Encrypt or Sign, 28013>>&0 ubeshort x \b %d bits) 28014>&0 ubyte =2 \b, RSA (Encrypt, 28015>>&0 ubeshort x \b %d bits) 28016>&0 ubyte =3 \b, RSA (Sign, 28017>>&0 ubeshort x \b %d bits) 28018>&0 ubyte =16 \b, El Gamal (Encrypt, 28019>>&0 ubeshort x \b %d bits) 28020>&0 ubyte =17 \b, DSA 28021>>&0 ubeshort x \b (%d bits) 28022>&0 ubyte =18 \b, ECDH 28023>&0 ubyte =19 \b, ECDSA 28024>&0 ubyte =20 \b, El Gamal (Encrypt or Sign, 28025>>&0 ubeshort x \b %d bits) 28026>&0 ubyte =22 \b, EdDSA 28027>&0 default x 28028>>&0 ubyte x \b, Unknown Algorithm (0x%x) 28029 28030# Match all possible second packets. 280310 name sig_or_component_1 28032#>0 ubyte x (ctb: %x) 28033>&0 ubyte =0xC2 28034>>0 ubyte x \b; Signature 28035>>&0 use sig_or_component_1_length_new 28036>&0 ubyte =0xCD 28037>>0 ubyte x \b; User ID 28038>>&0 use sig_or_component_1_length_new 28039>&0 ubyte =0xCE 28040>>0 ubyte x \b; Public Subkey 28041>>&0 use sig_or_component_1_length_new 28042>&0 ubyte =0xC7 28043>>0 ubyte x \b; Secret Subkey 28044>>&0 use sig_or_component_1_length_new 28045>&0 ubyte =0xD1 28046>>0 ubyte x \b; User Attribute 28047>>&0 use sig_or_component_1_length_new 28048>&0 ubyte&0xFC =0x88 28049>>0 ubyte x \b; Signature 28050>>&-1 use sig_or_component_1_length_old 28051>&0 ubyte&0xFC =0xB4 28052>>0 ubyte x \b; User ID 28053>>&-1 use sig_or_component_1_length_old 28054>&0 ubyte&0xFC =0xB8 28055>>0 ubyte x \b; Public Subkey 28056>>&-1 use sig_or_component_1_length_old 28057>&0 ubyte&0xFC =0x9C 28058>>0 ubyte x \b; Secret Subkey 28059>>&-1 use sig_or_component_1_length_old 28060 28061# Copy of 'primary_key_length_new', but calls cert_packet_3. 280620 name sig_or_component_1_length_new 28063>&0 ubyte <192 28064#>>&0 ubyte x (1 byte new length encoding, %d bytes) 28065>>&(&-1.B) use cert_packet_3 28066>&0 ubyte >191 28067>>&-1 ubyte <225 28068# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header) 28069# raw - (192 * 256 - 192 - 1) 28070# = 48959 28071#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes) 28072>>>&(&-1.S-48959) use cert_packet_3 28073>&0 ubyte =255 28074#>>&0 belong x (5 byte new length encoding, %d bytes) 28075>>&(&-4.L) use cert_packet_3 28076# Partial body encoding (only valid for container packets). 28077# >&0 ubyte >224 28078# >>&0 ubyte <255 partial body encoding 28079 280800 name sig_or_component_1_length_old 28081#>&0 ubyte x (ctb: %x) 28082>&0 ubyte&0x3 =0 28083#>>&0 ubyte x (1 byte old length encoding, %d bytes) 28084>>&(&0.B+1) use cert_packet_3 28085>&0 ubyte&0x3 =1 28086#>>&0 ubeshort x (2 byte old length encoding, %d bytes) 28087>>&(&0.S+2) use cert_packet_3 28088>&0 ubyte&0x3 =2 28089#>>&0 ubelong x (4 byte old length encoding, %d bytes) 28090>>&(&0.L+4) use cert_packet_3 28091 28092# Copy of above. 280930 name cert_packet_3 28094#>0 ubyte x (ctb: %x) 28095>&0 ubyte =0xC2 28096>>0 ubyte x \b; Signature 28097>>&0 use cert_packet_3_length_new 28098>&0 ubyte =0xCD 28099>>0 ubyte x \b; User ID 28100>>&0 use cert_packet_3_length_new 28101>&0 ubyte =0xCE 28102>>0 ubyte x \b; Public Subkey 28103>>&0 use cert_packet_3_length_new 28104>&0 ubyte =0xC7 28105>>0 ubyte x \b; Secret Subkey 28106>>&0 use cert_packet_3_length_new 28107>&0 ubyte =0xD1 28108>>0 ubyte x \b; User Attribute 28109>>&0 use cert_packet_3_length_new 28110>&0 ubyte&0xFC =0x88 28111>>0 ubyte x \b; Signature 28112>>&-1 use cert_packet_3_length_old 28113>&0 ubyte&0xFC =0xB4 28114>>0 ubyte x \b; User ID 28115>>&-1 use cert_packet_3_length_old 28116>&0 ubyte&0xFC =0xB8 28117>>0 ubyte x \b; Public Subkey 28118>>&-1 use cert_packet_3_length_old 28119>&0 ubyte&0xFC =0x9C 28120>>0 ubyte x \b; Secret Subkey 28121>>&-1 use cert_packet_3_length_old 28122 28123# Copy of above. 281240 name cert_packet_3_length_new 28125>&0 ubyte <192 28126#>>&0 ubyte x (1 byte new length encoding, %d bytes) 28127>>&(&-1.B) use pgp_binary_keys_end 28128>&0 ubyte >191 28129>>&-1 ubyte <225 28130# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header) 28131# raw - (192 * 256 - 192 - 1) 28132# = 48959 28133#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes) 28134>>>&(&-1.S-48959) use pgp_binary_keys_end 28135>&0 ubyte =255 28136#>>&0 belong x (5 byte new length encoding, %d bytes) 28137>>&(&-4.L) use pgp_binary_keys_end 28138 281390 name cert_packet_3_length_old 28140#>&0 ubyte x (ctb: %x) 28141>&0 ubyte&0x3 =0 28142#>>&0 ubyte x (1 byte old length encoding, %d bytes) 28143>>&(&0.B+1) use pgp_binary_keys_end 28144>&0 ubyte&0x3 =1 28145#>>&0 ubeshort x (2 byte old length encoding, %d bytes) 28146>>&(&0.S+2) use pgp_binary_keys_end 28147>&0 ubyte&0x3 =2 28148#>>&0 ubelong x (4 byte old length encoding, %d bytes) 28149>>&(&0.L+4) use pgp_binary_keys_end 28150 28151# We managed to parse the first three packets of the certificate. Declare 28152# victory. 281530 name pgp_binary_keys_end 28154>0 byte x \b; OpenPGP Certificate 28155!:mime application/pgp-keys 28156!:ext pgp/gpg/pkr/asd 28157 28158#------------------------------------------------------------------------------ 28159# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 28160# pkgadd: file(1) magic for SysV R4 PKG Datastreams 28161# 281620 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 28163!:mime application/x-svr4-package 28164 28165#------------------------------------------------------------------------------ 28166# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 28167# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 28168# From: "Stefan A. Haubenthal" <polluks@web.de> 28169# 281700 belong 0x00000107 Plan 9 executable, Motorola 68k 281710 belong 0x000001EB Plan 9 executable, Intel 386 281720 belong 0x00000247 Plan 9 executable, Intel 960 281730 belong 0x000002AB Plan 9 executable, SPARC 281740 belong 0x00000407 Plan 9 executable, MIPS R3000 281750 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 281760 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 281770 belong 0x000005AB Plan 9 executable, AMD 29000 281780 belong 0x00000647 Plan 9 executable, ARM 7-something 281790 belong 0x000006EB Plan 9 executable, PowerPC 281800 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 281810 belong 0x0000084B Plan 9 executable, DEC Alpha 28182 28183#------------------------------------------------------------------------------ 28184# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 28185# plus5: file(1) magic for Plus Five's UNIX MUMPS 28186# 28187# XXX - byte order? Paging Hokey.... 28188# 281890 short 0x259 mumps avl global 28190>2 byte >0 (V%d) 28191>6 byte >0 with %d byte name 28192>7 byte >0 and %d byte data cells 281930 short 0x25a mumps blt global 28194>2 byte >0 (V%d) 28195>8 short >0 - %d byte blocks 28196>15 byte 0x00 - P/D format 28197>15 byte 0x01 - P/K/D format 28198>15 byte 0x02 - K/D format 28199>15 byte >0x02 - Bad Flags 28200 28201#------------------------------------------------------------------------------ 28202# $File: pmem,v 1.3 2019/06/13 11:45:44 christos Exp $ 28203# pmem: file(1) magic for Persistent Memory Development Kit pool files 28204# 282050 string PMEM 28206>4 string POOLSET Persistent Memory Poolset file 28207>>11 search REPLICA with replica 28208>4 regex LOG|BLK|OBJ Persistent Memory Pool file, type: %s, 28209>>8 lelong >0 version: 0x%x, 28210>>12 lelong x compat: 0x%x, 28211>>16 lelong x incompat: 0x%x, 28212>>20 lelong x ro_compat: 0x%x, 28213 28214 28215>>120 leqldate x crtime: %s, 28216>>128 lequad x alignment_desc: 0x%016llx, 28217 28218>>136 clear x 28219>>136 byte 2 machine_class: 64-bit, 28220>>136 default x machine_class: unknown 28221>>>136 byte x (0x%d), 28222 28223>>137 clear x 28224>>137 byte 1 data: little-endian, 28225>>137 byte 2 data: big-endian, 28226>>137 default x data: unknown 28227>>>137 byte x (0x%d), 28228 28229>>138 byte !0 reserved[0]: %d, 28230>>139 byte !0 reserved[1]: %d, 28231>>140 byte !0 reserved[2]: %d, 28232>>141 byte !0 reserved[3]: %d, 28233 28234>>142 clear x 28235>>142 leshort 62 machine: x86_64 28236>>142 leshort 183 machine: aarch64 28237>>142 default x machine: unknown 28238>>>142 leshort x (0x%d) 28239 28240>4 string BLK 28241>>4096 lelong x \b, blk.bsize: %d 28242 28243>4 string OBJ 28244>>4096 string >0 \b, obj.layout: '%s' 28245>>4096 string <0 \b, obj.layout: NULL 28246 28247#------------------------------------------------------------------------------ 28248# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $ 28249# polyml: file(1) magic for PolyML 28250# 28251# PolyML 28252# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 28253# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 28254 28255# [0]: https://www.polyml.org/ 28256# [1]: https://github.com/polyml/polyml/blob/master/\ 28257# libpolyml/savestate.cpp#L146-L147 28258# [2]: https://github.com/polyml/polyml/blob/master/\ 28259# libpolyml/savestate.cpp#L1262-L1263 28260 28261# Type: Poly/ML saved data 28262# From: Matthew Fernandez <matthew.fernandez@gmail.com> 28263 282640 string POLYSAVE Poly/ML saved state 28265>8 long x version %u 28266 282670 string POLYMODU Poly/ML saved module 28268>8 long x version %u 28269 28270#------------------------------------------------------------------------------ 28271# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $ 28272# printer: file(1) magic for printer-formatted files 28273# 28274 28275# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 282760 string %! PostScript document text 28277!:mime application/postscript 28278!:apple ASPSTEXT 28279>2 string PS-Adobe- conforming 28280>>11 string >\0 DSC level %.3s 28281>>>15 string EPS \b, type %s 28282>>>15 string Query \b, type %s 28283>>>15 string ExitServer \b, type %s 28284>>>15 search/1000 %%LanguageLevel:\040 28285>>>>&0 string >\0 \b, Level %s 28286# Some PCs have the annoying habit of adding a ^D as a document separator 282870 string \004%! PostScript document text 28288!:mime application/postscript 28289!:apple ASPSTEXT 28290>3 string PS-Adobe- conforming 28291>>12 string >\0 DSC level %.3s 28292>>>16 string EPS \b, type %s 28293>>>16 string Query \b, type %s 28294>>>16 string ExitServer \b, type %s 28295>>>16 search/1000 %%LanguageLevel:\040 28296>>>>&0 string >\0 \b, Level %s 282970 string \033%-12345X%!PS PostScript document 28298 28299# DOS EPS Binary File Header 28300# From: Ed Sznyter <ews@Black.Market.NET> 283010 belong 0xC5D0D3C6 DOS EPS Binary File 28302>4 long >0 Postscript starts at byte %d 28303>>8 long >0 length %d 28304>>>12 long >0 Metafile starts at byte %d 28305>>>>16 long >0 length %d 28306>>>20 long >0 TIFF starts at byte %d 28307>>>>24 long >0 length %d 28308 28309# Summary: Adobe's PostScript Printer Description File 28310# Extension: .ppd 28311# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 28312# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 28313# 283140 string *PPD-Adobe:\x20 PPD file 28315>&0 string x \b, version %s 28316 28317# HP Printer Job Language 283180 string \033%-12345X@PJL HP Printer Job Language data 28319# HP Printer Job Language 28320# The header found on Win95 HP plot files is the "Silliest Thing possible" 28321# (TM) 28322# Every driver puts the language at some random position, with random case 28323# (LANGUAGE and Language) 28324# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 28325# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 28326# 283270 string \033%-12345X@PJL HP Printer Job Language data 28328>&0 string >\0 %s 28329>>&0 string >\0 %s 28330>>>&0 string >\0 %s 28331>>>>&0 string >\0 %s 28332#>15 string \ ENTER\ LANGUAGE\ = 28333#>31 string PostScript PostScript 28334 28335# From: Stefan Thurner <thurners@nicsys.de> 283360 string \033%-12345X@PJL 28337>&0 search/10000 %! PJL encapsulated PostScript document text 28338 28339# Rick Richardson <rickrich@gmail.com> 28340 28341# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 28342# For Oki Data Printers - HIPERC 28343# For Konica Minolta Printers - LAVAFLOW 28344# For Samsung Printers - QPDL 28345# For HP Printers - ZJS stands for Zenographics ZJStream 283460 string \033%-12345X@PJL HP Printer Job Language data 28347>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 28348>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 28349>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 28350>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 28351>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 28352>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 28353 28354 28355# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 283560 string \033E\033 HP PCL printer data 28357>3 string \&l0A - default page size 28358>3 string \&l1A - US executive page size 28359>3 string \&l2A - US letter page size 28360>3 string \&l3A - US legal page size 28361>3 string \&l26A - A4 page size 28362>3 string \&l80A - Monarch envelope size 28363>3 string \&l81A - No. 10 envelope size 28364>3 string \&l90A - Intl. DL envelope size 28365>3 string \&l91A - Intl. C5 envelope size 28366>3 string \&l100A - Intl. B5 envelope size 28367>3 string \&l-81A - No. 10 envelope size (landscape) 28368>3 string \&l-90A - Intl. DL envelope size (landscape) 28369 28370# IMAGEN printer-ready files: 283710 string @document( Imagen printer 28372# this only works if "language xxx" is first item in Imagen header. 28373>10 string language\ impress (imPRESS data) 28374>10 string language\ daisy (daisywheel text) 28375>10 string language\ diablo (daisywheel text) 28376>10 string language\ printer (line printer emulation) 28377>10 string language\ tektronix (Tektronix 4014 emulation) 28378# Add any other languages that your Imagen uses - remember 28379# to keep the word `text' if the file is human-readable. 28380# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 28381# 28382# Now magic for IMAGEN font files... 283830 string Rast RST-format raster font data 28384>45 string >0 face %s 28385# From Jukka Ukkonen 283860 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 28387 28388# From <mike@flyn.org> 28389# These are the /etc/magic entries to decode data sent to an Epson printer. 283900 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 28391 28392 28393#------------------------------------------------------------------------------ 28394# zenographics: file(1) magic for Zenographics ZjStream printer data 28395# Rick Richardson <rickrich@gmail.com> 283960 string JZJZ 28397>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 283980 string ZJZJ 28399>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 28400 28401 28402#------------------------------------------------------------------------------ 28403# Oak Technologies printer stream 28404# Rick Richardson <rickrich@gmail.com> 284050 string OAK 28406>0x07 byte 0 28407>0x0b byte 0 Oak Technologies printer stream 28408 28409# This would otherwise be recognized as PostScript - nick@debian.org 284100 string %!VMF SunClock's Vector Map Format data 28411 28412#------------------------------------------------------------------------------ 28413# HP LaserJet 1000 series downloadable firmware file 284140 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 28415 28416# From: Paolo <oopla@users.sf.net> 28417# Epson ESC/Page, ESC/PageColor 284180 string \x1b\x01@EJL Epson ESC/Page language printer data 28419 28420#------------------------------------------------------------------------------ 28421# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $ 28422# project: file(1) magic for Project management 28423# 28424# Magic strings for ftnchek project files. Alexander Mai 284250 string FTNCHEK_\ P project file for ftnchek 28426>10 string 1 version 2.7 28427>10 string 2 version 2.8 to 2.10 28428>10 string 3 version 2.11 or later 28429 28430#------------------------------------------------------------------------------ 28431# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $ 28432# psdbms: file(1) magic for psdatabase 28433# 28434# Update: Joerg Jenderek 28435# GRR: line below too general as it catches also some Panorama database *.pan , 28436# AppleWorks word processor 284370 belong&0xff00ffff 0x56000000 28438# assume version starts with digit 28439>1 regex/s =^[0-9] ps database 28440>>1 string >\0 version %s 28441# kernel name 28442>>4 string >\0 from kernel %s 28443 28444#------------------------------------------------------------------------------ 28445# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $ 28446# psl: file(1) magic for Public Suffix List representations 28447# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> 28448# URL: https://publicsuffix.org 28449# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166 28450 284510 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data 28452 284530 string .DAFSA@PSL_ 28454>15 string \n Public Suffix List data (optimized) 28455>>11 byte >0x2f 28456>>>11 byte <0x3a (Version %c) 28457 28458#------------------------------------------------------------------------------ 28459# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 28460# pulsar: file(1) magic for Pulsar POP3 daemon binary files 28461# 28462# http://pulsar.sourceforge.net 28463# mailto:rok.papez@lugos.si 28464# 28465 284660 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 28467>4 ubelong x Version: %d. 28468>8 ubelong x \b%d 28469 28470 28471#------------------------------------------------------------------------------ 28472# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $ 28473# pwsafe: file(1) magic for passwordsafe file 28474# 28475# Password Safe 28476# http://passwordsafe.sourceforge.net/ 28477# file format specs 28478# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 28479# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 28480# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 28481# V2 and V1 have no easy identifier that I can find 28482# .psafe3 284830 string PWS3 Password Safe V3 database 28484 28485#------------------------------------------------------------------------------ 28486# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 28487# pyramid: file(1) magic for Pyramids 28488# 28489# XXX - byte order? 28490# 284910 long 0x50900107 Pyramid 90x family executable 284920 long 0x50900108 Pyramid 90x family pure executable 28493>16 long >0 not stripped 284940 long 0x5090010b Pyramid 90x family demand paged pure executable 28495>16 long >0 not stripped 28496 28497#------------------------------------------------------------------------------ 28498# $File: python,v 1.42 2020/06/04 00:22:50 christos Exp $ 28499# python: file(1) magic for python 28500# 28501# Outlook puts """ too for urgent messages 28502# From: David Necas <yeti@physics.muni.cz> 28503# often the module starts with a multiline string 285040 string/t """ Python script text executable 28505# MAGIC as specified in Python/import.c (1.0 to 3.7) 28506# two bytes of magic followed by "\r\n" in little endian order 285070 belong 0x02099900 python 1.0 byte-compiled 28508!:mime text/x-bytecode.python 285090 belong 0x03099900 python 1.1/1.2 byte-compiled 28510!:mime text/x-bytecode.python 285110 belong 0x892e0d0a python 1.3 byte-compiled 28512!:mime text/x-bytecode.python 285130 belong 0x04170d0a python 1.4 byte-compiled 28514!:mime text/x-bytecode.python 285150 belong 0x994e0d0a python 1.5 byte-compiled 28516!:mime text/x-bytecode.python 285170 belong 0xfcc40d0a python 1.6 byte-compiled 28518!:mime text/x-bytecode.python 285190 belong 0xfdc40d0a python 1.6 byte-compiled 28520!:mime text/x-bytecode.python 285210 belong 0x87c60d0a python 2.0 byte-compiled 28522!:mime text/x-bytecode.python 285230 belong 0x88c60d0a python 2.0 byte-compiled 28524!:mime text/x-bytecode.python 285250 belong 0x2aeb0d0a python 2.1 byte-compiled 28526!:mime text/x-bytecode.python 285270 belong 0x2beb0d0a python 2.1 byte-compiled 28528!:mime text/x-bytecode.python 285290 belong 0x2ded0d0a python 2.2 byte-compiled 28530!:mime text/x-bytecode.python 285310 belong 0x2eed0d0a python 2.2 byte-compiled 28532!:mime text/x-bytecode.python 285330 belong 0x3bf20d0a python 2.3 byte-compiled 28534!:mime text/x-bytecode.python 285350 belong 0x3cf20d0a python 2.3 byte-compiled 28536!:mime text/x-bytecode.python 285370 belong 0x45f20d0a python 2.3 byte-compiled 28538!:mime text/x-bytecode.python 285390 belong 0x59f20d0a python 2.4 byte-compiled 28540!:mime text/x-bytecode.python 285410 belong 0x63f20d0a python 2.4 byte-compiled 28542!:mime text/x-bytecode.python 285430 belong 0x6df20d0a python 2.4 byte-compiled 28544!:mime text/x-bytecode.python 285450 belong 0x6ef20d0a python 2.4 byte-compiled 28546!:mime text/x-bytecode.python 285470 belong 0x77f20d0a python 2.5 byte-compiled 28548!:mime text/x-bytecode.python 285490 belong 0x81f20d0a python 2.5 byte-compiled 28550!:mime text/x-bytecode.python 285510 belong 0x8bf20d0a python 2.5 byte-compiled 28552!:mime text/x-bytecode.python 285530 belong 0x8cf20d0a python 2.5 byte-compiled 28554!:mime text/x-bytecode.python 285550 belong 0x95f20d0a python 2.5 byte-compiled 28556!:mime text/x-bytecode.python 285570 belong 0x9ff20d0a python 2.5 byte-compiled 28558!:mime text/x-bytecode.python 285590 belong 0xa9f20d0a python 2.5 byte-compiled 28560!:mime text/x-bytecode.python 285610 belong 0xb3f20d0a python 2.5 byte-compiled 28562!:mime text/x-bytecode.python 285630 belong 0xb4f20d0a python 2.5 byte-compiled 28564!:mime text/x-bytecode.python 285650 belong 0xc7f20d0a python 2.6 byte-compiled 28566!:mime text/x-bytecode.python 285670 belong 0xd1f20d0a python 2.6 byte-compiled 28568!:mime text/x-bytecode.python 285690 belong 0xd2f20d0a python 2.6 byte-compiled 28570!:mime text/x-bytecode.python 285710 belong 0xdbf20d0a python 2.7 byte-compiled 28572!:mime text/x-bytecode.python 285730 belong 0xe5f20d0a python 2.7 byte-compiled 28574!:mime text/x-bytecode.python 285750 belong 0xeff20d0a python 2.7 byte-compiled 28576!:mime text/x-bytecode.python 285770 belong 0xf9f20d0a python 2.7 byte-compiled 28578!:mime text/x-bytecode.python 285790 belong 0x03f30d0a python 2.7 byte-compiled 28580!:mime text/x-bytecode.python 285810 belong 0x04f30d0a python 2.7 byte-compiled 28582!:mime text/x-bytecode.python 285830 belong 0xb80b0d0a python 3.0 byte-compiled 28584!:mime text/x-bytecode.python 285850 belong 0xc20b0d0a python 3.0 byte-compiled 28586!:mime text/x-bytecode.python 285870 belong 0xcc0b0d0a python 3.0 byte-compiled 28588!:mime text/x-bytecode.python 285890 belong 0xd60b0d0a python 3.0 byte-compiled 28590!:mime text/x-bytecode.python 285910 belong 0xe00b0d0a python 3.0 byte-compiled 28592!:mime text/x-bytecode.python 285930 belong 0xea0b0d0a python 3.0 byte-compiled 28594!:mime text/x-bytecode.python 285950 belong 0xf40b0d0a python 3.0 byte-compiled 28596!:mime text/x-bytecode.python 285970 belong 0xf50b0d0a python 3.0 byte-compiled 28598!:mime text/x-bytecode.python 285990 belong 0xff0b0d0a python 3.0 byte-compiled 28600!:mime text/x-bytecode.python 286010 belong 0x090c0d0a python 3.0 byte-compiled 28602!:mime text/x-bytecode.python 286030 belong 0x130c0d0a python 3.0 byte-compiled 28604!:mime text/x-bytecode.python 286050 belong 0x1d0c0d0a python 3.0 byte-compiled 28606!:mime text/x-bytecode.python 286070 belong 0x1f0c0d0a python 3.0 byte-compiled 28608!:mime text/x-bytecode.python 286090 belong 0x270c0d0a python 3.0 byte-compiled 28610!:mime text/x-bytecode.python 286110 belong 0x3b0c0d0a python 3.0 byte-compiled 28612!:mime text/x-bytecode.python 286130 belong 0x450c0d0a python 3.1 byte-compiled 28614!:mime text/x-bytecode.python 286150 belong 0x4f0c0d0a python 3.1 byte-compiled 28616!:mime text/x-bytecode.python 286170 belong 0x580c0d0a python 3.2 byte-compiled 28618!:mime text/x-bytecode.python 286190 belong 0x620c0d0a python 3.2 byte-compiled 28620!:mime text/x-bytecode.python 286210 belong 0x6c0c0d0a python 3.2 byte-compiled 28622!:mime text/x-bytecode.python 286230 belong 0x760c0d0a python 3.3 byte-compiled 28624!:mime text/x-bytecode.python 286250 belong 0x800c0d0a python 3.3 byte-compiled 28626!:mime text/x-bytecode.python 286270 belong 0x8a0c0d0a python 3.3 byte-compiled 28628!:mime text/x-bytecode.python 286290 belong 0x940c0d0a python 3.3 byte-compiled 28630!:mime text/x-bytecode.python 286310 belong 0x9e0c0d0a python 3.3 byte-compiled 28632!:mime text/x-bytecode.python 286330 belong 0xb20c0d0a python 3.4 byte-compiled 28634!:mime text/x-bytecode.python 286350 belong 0xbc0c0d0a python 3.4 byte-compiled 28636!:mime text/x-bytecode.python 286370 belong 0xc60c0d0a python 3.4 byte-compiled 28638!:mime text/x-bytecode.python 286390 belong 0xd00c0d0a python 3.4 byte-compiled 28640!:mime text/x-bytecode.python 286410 belong 0xda0c0d0a python 3.4 byte-compiled 28642!:mime text/x-bytecode.python 286430 belong 0xe40c0d0a python 3.4 byte-compiled 28644!:mime text/x-bytecode.python 286450 belong 0xee0c0d0a python 3.4 byte-compiled 28646!:mime text/x-bytecode.python 286470 belong 0xf80c0d0a python 3.5.1- byte-compiled 28648!:mime text/x-bytecode.python 286490 belong 0x020d0d0a python 3.5.1- byte-compiled 28650!:mime text/x-bytecode.python 286510 belong 0x0c0d0d0a python 3.5.1- byte-compiled 28652!:mime text/x-bytecode.python 286530 belong 0x160d0d0a python 3.5.1- byte-compiled 28654!:mime text/x-bytecode.python 286550 belong 0x170d0d0a python 3.5.2+ byte-compiled 28656!:mime text/x-bytecode.python 286570 belong 0x200d0d0a python 3.6 byte-compiled 28658!:mime text/x-bytecode.python 286590 belong 0x210d0d0a python 3.6 byte-compiled 28660!:mime text/x-bytecode.python 286610 belong 0x2a0d0d0a python 3.6 byte-compiled 28662!:mime text/x-bytecode.python 286630 belong 0x2b0d0d0a python 3.6 byte-compiled 28664!:mime text/x-bytecode.python 286650 belong 0x2c0d0d0a python 3.6 byte-compiled 28666!:mime text/x-bytecode.python 286670 belong 0x2d0d0d0a python 3.6 byte-compiled 28668!:mime text/x-bytecode.python 286690 belong 0x2f0d0d0a python 3.6 byte-compiled 28670!:mime text/x-bytecode.python 286710 belong 0x300d0d0a python 3.6 byte-compiled 28672!:mime text/x-bytecode.python 286730 belong 0x310d0d0a python 3.6 byte-compiled 28674!:mime text/x-bytecode.python 286750 belong 0x320d0d0a python 3.6 byte-compiled 28676!:mime text/x-bytecode.python 286770 belong 0x330d0d0a python 3.6 byte-compiled 28678!:mime text/x-bytecode.python 286790 belong 0x3e0d0d0a python 3.7 byte-compiled 28680!:mime text/x-bytecode.python 286810 belong 0x3f0d0d0a python 3.7 byte-compiled 28682!:mime text/x-bytecode.python 286830 belong 0x400d0d0a python 3.7 byte-compiled 28684!:mime text/x-bytecode.python 286850 belong 0x410d0d0a python 3.7 byte-compiled 28686!:mime text/x-bytecode.python 286870 belong 0x420d0d0a python 3.7 byte-compiled 28688!:mime text/x-bytecode.python 286890 belong 0x480d0d0a python 3.8 byte-compiled 28690!:mime text/x-bytecode.python 286910 belong 0x490d0d0a python 3.8 byte-compiled 28692!:mime text/x-bytecode.python 286930 belong 0x520d0d0a python 3.8 byte-compiled 28694!:mime text/x-bytecode.python 286950 belong 0x530d0d0a python 3.8 byte-compiled 28696!:mime text/x-bytecode.python 286970 belong 0x540d0d0a python 3.8 byte-compiled 28698!:mime text/x-bytecode.python 286990 belong 0x550d0d0a python 3.8 byte-compiled 28700!:mime text/x-bytecode.python 287010 belong 0x5c0d0d0a python 3.9 byte-compiled 28702!:mime text/x-bytecode.python 287030 belong 0x5d0d0d0a python 3.9 byte-compiled 28704!:mime text/x-bytecode.python 287050 belong 0x5e0d0d0a python 3.9 byte-compiled 28706!:mime text/x-bytecode.python 287070 belong 0x5f0d0d0a python 3.9 byte-compiled 28708!:mime text/x-bytecode.python 287090 belong 0x600d0d0a python 3.9 byte-compiled 28710!:mime text/x-bytecode.python 287110 belong 0x610d0d0a python 3.9 byte-compiled 28712!:mime text/x-bytecode.python 28713 287140 search/1/w #!\040/usr/bin/python Python script text executable 28715!:strength + 15 28716!:mime text/x-script.python 287170 search/1/w #!\040/usr/local/bin/python Python script text executable 28718!:strength + 15 28719!:mime text/x-script.python 287200 search/10/w #!\040/usr/bin/env\040python Python script text executable 28721!:strength + 15 28722!:mime text/x-script.python 28723 28724 28725# from module.submodule import func1, func2 287260 search/8192 import 28727>0 regex \^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$ Python script text executable 28728!:strength + 15 28729!:mime text/x-script.python 28730 28731# def __init__ (self, ...): 287320 search/4096 def\ __init__ 28733>&0 search/64 self Python script text executable 28734!:strength + 15 28735!:mime text/x-script.python 28736 28737# if __name__ == "__main__": 287380 search/4096 if\ __name__ 28739>&0 search/64 '__main__' Python script text executable 28740>&0 search/64 "__main__" Python script text executable 28741!:strength + 15 28742!:mime text/x-script.python 28743 28744# import module [as abrev] 287450 search/8192 import 28746>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable 28747!:mime text/x-script.python 28748 28749# comments 28750#0 search/4096 ''' 28751#>&0 regex .*'''$ Python script text executable 28752#!:mime text/x-script.python 28753 28754#0 search/4096 """ 28755#>&0 regex .*"""$ Python script text executable 28756#!:mime text/x-script.python 28757 28758# try: 28759# except: or finally: 28760# block 287610 search/4096 try: 28762>&0 regex \^[[:space:]]*except.*:$ Python script text executable 28763!:strength + 15 28764!:mime text/x-script.python 28765>&0 search/4096 finally: Python script text executable 28766!:mime text/x-script.python 28767 28768# class name[(base classes,)]: [pass] 287690 search/8192 class 28770>0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable 28771!:strength + 15 28772!:mime text/x-script.python 28773 28774# def name(*args, **kwargs): 287750 search/8192 def\ 28776>0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100} 28777>>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable 28778!:strength + 15 28779!:mime text/x-script.python 28780 28781# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html 287820 string \223NUMPY NumPy data file 28783!:mime application/x-numpy-data 28784>6 byte x \b, version %d 28785>7 byte x \b.%d 28786#>8 leshort x \b, header length=%d 28787>10 string x \b, description %s 28788 28789#------------------------------------------------------------------------------ 28790# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $ 28791# qt: file(1) magic for Qt 28792 28793# https://doc.qt.io/qt-5/resources.html 287940 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 28795 28796# https://qt.gitorious.org/qt/qtbase/source/\ 28797# 5367fa356233da4c0f28172a8f817791525f5457:\ 28798# src/tools/rcc/rcc.cpp#L840 287990 string qres\0\0 Qt Binary Resource file 288000 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 28801 28802# https://qt.gitorious.org/qt/qtbase/source/\ 28803# 5367fa356233da4c0f28172a8f817791525f5457:\ 28804# src/corelib/kernel/qtranslator.cpp#L62 288050 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 28806>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 28807 28808#------------------------------------------------------------------------------ 28809# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $ 28810# file(1) magic for revision control files 28811# From Hendrik Scholz <hendrik@scholz.net> 288120 string/t /1\ :pserver: cvs password text file 28813 28814# Conary changesets 28815# From: Jonathan Smith <smithj@rpath.com> 288160 belong 0xea3f81bb Conary changeset data 28817 28818# Type: Git bundles (git-bundle) 28819# From: Josh Triplett <josh@freedesktop.org> 288200 string #\ v2\ git\ bundle\n Git bundle 28821 28822# Type: Git pack 28823# From: Adam Buchbinder <adam.buchbinder@gmail.com> 28824# Update: Joerg Jenderek 28825# URL: http://fileformats.archiveteam.org/wiki/Git 28826# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt 28827# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 28828# those have a little-endian offset immediately following the magic 'PACK', 28829# the first byte of which is never 0, while the first byte of the Git pack 28830# version, since it's a tiny number stored in big-endian format, is always 0. 