1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@astron.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.8 2021/04/26 15:56:00 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83# From: Joerg Jenderek 84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir 85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c 86# GRR: line below is too general as it matches also "Git pack" in ./revision 870 string PACK\0 88# check for valid compression method 0-4 89>5 ulelong <5 90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems 91# To skip "Git pack" version 0 test for root directory object like 92# ADFS::RPC.$.websitezip.FONTFIX 93>>9 string >ADFS\ PackDir archive (RISC OS) 94# TrID labels above as "Acorn PackDir compressed Archive" 95# compression mode y (0 - 4) for GIF LZW with a maximum n bits 96# (y~n,0~12,1~13,2~14,3~15,4~16) 97>>>5 ulelong+12 x \b, LZW %u-bits compression 98# https://www.filebase.org.uk/filetypes 99# !Packdir compressed archive has three hexadecimal digits code 68E 100!:mime application/x-acorn-68E 101!:ext pkd/bin 102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo 103>>>9 string x \b, root "%s" 104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time 105>>>>&1 ulelong x \b, load address %#x 106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC 107>>>>&5 ulelong x \b, exec address %#x 108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) 109>>>>&9 ulelong x \b, attributes %#x 110# number of entries in this directory. for root dir 0 111#>>>&13 ulelong x \b, entries %#x 112# the entries start here with object name 113>>>>&17 string x \b, 1st object "%s" 114 115 116#------------------------------------------------------------------------------ 117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 118# adi: file(1) magic for ADi's objects 119# From Gregory McGarry <g.mcgarry@ieee.org> 120# 1210 leshort 0x521c COFF DSP21k 122>18 lelong &02 executable, 123>18 lelong ^02 124>>18 lelong &01 static object, 125>>18 lelong ^01 relocatable object, 126>18 lelong &010 stripped 127>18 lelong ^010 not stripped 128 129#------------------------------------------------------------------------------ 130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $ 131# adventure: file(1) magic for Adventure game files 132# 133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 136# 137# ALAN 138# I assume there are other, lower versions, but these are the only ones I 139# saw in the archive. 1400 beshort 0x0206 ALAN game data 141>2 byte <10 version 2.6%d 142 143 144# Infocom (see z-machine) 145#------------------------------------------------------------------------------ 146# Z-machine: file(1) magic for Z-machine binaries. 147# Sanity checks by David Griffith <dave@661.org> 148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 149# 150#http://www.gnelson.demon.co.uk/zspec/sect11.html 151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 152#https://en.wikipedia.org/wiki/Z-machine 153# The first byte is the Z-machine revision; it is always between 1 and 8. We 154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 155# well as an occasional MP3 file), so we sanity-check the version number. 156# 157# It might be possible to sanity-check the release number as well, as it seems 158# (at least in classic Infocom games) to always be a relatively small number, 159# always under 150 or so, but as this isn't rigorous, we'll wait on that until 160# it becomes clear that it's needed. 161# 1620 ubyte >0 163>0 ubyte <9 164>>16 belong&0xfe00f0f0 0x3030 165>>>0 ubyte < 10 166>>>>2 ubeshort x 167>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 168>>>>>>0 ubyte < 10 Infocom (Z-machine %d 169>>>>>>>2 ubeshort x \b, Release %d 170>>>>>>>>18 string >\0 \b, Serial %.6s 171>>>>>>>>18 string x \b) 172!:strength + 40 173!:mime application/x-zmachine 174 175#------------------------------------------------------------------------------ 176# Glulx: file(1) magic for Glulx binaries. 