288310 string PACK 28832# GRR: line above is too general as it matches also PackDir archive ./acorn 28833# test for major version. Git 2017 accepts version number 2 or 3 28834>4 ubelong <9 28835# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc 28836# or SystemDevice::foobar 28837>>9 search/13 :: 28838# but in git binary 28839>>9 default x Git pack 28840!:mime application/x-git 28841!:ext pack 28842# 4 GB limit implies unsigned integer 28843>>>4 ubelong x \b, version %u 28844>>>8 ubelong x \b, %u objects 28845 28846# Type: Git pack index 28847# From: Adam Buchbinder <adam.buchbinder@gmail.com> 288480 string \377tOc Git pack index 28849>4 belong =2 \b, version 2 28850 28851# Type: Git index file 28852# From: Frederic Briare <fbriere@fbriere.net> 288530 string DIRC Git index 28854>4 belong >0 \b, version %d 28855>>8 belong >0 \b, %d entries 28856 28857# Type: Mercurial bundles 28858# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 288590 string HG10 Mercurial bundle, 28860>4 string UN uncompressed 28861>4 string BZ bzip2 compressed 28862 28863# Type: Subversion (SVN) dumps 28864# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 288650 string SVN-fs-dump-format-version: Subversion dumpfile 28866>28 string >\0 (version: %s) 28867 28868# Type: Bazaar revision bundles and merge requests 28869# URL: https://www.bazaar-vcs.org/ 28870# From: Jelmer Vernooij <jelmer@samba.org> 288710 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 288720 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 28873 28874#------------------------------------------------------------------------------ 28875# $File: riff,v 1.42 2020/07/17 19:18:56 christos Exp $ 28876# riff: file(1) magic for RIFF format 28877# See 28878# 28879# https://www.seanet.com/users/matts/riffmci/riffmci.htm 28880# http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf 28881# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 28882# 28883 28884# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 288850 name riff-wave 28886>0 leshort 0x01 \b, Microsoft PCM 28887>>14 leshort >0 28888>>>14 leshort <1024 \b, %d bit 28889>0 leshort 0x02 \b, Microsoft ADPCM 28890>0 leshort 0x03 \b, IEEE Float 28891>0 leshort 0x04 \b, Compaq VSELP 28892>0 leshort 0x05 \b, IBM CVSD 28893>0 leshort 0x06 \b, ITU G.711 A-law 28894>0 leshort 0x07 \b, ITU G.711 mu-law 28895>0 leshort 0x08 \b, Microsoft DTS 28896>0 leshort 0x10 \b, OKI ADPCM 28897>0 leshort 0x11 \b, IMA ADPCM 28898>0 leshort 0x12 \b, MediaSpace ADPCM 28899>0 leshort 0x13 \b, Sierra ADPCM 28900>0 leshort 0x14 \b, ITU G.723 ADPCM (Yamaha) 28901>0 leshort 0x15 \b, DSP Solutions DIGISTD 28902>0 leshort 0x16 \b, DSP Solutions DIGIFIX 28903>0 leshort 0x17 \b, Dialogic OKI ADPCM 28904>0 leshort 0x18 \b, MediaVision ADPCM 28905>0 leshort 0x19 \b, HP CU 28906>0 leshort 0x20 \b, Yamaha ADPCM 28907>0 leshort 0x21 \b, Speech Compression SONARC 28908>0 leshort 0x22 \b, DSP Group True Speech 28909>0 leshort 0x23 \b, Echo Speech EchoSC1 28910>0 leshort 0x24 \b, AudioFile AF36 28911>0 leshort 0x25 \b, APTX 28912>0 leshort 0x26 \b, AudioFile AF10 28913>0 leshort 0x27 \b, Prosody 1612 28914>0 leshort 0x28 \b, LRC 28915>0 leshort 0x30 \b, Dolby AC2 28916>0 leshort 0x31 \b, GSM 6.10 28917>0 leshort 0x32 \b, MSN Audio 28918>0 leshort 0x33 \b, Antex ADPCME 28919>0 leshort 0x34 \b, Control Res VQLPC 28920>0 leshort 0x35 \b, Digireal 28921>0 leshort 0x36 \b, DigiADPCM 28922>0 leshort 0x37 \b, Control Res CR10 28923>0 leshort 0x38 \b, NMS VBXADPCM 28924>0 leshort 0x39 \b, Roland RDAC 28925>0 leshort 0x3A \b, Echo Speech EchoSC3 28926>0 leshort 0x3B \b, Rockwell ADPCM 28927>0 leshort 0x3C \b, Rockwell Digitalk 28928>0 leshort 0x3D \b, Xebec 28929>0 leshort 0x40 \b, ITU G.721 ADPCM 28930>0 leshort 0x41 \b, ITU G.728 CELP 28931>0 leshort 0x42 \b, MSG723 28932>0 leshort 0x50 \b, MPEG 28933>0 leshort 0x52 \b, RT24 28934>0 leshort 0x53 \b, PAC 28935>0 leshort 0x55 \b, MPEG Layer 3 28936>0 leshort 0x59 \b, Lucent G.723 28937>0 leshort 0x60 \b, Cirrus 28938>0 leshort 0x61 \b, ESPCM 28939>0 leshort 0x62 \b, Voxware 28940>0 leshort 0x63 \b, Canopus Atrac 28941>0 leshort 0x64 \b, ITU G.726 ADPCM 28942>0 leshort 0x65 \b, ITU G.722 ADPCM 28943>0 leshort 0x66 \b, DSAT 28944>0 leshort 0x67 \b, DSAT Display 28945>0 leshort 0x69 \b, Voxware Byte Aligned 28946>0 leshort 0x70 \b, Voxware AC8 28947>0 leshort 0x71 \b, Voxware AC10 28948>0 leshort 0x72 \b, Voxware AC16 28949>0 leshort 0x73 \b, Voxware AC20 28950>0 leshort 0x74 \b, Voxware MetaVoice 28951>0 leshort 0x75 \b, Voxware MetaSound 28952>0 leshort 0x76 \b, Voxware RT29HW 28953>0 leshort 0x77 \b, Voxware VR12 28954>0 leshort 0x78 \b, Voxware VR18 28955>0 leshort 0x79 \b, Voxware TQ40 28956>0 leshort 0x80 \b, Softsound 28957>0 leshort 0x81 \b, Voxware TQ60 28958>0 leshort 0x82 \b, MSRT24 28959>0 leshort 0x83 \b, ITU G.729A 28960>0 leshort 0x84 \b, MVI MV12 28961>0 leshort 0x85 \b, DF G.726 28962>0 leshort 0x86 \b, DF GSM610 28963>0 leshort 0x88 \b, ISIAudio 28964>0 leshort 0x89 \b, Onlive 28965>0 leshort 0x91 \b, SBC24 28966>0 leshort 0x92 \b, Dolby AC3 S/PDIF 28967>0 leshort 0x97 \b, ZyXEL ADPCM 28968>0 leshort 0x98 \b, Philips LPCBB 28969>0 leshort 0x99 \b, Packed 28970>0 leshort 0x100 \b, Rhetorex ADPCM 28971>0 leshort 0x101 \b, BeCubed Software IRAT 28972>0 leshort 0x111 \b, Vivo G.723 28973>0 leshort 0x112 \b, Vivo Siren 28974>0 leshort 0x123 \b, Digital G.723 28975>0 leshort 0x200 \b, Creative ADPCM 28976>0 leshort 0x202 \b, Creative FastSpeech8 28977>0 leshort 0x203 \b, Creative FastSpeech10 28978>0 leshort 0x220 \b, Quarterdeck 28979>0 leshort 0x300 \b, FM Towns Snd 28980>0 leshort 0x400 \b, BTV Digital 28981>0 leshort 0x680 \b, VME VMPCM 28982>0 leshort 0x1000 \b, OLIGSM 28983>0 leshort 0x1001 \b, OLIADPCM 28984>0 leshort 0x1002 \b, OLICELP 28985>0 leshort 0x1003 \b, OLISBC 28986>0 leshort 0x1004 \b, OLIOPR 28987>0 leshort 0x1100 \b, LH Codec 28988>0 leshort 0x1400 \b, Norris 28989>0 leshort 0x1401 \b, ISIAudio 28990>0 leshort 0x1500 \b, Soundspace Music Compression 28991>0 leshort 0x2000 \b, AC3 DVM 28992>0 leshort 0x2001 \b, DTS 28993>2 leshort =1 \b, mono 28994>2 leshort =2 \b, stereo 28995>2 leshort >2 28996>>2 leshort <128 \b, %d channels 28997>4 lelong >0 28998>>4 lelong <1000000 %d Hz 28999 29000# try to find "fmt " 290010 name riff-walk 29002>0 string fmt\x20 29003>>4 lelong >15 29004>>>8 use riff-wave 29005>0 string LIST 29006>>&(4.l+4) use riff-walk 29007>0 string DISP 29008>>&(4.l+4) use riff-walk 29009>0 string bext 29010>>&(4.l+4) use riff-walk 29011>0 string Fake 29012>>&(4.l+4) use riff-walk 29013>0 string fact 29014>>&(4.l+4) use riff-walk 29015>0 string VP8 29016>>11 byte 0x9d 29017>>>12 byte 0x01 29018>>>>13 byte 0x2a \b, VP8 encoding 29019>>>>>14 leshort&0x3fff x \b, %d 29020>>>>>16 leshort&0x3fff x \bx%d, Scaling: 29021>>>>>14 leshort&0xc000 0x0000 \b [none] 29022>>>>>14 leshort&0xc000 0x1000 \b [5/4] 29023>>>>>14 leshort&0xc000 0x2000 \b [5/3] 29024>>>>>14 leshort&0xc000 0x3000 \b [2] 29025>>>>>14 leshort&0xc000 0x0000 \bx[none] 29026>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 29027>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 29028>>>>>14 leshort&0xc000 0x3000 \bx[2] 29029>>>>>15 byte&0x80 =0x00 \b, YUV color 29030>>>>>15 byte&0x80 =0x80 \b, bad color specification 29031>>>>>15 byte&0x40 =0x40 \b, no clamping required 29032>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 29033#>0 string x we got %s 29034#>>&(4.l+4) use riff-walk 29035 29036# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 29037# 290380 string RIFF RIFF (little-endian) data 29039# RIFF Palette format 29040# Update: Joerg Jenderek 29041# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format 29042# Reference: https://worms2d.info/Palette_file 29043# WAVE/AVI codec registry: https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 29044>8 string PAL\ \b, palette 29045!:mime application/x-riff 29046# color palette by Microsoft Corporation 29047!:ext pal 29048# file size = chunk size + 8 in most cases 29049>>4 ulelong+8 x \b, %u bytes 29050# Extended PAL Format 29051>>12 string plth \b, extended 29052# Simple PAL Format 29053>>12 string data 29054# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes 29055>>>16 ulelong x \b, data size %u 29056# palVersion is always 0x0300 29057#>>>20 leshort x \b, version 0x%4.4x 29058# palNumEntries specifies the number of palette color entries 29059>>>22 uleshort x \b, %u entries 29060# after palPalEntry sized (number of color entries * 4 ) vector 29061>>>(22.s*4) ubequad x 29062# jump relative 22 ( 8 + 16) bytes forward points after end of file or to 29063# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal 29064>>>>&16 ubelong x \b, extra bytes 29065>>>>>&-4 ubelong >0 0x%8.8x 29066# RIFF Device Independent Bitmap format 29067# URL: http://fileformats.archiveteam.org/wiki/RDIB 29068>8 string RDIB \b, device-independent bitmap 29069!:ext rdi/dib 29070>>16 string BM 29071>>>30 leshort 12 \b, OS/2 1.x format 29072>>>>34 leshort x \b, %d x 29073>>>>36 leshort x %d 29074>>>30 leshort 64 \b, OS/2 2.x format 29075>>>>34 leshort x \b, %d x 29076>>>>36 leshort x %d 29077>>>30 leshort 40 \b, Windows 3.x format 29078>>>>34 lelong x \b, %d x 29079>>>>38 lelong x %d x 29080>>>>44 leshort x %d 29081# RIFF MIDI format 29082# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDI 29083>8 string RMID \b, MIDI 29084# http://extension.nirsoft.net/rmi 29085!:mime audio/mid 29086#!:mime audio/x-rmid 29087!:ext rmi 29088# RIFF Multimedia Movie File format 29089# URL: http://fileformats.archiveteam.org/wiki/RIFF_Multimedia_Movie 29090>8 string RMMP \b, multimedia movie 29091!:mime video/x-mmm 29092!:ext mmm 29093# RIFF wrapper for MP3 29094>8 string RMP3 \b, MPEG Layer 3 audio 29095#!:mime audio/x-rmp3 29096# Microsoft WAVE format (*.wav) 29097# URL: http://fileformats.archiveteam.org/wiki/WAV 29098>8 string WAVE \b, WAVE audio 29099#!:mime audio/vnd.wave 29100!:mime audio/x-wav 29101# https://www.macdisk.com/macsigen.php 29102#!:apple ????WAVE 29103!:ext wav/wave 29104>>12 string >\0 29105>>>12 use riff-walk 29106# Update: Joerg Jenderek 29107# lower case for Corel Draw version 8 Bidi 29108>8 string/c cdr 29109# skip Corel CCX Clipart 29110>>8 string !CDRXcont 29111# Corel Draw Picture 29112>>>0 use corel-draw 29113# URL: http://fileformats.archiveteam.org/wiki/CCX_(Corel) 29114# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccx-corel.trid.xml 29115>>8 string =CDRXcont \b, Corel Clipart 29116!:mime application/x-corel-ccx 29117!:ext ccx 29118# 3rd chunk data {Corel\040Binary\040Meta\040File} 29119#>>>20 string x \b, 3rd '%-s' 29120>>>4 ulelong+8 x \b, %u bytes 29121# From: Joerg Jenderek 29122# URL: https://en.wikipedia.org/wiki/CorelDRAW 29123# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 29124# Picture templates created by newer software start with RIFF type CDT 29125>8 string CDT 29126>>0 use corel-draw 29127# Picture templates with version 4.4 29128>8 string CDST 29129>>0 use corel-draw 29130# pattern created by newer software start with RIFF type PAT 29131>8 string PAT 29132>>0 use corel-draw 29133# From: Joerg Jenderek 29134# URL: https://en.wikipedia.org/wiki/Corel_Designer 29135# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 29136>8 string DES 29137>>8 string !DESC 29138>>>0 use corel-des 29139# Corel Draw templates with version 12.5 or Corel Designer illustration 12 29140>>8 string =DESC 29141# MORE TESTS NEEDED HERE! 29142#>>>0 use corel-des 29143#>>>0 use corel-draw 29144>8 string NUNDROOT \b, Steinberg CuBase 29145# AVI == Audio Video Interleave 29146# Reference: http://fileformats.archiveteam.org/wiki/AVI 29147>8 string AVI\040 \b, AVI 29148# https://reposcope.com/mimetype/video/x-msvideo 29149!:mime video/x-msvideo 29150# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 29151#!:mime video/vnd.avi 29152!:ext avi/divx 29153>>12 string LIST 29154>>>20 string hdrlavih 29155>>>>&36 lelong x \b, %u x 29156>>>>&40 lelong x %u, 29157>>>>&4 lelong >1000000 <1 fps, 29158>>>>&4 lelong 1000000 1.00 fps, 29159>>>>&4 lelong 500000 2.00 fps, 29160>>>>&4 lelong 333333 3.00 fps, 29161>>>>&4 lelong 250000 4.00 fps, 29162>>>>&4 lelong 200000 5.00 fps, 29163>>>>&4 lelong 166667 6.00 fps, 29164>>>>&4 lelong 142857 7.00 fps, 29165>>>>&4 lelong 125000 8.00 fps, 29166>>>>&4 lelong 111111 9.00 fps, 29167>>>>&4 lelong 100000 10.00 fps, 29168# ]9.9,10.1[ 29169>>>>&4 lelong <101010 29170>>>>>&-4 lelong >99010 29171>>>>>>&-4 lelong !100000 ~10 fps, 29172>>>>&4 lelong 83333 12.00 fps, 29173# ]11.9,12.1[ 29174>>>>&4 lelong <84034 29175>>>>>&-4 lelong >82645 29176>>>>>>&-4 lelong !83333 ~12 fps, 29177>>>>&4 lelong 66667 15.00 fps, 29178# ]14.9,15.1[ 29179>>>>&4 lelong <67114 29180>>>>>&-4 lelong >66225 29181>>>>>>&-4 lelong !66667 ~15 fps, 29182>>>>&4 lelong 50000 20.00 fps, 29183>>>>&4 lelong 41708 23.98 fps, 29184>>>>&4 lelong 41667 24.00 fps, 29185# ]23.9,24.1[ 29186>>>>&4 lelong <41841 29187>>>>>&-4 lelong >41494 29188>>>>>>&-4 lelong !41708 29189>>>>>>>&-4 lelong !41667 ~24 fps, 29190>>>>&4 lelong 40000 25.00 fps, 29191# ]24.9,25.1[ 29192>>>>&4 lelong <40161 29193>>>>>&-4 lelong >39841 29194>>>>>>&-4 lelong !40000 ~25 fps, 29195>>>>&4 lelong 33367 29.97 fps, 29196>>>>&4 lelong 33333 30.00 fps, 29197# ]29.9,30.1[ 29198>>>>&4 lelong <33445 29199>>>>>&-4 lelong >33223 29200>>>>>>&-4 lelong !33367 29201>>>>>>>&-4 lelong !33333 ~30 fps, 29202>>>>&4 lelong <32224 >30 fps, 29203##>>>>&4 lelong x (%lu) 29204##>>>>&20 lelong x %lu frames, 29205# Note: The tests below assume that the AVI has 1 or 2 streams, 29206# "vids" optionally followed by "auds". 29207# (Should cover 99.9% of all AVIs.) 29208# assuming avih length = 56 29209>>>88 string LIST 29210>>>>96 string strlstrh 29211>>>>>108 string vids video: 29212>>>>>>&0 lelong 0 uncompressed 29213# skip past vids strh 29214>>>>>>(104.l+108) string strf 29215>>>>>>>(104.l+132) lelong 1 RLE 8bpp 29216>>>>>>>(104.l+132) string/c anim Intel RDX 29217>>>>>>>(104.l+132) string/c aur2 AuraVision Aura 2 29218>>>>>>>(104.l+132) string/c aura AuraVision Aura 29219>>>>>>>(104.l+132) string/c bt20 Brooktree MediaStream 29220>>>>>>>(104.l+132) string/c btcv Brooktree Composite Video 29221>>>>>>>(104.l+132) string/c cc12 Intel YUV12 29222>>>>>>>(104.l+132) string/c cdvc Canopus DV 29223>>>>>>>(104.l+132) string/c cham Winnov Caviara Cham 29224>>>>>>>(104.l+132) string/c cljr Proprietary YUV 4 pixels 29225>>>>>>>(104.l+132) string/c cmyk Common Data Format in Printing 29226>>>>>>>(104.l+132) string/c cpla Weitek 4:2:0 YUV Planar 29227>>>>>>>(104.l+132) string/c cvid Cinepak 29228>>>>>>>(104.l+132) string/c cwlt Microsoft Color WLT DIB 29229>>>>>>>(104.l+132) string/c cyuv Creative Labs YUV 29230>>>>>>>(104.l+132) string/c d261 H.261 29231>>>>>>>(104.l+132) string/c d263 H.263 29232>>>>>>>(104.l+132) string/c duck TrueMotion 1.0 29233>>>>>>>(104.l+132) string/c dve2 DVE-2 Videoconferencing 29234>>>>>>>(104.l+132) string/c fljp Field Encoded Motion JPEG 29235>>>>>>>(104.l+132) string/c fvf1 Fractal Video Frame 29236>>>>>>>(104.l+132) string/c gwlt Microsoft Greyscale WLT DIB 29237>>>>>>>(104.l+132) string/c h260 H.260 29238>>>>>>>(104.l+132) string/c h261 H.261 29239>>>>>>>(104.l+132) string/c h262 H.262 29240>>>>>>>(104.l+132) string/c h263 H.263 29241>>>>>>>(104.l+132) string/c h264 H.264 29242>>>>>>>(104.l+132) string/c h265 H.265 29243>>>>>>>(104.l+132) string/c h266 H.266 29244>>>>>>>(104.l+132) string/c h267 H.267 29245>>>>>>>(104.l+132) string/c h268 H.268 29246>>>>>>>(104.l+132) string/c h269 H.269 29247>>>>>>>(104.l+132) string/c i263 Intel I.263 29248>>>>>>>(104.l+132) string/c i420 Intel Indeo 4 29249>>>>>>>(104.l+132) string/c ian Intel RDX 29250>>>>>>>(104.l+132) string/c iclb CellB Videoconferencing Codec 29251>>>>>>>(104.l+132) string/c ilvc Intel Layered Video 29252>>>>>>>(104.l+132) string/c ilvr ITU-T H.263+ 29253>>>>>>>(104.l+132) string/c iraw Intel YUV Uncompressed 29254>>>>>>>(104.l+132) string/c iv30 Intel Indeo 3 29255>>>>>>>(104.l+132) string/c iv31 Intel Indeo 3.1 29256>>>>>>>(104.l+132) string/c iv32 Intel Indeo 3.2 29257>>>>>>>(104.l+132) string/c iv33 Intel Indeo 3.3 29258>>>>>>>(104.l+132) string/c iv34 Intel Indeo 3.4 29259>>>>>>>(104.l+132) string/c iv35 Intel Indeo 3.5 29260>>>>>>>(104.l+132) string/c iv36 Intel Indeo 3.6 29261>>>>>>>(104.l+132) string/c iv37 Intel Indeo 3.7 29262>>>>>>>(104.l+132) string/c iv38 Intel Indeo 3.8 29263>>>>>>>(104.l+132) string/c iv39 Intel Indeo 3.9 29264>>>>>>>(104.l+132) string/c iv40 Intel Indeo 4.0 29265>>>>>>>(104.l+132) string/c iv41 Intel Indeo 4.1 29266>>>>>>>(104.l+132) string/c iv42 Intel Indeo 4.2 29267>>>>>>>(104.l+132) string/c iv43 Intel Indeo 4.3 29268>>>>>>>(104.l+132) string/c iv44 Intel Indeo 4.4 29269>>>>>>>(104.l+132) string/c iv45 Intel Indeo 4.5 29270>>>>>>>(104.l+132) string/c iv46 Intel Indeo 4.6 29271>>>>>>>(104.l+132) string/c iv47 Intel Indeo 4.7 29272>>>>>>>(104.l+132) string/c iv48 Intel Indeo 4.8 29273>>>>>>>(104.l+132) string/c iv49 Intel Indeo 4.9 29274>>>>>>>(104.l+132) string/c iv50 Intel Indeo 5.0 29275>>>>>>>(104.l+132) string/c mpeg MPEG 1 Video Frame 29276>>>>>>>(104.l+132) string/c mjpg Motion JPEG 29277>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 29278>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 29279>>>>>>>(104.l+132) string/c mrca MR Codec 29280>>>>>>>(104.l+132) string/c mrle Run Length Encoding 29281>>>>>>>(104.l+132) string/c msvc Microsoft Video 1 29282>>>>>>>(104.l+132) string/c phmo Photomotion 29283>>>>>>>(104.l+132) string/c qpeq QPEG 1.1 Format Video 29284>>>>>>>(104.l+132) string/c rgbt RGBT 29285>>>>>>>(104.l+132) string/c rle4 Run Length Encoded 4 29286>>>>>>>(104.l+132) string/c rle8 Run Length Encoded 8 29287>>>>>>>(104.l+132) string/c rt21 Intel Indeo 2.1 29288>>>>>>>(104.l+132) string/c rvx Intel RDX 29289>>>>>>>(104.l+132) string/c sdcc Sun Digital Camera Codec 29290>>>>>>>(104.l+132) string/c sfmc Crystal Net SFM Codec 29291>>>>>>>(104.l+132) string/c smsc SMSC 29292>>>>>>>(104.l+132) string/c smsd SMSD 29293>>>>>>>(104.l+132) string/c splc Splash Studios ACM Audio Codec 29294>>>>>>>(104.l+132) string/c sqz2 Microsoft VXtreme Video Codec 29295>>>>>>>(104.l+132) string/c sv10 Sorenson Video R1 29296>>>>>>>(104.l+132) string/c tlms TeraLogic Motion Intraframe Codec A 29297>>>>>>>(104.l+132) string/c tlst TeraLogic Motion Intraframe Codec B 29298>>>>>>>(104.l+132) string/c tm20 TrueMotion 2.0 29299>>>>>>>(104.l+132) string/c tmic TeraLogic Motion Intraframe Codec 2 29300>>>>>>>(104.l+132) string/c tmot TrueMotion Video Compression 29301>>>>>>>(104.l+132) string/c tr20 TrueMotion RT 2.0 29302>>>>>>>(104.l+132) string/c ulti Ultimotion 29303>>>>>>>(104.l+132) string/c uyvy UYVY 4:2:2 byte ordering 29304>>>>>>>(104.l+132) string/c v422 24-bit YUV 4:2:2 format 29305>>>>>>>(104.l+132) string/c v655 16-bit YUV 4:2:2 format 29306>>>>>>>(104.l+132) string/c vcr1 ATI VCR 1.0 29307>>>>>>>(104.l+132) string/c vcr2 ATI VCR 2.0 29308>>>>>>>(104.l+132) string/c vcr3 ATI VCR 3.0 29309>>>>>>>(104.l+132) string/c vcr4 ATI VCR 4.0 29310>>>>>>>(104.l+132) string/c vcr5 ATI VCR 5.0 29311>>>>>>>(104.l+132) string/c vcr6 ATI VCR 6.0 29312>>>>>>>(104.l+132) string/c vcr7 ATI VCR 7.0 29313>>>>>>>(104.l+132) string/c vcr8 ATI VCR 8.0 29314>>>>>>>(104.l+132) string/c vcr9 ATI VCR 9.0 29315>>>>>>>(104.l+132) string/c vdct Video Maker Pro DIB 29316>>>>>>>(104.l+132) string/c vids YUV 4:2:2 CCIR 601 for V422 29317>>>>>>>(104.l+132) string/c vivo Vivo H.263 29318>>>>>>>(104.l+132) string/c vixl VIXL 29319>>>>>>>(104.l+132) string/c vlv1 VLCAP.DRV 29320>>>>>>>(104.l+132) string/c wbvc W9960 29321>>>>>>>(104.l+132) string/c x263 mmioFOURCC('X','2','6','3') 29322>>>>>>>(104.l+132) string/c xlv0 XL Video Decoder 29323>>>>>>>(104.l+132) string/c y211 YUV 2:1:1 Packed 29324>>>>>>>(104.l+132) string/c y411 YUV 4:1:1 Packed 29325>>>>>>>(104.l+132) string/c y41b YUV 4:1:1 Planar 29326>>>>>>>(104.l+132) string/c y41p PC1 4:1:1 29327>>>>>>>(104.l+132) string/c y41t PC1 4:1:1 with transparency 29328>>>>>>>(104.l+132) string/c y42b YUV 4:2:2 Planar 29329>>>>>>>(104.l+132) string/c y42t PC1 4:2:2 with transparency 29330>>>>>>>(104.l+132) string/c yc12 Intel YUV12 Codec 29331>>>>>>>(104.l+132) string/c yuv8 Winnov Caviar YUV8 29332>>>>>>>(104.l+132) string/c yuv9 YUV9 29333>>>>>>>(104.l+132) string/c yuy2 YUY2 4:2:2 byte ordering packed 29334>>>>>>>(104.l+132) string/c yuyv BI_YUYV, Canopus 29335>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 29336>>>>>>>(104.l+132) string/c div3 DivX 3 29337>>>>>>>>112 string/c div3 Low-Motion 29338>>>>>>>>112 string/c div4 Fast-Motion 29339>>>>>>>(104.l+132) string/c divx DivX 4 29340>>>>>>>(104.l+132) string/c dx50 DivX 5 29341>>>>>>>(104.l+132) string/c xvid XviD 29342>>>>>>>(104.l+132) string/c h264 H.264 29343>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 29344>>>>>>>(104.l+132) string/c h264 X.264 or H.264 29345>>>>>>>(104.l+132) lelong 0 29346##>>>>>>>(104.l+132) string x (%.4s) 29347# skip past first (video) LIST 29348>>>>(92.l+96) string LIST 29349>>>>>(92.l+104) string strlstrh 29350>>>>>>(92.l+116) string auds \b, audio: 29351# auds strh length = 56: 29352>>>>>>>(92.l+172) string strf 29353>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 29354>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 29355>>>>>>>>(92.l+180) leshort 0x0006 aLaw 29356>>>>>>>>(92.l+180) leshort 0x0007 uLaw 29357>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 29358>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 29359>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 29360>>>>>>>>(92.l+180) leshort 0x0161 DivX 29361##>>>>>>>>(92.l+180) leshort x (0x%.4x) 29362>>>>>>>>(92.l+182) leshort 1 (mono, 29363>>>>>>>>(92.l+182) leshort 2 (stereo, 29364>>>>>>>>(92.l+182) leshort >2 (%d channels, 29365>>>>>>>>(92.l+184) lelong x %d Hz) 29366# auds strh length = 64: 29367>>>>>>>(92.l+180) string strf 29368>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 29369>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 29370>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 29371>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 29372>>>>>>>>(92.l+188) leshort 0x0161 DivX 29373##>>>>>>>>(92.l+188) leshort x (0x%.4x) 29374>>>>>>>>(92.l+190) leshort 1 (mono, 29375>>>>>>>>(92.l+190) leshort 2 (stereo, 29376>>>>>>>>(92.l+190) leshort >2 (%d channels, 29377>>>>>>>>(92.l+192) lelong x %d Hz) 29378# From: Joerg Jenderek 29379# URL: http://fileformats.archiveteam.org/wiki/VDR_(VirtualDub) 29380# Reference: http://sourceforge.net/projects/virtualdub/files/virtualdub-win/ 29381# 1.10.4.35491/VirtualDub-1.10.4-src.7z/src/vdremote/Main.cpp 29382# VirtualDub link handler 29383>8 string VDRM \b, VirtualDub link 29384!:mime video/x-vdr 29385!:ext vdr 29386>>12 string PATH \b, PATH 29387# remote-path to video file 29388>>16 pstring/l x %s 29389# Animated Cursor format 29390# Update: Joerg Jenderek 29391# URL: http://fileformats.archiveteam.org/wiki/Windows_Animated_Cursor 29392# Reference: https://www.gdgsoft.com/anituner/help/aniformat.htm 29393>8 string ACON \b, animated cursor 29394!:mime application/x-navi-animation 29395# http://extension.nirsoft.net/ani 29396#!:mime image/ani 29397!:ext ani 29398# INAM tag followed by length of title 29399>>24 string INAM 29400>>>28 pstring/l x "%s" 29401# IART tag followed by length of author 29402>>>(28.l+32) ubelong 0x49415254 29403>>>>&0 pstring/l x %s 29404# SoundFont 2 <mpruett@sgi.com> 29405# URL: http://fileformats.archiveteam.org/wiki/SoundFont_2.0 29406>8 string sfbk \b, SoundFont/Bank 29407!:mime audio/x-sfbk 29408!:ext sf2 29409# MPEG-1 wrapped in a RIFF, apparently 29410# URL: http://file.fyicenter.com/17_Video_.DAT_File_Extension_for_VCD_Files.html 29411>8 string CDXA \b, wrapped MPEG-1 (CDXA) 29412!:mime video/x-cdxa 29413!:ext mpg/dat 29414# URL: http://fileformats.archiveteam.org/wiki/4X_IMA_ADPCM 29415>8 string 4XMV \b, 4X Movie file 29416!:mime video/x-4xmv 29417!:ext 4xm/4xa 29418# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV 29419>8 string AMV\040 \b, AMV 29420# http://fileformats.archiveteam.org/wiki/MTV_Video_(.AMV) 29421!:mime video/x-amv 29422!:ext amv 29423#!:ext amv/mtv 29424# URL: http://fileformats.archiveteam.org/wiki/WebP 29425>8 string WEBP \b, Web/P image 29426!:mime image/webp 29427!:ext webp 29428>>12 use riff-walk 29429# From: Joerg Jenderek 29430# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDS 29431>8 string MIDS \b, MIDI Stream 29432!:mime audio/x-mids 29433!:ext mds 29434# From: Joerg Jenderek 29435# URL: http://mark0.net/soft-trid-e.html 29436# Reference: http://fileformats.archiveteam.org/wiki/Trd_(TRID) 29437>8 string TRID \b, TrID defs package 29438!:mime application/x-trid-trd 29439!:ext trd 29440# From: Joerg Jenderek 29441# URL: https://en.wikipedia.org/wiki/CorelDRAW 29442# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 29443# Note: Since version 3 CorelDraw Pictures are RIFF based 29444# but data chunks remain proprietary. 29445# Since version 14 til 15 packed as "content/riffData.cdr" and 29446# since 16 "content/root.dat" in ZIP container 29447# TODO: distinguish templates with version 12.5 from Designer illustration 12 29448# display information of RIFF based Corel Draw pictures, templates and patterns 294490 name corel-draw 29450# display second chunk for debugging 29451#>8 string x \b, [8]=%.8s 29452>0 string x \b, Corel Draw 29453#!:mime image/x-coreldraw 29454!:mime application/vnd.corel-draw 29455# used by newer pictures templates 29456>>8 string CDT 29457# used by templates with newer versions since 16 29458>>>12 string =fver Picture template (root.dat) 29459!:ext dat 29460# used by templates with older versions with vrsn tag 29461>>>12 string !fver 29462# used by templates with older versions 14-15 29463>>>>11 string >E Picture template (riffData.cdr) 29464!:ext cdr 29465# used by templates with older versions 11-13 29466>>>>11 string <F Picture template 29467!:ext cdt/cdrt 29468# used by older templates with version 4.4 29469>>8 string CDST Picture template 29470!:ext cdt 29471# used by templates with version 12.5 29472>>8 string DESC Picture template 29473!:ext cdt 29474# used by newer patterns with version 22 29475>>8 string PAT Pattern 29476!:ext dat 29477# remaining older templates, patterns, drawings 29478>>8 default x 29479# pattern with old version 4.y 29480>>>26 ulelong =0x0000206C Pattern 29481!:ext pat 29482# pattern with newer versions 29483>>>26 ulelong =0x00000D2C Pattern 29484!:ext pat 29485# remaining older templates or pictures 29486>>>26 default x 29487# used by older versions 5 - 15 29488>>>>12 string =vrsn 29489# 4th chunk size unequal 282Ch only found for CDR 29490>>>>>26 ulelong !0x0000282c Picture 29491!:ext cdr 29492>>>>>26 default x Picture or template 29493!:ext cdr/cdt 29494# used by newer versions since 16 29495>>>>12 string =fver Picture (root.dat) 29496!:ext dat 29497# version marked by 1 ASCII char: space~3, ... , F~15, ... , N~22, ... R~22 template 29498>11 string x \b, version 29499>11 string >\040 '%-.1s' 29500>0 use corel-version 29501>4 ulelong+8 x \b, %u bytes 29502# 29503# display numeric version of RIFF based Corel after 3rd RIFF tag 295040 name corel-version 29505# for debugging purpose; vrsn for short content; fver for 16 byte size 29506#>12 string x \b, TAG "%-4.4s" 29507# 1st data chunk length 2 implies short content version 29508>16 ulelong 2 29509# vrsn chunk short content interpreted by MajorVersion * 100 + MinorVersion 29510>>20 uleshort/100 x %u 29511>>20 uleshort%100 >0 \b.%u 29512# for debugging purpose display next chunk like: DISP LIST 29513#>>22 string x \b, 4th "%-4.4s" 29514#>>26 ulelong x \b, 4th SIZE 0x%x 29515# for debugging purpose display 5th chunk like: LIST DISP ccmm osfp 29516#>>(26.l+30) string x \b, 5th "%-4.4s" 29517# 1st data chunk length 10h implies 16 byte content with version info 29518>16 ulelong 0x10 29519>>34 ubyte x %u 29520>>>33 ubyte >0 \b.%u 29521# display information of RIFF based Corel Design formats 295220 name corel-des 29523# display second chunk for debugging 29524#>8 string x \b, [8]=%.8s 29525>12 string x \b, Corel DESIGNER 29526!:mime image/x-corel-des 29527#!:mime application/x-vnd.corel.designer.document 29528# used by Corel Designer with newer versions since 16 29529>12 string =fver graphics (root.dat) 29530!:ext dat 29531# used by Corel Designer templates with older versions with vrsn tag 29532>12 string !fver 29533# used by Corel Designer with versions 14-15 29534>>11 string >D graphics (riffData.cdr) 29535!:ext cdr 29536# used by Corel Designer with versions 10-12 29537>>11 string <E graphics 29538!:ext des 29539# version indicated by last ASCII char of second chunk tag 29540>11 string x \b, version '%-.1s' 29541# but vrsn short content is not always version indicator 29542# exceptions: 'A'~11.4 'B'~12 'C'~12.5 29543>11 string >D 29544>>0 use corel-version 29545# for debugging purpose display next chunk like: DISP LIST 29546#>>22 string x \b, 4th "%-4.4s" 29547#>>26 ulelong x \b, 4th SIZE 0x%x 29548# for debugging purpose display 5th chunk like: LIST osfp 29549#>>(26.l+30) string x \b, 5th "%-4.4s" 29550>4 ulelong+8 x \b, %u bytes 29551# 29552# XXX - some of the below may only appear in little-endian form. 29553# 29554# Also "MV93" appears to be for one form of Macromedia Director 29555# files, and "GDMF" appears to be another multimedia format. 29556# 295570 string RIFX RIFF (big-endian) data 29558# RIFF Palette format 29559>8 string PAL \b, palette 29560>>16 beshort x \b, version %d 29561>>18 beshort x \b, %d entries 29562# RIFF Device Independent Bitmap format 29563>8 string RDIB \b, device-independent bitmap 29564>>16 string BM 29565>>>30 beshort 12 \b, OS/2 1.x format 29566>>>>34 beshort x \b, %d x 29567>>>>36 beshort x %d 29568>>>30 beshort 64 \b, OS/2 2.x format 29569>>>>34 beshort x \b, %d x 29570>>>>36 beshort x %d 29571>>>30 beshort 40 \b, Windows 3.x format 29572>>>>34 belong x \b, %d x 29573>>>>38 belong x %d x 29574>>>>44 beshort x %d 29575# RIFF MIDI format 29576>8 string RMID \b, MIDI 29577# RIFF Multimedia Movie File format 29578>8 string RMMP \b, multimedia movie 29579# Microsoft WAVE format (*.wav) 29580>8 string WAVE \b, WAVE audio 29581>>20 leshort 1 \b, Microsoft PCM 29582>>>34 leshort >0 \b, %d bit 29583>>22 beshort =1 \b, mono 29584>>22 beshort =2 \b, stereo 29585>>22 beshort >2 \b, %d channels 29586>>24 belong >0 %d Hz 29587# Corel Draw Picture big endian not tested by real examples 29588#>8 string CDRA \b, Corel Draw Picture 29589#>8 string CDR6 \b, Corel Draw Picture, version 6 29590>8 string CDR 29591>>0 use \^corel-draw 29592 29593# AVI == Audio Video Interleave 29594>8 string AVI\040 \b, AVI 29595# Animated Cursor format 29596>8 string ACON \b, animated cursor 29597# Notation Interchange File Format (big-endian only) 29598>8 string NIFF \b, Notation Interchange File Format 29599# SoundFont 2 <mpruett@sgi.com> 29600>8 string sfbk SoundFont/Bank 29601 29602#------------------------------------------------------------------------------ 29603# Sony Wave64 29604# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 29605# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 296060 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 29607# 128 bit + total file size (64 bits) so 24 bytes 29608# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 29609>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 29610!:mime audio/x-w64 29611# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 29612>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 29613>>>&10 leshort =1 \b, mono 29614>>>&10 leshort =2 \b, stereo 29615>>>&10 leshort >2 \b, %d channels 29616>>>&12 lelong >0 %d Hz 29617 29618#------------------------------------------------------------------------------ 29619# MBWF/RF64 29620# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf 296210 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 29622!:mime audio/x-wav 29623>40 search/256 fmt\x20 \b 29624>>&6 leshort =1 \b, mono 29625>>&6 leshort =2 \b, stereo 29626>>&6 leshort >2 \b, %d channels 29627>>&8 lelong >0 %d Hz 29628 29629#------------------------------------------------------------------------------ 29630# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $ 29631# rpi: file(1) magic for Raspberry Pi images 29632-44 lelong 0 29633>4 lelong 0 29634>>8 lelong 1 29635>>12 lelong 4 29636>>>16 string 283x 29637>>>>20 lelong 1 29638>>>>>24 lelong 4 29639>>>>>>28 string DTOK 29640>>>>>>>32 lelong 44 29641>>>>>>>>36 lelong 4 29642>>>>>>>>>40 string RPTL Raspberry PI kernel image 29643 29644-56 lelong 0 29645>4 lelong 0 29646>>8 lelong 1 29647>>12 lelong 4 29648>>>16 string 283x 29649>>>>20 lelong 1 29650>>>>>24 lelong 4 29651>>>>>>28 string DTOK 29652>>>>>>>32 lelong 1 29653>>>>>>>>36 lelong 4 29654>>>>>>>>>40 string DDTK8 29655>>>>>>>>>>48 lelong 4 29656>>>>>>>>>>>52 string RPTL Raspberry PI kernel image 29657 29658#------------------------------------------------------------------------------ 29659# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 29660# 29661# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 29662# 296630 belong 0xedabeedb RPM 29664!:mime application/x-rpm 29665>4 byte x v%d 29666>5 byte x \b.%d 29667>6 beshort 1 src 29668>6 beshort 0 bin 29669>>8 beshort 1 i386/x86_64 29670>>8 beshort 2 Alpha/Sparc64 29671>>8 beshort 3 Sparc 29672>>8 beshort 4 MIPS 29673>>8 beshort 5 PowerPC 29674>>8 beshort 6 68000 29675>>8 beshort 7 SGI 29676>>8 beshort 8 RS6000 29677>>8 beshort 9 IA64 29678>>8 beshort 10 Sparc64 29679>>8 beshort 11 MIPSel 29680>>8 beshort 12 ARM 29681>>8 beshort 13 MiNT 29682>>8 beshort 14 S/390 29683>>8 beshort 15 S/390x 29684>>8 beshort 16 PowerPC64 29685>>8 beshort 17 SuperH 29686>>8 beshort 18 Xtensa 29687>>8 beshort 255 noarch 29688>>10 string x %s 29689 29690#delta RPM Daniel Novotny (dnovotny@redhat.com) 296910 string drpm Delta RPM 29692!:mime application/x-rpm 29693>12 string x %s 29694>>8 beshort 11 MIPSel 29695>>8 beshort 12 ARM 29696>>8 beshort 13 MiNT 29697>>8 beshort 14 S/390 29698>>8 beshort 15 S/390x 29699>>8 beshort 16 PowerPC64 29700>>8 beshort 17 SuperH 29701>>8 beshort 18 Xtensa 29702>>10 string x %s 29703 29704#------------------------------------------------------------------------------ 29705# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $ 29706# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages) 29707# see https://en.wikipedia.org/wiki/Rpmsg 29708 297090 string \x76\xe8\x04\x60\xc4\x11\xe3\x86 rpmsg Restricted Permission Message 29710 29711#------------------------------------------------------------------------------ 29712# $File: rst,v 1.3 2020/04/27 01:50:36 christos Exp $ 29713# rst: ReStructuredText http://docutils.sourceforge.net/rst.html 297140 search/256 \=\= 29715!:strength + 30 29716>&0 regex/256 \^[\=]+$ 29717>>&0 search/512 :Author: ReStructuredText file 29718>>&0 default x 29719>>>&0 regex/512 \^\\.\\.[A-Za-z] ReStructuredText file 29720!:ext rst 29721 29722#------------------------------------------------------------------------------ 29723# $File: rtf,v 1.9 2020/12/12 20:01:47 christos Exp $ 29724# rtf: file(1) magic for Rich Text Format (RTF) 29725# 29726# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 29727# Update: Joerg Jenderek 29728# URL: https://en.wikipedia.org/wiki/Rich_Text_Format 29729# Reference: http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf 29730# http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf 297310 string {\\rtf 29732# skip DROID fmt-355-signature-id-522.rtf by looking for valid version 29733>5 ubyte !0xAB 29734# skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version 29735>>5 ubyte !0x5C Rich Text Format data 29736!:mime text/rtf 29737!:apple ????RTF 29738!:ext rtf 29739>>>0 use rtf-info 29740# display information like version, language and code page of RTF 297410 name rtf-info 29742# 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf 29743>5 ubyte !0x7b \b, version %c 29744# The word for character set must precede any text or most other control words 29745>6 string \\mac \b, Apple Macintosh 29746>6 string \\pc 29747# control word \pca 29748>>9 ubyte =0x61 \b, IBM PS/2, code page 850 29749>>9 ubyte !0x61 \b, IBM PC, code page 437 29750# unknown character set or ANSI later after control words like 29751# \adeflang1025 \info \title \author \category \manager 29752# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 29753#>6 search/105 \\ansi \b, ANSI 29754>6 search/502 \\ansi \b, ANSI 29755>6 default x \b, unknown character set 29756# look for explicit codepage keyword 29757# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 29758#>5 search/110 \\ansicpg 29759>5 search/500 \\ansicpg 29760# skip unknown or buggy codepage string 0 like in fdo78502.rtf 29761>>&0 ubyte !0x30 \b, code page 29762# codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi 29763>>>&-1 string x %-.3s 29764# skip space or \ and display possible 4th digit of code page string 29765>>>&2 ubyte >0x2F 29766>>>>&-1 ubyte <0x3A \b%c 29767# possible 5th digit of code page string 29768>>>>>&0 ubyte >0x2F 29769>>>>>>&-1 ubyte <0x3A \b%c 29770# look again at version byte to use default clause 29771>5 ubyte x 29772# Default language ID for South Asian/Middle Eastern text 29773# language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica 29774# Readme-0.72-Persian.rtf 29775#>6 search/1 \\adeflang \b, default middle east language ID 29776>>6 search/497 \\adeflang \b, default middle east language ID 29777# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 29778>>>&0 string x %.4s 29779# skip \ and NL and show possible 5th digit of language string 29780>>>&4 ubyte >0x2F 29781>>>>&-1 ubyte <0x3A \b%c 29782# else look for default language to be used when the \plain control word is encountered 29783>>6 default x 29784# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 29785#>>>6 search/127 \\deflang 29786>>>6 search/505 \\deflang 29787>>>>&0 string >0 \b, default language ID %-.4s 29788# possible 5th digit of language string 29789>>>>&4 ubyte >0x2F 29790>>>>>&-1 ubyte <0x3A \b%c 29791 29792# Reference: http://latex2rtf.sourceforge.net/rtfspec_63.html 29793# Note: no real world example found 297940 string {\\urtf Rich Text Format unicoded data 29795!:mime text/rtf 29796#!:apple ????RTF 29797!:ext rtf 29798>1 use rtf-info 29799 29800# URL: https://en.wikipedia.org/wiki/Microsoft_Word 29801# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Word 29802# Note: called by TrID "Pocket Word document" 29803# by PlanMaker "Pocket Word-Handheld PC" for pwd 29804# by PlanMaker "Pocket Word-Pocket PC" for psw 298050 string {\\pwd Pocket Word document or template 29806# by SoftMaker Office http://extension.nirsoft.net/pwd 29807#!:mime application/msword 29808# https://reposcope.com/mimetype/application/x-pocket-word 29809!:mime application/x-pocket-word 29810# PWD for Handheld PC variant and PSW for Pocket PC variant 29811# PWT for template 29812!:ext pwd/psw/pwt 29813>0 use rtf-info 29814 29815 29816#------------------------------------------------------------------------------ 29817# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $ 29818# ruby: file(1) magic for Ruby scripting language 29819# URL: https://www.ruby-lang.org/ 29820# From: Reuben Thomas <rrt@sc3d.org> 29821 29822# Ruby scripts 298230 search/1/w #!\ /usr/bin/ruby Ruby script text executable 29824!:strength + 15 29825!:mime text/x-ruby 298260 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 29827!:strength + 15 29828!:mime text/x-ruby 298290 search/1 #!