177# 178# David Griffith <dave@661.org> 179# I haven't checked for false matches yet. 180# 1810 string Glul Glulx game data 182>4 beshort x (Version %d 183>>6 byte x \b.%d 184>>8 byte x \b.%d) 185>36 string Info Compiled by Inform 186!:mime application/x-glulx 187 188 189# For Quetzal and blorb magic see iff 190 191 192# TADS (Text Adventure Development System) version 2 193# All files are machine-independent (games compile to byte-code) and are tagged 194# with a version string of the form "V2.<digit>.<digit>\0". 195# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1960 string TADS2\ bin TADS 197>9 belong !0x0A0D1A00 game data, CORRUPTED 198>9 belong 0x0A0D1A00 199>>13 string >\0 %s game data 200!:mime application/x-tads 201# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 2020 string TADS2\ rsc TADS 203>9 belong !0x0A0D1A00 resource data, CORRUPTED 204>9 belong 0x0A0D1A00 205>>13 string >\0 %s resource data 206!:mime application/x-tads 207# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 208# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 209# "TADS2 save\n\r\032\0" and the interpreter version. 2100 string TADS2\ save/g TADS 211>12 belong !0x0A0D1A00 saved game data, CORRUPTED 212>12 belong 0x0A0D1A00 213>>(16.s+32) string >\0 %s saved game data 214!:mime application/x-tads 215# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 216# version. 2170 string TADS2\ save TADS 218>10 belong !0x0A0D1A00 saved game data, CORRUPTED 219>10 belong 0x0A0D1A00 220>>14 string >\0 %s saved game data 221!:mime application/x-tads 222 223# TADS (Text Adventure Development System) version 3 224# Game files start with "T3-image\015\012\032" 2250 string T3-image\015\012\032 226>11 leshort x TADS 3 game data (format version %d) 227# Saved game files start with "T3-state-v####\015\012\032" 228# where #### is a format version number 2290 string T3-state-v 230>14 string \015\012\032 TADS 3 saved game data (format version 231>>10 byte x %c 232>>11 byte x \b%c 233>>12 byte x \b%c 234>>13 byte x \b%c) 235!:mime application/x-t3vm-image 236 237# edited by David Griffith <dave@661.org> 238# Danny Milosavljevic <danny.milo@gmx.net> 239# These are ADRIFT (adventure game standard) game files, extension .taf 240# Checked from source at (http://www.adrift.co/) and various taf files 241# found at the Interactive Fiction Archive (https://ifarchive.org/) 2420 belong 0x3C423FC9 243>4 belong 0x6A87C2CF Adrift game file version 244>>8 belong 0x94453661 3.80 245>>8 belong 0x94453761 3.90 246>>8 belong 0x93453E61 4.0 247>>8 belong 0x92453E61 5.0 248>>8 default x unknown 249!:mime application/x-adrift 250 251#------------------------------------------------------------------------------ 252# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $ 253# 254# aes: magic file for AES encrypted files 255 256# Summary: AES Crypt Encrypted Data File 257# From: Joerg Jenderek 258# URL: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard 259# Reference: https://www.aescrypt.com/aes_file_format.html 2600 string AES 261>3 ubyte <3 AES encrypted data, version %u 262#!:mime application/aes 263!:mime application/x-aes-encrypted 264!:ext aes 265# For Version 2 the encrypted file can have text tags 266>>3 ubyte =2 267# length of an extension identifier and contents like: 0 24 33 38 268#>>5 ubeshort x \b, tag length %u 269#>>5 pstring/H x '%s' 270# standard extension tags like CREATED_BY 271>>>7 string CREATED_BY \b, created by 272# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ... 273>>>>&1 string x "%s" 274# TODO: more other tags 275# tag CREATED_DATE like YYYY-MM-DD 276# tag CREATED_TIME like HH:MM:SS 277# 278 279 280#------------------------------------------------------------------------------ 281# $File: algol68,v 1.4 2021/08/15 06:00:55 christos Exp $ 282# algol68: file(1) magic for Algol 68 source 283# 284# URL: https://en.wikipedia.org/wiki/ALGOL_68 285# Reference: http://www.softwarepreservation.org/projects/ALGOL/report/Algol68_revised_report-AB.pdf 286# Update: Joerg Jenderek 2870 search/8192 (input, 288>0 use algol_68 289# graph_2d.a68 2900 regex/4006 \^PROC 291#>&-4 string x \b, dBase or Algol "%s" 292# most xBase scripts *.prg with PROCEDURE like: Areacode BarCount Def_mens Vendors 293#>&-4 string =PROCEDURE \b, dBase PROCEDURE 294# skip xBase program scripts *.prg with PROCEDURE keyword 295# keyword proc probably followed by white space used to specify algol procedures 296>&-4 string !PROCEDURE 297>>0 use algol_68 2980 regex/1024 \bMODE[\t\ ] 299>0 use algol_68 3000 regex/1024 \bMODE[\t\ ] 301>0 use algol_68 3020 regex/1024 \bREF[\t\ ] 303>0 use algol_68 3040 regex/1024 \bFLEX[\t\ ]\*\\[ 305>0 use algol_68 306 307# display information like mime type and file name extension of Algol 68 source text 3080 name algol_68 Algol 68 source text 309!:mime text/x-Algol68 310# https://file-extension.net/seeker/file_extension_a68 311!:ext a68 312#!:ext a68/alg 313 314#0 regex [\t\ ]OD Algol 68 source text 315#>0 use algol_68 316#!:mime text/x-Algol68 317#0 regex [\t\ ]FI Algol 68 source text 318#>0 use algol_68 319#!:mime text/x-Algol68 320 321#------------------------------------------------------------------------------ 322# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 323# allegro: file(1) magic for Allegro datafiles 324# Toby Deshane <hac@shoelace.digivill.net> 325# 3260 belong 0x736C6821 Allegro datafile (packed) 3270 belong 0x736C682E Allegro datafile (not packed/autodetect) 3280 belong 0x736C682B Allegro datafile (appended exe data) 329 330#------------------------------------------------------------------------------ 331# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 332# alliant: file(1) magic for Alliant FX series a.out files 333# 334# If the FX series is the one that had a processor with a 68K-derived 335# instruction set, the "short" should probably become "beshort" and the 336# "long" should probably become "belong". 337# If it's the i860-based one, they should probably become either the 338# big-endian or little-endian versions, depending on the mode they ran 339# the 860 in.... 340# 3410 short 0420 0420 Alliant virtual executable 342>2 short &0x0020 common library 343>16 long >0 not stripped 3440 short 0421 0421 Alliant compact executable 345>2 short &0x0020 common library 346>16 long >0 not stripped 347 348#------------------------------------------------------------------------------ 349# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $ 350# amanda: file(1) magic for amanda file format 351# 3520 string AMANDA:\ AMANDA 353>8 string TAPESTART\ DATE tape header file, 354>>23 string X 355>>>25 string >\ Unused %s 356>>23 string >\ DATE %s 357>8 string FILE\ dump file, 358>>13 string >\ DATE %s 359 360#------------------------------------------------------------------------------ 361# $File: amigaos,v 1.20 2021/09/20 00:42:19 christos Exp $ 362# amigaos: file(1) magic for AmigaOS binary formats: 363 364# 365# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 366# 3670 belong 0x000003fa AmigaOS shared library 3680 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 3690 belong 0x000003e7 AmigaOS object/library data 370# 3710 beshort 0xe310 Amiga Workbench 372>2 beshort 1 373>>48 byte 1 disk icon 374>>48 byte 2 drawer icon 375>>48 byte 3 tool icon 376>>48 byte 4 project icon 377>>48 byte 5 garbage icon 378>>48 byte 6 device icon 379>>48 byte 7 kickstart icon 380>>48 byte 8 workbench application icon 381>2 beshort >1 icon, vers. %d 382# 383# various sound formats from the Amiga 384# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 385# 3860 string FC14 Future Composer 1.4 Module sound file 3870 string SMOD Future Composer 1.3 Module sound file 3880 string AON4artofnoise Art Of Noise Module sound file 3891 string MUGICIAN/SOFTEYES Mugician Module sound file 39058 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3910 string Synth4.0 Synthesis Module sound file 3920 string ARP. The Holy Noise Module sound file 3930 string BeEp\0 JamCracker Module