/usr/bin/env\ ruby Ruby script text executable 29830!:strength + 15 29831!:mime text/x-ruby 298320 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 29833!:strength + 15 29834!:mime text/x-ruby 29835 29836# What looks like ruby, but does not have a shebang 29837# (modules and such) 29838# From: Lubomir Rintel <lkundrak@v3.sk> 298390 search/8192 require 29840>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' 29841>>0 regex def\ [a-z]|\ do$ 29842>>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 29843!:strength + 30 29844!:mime text/x-ruby 298450 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 29846>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 29847>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 29848!:strength + 30 29849!:mime text/x-ruby 29850# Classes with no modules or defs, beats simple ASCII 298510 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 29852>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text 29853!:strength + 10 29854!:mime text/x-ruby 29855# Looks for function definition to balance python magic 29856# def name (args) 29857# end 298580 search/8192 def\ 29859>0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z] 29860>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 29861!:strength + 10 29862!:mime text/x-ruby 29863 298640 search/8192 require 29865>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' Ruby script text 29866!:mime text/x-ruby 298670 search/8192 include 29868>0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text 29869!:mime text/x-ruby 29870 29871#------------------------------------------------------------------------------ 29872# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 29873# sc: file(1) magic for "sc" spreadsheet 29874# 2987538 string Spreadsheet sc spreadsheet file 29876!:mime application/x-sc 29877 29878#------------------------------------------------------------------------------ 29879# $File: sccs,v 1.8 2020/06/20 21:32:52 christos Exp $ 29880# sccs: file(1) magic for SCCS archives 29881# 29882# SCCS v4 archive structure: 29883# \001h01207 29884# \001s 00276/00000/00000 29885# \001d D 1.1 87/09/23 08:09:20 ian 1 0 29886# \001c date and time created 87/09/23 08:09:20 by ian 29887# \001e 29888# \001u 29889# \001U 29890# ... etc. 29891# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 29892# *Sigh*. And these both came from various parts of the USG. 29893# Maybe we should just switch everybody from SCCS to RCS! 29894# Further, you can't just say '\001h0', because the five-digit number 29895# is a checksum that could (presumably) have any leading digit, 29896# Fortunately we have regular expression matching: 298970 string \001h 29898>2 regex [0-9][0-9][0-9][0-9][0-9]$ 29899>>8 string \001s\040 SCCS v4 archive data 29900>2 string V6,sum= SCCS v6 archive data 29901 29902#------------------------------------------------------------------------------ 29903# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $ 29904# scientific: file(1) magic for scientific formats 29905# 29906# From: Joe Krahn <krahn@niehs.nih.gov> 29907 29908######################################################## 29909# CCP4 data and plot files: 299100 string MTZ\040 MTZ reflection file 29911 2991292 string PLOT%%84 Plot84 plotting file 29913>52 byte 1 , Little-endian 29914>55 byte 1 , Big-endian 29915 29916######################################################## 29917# Electron density MAP/MASK formats 29918 299190 string EZD_MAP NEWEZD Electron Density Map 29920109 string MAP\040( Old EZD Electron Density Map 29921 299220 string/c :-)\040Origin BRIX Electron Density Map 29923>170 string >0 , Sigma:%.12s 29924#>4 string >0 %.178s 29925#>4 addr x %.178s 29926 299277 string 18\040!NTITLE XPLOR ASCII Electron Density Map 299289 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 29929 29930208 string MAP\040 CCP4 Electron Density Map 29931# Assumes same stamp for float and double (normal case) 29932>212 byte 17 \b, Big-endian 29933>212 byte 34 \b, VAX format 29934>212 byte 68 \b, Little-endian 29935>212 byte 85 \b, Convex native 29936 29937############################################################ 29938# X-Ray Area Detector images 299390 string R-AXIS4\ \ \ R-Axis Area Detector Image: 29940>796 lelong <20 Little-endian, IP #%d, 29941>>768 lelong >0 Size=%dx 29942>>772 lelong >0 \b%d 29943>796 belong <20 Big-endian, IP #%d, 29944>>768 belong >0 Size=%dx 29945>>772 belong >0 \b%d 29946 299470 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 29948>796 lelong <20 Little-endian, IP #%d, 29949>>768 lelong >0 Size=%dx 29950>>772 lelong >0 \b%d 29951>796 belong <20 Big-endian, IP #%d, 29952>>768 belong >0 Size=%dx 29953>>772 belong >0 \b%d 29954 29955 299561028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 29957>1072 ulong >1 Compressed(%d), 29958>1100 ulong >1 %d headers, 29959>1104 ulong >0 %d x 29960>1108 ulong >0 %d, 29961>1120 ulong >0 %d bits/pixel 29962 29963# Type: GEDCOM genealogical (family history) data 29964# From: Giuseppe Bilotta 299650 search/1/c 0\ HEAD GEDCOM genealogy text 29966>&0 search 1\ GEDC 29967>>&0 search 2\ VERS version 29968>>>&1 string >\0 %s 29969# From: Phil Endecott <phil05@chezphil.org> 299700 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 299710 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 299720 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 299730 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 29974 29975# PDB: Protein Data Bank files 29976# Adam Buchbinder <adam.buchbinder@gmail.com> 29977# 29978# https://www.wwpdb.org/documentation/format32/sect2.html 29979# https://www.ch.ic.ac.uk/chemime/ 29980# 29981# The PDB file format is fixed-field, 80 columns. From the spec: 29982# 29983# COLS DATA 29984# 1 - 6 "HEADER" 29985# 11 - 50 String(40) 29986# 51 - 59 Date 29987# 63 - 66 IDcode 29988# 29989# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 29990# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 29991# uppercase letters. However, examples have been seen without the date string, 29992# e.g., the example on the chemime site. 299930 string HEADER\ \ \ \040 29994>&0 regex/1l \^.{40} 29995>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 29996>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 29997>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 29998!:mime chemical/x-pdb 29999>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 30000 30001# Type: GDSII Stream file 300020 belong 0x00060002 GDSII Stream file 30003>4 byte 0x00 30004>>5 byte x version %d.0 30005>4 byte >0x00 version %d 30006>>5 byte x \b.%d 30007 30008# Type: LXT (interLaced eXtensible Trace) 30009# chrysn <chrysn@fsfe.org> 300100 beshort 0x0138 interLaced eXtensible Trace (LXT) file 30011>2 beshort >0 (Version %u) 30012 30013#------------------------------------------------------------------------------ 30014# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 300150 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 300160 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 300170 belong 0xedfeedfe Sun 'jks' Java Keystore File data 30018 300190 string \0volume_key volume_key escrow packet 30020# Type: SE Linux policy modules *.pp reference policy 30021# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 30022# URL: https://doc.coker.com.au/computers/selinux-magic 30023# From: Russell Coker <russell@coker.com.au> 30024 300250 lelong 0xf97cff8f SE Linux modular policy 30026>4 lelong x version %d, 30027>8 lelong x %d sections, 30028>>(12.l) lelong 0xf97cff8d 30029>>>(12.l+27) lelong x mod version %d, 30030>>>(12.l+31) lelong 0 Not MLS, 30031>>>(12.l+31) lelong 1 MLS, 30032>>>(12.l+23) lelong 2 30033>>>>(12.l+47) string >\0 module name %s 30034>>>(12.l+23) lelong 1 base 30035 300361 string policy_module( SE Linux policy module source 300372 string policy_module( SE Linux policy module source 30038 300390 string ##\ <summary> SE Linux policy interface source 30040 30041#0 search gen_context( SE Linux policy file contexts 30042 30043#0 search gen_sens( SE Linux policy MLS constraints source 30044 30045#------------------------------------------------------------------------------ 30046# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $ 30047# sendmail: file(1) magic for sendmail config files 30048# 30049# XXX - byte order? 30050# 30051# Update: Joerg Jenderek 30052# GRR: this test is too general as it catches also 30053# READ.ME.FIRST.AWP Sendmail frozen configuration 30054# - version ====|====|====|====|====|====|====|====|====|====|====|====|=== 30055# Email_23_f217153422.ts Sendmail frozen configuration 30056# - version \330jK\354 300570 byte 046 30058# https://www.sendmail.com/sm/open_source/docs/older_release_notes/ 30059# freezed configuration file (dbm format?) created from sendmal.cf with -bz 30060# by older sendmail. til version 8.6 support for frozen configuration files is removed 30061# valid version numbers look like "7.14.4" and should be similar to output of commands 30062# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf" 30063>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 30064# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc 30065!:ext fc 30066>>16 string >\0 - version %s 300670 short 0x271c 30068# look for valid version number 30069>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 30070!:ext fc 30071>>16 string >\0 - version %s 30072 30073#------------------------------------------------------------------------------ 30074# sendmail: file(1) magic for sendmail m4(1) files 30075# 30076# From Hendrik Scholz <hendrik@scholz.net> 30077# i.e. files in /usr/share/sendmail/cf/ 30078# 300790 string divert(-1)\n sendmail m4 text file 30080 30081 30082#------------------------------------------------------------------------------ 30083# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $ 30084# sequent: file(1) magic for Sequent machines 30085# 30086# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 30087# For Sequent's multiprocessor systems (incomplete). 300880 lelong 0x00ea BALANCE NS32000 .o 30089>16 lelong >0 not stripped 30090>124 lelong >0 version %d 300910 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 30092>16 lelong >0 not stripped 30093>124 lelong >0 version %d 300940 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 30095>16 lelong >0 not stripped 30096>124 lelong >0 version %d 300970 lelong 0x30ea BALANCE NS32000 standalone executable 30098>16 lelong >0 not stripped 30099>124 lelong >0 version %d 30100# 30101# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 30102# Symmetry magic nums will not be reached if DOS COM comes before them; 30103# byte 0xeb is matched before these get a chance. 301040 leshort 0x12eb SYMMETRY i386 .o 30105>16 lelong >0 not stripped 30106>124 lelong >0 version %d 301070 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 30108>16 lelong >0 not stripped 30109>124 lelong >0 version %d 301100 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 30111>16 lelong >0 not stripped 30112>124 lelong >0 version %d 30113# https://en.wikipedia.org/wiki/Sequent_Computer_Systems 30114# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 30115#0 leshort 0x42eb SYMMETRY i386 standalone executable 301160 leshort 0x42eb 30117# skip unlike negative version 30118>124 lelong >-1 30119# assuming version 28867614 is very low probable 30120>>124 lelong !28867614 SYMMETRY i386 standalone executable 30121>>>16 lelong >0 not stripped 30122>>>124 lelong >0 version %d 30123 30124#------------------------------------------------------------------------------ 30125# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $ 30126# sereal: file(1) magic the Sereal binary serialization format 30127# 30128# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 30129# 30130# See the specification of the format at 30131# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 30132# 30133# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 30134# doing (byte&0xF0)>>4 here, but unfortunately that's not 30135# supported. So when we print out a message about an unknown format 30136# we'll print out e.g. 0x30 instead of the more human-readable 30137# 0x30>>4. 30138# 30139# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 30140# Sereal.git repository for test Sereal data. 301410 name sereal 30142>4 byte&0x0F x (version %d, 30143>4 byte&0xF0 0x00 uncompressed) 30144>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 30145>4 byte&0xF0 0x20 compressed with incremental Snappy) 30146>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 30147 301480 string/b \=srl Sereal data packet 30149!:mime application/sereal 30150>&0 use sereal 301510 string/b \=\xF3rl Sereal data packet 30152!:mime application/sereal 30153>&0 use sereal 301540 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 30155!:mime application/sereal 30156>&0 use sereal 30157 30158 30159#------------------------------------------------------------------------------ 30160# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $ 30161# sgi: file(1) magic for Silicon Graphics operating systems and applications 30162# 30163# Executable images are handled either in aout (for old-style a.out 30164# files for 68K; they are indistinguishable from other big-endian 32-bit 30165# a.out files) or in mips (for MIPS ECOFF and Ucode files) 30166# 30167 30168# kbd file definitions 301690 string kbd!map kbd map file 30170>8 byte >0 Ver %d: 30171>10 short >0 with %d table(s) 30172 301730 beshort 0x8765 disk quotas file 30174 301750 beshort 0x0506 IRIS Showcase file 30176>2 byte 0x49 - 30177>3 byte x - version %d 301780 beshort 0x0226 IRIS Showcase template 30179>2 byte 0x63 - 30180>3 byte x - version %d 301810 belong 0x5343464d IRIS Showcase file 30182>4 byte x - version %d 301830 belong 0x5443464d IRIS Showcase template 30184>4 byte x - version %d 301850 belong 0xdeadbabe IRIX Parallel Arena 30186>8 belong >0 - version %d 30187 30188# core files 30189# 30190# 32bit core file 301910 belong 0xdeadadb0 IRIX core dump 30192>4 belong 1 of 30193>16 string >\0 '%s' 30194# 64bit core file 301950 belong 0xdeadad40 IRIX 64-bit core dump 30196>4 belong 1 of 30197>16 string >\0 '%s' 30198# N32bit core file 301990 belong 0xbabec0bb IRIX N32 core dump 30200>4 belong 1 of 30201>16 string >\0 '%s' 30202# New style crash dump file 302030 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 30204>36 string >\0 '%s' 30205 30206# Trusted IRIX info 302070 string SGIAUDIT SGI Audit file 30208>8 byte x - version %d 30209>9 byte x \b.%d 30210# 302110 string WNGZWZSC Wingz compiled script 302120 string WNGZWZSS Wingz spreadsheet 302130 string WNGZWZHP Wingz help file 30214# 302150 string #Inventor\040V IRIS Inventor 1.0 file 302160 string #Inventor\040V2 Open Inventor 2.0 file 30217# GLF is OpenGL stream encoding 302180 string glfHeadMagic(); GLF_TEXT 302194 belong 0x7d000000 GLF_BINARY_LSB_FIRST 30220!:strength -30 302214 belong 0x0000007d GLF_BINARY_MSB_FIRST 30222!:strength -30 30223# GLS is OpenGL stream encoding; GLS is the successor of GLF 302240 string glsBeginGLS( GLS_TEXT 302254 belong 0x10000000 GLS_BINARY_LSB_FIRST 30226!:strength -30 302274 belong 0x00000010 GLS_BINARY_MSB_FIRST 30228!:strength -30 30229 30230# Performance Co-Pilot file types 302310 string PmNs PCP compiled namespace (V.0) 302320 string PmN PCP compiled namespace 30233>3 string >\0 (V.%1.1s) 30234#3 lelong 0x84500526 PCP archive 302353 belong 0x84500526 PCP archive 30236>7 byte x (V.%d) 30237#>20 lelong -2 temporal index 30238#>20 lelong -1 metadata 30239#>20 lelong 0 log volume #0 30240#>20 lelong >0 log volume #%d 30241>20 belong -2 temporal index 30242>20 belong -1 metadata 30243>20 belong 0 log volume #0 30244>20 belong >0 log volume #%d 30245>24 string >\0 host: %s 302460 string PCPFolio PCP 30247>9 string Version: Archive Folio 30248>18 string >\0 (V.%s) 302490 string #pmchart PCP pmchart view 30250>9 string Version 30251>17 string >\0 (V%-3.3s) 302520 string #kmchart PCP kmchart view 30253>9 string Version 30254>17 string >\0 (V.%s) 302550 string pmview PCP pmview config 30256>7 string Version 30257>15 string >\0 (V%-3.3s) 302580 string #pmlogger PCP pmlogger config 30259>10 string Version 30260>18 string >\0 (V%1.1s) 302610 string #pmdahotproc PCP pmdahotproc config 30262>13 string Version 30263>21 string >\0 (V%-3.3s) 302640 string PcPh PCP Help 30265>4 string 1 Index 30266>4 string 2 Text 30267>5 string >\0 (V.%1.1s) 302680 string #pmieconf-rules PCP pmieconf rules 30269>16 string >\0 (V.%1.1s) 302703 string pmieconf-pmie PCP pmie config 30271>17 string >\0 (V.%1.1s) 302720 string MMV PCP memory mapped values 30273>4 long x (V.%d) 30274 30275# SpeedShop data files 302760 lelong 0x13130303 SpeedShop data file 30277 30278# mdbm files 302790 lelong 0x01023962 mdbm file, version 0 (obsolete) 302800 string mdbm mdbm file, 30281>5 byte x version %d, 30282>6 byte x 2^%d pages, 30283>7 byte x pagesize 2^%d, 30284>17 byte x hash %d, 30285>11 byte x dataformat %d 30286 30287# Alias Maya files 302880 string/t //Maya\040ASCII Alias Maya Ascii File, 30289>13 string >\0 version %s 302908 string MAYAFOR4 Alias Maya Binary File, 30291>32 string >\0 version %s scene 302928 string MayaFOR4 Alias Maya Binary File, 30293>32 string >\0 version %s scene 302948 string CIMG Alias Maya Image File 302958 string DEEP Alias Maya Image File 30296 30297#------------------------------------------------------------------------------ 30298# $File: sgml,v 1.42 2020/12/12 20:01:47 christos Exp $ 30299# Type: SVG Vectorial Graphics 30300# From: Noel Torres <tecnico@ejerciciosresueltos.com> 303010 string/bt \<?xml\ version= 30302>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30303>>19 search/4096 \<svg SVG Scalable Vector Graphics image 30304!:strength +50 30305!:mime image/svg+xml 30306>>19 search/4096 \<gnc-v2 GnuCash file 30307!:mime application/x-gnucash 303080 string/bt \<svg SVG Scalable Vector Graphics image 30309!:mime image/svg+xml 30310 30311# Sitemap file 303120 string/t \<?xml\ version= 30313>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30314>>19 search/4096 \<urlset XML Sitemap document text 30315!:mime application/xml-sitemap 30316 30317# OpenStreetMap XML (.osm) 30318# https://wiki.openstreetmap.org/wiki/OSM_XML 30319# From: Markus Heidelberg <markus.heidelberg@web.de> 303200 string \<?xml\ version= 30321>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30322>>19 search/4096 \<osm OpenStreetMap XML data 30323 30324# xhtml 303250 string/t \<?xml\ version=" 30326>19 search/4096/cWbt \<!doctype\ html XHTML document text 30327>>15 string >\0 (version %.3s) 30328!:mime text/html 303290 string/t \<?xml\ version=' 30330>19 search/4096/cWbt \<!doctype\ html XHTML document text 30331>>15 string >\0 (version %.3s) 30332!:mime text/html 303330 string/t \<?xml\ version=" 30334>19 search/4096/cWbt \<html broken XHTML document text 30335>>15 string >\0 (version %.3s) 30336!:mime text/html 30337 30338#------------------------------------------------------------------------------ 30339# sgml: file(1) magic for Standard Generalized Markup Language 30340# HyperText Markup Language (HTML) is an SGML document type, 30341# from Daniel Quinlan (quinlan@yggdrasil.com) 30342# adapted to string extensions by Anthon van der Neut <anthon@mnt.org) 303430 search/4096/cWt \<!doctype\ html HTML document text 30344!:mime text/html 30345!:strength + 5 30346 30347# SVG document 30348# https://www.w3.org/TR/SVG/single-page.html 303490 search/4096/cWbt \<!doctype\ svg SVG XML document 30350!:mime image/svg+xml 30351!:strength + 5 30352 303530 search/4096/cwt \<head\> HTML document text 30354!:mime text/html 30355!:strength + 5 303560 search/4096/cWt \<head\ HTML document text 30357!:mime text/html 30358!:strength + 5 303590 search/4096/cwt \<title\> HTML document text 30360!:mime text/html 30361!:strength + 5 303620 search/4096/cWt \<title\ HTML document text 30363!:mime text/html 30364!:strength + 5 303650 search/4096/cwt \<html\> HTML document text 30366!:mime text/html 30367!:strength + 5 303680 search/4096/cWt \<html\ HTML document text 30369!:mime text/html 30370!:strength + 5 303710 search/4096/cwt \<script\> HTML document text 30372!:mime text/html 30373!:strength + 5 303740 search/4096/cWt \<script\ HTML document text 30375!:mime text/html 30376!:strength + 5 303770 search/4096/cwt \<style\> HTML document text 30378!:mime text/html 30379!:strength + 5 303800 search/4096/cWt \<style\ HTML document text 30381!:mime text/html 30382!:strength + 5 303830 search/4096/cwt \<table\> HTML document text 30384!:mime text/html 30385!:strength + 5 303860 search/4096/cWt \<table\ HTML document text 30387!:mime text/html 30388!:strength + 5 30389 303900 search/4096/cwt \<a\ href= HTML document text 30391!:mime text/html 30392!:strength + 5 30393 30394# Extensible markup language (XML), a subset of SGML 30395# from Marc Prud'hommeaux (marc@apocalypse.org) 303960 search/1/cwt \<?xml XML document text 30397!:mime text/xml 30398!:strength + 5 303990 string/t \<?xml\ version\ " XML 30400!:mime text/xml 30401!:strength + 5 304020 string/t \<?xml\ version=" XML 30403!:mime text/xml 30404!:strength + 5 30405>15 string/t >\0 %.3s document text 30406>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 30407>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 304080 string/t \<?xml\ version=' XML 30409!:mime text/xml 30410!:strength + 5 30411>15 string/t >\0 %.3s document text 30412>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 30413>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 304140 search/1/wt \<?XML broken XML document text 30415!:mime text/xml 30416!:strength - 10 30417 30418 30419# SGML, mostly from rph@sq 304200 search/4096/cwt \<!doctype exported SGML document text 304210 search/4096/cwt \<!subdoc exported SGML subdocument text 304220 search/4096/cwt \<!-- exported SGML document text 30423!:strength - 10 30424 30425# Web browser cookie files 30426# (Mozilla, Galeon, Netscape 4, Konqueror..) 30427# Ulf Harnhammar <ulfh@update.uu.se> 304280 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 304290 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 304300 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 30431 30432# XML-based format representing braille pages in a digital format. 30433# 30434# Specification: 30435# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html 30436# 30437# Simon Aittamaa <simon.aittamaa@gmail.com> 304380 string \<?xml\ version= 30439>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 30440>>19 search/4096 \<pef Portable Embosser Format 30441!:mime application/x-pef+xml 30442 30443#------------------------------------------------------------------------ 30444# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $ 30445# file(1) magic for sharc files 30446# 30447# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 30448# FutureGroove Music (dsp@futuregroove.de) 30449 30450#------------------------------------------------------------------------ 30451#0 string Draw RiscOS Drawfile 30452#0 string PACK RiscOS PackdDir archive 30453 30454#------------------------------------------------------------------------ 30455# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 30456 30457#0 string =! Assembler source 30458#0 string Analog ADi asm listing file 304590 string .SYSTEM SHARC architecture file 304600 string .system SHARC architecture file 30461 304620 leshort 0x521C SHARC COFF binary 30463>2 leshort >1 , %d sections 30464>>12 lelong >0 , not stripped 30465 30466#------------------------------------------------------------------------------ 30467# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $ 30468# sinclair: file(1) sinclair QL 30469 30470# additions to /etc/magic by Thomas M. Ott (ThMO) 30471 30472# Sinclair QL floppy disk formats (ThMO) 304730 string =QL5 QL disk dump data, 30474>3 string =A 720 KB, 30475>3 string =B 1.44 MB, 30476>3 string =C 3.2 MB, 30477>4 string >\0 label:%.10s 30478 30479# Sinclair QL OS dump (ThMO) 304800 belong =0x30000 30481>49124 belong <47104 30482>>49128 belong <47104 30483>>>49132 belong <47104 30484>>>>49136 belong <47104 QL OS dump data, 30485>>>>>49148 string >\0 type %.3s, 30486>>>>>49142 string >\0 version %.4s 30487 30488# Sinclair QL firmware executables (ThMO) 304890 string NqNqNq`\004 QL firmware executable (BCPL) 30490 30491# Sinclair QL libraries (was ThMO) 304920 beshort 0xFB01 QDOS object 30493>2 pstring x '%s' 30494 30495# Sinclair QL executables (was ThMO) 304964 belong 0x4AFB QDOS executable 30497>9 pstring x '%s' 30498 30499# Sinclair QL ROM (ThMO) 305000 belong =0x4AFB0001 QL plugin-ROM data, 30501>9 pstring =\0 un-named 30502>9 pstring >\0 named: %s 30503# Type: SiSU Markup Language 30504# URL: http://www.sisudoc.org/ 30505# From: Ralph Amissah <ralph.amissah@gmail.com> 30506 305070 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 30508>5 regex [0-9.]+ %s 30509 305100 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 30511>5 regex [0-9.]+ %s 30512 305130 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 30514>5 regex [0-9.]+ %s 30515 305160 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 30517>5 regex [0-9.]+ %s 30518 305190 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 30520>5 regex [0-9.]+ %s 30521 30522#------------------------------------------------------------------------------ 30523# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $ 30524# Sketch Drawings: http://sketch.sourceforge.net/ 30525# From: Edwin Mons <e@ik.nu> 305260 search/1 ##Sketch Sketch document text 30527 30528#----------------------------------------------- 30529# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 30530# GNU Smalltalk image, starting at version 1.6.2 30531# From: catull_us@yahoo.com 30532# 305330 string GSTIm\0\0 GNU SmallTalk 30534# little-endian 30535>7 byte&1 =0 LE image version 30536>>10 byte x %d. 30537>>9 byte x \b%d. 30538>>8 byte x \b%d 30539#>>12 lelong x , data: %ld 30540#>>16 lelong x , table: %ld 30541#>>20 lelong x , memory: %ld 30542# big-endian 30543>7 byte&1 =1 BE image version 30544>>8 byte x %d. 30545>>9 byte x \b%d. 30546>>10 byte x \b%d 30547#>>12 belong x , data: %ld 30548#>>16 belong x , table: %ld 30549#>>20 belong x , memory: %ld 30550 30551 30552 30553#------------------------------------------------------------------------------ 30554# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 30555# smile: file(1) magic for Smile serialization 30556# 30557# The Smile serialization format uses a 4-byte header: 30558# 30559# Constant byte #0: 0x3A (ASCII ':') 30560# Constant byte #1: 0x29 (ASCII ')') 30561# Constant byte #2: 0x0A (ASCII linefeed, '\n') 30562# Variable byte #3, consisting of bits: 30563# Bits 4-7 (4 MSB): 4-bit version number 30564# Bits 3: Reserved 30565# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 30566# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 30567# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 30568# 30569# Reference: http://wiki.fasterxml.com/SmileFormatSpec 30570# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 30571 30572# Detection 305730 string :)\n Smile binary data 30574 30575# Versioning 30576>3 byte&0xF0 x version %d: 30577 30578# Properties 30579>3 byte&0x04 0x04 binary raw, 30580>3 byte&0x04 0x00 binary encoded, 30581>3 byte&0x02 0x02 shared String values enabled, 30582>3 byte&0x02 0x00 shared String values disabled, 30583>3 byte&0x01 0x01 shared field names enabled 30584>3 byte&0x01 0x00 shared field names disabled 30585 30586 30587#------------------------------------------------------------------------------ 30588# $File: sniffer,v 1.29 2021/03/13 18:51:51 christos Exp $ 30589# sniffer: file(1) magic for packet capture files 30590# 30591# From: guy@alum.mit.edu (Guy Harris) 30592# 30593 30594# 30595# Microsoft Network Monitor 1.x capture files. 30596# 305970 string RTSS NetMon capture file 30598>5 byte x - version %d 30599>4 byte x \b.%d 30600>6 leshort 0 (Unknown) 30601>6 leshort 1 (Ethernet) 30602>6 leshort 2 (Token Ring) 30603>6 leshort 3 (FDDI) 30604>6 leshort 4 (ATM) 30605>6 leshort >4 (type %d) 30606 30607# 30608# Microsoft Network Monitor 2.x capture files. 30609# 306100 string GMBU NetMon capture file 30611>5 byte x - version %d 30612>4 byte x \b.%d 30613>6 leshort 0 (Unknown) 30614>6 leshort 1 (Ethernet) 30615>6 leshort 2 (Token Ring) 30616>6 leshort 3 (FDDI) 30617>6 leshort 4 (ATM) 30618>6 leshort 5 (IP-over-IEEE 1394) 30619>6 leshort 6 (802.11) 30620>6 leshort 7 (Raw IP) 30621>6 leshort 8 (Raw IP) 30622>6 leshort 9 (Raw IP) 30623>6 leshort >9 (type %d) 30624 30625# 30626# Network General Sniffer capture files. 30627# Sorry, make that "Network Associates Sniffer capture files." 30628# Sorry, make that "Network General old DOS Sniffer capture files." 30629# 306300 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file 30631>33 byte 2 (compressed) 30632>23 leshort x - version %d 30633>25 leshort x \b.%d 30634>32 byte 0 (Token Ring) 30635>32 byte 1 (Ethernet) 30636>32 byte 2 (ARCNET) 30637>32 byte 3 (StarLAN) 30638>32 byte 4 (PC Network broadband) 30639>32 byte 5 (LocalTalk) 30640>32 byte 6 (Znet) 30641>32 byte 7 (Internetwork Analyzer) 30642>32 byte 9 (FDDI) 30643>32 byte 10 (ATM) 30644 30645# 30646# Cinco Networks NetXRay capture files. 30647# Sorry, make that "Network General Sniffer Basic capture files." 30648# Sorry, make that "Network Associates Sniffer Basic capture files." 30649# Sorry, make that "Network Associates Sniffer Basic, and Windows 30650# Sniffer Pro", capture files." 30651# Sorry, make that "Network General Sniffer capture files." 30652# Sorry, make that "NetScout Sniffer capture files." 30653# 306540 string XCP\0 NetXRay capture file 30655>4 string >\0 - version %s 30656>44 leshort 0 (Ethernet) 30657>44 leshort 1 (Token Ring) 30658>44 leshort 2 (FDDI) 30659>44 leshort 3 (WAN) 30660>44 leshort 8 (ATM) 30661>44 leshort 9 (802.11) 30662 30663# 30664# "libpcap" capture files. 30665# https://www.tcpdump.org/manpages/pcap-savefile.5.html 30666# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 30667# the main program that uses that format, but there are other programs 30668# that use "libpcap", or that use the same capture file format.) 30669# 306700 name pcap-be 30671>4 beshort x - version %d 30672>6 beshort x \b.%d 30673# clear that continuation level match 30674>20 clear x 30675>20 belong&0x03FFFFFF 0 (No link-layer encapsulation 30676>20 belong&0x03FFFFFF 1 (Ethernet 30677>20 belong&0x03FFFFFF 2 (3Mb Ethernet 30678>20 belong&0x03FFFFFF 3 (AX.25 30679>20 belong&0x03FFFFFF 4 (ProNET 30680>20 belong&0x03FFFFFF 5 (CHAOS 30681>20 belong&0x03FFFFFF 6 (Token Ring 30682>20 belong&0x03FFFFFF 7 (BSD ARCNET 30683>20 belong&0x03FFFFFF 8 (SLIP 30684>20 belong&0x03FFFFFF 9 (PPP 30685>20 belong&0x03FFFFFF 10 (FDDI 30686>20 belong&0x03FFFFFF 11 (RFC 1483 ATM 30687>20 belong&0x03FFFFFF 12 (Raw IP 30688>20 belong&0x03FFFFFF 13 (BSD/OS SLIP 30689>20 belong&0x03FFFFFF 14 (BSD/OS PPP 30690>20 belong&0x03FFFFFF 19 (Linux ATM Classical IP 30691>20 belong&0x03FFFFFF 50 (PPP or Cisco HDLC 30692>20 belong&0x03FFFFFF 51 (PPP-over-Ethernet 30693>20 belong&0x03FFFFFF 99 (Symantec Enterprise Firewall 30694>20 belong&0x03FFFFFF 100 (RFC 1483 ATM 30695>20 belong&0x03FFFFFF 101 (Raw IP 30696>20 belong&0x03FFFFFF 102 (BSD/OS SLIP 30697>20 belong&0x03FFFFFF 103 (BSD/OS PPP 30698>20 belong&0x03FFFFFF 104 (BSD/OS Cisco HDLC 30699>20 belong&0x03FFFFFF 105 (802.11 30700>20 belong&0x03FFFFFF 106 (Linux Classical IP over ATM 30701>20 belong&0x03FFFFFF 107 (Frame Relay 30702>20 belong&0x03FFFFFF 108 (OpenBSD loopback 30703>20 belong&0x03FFFFFF 109 (OpenBSD IPsec encrypted 30704>20 belong&0x03FFFFFF 112 (Cisco HDLC 30705>20 belong&0x03FFFFFF 113 (Linux cooked v1 30706>20 belong&0x03FFFFFF 114 (LocalTalk 30707>20 belong&0x03FFFFFF 117 (OpenBSD PFLOG 30708>20 belong&0x03FFFFFF 119 (802.11 with Prism header 30709>20 belong&0x03FFFFFF 122 (RFC 2625 IP over Fibre Channel 30710>20 belong&0x03FFFFFF 123 (SunATM 30711>20 belong&0x03FFFFFF 127 (802.11 with radiotap header 30712>20 belong&0x03FFFFFF 129 (Linux ARCNET 30713>20 belong&0x03FFFFFF 130 (Juniper Multi-Link PPP 30714>20 belong&0x03FFFFFF 131 (Juniper Multi-Link Frame Relay 30715>20 belong&0x03FFFFFF 132 (Juniper Encryption Services PIC 30716>20 belong&0x03FFFFFF 133 (Juniper GGSN PIC 30717>20 belong&0x03FFFFFF 134 (Juniper FRF.16 Frame Relay 30718>20 belong&0x03FFFFFF 135 (Juniper ATM2 PIC 30719>20 belong&0x03FFFFFF 136 (Juniper Advanced Services PIC 30720>20 belong&0x03FFFFFF 137 (Juniper ATM1 PIC 30721>20 belong&0x03FFFFFF 138 (Apple IP over IEEE 1394 30722>20 belong&0x03FFFFFF 139 (SS7 MTP2 with pseudo-header 30723>20 belong&0x03FFFFFF 140 (SS7 MTP2 30724>20 belong&0x03FFFFFF 141 (SS7 MTP3 30725>20 belong&0x03FFFFFF 142 (SS7 SCCP 30726>20 belong&0x03FFFFFF 143 (DOCSIS 30727>20 belong&0x03FFFFFF 144 (Linux IrDA 30728>20 belong&0x03FFFFFF 147 (Private use 0 30729>20 belong&0x03FFFFFF 148 (Private use 1 30730>20 belong&0x03FFFFFF 149 (Private use 2 30731>20 belong&0x03FFFFFF 150 (Private use 3 30732>20 belong&0x03FFFFFF 151 (Private use 4 30733>20 belong&0x03FFFFFF 152 (Private use 5 30734>20 belong&0x03FFFFFF 153 (Private use 6 30735>20 belong&0x03FFFFFF 154 (Private use 7 30736>20 belong&0x03FFFFFF 155 (Private use 8 30737>20 belong&0x03FFFFFF 156 (Private use 9 30738>20 belong&0x03FFFFFF 157 (Private use 10 30739>20 belong&0x03FFFFFF 158 (Private use 11 30740>20 belong&0x03FFFFFF 159 (Private use 12 30741>20 belong&0x03FFFFFF 160 (Private use 13 30742>20 belong&0x03FFFFFF 161 (Private use 14 30743>20 belong&0x03FFFFFF 162 (Private use 15 30744>20 belong&0x03FFFFFF 163 (802.11 with AVS header 30745>20 belong&0x03FFFFFF 164 (Juniper Passive Monitor PIC 30746>20 belong&0x03FFFFFF 165 (BACnet MS/TP 30747>20 belong&0x03FFFFFF 166 (PPPD 30748>20 belong&0x03FFFFFF 167 (Juniper PPPoE 30749>20 belong&0x03FFFFFF 168 (Juniper PPPoE/ATM 30750>20 belong&0x03FFFFFF 169 (GPRS LLC 30751>20 belong&0x03FFFFFF 170 (GPF-T 30752>20 belong&0x03FFFFFF 171 (GPF-F 30753>20 belong&0x03FFFFFF 174 (Juniper PIC Peer 30754>20 belong&0x03FFFFFF 175 (Ethernet with Endace ERF header 30755>20 belong&0x03FFFFFF 176 (Packet-over-SONET with Endace ERF header 30756>20 belong&0x03FFFFFF 177 (Linux LAPD 30757>20 belong&0x03FFFFFF 178 (Juniper Ethernet 30758>20 belong&0x03FFFFFF 179 (Juniper PPP 30759>20 belong&0x03FFFFFF 180 (Juniper Frame Relay 30760>20 belong&0x03FFFFFF 181 (Juniper C-HDLC 30761>20 belong&0x03FFFFFF 182 (FRF.16 Frame Relay 30762>20 belong&0x03FFFFFF 183 (Juniper Voice PIC 30763>20 belong&0x03FFFFFF 184 (Arinc 429 30764>20 belong&0x03FFFFFF 185 (Arinc 653 Interpartition Communication 30765>20 belong&0x03FFFFFF 186 (USB with FreeBSD header 30766>20 belong&0x03FFFFFF 187 (Bluetooth HCI H4 30767>20 belong&0x03FFFFFF 188 (802.16 MAC Common Part Sublayer 30768>20 belong&0x03FFFFFF 189 (Linux USB 30769>20 belong&0x03FFFFFF 190 (Controller Area Network (CAN) v. 2.0B 30770>20 belong&0x03FFFFFF 191 (802.15.4 with Linux padding 30771>20 belong&0x03FFFFFF 192 (PPI 30772>20 belong&0x03FFFFFF 193 (802.16 MAC Common Part Sublayer plus radiotap header 30773>20 belong&0x03FFFFFF 194 (Juniper Integrated Service Module 30774>20 belong&0x03FFFFFF 195 (802.15.4 with FCS 30775>20 belong&0x03FFFFFF 196 (SITA 30776>20 belong&0x03FFFFFF 197 (Endace ERF 30777>20 belong&0x03FFFFFF 198 (Ethernet with u10 Networks pseudo-header 30778>20 belong&0x03FFFFFF 199 (IPMB 30779>20 belong&0x03FFFFFF 200 (Juniper Secure Tunnel 30780>20 belong&0x03FFFFFF 201 (Bluetooth HCI H4 with pseudo-header 30781>20 belong&0x03FFFFFF 202 (AX.25 with KISS header 30782>20 belong&0x03FFFFFF 203 (LAPD 30783>20 belong&0x03FFFFFF 204 (PPP with direction pseudo-header 30784>20 belong&0x03FFFFFF 205 (Cisco HDLC with direction pseudo-header 30785>20 belong&0x03FFFFFF 206 (Frame Relay with direction pseudo-header 30786>20 belong&0x03FFFFFF 209 (Linux IPMB 30787>20 belong&0x03FFFFFF 215 (802.15.4 with non-ASK PHY header 30788>20 belong&0x03FFFFFF 216 (Linux evdev events 30789>20 belong&0x03FFFFFF 219 (MPLS with label as link-layer header 30790>20 belong&0x03FFFFFF 220 (Memory-mapped Linux USB 30791>20 belong&0x03FFFFFF 221 (DECT 30792>20 belong&0x03FFFFFF 222 (AOS Space Data Link protocol 30793>20 belong&0x03FFFFFF 223 (Wireless HART 30794>20 belong&0x03FFFFFF 224 (Fibre Channel FC-2 30795>20 belong&0x03FFFFFF 225 (Fibre Channel FC-2 with frame delimiters 30796>20 belong&0x03FFFFFF 226 (Solaris IPNET 30797>20 belong&0x03FFFFFF 227 (SocketCAN 30798>20 belong&0x03FFFFFF 228 (Raw IPv4 30799>20 belong&0x03FFFFFF 229 (Raw IPv6 30800>20 belong&0x03FFFFFF 230 (802.15.4 without FCS 30801>20 belong&0x03FFFFFF 231 (D-Bus messages 30802>20 belong&0x03FFFFFF 232 (Juniper Virtual Server 30803>20 belong&0x03FFFFFF 233 (Juniper SRX E2E 30804>20 belong&0x03FFFFFF 234 (Juniper Fibre Channel 30805>20 belong&0x03FFFFFF 235 (DVB-CI 30806>20 belong&0x03FFFFFF 236 (MUX27010 30807>20 belong&0x03FFFFFF 237 (STANAG 5066 D_PDUs 30808>20 belong&0x03FFFFFF 238 (Juniper ATM CEMIC 30809>20 belong&0x03FFFFFF 239 (Linux netfilter log messages 30810>20 belong&0x03FFFFFF 240 (Hilscher netAnalyzer 30811>20 belong&0x03FFFFFF 241 (Hilscher netAnalyzer with delimiters 30812>20 belong&0x03FFFFFF 242 (IP-over-Infiniband 30813>20 belong&0x03FFFFFF 243 (MPEG-2 Transport Stream packets 30814>20 belong&0x03FFFFFF 244 (ng4t ng40 30815>20 belong&0x03FFFFFF 245 (NFC LLCP 30816>20 belong&0x03FFFFFF 246 (Packet filter state syncing 30817>20 belong&0x03FFFFFF 247 (InfiniBand 30818>20 belong&0x03FFFFFF 248 (SCTP 30819>20 belong&0x03FFFFFF 249 (USB with USBPcap header 30820>20 belong&0x03FFFFFF 250 (Schweitzer Engineering Laboratories RTAC packets 30821>20 belong&0x03FFFFFF 251 (Bluetooth Low Energy air interface 30822>20 belong&0x03FFFFFF 252 (Wireshark Upper PDU export 30823>20 belong&0x03FFFFFF 253 (Linux netlink 30824>20 belong&0x03FFFFFF 254 (Bluetooth Linux Monitor 30825>20 belong&0x03FFFFFF 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets 30826>20 belong&0x03FFFFFF 256 (Bluetooth Low Energy air interface with pseudo-header 30827>20 belong&0x03FFFFFF 257 (PROFIBUS data link layer 30828>20 belong&0x03FFFFFF 258 (Apple DLT_PKTAP 30829>20 belong&0x03FFFFFF 259 (Ethernet with 802.3 Clause 65 EPON preamble 30830>20 belong&0x03FFFFFF 260 (IPMI trace packets 30831>20 belong&0x03FFFFFF 261 (Z-Wave RF profile R1 and R2 packets 30832>20 belong&0x03FFFFFF 262 (Z-Wave RF profile R3 packets 30833>20 belong&0x03FFFFFF 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto 30834>20 belong&0x03FFFFFF 264 (ISO 14443 messages 30835>20 belong&0x03FFFFFF 265 (IEC 62106 Radio Data System groups 30836>20 belong&0x03FFFFFF 266 (USB with Darwin header 30837>20 belong&0x03FFFFFF 267 (OpenBSD DLT_OPENFLOW 30838>20 belong&0x03FFFFFF 268 (IBM SDLC frames 30839>20 belong&0x03FFFFFF 269 (TI LLN sniffer frames 30840>20 belong&0x03FFFFFF 271 (Linux vsock 30841>20 belong&0x03FFFFFF 272 (Nordic Semiconductor Bluetooth LE sniffer frames 30842>20 belong&0x03FFFFFF 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames 30843>20 belong&0x03FFFFFF 274 (802.3br mPackets 30844>20 belong&0x03FFFFFF 275 (DisplayPort AUX channel monitoring data 30845>20 belong&0x03FFFFFF 276 (Linux cooked v2 30846>20 belong&0x03FFFFFF 278 (OpenVizsla USB 30847>20 belong&0x03FFFFFF 279 (Elektrobit High Speed Capture and Replay (EBHSCR) 30848>20 belong&0x03FFFFFF 281 (Broadcom tag 30849>20 belong&0x03FFFFFF 282 (Broadcom tag (prepended) 30850>20 belong&0x03FFFFFF 284 (Marvell DSA 30851>20 belong&0x03FFFFFF 285 (Marvell EDSA 30852>20 belong&0x03FFFFFF 286 (ELEE lawful intercept 30853>20 belong&0x03FFFFFF 287 (Z-Wave serial 30854>20 belong&0x03FFFFFF 288 (USB 2.0 30855>20 belong&0x03FFFFFF 289 (ATSC ALP 30856>20 belong&0x03FFFFFF 290 (Event Tracing for Windows 30857# print default match 30858>20 default x 30859>>20 belong x (linktype#%u 30860>16 belong x \b, capture length %u) 30861 30862# packets time stamps in seconds and microseconds. 