sound file 3940 string COSO\0 Hippel-COSO Module sound file 395# Too simple (short, pure ASCII, deep), MPi 396#26 string V.3 Brian Postma's Soundmon Module sound file v3 397#26 string BPSM Brian Postma's Soundmon Module sound file v3 398#26 string V.2 Brian Postma's Soundmon Module sound file v2 399 400# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 401# Update: Joerg Jenderek 402# URL: http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font 403# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga.trid.xml 404# https://wiki.amigaos.net/wiki/Graphics_Library_and_Text 405# fch_FileID=FCH_ID=0x0f00 4060 beshort 0x0f00 407# skip some AVM powerline firmware images by check for positive number of font elements 408# https://download.avm.de/fritzpowerline/fritzpowerline-1000e-t/other/fritz.os/fritz.powerline_1000ET_01_05.image 409>2 ubeshort >0 AmigaOS bitmap font 410#!:mime application/octet-stream 411!:mime font/x-amiga-font 412!:ext font 413# struct FontContents fch_FC; 1st fc_FileName [MAXFONTPATH=256]; ~ filename "/" fc_YSize 414# like: topazb/6 suits/8 Excel/9e emerald/17 Franklin/23 DIAMONDS/60.8C 415>>4 string x "%.256s" 416# fc_YSize ~number after slash in fc_FileName; like: 6 7 8 9 11 12 16 17 21 23 45 60 417>>260 beshort x \b, fc_YSize %u 418# fch_NumEntries; number of FontContents elements like: 419# 1 (often) 2 3 (IconCondensed.font tempfont.font) 4 (Franklin.font) 6 (mcoop.font) 420>>2 ubeshort >1 \b, %u elements 421#>>2 beshort x \b, %u element 422# plural s 423#>>2 beshort !1 \bs 424# like: 6 7 8 9 11 12 16 17 21 23 45 60 425#>>262 beshort x \b, FLAGS_STYLE 426>>2 beshort >1 \b, 2nd 427# 2nd fc_FileName like: Franklin/36 428>>>264 string x "%.256s" 429>>2 beshort >2 \b, 3rd 430# 3rd fc_FileName like: Franklin/18 431>>>524 string x "%.256s" 432# URL: http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font 433# Reference: https://wiki.amigaos.net/wiki/Graphics_Library_and_Text 434# http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga-var2.trid.xml 435# Note: called by TrID "Amiga bitmap Font (var.2)" 436# fch_FileID=TFCH_ID=0x0f02 4370 beshort 0x0f02 438# skip possible misidentified foo by check for positive number of font elements 439>2 ubeshort >0 AmigaOS bitmap font (TFCH) 440#!:mime application/octet-stream 441!:mime font/x-amiga-font 442!:ext font 443# struct TFontContents fch_TFC[]; 1st tfc_FileName [254]; ~ filename "/" fc_YSize 444# like: Abbey/45 XScript/75 XTriumvirate/45 445>>4 string x "%.254s" 446# tfc_TagCount; including the TAG_END tag like: 4 447>>258 ubeshort x \b, tfc_TagCount %u 448# tfc_YSize ~number after slash in tfc_FileName; like: 45 75 449>>260 beshort x \b, tfc_YSize %u 450# tfc_Style; tfc_Flags like: 8022h 8222h 451#>>262 ubeshort x \b, FLAGS_STYLE %#x 452# fch_NumEntries; number of FontContents elements like: 1 (abbey.font) 2 (xscript.font xtriumvirate.font) 453>>2 ubeshort >1 \b, %u elements 454>>2 beshort >1 \b, 2nd 455# 2nd tfc_FileName like: XScript/45 XTriumvirate/30 456>>>264 string x "%.254s" 4570 beshort 0x0f03 AmigaOS outline font 4580 belong 0x80001001 AmigaOS outline tag 4590 string ##\ version catalog translation 4600 string EMOD\0 Amiga E module 4618 string ECXM\0 ECX module 4620 string/c @database AmigaGuide file 463 464# Amiga disk types 465# display information like volume name of root block on Amiga (floppy) disk 4660 name adf-rootblock 467# block primary type = T_HEADER (value 2) 468>0x000 ubelong !2 \b, type %u 469# header_key; unused in rootblock (value 0) 470>0x004 ubelong !0 \b, header_key %u 471# high_seq; unused (value 0) 472>0x008 ubelong !0 \b, high_seq %u 473# ht_size; hash table size; 0x48 for flopies 474>0x00c ubelong !0x48 \b, hash table size %#x 475# bm_flag; bitmap flag, -1 means VALID 476>0x138 belong !-1 \b, bitmap flag %#x 477# bm_ext; first bitmap extension block (Hard disks only) 478>0x1A0 ubelong !0 \b, bitmap extension block %#x 479# name_len; volume name length; diskname[30]; volume name 480>0x1B0 pstring >\0 \b, "%s" 481# first directory cache block for FFS; otherwise 0 482>0x1F8 ubelong !0 \b, directory cache block %#x 483# block secondary type = ST_ROOT (value 1) 484>0x1FC ubelong !1 \b, sec_type %#x 485# 4860 string RDSK Rigid Disk Block 487>160 string x on %.24s 488# URL: http://fileformats.archiveteam.org/wiki/ADF_(Amiga) 489# https://en.wikipedia.org/wiki/Amiga_Fast_File_System 490# Reference: http://lclevy.free.fr/adflib/adf_info.html 491# Update: Joerg Jenderek 492# Note: created by ADFOpus.exe 493# and verified by `unadf -l TURBO_SILVER_SV.ADF` 4940 string DOS 495# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG 496>3 ubyte <8 Amiga 497# https://reposcope.com/mimetype/application/x-amiga-disk-format 498!:mime application/x-amiga-disk-format 499!:ext adf 500>>3 ubyte 0 DOS disk 501>>3 ubyte 1 FFS disk 502>>3 ubyte 2 Inter DOS disk 503>>3 ubyte 3 Inter FFS disk 504# For Fastdir mode the international mode is also enabled, 505>>3 ubyte 4 Fastdir DOS disk 506>>3 ubyte 5 Fastdir FFS dis 507# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)" 508>>3 ubyte 6 Inter Fastdir DOS disk 509# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)" 510>>3 ubyte 7 Inter Fastdir FFS disk 511# but according to Wikipedia variants with long name support 512#>>3 ubyte 6 long name DOS disk 513#>>3 ubyte 7 long name FFS disk 514# DOES NOT only work! Partly for file size ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h 515#>>-0 offset x \b, %lld bytes 516# Correct file size, but next lines are NOT executed 517#>>-0 offset 901120 (DD 880 KiB floppy) 518# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2 519>>0x6E00C ubelong 0x48 520>>>0x6E000 ubelong 2 (DD 880 KiB) 521# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48 522>>0xDC00C ubelong 0x48 523>>>0xDC000 ubelong 2 (HD 1760 KiB) 524# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ... 525#>>4 ubelong x \b, CRC %#x 526# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF) 527>>8 ubelong >0 \b, probably root block %d 528# bootblock code 529>>12 quad !0 \b, bootable 530# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6) 531>>>12 ubequad =0x43fa003e70254eae AmigaDOS 3.0 532>>>12 default x 533>>>>12 ubequad !0x43fa003e70254eae %#llx.. 534# 880 KiB Double Density floppy disk (901120 bytes) 535>>0x6E00C ubelong 0x48 536>>>0x6E000 ubelong 2 537>>>>0x6E000 use adf-rootblock 538# 1760 KiB High Density floppy disk (1802240 bytes) 539>>0xDC00C ubelong 0x48 540>>>0xDC000 ubelong 2 541>>>>0xDC000 use adf-rootblock 542# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq 543>>0x80000 ubelong 2 544>>>0x80004 quad 0 545>>>>0x80000 use adf-rootblock 546# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB 547#>>0x100000 ubelong x 2 MiB TEST 548#>>0x100000 ubelong 2 \b, 2 MiB hard disc rootblock 549#>>>0x100000 use adf-rootblock 5500 string KICK Kickstart disk 551 552# From: Alex Beregszaszi <alex@fsn.hu> 5530 string LZX LZX compressed archive (Amiga) 554 555# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 5560 string .KEY AmigaDOS script 5570 string .key AmigaDOS script 558 559# AMOS Basic file formats 560# https://www.exotica.org.uk/wiki/AMOS_file_formats 5610 string AMOS\040Basic\040 AMOS Basic source code 562>11 byte =0x56 \b, tested 563>11 byte =0x76 \b, untested 5640 string AMOS\040Pro AMOS Basic source code 565>11 byte =0x56 \b, tested 566>11 byte =0x76 \b, untested 5670 string AmSp AMOS Basic sprite bank 568>4 beshort x \b, %d sprites 5690 string AmIc AMOS Basic icon bank 570>4 beshort x \b, %d icons 5710 string AmBk AMOS Basic memory bank 572>4 beshort x \b, bank number %d 573>8 belong&0xFFFFFFF x \b, length %d 574>12 regex .