308630 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) 30864!:mime application/vnd.tcpdump.pcap 30865>0 use pcap-be 308660 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) 30867!:mime application/vnd.tcpdump.pcap 30868>0 use \^pcap-be 30869 30870# packets time stamps in seconds and nanoseconds. 308710 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) 30872!:mime application/vnd.tcpdump.pcap 30873>0 use pcap-be 308740 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) 30875!:mime application/vnd.tcpdump.pcap 30876>0 use \^pcap-be 30877 30878# 30879# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 30880# 308810 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) 30882>0 use pcap-be 308830 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) 30884>0 use \^pcap-be 30885 30886# 30887# "pcapng" capture files. 30888# https://github.com/pcapng/pcapng 30889# Pcapng files can contain multiple sections. Printing the endianness, 30890# snaplen, or other information from the first SHB may be misleading. 30891# 308920 ubelong 0x0a0d0d0a 30893>8 ubelong 0x1a2b3c4d pcapng capture file 30894>>12 beshort x - version %d 30895>>14 beshort x \b.%d 308960 ulelong 0x0a0d0d0a 30897>8 ulelong 0x1a2b3c4d pcapng capture file 30898>>12 leshort x - version %d 30899>>14 leshort x \b.%d 30900 30901# 30902# AIX "iptrace" capture files. 30903# 309040 string iptrace\0401.0 AIX iptrace capture file 309050 string iptrace\0402.0 AIX iptrace capture file 30906 30907# 30908# Novell LANalyzer capture files. 30909# 309100 leshort 0x1001 Novell LANalyzer capture file 309110 leshort 0x1007 Novell LANalyzer capture file 30912 30913# 30914# HP-UX "nettl" capture files. 30915# 309160 string \x54\x52\x00\x64\x00 HP/UX nettl capture file 30917 30918# 30919# RADCOM WAN/LAN Analyzer capture files. 30920# 309210 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 30922 30923# 30924# NetStumbler log files. Not really packets, per se, but about as 30925# close as you can get. These are log files from NetStumbler, a 30926# Windows program, that scans for 802.11b networks. 30927# 309280 string NetS NetStumbler log file 30929>8 lelong x \b, %d stations found 30930 30931# 30932# *Peek tagged capture files. 30933# 309340 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 30935 30936# 30937# Visual Networks traffic capture files. 30938# 309390 string \x05VNF Visual Networks traffic capture file 30940 30941# 30942# Network Instruments Observer capture files. 30943# 309440 string ObserverPktBuffe Network Instruments Observer capture file 30945 30946# 30947# Files from Accellent Group's 5View products. 30948# 309490 string \xaa\xaa\xaa\xaa 5View capture file 30950 30951#------------------------------------------------------------------------------ 30952# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 30953# softquad: file(1) magic for SoftQuad Publishing Software 30954# 30955# Author/Editor and RulesBuilder 30956# 30957# XXX - byte order? 30958# 309590 string \<!SQ\ DTD> Compiled SGML rules file 30960>9 string >\0 Type %s 309610 string \<!SQ\ A/E> A/E SGML Document binary 30962>9 string >\0 Type %s 309630 string \<!SQ\ STS> A/E SGML binary styles file 30964>9 string >\0 Type %s 309650 short 0xc0de Compiled PSI (v1) data 309660 short 0xc0da Compiled PSI (v2) data 30967>3 string >\0 (%s) 30968# Binary sqtroff font/desc files... 309690 short 0125252 SoftQuad DESC or font file binary 30970>2 short >0 - version %d 30971# Bitmaps... 309720 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 30973#0 string SQ\ BITMAP2 SoftQuad Raster Format data 30974# sqtroff intermediate language (replacement for ditroff int. lang.) 309750 string X\ SoftQuad troff Context intermediate 30976>2 string 495 for AT&T 495 laser printer 30977>2 string hp for Hewlett-Packard LaserJet 30978>2 string impr for IMAGEN imPRESS 30979>2 string ps for PostScript 30980 30981# From: Michael Piefel <piefel@debian.org> 30982# sqtroff intermediate language (replacement for ditroff int. lang.) 309830 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 309840 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 309850 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 309860 string X\ ps SoftQuad troff Context intermediate for PostScript 30987 30988#------------------------------------------------------------------------------ 30989# $File: sosi,v 1.2 2021/02/23 00:51:10 christos Exp $ 30990# SOSI 30991# Summary: Systematic Organization of Spatial Information 30992# Long description: Norwegian text based map format 30993# File extension: .sos 30994# Full name: Petter Reinholdtsen (pere@hungry.com) 30995# Reference: https://en.wikipedia.org/wiki/SOSI 30996# 30997# Example SOSI files available from 30998# https://trac.osgeo.org/gdal/ticket/3638 30999# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/ 31000# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/ 31001# 31002# Start with optional comments (from "!" to the next line end) 31003# followed by ".HODE" and end with "\n.SLUTT" followed by an optional 31004# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at 31005# the start and following ".HODE" near the start there is "..OMR=C3=85DE" 31006# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on 31007# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a 31008# separator, as well as "..SOSI-VERSJON " followed by the format 31009# version and a separator. 31010# 31011# FIXME figure out how to accept any of [space], [tab], [newline] and 31012# [carriage return] as separators, not only line end. 31013 31014# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8 31015# character sets 310160 search ..OMR 31017>0 search ..TRANSPAR 31018>>0 search .HODE SOSI map data 31019>>>&0 search ..SOSI-VERSJON 31020>>>>&1 string x \b, version %s 31021# FIXME could not figure out way to make a match for .SLUTT at the end required 31022#>-7 string \n.SLUTT slutt 31023#>-8 string \n.SLUTT\n slutt-nl 31024#>-9 string \n.SLUTT\r\n slutt-crnl2 31025!:mime text/vnd.sosi 31026!:ext sos 31027 31028#------------------------------------------------------------------------------ 31029# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 31030# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 31031# 31032# Cloyce D. Spradling <cloyce@headgear.org> 31033 310340 string spec SPEC 31035>4 string .cpu CPU 31036>>8 string <: \b%.4s 31037>>12 string . raw result text 31038 3103917 string version=SPECjbb SPECjbb 31040>32 string <: \b%.4s 31041>>37 string <: v%.4s raw result text 31042 310430 string BEGIN\040SPECWEB SPECweb 31044>13 string <: \b%.2s 31045>>15 string _SSL \b_SSL 31046>>>20 string <: v%.4s raw result text 31047>>16 string <: v%.4s raw result text 31048 31049#------------------------------------------------------------------------------ 31050# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $ 31051# spectrum: file(1) magic for Spectrum emulator files. 31052# 31053# John Elliott <jce@seasip.demon.co.uk> 31054 31055# 31056# Spectrum +3DOS header 31057# 310580 string PLUS3DOS\032 Spectrum +3 data 31059>15 byte 0 - BASIC program 31060>15 byte 1 - number array 31061>15 byte 2 - character array 31062>15 byte 3 - memory block 31063>>16 belong 0x001B0040 (screen) 31064>15 byte 4 - Tasword document 31065>15 string TAPEFILE - ZXT tapefile 31066# 31067# Tape file. This assumes the .TAP starts with a Spectrum-format header, 31068# which nearly all will. 31069# 31070# Update: Sanity-check string contents to be printable. 31071# -Adam Buchbinder <adam.buchbinder@gmail.com> 31072# 310730 string \023\000\000 31074>4 string >\0 31075>>4 string <\177 Spectrum .TAP data "%-10.10s" 31076>>>3 byte 0 - BASIC program 31077>>>3 byte 1 - number array 31078>>>3 byte 2 - character array 31079>>>3 byte 3 - memory block 31080>>>>14 belong 0x001B0040 (screen) 31081 31082# The following three blocks are from pak21-spectrum@srcf.ucam.org 31083# TZX tape images 310840 string ZXTape!\x1a Spectrum .TZX data 31085>8 byte x version %d 31086>9 byte x \b.%d 31087 31088# RZX input recording files 310890 string RZX! Spectrum .RZX data 31090>4 byte x version %d 31091>5 byte x \b.%d 31092 31093# Floppy disk images 310940 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 310950 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 310960 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 310970 string SINCLAIR Spectrum .SCL Betadisk image 31098 31099# Hard disk images 311000 string RS-IDE\x1a Spectrum .HDF hard disk image 31101>7 byte x \b, version 0x%02x 31102 31103# SZX snapshots (fuse and spectaculator) 31104# Martin M. S. Pedersen <martin@linux.com> 31105# http://www.spectaculator.com/docs/zx-state/header.shtml 31106# 311070 string ZXST zx-state snapshot 31108>4 byte x version %d 31109>5 byte x \b.%d 31110>>6 byte 0 16k ZX Spectrum 31111>>6 byte 1 48k ZX Spectrum/ZX Spectrum+ 31112>>6 byte 2 ZX Spectrum 128 31113>>6 byte 3 ZX Spectrum +2 31114>>6 byte 4 ZX Spectrum +2A/+2B 31115>>6 byte 5 ZX Spectrum +3 31116>>6 byte 6 ZX Spectrum +3e 31117>>6 byte 7 Pentagon 128 31118>>6 byte 8 Timex Sinclair TC2048 31119>>6 byte 9 Timex Sinclair TC2068 31120>>6 byte 10 Scorpion ZS-256 31121>>6 byte 11 ZX Spectrum SE 31122>>6 byte 12 Timex Sinclair TS2068 31123>>6 byte 13 Pentagon 512 31124>>6 byte 14 Pentagon 1024 31125>>6 byte 15 48k ZX Spectrum (NTSC) 31126>>6 byte 16 ZX Spectrum 12Ke 31127>>>7 byte 1 (alternate timings) 31128 31129#------------------------------------------------------------------------------ 31130# $File: sql,v 1.22 2019/04/19 00:42:27 christos Exp $ 31131# sql: file(1) magic for SQL files 31132# 31133# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 31134# Recognize some MySQL files. 31135# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 31136# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 31137# 311380 beshort 0xfe01 MySQL table definition file 31139>2 byte x Version %d 31140>3 byte 0 \b, type UNKNOWN 31141>3 byte 1 \b, type DIAM_ISAM 31142>3 byte 2 \b, type HASH 31143>3 byte 3 \b, type MISAM 31144>3 byte 4 \b, type PISAM 31145>3 byte 5 \b, type RMS_ISAM 31146>3 byte 6 \b, type HEAP 31147>3 byte 7 \b, type ISAM 31148>3 byte 8 \b, type MRG_ISAM 31149>3 byte 9 \b, type MYISAM 31150>3 byte 10 \b, type MRG_MYISAM 31151>3 byte 11 \b, type BERKELEY_DB 31152>3 byte 12 \b, type INNODB 31153>3 byte 13 \b, type GEMINI 31154>3 byte 14 \b, type NDBCLUSTER 31155>3 byte 15 \b, type EXAMPLE_DB 31156>3 byte 16 \b, type CSV_DB 31157>3 byte 17 \b, type FEDERATED_DB 31158>3 byte 18 \b, type BLACKHOLE_DB 31159>3 byte 19 \b, type PARTITION_DB 31160>3 byte 20 \b, type BINLOG 31161>3 byte 21 \b, type SOLID 31162>3 byte 22 \b, type PBXT 31163>3 byte 23 \b, type TABLE_FUNCTION 31164>3 byte 24 \b, type MEMCACHE 31165>3 byte 25 \b, type FALCON 31166>3 byte 26 \b, type MARIA 31167>3 byte 27 \b, type PERFORMANCE_SCHEMA 31168>3 byte 127 \b, type DEFAULT 31169>0x0033 ulong x \b, MySQL version %d 311700 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 31171>3 byte x Version %d 311720 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 31173>3 byte x Version %d 311740 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 31175>3 byte x Version %d 31176>14 beshort x \b, %d key parts 31177>16 beshort x \b, %d unique key parts 31178>18 byte x \b, %d keys 31179>28 bequad x \b, %lld records 31180>36 bequad x \b, %lld deleted records 311810 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 31182>3 byte x Version %d 311830 belong&0xffffff00 0xfefe0900 MySQL Maria index file 31184>3 byte x Version %d 311850 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file 31186>3 byte x Version %d 311870 belong&0xffffff00 0xfefe0c00 31188>4 string MACF MySQL Maria control file 31189>>3 byte x Version %d 311900 string \376bin MySQL replication log, 31191>9 long x server id %d 31192>8 byte 1 31193>>13 long 69 \b, MySQL V3.2.3 31194>>>19 string x \b, server version %s 31195>>13 long 75 \b, MySQL V4.0.2-V4.1 31196>>>25 string x \b, server version %s 31197>8 byte 15 MySQL V5+, 31198>>25 string x server version %s 31199>4 string MARIALOG MySQL Maria transaction log file 31200>>3 byte x Version %d 31201 31202#------------------------------------------------------------------------------ 31203# iRiver H Series database file 31204# From Ken Guest <ken@linux.ie> 31205# As observed from iRivNavi.iDB and unencoded firmware 31206# 312070 string iRivDB iRiver Database file 31208>11 string >\0 Version %s 31209>39 string iHP-100 [H Series] 31210 31211#------------------------------------------------------------------------------ 31212# SQLite database files 31213# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 31214# 31215# Version 1 used GDBM internally; its files cannot be distinguished 31216# from other GDBM files. 31217# 31218# Version 2 used this format: 312190 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 31220 31221# Version 3 of SQLite allows applications to embed their own "user version" 31222# number in the database at offset 60. Later, SQLite added an "application id" 31223# at offset 68 that is preferred over "user version" for indicating the 31224# associated application. 31225# 312260 string SQLite\ format\ 3 SQLite 3.x database 31227!:mime application/x-sqlite3 31228# seldom found extension sqlite3 like in SyncData.sqlite3 31229# db 31230# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe 31231# Unfortunately extension sqlite also used for other databases starting with string 31232# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite 31233# and with string "ZV-zlib" in like extra.sqlite 31234!:ext sqlite/sqlite3/db/dbe 31235>60 belong =0x5f4d544e (Monotone source repository) 31236>68 belong =0x0f055112 (Fossil checkout) 31237>68 belong =0x0f055113 (Fossil global configuration) 31238>68 belong =0x0f055111 (Fossil repository) 31239>68 belong =0x42654462 (Bentley Systems BeSQLite Database) 31240>68 belong =0x42654c6e (Bentley Systems Localization File) 31241>68 belong =0x47504b47 (OGC GeoPackage file) 31242>68 default x 31243>>68 belong !0 \b, application id %u 31244>>60 belong !0 \b, user version %d 31245>96 belong x \b, last written using SQLite version %d 31246 31247 31248# SQLite Write-Ahead Log from SQLite version >= 3.7.0 31249# https://www.sqlite.org/fileformat.html#walformat 312500 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 31251!:ext sqlite-wal/db-wal 31252>4 belong x version %d 31253 31254# SQLite Rollback Journal 31255# https://www.sqlite.org/fileformat.html#rollbackjournal 312560 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 31257 31258# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 31259# https://github.com/PredatH0r/ChanSort 312600 string PSDB\0 Panasonic channel list DataBase 31261!:ext db/bin 31262#!:mime application/x-db-svl-panasonic 31263>126 string SQLite\ format\ 3 31264#!:mime application/x-panasonic-sqlite3 31265>>&-15 indirect x \b; contains 31266 31267# H2 Database from https://www.h2database.com/ 312680 string --\ H2\ 0.5/B\ --\ \n H2 Database file 31269# Type: OpenSSH key files 31270# From: Nicolas Collignon <tsointsoin@gmail.com> 31271 312720 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 31273>28 string >\0 version %s 312740 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 31275 312760 string ssh-dss\ OpenSSH DSA public key 312770 string ssh-rsa\ OpenSSH RSA public key 312780 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 312790 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 312800 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 312810 string ssh-ed25519 OpenSSH ED25519 public key 31282 312830 string SSHKRL\n\0 31284>8 ubelong 1 OpenSSH key/certificate revocation list, format %u 31285>>12 ubequad x \b, version %llx 31286>>>20 beqdate x \b, generated %s 31287 31288# From: Joerg Jenderek 31289# URL: https://en.wikipedia.org/wiki/PuTTY 31290# Reference: https://the.earth.li/~sgtatham/putty/latest/putty-0.73.tar.gz 31291# /sshpubk.c 312920 string PuTTY-User-Key-File- PuTTY Private Key File 31293#!:mime text/plain 31294# https://github.com/github/putty/blob/master/windows/installer.wxs 31295!:mime application/x-putty-private-key 31296!:ext ppk 31297# version 1 or 2 31298>20 string x \b, version %.1s 31299# name of the algorithm like: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ssh-ed25519 31300>23 string x \b, algorithm %s 31301# next line says "Encryption: " plus an encryption type like aes256-cbc or none 31302>32 search/13 Encryption:\040 \b, Encryption 31303>>&0 string x %s 31304# next line says "Comment: " plus the comment string 31305>>>&0 search/3 Comment:\040 31306>>>>&0 string x "%s" 31307 31308 31309#------------------------------------------------------------------------------ 31310# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $ 31311# ssl: file(1) magic for SSL file formats 31312 31313# Type: OpenSSL certificates/key files 31314# From: Nicolas Collignon <tsointsoin@gmail.com> 31315 313160 string -----BEGIN\040CERTIFICATE----- PEM certificate 313170 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request 313180 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key 313190 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key 313200 string -----BEGIN\040EC\040PRIVATE PEM EC private key 313210 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key 31322 31323# From Luc Gommans 31324# OpenSSL enc file (recognized by a magic string preceding the password's salt) 313250 string Salted__ openssl enc'd data with salted password 31326# Using the -a or -base64 option, OpenSSL will base64-encode the data. 313270 string U2FsdGVkX1 openssl enc'd data with salted password, base64 encoded 31328 31329#------------------------------------------------------------------------------ 31330# $File: statistics,v 1.2 2020/10/08 17:51:53 christos Exp $ 31331# statistics: file(1) magic for statistics related software 31332# 31333 31334# From Remy Rampin 31335 31336# Stata is a statistical software tool that was created in 1985. While I 31337# don't personally use it, data files in its native (proprietary) format 31338# are common (.dta files). 31339# 31340# Because they are so common, especially in statistical and social 31341# sciences, Stata files and SPSS files can be opened by a lot of modern 31342# software, for example Python's pandas package provides built-in 31343# support for them (read_stata() and read_spss()). 31344# 31345# I noticed that the magic database includes an entry for SPSS files but 31346# not Stata files. Stata files for Stata 13 and newer (formats 117, 118, 31347# and 119) always begin with the string "<stata_dta><header>" as per 31348# https://www.stata.com/help.cgi?dta#definition 31349# 31350# The format version number always follows, for example: 31351# <stata_dta><header><release>117</release> 31352# <stata_dta><header><release>118</release> 31353# 31354# Therefore the following line would do the trick: 31355# 0 string <stata_dta><header> Stata Data File 31356# 31357# (I'm sure the version number could be captured as well but I did not 31358# manage this without a regex) 31359# 31360# Unfortunately the previous formats (created by Stata before 13, which 31361# was released 2013) are harder to recognize. Format 115 starts with the 31362# four bytes 0x73010100 or 0x73020100, format 114 with 0x72010100 or 31363# 0x72020100, format 113 with 0x71010101 or 0x71020101. 31364# 31365# For additional reference, the Library of Congress website has an entry 31366# for the Stata Data File Format 118: 31367# https://www.loc.gov/preservation/digital/formats/fdd/fdd000471.shtml 31368# 31369# Example of those files can be found on Zenodo: 31370# https://zenodo.org/search?page=1&size=20&q=&file_type=dta 313710 string \<stata_dta\>\<header\>\<release\> Stata Data File 31372>&0 regex [0-9]* (Release %s) 31373 31374#------------------------------------------------------------------------------ 31375# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $ 31376# sun: file(1) magic for Sun machines 31377# 31378# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 31379# releases. (5.x uses ELF.) Entries for executables without an 31380# architecture type, used before the 68020-based Sun-3's came out, 31381# are in aout, as they're indistinguishable from other big-endian 31382# 32-bit a.out files. 31383# 313840 belong&077777777 0600413 a.out SunOS SPARC demand paged 31385>0 byte &0x80 31386>>20 belong <4096 shared library 31387>>20 belong =4096 dynamically linked executable 31388>>20 belong >4096 dynamically linked executable 31389>0 byte ^0x80 executable 31390>16 belong >0 not stripped 31391 313920 belong&077777777 0600410 a.out SunOS SPARC pure 31393>0 byte &0x80 dynamically linked executable 31394>0 byte ^0x80 executable 31395>16 belong >0 not stripped 31396 313970 belong&077777777 0600407 a.out SunOS SPARC 31398>0 byte &0x80 dynamically linked executable 31399>0 byte ^0x80 executable 31400>16 belong >0 not stripped 31401 314020 belong&077777777 0400413 a.out SunOS mc68020 demand paged 31403>0 byte &0x80 31404>>20 belong <4096 shared library 31405>>20 belong =4096 dynamically linked executable 31406>>20 belong >4096 dynamically linked executable 31407>0 byte ^0x80 executable 31408>16 belong >0 not stripped 31409 314100 belong&077777777 0400410 a.out SunOS mc68020 pure 31411>0 byte &0x80 dynamically linked executable 31412>0 byte ^0x80 executable 31413>16 belong >0 not stripped 31414 314150 belong&077777777 0400407 a.out SunOS mc68020 31416>0 byte &0x80 dynamically linked executable 31417>0 byte ^0x80 executable 31418>16 belong >0 not stripped 31419 314200 belong&077777777 0200413 a.out SunOS mc68010 demand paged 31421>0 byte &0x80 31422>>20 belong <4096 shared library 31423>>20 belong =4096 dynamically linked executable 31424>>20 belong >4096 dynamically linked executable 31425>0 byte ^0x80 executable 31426>16 belong >0 not stripped 31427 314280 belong&077777777 0200410 a.out SunOS mc68010 pure 31429>0 byte &0x80 dynamically linked executable 31430>0 byte ^0x80 executable 31431>16 belong >0 not stripped 31432 314330 belong&077777777 0200407 a.out SunOS mc68010 31434>0 byte &0x80 dynamically linked executable 31435>0 byte ^0x80 executable 31436>16 belong >0 not stripped 31437 31438# 31439# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 31440# binary executed in compatibility mode under SunOS 5.x". 31441# 314420 belong 0x080456 SunOS core file 31443>4 belong 432 (SPARC) 31444>>132 string >\0 from '%s' 31445>>116 belong =3 (quit) 31446>>116 belong =4 (illegal instruction) 31447>>116 belong =5 (trace trap) 31448>>116 belong =6 (abort) 31449>>116 belong =7 (emulator trap) 31450>>116 belong =8 (arithmetic exception) 31451>>116 belong =9 (kill) 31452>>116 belong =10 (bus error) 31453>>116 belong =11 (segmentation violation) 31454>>116 belong =12 (bad argument to system call) 31455>>116 belong =29 (resource lost) 31456>>120 belong x (T=%dK, 31457>>124 belong x D=%dK, 31458>>128 belong x S=%dK) 31459>4 belong 826 (68K) 31460>>128 string >\0 from '%s' 31461>4 belong 456 (SPARC 4.x BCP) 31462>>152 string >\0 from '%s' 31463# Sun SunPC 314640 long 0xfa33c08e SunPC 4.0 Hard Disk 314650 string #SUNPC_CONFIG SunPC 4.0 Properties Values 31466# Sun snoop (see RFC 1761, which describes the capture file format, 31467# RFC 3827, which describes some additional datalink types, and 31468# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 31469# which is the IANA registry of Snoop datalink types) 31470# 314710 string snoop Snoop capture file 31472>8 belong >0 - version %d 31473>12 belong 0 (IEEE 802.3) 31474>12 belong 1 (IEEE 802.4) 31475>12 belong 2 (IEEE 802.5) 31476>12 belong 3 (IEEE 802.6) 31477>12 belong 4 (Ethernet) 31478>12 belong 5 (HDLC) 31479>12 belong 6 (Character synchronous) 31480>12 belong 7 (IBM channel-to-channel adapter) 31481>12 belong 8 (FDDI) 31482>12 belong 9 (Other) 31483>12 belong 10 (type %d) 31484>12 belong 11 (type %d) 31485>12 belong 12 (type %d) 31486>12 belong 13 (type %d) 31487>12 belong 14 (type %d) 31488>12 belong 15 (type %d) 31489>12 belong 16 (Fibre Channel) 31490>12 belong 17 (ATM) 31491>12 belong 18 (ATM Classical IP) 31492>12 belong 19 (type %d) 31493>12 belong 20 (type %d) 31494>12 belong 21 (type %d) 31495>12 belong 22 (type %d) 31496>12 belong 23 (type %d) 31497>12 belong 24 (type %d) 31498>12 belong 25 (type %d) 31499>12 belong 26 (IP over Infiniband) 31500>12 belong >26 (type %d) 31501 31502#--------------------------------------------------------------------------- 31503# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 31504# lead Sun/Cobalt developer) who agrees that they are good and worthy of 31505# inclusion. 31506 31507# Boot ROM images for Sun/Cobalt Linux server appliances 315080 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 31509>38 string x V%.4s 31510 31511# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 31512# at the very end where file(1) can't get it. 315130 string CRfs COBALT boot rom data (Flat boot rom or file system) 31514 31515#------------------------------------------------------------------------------ 31516# $File: sylk,v 1.1 2020/04/05 22:18:34 christos Exp $ 31517# sylk: file(1) magic for SYLK text files 31518 31519# From: Joerg Jenderek 31520# URL: https://en.wikipedia.org/wiki/SYmbolic_LinK_%28SYLK%29 31521# http://fileformats.archiveteam.org/wiki/SYLK 31522# Note: called by TrID "SYLK - SYmbolic LinK data", 31523# by DROID "Microsoft Symbolic Link (SYLK) File" 31524# by FreeDesktop.org "spreadsheet interchange document" 315250 string ID;P 31526# skip short DROID x-fmt-106-signature-id-603.slk 31527>7 ubyte >0 spreadsheet interchange document 31528# https://reposcope.com/mimetype/text/spreadsheet 31529#!:mime text/spreadsheet 31530# https://reposcope.com/mimetype/application/x-sylk by Gnumeric 31531!:mime application/x-sylk 31532!:ext slk/sylk 31533>>4 ubyte >037 \b, created by 31534# Gnumeric, pmw~PlanMaker, CALCOOO32~LibreOffice OpenOffice, SCALC3~StarOffice 31535# MP~Multiplan, XL~Excel WXL~Excel Windows 31536>>>4 string Gnumeric Gnumeric 31537>>>4 string pmw PlanMaker 31538>>>4 string CALCOOO32 Libre/OpenOffice Calc 31539>>>4 string SCALC3 StarOffice Calc 31540>>>4 string XL Excel 31541# Excel, version probably running on Windows 31542>>>4 string WXL Excel 31543# not tested 31544>>>4 string MP Multiplan 31545# unknown spreadsheet software 31546>>>4 default x 31547>>>>4 string x %s 31548 31549 31550 31551#------------------------------------------------------------------------------ 31552# msx: file(1) magic for the SymbOS operating system 31553# http://www.symbos.de 31554# Fabio R. Schmidlin <frs@pop.com.br> 31555 31556# SymbOS EXE file 315570x30 string SymExe SymbOS executable 31558>0x36 ubyte x v%c 31559>0x37 ubyte x \b.%c 31560>0xF string x \b, name: %s 31561 31562# SymbOS DOX document 315630 string INFOq\0 SymbOS DOX document 31564 31565# Symbos driver 315660 string SMD1 SymbOS driver 31567>19 byte x \b, name: %c 31568>20 byte x \b%c 31569>21 byte x \b%c 31570>22 byte x \b%c 31571>23 byte x \b%c 31572>24 byte x \b%c 31573>25 byte x \b%c 31574>26 byte x \b%c 31575>27 byte x \b%c 31576>28 byte x \b%c 31577>29 byte x \b%c 31578>30 byte x \b%c 31579>31 byte x \b%c 31580 31581# Symbos video 315820 string SymVid SymbOS video 31583>6 ubyte x v%c 31584>7 ubyte x \b.%c 31585 31586# Soundtrakker 128 ST2 music 315870 byte 0 31588>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 31589>>1 string x name: %s 31590 31591 31592 31593#------------------------------------------------------------------------ 31594# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $ 31595# sysex: file(1) magic for MIDI sysex files 31596# 31597# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 31598# where real SYStem EXclusive messages at offset 1 are limited to seven bits 31599# https://en.wikipedia.org/wiki/MIDI 316000 ubeshort&0xFF80 0xF000 SysEx File - 31601 31602# North American Group 31603>1 byte 0x01 Sequential 31604>1 byte 0x02 IDP 31605>1 byte 0x03 OctavePlateau 31606>1 byte 0x04 Moog 31607>1 byte 0x05 Passport 31608>1 byte 0x06 Lexicon 31609>1 byte 0x07 Kurzweil/Future Retro 31610>>3 byte 0x77 777 31611>>4 byte 0x00 Bank 31612>>4 byte 0x01 Song 31613>>5 byte 0x0f 16 31614>>5 byte 0x0e 15 31615>>5 byte 0x0d 14 31616>>5 byte 0x0c 13 31617>>5 byte 0x0b 12 31618>>5 byte 0x0a 11 31619>>5 byte 0x09 10 31620>>5 byte 0x08 9 31621>>5 byte 0x07 8 31622>>5 byte 0x06 7 31623>>5 byte 0x05 6 31624>>5 byte 0x04 5 31625>>5 byte 0x03 4 31626>>5 byte 0x02 3 31627>>5 byte 0x01 2 31628>>5 byte 0x00 1 31629>>5 byte 0x10 (ALL) 31630>>2 byte x \b, Channel %d 31631>1 byte 0x08 Fender 31632>1 byte 0x09 Gulbransen 31633>1 byte 0x0a AKG 31634>1 byte 0x0b Voyce 31635>1 byte 0x0c Waveframe 31636>1 byte 0x0d ADA 31637>1 byte 0x0e Garfield 31638>1 byte 0x0f Ensoniq 31639>1 byte 0x10 Oberheim 31640>>2 byte 0x06 Matrix 6 series 31641>>3 byte 0x0A Dump (All) 31642>>3 byte 0x01 Dump (Bank) 31643>>4 belong 0x0002040E Matrix 1000 31644>>>11 byte <2 User bank %d 31645>>>11 byte >1 Preset bank %d 31646>1 byte 0x11 Apple 31647>1 byte 0x12 GreyMatter 31648>1 byte 0x14 PalmTree 31649>1 byte 0x15 JLCooper 31650>1 byte 0x16 Lowrey 31651>1 byte 0x17 AdamsSmith 31652>1 byte 0x18 E-mu 31653>1 byte 0x19 Harmony 31654>1 byte 0x1a ART 31655>1 byte 0x1b Baldwin 31656>1 byte 0x1c Eventide 31657>1 byte 0x1d Inventronics 31658>1 byte 0x1f Clarity 31659 31660# European Group 31661>1 byte 0x21 SIEL 31662>1 byte 0x22 Synthaxe 31663>1 byte 0x24 Hohner 31664>1 byte 0x25 Twister 31665>1 byte 0x26 Solton 31666>1 byte 0x27 Jellinghaus 31667>1 byte 0x28 Southworth 31668>1 byte 0x29 PPG 31669>1 byte 0x2a JEN 31670>1 byte 0x2b SSL 31671>1 byte 0x2c AudioVertrieb 31672 31673>1 byte 0x2f ELKA 31674>>3 byte 0x09 EK-44 31675 31676>1 byte 0x30 Dynacord 31677>1 byte 0x31 Jomox 31678>1 byte 0x33 Clavia 31679>1 byte 0x39 Soundcraft 31680# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 31681>1 byte 0x3e Waldorf 31682>>2 byte 0x00 microWave 31683>>2 byte 0x0E microwave2 / XT 31684>>2 byte 0x0F Q / Q+ 31685>>3 byte =0 (default id) 31686>>3 byte >0 ( 31687>>>3 byte <0x7F \bdevice %d) 31688>>>3 byte =0x7F \bbroadcast id) 31689>>3 byte 0x7f Microwave I 31690>>>4 byte 0x00 SNDR (Sound Request) 31691>>>4 byte 0x10 SNDD (Sound Dump) 31692>>>4 byte 0x20 SNDP (Sound Parameter Change) 31693>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 31694>>>4 byte 0x70 BOOT (Sound Reserved) 31695>>>4 byte 0x01 MULR (Multi Request) 31696>>>4 byte 0x11 MULD (Multi Dump) 31697>>>4 byte 0x21 MULP (Multi Parameter Change) 31698>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 31699>>>4 byte 0x71 OS (Multi Reserved) 31700>>>4 byte 0x02 DRMR (Drum Map Request) 31701>>>4 byte 0x12 DRMD (Drum Map Dump) 31702>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 31703>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 31704>>>4 byte 0x72 BIN (Drum Map Reserved) 31705>>>4 byte 0x03 PATR (Sequencer Pattern Request) 31706>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 31707>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 31708>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 31709>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 31710>>>4 byte 0x04 GLBR (Global Parameter Request) 31711>>>4 byte 0x14 GLBD (Global Parameter Dump) 31712>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 31713>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 31714>>>4 byte 0x07 MODR (Mode Parameter Request) 31715>>>4 byte 0x17 MODD (Mode Parameter Dump) 31716>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 31717>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 31718>>2 byte 0x10 microQ 31719>>>4 byte 0x00 SNDR (Sound Request) 31720>>>4 byte 0x10 SNDD (Sound Dump) 31721>>>4 byte 0x20 SNDP (Sound Parameter Change) 31722>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 31723>>>4 byte 0x70 (Sound Reserved) 31724>>>4 byte 0x01 MULR (Multi Request) 31725>>>4 byte 0x11 MULD (Multi Dump) 31726>>>4 byte 0x21 MULP (Multi Parameter Change) 31727>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 31728>>>4 byte 0x71 OS (Multi Reserved) 31729>>>4 byte 0x02 DRMR (Drum Map Request) 31730>>>4 byte 0x12 DRMD (Drum Map Dump) 31731>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 31732>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 31733>>>4 byte 0x72 BIN (Drum Map Reserved) 31734>>>4 byte 0x04 GLBR (Global Parameter Request) 31735>>>4 byte 0x14 GLBD (Global Parameter Dump) 31736>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 31737>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 31738>>2 byte 0x11 rackAttack 31739>>>4 byte 0x00 SNDR (Sound Parameter Request) 31740>>>4 byte 0x10 SNDD (Sound Parameter Dump) 31741>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 31742>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 31743>>>4 byte 0x01 PRGR (Program Parameter Request) 31744>>>4 byte 0x11 PRGD (Program Parameter Dump) 31745>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 31746>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 31747>>>4 byte 0x71 OS (Program Parameter Reserved) 31748>>>4 byte 0x03 PATR (Pattern Parameter Request) 31749>>>4 byte 0x13 PATD (Pattern Parameter Dump) 31750>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 31751>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 31752>>>4 byte 0x04 GLBR (Global Parameter Request) 31753>>>4 byte 0x14 GLBD (Global Parameter Dump) 31754>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 31755>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 31756>>>4 byte 0x05 EFXR (FX Parameter Request) 31757>>>4 byte 0x15 EFXD (FX Parameter Dump) 31758>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 31759>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 31760>>>4 byte 0x07 MODR (Mode Command Request) 31761>>>4 byte 0x17 MODD (Mode Command Dump) 31762>>>4 byte 0x27 MODP (Mode Command Parameter Change) 31763>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 31764>>2 byte 0x03 Wave 31765>>>4 byte 0x00 SBPR (Soundprogram) 31766>>>4 byte 0x01 SAPR (Performance) 31767>>>4 byte 0x02 SWAVE (Wave) 31768>>>4 byte 0x03 SWTBL (Wave control table) 31769>>>4 byte 0x04 SVT (Velocity Curve) 31770>>>4 byte 0x05 STT (Tuning Table) 31771>>>4 byte 0x06 SGLB (Global Parameters) 31772>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 31773>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 31774>>>4 byte 0x09 SBPRPAR (Sound Parameter) 31775>>>4 byte 0x0A SARRPAR (Performance Parameter) 31776>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 31777>>>4 byte 0x0F SBULK (Bulk Switch on/off) 31778 31779# Japanese Group 31780>1 byte 0x40 Kawai 31781>>3 byte 0x20 K1 31782>>3 byte 0x22 K4 31783 31784>1 byte 0x41 Roland 31785>>3 byte 0x14 D-50 31786>>3 byte 0x2b U-220 31787>>3 byte 0x02 TR-707 31788 31789>1 byte 0x42 Korg 31790>>3 byte 0x19 M1 31791 31792>1 byte 0x43 Yamaha 31793>1 byte 0x44 Casio 31794>1 byte 0x46 Kamiya 31795>1 byte 0x47 Akai 31796>1 byte 0x48 Victor 31797>1 byte 0x49 Mesosha 31798>1 byte 0x4b Fujitsu 31799>1 byte 0x4c Sony 31800>1 byte 0x4e Teac 31801>1 byte 0x50 Matsushita 31802>1 byte 0x51 Fostex 31803>1 byte 0x52 Zoom 31804>1 byte 0x54 Matsushita 31805>1 byte 0x57 Acoustic tech. lab. 31806# https://www.midi.org/techspecs/manid.php 31807>1 belong&0xffffff00 0x00007400 Ta Horng 31808>1 belong&0xffffff00 0x00007500 e-Tek 31809>1 belong&0xffffff00 0x00007600 E-Voice 31810>1 belong&0xffffff00 0x00007700 Midisoft 31811>1 belong&0xffffff00 0x00007800 Q-Sound 31812>1 belong&0xffffff00 0x00007900 Westrex 31813>1 belong&0xffffff00 0x00007a00 Nvidia* 31814>1 belong&0xffffff00 0x00007b00 ESS 31815>1 belong&0xffffff00 0x00007c00 Mediatrix 31816>1 belong&0xffffff00 0x00007d00 Brooktree 31817>1 belong&0xffffff00 0x00007e00 Otari 31818>1 belong&0xffffff00 0x00007f00 Key Electronics 31819>1 belong&0xffffff00 0x00010000 Shure 31820>1 belong&0xffffff00 0x00010100 AuraSound 31821>1 belong&0xffffff00 0x00010200 Crystal 31822>1 belong&0xffffff00 0x00010300 Rockwell 31823>1 belong&0xffffff00 0x00010400 Silicon Graphics 31824>1 belong&0xffffff00 0x00010500 Midiman 31825>1 belong&0xffffff00 0x00010600 PreSonus 31826>1 belong&0xffffff00 0x00010800 Topaz 31827>1 belong&0xffffff00 0x00010900 Cast Lightning 31828>1 belong&0xffffff00 0x00010a00 Microsoft 31829>1 belong&0xffffff00 0x00010b00 Sonic Foundry 31830>1 belong&0xffffff00 0x00010c00 Line 6 31831>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 31832>1 belong&0xffffff00 0x00010e00 Van Koerving 31833>1 belong&0xffffff00 0x00010f00 Altech Systems 31834>1 belong&0xffffff00 0x00011000 S & S Research 31835>1 belong&0xffffff00 0x00011100 VLSI Technology 31836>1 belong&0xffffff00 0x00011200 Chromatic 31837>1 belong&0xffffff00 0x00011300 Sapphire 31838>1 belong&0xffffff00 0x00011400 IDRC 31839>1 belong&0xffffff00 0x00011500 Justonic Tuning 31840>1 belong&0xffffff00 0x00011600 TorComp 31841>1 belong&0xffffff00 0x00011700 Newtek Inc. 31842>1 belong&0xffffff00 0x00011800 Sound Sculpture 31843>1 belong&0xffffff00 0x00011900 Walker Technical 31844>1 belong&0xffffff00 0x00011a00 Digital Harmony 31845>1 belong&0xffffff00 0x00011b00 InVision 31846>1 belong&0xffffff00 0x00011c00 T-Square 31847>1 belong&0xffffff00 0x00011d00 Nemesys 31848>1 belong&0xffffff00 0x00011e00 DBX 31849>1 belong&0xffffff00 0x00011f00 Syndyne 31850>1 belong&0xffffff00 0x00012000 Bitheadz 31851>1 belong&0xffffff00 0x00012100 Cakewalk 31852>1 belong&0xffffff00 0x00012200 Staccato 31853>1 belong&0xffffff00 0x00012300 National Semicon. 31854>1 belong&0xffffff00 0x00012400 Boom Theory 31855>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 31856>1 belong&0xffffff00 0x00012600 Antares 31857>1 belong&0xffffff00 0x00012700 Angel Software 31858>1 belong&0xffffff00 0x00012800 St Louis Music 31859>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 31860>1 belong&0xffffff00 0x00012a00 Ashley Audio 31861>1 belong&0xffffff00 0x00012b00 Vari-Lite 31862>1 belong&0xffffff00 0x00012c00 Summit Audio 31863>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 31864>1 belong&0xffffff00 0x00012e00 SeaSound 31865>1 belong&0xffffff00 0x00012f00 U.S. Robotics 31866>1 belong&0xffffff00 0x00013000 Aurisis 31867>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 31868>1 belong&0xffffff00 0x00013200 FM7 Inc. 31869>1 belong&0xffffff00 0x00013300 Swivel Systems 31870>1 belong&0xffffff00 0x00013400 Hyperactive 31871>1 belong&0xffffff00 0x00013500 MidiLite 31872>1 belong&0xffffff00 0x00013600 Radical 31873>1 belong&0xffffff00 0x00013700 Roger Linn 31874>1 belong&0xffffff00 0x00013800 Helicon 31875>1 belong&0xffffff00 0x00013900 Event 31876>1 belong&0xffffff00 0x00013a00 Sonic Network 31877>1 belong&0xffffff00 0x00013b00 Realtime Music 31878>1 belong&0xffffff00 0x00013c00 Apogee Digital 31879 31880>1 belong&0xffffff00 0x00202b00 Medeli Electronics 31881>1 belong&0xffffff00 0x00202c00 Charlie Lab 31882>1 belong&0xffffff00 0x00202d00 Blue Chip Music 31883>1 belong&0xffffff00 0x00202e00 BEE OH Corp 31884>1 belong&0xffffff00 0x00202f00 LG Semicon America 31885>1 belong&0xffffff00 0x00203000 TESI 31886>1 belong&0xffffff00 0x00203100 EMAGIC 31887>1 belong&0xffffff00 0x00203200 Behringer 31888>1 belong&0xffffff00 0x00203300 Access Music 31889>1 belong&0xffffff00 0x00203400 Synoptic 31890>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 31891>1 belong&0xffffff00 0x00203600 Terratec 31892>1 belong&0xffffff00 0x00203700 Proel SpA 31893>1 belong&0xffffff00 0x00203800 IBK MIDI 31894>1 belong&0xffffff00 0x00203900 IRCAM 31895>1 belong&0xffffff00 0x00203a00 Propellerhead Software 31896>1 belong&0xffffff00 0x00203b00 Red Sound Systems 31897>1 belong&0xffffff00 0x00203c00 Electron ESI AB 31898>1 belong&0xffffff00 0x00203d00 Sintefex Audio 31899>1 belong&0xffffff00 0x00203e00 Music and More 31900>1 belong&0xffffff00 0x00203f00 Amsaro 31901>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 31902>1 belong&0xffffff00 0x00204100 Touched by Sound 31903>1 belong&0xffffff00 0x00204200 DSP Arts 31904>1 belong&0xffffff00 0x00204300 Phil Rees Music 31905>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 31906>1 belong&0xffffff00 0x00204500 Soundart 31907>1 belong&0xffffff00 0x00204600 C-Mexx Software 31908>1 belong&0xffffff00 0x00204700 Klavis Tech. 31909>1 belong&0xffffff00 0x00204800 Noteheads AB 31910 319110 string T707 Roland TR-707 Data 31912#------------------------------------------------------------------------------ 31913# file: file(1) magic for Tcl scripting language 31914# URL: https://www.tcl.tk/ 31915# From: gustaf neumann 31916 31917# Tcl scripts 319180 search/1/w #!\ /usr/bin/tcl Tcl script text executable 31919!:mime text/x-tcl 319200 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 31921!:mime text/x-tcl 319220 search/1 #!/usr/bin/env\ tcl Tcl script text executable 31923!:mime text/x-tcl 319240 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 31925!:mime text/x-tcl 319260 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 31927!:mime text/x-tcl 319280 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 31929!:mime text/x-tcl 319300 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 31931!:mime text/x-tcl 319320 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 31933!:mime text/x-tcl 31934 31935# check the first line 319360 search/1 package\ req 31937>0 regex \^package[\ \t]+req Tcl script 31938# not 'p', check other lines 319390 search/1 !p 31940>0 regex \^package[\ \t]+req Tcl script 31941 31942#------------------------------------------------------------------------------ 31943# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 31944# teapot: file(1) magic for "teapot" spreadsheet 31945# 319460 string #!teapot\012xdr teapot work sheet (XDR format) 31947 31948#------------------------------------------------------------------------------ 31949# $File: terminfo,v 1.12 2021/02/23 00:51:10 christos Exp $ 31950# terminfo: file(1) magic for terminfo 31951# 31952# URL: https://invisible-island.net/ncurses/man/term.5.html 31953# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html 31954# 31955# Workaround for Targa image type by Joerg Jenderek 31956# GRR: line below too general as it catches also 31957# Targa image type 1 with 26 long identification field 31958# and HELP.DSK 319590 string \032\001 31960# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32) 31961>16 ubyte >32 31962# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1" 31963>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s" 31964!:mime application/x-terminfo 31965# no extension 31966#!:ext 31967# 31968#------------------------------------------------------------------------------ 31969# The following was added for ncurses6 development: 31970#------------------------------------------------------------------------------ 31971# 319720 string \036\002 31973# imitate the legacy compiled-format, to get the entry-name printed 31974>16 ubyte >32 31975# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1" 31976>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled 32-bit terminfo entry "%-s" 31977!:mime application/x-terminfo2 31978# 31979# While the compiled terminfo uses little-endian format regardless of 31980# platform, SystemV screen dumps do not. They came later, and that detail was 31981# overlooked. 31982# 31983# AIX and HPUX use the SVr4 big-endian format 31984# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness) 319850 beshort 0433 SVr2 curses screen image, big-endian 319860 beshort 0434 SVr3 curses screen image, big-endian 319870 beshort 0435 SVr4 curses screen image, big-endian 31988# 319890 leshort 0433 SVr2 curses screen image, little-endian 319900 leshort 0434 SVr3 curses screen image, little-endian 319910 leshort 0435 SVr4 curses screen image, little-endian 31992# 31993# Rather than SVr4, Solaris "xcurses" writes this header: 319940 regex \^MAX=[0-9]+,[0-9]+$ 31995>1 regex \^BEG=[0-9]+,[0-9]+$ 31996>2 regex \^SCROLL=[0-9]+,[0-9]+$ 31997>3 regex \^VMIN=[0-9]+$ 31998>4 regex \^VTIME=[0-9]+$ 31999>5 regex \^FLAGS=0x[[:xdigit:]]+$ 32000>6 regex \^FG=[0-9],[0-9]+$ 32001>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image 32002# 32003# ncurses5 (and before) did not use a magic number, making screen dumps "data". 32004# ncurses6 (2015) uses this format, ignoring byte-order 320050 string \210\210\210\210ncurses ncurses6 screen image 32006# 32007# PDCurses added this in 2005 320080 string PDC\001 PDCurses screen image 32009 32010#------------------------------------------------------------------------------ 32011# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $ 32012# tex: file(1) magic for TeX files 32013# 32014# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 32015# 32016# From <conklin@talisman.kaleida.com> 32017 32018# Although we may know the offset of certain text fields in TeX DVI 32019# and font files, we can't use them reliably because they are not 32020# zero terminated. [but we do anyway, christos] 320210 string \367\002 TeX DVI file 32022!:mime application/x-dvi 32023>16 string >\0 (%s) 320240 string \367\203 TeX generic font data 320250 string \367\131 TeX packed font data 32026>3 string >\0 (%s) 320270 string \367\312 TeX virtual font data 320280 search/1 This\ is\ TeX, TeX transcript text 320290 search/1 This\ is\ METAFONT, METAFONT transcript text 32030 32031# There is no way to detect TeX Font Metric (*.tfm) files without 32032# breaking them apart and reading the data. The following patterns 32033# match most *.tfm files generated by METAFONT or afm2tfm. 320342 string \000\021 TeX font metric data 32035!:mime application/x-tex-tfm 32036>33 string >\0 (%s) 320372 string \000\022 TeX font metric data 32038!:mime application/x-tex-tfm 32039>33 string >\0 (%s) 32040 32041# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 320420 search/1 \\input\ texinfo Texinfo source text 32043!:mime text/x-texinfo 320440 search/1 This\ is\ Info\ file GNU Info text 32045!:mime text/x-info 32046 32047# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 320480 search/4096 \\input TeX document text 32049!:mime text/x-tex 32050!:strength + 15 320510 search/4096 \\begin LaTeX document text 32052!:mime text/x-tex 32053!:strength + 15 320540 search/4096 \\section LaTeX document text 32055!:mime text/x-tex 32056!:strength + 18 320570 search/4096 \\setlength LaTeX document text 32058!:mime text/x-tex 32059!:strength + 15 320600 search/4096 \\documentstyle LaTeX document text 32061!:mime text/x-tex 32062!:strength + 18 320630 search/4096 \\chapter LaTeX document text 32064!:mime text/x-tex 32065!:strength + 18 320660 search/4096 \\documentclass LaTeX 2e document text 32067!:mime text/x-tex 32068!:strength + 15 320690 search/4096 \\relax LaTeX auxiliary file 32070!:mime text/x-tex 32071!:strength + 15 320720 search/4096 \\contentsline LaTeX table of contents 32073!:mime text/x-tex 32074!:strength + 15 320750 search/4096 %\ -*-latex-*- LaTeX document text 32076!:mime text/x-tex 32077 32078# Tex document, from Hendrik Scholz <hendrik@scholz.net> 320790 search/1 \\ifx TeX document text 32080 32081# Index and glossary files 320820 search/4096 \\indexentry LaTeX raw index file 320830 search/4096 \\begin{theindex} LaTeX sorted index 320840 search/4096 \\glossaryentry LaTeX raw glossary 320850 search/4096 \\begin{theglossary} LaTeX sorted glossary 320860 search/4096 This\ is\ makeindex Makeindex log file 32087 32088# End of TeX 32089 32090#------------------------------------------------------------------------------ 32091# file(1) magic for BibTex text files 32092# From Hendrik Scholz <hendrik@scholz.net> 32093 320940 search/1/c @article{ BibTeX text file 320950 search/1/c @book{ BibTeX text file 320960 search/1/c @inbook{ BibTeX text file 320970 search/1/c @incollection{ BibTeX text file 320980 search/1/c @inproceedings{ BibTeX text file 320990 search/1/c @manual{ BibTeX text file 321000 search/1/c @misc{ BibTeX text file 321010 search/1/c @preamble{ BibTeX text file 321020 search/1/c @phdthesis{ BibTeX text file 321030 search/1/c @techreport{ BibTeX text file 321040 search/1/c @unpublished{ BibTeX text file 32105 3210673 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 32107 3210873 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 32109 321100 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 32111 321120 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 32113 321140 search/1 @c\ @mapfile{ TeX font aliases text file 32115 321160 string #LyX LyX document text 32117 32118# ConTeXt documents 32119# https://wiki.contextgarden.net/ 321200 search/4096 \\setupcolors[ ConTeXt document text 32121!:strength + 15 321220 search/4096 \\definecolor[ ConTeXt document text 32123!:strength + 15 321240 search/4096 \\setupinteraction[ ConTeXt document text 32125!:strength + 15 321260 search/4096 \\useURL[ ConTeXt document text 32127!:strength + 15 321280 search/4096 \\setuppapersize[ ConTeXt document text 32129!:strength + 15 321300 search/4096 \\setuplayout[ ConTeXt document text 32131!:strength + 15 321320 search/4096 \\setupfooter[ ConTeXt document text 32133!:strength + 15 321340 search/4096 \\setupfootertexts[ ConTeXt document text 32135!:strength + 15 321360 search/4096 \\setuppagenumbering[ ConTeXt document text 32137!:strength + 15 321380 search/4096 \\setupbodyfont[ ConTeXt document text 32139!:strength + 15 321400 search/4096 \\setuphead[ ConTeXt document text 32141!:strength + 15 321420 search/4096 \\setupitemize[ ConTeXt document text 32143!:strength + 15 321440 search/4096 \\setupwhitespace[ ConTeXt document text 32145!:strength + 15 321460 search/4096 \\setupindenting[ ConTeXt document text 32147!:strength + 15 32148 32149#------------------------------------------------------------------------------ 32150# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 32151# file(1) magic for tgif(1) files 32152# From Hendrik Scholz <hendrik@scholz.net> 321530 string %TGIF\ Tgif file version 32154>6 string x %s 32155 32156#------------------------------------------------------------------------------ 32157# $File: ti-8x,v 1.8 2020/02/12 22:13:01 christos Exp $ 32158# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 32159# 32160# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 32161# 32162# Update: Romain Lievin (roms@lpg.ticalc.org). 32163# 32164# NOTE: This list is not complete. 32165# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 32166# program/group magic numbers in here because I cannot find any. 321670 string **TI80** TI-80 Graphing Calculator File. 321680 string **TI81** TI-81 Graphing Calculator File. 32169# 32170# Magic Numbers for the TI-73 32171# 321720 string **TI73** TI-73 Graphing Calculator 32173>0x00003B byte 0x00 (real number) 32174>0x00003B byte 0x01 (list) 32175>0x00003B byte 0x02 (matrix) 32176>0x00003B byte 0x03 (equation) 32177>0x00003B byte 0x04 (string) 32178>0x00003B byte 0x05 (program) 32179>0x00003B byte 0x06 (assembly program) 32180>0x00003B byte 0x07 (picture) 32181>0x00003B byte 0x08 (gdb) 32182>0x00003B byte 0x0C (complex number) 32183>0x00003B byte 0x0F (window settings) 32184>0x00003B byte 0x10 (zoom) 32185>0x00003B byte 0x11 (table setup) 32186>0x00003B byte 0x13 (backup) 32187 32188# Magic Numbers for the TI-82 32189# 321900 string **TI82** TI-82 Graphing Calculator 32191>0x00003B byte 0x00 (real) 32192>0x00003B byte 0x01 (list) 32193>0x00003B byte 0x02 (matrix) 32194>0x00003B byte 0x03 (Y-variable) 32195>0x00003B byte 0x05 (program) 32196>0x00003B byte 0x06 (protected prgm) 32197>0x00003B byte 0x07 (picture) 32198>0x00003B byte 0x08 (gdb) 32199>0x00003B byte 0x0B (window settings) 32200>0x00003B byte 0x0C (window settings) 32201>0x00003B byte 0x0D (table setup) 32202>0x00003B byte 0x0E (screenshot) 32203>0x00003B byte 0x0F (backup) 32204# 32205# Magic Numbers for the TI-83 32206# 322070 string **TI83** TI-83 Graphing Calculator 32208>0x00003B byte 0x00 (real) 32209>0x00003B byte 0x01 (list) 32210>0x00003B byte 0x02 (matrix) 32211>0x00003B byte 0x03 (Y-variable) 32212>0x00003B byte 0x04 (string) 32213>0x00003B byte 0x05 (program) 32214>0x00003B byte 0x06 (protected prgm) 32215>0x00003B byte 0x07 (picture) 32216>0x00003B byte 0x08 (gdb) 32217>0x00003B byte 0x0B (window settings) 32218>0x00003B byte 0x0C (window settings) 32219>0x00003B byte 0x0D (table setup) 32220>0x00003B byte 0x0E (screenshot) 32221>0x00003B byte 0x13 (backup) 32222# 32223# Magic Numbers for the TI-83+ 32224# 322250 string **TI83F* TI-83+ Graphing Calculator 32226>0x00003B byte 0x00 (real number) 32227>0x00003B byte 0x01 (list) 32228>0x00003B byte 0x02 (matrix) 32229>0x00003B byte 0x03 (equation) 32230>0x00003B byte 0x04 (string) 32231>0x00003B byte 0x05 (program) 32232>0x00003B byte 0x06 (assembly program) 32233>0x00003B byte 0x07 (picture) 32234>0x00003B byte 0x08 (gdb) 32235>0x00003B byte 0x0C (complex number) 32236>0x00003B byte 0x0F (window settings) 32237>0x00003B byte 0x10 (zoom) 32238>0x00003B byte 0x11 (table setup) 32239>0x00003B byte 0x13 (backup) 32240>0x00003B byte 0x15 (application variable) 32241>0x00003B byte 0x17 (group of variable) 32242 32243# 32244# Magic Numbers for the TI-85 32245# 322460 string **TI85** TI-85 Graphing Calculator 32247>0x00003B byte 0x00 (real number) 32248>0x00003B byte 0x01 (complex number) 32249>0x00003B byte 0x02 (real vector) 32250>0x00003B byte 0x03 (complex vector) 32251>0x00003B byte 0x04 (real list) 32252>0x00003B byte 0x05 (complex list) 32253>0x00003B byte 0x06 (real matrix) 32254>0x00003B byte 0x07 (complex matrix) 32255>0x00003B byte 0x08 (real constant) 32256>0x00003B byte 0x09 (complex constant) 32257>0x00003B byte 0x0A (equation) 32258>0x00003B byte 0x0C (string) 32259>0x00003B byte 0x0D (function GDB) 32260>0x00003B byte 0x0E (polar GDB) 32261>0x00003B byte 0x0F (parametric GDB) 32262>0x00003B byte 0x10 (diffeq GDB) 32263>0x00003B byte 0x11 (picture) 32264>0x00003B byte 0x12 (program) 32265>0x00003B byte 0x13 (range) 32266>0x00003B byte 0x17 (window settings) 32267>0x00003B byte 0x18 (window settings) 32268>0x00003B byte 0x19 (window settings) 32269>0x00003B byte 0x1A (window settings) 32270>0x00003B byte 0x1B (zoom) 32271>0x00003B byte 0x1D (backup) 32272>0x00003B byte 0x1E (unknown) 32273>0x00003B byte 0x2A (equation) 32274>0x000032 string ZS4 - ZShell Version 4 File. 32275>0x000032 string ZS3 - ZShell Version 3 File. 32276# 32277# Magic Numbers for the TI-86 32278# 322790 string **TI86** TI-86 Graphing Calculator 32280>0x00003B byte 0x00 (real number) 32281>0x00003B byte 0x01 (complex number) 32282>0x00003B byte 0x02 (real vector) 32283>0x00003B byte 0x03 (complex vector) 32284>0x00003B byte 0x04 (real list) 32285>0x00003B byte 0x05 (complex list) 32286>0x00003B byte 0x06 (real matrix) 32287>0x00003B byte 0x07 (complex matrix) 32288>0x00003B byte 0x08 (real constant) 32289>0x00003B byte 0x09 (complex constant) 32290>0x00003B byte 0x0A (equation) 32291>0x00003B byte 0x0C (string) 32292>0x00003B byte 0x0D (function GDB) 32293>0x00003B byte 0x0E (polar GDB) 32294>0x00003B byte 0x0F (parametric GDB) 32295>0x00003B byte 0x10 (diffeq GDB) 32296>0x00003B byte 0x11 (picture) 32297>0x00003B byte 0x12 (program) 32298>0x00003B byte 0x13 (range) 32299>0x00003B byte 0x17 (window settings) 32300>0x00003B byte 0x18 (window settings) 32301>0x00003B byte 0x19 (window settings) 32302>0x00003B byte 0x1A (window settings) 32303>0x00003B byte 0x1B (zoom) 32304>0x00003B byte 0x1D (backup) 32305>0x00003B byte 0x1E (unknown) 32306>0x00003B byte 0x2A (equation) 32307# 32308# Magic Numbers for the TI-89 32309# 323100 string **TI89** TI-89 Graphing Calculator 32311>0x000048 byte 0x00 (expression) 32312>0x000048 byte 0x04 (list) 32313>0x000048 byte 0x06 (matrix) 32314>0x000048 byte 0x0A (data) 32315>0x000048 byte 0x0B (text) 32316>0x000048 byte 0x0C (string) 32317>0x000048 byte 0x0D (graphic data base) 32318>0x000048 byte 0x0E (figure) 32319>0x000048 byte 0x10 (picture) 32320>0x000048 byte 0x12 (program) 32321>0x000048 byte 0x13 (function) 32322>0x000048 byte 0x14 (macro) 32323>0x000048 byte 0x1C (zipped) 32324>0x000048 byte 0x21 (assembler) 32325# 32326# Magic Numbers for the TI-92 32327# 323280 string **TI92** TI-92 Graphing Calculator 32329>0x000048 byte 0x00 (expression) 32330>0x000048 byte 0x04 (list) 32331>0x000048 byte 0x06 (matrix) 32332>0x000048 byte 0x0A (data) 32333>0x000048 byte 0x0B (text) 32334>0x000048 byte 0x0C (string) 32335>0x000048 byte 0x0D (graphic data base) 32336>0x000048 byte 0x0E (figure) 32337>0x000048 byte 0x10 (picture) 32338>0x000048 byte 0x12 (program) 32339>0x000048 byte 0x13 (function) 32340>0x000048 byte 0x14 (macro) 32341>0x000048 byte 0x1D (backup) 32342# 32343# Magic Numbers for the TI-92+/V200 32344# 323450 string **TI92P* TI-92+/V200 Graphing Calculator 32346>0x000048 byte 0x00 (expression) 32347>0x000048 byte 0x04 (list) 32348>0x000048 byte 0x06 (matrix) 32349>0x000048 byte 0x0A (data) 32350>0x000048 byte 0x0B (text) 32351>0x000048 byte 0x0C (string) 32352>0x000048 byte 0x0D (graphic data base) 32353>0x000048 byte 0x0E (figure) 32354>0x000048 byte 0x10 (picture) 32355>0x000048 byte 0x12 (program) 32356>0x000048 byte 0x13 (function) 32357>0x000048 byte 0x14 (macro) 32358>0x000048 byte 0x1C (zipped) 32359>0x000048 byte 0x21 (assembler) 32360# 32361# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 32362# 32363#0x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 323640 string **TIFL** TI-XX Graphing Calculator (FLASH) 32365>8 byte >0 - Revision %d 32366>>9 byte x \b.%d, 32367>12 byte >0 Revision date %02x 32368>>13 byte x \b/%02x 32369>>14 beshort x \b/%04x, 32370>17 string >/0 name: '%s', 32371>48 byte 0x74 device: TI-73, 32372>48 byte 0x73 device: TI-83+, 32373>48 byte 0x98 device: TI-89, 32374>48 byte 0x88 device: TI-92+, 32375>49 byte 0x23 type: OS upgrade, 32376>49 byte 0x24 type: application, 32377>49 byte 0x25 type: certificate, 32378>49 byte 0x3e type: license, 32379>74 lelong >0 size: %d bytes 32380 32381# VTi & TiEmu skins (TI Graphing Calculators). 32382# From: Romain Lievin (roms@lpg.ticalc.org). 32383# Magic Numbers for the VTi skins 323840 string VTI Virtual TI skin 32385>3 string v - Version 32386>>4 byte >0 \b %c 32387>>6 byte x \b.%c 32388# Magic Numbers for the TiEmu skins 323890 string TiEmu TiEmu skin 32390>6 string v - Version 32391>>7 byte >0 \b %c 32392>>9 byte x \b.%c 32393>>10 byte x \b%c 32394 32395#------------------------------------------------------------------------------ 32396# $File: timezone,v 1.12 2020/12/28 15:59:23 christos Exp $ 32397# timezone: file(1) magic for timezone data 32398# 32399# from Daniel Quinlan (quinlan@yggdrasil.com) 32400# this should work on Linux, SunOS, and maybe others 32401# Added new official magic number for recent versions of the Olson code 324020 string TZif timezone data 32403>4 byte 0 \b, old version 32404>4 byte >0 \b, version %c 32405>20 belong 0 \b, no gmt time flags 32406>20 belong 1 \b, 1 gmt time flag 32407>20 belong >1 \b, %d gmt time flags 32408>24 belong 0 \b, no std time flags 32409>24 belong 1 \b, 1 std time flag 32410>24 belong >1 \b, %d std time flags 32411>28 belong 0 \b, no leap seconds 32412>28 belong 1 \b, 1 leap second 32413>28 belong >1 \b, %d leap seconds 32414>32 belong 0 \b, no transition times 32415>32 belong 1 \b, 1 transition time 32416>32 belong >1 \b, %d transition times 32417>36 belong 0 \b, no local time types 32418>36 belong 1 \b, 1 local time type 32419>36 belong >1 \b, %d local time types 32420>40 belong 0 \b, no abbreviation chars 32421>40 belong 1 \b, 1 abbreviation char 32422>40 belong >1 \b, %d abbreviation chars 324230 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 324240 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 324250 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 324260 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 324270 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 324280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 32429 32430#------------------------------------------------------------------------------ 32431# $File: tplink,v 1.6 2020/12/12 20:01:47 christos Exp $ 32432# tplink: File magic for openwrt firmware files 32433 32434# URL: https://wiki.openwrt.org/doc/techref/header 32435# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c 32436# From: Joerg Jenderek 32437# check for valid header version 1 or 2 324380 ulelong <3 32439>0 ulelong !0 32440# test for header padding with nulls 32441>>0x100 long 0 32442# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor 32443>>>4 ubelong >0x1F000000 32444# skip user.dbt by looking for positive hardware id 32445>>>>0x40 ubeshort >0 32446>>>>>0 use firmware-tplink 32447 324480 name firmware-tplink 32449>0 ubyte x firmware 32450!:mime application/x-tplink-bin 32451!:ext bin 32452# hardware id like 10430001 07410001 09410004 09410006 32453>0x40 ubeshort x %x 32454>0x42 ubeshort x v%x 32455# hardware revision like 1 32456>0x44 ubelong !1 (revision %u) 32457# vendor_name[24] like OpenWrt or TP-LINK Technologies 32458>4 string x %.24s 32459# fw_version[36] like r49389 or ver. 1.0 32460>0x1c string x %.36s 32461# header version 1 or 2 32462>0 ubyte !1 V%X 32463# ver_hi.ver_mid.ver_lo 32464>0x98 long !0 \b, version 32465>>0x98 ubeshort x %u 32466>>0x9A ubeshort x \b.%u 32467>>0x9C ubeshort x \b.%u 32468# region code 0~universal 1~US 32469>0x48 ubelong x 32470#>>0x48 ubelong 0 (universal) 32471>>0x48 ubelong 1 (US) 32472>>0x48 ubelong >1 (region %u) 32473# total length of the firmware. not always true 32474>0x7C ubelong x \b, %u bytes or less 32475# unknown 1 32476>0x48 ubelong !0 \b, UNKNOWN1 0x%x 32477# md5sum1[16] 32478#>0x4c ubequad x \b, MD5 %llx 32479#>>0x54 ubequad x \b%llx 32480# unknown 2 32481>0x5c ubelong !0 \b, UNKNOWN2 0x%x 32482# md5sum2[16] 32483#>0x60 ubequad !0 \b, 2nd MD5 %llx 32484#>>0x68 ubequad x \b%llx 32485# unknown 3 32486>0x70 ubelong !0 \b, UNKNOWN3 0x%x 32487# kernel load address 32488#>0x74 ubelong x \b, 0x%x load 32489# kernel entry point 32490#>0x78 ubelong x \b, 0x%x entry 32491# kernel data offset. 200h means direct after header 32492>0x80 ubelong x \b, at 0x%x 32493# kernel data length and 1 space 32494>0x84 ubelong x %u bytes 32495# look for kernel type (gzip compressed vmlinux.bin by ./compress) 32496>(0x80.L) indirect x 32497# root file system data offset 32498# WRONG in 5.35 with above indirect expression 32499>0x88 ubelong x \b, at 0x%x 32500# rootfs data length and 1 space 32501>0x8C ubelong x %u bytes 32502# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h 32503>(0x88.L) indirect x 32504# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin 32505#>(0x88.L) string x \b, file system '%.4s' 32506#>(0x88.L) ubequad x \b, file system 0x%llx 32507# bootloader data offset 32508>0x90 ubelong !0 \b, at 0x%x 32509# bootloader data length only reasonable if bootloader offset not null 32510>>0x94 ubelong !0 %u bytes 32511# pad[354] should be 354 null bytes. 32512#>0x9E ubequad !0 \b, padding 0x%llx 32513# But at 0x120 18 non null bytes in examples like 32514# wr940nv4_eu_3_16_9_up_boot(160620).bin 32515# wr940nv6_us_3_18_1_up_boot(171030).bin 32516#>0x120 ubequad !0 \b, other padding 0x%llx 32517 32518#------------------------------------------------------------------------------ 32519# $File: troff,v 1.13 2020/05/30 23:12:34 christos Exp $ 32520# troff: file(1) magic for *roff 32521# 32522# updated by Daniel Quinlan (quinlan@yggdrasil.com) 32523 32524# troff input 325250 search/1 .\\" troff or preprocessor input text 32526!:mime text/troff 325270 search/1 '\\" troff or preprocessor input text 32528!:mime text/troff 325290 search/1 '.\\" troff or preprocessor input text 32530!:mime text/troff 325310 search/1 \\" troff or preprocessor input text 32532!:mime text/troff 32533#0 search/1 ''' troff or preprocessor input text 32534#!:mime text/troff 325350 regex/20l \^\\.[A-Za-z][A-Za-z0-9][\ \t] troff or preprocessor input text 32536!:mime text/troff 325370 regex/20l \^\\.[A-Za-z][A-Za-z0-9]$ troff or preprocessor input text 32538!:mime text/troff 32539 32540# ditroff intermediate output text 325410 search/1 x\ T ditroff output text 32542>4 search/1 cat for the C/A/T phototypesetter 32543>4 search/1 ps for PostScript 32544>4 search/1 dvi for DVI 32545>4 search/1 ascii for ASCII 32546>4 search/1 lj4 for LaserJet 4 32547>4 search/1 latin1 for ISO 8859-1 (Latin 1) 32548>4 search/1 X75 for xditview at 75dpi 32549>>7 search/1 -12 (12pt) 32550>4 search/1 X100 for xditview at 100dpi 32551>>8 search/1 -12 (12pt) 32552 32553# output data formats 325540 string \100\357 very old (C/A/T) troff output data 32555 32556#------------------------------------------------------------------------------ 32557# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 32558# tuxedo: file(1) magic for BEA TUXEDO data files 32559# 32560# from Ian Springer <ispringer@hotmail.com> 32561# 325620 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 32563 32564#------------------------------------------------------------------------------ 32565# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 32566# typeset: file(1) magic for other typesetting 32567# 325680 string Interpress/Xerox Xerox InterPress data 32569>16 string / (version 32570>>17 string >\0 %s) 32571 32572#------------------------------------------------------------------------------ 32573# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $ 32574# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 32575# These types are recognised in file_ascmagic so these encodings can be 32576# treated by text patterns. Missing types are already dealt with internally. 32577# 325780 string +/v8 Unicode text, UTF-7 325790 string +/v9 Unicode text, UTF-7 325800 string +/v+ Unicode text, UTF-7 325810 string +/v/ Unicode text, UTF-7 325820 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 325830 string \000\000\376\377 Unicode text, UTF-32, big-endian 325840 string \377\376\000\000 Unicode text, UTF-32, little-endian 325850 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 32586 32587#------------------------------------------------------------------------------ 32588# $File: unisig,v 1.1 2020/04/09 19:05:44 christos Exp $ 32589# unisig: file(1) magic for files carrying a uniform signature (Unisig) 32590# From: Lassi Kortela, John Cowan 32591# URL: https://github.com/unisig 32592# 325930 string \xDC\xDC\x0D\x0A\x1A\x0A\x00 Unisig: 32594>7 ubyte =0 UUID 32595>>8 guid x %s 32596>7 ubyte >0 URI 32597>>7 pstring x %s 32598 32599#------------------------------------------------------------------------------ 32600# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 32601# unknown: file(1) magic for unknown machines 32602# 32603# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 32604# (executable, pure, and split I&D, respectively), but the PDP-11 version 32605# doesn't have the "version %ld", which may be a bogus COFFism (I don't 32606# think there was ever COFF for the PDP-11). 32607# 32608# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 32609# long, as it would be on a VAX. In any case, that could collide with 32610# VAX demand-paged files, as the magic number is little-endian on those 32611# binaries, so the first 16 bits of the file would contain 0x10B. 32612# 32613# Therefore, those entries are commented out. 32614# 32615# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 32616# 32617#0 short 0x107 unknown machine executable 32618#>8 short >0 not stripped 32619#>15 byte >0 - version %ld 32620#0 short 0x108 unknown pure executable 32621#>8 short >0 not stripped 32622#>15 byte >0 - version %ld 32623#0 short 0x109 PDP-11 separate I&D 32624#>8 short >0 not stripped 32625#>15 byte >0 - version %ld 32626#0 short 0x10b unknown pure executable 32627#>8 short >0 not stripped 32628#>15 byte >0 - version %ld 326290 long 0x10c unknown demand paged pure executable 32630>16 long >0 not stripped 326310 long 0x10e unknown readable demand paged pure executable 32632 32633#------------------------------------------------------------------------------ 32634# $File: usd,v 1.2 2020/05/21 22:17:00 christos Exp $ 32635# 32636# From Christian Schmidbauer 32637# 32638# https://github.com/PixarAnimationStudios/USD 32639 32640# USD crate file 32641# https://github.com/PixarAnimationStudios/USD/blob/ebac0a8b6703f4fa1c27115f1f013bb9819662f4/pxr/usd/usd/crateFile.h#L441-L450 326420 string PXR-USDC USD crate 32643>8 byte x \b, version %x. 32644>9 byte x \b%x. 32645>10 byte x \b%x 32646!:ext usd 32647 32648# USD ASCII file 326490 string #usda\040 USD ASCII 32650>6 string x \b, version %s 32651!:mime text/plain 32652!:ext usd 32653 32654#------------------------------------------------------------------------------ 32655# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $ 32656# file(1) magic for uterus files 32657# http://freecode.com/projects/uterus 32658# 326590 string UTE+ uterus file 32660>4 string v \b, version 32661>5 byte x %c 32662>6 string . \b. 32663>7 byte x \b%c 32664>8 string \<\> \b, big-endian 32665>>16 belong >0 \b, slut size %u 32666>8 string \>\< \b, litte-endian 32667>>16 lelong >0 \b, slut size %u 32668>10 byte &8 \b, compressed 32669 32670#------------------------------------------------------------------------------ 32671# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $ 32672# uuencode: file(1) magic for ASCII-encoded files 32673# 32674 32675# GRR: the first line of xxencoded files is identical to that in uuencoded 32676# files, but the first character in most subsequent lines is 'h' instead of 32677# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 32678# punctuation and survives BITNET gateways better.) If regular expressions 32679# were supported, this entry could possibly be split into two with 32680# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 326810 search/1 begin\ uuencoded or xxencoded text 32682 32683# btoa(1) is an alternative to uuencode that requires less space. 326840 search/1 xbtoa\ Begin btoa'd text 32685 32686# ship(1) is another, much cooler alternative to uuencode. 32687# Greg Roelofs, newt@uchicago.edu 326880 search/1 $\012ship ship'd binary text 32689 32690# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 32691# Greg Roelofs, newt@uchicago.edu 326920 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 32693 32694# GRR: handle BASE64 32695 32696#------------------------------------------------------------------------------ 32697# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $ 32698# vacuum cleaner magic by Thomas M. Ott (ThMO) 32699# 32700# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx 32701# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk 32702# -> yyyymmdd: year, month, day of cleaning 32703# -> hhmmss: hour, minute, second of cleaning 32704# -> xxxxxx: 6 digits 32705# -> cc: cleaning runs counter 32706# size: 136044 bytes 32707# 32708# struct maphdr { 32709# int32_t map_cnt; /* 0: single map */ 32710# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */ 32711# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */ 32712# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */ 32713# int32_t unknown; /* 16: 50000 ??? */ 32714# int32_t cell_bytes; /* 20: # of bytes for cells per block */ 32715# int32_t block_max; /* 24: 1000 == max. # of blocks */ 32716# int32_t route_max; /* 28: 1000 == max. # of routes */ 32717# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */ 32718# int32_t cell_dim; /* 36: 10 == cell dimension */ 32719# int32_t clock_tick; /* 40: 100 == clock ticks */ 32720# #if 0 32721# struct { /* 44: 1000 blocks for 10x10 cells */ 32722# int32_t yoffset; 32723# int32_t xoffset; 32724# int32_t posxy; 32725# int32_t timecode; 32726# } blocks[ 1000]; 32727# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */ 32728# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */ 32729# #endif 32730# }; 32731 327320 lelong =1 32733>4 lelong =100 32734>>8 lelong =10000 32735>>>12 lelong =50 32736>>>>16 lelong =50000 32737>>>>>20 lelong =100 32738>>>>>>24 lelong =1000 32739>>>>>>>28 lelong =1000 32740>>>>>>>>36 lelong =10 32741>>>>>>>>>40 lelong =100 32742>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation 32743>>>>>>>>>>136040 lelong =-1 reuse map data 32744>>>>>>>>>>136040 lelong =0 map data 32745>>>>>>>>>>136040 lelong >0 spurious map data 32746>>>>>>>>>>136040 lelong <-1 spurious map data 32747 32748 32749 32750#------------------------------------------------------------------------------ 32751# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $ 32752# varied.out: file(1) magic for various USG systems 32753# 32754# Herewith many of the object file formats used by USG systems. 32755# Most have been moved to files for a particular processor, 32756# and deleted if they duplicate other entries. 32757# 327580 short 0610 Perkin-Elmer executable 32759# AMD 29K 327600 beshort 0572 amd 29k coff noprebar executable 327610 beshort 01572 amd 29k coff prebar executable 327620 beshort 0160007 amd 29k coff archive 32763# Cray 327646 beshort 0407 unicos (cray) executable 32765# Ultrix 4.3 32766596 string \130\337\377\377 Ultrix core file 32767>600 string >\0 from '%s' 32768# BeOS and MAcOS PEF executables 32769# From: hplus@zilker.net (Jon Watte) 327700 string Joy!peffpwpc header for PowerPC PEF executable 32771# 32772# ava assembler/linker Uros Platise <uros.platise@ijs.si> 327730 string avaobj AVR assembler object code 32774>7 string >\0 version '%s' 32775# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 327760 string gmon GNU prof performance data 32777>4 long x - version %d 32778# From: Dave Pearson <davep@davep.org> 32779# Harbour <URL:http://harbour-project.org/> HRB files. 327800 string \xc0HRB Harbour HRB file 32781>4 leshort x version %d 32782# Harbour HBV files 327830 string \xc0HBV Harbour variable dump file 32784>4 leshort x version %d 32785 32786# From: Alex Beregszaszi <alex@fsn.hu> 32787# 0 string exec BugOS executable 32788# 0 string pack BugOS archive 32789 32790# From: Jason Spence <jspence@lightconsulting.com> 32791# Generated by the "examples" in STM's ST40 devkit, and derived code. 327920 lelong 0x13a9f17e ST40 component image format 32793>4 string >\0 \b, name '%s' 32794 32795#------------------------------------------------------------------------------ 32796# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $ 32797# varied.script: file(1) magic for various interpreter scripts 32798 327990 string/t #!\ / a 32800>3 string >\0 %s script text executable 32801!:strength / 2 32802 328030 string/b #!\ / a 32804>3 string >\0 %s script executable (binary data) 32805!:strength / 2 32806 328070 string/t #!\t/ a 32808>3 string >\0 %s script text executable 32809!:strength / 2 32810 328110 string/b #!\t/ a 32812>3 string >\0 %s script executable (binary data) 32813!:strength / 2 32814 328150 string/t #!/ a 32816>2 string >\0 %s script text executable 32817!:strength / 2 32818 328190 string/b #!/ a 32820>2 string >\0 %s script executable (binary data) 32821!:strength / 2 32822 328230 string/t #!\ script text executable 32824>3 string >\0 for %s 32825!:strength / 2 32826 328270 string/b #!\ script executable 32828>3 string >\0 for %s (binary data) 32829!:strength / 2 32830 32831# using env 328320 string/t #!/usr/bin/env a 32833>15 string/t >\0 %s script text executable 32834!:strength / 10 32835 328360 string/b #!/usr/bin/env a 32837>15 string/b >\0 %s script executable (binary data) 32838!:strength / 10 32839 328400 string/t #!\ /usr/bin/env a 32841>16 string/t >\0 %s script text executable 32842!:strength / 10 32843 328440 string/b #!\ /usr/bin/env a 32845>16 string/b >\0 %s script executable (binary data) 32846!:strength / 10 32847 32848# From: arno <arenevier@fdn.fr> 32849# mozilla xpconnect typelib 32850# see https://www.mozilla.org/scriptable/typelib_file.html 328510 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 32852>0x10 byte x version %d 32853>>0x11 byte x \b.%d 32854 32855#------------------------------------------------------------------------------ 32856# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $ 32857# vax: file(1) magic for VAX executable/object and APL workspace 32858# 328590 lelong 0101557 VAX single precision APL workspace 328600 lelong 0101556 VAX double precision APL workspace 32861 32862# 32863# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 32864# executables, and are handled in aout) 32865# 328660 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 32867>16 lelong >0 not stripped 32868 32869# 32870# VAX COFF 32871# 32872# The `versions' were commented out, but have been un-commented out. 32873# (Was the problem just one of endianness?) 32874# 328750 leshort 0570 32876>2 uleshort <100 VAX COFF executable, sections %d 32877>>4 ledate x \b, created %s 32878>>12 lelong >0 \b, not stripped 32879>>22 leshort >0 \b, version %d 32880 328810 leshort 0575 32882>2 uleshort <100 VAX COFF pure executable, sections %d 32883>>4 ledate x \b, created %s 32884>>12 lelong >0 \b, not stripped 32885>>22 leshort >0 \b, version %d 32886 32887#------------------------------------------------------------------------------ 32888# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 32889# vicar: file(1) magic for VICAR files. 32890# 32891# From: Ossama Othman <othman@astrosun.tn.cornell.edu 32892# VICAR is JPL's in-house spacecraft image processing program 32893# VICAR image 328940 string LBLSIZE= VICAR image data 32895>32 string BYTE \b, 8 bits = VAX byte 32896>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 32897>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 32898>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 32899>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 32900>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 32901# VICAR label file 3290243 string SFDU_LABEL VICAR label file 32903 32904#------------------------------------------------------------------------------ 32905# $File: virtual,v 1.13 2021/02/23 00:51:10 christos Exp $ 32906# From: James Nobis <quel@quelrod.net> 32907# Microsoft hard disk images for: 32908# Virtual Server 32909# Virtual PC 32910# VirtualBox 32911# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) 32912# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ 32913# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc 329140 string connectix Microsoft Disk Image, Virtual Server or Virtual PC 32915# alternative shorter names 32916#0 string connectix Microsoft Virtual Hard Disk image 32917#0 string connectix Microsoft Virtual HD image 32918!:mime application/x-virtualbox-vhd 32919!:ext vhd 32920# Features is a bit field used to indicate specific feature support 32921#>8 ubelong !0x00000002 \b, Features 0x%x 32922# Reserved. This bit must always be set to 1. 32923#>8 ubelong &0x00000002 \b, Reserved 0x%x 32924# File Format Version for the current specification 0x00010000 32925#>12 ubelong !0x00010000 \b, Version 0x%8.8x 32926# Data Offset only found 0x200 32927#>16 ubequad !0x200 \b, Data Offset 0x%llx 32928#>16 ubequad x \b, at 0x%llx 32929# Dynamic Disk Header cookie like cxsparse 32930#>(16.Q) string x "%-.8s" 32931# This field contains a Unicode string (UTF-16) of the parent hard disk filename 32932#>(16.Q+64) ubequad x \b, parent name 0x%llx 32933# Creator Application 32934# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd 32935>28 string x \b, Creator %-4.4s 32936# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 32937# holds the major/minor version of the application that created the image 32938>32 ubeshort x %x 32939>34 ubeshort x \b.%x 32940#>32 ubelong x \b, Version 0x%8.8x 32941# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) 32942>36 ubelong x ( 32943>>36 ubelong 0x5769326B \bW2k 32944>>36 ubelong 0x4D616320 \bMac 32945>>36 default x \b0x 32946>>>36 ubelong x \b%8.8x 32947# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch 32948>24 bedate+946684800 x \b) %s 32949# Original Size 32950#>40 ubequad x \b, o.-Size 0x%llx 32951# Current Size is same as original size, but change when disk is expanded 32952#>48 ubequad x \b, Size 0x%llx 32953>48 ubequad x \b, %llu bytes 32954# Disk Geometry: cylinder, heads, and sectors/track for hard disk 32955#>56 ubeshort x \b, Cylinder 0x%x 32956>56 ubeshort x \b, CHS %u 32957# Heads 32958#>58 ubyte x \b, Heads 0x%x 32959>58 ubyte x \b/%u 32960# Sectors per track 32961#>59 ubyte x \b, Sectors 0x%x 32962>59 ubyte x \b/%u 32963# Disk Type: 3~Dynamic hard disk 32964>60 ubelong !0x3 \b, type 0x%x 32965# Checksum 32966#>64 ubelong x \b, cksum 0x%x 32967# universally unique identifier (UUID) to associate a parent with its differencing image 32968#>68 ubequad x \b, id 0x%16.16llx 32969#>76 ubequad x \b-%16.16llx 32970# Saved State: 1~Saved State 32971>84 ubyte !0 \b, State 0x%x 32972# Reserved 427 bytes with nils 32973#>85 ubequad !0 \b, Reserved 0x%16.16llx 32974 32975# From: Joerg Jenderek 32976# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx 32977# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ 32978# MS-VHDX/[MS-VHDX].pdf 32979# Note: extends the VHD format with new capabilities, such as a 16TB maximum size 32980# TODO: find and display values like virtual size, disk size, cluster_size, etc 32981# display id in GUID format 32982# 32983# VHDX_FILE_IDENTIFIER signature 0x656C696678646876 329840 string vhdxfile 32985# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB 32986>0x10000 string head Microsoft Disk Image eXtended 32987#>0x20000 string head \b, 2nd header 32988#!:mime application/x-virtualbox-vhdx 32989!:ext vhdx 32990# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" 32991>>8 lestring16 x \b, by %.256s 32992# The Checksum field is a CRC-32C hash over the entire 4 KB structure 32993#>>0x10004 ulelong x \b, CRC 0x%x 32994# SequenceNumber 32995>>0x10008 ulequad x \b, sequence 0x%llx 32996# FileWriteGuid 32997#>>0x10010 ubequad x \b, file id 0x%llx 32998#>>>0x10018 ubequad x \b-%llx 32999# DataWriteGuid 33000#>>0x10020 ubequad x \b, data id 0x%llx 33001#>>>0x10028 ubequad x \b-%llx 33002# LogGuid. If this field is zero, then the log is empty or has no valid entries 33003>>0x10030 ubequad >0 \b, log id 0x%llx 33004>>>0x10038 ubequad x \b-%llx 33005# LogVersion. If not 0 there is a log to replay 33006>>0x10040 uleshort >0 \b, LogVersion 0x%x 33007# Version. This field must be set to 1 33008>>0x10042 uleshort !1 \b, Version 0x%x 33009# LogLength must be multiples of 1 MB 33010>>0x10044 ulelong/1048576 >1 \b, LogLength %u MB 33011# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB 33012>>0x10048 ulequad !0x100000 \b, LogOffset 0x%llx 33013# Log Entry Signature must be 0x65676F6C~loge 33014>>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature 33015>>(0x10048.q) ulelong =0x65676F6C \b; LOG 33016# Log Entry Checksum 33017#>>>(0x10048.q+4) ulelong x \b, Log CRC 0x%x 33018# Log Entry Length must be a multiple of 4 KB 33019>>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB 33020# Log Entry Tail must be a multiple of 4 KB 33021#>>>(0x10048.q+12) ulelong x \b, Tail 0x%x 33022# Log Entry SequenceNumber 33023#>>>(0x10048.q+16) ulequad x \b, # 0x%llx 33024# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 33025#>>>(0x10048.q+24) ulelong x \b, DescriptorCount 0x%llx 33026# Log Entry Reserved must be set to 0 33027>>>(0x10048.q+28) ulelong !0 \b, Reserved 0x%x 33028# Log Entry LogGuid 33029#>>>(0x10048.q+32) ubequad x \b, Log id 0x%llx 33030#>>>(0x10048.q+40) ubequad x \b-%llx 33031# Log Entry FlushedFileOffset should VHDX size when entry is written. 33032#>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu 33033# Log Entry LastFileOffset 33034#>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu 33035# filling 33036#>>>(0x10048.q+64) ulequad >0 \b, filling %llx 33037# Reserved[4016] 33038#>>0x10050 ulequad >0 \b, Reserved 0x%llx 33039# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB 33040>0x30000 ulelong !0x69676572 \b, 1st region INVALID 33041>0x30000 ulelong =0x69676572 \b; region 33042# region Checksum. CRC-32C hash over the entire 64-KB table 33043#>>0x30004 ulelong x \b, CRC 0x%x 33044# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. 33045>>0x30008 ulelong x \b, %u entries 33046# reserved must be zero 33047#>>0x3000C ulelong !0 \b, RESERVED 0x%x 33048# Region Table Entry starts with identifier for the object. often BAT id 33049>>0x30010 use vhdx-id 33050# FileOffset 33051>>0x30020 ulequad x \b, at 0x%llx 33052# Length. Specifies the length of the object within the file 33053#>>0x30028 ulelong x \b, Length 0x%x 33054# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 33055>>0x3002C ulelong x \b, Required %u 33056# 2nd region entry often metadata id 33057>>0x30030 use vhdx-id 33058# 2nd entry FileOffset 33059>>0x30040 ulequad x \b, at 0x%llx 33060# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 33061>>0x3004C ulelong x \b, Required %u 33062# 2nd region 33063>>0x40000 ulelong !0x69676572 \b, 2nd region INVALID 33064# check in vhdx images for known id and show names instead hexadecimal 330650 name vhdx-id 33066# https://www.windowstricks.in/online-windows-guid-converter 33067# 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID 33068# 6677C22D23F600429D64115E9BFD4A08 BAT ID 33069>0 ubequad =0x6677C22D23F60042 33070>>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT 33071# no BAT id 33072>>8 default x 33073>>>0 use vhdx-id-hex 33074# 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID 33075# 06A27C8B90479A4BB8FE575F050F886E Metadata region ID 33076>0 ubequad =0x06A27C8B90479A4B 33077>>8 ubequad =0xB8FE575F050F886E \b, id Metadata 33078# no Metadata id 33079>>8 default x 33080>>>0 use vhdx-id-hex 33081# 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID 33082# 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID 33083# value "virtual size" can be verified by command `qemu-img info ` 33084>0 ubequad =0x2442A52F1BCD7648 33085>>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize 33086# no Virtual Disk Size ID 33087>>8 default x 33088>>>0 use vhdx-id-hex 33089# other ids 33090>0 default x 33091>>0 use vhdx-id-hex 33092# in vhdx images show id as hexadecimal 330930 name vhdx-id-hex 33094>0 ubequad x \b, ID 0x%16.16llx 33095>8 ubequad x \b-%16.16llx 33096# 33097# libvirt 33098# From: Philipp Hahn <hahn@univention.de> 330990 string LibvirtQemudSave Libvirt QEMU Suspend Image 33100>0x10 lelong x \b, version %u 33101>0x14 lelong x \b, XML length %u 33102>0x18 lelong 1 \b, running 33103>0x1c lelong 1 \b, compressed 33104 331050 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 33106# From: Alex Beregszaszi <alex@fsn.hu> 331070 string/b COWD VMWare3 33108>4 byte 3 disk image 33109>>32 lelong x (%d/ 33110>>36 lelong x \b%d/ 33111>>40 lelong x \b%d) 33112>4 byte 2 undoable disk image 33113>>32 string >\0 (%s) 33114 331150 string/b VMDK VMware4 disk image 331160 string/b KDMV VMware4 disk image 33117 33118#-------------------------------------------------------------------- 33119# Qemu Emulator Images 33120# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 33121# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 33122# Made by reading sources, reading documentation, and doing trial and error 33123# on existing QCOW files 331240 string/b QFI\xFB 33125 33126# Uncomment the following line to display Magic (only used for debugging 33127# this magic number) 33128#>0 string/b x , Magic: %s 33129 33130# There are currently 2 Versions: "1" and "2". 33131# https://www.gnome.org/~markmc/qcow-image-format-version-1.html 33132>4 belong !1 QEMU QCOW2 Image 33133>4 belong 1 QEMU QCOW Image (v1) 33134 33135# Using the existence of the Backing File Offset to determine whether 33136# to read Backing File Information 33137>>12 belong >0 \b, has backing file ( 33138# Note that this isn't a null-terminated string; the length is actually 33139# (16.L). Assuming a null-terminated string happens to work usually, but it 33140# may spew junk until it reaches a \0 in some cases. 33141>>>(12.L) string >\0 \bpath %s 33142 33143# Modification time of the Backing File 33144# Really useful if you want to know if your backing 33145# file is still usable together with this image 33146>>>>20 bedate >0 \b, mtime %s) 33147>>>>20 default x \b) 33148 33149# Size is stored in bytes in a big-endian u64. 33150>>24 bequad x \b, %lld bytes 33151 33152# 1 for AES encryption, 0 for none. 33153>>36 belong 1 \b, AES-encrypted 33154 33155# https://www.gnome.org/~markmc/qcow-image-format.html 33156>4 belong 2 (v2) 33157# Using the existence of the Backing File Offset to determine whether 33158# to read Backing File Information 33159>>8 bequad >0 \b, has backing file 33160# Note that this isn't a null-terminated string; the length is actually 33161# (16.L). Assuming a null-terminated string happens to work usually, but it 33162# may spew junk until it reaches a \0 in some cases. Also, since there's no 33163# .Q modifier, we just use the bottom four bytes as an offset. Note that if 33164# the file is over 4G, and the backing file path is stored after the first 4G, 33165# the wrong filename will be printed. (This should be (8.Q), when that syntax 33166# is introduced.) 33167>>>(12.L) string >\0 (path %s) 33168>>24 bequad x \b, %lld bytes 33169>>32 belong 1 \b, AES-encrypted 33170 33171>4 belong 3 (v3) 33172# Using the existence of the Backing File Offset to determine whether 33173# to read Backing File Information 33174>>8 bequad >0 \b, has backing file 33175# Note that this isn't a null-terminated string; the length is actually 33176# (16.L). Assuming a null-terminated string happens to work usually, but it 33177# may spew junk until it reaches a \0 in some cases. Also, since there's no 33178# .Q modifier, we just use the bottom four bytes as an offset. Note that if 33179# the file is over 4G, and the backing file path is stored after the first 4G, 33180# the wrong filename will be printed. (This should be (8.Q), when that syntax 33181# is introduced.) 33182>>>(12.L) string >\0 (path %s) 33183>>24 bequad x \b, %lld bytes 33184>>32 belong 1 \b, AES-encrypted 33185 33186>4 default x (unknown version) 33187 331880 string/b QEVM QEMU suspend to disk image 33189 33190# QEMU QED Image 33191# https://wiki.qemu.org/Features/QED/Specification 331920 string/b QED\0 QEMU QED Image 33193 33194# VDI Image 33195# Sun xVM VirtualBox Disk Image 33196# From: Richard W.M. Jones <rich@annexia.org> 33197# VirtualBox Disk Image 331980x40 ulelong 0xbeda107f VirtualBox Disk Image 33199>0x44 uleshort >0 \b, major %u 33200>0x46 uleshort >0 \b, minor %u 33201>0 string >\0 (%s) 33202>368 lequad x \b, %lld bytes 33203 332040 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 33205>32 string x type %s, 33206>48 string x subtype %s 33207 332080 lelong 0x02468ace Bochs Sparse disk image 33209 33210 33211#------------------------------------------------------------------------------ 33212# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 33213# Virtutech Compressed Random Access File Format 33214# 33215# From <gustav@virtutech.com> 332160 string \211\277\036\203 Virtutech CRAFF 33217>4 belong x v%d 33218>20 belong 0 uncompressed 33219>20 belong 1 bzipp2ed 33220>20 belong 2 gzipped 33221>24 belong 0 not clean 33222 33223#------------------------------------------------------------------------------ 33224# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 33225# visx: file(1) magic for Visx format files 33226# 332270 short 0x5555 VISX image file 33228>2 byte 0 (zero) 33229>2 byte 1 (unsigned char) 33230>2 byte 2 (short integer) 33231>2 byte 3 (float 32) 33232>2 byte 4 (float 64) 33233>2 byte 5 (signed char) 33234>2 byte 6 (bit-plane) 33235>2 byte 7 (classes) 33236>2 byte 8 (statistics) 33237>2 byte 10 (ascii text) 33238>2 byte 15 (image segments) 33239>2 byte 100 (image set) 33240>2 byte 101 (unsigned char vector) 33241>2 byte 102 (short integer vector) 33242>2 byte 103 (float 32 vector) 33243>2 byte 104 (float 64 vector) 33244>2 byte 105 (signed char vector) 33245>2 byte 106 (bit plane vector) 33246>2 byte 121 (feature vector) 33247>2 byte 122 (feature vector library) 33248>2 byte 124 (chain code) 33249>2 byte 126 (bit vector) 33250>2 byte 130 (graph) 33251>2 byte 131 (adjacency graph) 33252>2 byte 132 (adjacency graph library) 33253>2 string .VISIX (ascii text) 33254 33255#------------------------------------------------------------------------------ 33256# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $ 33257# vms: file(1) magic for VMS executables (experimental) 33258# 33259# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 33260 33261# GRR 950122: I'm just guessing on these, based on inspection of the headers 33262# of three executables each for Alpha and VAX architectures. The VAX files 33263# all had headers similar to this: 33264# 33265# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 33266# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 33267# 332680 string \xb0\0\x30\0 VMS VAX executable 33269>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 33270# 33271# The AXP files all looked like this, except that the byte at offset 0x22 33272# was 06 in some of them and 07 in others: 33273# 33274# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 33275# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 33276# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 33277# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 33278# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 33279# 33280# GRR this test is still too general as it catches example adressen.dbt 332810 belong 0x03000000 33282>8 ubelong 0xec020000 VMS Alpha executable 33283>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 33284 33285#------------------------------------------------------------------------------ 33286# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $ 33287# VMware specific files (deducted from version 1.1 and log file entries) 33288# Anthon van der Neut (anthon@mnt.org) 332890 belong 0x4d52564e VMware nvram 33290 33291#------------------------------------------------------------------------------ 33292# $File: vorbis,v 1.26 2020/08/22 18:30:55 christos Exp $ 33293# vorbis: file(1) magic for Ogg/Vorbis files 33294# 33295# From Felix von Leitner <leitner@fefe.de> 33296# Extended by Beni Cherniavsky <cben@crosswinds.net> 33297# Further extended by Greg Wooledge <greg@wooledge.org> 33298# 33299# Most (everything but the number of channels and bitrate) is commented 33300# out with `##' as it's not interesting to the average user. The most 33301# probable things advanced users would want to uncomment are probably 33302# the number of comments and the encoder version. 33303# 33304# FIXME: The first match has been made a search, so that it can skip 33305# over prepended ID3 tags. This will work for MIME type detection, but 33306# won't work for detecting other properties of the file (they all need 33307# to be made relative to the search). In any case, if the file has ID3 33308# tags, the ID3 information will be printed, not the Ogg information, 33309# so until that's fixed, this doesn't matter. 33310# FIXME[2]: Disable the above for now, since search assumes text mode. 33311# 33312# --- Ogg Framing --- 33313#0 search/1000 OggS Ogg data 333140 string OggS Ogg data 33315>4 byte !0 UNKNOWN REVISION %u 33316##>4 byte 0 revision 0 33317>4 byte 0 33318##>>14 lelong x (Serial %lX) 33319# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 33320>>28 string \x7fFLAC \b, FLAC audio 33321# non-Vorbis content: Theora 33322!:mime audio/ogg 33323>>28 string \x80theora \b, Theora video 33324!:mime video/ogg 33325# non-Vorbis content: Kate 33326>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 33327!:mime application/ogg 33328>>>37 ubyte x v%u 33329>>>38 ubyte x \b.%u, 33330>>>40 byte 0 utf8 encoding, 33331>>>40 byte !0 unknown character encoding, 33332>>>60 string >\0 language %s, 33333>>>60 string \0 no language set, 33334>>>76 string >\0 category %s 33335>>>76 string \0 no category set 33336# non-Vorbis content: Skeleton 33337>>28 string fishead\0 \b, Skeleton 33338!:mime video/ogg 33339>>>36 leshort x v%u 33340>>>40 leshort x \b.%u 33341# non-Vorbis content: Speex 33342>>28 string Speex\ \ \ \b, Speex audio 33343!:mime audio/ogg 33344# non-Vorbis content: OGM 33345>>28 string \x01video\0\0\0 \b, OGM video 33346!:mime video/ogg 33347>>>37 string/c div3 (DivX 3) 33348>>>37 string/c divx (DivX 4) 33349>>>37 string/c dx50 (DivX 5) 33350>>>37 string/c xvid (XviD) 33351# --- First vorbis packet - general header --- 33352>>28 string \x01vorbis \b, Vorbis audio, 33353!:mime audio/ogg 33354>>>35 lelong !0 UNKNOWN VERSION %u, 33355##>>>35 lelong 0 version 0, 33356>>>35 lelong 0 33357>>>>39 ubyte 1 mono, 33358>>>>39 ubyte 2 stereo, 33359>>>>39 ubyte >2 %u channels, 33360>>>>40 lelong x %u Hz 33361# Minimal, nominal and maximal bitrates specified when encoding 33362>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 33363# The above tests if at least one of these is specified: 33364>>>>>52 lelong !-1 33365# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 33366# instead of -1. 33367# Vorbis 1.0 uses 0 instead of -1. 33368>>>>>>52 lelong !0 33369>>>>>>>52 lelong !-1000 33370>>>>>>>>52 lelong x <%u 33371>>>>>48 lelong !-1 33372>>>>>>48 lelong x ~%u 33373>>>>>44 lelong !-1 33374>>>>>>44 lelong !-1000 33375>>>>>>>44 lelong !0 33376>>>>>>>>44 lelong x >%u 33377>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 33378# -- Second vorbis header packet - the comments 33379# A kludge to read the vendor string. It's a counted string, not a 33380# zero-terminated one, so file(1) can't read it in a generic way. 33381# libVorbis is the only one existing currently, so I detect specifically 33382# it. The interesting value is the cvs date (8 digits decimal). 33383# Post-RC1 Ogg files have the second header packet (and thus the version) 33384# in a different place, so we must use an indirect offset. 33385>>>(84.b+85) string \x03vorbis 33386>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 33387>>>>>(84.b+120) string >00000000 33388# Map to beta version numbers: 33389>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 33390>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 33391>>>>>>(84.b+120) string >20000508 33392>>>>>>>(84.b+120) string <20001031 (beta2-3) 33393>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 33394>>>>>>(84.b+120) string >20001031 33395>>>>>>>(84.b+120) string <20010225 (beta3-4) 33396>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 33397>>>>>>(84.b+120) string >20010225 33398>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 33399>>>>>>(84.b+120) string 20010615 (1.0 RC1) 33400>>>>>>(84.b+120) string 20010813 (1.0 RC2) 33401>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 33402>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 33403>>>>>>(84.b+120) string 20011217 (1.0 RC3) 33404>>>>>>(84.b+120) string 20011231 (1.0 RC3) 33405# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 33406>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 33407# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 33408>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 33409>>>>>(84.b+117) string >00000000 33410>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 33411>>>>>>(84.b+117) string 20020717 (1.0) 33412>>>>>>(84.b+117) string 20030909 (1.0.1) 33413>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 33414>>>>>>(84.b+117) string 20050304 (1.1.2) 33415>>>>>>(84.b+117) string 20070622 (1.2.0) 33416>>>>>>(84.b+117) string 20090624 (1.2.2) 33417>>>>>>(84.b+117) string 20090709 (1.2.3) 33418>>>>>>(84.b+117) string 20100325 (1.3.1) 33419>>>>>>(84.b+117) string 20101101 (1.3.2) 33420>>>>>>(84.b+117) string 20120203 (1.3.3) 33421>>>>>>(84.b+117) string 20140122 (1.3.4) 33422>>>>>>(84.b+117) string 20150105 (1.3.5) 33423 33424# non-Vorbis content: Opus https://tools.ietf.org/html/rfc7845#section-5 33425>>28 string OpusHead \b, Opus audio, 33426!:mime audio/ogg 33427>>>36 ubyte >0x0F UNKNOWN VERSION %u, 33428>>>36 ubyte&0x0F !0 version 0.%u, 33429>>>>46 ubyte >1 33430>>>>>46 ubyte !255 unknown channel mapping family %u, 33431>>>>>37 ubyte x %u channels 33432>>>>46 ubyte 0 33433>>>>>37 ubyte 1 mono 33434>>>>>37 ubyte 2 stereo 33435>>>>46 ubyte 1 33436>>>>>37 ubyte 1 mono 33437>>>>>37 ubyte 2 stereo 33438>>>>>37 ubyte 3 linear surround 33439>>>>>37 ubyte 4 quadraphonic 33440>>>>>37 ubyte 5 5.0 surround 33441>>>>>37 ubyte 6 5.1 surround 33442>>>>>37 ubyte 7 6.1 surround 33443>>>>>37 ubyte 8 7.1 surround 33444>>>>40 lelong !0 \b, %u Hz (Input Sample Rate) 33445#------------------------------------------------------------------------------ 33446# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 33447# VXL: file(1) magic for VXL binary IO data files 33448# 33449# from Ian Scott <scottim@sf.net> 33450# 33451# VXL is a collection of C++ libraries for Computer Vision. 33452# See the vsl chapter in the VXL Book for more info 33453# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 33454# http:/vxl.sf.net 33455 334562 lelong 0x472b2c4e VXL data file, 33457>0 leshort >0 schema version no %d 33458 33459#------------------------------------------------------------------------------ 33460# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $ 33461# warc: file(1) magic for WARC files 33462 334630 string WARC/ WARC Archive 33464>5 string x version %.4s 33465!:mime application/warc 33466 33467#------------------------------------------------------------------------------ 33468# Arc File Format from Internet Archive 33469# see https://www.archive.org/web/researcher/ArcFileFormat.php 334700 string filedesc:// Internet Archive File 33471!:mime application/x-ia-arc 33472>11 search/256 \x0A \b 33473>>&0 ubyte >0 \b version %c 33474 33475#------------------------------------------------------------------------------ 33476# weak: file(1) magic for very weak magic entries, disabled by default 33477# 33478# These entries are so weak that they might interfere identification of 33479# other formats. Example include: 33480# - Only identify for 1 or 2 bytes 33481# - Match against very wide range of values 33482# - Match against generic word in some spoken languages (e.g. English) 33483 33484# Summary: Computer Graphics Metafile 33485# Extension: .cgm 33486#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 33487#0 beshort 0x3020 character Computer Graphics Metafile 33488 33489#0 string =!! Bennet Yee's "face" format 33490 33491#------------------------------------------------------------------------------ 33492# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $ 33493 33494# http://www.rdfhdt.org/ 33495# From Christoph Biedl 33496# http://www.rdfhdt.org/hdt-internals/ 33497# https://github.com/rdfhdt/hdt-cpp 33498 334990 string $HDT\x01 HDT file (binary compressed indexed RDF triples) type 1 33500!:mime application/vnd.hdt 33501!:ext hdt 33502#------------------------------------------------------------------------------ 33503# $File: webassembly,v 1.3 2019/04/19 00:42:27 christos Exp $ 33504# webassembly: file(1) magic for WebAssembly modules 33505# 33506# WebAssembly is a virtual architecture developed by a W3C Community 33507# Group at https://webassembly.org/. The file extension is .wasm, and 33508# the MIME type is application/wasm. 33509# 33510# https://webassembly.org/docs/binary-encoding/ is the main 33511# document describing the binary format. 33512# From: Pip Cet <pipcet@gmail.com> and Joel Martin 33513 335140 string \0asm WebAssembly (wasm) binary module 33515>4 lelong =1 version %#x (MVP) 33516>4 lelong >1 version %#x 33517 33518#------------------------------------------------------------------------------ 33519# $File: windows,v 1.36 2021/02/05 22:29:07 christos Exp $ 33520# windows: file(1) magic for Microsoft Windows 33521# 33522# This file is mainly reserved for files where programs 33523# using them are run almost always on MS Windows 3.x or 33524# above, or files only used exclusively in Windows OS, 33525# where there is no better category to allocate for. 33526# For example, even though WinZIP almost run on Windows 33527# only, it is better to treat them as "archive" instead. 33528# For format usable in DOS, such as generic executable 33529# format, please specify under "msdos" file. 33530# 33531 33532 33533# Summary: Outlook Express DBX file 33534# Extension: .dbx 33535# Created by: Christophe Monniez 335360 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 33537>4 byte =0xC5 \b, message database 33538>4 byte =0xC6 \b, folder database 33539>4 byte =0xC7 \b, account information 33540>4 byte =0x30 \b, offline database 33541 33542 33543# Summary: Windows crash dump 33544# Extension: .dmp 33545# Created by: Andreas Schuster (https://computer.forensikblog.de/) 33546# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html 33547# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 335480 string PAGE 33549>4 string DUMP MS Windows 32bit crash dump 33550>>0x05c byte 0 \b, no PAE 33551>>0x05c byte 1 \b, PAE 33552>>0xf88 lelong 1 \b, full dump 33553>>0xf88 lelong 2 \b, kernel dump 33554>>0xf88 lelong 3 \b, small dump 33555>>0x068 lelong x \b, %d pages 33556>4 string DU64 MS Windows 64bit crash dump 33557>>0xf98 lelong 1 \b, full dump 33558>>0xf98 lelong 2 \b, kernel dump 33559>>0xf98 lelong 3 \b, small dump 33560>>0x090 lequad x \b, %lld pages 33561 33562 33563# Summary: Vista Event Log 33564# Extension: .evtx 33565# Created by: Andreas Schuster (https://computer.forensikblog.de/) 33566# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html 335670 string ElfFile\0 MS Windows Vista Event Log 33568>0x2a leshort x \b, %d chunks 33569>>0x10 lelong x \b (no. %d in use) 33570>0x18 lelong >1 \b, next record no. %d 33571>0x18 lelong =1 \b, empty 33572>0x78 lelong &1 \b, DIRTY 33573>0x78 lelong &2 \b, FULL 33574 33575# Summary: Windows System Deployment Image 33576# Created by: Joerg Jenderek 33577# URL: http://en.wikipedia.org/wiki/System_Deployment_Image 33578# Reference: http://skolk.livejournal.com/1320.html 335790 string $SDI 33580>4 string 0001 System Deployment Image 33581!:mime application/x-ms-sdi 33582#!:mime application/octet-stream 33583# \Boot\boot.sdi 33584!:ext sdi 33585# MDBtype: 0~Unspecified 1~RAM 2~ROM 33586>>8 ulequad !0 \b, MDBtype 0x%llx 33587# BootCodeOffset 33588>>16 ulequad !0 \b, BootCodeOffset 0x%llx 33589# BootCodeSize 33590>>24 ulequad !0 \b, BootCodeSize 0x%llx 33591# VendorID 33592>>32 ulequad !0 \b, VendorID 0x%llx 33593# DeviceID 33594>>40 ulequad !0 \b, DeviceID 0x%llx 33595# DeviceModel 33596>>48 ulequad !0 \b, DeviceModel 0x%llx 33597>>>56 ulequad !0 \b%llx 33598# DeviceRole 33599>>64 ulequad !0 \b, DeviceRole 0x%llx 33600# Reserved1; reserved fields and gaps between BLOBs are padded with \0 33601#>>72 ulequad !0 \b, Reserved1 0x%llx 33602# RuntimeGUID 33603>>80 ulequad !0 \b, RuntimeGUID 0x%llx 33604>>>88 ulequad !0 \b%llx 33605# RuntimeOEMrev 33606>>96 ulequad !0 \b, RuntimeOEMrev 0x%llx 33607# Reserved2 33608#>>104 ulequad !0 \b, Reserved2 0x%llx 33609# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 33610>>112 ulequad !0 \b, PageAlignment %llu 33611# Reserved3[48] 33612#>>120 ulequad !0 \b, Reserved3 0x%llx 33613# SDI checksum 39h 33614>>0x1f8 ulequad x \b, checksum 0x%llx 33615# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 33616>>0x400 string >\0 \b, type %-3.8s 33617# 0~non-filesystem 7~NTFS 6~BIGFAT 33618>>>0x420 ulequad !0 (0x%llx) 33619# ATTRibutes 33620>>>0x408 ulequad !0 0x%llx attributes 33621# Offset 33622>>>0x410 ulequad x at 0x%llx 33623# print 1 space after size and then handles NTFS boot sector by ./filesystems 33624>>>0x418 ulequad >0 %llu bytes 33625>>>>(0x410.l) indirect x 33626# 2nd BLOB: WIM 33627>>0x440 string >\0 \b, type %-3.8s 33628>>>0x428 ulequad !0 (0x%llx) 33629# ATTRibutes 33630>>>0x448 ulequad !0 0x%llx attributes 33631# Offset 33632>>>0x450 ulequad x at 0x%llx 33633>>>0x458 ulequad >0 %llu bytes 33634>>>>(0x450.l) indirect x 33635# 3rd BLOB 33636>>0x480 string >\0 \b, type %-3.8s 33637 33638# Summary: Windows boot status log BOOTSTAT.DAT 33639# From: Joerg Jenderek 33640# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 33641# Note: mainly refers to older Windows Vista, sometimes 33642# BOOTSTAT.DAT only contains nulls or invalid data 33643# checking for valid version below 5 336440 ulelong <5 33645# skip many ISO images by checking for valid 64 KiB file size 33646>8 ulelong =0x00010000 33647>>0 use bootstat-dat 33648# display information of BOOTSTAT.DAT 336490 name bootstat-dat 33650>0 ulelong x Windows boot log 33651#!:mime application/octet-stream 33652!:mime application/x-ms-dat 33653# BOOTSTAT.DAT in BOOT subdirectory 33654!:ext dat 33655# apparently a version number: 2 for older like Vista, 3, 4 Windows 10 33656>0 ulelong >2 \b, version %u 33657# apparently the size of the header: often 10h in older Windows, 14h, 18h 33658>4 ulelong !0x10 \b, header size 0x%x 33659#>4 ulelong !0x10 \b, header size %u 33660# apparently the size of the file: always 0x00010000~64KiB 33661# the file is acceptable to BOOTMGR only if it is exactly 64 KiB 33662>8 ulelong !0x00010000 \b, file size 0x%x 33663# size of valid data, in bytes: C8h 50h 172h 5D5Ch 33664>0xc ulelong x \b, 0x%x valid bytes 33665# skip header and jump to first bootstat entry and display information 33666>(0x4.l-1) ubyte x 33667>>&0 use bootstat-entry 33668# jump to first entry again because pointer are bad after "use" 33669>(0x4.l-1) ubyte x 33670# by 1st entry size jump to 2nd entry and display information 33671>>&(&0x18.l-1) ubyte x 33672>>>&0 use bootstat-entry 33673# jump to possible 3rd boot entry and display information 33674# >(0x4.l-1) ubyte x 33675# >>&(&0x18.l-1) ubyte x 33676# >>>&(&0x18.l-1) ubyte x 33677# >>>>&0 use bootstat-entry 33678# display BOOTSTAT.DAT entry 336790 name bootstat-entry 33680#>0x00 ubequad x \b, ENTRY %16.16llx 33681# size of entry, in bytes: 40h(init) 78h(launced) 9Ch 33682#>0x18 ulelong x \b; entry size %u 33683>0x18 ulelong x \b; entry size 0x%x 33684# time stamp, in seconds 33685>0x00 ulelong x \b, 0x%x seconds 33686# always zero, significance unknown 33687>0x04 ulelong !0 \b, not null %u 33688# GUID of event source; but empty if event source is BOOTMGR 33689>0x08 ubequad !0 \b, GUID 0x%16.16llx 33690>>0x10 ubequad x \b%16.16llx 33691# severity code: 1~informational 3~errors 33692>0x1C ulelong !1 \b, severity 0x%x 33693# apparently a version number: 2 33694>0x20 ulelong !2 \b, version %u 33695# event identifier 1~log file initialised 11h~boot application launched 33696#>0x24 ulelong x \b, event 0x%x 33697>0x24 ulelong !1 33698>>0x24 ulelong !0x11 \b, event 0x%x 33699# entry data; size depends on event identifier 33700#>0x28 ubequad x \b, data 0x%16.16llx 33701>0x24 ulelong =0x1 \b, Init 33702# always 0, significance unknown 33703>>0x34 uleshort !0 \b, not null %u 33704# always 7, significance unknown 33705>>0x36 uleshort !7 \b, not seven %u 33706# year 33707>>0x28 uleshort x %u 33708# month 33709>>0x2A uleshort x \b-%u 33710# day 33711>>0x2C uleshort x \b-%u 33712# hour 33713>>0x2E uleshort x %u 33714# minute 33715>>0x30 uleshort x \b:%u 33716# second 33717>>0x32 uleshort x \b:%u 33718# boot application launched 33719>0x24 ulelong =0x11 \b, launched 33720# type of start: 0 normally, 1 or 2 maybe in a recovery sequence 33721>>0x38 uleshort !0 \b, type %u 33722# pathname of boot application, as null-terminated Unicode string; typically 33723# \Windows\system32\winload.exe \Windows\system32\winload.efi 33724>>0x3C lestring16 x %s 33725 33726# Summary: Windows Error Report text files 33727# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 33728# Reference: https://www.nirsoft.net/utils/app_crash_view.html 33729# Created by: Joerg Jenderek 33730# Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 33731# %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 337320 lestring16 Version= 33733>22 lestring16 EventType Windows Error Report 33734!:mime text/plain 33735# Report.wer 33736!:ext wer 33737 33738# Summary: Windows 3.1 group files 33739# Extension: .grp 33740# Created by: unknown 337410 string \120\115\103\103 MS Windows 3.1 group files 33742 33743 33744# Summary: Old format help files 33745# URL: https://en.wikipedia.org/wiki/WinHelp 33746# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 33747# Update: Joerg Jenderek 33748# Created by: Dirk Jagdmann <doj@cubic.org> 33749# 33750# check and then display version and date inside MS Windows HeLP file fragment 337510 name help-ver-date 33752# look for Magic of SYSTEMHEADER 33753>0 leshort 0x036C 33754# version Major 1 for right file fragment 33755>>4 leshort 1 Windows 33756# print non empty string above to avoid error message 33757# Warning: Current entry does not yet have a description for adding a MIME type 33758!:mime application/winhelp 33759!:ext hlp 33760# version Minor of help file format is hint for windows version 33761>>>2 leshort 0x0F 3.x 33762>>>2 leshort 0x15 3.0 33763>>>2 leshort 0x21 3.1 33764>>>2 leshort 0x27 x.y 33765>>>2 leshort 0x33 95 33766>>>2 default x y.z 33767>>>>2 leshort x 0x%x 33768# to complete message string like "MS Windows 3.x help file" 33769>>>2 leshort x help 33770# GenDate often older than file creation date 33771>>>6 ldate x \b, %s 33772# 33773# Magic for HeLP files 337740 lelong 0x00035f3f 33775# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 33776# file header magic 0x293B at DirectoryStart+9 33777>(4.l+9) uleshort 0x293B MS 33778# look for @VERSION bmf.. like IBMAVW.ANN 33779>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 33780!:mime application/x-winhelp 33781!:ext ann 33782>>0xD4 string !\x62\x6D\x66\x01\x00 33783# "GID Help index" by TrID 33784>>>(4.l+0x65) string =|Pete Windows help Global Index 33785!:mime application/x-winhelp 33786!:ext gid 33787# HeLP Bookmark or 33788# "Windows HELP File" by TrID 33789>>>(4.l+0x65) string !|Pete 33790# maybe there exist a cleaner way to detect HeLP fragments 33791# brute search for Magic 0x036C with matching Major maximal 7 iterations 33792# discapp.hlp 33793>>>>16 search/0x49AF/s \x6c\x03 33794>>>>>&0 use help-ver-date 33795>>>>>&4 leshort !1 33796# putty.hlp 33797>>>>>>&0 search/0x69AF/s \x6c\x03 33798>>>>>>>&0 use help-ver-date 33799>>>>>>>&4 leshort !1 33800>>>>>>>>&0 search/0x49AF/s \x6c\x03 33801>>>>>>>>>&0 use help-ver-date 33802>>>>>>>>>&4 leshort !1 33803>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33804>>>>>>>>>>>&0 use help-ver-date 33805>>>>>>>>>>>&4 leshort !1 33806>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33807>>>>>>>>>>>>>&0 use help-ver-date 33808>>>>>>>>>>>>>&4 leshort !1 33809>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33810>>>>>>>>>>>>>>>&0 use help-ver-date 33811>>>>>>>>>>>>>>>&4 leshort !1 33812>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 33813# GCC.HLP is detected after 7 iterations 33814>>>>>>>>>>>>>>>>>&0 use help-ver-date 33815# this only happens if bigger hlp file is detected after used search iterations 33816>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 33817!:mime application/winhelp 33818!:ext hlp 33819# repeat search again or following default line does not work 33820>>>>16 search/0x49AF/s \x6c\x03 33821# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 33822>>>>16 default x Windows help Bookmark 33823!:mime application/x-winhelp 33824!:ext bmk 33825## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 33826##>>8 lelong x \b, FirstFreeBlock 0x%8.8x 33827# EntireFileSize 33828>>12 lelong x \b, %d bytes 33829## ReservedSpace normally 042Fh AFh for *.ANN 33830#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x 33831## UsedSpace normally 0426h A6h for *.ANN 33832#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x 33833## FileFlags normally 04... 33834#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x 33835## file header magic 0x293B 33836#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x 33837## file header Flags 0x0402 33838#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x 33839## file header PageSize 0400h 80h for *.ANN 33840#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x 33841## Structure[16] z4 33842#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 33843## MustBeZero 0 33844#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x 33845## PageSplits 33846#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x 33847## RootPage 33848#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x 33849## MustBeNegOne 0xffff 33850#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x 33851## TotalPages 1 33852#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x 33853## NLevels 0x0001 33854#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x 33855## TotalBtreeEntries 33856#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x 33857## pages of the B+ tree 33858#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx 33859 33860# start with colon or semicolon for comment line like Back2Life.cnt 338610 regex \^(:|;) 33862# look for first keyword Base 33863>0 search/45 :Base 33864>>&0 use cnt-name 33865# only solution to search again from beginning , because relative offsets changes when use is called 33866>0 search/45 :Base 33867>0 default x 33868# look for other keyword Title like in putty.cnt 33869>>0 search/45 :Title 33870>>>&0 use cnt-name 33871# 33872# display mime type and name of Windows help Content source 338730 name cnt-name 33874# skip space at beginning 33875>0 string \040 33876# name without extension and greater character or name with hlp extension 33877>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s" 33878!:mime text/plain 33879!:apple ????TEXT 33880!:ext cnt 33881# 33882# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 338830 string tfMR MS Windows help Full Text Search index 33884!:mime application/x-winhelp-fts 33885!:ext fts 33886>16 string >\0 for "%s" 33887 33888# Summary: Hyper terminal 33889# Extension: .ht 33890# Created by: unknown 338910 string HyperTerminal\040 33892>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 33893 33894# https://ithreats.files.wordpress.com/2009/05/\040 33895# lnk_the_windows_shortcut_file_format.pdf 33896# Summary: Windows shortcut 33897# Extension: .lnk 33898# Created by: unknown 33899# 'L' + GUUID 339000 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 33901>20 lelong&1 1 \b, Item id list present 33902>20 lelong&2 2 \b, Points to a file or directory 33903>20 lelong&4 4 \b, Has Description string 33904>20 lelong&8 8 \b, Has Relative path 33905>20 lelong&16 16 \b, Has Working directory 33906>20 lelong&32 32 \b, Has command line arguments 33907>20 lelong&64 64 \b, Icon 33908>>56 lelong x \b number=%d 33909>24 lelong&1 1 \b, Read-Only 33910>24 lelong&2 2 \b, Hidden 33911>24 lelong&4 4 \b, System 33912>24 lelong&8 8 \b, Volume Label 33913>24 lelong&16 16 \b, Directory 33914>24 lelong&32 32 \b, Archive 33915>24 lelong&64 64 \b, Encrypted 33916>24 lelong&128 128 \b, Normal 33917>24 lelong&256 256 \b, Temporary 33918>24 lelong&512 512 \b, Sparse 33919>24 lelong&1024 1024 \b, Reparse point 33920>24 lelong&2048 2048 \b, Compressed 33921>24 lelong&4096 4096 \b, Offline 33922>28 leqwdate x \b, ctime=%s 33923>36 leqwdate x \b, mtime=%s 33924>44 leqwdate x \b, atime=%s 33925>52 lelong x \b, length=%u, window= 33926>60 lelong&1 1 \bhide 33927>60 lelong&2 2 \bnormal 33928>60 lelong&4 4 \bshowminimized 33929>60 lelong&8 8 \bshowmaximized 33930>60 lelong&16 16 \bshownoactivate 33931>60 lelong&32 32 \bminimize 33932>60 lelong&64 64 \bshowminnoactive 33933>60 lelong&128 128 \bshowna 33934>60 lelong&256 256 \brestore 33935>60 lelong&512 512 \bshowdefault 33936#>20 lelong&1 0 33937#>>20 lelong&2 2 33938#>>>(72.l-64) pstring/h x \b [%s] 33939#>20 lelong&1 1 33940#>>20 lelong&2 2 33941#>>>(72.s) leshort x 33942#>>>&75 pstring/h x \b [%s] 33943 33944# Summary: Outlook Personal Folders 33945# Created by: unknown 339460 lelong 0x4E444221 Microsoft Outlook email folder 33947>10 leshort 0x0e (<=2002) 33948>10 leshort 0x17 (>=2003) 33949 33950 33951# Summary: Windows help cache 33952# Created by: unknown 339530 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 33954 33955 33956# Summary: IE cache file 33957# Created by: Christophe Monniez 339580 string Client\ UrlCache\ MMF Internet Explorer cache file 33959>20 string >\0 version %s 33960 33961 33962# Summary: Registry files 33963# Created by: unknown 33964# Modified by (1): Joerg Jenderek 339650 string regf MS Windows registry file, NT/2000 or above 339660 string CREG MS Windows 95/98/ME registry file 339670 string SHCC3 MS Windows 3.1 registry file 33968 33969 33970# Summary: Windows Registry text 33971# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 33972# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 33973# Submitted by: Abel Cheung <abelcheung@gmail.com> 33974# Update: Joerg Jenderek 33975# Windows 3-9X variant 339760 string REGEDIT 33977# skip ASCII text like "REGEDITor.txt" but match 33978# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 33979>7 search/3 \n Windows Registry text 33980!:mime text/x-ms-regedit 33981!:ext reg 33982# Windows 9X variant 33983>>0 string REGEDIT4 (Win95 or above) 33984# Windows 2K ANSI variant 339850 string Windows\ Registry\ Editor\ 33986>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 33987!:mime text/x-ms-regedit 33988!:ext reg 33989# Windows 2K UTF-16 variant 339902 lestring16 Windows\ Registry\ Editor\ 33991>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 33992# relative offset not working 33993#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 33994!:mime text/x-ms-regedit 33995!:ext reg 33996# WINE variant 33997# URL: https://en.wikipedia.org/wiki/Wine_(software) 33998# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 33999# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 34000# instead binary hiv structure like Windows 340010 string WINE\ REGISTRY\ Version\ WINE registry text 34002# version 2 34003>&0 string x \b, version %s 34004!:mime text/x-wine-extension-reg 34005!:ext reg 34006 34007# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 34008# empty ,comment , section 34009# PR/383: remove unicode BOM because it is not portable across regex impls 34010#0 regex/s \\`(\\r\\n|;|[[]) 34011# empty line CRLF 340120 ubeshort 0x0D0A 34013>0 use ini-file 34014# comment line 340150 string ; 34016>0 use ini-file 34017# section line 340180 string [ 34019>0 use ini-file 34020# check and then display Windows INItialization configuration 340210 name ini-file 34022# look for left bracket in section line 34023>0 search/8192 [ 34024# https://en.wikipedia.org/wiki/Autorun.inf 34025# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 34026# space after right bracket 34027# or AutoRun.Amd64 for 64 bit systems 34028# or only NL separator 34029>>&0 regex/c \^(autorun) 34030# but sometimes total commander directory tree file "treeinfo.wc" with lines like 34031# [AUTORUN] 34032# [boot] 34033>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 34034!:mime text/plain 34035!:ext wc 34036# From: Pal Tamas <folti@balabit.hu> 34037# Autorun File 34038>>>&0 string !]\r\n[ Microsoft Windows Autorun file 34039!:mime application/x-setupscript 34040!:ext inf 34041# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 34042# version strings ASCII coded case-independent for Windows setup information script file 34043>>&0 regex/c \^(version|strings)] Windows setup INFormation 34044!:mime application/x-setupscript 34045#!:mime application/x-wine-extension-inf 34046!:ext inf 34047# NETCRC.INF OEMCPL.INF 34048>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 34049!:mime application/x-setupscript 34050!:ext inf 34051# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 34052# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 34053# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 34054>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 34055!:mime application/x-wine-extension-ini 34056#!:mime text/plain 34057# https://support.microsoft.com/kb/84709/ 34058>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 34059!:mime application/x-wine-extension-ini 34060!:ext ini 34061>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 34062!:mime application/x-wine-extension-ini 34063!:ext ini 34064# https://technet.microsoft.com/en-us/library/cc722567.aspx 34065# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 34066>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 34067!:mime application/x-wine-extension-ini 34068!:ext ini 34069# https://en.wikipedia.org/wiki/SYSTEM.INI 34070>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 34071!:mime application/x-wine-extension-ini 34072!:ext ini 34073# http://www.mdgx.com/newtip6.htm 34074>>&0 regex/c \^(SafeList)] Windows IOS.INI 34075!:mime application/x-wine-extension-ini 34076!:ext ini 34077# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 34078>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 34079!:mime application/x-wine-extension-ini 34080!:ext ini 34081# https://en.wikipedia.org/wiki/CONFIG.SYS 34082>>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS 34083# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 34084# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 34085# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 34086# dos and w40 used in dual booting scene 34087!:ext sys/dos/w40 34088# https://support.microsoft.com/kb/118579/ 34089>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 34090!:ext sys/dos 34091# http://chmspec.nongnu.org/latest/INI.html#HHP 34092>>&0 regex/c \^(options)]\r\n Microsoft HTML Help Project 34093!:mime text/plain 34094!:ext hhp 34095# From: Joerg Jenderek 34096# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/obdcdriv_character_translation.htm 34097# Reference: https://www.garykessler.net/library/file_sigs.html 34098# Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system 34099>>&0 regex/c \^(Windows\ Latin) Windows codepage translator 34100!:mime text/plain 34101!:ext cpx 34102# unknown keyword after opening bracket 34103>>&0 default x 34104#>>>&0 string/c x UNKNOWN [%s 34105# look for left bracket of second section 34106>>>&0 search/8192 [ 34107# version Strings FileIdentification 34108>>>>&0 string/c version Windows setup INFormation 34109!:mime application/x-setupscript 34110!:ext inf 34111# https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 34112>>>>&0 default x 34113>>>>>&0 ubyte x 34114# characters, digits, underscore and white space followed by right bracket 34115# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 34116>>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 34117# NETDEF.INF multiarc.ini 34118#!:mime application/x-setupscript 34119!:mime application/x-wine-extension-ini 34120#!:mime text/plain 34121!:ext ini/inf 34122# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 341230 ubelong&0xFFff89FF =0xFFFE0900 34124# look for left bracket in section line 34125>2 search/8192 [ 34126# keyword without 1st letter which is maybe up-/down-case 34127>>&3 lestring16 ersion] Windows setup INFormation 34128!:mime application/x-setupscript 34129!:ext inf 34130>>&3 lestring16 trings] Windows setup INFormation 34131!:mime application/x-setupscript 34132!:ext inf 34133>>&3 lestring16 ourceDisksNames] Windows setup INFormation 34134!:mime application/x-setupscript 34135!:ext inf 34136# netnwcli.inf start with ;---[ NetNWCli.INX ] 34137>>&3 default x 34138# look for NL followed by left bracket 34139>>>&0 search/8192 \x0A\x00\x5b 34140>>>>&3 lestring16 ersion] Windows setup INFormation 34141!:mime application/x-setupscript 34142!:ext inf 34143 34144# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 34145# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 34146# URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 34147# Reference: http://en.verysource.com/code/10350344_1/inf.h.html 34148# Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 34149# check for valid major and minor versions: 101h - 303h 341500 leshort&0xFcFc =0x0000 34151# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 34152>0 leshort&0x0303 !0x0000 34153# test for valid InfStyles: 1 2 34154>>2 uleshort >0 34155>>>2 uleshort <3 34156# look for colon in WinDirPath after PNF header 34157#>>>>0x59 search/18 : 34158>>>>0 use PreCompiledInf 341590 name PreCompiledInf 34160>0 uleshort x Windows Precompiled iNF 34161!:mime application/x-pnf 34162!:ext pnf 34163# major version 1 for older Windows like XP and 3 since about Windows Vista 34164# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362 34165>1 ubyte x \b, version %u 34166>0 ubyte x \b.%u 34167>0 uleshort =0x0101 (Windows 34168>>4 ulelong&0x00000001 !0x00000001 98) 34169>>4 ulelong&0x00000001 =0x00000001 XP) 34170>0 uleshort =0x0301 (Windows Vista-8.1) 34171>0 uleshort =0x0302 (Windows 10 older) 34172>0 uleshort =0x0303 (Windows 10) 34173# 1 ,2 (windows 98 SE) 34174>2 uleshort !2 \b, InfStyle %u 34175# PNF_FLAG_IS_UNICODE 0x00000001 34176# PNF_FLAG_HAS_STRINGS 0x00000002 34177# PNF_FLAG_SRCPATH_IS_URL 0x00000004 34178# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 34179# PNF_FLAG_INF_VERIFIED 0x00000010 34180# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 34181# UNKNOWN8 0x00000080 34182# UNKNOWN 0x00000100 34183# UNKNOWN1 0x01000000 34184# UNKNOWN2 0x02000000 34185>4 ulelong&0x03000180 >0 \b, flags 34186>>4 ulelong x 0x%x 34187>4 ulelong&0x00000001 0x00000001 \b, unicoded 34188>4 ulelong&0x00000002 0x00000002 \b, has strings 34189>4 ulelong&0x00000004 0x00000004 \b, src URL 34190>4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 34191>4 ulelong&0x00000010 0x00000010 \b, verified 34192>4 ulelong&0x00000020 0x00000020 \b, digitally signed 34193# >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 34194# >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 34195# >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 34196# >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 34197#>8 ulelong x \b, InfSubstValueListOffset 0x%x 34198# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 34199# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 34200#>12 uleshort x \b, InfSubstValueCount 0x%x 34201# only < 9 found: 8 hcw85b64.PNF 34202#>14 uleshort x \b, InfVersionDatumCount 0x%x 34203# only found values lower 0x0000ffff ?? 34204#>16 ulelong x \b, InfVersionDataSize 0x%x 34205# only found positive values lower 0x00ffFFff for InfVersionDataOffset 34206>20 ulelong x \b, at 0x%x 34207>4 ulelong&0x00000001 =0x00000001 34208# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 34209>>(20.l) lestring16 x "%s" 34210>4 ulelong&0x00000001 !0x00000001 34211>>(20.l) string x "%s" 34212# FILETIME is number of 100-nanosecond intervals since 1 January 1601 34213#>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 34214#>24 foodate-0xbar x \b, InfVersionLastWriteTime %s 34215# for Windows 98, XP 34216>0 uleshort <0x0102 34217# only found values lower 0x00ffFFff 34218# often 70 but also 78h for corelist.PNF 34219# >>32 ulelong x \b, StringTableBlockOffset 0x%x 34220# >>36 ulelong x \b, StringTableBlockSize 0x%x 34221# >>40 ulelong x \b, InfSectionCount 0x%x 34222# >>44 ulelong x \b, InfSectionBlockOffset 0x%x 34223# >>48 ulelong x \b, InfSectionBlockSize 0x%x 34224# >>52 ulelong x \b, InfLineBlockOffset 0x%x 34225# >>56 ulelong x \b, InfLineBlockSize 0x%x 34226# >>60 ulelong x \b, InfValueBlockOffset 0x%x 34227# >>64 ulelong x \b, InfValueBlockSize 0x%x 34228# WinDirPathOffset 34229# like 58h, which means direct after PNF header 34230#>>68 ulelong x \b, at 0x%x 34231>>68 ulelong x 34232>>>4 ulelong&0x00000001 =0x00000001 34233#>>>>(68.l) ubequad =0x43003a005c005700 34234# normally unicoded C:\Windows 34235#>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 34236>>>>(68.l) ubequad !0x43003a005c005700 34237>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 34238>>>4 ulelong&0x00000001 !0x00000001 34239# normally ASCII C:\WINDOWS 34240#>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 34241>>>>(68.l) string !C:\\WINDOWS 34242>>>>>(68.l) string x \b, WinDirPath "%s" 34243# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 34244>>>72 ulelong >0 \b, 34245>>>>4 ulelong&0x00000001 =0x00000001 34246>>>>>(72.l) lestring16 x OsLoaderPath "%s" 34247>>>>4 ulelong&0x00000001 !0x00000001 34248# seldom C:\ instead empty 34249>>>>>(72.l) string x OsLoaderPath "%s" 34250# 1fdh 34251#>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 34252# only 407h found 34253>>>78 uleshort !0x409 \b, LanguageID %x 34254#>>>78 uleshort =0x409 \b, LanguageID %x 34255# InfSourcePathOffset often 0 34256>>>80 ulelong >0 \b, at 0x%x 34257>>>>4 ulelong&0x00000001 =0x00000001 34258>>>>>(80.l) lestring16 x SourcePath "%s" 34259>>>>4 ulelong&0x00000001 !0x00000001 34260>>>>>(80.l) string >\0 SourcePath "%s" 34261# OriginalInfNameOffset often 0 34262>>>84 ulelong >0 \b, at 0x%x 34263>>>>4 ulelong&0x00000001 =0x00000001 34264>>>>>(84.l) lestring16 x InfName "%s" 34265>>>>4 ulelong&0x00000001 !0x00000001 34266>>>>>(84.l) string >\0 InfName "%s" 34267 34268# for newer Windows like Vista, 7 , 8.1 , 10 34269>0 uleshort >0x0101 34270>>80 ulelong x \b, at 0x%x WinDirPath 34271>>>4 ulelong&0x00000001 0x00000001 34272# normally unicoded C:\Windows 34273#>>>>(80.l) ubequad =0x43003a005c005700 34274#>>>>>(80.l) lestring16 x "%s" 34275>>>>(80.l) ubequad !0x43003a005c005700 34276>>>>>(80.l) lestring16 x "%s" 34277# language id: 0 407h~german 409h~English_US 34278>>90 uleshort !0x409 \b, LanguageID %x 34279#>>90 uleshort =0x409 \b, LanguageID %x 34280>>92 ulelong >0 \b, at 0x%x 34281>>>4 ulelong&0x00000001 0x00000001 34282# language string like: de-DE en-US 34283>>>>(92.l) lestring16 x language %s 34284 34285# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 34286# Extension: .bkf 34287# Created by: Joerg Jenderek 34288# URL: https://en.wikipedia.org/wiki/NTBackup 34289# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 34290# Descriptor BloCK name of Microsoft Tape Format 342910 string TAPE 34292# Format Logical Address is zero 34293>20 ulequad 0 34294# Reserved for MBC is zero 34295>>28 uleshort 0 34296# Control Block ID is zero 34297>>>36 ulelong 0 34298# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 34299>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 34300#!:mime application/x-ntbackup 34301!:ext bkf 34302# OS ID 34303>>>>>10 ubyte 1 \b NetWare 34304>>>>>10 ubyte 13 \b NetWare SMS 34305>>>>>10 ubyte 14 \b NT 34306>>>>>10 ubyte 24 \b 3 34307>>>>>10 ubyte 25 \b OS/2 34308>>>>>10 ubyte 26 \b 95 34309>>>>>10 ubyte 27 \b Macintosh 34310>>>>>10 ubyte 28 \b UNIX 34311# OS Version (2) 34312#>>>>>11 ubyte x OS V=%x 34313# MTF_CONTINUATION Media Sequence Number > 1 34314#>>>>>4 ulelong&0x00000001 !0 \b, continued 34315# MTF_COMPRESSION 34316>>>>>4 ulelong&0x00000004 !0 \b, compressed 34317# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 34318>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 34319>>>>>4 ulelong&0x00020000 0 34320# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 34321>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 34322# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 34323>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 34324# Offset To First Event 238h,240h,28Ch 34325#>>>>>8 uleshort x \b, event offset %4.4x 34326# Displayable Size (20e0230h 20e024ch 20e0224h) 34327#>>>>>8 ulequad x dis. size %16.16llx 34328# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 34329#>>>>>52 ulelong x family ID %8.8x 34330# TAPE Attributes (3) 34331#>>>>>56 ulelong x TAPE %8.8x 34332# Media Sequence Number 34333>>>>>60 uleshort >1 \b, sequence %u 34334# Password Encryption Algorithm (3) 34335>>>>>62 uleshort >0 \b, 0x%x encrypted 34336# Soft Filemark Block Size * 512 (2) 34337#>>>>>64 uleshort =2 \b, soft size %u*512 34338>>>>>64 uleshort !2 \b, soft size %u*512 34339# Media Based Catalog Type (1,2) 34340#>>>>>66 uleshort x \b, catalog type %4.4x 34341# size of Media Name (66,68,6Eh) 34342>>>>>68 uleshort >0 34343# offset of Media Name (5Eh) 34344>>>>>>70 uleshort >0 34345# 0~, 1~ANSI, 2~UNICODE 34346>>>>>>>48 ubyte 1 34347# size terminated ansi coded string normally followed by "MTF Media Label" 34348>>>>>>>>(70.s) string >\0 \b, name: %s 34349>>>>>>>48 ubyte 2 34350# Not null, but size terminated unicoded string 34351>>>>>>>>(70.s) lestring16 x \b, name: %s 34352# size of Media Label (104h) 34353>>>>>72 uleshort >0 34354# offset of Media Label (C4h,C6h,CCh) 34355>>>>>74 uleshort >0 34356>>>>>>48 ubyte 1 34357#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 34358>>>>>>>(74.s) string >\0 \b, label: %s 34359>>>>>>48 ubyte 2 34360>>>>>>>(74.s) lestring16 x \b, label: %s 34361# size of password name (0,1Ch) 34362#>>>>>76 uleshort >0 \b, password size %4.4x 34363# Software Vendor ID (CBEh) 34364>>>>>86 uleshort x \b, software (0x%x) 34365# size of Software Name (6Eh) 34366>>>>>80 uleshort >0 34367# offset of Software Name (1C8h,1CAh,1D0h) 34368>>>>>>82 uleshort >0 34369# 1~ANSI, 2~UNICODE 34370>>>>>>>48 ubyte 1 34371>>>>>>>>(82.s) string >\0 \b: %s 34372>>>>>>>48 ubyte 2 34373# size terminated unicoded coded string normally followed by "SPAD" 34374>>>>>>>>(82.s) lestring16 x \b: %s 34375# Format Logical Block Size (512,1024) 34376#>>>>>84 uleshort =1024 \b, block size %u 34377>>>>>84 uleshort !1024 \b, block size %u 34378# Media Date of MTF_DATE_TIME type with 5 bytes 34379#>>>>>>88 ubequad x DATE %16.16llx 34380# MTF Major Version (1) 34381#>>>>>>93 ubyte x \b, MFT version %x 34382# 34383 34384# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 34385# Reference: https://www.cryer.co.uk/file-types/p/pal.htm 34386# Created by: Joerg Jenderek 34387# Note: there exist other color palette formats also with .pal extension 343880 string JASC-PAL\r\n PaintShop Pro color palette 34389#!:mime text/plain 34390# PspPalette extension is used by newer (probably 8) PaintShopPro versions 34391!:ext pal/PspPalette 34392# 2nd line contains palette file version. For example "0100" 34393>10 string !0100 \b, version %.4s 34394# third line contains the number of colours: 16 256 ... 34395>16 string x \b, %.3s colors 34396 34397# URL: https://en.wikipedia.org/wiki/Innosetup 34398# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 34399# Created by: Joerg Jenderek 34400# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 34401# TrID labeles the entry as "Inno Setup Uninstall Log" 34402# TUninstallLogID 344030 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 34404!:mime application/x-innosetup 34405# unins000.dat, unins001.dat, ... 34406!:ext dat 34407# " 64-bit" variant 34408>0x1c string >\0 \b%.7s 34409# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 34410>0xc0 string x %s 34411# AppId[0x80] is similar to AppName or 34412# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 34413>0x40 ubyte 0x7b 34414>>0x40 string x %-.38s 34415# do not know how this log version correlates to program version 34416>0x140 ulelong x \b, version 0x%x 34417# NumRecs 34418#>0x144 ulelong x \b, 0x%4.4x records 34419# EndOffset means files size 34420>0x148 ulelong x \b, %u bytes 34421# Flags 5 25h 35h 34422#>0x14c ulelong x \b, flags %8.8x 34423# Reserved: array[0..26] of Longint 34424# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 34425>0x140 ulelong <1000 34426# hostname 34427>>0x1d6 pstring x \b, %s 34428# user name 34429>>>&0 pstring x \b\%s 34430# directory like C:\Program Files (x86)\GnuWin32 34431>>>>&0 pstring x \b, "%s" 34432# version 1000 or higher implies unicode 34433>0x140 ulelong >999 34434# hostname 34435>>0x1db lestring16 x \b, %-.9s 34436# utf string variant with prepending fe??ffFFff 34437>>0x1db search/43 \xFF\xFF\xFF 34438# user name 34439>>>&0 lestring16 x \b\%-.9s 34440>>>&0 search/43 \xFF\xFF\xFF 34441# directory like C:\Program Files\GIMP 2 34442>>>>&0 lestring16 x \b, %-.42s 34443 34444# URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller 34445# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas 34446# From: Joerg Jenderek 344470 string Inno\ Setup\ Messages\ ( 34448# null padded til 0x40 boundary 34449>0x38 quad 0 InnoSetup messages 34450!:mime application/x-innosetup-msg 34451# unins000.msg, unins001.msg, ... 34452!:ext msg 34453# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0 34454>>0x15 string x \b, version %.5s 34455# look for 6th char of version string or terminating right parentheses 34456>>>0x1a ubyte !0x29 \b%c 34457# NumMessages 34458>>0x40 ulelong x \b, %u messages 34459# TotalSize: Cardinal; 34460#>>0x44 ulelong x \b, TotalSize %u 34461# NotTotalSize: Cardinal; 34462#>>0x48 ulelong x \b, NotTotalSize %u 34463# CRCMessages: Longint; 34464#>>0x4C ulelong x \b, CRC 0x%x 34465>>0x40 ulelong x 34466# (u) after version means unicoded messages 34467>>>0x1c search/2 (u) (UTF-16), 34468>>>>0x50 lestring16 x %s 34469# ASCII coded message 34470>>>0x1c default x (ASCII), 34471>>>>0x50 string x %s 34472 34473# Windows Imaging (WIM) Image 34474# Update: Joerg Jenderek at Mar 2019, 2021 34475# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 34476# http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format 34477# Reference: https://download.microsoft.com/download/f/e/f/ 34478# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 34479# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 344800 string MSWIM\000\000\000 34481>0 use wim-archive 34482# https://wimlib.net/man1/wimoptimize.html 344830 string WLPWM\000\000\000 34484>0 use wim-archive 344850 name wim-archive 34486# _WIMHEADER_V1_PACKED ImageTag[8] 34487>0 string x Windows imaging 34488!:mime application/x-ms-wim 34489# TO avoid in file version 5.36 error like 34490# Magdir/windows, 760: Warning: Current entry does not yet have a description 34491# file: could not find any valid magic files! (No error) 34492# split WIM 34493>16 ulelong &0x00000008 (SWM 34494!:ext swm 34495# usPartNumber; 1, unless the file was split into multiple parts 34496>>40 uleshort x \b %u 34497# usTotalParts; The total number of WIM file parts in a spanned set 34498>>42 uleshort x \b of %u) image 34499# non split WIM 34500>16 ulelong ^0x00000008 34501# https://wimlib.net/man1/wimmount.html 34502# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 34503>>12 ulelong 3584 (ESD) image 34504!:ext esd 34505>>12 ulelong !3584 ( 34506# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg 34507>>>156 search/68233/s RunTime.xml \bWindows provisioning package) 34508!:ext ppkg 34509# if is is not a Windows provisioning package, then it is a WIM 34510>>>156 default x \bWIM) image 34511# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2 34512!:ext wim/wim2 34513>0 string/b WLPWM\000\000\000 \b, wimlib pipable format 34514# cbSize size of the WIM header in bytes like 208 34515#>8 ulelong x \b, headersize %u 34516# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 34517>14 uleshort x v%u 34518>13 ubyte x \b.%u 34519# dwImageCount; The number of images contained in the WIM file 34520>44 ulelong >1 \b, %u images 34521# dwBootIndex 34522# 1-based index of the bootable image of the WIM, or 0 if no image is bootable 34523>0x78 ulelong >0 \b, bootable no. %u 34524# dwFlags 34525#>16 ulelong x \b, flags 0x%8.8x 34526#define FLAG_HEADER_COMPRESSION 0x00000002 34527#define FLAG_HEADER_READONLY 0x00000004 34528#define FLAG_HEADER_SPANNED 0x00000008 34529#define FLAG_HEADER_RESOURCE_ONLY 0x00000010 34530#define FLAG_HEADER_METADATA_ONLY 0x00000020 34531#define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 34532#define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 34533#define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 34534#define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 34535#define FLAG_HEADER_COMPRESS_LZX 0x00040000 34536#define FLAG_HEADER_COMPRESS_LZMS 0x00080000 34537#define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 34538# XPRESS, with small chunk size 34539>16 ulelong &0x00100000 \b, XPRESS2 34540>16 ulelong &0x00080000 \b, LZMS 34541>16 ulelong &0x00040000 \b, LZX 34542>16 ulelong &0x00020000 \b, XPRESS 34543>16 ulelong &0x00000002 compressed 34544>16 ulelong &0x00000004 \b, read only 34545>16 ulelong &0x00000010 \b, resource only 34546>16 ulelong &0x00000020 \b, metadata only 34547>16 ulelong &0x00000080 \b, reparse point fixup 34548#>16 ulelong &0x00010000 \b, RESERVED 34549# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 34550#>20 ulelong >0 \b, chunk size %u bytes 34551# gWIMGuid 34552#>24 ubequad x \b, GUID 0x%16.16llx 34553#>>32 ubequad x \b%16.16llx 34554# rhOffsetTable; the location of the resource lookup table 34555# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 34556#>48 ubequad x \b, rhOffsetTable 0x%16.16llx 34557# rhXmlData; the location of the XML data 34558#>0x50 ulelong x \b, at 0x%8.8x 34559# NOT WORKING \xff\xfe<\0W\0I\0M\0 34560#>(0x50.l) ubequad x \b, xml=%16.16llx 34561# rhBootMetadata; the location of the metadata resource 34562#>0x60 ubequad x \b, rhBootMetadata 0x%16.16llx 34563# rhIntegrity; the location of integrity table used to verify files 34564#>0x7c ubequad x \b, rhIntegrity 0x%16.16llx 34565# Unused[60] 34566#>148 ubequad !0 \b,unused 0x%16.16llx 34567# 34568 34569# From: Joerg Jenderek 34570# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 34571# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 34572# Note: called "Windows Easy Transfer migration data" by TrID, 34573# "Migration Store" or "EasyTransfer file" by Microsoft 345740 string 1giM Windows Easy Transfer migration data 34575#!:mime application/octet-stream 34576!:mime application/x-ms-mig 34577!:ext mig 34578>0x18 string =MRTS without password 34579# data offset with 1 space at end 34580>>0x1c ulelong+0x38 x \b, at 0x%x 34581# look for zlib compressed data by ./compress 34582>>(0x1c.l+0x38) ubyte x 34583>>>&-1 indirect x 34584# in password protected examples MRTS comes some bytes further 34585>0x18 string !MRTS with password 34586# look for first MRTS tag 34587>0x18 search/29/b MRTS 34588# probably first file name length like 178, ... 34589#>>&0 ulelong x \b, 1st length %u 34590# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 34591>>&20 lestring16 x \b, 1st %-s 34592 34593# Microsoft SYLK 34594# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 34595# https://outflank.nl/upload/sylksum.txt 345960 string ID;P Microsoft SYLK program 34597>4 string >0 \b, created by %s 34598!:ext slk/sylk 34599 34600#------------------------------------------------------------------------------ 34601# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 34602# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 34603# 346040 string RGDB CRDA wireless regulatory database file 34605>4 belong 19 (Version 1) 34606 34607#------------------------------------------------------------------------------ 34608# $File: wordprocessors,v 1.24 2020/05/22 19:28:47 christos Exp $ 34609# wordprocessors: file(1) magic fo word processors. 34610# 34611####### PWP file format used on Smith Corona Personal Word Processors: 346122 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 34613>24 byte 2 \b, single spaced 34614>24 byte 3 \b, 1.5 spaced 34615>24 byte 4 \b, double spaced 34616>25 byte 0x42 \b, letter 34617>25 byte 0x54 \b, legal 34618>26 byte 0x46 \b, A4 34619 34620# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 34621# reference: http://mark0.net/download/triddefs_xml.7z 34622# /defs/w/wps-works-dos.trid.xml 34623# From: Joerg Jenderek 34624# Note: older non OLE 2 Compound based versions 346250 ubeshort =0x01FE 34626>112 ubeshort =0x0100 Microsoft Works 1-3 (DOS) or 2 (Windows) document 34627# title like THE GREAT KHAN GAME 34628>>0x100 string x %s 34629!:mime application/vnd-ms-works 34630#!:mime application/x-msworks 34631# https://www.macdisk.com/macsigen.php 34632!:apple ????AWWP 34633!:ext wps 34634 34635# Corel/WordPerfect 346360 string \xffWPC 34637# WordPerfect 34638>8 byte 1 34639>>9 byte 1 WordPerfect macro 34640>>9 byte 2 WordPerfect help file 34641>>9 byte 3 WordPerfect keyboard file 34642>>9 byte 10 WordPerfect document 34643>>9 byte 11 WordPerfect dictionary 34644>>9 byte 12 WordPerfect thesaurus 34645>>9 byte 13 WordPerfect block 34646>>9 byte 14 WordPerfect rectangular block 34647>>9 byte 15 WordPerfect column block 34648>>9 byte 16 WordPerfect printer data 34649>>9 byte 19 WordPerfect printer data 34650>>9 byte 20 WordPerfect driver resource data 34651>>9 byte 22 WordPerfect graphic image 34652>>9 byte 23 WordPerfect hyphenation code 34653>>9 byte 24 WordPerfect hyphenation data 34654>>9 byte 25 WordPerfect macro resource data 34655>>9 byte 27 WordPerfect hyphenation lex 34656>>9 byte 29 WordPerfect wordlist 34657>>9 byte 30 WordPerfect equation resource data 34658>>9 byte 33 WordPerfect spell rules 34659>>9 byte 34 WordPerfect dictionary rules 34660>>9 byte 39 WordPerfect spell rules (Microlytics) 34661>>9 byte 43 WordPerfect settings file 34662>>9 byte 44 WordPerfect 3.5 document 34663>>9 byte 45 WordPerfect 4.2 document 34664>>9 byte 69 WordPerfect dialog file 34665>>9 byte 76 WordPerfect button bar 34666>>9 default x 34667>>>9 byte x Corel WordPerfect: Unknown filetype %d 34668# Corel Shell 34669>8 byte 2 34670>>9 byte 1 Corel shell macro 34671>>9 byte 10 Corel shell definition 34672>>9 default x 34673>>>9 byte x Corel Shell: Unknown filetype %d 34674# Corel Notebook 34675>8 byte 3 34676>>9 byte 1 Corel Notebook macro 34677>>9 byte 2 Corel Notebook help file 34678>>9 byte 3 Corel Notebook keyboard file 34679>>9 byte 10 Corel Notebook definition 34680>>9 default x 34681>>>9 byte x Corel Notebook: Unknown filetype %d 34682# Corel Calculator 34683>8 byte 4 34684>>9 byte 2 Corel Calculator help file 34685>>9 default x 34686>>>9 byte x Corel Calculator: Unknown filetype %d 34687# Corel File Manager 34688>8 byte 5 34689>>9 default x 34690>>>9 byte x Corel File Manager: Unknown filetype %d 34691# Corel Calendar 34692>8 byte 6 34693>>9 byte 2 Corel Calendar help file 34694>>9 byte 10 Corel Calendar data file 34695>>9 default x 34696>>>9 byte x Corel Calendar: Unknown filetype %d 34697# Corel Program Editor/Ed Editor 34698>8 byte 7 34699>>9 byte 1 Corel Editor macro 34700>>9 byte 2 Corel Editor help file 34701>>9 byte 3 Corel Editor keyboard file 34702>>9 byte 25 Corel Editor macro resource file 34703>>9 default x 34704>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d 34705# Corel Macro Editor 34706>8 byte 8 34707>>9 byte 1 Corel Macro editor macro 34708>>9 byte 2 Corel Macro editor help file 34709>>9 byte 3 Corel Macro editor keyboard file 34710>>9 default x 34711>>>9 byte x Corel Macro Editor: Unknown filetype %d 34712# Corel Plan Perfect 34713>8 byte 9 34714>>9 default x 34715>>>9 byte x Corel Plan Perfect: Unknown filetype %d 34716# Corel DataPerfect 34717>8 byte 10 34718# CHECK: Don't these belong into product 9? 34719>>9 byte 1 Corel PlanPerfect macro 34720>>9 byte 2 Corel PlanPerfect help file 34721>>9 byte 3 Corel PlanPerfect keyboard file 34722>>9 byte 10 Corel PlanPerfect worksheet 34723>>9 byte 15 Corel PlanPerfect printer definition 34724>>9 byte 18 Corel PlanPerfect graphic definition 34725>>9 byte 19 Corel PlanPerfect data 34726>>9 byte 20 Corel PlanPerfect temporary printer 34727>>9 byte 25 Corel PlanPerfect macro resource data 34728>>9 default x 34729>>>9 byte x Corel DataPerfect: Unknown filetype %d 34730# Corel Mail 34731>8 byte 11 34732>>9 byte 2 Corel Mail help file 34733>>9 byte 5 Corel Mail distribution list 34734>>9 byte 10 Corel Mail out box 34735>>9 byte 11 Corel Mail in box 34736>>9 byte 20 Corel Mail users archived mailbox 34737>>9 byte 21 Corel Mail archived message database 34738>>9 byte 22 Corel Mail archived attachments 34739>>9 default x 34740>>>9 byte x Corel Mail: Unknown filetype %d 34741# Corel Printer 34742>8 byte 12 34743>>9 byte 11 Corel Printer temporary file 34744>>9 default x 34745>>>9 byte x Corel Printer: Unknown filetype %d 34746# Corel Scheduler 34747>8 byte 13 34748>>9 byte 2 Corel Scheduler help file 34749>>9 byte 10 Corel Scheduler in file 34750>>9 byte 11 Corel Scheduler out file 34751>>9 default x 34752>>>9 byte x Corel Scheduler: Unknown filetype %d 34753# Corel WordPerfect Office 34754>8 byte 14 34755>>9 byte 10 Corel GroupWise settings file 34756>>9 byte 17 Corel GroupWise directory services 34757>>9 byte 43 Corel GroupWise settings file 34758>>9 default x 34759>>>9 byte x Corel WordPerfect Office: Unknown filetype %d 34760# Corel DrawPerfect 34761>8 byte 15 34762>>9 default x 34763>>>9 byte x Corel DrawPerfect: Unknown filetype %d 34764# Corel LetterPerfect 34765>8 byte 16 34766>>9 default x 34767>>>9 byte x Corel LetterPerfect: Unknown filetype %d 34768# Corel Terminal 34769>8 byte 17 34770>>9 byte 10 Corel Terminal resource data 34771>>9 byte 11 Corel Terminal resource data 34772>>9 byte 43 Corel Terminal resource data 34773>>9 default x 34774>>>9 byte x Corel Terminal: Unknown filetype %d 34775# Corel loadable file 34776>8 byte 18 34777>>9 byte 10 Corel loadable file 34778>>9 byte 11 Corel GUI loadable text 34779>>9 byte 12 Corel graphics resource data 34780>>9 byte 13 Corel printer settings file 34781>>9 byte 14 Corel port definition file 34782>>9 byte 15 Corel print queue parameters 34783>>9 byte 16 Corel compressed file 34784>>9 default x 34785>>>9 byte x Corel loadable file: Unknown filetype %d 34786>>15 byte 0 \b, optimized for Intel 34787>>15 byte 1 \b, optimized for Non-Intel 34788# Network service 34789>8 byte 20 34790>>9 byte 10 Corel Network service msg file 34791>>9 byte 11 Corel Network service msg file 34792>>9 byte 12 Corel Async gateway login msg 34793>>9 byte 14 Corel GroupWise message file 34794>>9 default x 34795>>>9 byte x Corel Network service: Unknown filetype %d 34796# GroupWise 34797>8 byte 31 34798>>9 byte 20 GroupWise admin domain database 34799>>9 byte 21 GroupWise admin host database 34800>>9 byte 23 GroupWise admin remote host database 34801>>9 byte 24 GroupWise admin ADS deferment data file 34802>>9 default x 34803>>>9 byte x GroupWise: Unknown filetype %d 34804# IntelliTAG 34805>8 byte 33 34806>>9 byte 10 IntelliTAG (SGML) compiled DTD 34807>>9 default x 34808>>>9 byte x IntelliTAG: Unknown filetype %d 34809# everything else 34810>8 default x 34811>>8 byte x Unknown Corel/Wordperfect product %d, 34812>>>9 byte x file type %d 34813>10 byte 0 \b, v5. 34814>10 byte !0 \b, v%d. 34815>11 byte x \b%d 34816 34817# Hangul (Korean) Word Processor File 348180 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 34819 34820# CosmicBook, from Benoit Rouits 348210 string CSBK Ted Neslson's CosmicBook hypertext file 34822 348232 string EYWR AmigaWriter file 34824 34825# chi: file(1) magic for ChiWriter files 348260 string \\1cw\ ChiWriter file 34827>5 string >\0 version %s 348280 string \\1cw ChiWriter file 34829 34830# Quark Express from https://www.garykessler.net/library/file_sigs.html 348312 string IIXPR3 Intel Quark Express Document (English) 348322 string IIXPRa Intel Quark Express Document (Korean) 348332 string MMXPR3 Motorola Quark Express Document (English) 34834!:mime application/x-quark-xpress-3 348352 string MMXPRa Motorola Quark Express Document (Korean) 34836 34837# adobe indesign (document, whatever...) from querkan 348380 belong 0x0606edf5 Adobe InDesign 34839>16 string DOCUMENT Document 34840 34841#------------------------------------------------------------------------------ 34842# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 34843# 34844# Contributor kenzo-: 34845# Reversed-engineered JS Ichitaro magic numbers 34846# 34847 348480 string DOC 34849>43 byte 0x14 Just System Word Processor Ichitaro v4 34850!:mime application/x-ichitaro4 34851>144 string JDASH application/x-ichitaro4 34852 348530 string DOC 34854>43 byte 0x15 Just System Word Processor Ichitaro v5 34855!:mime application/x-ichitaro5 34856 348570 string DOC 34858>43 byte 0x16 Just System Word Processor Ichitaro v6 34859!:mime application/x-ichitaro6 34860 34861# Type: Freemind mindmap documents 34862# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 348630 string/w \<map\ version Freemind document 34864!:mime application/x-freemind 34865 34866# Type: Freeplane mindmap documents 34867# From: Felix Natter <fnatter@gmx.net> 348680 string/w \<map\ version="freeplane Freeplane document 34869!:mime application/x-freeplane 34870 34871# Type: Scribus 34872# From: Werner Fink <werner@suse.de> 348730 string \<SCRIBUSUTF8\ Version Scribus Document 348740 string \<SCRIBUSUTF8NEW\ Version Scribus Document 34875!:mime application/x-scribus 34876 34877# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 34878# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 348790 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 34880 34881# From: Joerg Jenderek 34882# URL: https://en.wikipedia.org/wiki/StarOffice 34883# Note: used in Star-, Open- and Libre-Office 34884# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others 348850 ubeshort 0x0400 34886#>(2.s+8) ubequad x \b, gap 0x%16.16llx 34887# test for null value in gap after theme name maybe unreliable 34888#>(2.s+9) ubyte 0 \b, 0-byte 34889# look for keyword GALRESRV near the end 34890# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects 34891#>0 search/8415 GALRESRV \b, GALRESRV found 34892# "neues thema6.thm" MorePictures, 315 objects 34893#>0 search/19299 GALRESRV \b, GALRESRV FOUND 34894#>2 uleshort x \b, name length %u 34895# skip file2147.chk by check for positive name length like for sg16.thm "3D" 34896>2 uleshort >0 StarOffice Gallery theme 34897!:mime application/x-stargallery-thm 34898!:ext thm 34899# gallery name 34900>>2 pstring/h x %s 34901# number of objects 34902>>(2.s+4) ulelong x \b, %u object 34903# plural s 34904>>(2.s+4) ulelong !1 \bs 34905# if available then display first object name 34906>>(2.s+4) ulelong >0 34907# partial file name, URL or internal name like "dd2*" of 1st object or RESRV 34908>>>(2.s+11) pstring/h x \b, 1st %s 34909 34910# From: Joerg Jenderek 34911# URL: http://fileformats.archiveteam.org/wiki/StarOffice_Gallery 34912# Note: used in Star-, Open- and Libre-Office and found in directories like 34913# %APPDATA%\Roaming\LibreOffice\4\user\gallery 34914# $HOME/.config/libreoffice/4/user/gallery 349150 string SGA3 StarOffice Gallery thumbnails 34916# Unknown like 0x04000?0001000142 34917#>4 ubequad x \b, UNKNOWN 0x%16.16llx 34918#!:mime application/x-sdg 34919!:mime application/x-stargallery-sdg 34920!:ext sdg 34921# display image magic for debugging purpose like 'BM' 34922# looking like PC bitmap, Windows 3.x format with unknown compression 34923#>11 string x \b, image magic '%-.2s' 34924# inspect 1st GALLERY thumbnail magic by ./images with 1 space at end 34925#>11 indirect x \b; contains 34926 34927 34928#------------------------------------------------------------------------------ 34929# $File: wsdl,v 1.5 2019/04/19 00:42:27 christos Exp $ 34930# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php 34931# Cache format extracted from source: 34932# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 34933# Requires file >= 5.05 34934# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 349350 string wsdl PHP WSDL cache, 34936>4 byte x version 0x%02x 34937>6 ledate x \b, created %s 34938 34939# uri 34940>10 lelong <0x7fffffff 34941>>10 pstring/l x \b, uri: "%s" 34942 34943# source 34944>>>&0 lelong <0x7fffffff 34945>>>>&-4 pstring/l x \b, source: "%s" 34946 34947# target_ns 34948>>>>>&0 lelong <0x7fffffff 34949>>>>>>&-4 pstring/l x \b, target_ns: "%s" 34950#------------------------------------------------------------------------------ 34951# x68000: file(1) magic for the Sharp Home Computer 34952# v1.0 34953# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 34954 34955# Yanagisawa PIC picture 349560 string PIC 34957>3 search/0x200 \x1A 34958>>&0 search/0x200 \x0 34959>>>&0 ubyte 0 Yanagisawa PIC image file, 34960>>>>&0 ubyte&15 0 model: X68000, 34961>>>>&0 ubyte&15 1 model: PC-88VA, 34962>>>>&0 ubyte&15 2 model: FM-TOWNS, 34963>>>>&0 ubyte&15 3 model: MAC, 34964>>>>&0 ubyte&15 15 model: Generic, 34965>>>>&3 ubeshort x %dx 34966>>>>&5 ubeshort x \b%d, 34967>>>>&1 ubeshort 4 colors: 16 34968>>>>&1 ubeshort 8 colors: 256 34969>>>>&1 ubeshort 12 colors: 4096 34970>>>>&1 ubeshort 15 colors: 32768 34971>>>>&1 ubeshort 16 colors: 65536 34972>>>>&1 ubeshort >16 colors: %d-bit 34973 34974 34975 34976#------------------------------------------------------------------------------ 34977# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 34978# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 34979# 349800 string %XDELTA% XDelta binary patch file 0.14 349810 string %XDZ000% XDelta binary patch file 0.18 349820 string %XDZ001% XDelta binary patch file 0.20 349830 string %XDZ002% XDelta binary patch file 1.0 349840 string %XDZ003% XDelta binary patch file 1.0.4 349850 string %XDZ004% XDelta binary patch file 1.1 34986 349870 string \xD6\xC3\xC4\x00 VCDIFF binary diff 34988 34989#------------------------------------------------------------------------------ 34990# $File: xenix,v 1.12 2021/02/23 00:51:10 christos Exp $ 34991# xenix: file(1) magic for Microsoft Xenix 34992# 34993# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 34994# model" lifted from "magic.xenix", with comment "derived empirically; 34995# treat as folklore until proven" 34996# 34997# "small model", "large model", "huge model" stuff lifted from XXX 34998# 34999# XXX - "x.out" collides with PDP-11 archives 35000# 350010 string core core file (Xenix) 35002# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 35003# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 35004# Update: Joerg Jenderek 35005# recordtype~TranslatorHEADerRecord 350060 byte 0x80 35007# GRR: line above is too general as it catches also Extensible storage engine DataBase 35008# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 35009>1 uleshort <1022 35010# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length 35011>>1 uleshort >0 35012# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length 35013>>>3 ubyte >0 35014# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" 35015>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) 35016#!:mime application/octet-stream 35017!:mime application/x-object 35018!:ext o/a 35019>>>>>3 pstring x \b, "%s" 35020# checksum 35021#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x 350220 leshort 0xff65 x.out 35023>2 string __.SYMDEF randomized 35024>0 byte x archive 350250 leshort 0x206 Microsoft a.out 35026>8 leshort 1 Middle model 35027>0x1e leshort &0x10 overlay 35028>0x1e leshort &0x2 separate 35029>0x1e leshort &0x4 pure 35030>0x1e leshort &0x800 segmented 35031>0x1e leshort &0x400 standalone 35032>0x1e leshort &0x8 fixed-stack 35033>0x1c byte &0x80 byte-swapped 35034>0x1c byte &0x40 word-swapped 35035>0x10 lelong >0 not-stripped 35036>0x1e leshort ^0xc000 pre-SysV 35037>0x1e leshort &0x4000 V2.3 35038>0x1e leshort &0x8000 V3.0 35039>0x1c byte &0x4 86 35040>0x1c byte &0xb 186 35041>0x1c byte &0x9 286 35042>0x1c byte &0xa 386 35043>0x1f byte <0x040 small model 35044>0x1f byte =0x048 large model 35045>0x1f byte =0x049 huge model 35046>0x1e leshort &0x1 executable 35047>0x1e leshort ^0x1 object file 35048>0x1e leshort &0x40 Large Text 35049>0x1e leshort &0x20 Large Data 35050>0x1e leshort &0x120 Huge Objects Enabled 35051>0x10 lelong >0 not stripped 35052 350530 leshort 0x140 old Microsoft 8086 x.out 35054>0x3 byte &0x4 separate 35055>0x3 byte &0x2 pure 35056>0 byte &0x1 executable 35057>0 byte ^0x1 relocatable 35058>0x14 lelong >0 not stripped 35059 350600 lelong 0x206 b.out 35061>0x1e leshort &0x10 overlay 35062>0x1e leshort &0x2 separate 35063>0x1e leshort &0x4 pure 35064>0x1e leshort &0x800 segmented 35065>0x1e leshort &0x400 standalone 35066>0x1e leshort &0x1 executable 35067>0x1e leshort ^0x1 object file 35068>0x1e leshort &0x4000 V2.3 35069>0x1e leshort &0x8000 V3.0 35070>0x1c byte &0x4 86 35071>0x1c byte &0xb 186 35072>0x1c byte &0x9 286 35073>0x1c byte &0x29 286 35074>0x1c byte &0xa 386 35075>0x1e leshort &0x4 Large Text 35076>0x1e leshort &0x2 Large Data 35077>0x1e leshort &0x102 Huge Objects Enabled 35078 350790 leshort 0x580 XENIX 8086 relocatable or 80286 small model 35080 35081#------------------------------------------------------------------------------ 35082# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $ 35083# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 35084# Xilinx-Magic@RevRagnarok.com 35085# Got the info from FPGA-FAQ 0026 35086# 35087# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 35088# fixes at least reading of bitfiles from Spartan 2, 3, 6. 35089# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 35090# 35091# First there is the sync header and its length 350920 beshort 0x0009 35093>2 belong =0x0ff00ff0 35094>>&0 belong =0x0ff00ff0 35095>>>&0 byte =0x00 35096>>>&1 beshort =0x0001 35097>>>&3 string a Xilinx BIT data 35098# Next is a Pascal-style string with the NCD name. We want to capture that. 35099>>>>&0 pstring/H x - from %s 35100# And then 'b' 35101>>>>>&1 string b 35102# Then the model / part number: 35103>>>>>>&0 pstring/H x - for %s 35104# Then 'c' 35105>>>>>>>&1 string c 35106# Then the build-date 35107>>>>>>>>&0 pstring/H x - built %s 35108# Then 'd' 35109>>>>>>>>>&1 string d 35110# Then the build-time 35111>>>>>>>>>>&0 pstring/H x \b(%s) 35112# Then 'e' 35113>>>>>>>>>>>&1 string e 35114# And length of data 35115>>>>>>>>>>>>&0 belong x - data length 0x%x 35116 35117# Raw bitstream files 351180 long 0xffffffff 35119>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 35120 35121#------------------------------------------------------------------------------ 35122# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 35123# xo65 object files 35124# From: "Ullrich von Bassewitz" <uz@cc65.org> 35125# 351260 string \x55\x7A\x6E\x61 xo65 object, 35127>4 leshort x version %d, 35128>6 leshort&0x0001 =0x0001 with debug info 35129>6 leshort&0x0001 =0x0000 no debug info 35130 35131# xo65 library files 351320 string \x6E\x61\x55\x7A xo65 library, 35133>4 leshort x version %d 35134 35135# o65 object files 351360 string \x01\x00\x6F\x36\x35 o65 35137>6 leshort&0x1000 =0x0000 executable, 35138>6 leshort&0x1000 =0x1000 object, 35139>5 byte x version %d, 35140>6 leshort&0x8000 =0x8000 65816, 35141>6 leshort&0x8000 =0x0000 6502, 35142>6 leshort&0x2000 =0x2000 32 bit, 35143>6 leshort&0x2000 =0x0000 16 bit, 35144>6 leshort&0x4000 =0x4000 page reloc, 35145>6 leshort&0x4000 =0x0000 byte reloc, 35146>6 leshort&0x0003 =0x0000 alignment 1 35147>6 leshort&0x0003 =0x0001 alignment 2 35148>6 leshort&0x0003 =0x0002 alignment 4 35149>6 leshort&0x0003 =0x0003 alignment 256 35150 35151#------------------------------------------------------------------------------ 35152# $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $ 35153# xwindows: file(1) magic for various X/Window system file formats. 35154 35155# Compiled X Keymap 35156# XKM (compiled X keymap) files (including version and byte ordering) 351571 string mkx Compiled XKB Keymap: lsb, 35158>0 byte >0 version %d 35159>0 byte =0 obsolete 351600 string xkm Compiled XKB Keymap: msb, 35161>3 byte >0 version %d 35162>3 byte =0 obsolete 35163 35164# xfsdump archive 351650 string xFSdump0 xfsdump archive 35166>8 belong x (version %d) 35167 35168# Jaleo XFS files 351690 long 395726 Jaleo XFS file 35170>4 long x - version %d 35171>8 long x - [%d - 35172>20 long x \b%dx 35173>24 long x \b%dx 35174>28 long 1008 \bYUV422] 35175>28 long 1000 \bRGB24] 35176 35177# Xcursor data 35178# X11 mouse cursor format defined in libXcursor, see 35179# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 35180# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 351810 string Xcur Xcursor data 35182!:mime image/x-xcursor 35183>10 leshort x version %d 35184>>8 leshort x \b.%d 35185 35186 35187#------------------------------------------------------------------------------ 35188# $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $ 35189# yara: file(1) magic for https://virustotal.github.io/yara/ 35190# 35191 351920 string YARA 35193>4 lelong >2047 35194>8 byte <20 YARA 3.x compiled rule set 35195# version 35196>>8 clear x 35197>>8 byte 6 created with version 3.3.0 35198>>8 byte 8 created with version 3.4.0 35199>>8 byte 11 created with version 3.5.0 35200>>8 default x 35201>>>8 byte x development version 0x%02x 35202#------------------------------------------------------------------------------ 35203# zfs: file(1) magic for ZFS dumps 35204# 35205# From <rea-fbsd@codelabs.ru> 35206# ZFS dump header has the following structure (as per zfs_ioctl.h 35207# in FreeBSD with drr_type is set to DRR_BEGIN) 35208# 35209# enum { 35210# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 35211# DRR_WRITE, DRR_FREE, DRR_END, 35212# } drr_type; 35213# uint32_t drr_pad; 35214# uint64_t drr_magic; 35215# uint64_t drr_version; 35216# uint64_t drr_creation_time; 35217# dmu_objset_type_t drr_type; 35218# uint32_t drr_pad; 35219# uint64_t drr_toguid; 35220# uint64_t drr_fromguid; 35221# char drr_toname[MAXNAMELEN]; 35222# 35223# Backup magic is 0x00000002f5bacbac (quad word) 35224# The drr_type is defined as 35225# typedef enum dmu_objset_type { 35226# DMU_OST_NONE, 35227# DMU_OST_META, 35228# DMU_OST_ZFS, 35229# DMU_OST_ZVOL, 35230# DMU_OST_OTHER, /* For testing only! */ 35231# DMU_OST_ANY, /* Be careful! */ 35232# DMU_OST_NUMTYPES 35233# } dmu_objset_type_t; 35234# 35235# Almost all uint64_t fields are printed as the 32-bit ones (with high 35236# 32 bits zeroed), because there is no simple way to print them as the 35237# full 64-bit values. 35238 35239# Big-endian values 352408 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 35241>20 belong x version %u, 35242>32 belong 0 type: NONE, 35243>32 belong 1 type: META, 35244>32 belong 2 type: ZFS, 35245>32 belong 3 type: ZVOL, 35246>32 belong 4 type: OTHER, 35247>32 belong 5 type: ANY, 35248>32 belong >5 type: UNKNOWN (%u), 35249>40 byte x destination GUID: %02X 35250>41 byte x %02X 35251>42 byte x %02X 35252>43 byte x %02X 35253>44 byte x %02X 35254>45 byte x %02X 35255>46 byte x %02X 35256>47 byte x %02X, 35257>48 ulong >0 35258>>52 ulong >0 35259>>>48 byte x source GUID: %02X 35260>>>49 byte x %02X 35261>>>50 byte x %02X 35262>>>51 byte x %02X 35263>>>52 byte x %02X 35264>>>53 byte x %02X 35265>>>54 byte x %02X 35266>>>55 byte x %02X, 35267>56 string >\0 name: '%s' 35268 35269# Little-endian values 352708 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 35271>16 lelong x version %u, 35272>32 lelong 0 type: NONE, 35273>32 lelong 1 type: META, 35274>32 lelong 2 type: ZFS, 35275>32 lelong 3 type: ZVOL, 35276>32 lelong 4 type: OTHER, 35277>32 lelong 5 type: ANY, 35278>32 lelong >5 type: UNKNOWN (%u), 35279>47 byte x destination GUID: %02X 35280>46 byte x %02X 35281>45 byte x %02X 35282>44 byte x %02X 35283>43 byte x %02X 35284>42 byte x %02X 35285>41 byte x %02X 35286>40 byte x %02X, 35287>48 ulong >0 35288>>52 ulong >0 35289>>>55 byte x source GUID: %02X 35290>>>54 byte x %02X 35291>>>53 byte x %02X 35292>>>52 byte x %02X 35293>>>51 byte x %02X 35294>>>50 byte x %02X 35295>>>49 byte x %02X 35296>>>48 byte x %02X, 35297>56 string >\0 name: '%s' 35298 35299#------------------------------------------------------------------------------ 35300# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 35301# zilog: file(1) magic for Zilog Z8000. 35302# 35303# Was it big-endian or little-endian? My Product Specification doesn't 35304# say. 35305# 353060 long 0xe807 object file (z8000 a.out) 353070 long 0xe808 pure object file (z8000 a.out) 353080 long 0xe809 separate object file (z8000 a.out) 353090 long 0xe805 overlay object file (z8000 a.out) 35310#------------------------------------------------------------------------------ 35311# $File: zip,v 1.6 2021/02/05 22:55:36 christos Exp $ 35312# zip: file(1) magic for zip files; this is not use 35313# Note the version of magic in archive is currently stronger, this is 35314# just an example until negative offsets are supported better 35315 35316# Zip Central Directory record 353170 name zipcd 35318>0 string PK\001\002 Zip archive data 35319!:mime application/zip 35320>>4 leshort x \b, made by 35321>>4 use zipversion 35322>>4 use ziphost 35323>>6 leshort x \b, extract using at least 35324>>6 use zipversion 35325>>12 ledate x \b, last modified %s 35326>>24 lelong >0 \b, uncompressed size %d 35327>>10 leshort x \b, method= 35328>>10 use zipcompression 35329 35330# URL: https://en.wikipedia.org/wiki/Zip_(file_format) 35331# reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT (Version: 6.3.9) 35332# Zip known compressions 353330 name zipcompression 35334>0 leshort 0 \bstore 35335>0 leshort 1 \bShrinking 35336>0 leshort 6 \bImploding 35337>0 leshort 7 \bTokenizing 35338>0 leshort 8 \bdeflate 35339>0 leshort 9 \bdeflate64 35340>0 leshort 10 \bLibrary imploding 35341#>0 leshort 11 \bReserved by PKWARE 35342>0 leshort 12 \bbzip2 35343#>0 leshort 13 \bReserved by PKWARE 35344>0 leshort 14 \blzma 35345#>0 leshort 15 \bReserved by PKWARE 35346>0 leshort 16 \bCMPSC (IBM z/OS) 35347#>0 leshort 17 \bReserved by PKWARE 35348>0 leshort 18 \bIBM TERSE 35349>0 leshort 19 \bIBM LZ77 (z/Architecture) 35350>0 leshort 20 \bZstd (deprecated) 35351>0 leshort 93 \bZstd 35352>0 leshort 94 \bMP3 35353>0 leshort 95 \bxz 35354>0 leshort 96 \bJpeg 35355>0 leshort 97 \bWavPack 35356>0 leshort 98 \bPPMd 35357>0 leshort 99 \bAES Encrypted 35358>0 default x 35359>>0 leshort x \b[%#x] 35360 35361# Zip known versions 353620 name zipversion 35363# The lower byte indicates the ZIP version of this file. The value/10 indicates 35364# the major version number, and the value mod 10 is the minor version number. 35365>0 ubyte/10 x v%u 35366>0 ubyte%10 x \b.%u 35367# >0 leshort 0x09 v0.9 35368# >0 leshort 0x0a v1.0 35369# >0 leshort 0x0b v1.1 35370# >0 leshort 0x14 v2.0 35371# >0 leshort 0x15 v2.1 35372# >0 leshort 0x19 v2.5 35373# >0 leshort 0x1b v2.7 35374# >0 leshort 0x2d v4.5 35375# >0 leshort 0x2e v4.6 35376# >0 leshort 0x32 v5.0 35377# >0 leshort 0x33 v5.1 35378# >0 leshort 0x34 v5.2 35379# >0 leshort 0x3d v6.1 35380# >0 leshort 0x3e v6.2 35381# >0 leshort 0x3f v6.3 35382# >0 default x 35383# >>0 leshort x v?[%#x] 35384 35385# display compatible host system name of ZIP archive 353860 name ziphost 35387# The upper byte indicates the compatibility of the file attribute information. 35388# If the file is compatible with MS-DOS (v 2.04g) then this value will be zero. 35389#>1 ubyte 0 DOS 35390>1 ubyte 1 Amiga 35391>1 ubyte 2 OpenVMS 35392>1 ubyte 3 UNIX 35393>1 ubyte 4 VM/CMS 35394>1 ubyte 6 OS/2 35395>1 ubyte 7 Macintosh 35396>1 ubyte 11 MVS 35397>1 ubyte 13 Acorn Risc 35398>1 ubyte 16 BeOS 35399>1 ubyte 17 Tandem 35400# 9 untested 35401>1 ubyte 5 Atari ST 35402>1 ubyte 8 Z-System 35403>1 ubyte 9 CP/M 35404>1 ubyte 10 Windows NTFS 35405>1 ubyte 12 VSE 35406>1 ubyte 14 VFAT 35407>1 ubyte 15 alternate MVS 35408>1 ubyte 18 OS/400 35409>1 ubyte 19 OS X 35410# unused 35411#>1 ubyte >19 unused 0x%x 35412 35413# Zip End Of Central Directory record 35414-22 string PK\005\006 35415#>4 leshort >1 \b, %d disks 35416#>6 leshort >1 \b, central directory disk %d 35417#>8 leshort >1 \b, %d central directories on this disk 35418#>10 leshort >1 \b, %d central directories 35419#>12 lelong x \b, %d central directory bytes 35420>(16.l) use zipcd 35421>>20 pstring/l >0 \b, %s 35422 35423#------------------------------------------------------------------------------ 35424# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 35425# zyxel: file(1) magic for ZyXEL modems 35426# 35427# From <rob@pe1chl.ampr.org> 35428# These are the /etc/magic entries to decode datafiles as used for the 35429# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 35430# ZyXEL-defined standard) 35431 354320 string ZyXEL\002 ZyXEL voice data 35433>10 byte 0 - CELP encoding 35434>10 byte&0x0B 1 - ADPCM2 encoding 35435>10 byte&0x0B 2 - ADPCM3 encoding 35436>10 byte&0x0B 3 - ADPCM4 encoding 35437>10 byte&0x0B 8 - New ADPCM3 encoding 35438>10 byte&0x04 4 with resync 35439