{8} \b, type %s 5750 string AmBs AMOS Basic memory banks 576>4 beshort x \b, %d banks 577 578#------------------------------------------------------------ 579# $File: android,v 1.19 2021/04/26 15:56:00 christos Exp $ 580# Various android related magic entries 581#------------------------------------------------------------ 582 583# Dalvik .dex format. http://retrodev.com/android/dexformat.html 584# From <mkf@google.com> "Mike Fleming" 585# Fixed to avoid regexec 17 errors on some dex files 586# From <diff@lookout.com> "Tim Strazzere" 5870 string dex\n 588>0 regex dex\n[0-9]{2}\0 Dalvik dex file 589>4 string >000 version %s 5900 string dey\n 591>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 592>4 string >000 version %s 593 594# Android bootimg format 595# From https://android.googlesource.com/\ 596# platform/system/core/+/master/mkbootimg/bootimg.h 597# https://github.com/djrbliss/loki/blob/master/loki.h#L43 5980 string ANDROID! Android bootimg 599>1024 string LOKI \b, LOKI'd 600>>1028 lelong 0 \b (boot) 601>>1028 lelong 1 \b (recovery) 602>8 lelong >0 \b, kernel 603>>12 lelong >0 \b (%#x) 604>16 lelong >0 \b, ramdisk 605>>20 lelong >0 \b (%#x) 606>24 lelong >0 \b, second stage 607>>28 lelong >0 \b (%#x) 608>36 lelong >0 \b, page size: %d 609>38 string >0 \b, name: %s 610>64 string >0 \b, cmdline (%s) 611 612# Android Backup archive 613# From: Ariel Shkedi 614# Update: Joerg Jenderek 615# URL: https://github.com/android/platform_frameworks_base/blob/\ 616# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 617# android/server/BackupManagerService.java#L2367 618# Reference: https://sourceforge.net/projects/adbextractor/ 619# android-backup-extractor/perl/backupencrypt.pl 620# Note: only unix line feeds "\n" found 621# After the header comes a tar file 622# If compressed, the entire tar file is compressed with JAVA deflate 623# 624# Include the version number hardcoded with the magic string to avoid 625# false positives 6260 string/b ANDROID\ BACKUP\n Android Backup 627# maybe look for some more characteristics like linefeed '\n' or version 628#>16 string \n 629# No mime-type defined officially 630!:mime application/x-google-ab 631!:ext ab 632# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) 633>15 string >\0 \b, version %s 634# "1" on 3rd line means compressed 635>17 string 0\n \b, Not-Compressed 636>17 string 1\n \b, Compressed 637# The 4th line is encryption "none" or "AES-256" 638# any string as long as it's not the word none (which is matched below) 639>19 string none\n \b, Not-Encrypted 640# look for backup content after line with encryption info 641#>>19 search/7 \n 642# data part after header for not encrypted Android Backup 643#>>>&0 ubequad x \b, content %#16.16llx... 644# look for zlib compressed by ./compress after message with 1 space at end 645#>>>&0 indirect x \b; contains 646# look for tar archive block by ./archive for package name manifest 647>>288 string ustar \b; contains 648>>>31 use tar-file 649# look for zip/jar archive by ./archive ./zip after message with 1 space at end 650#>>2079 search/1025/s PK\003\004 \b; contains 651#>>>&0 indirect x 652>19 string !none 653>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 654# Commented out because they don't seem useful to print 655# (but they are part of the header - the tar file comes after them): 656# The 5th line is User Password Salt (128 Hex) 657# string length too high with standard src configuration 658#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s" 659#>>>&1 regex/1l .* \b, Password salt: %s 660# The 6th line is Master Key Checksum Salt (128 Hex) 661#>>>>&1 regex/1l .* \b, Master salt: %s 662# The 7th line is Number of PBDKF2 Rounds (10000) 663#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 664# The 8th line is User key Initialization Vector (IV) (32 Hex) 665#>>>>>>&1 regex/1l .* \b, IV: %s 666#>>>>>>&1 regex/1l .* \b, IV: %s 667# The 9th line is Master IV+Key+Checksum (192 Hex) 668#>>>>>>>&1 regex/1l .* \b, Key: %s 669# look for new line separator char after line number 9 670#>>>0x204 ubyte 0x0a NL found 671#>>>>&1 ubequad x \b, Content magic %16.16llx 672 673# *.pit files by Joerg Jenderek 674# https://forum.xda-developers.com/showthread.php?p=9122369 675# https://forum.xda-developers.com/showthread.php?t=816449 676# Partition Information Table for Samsung's smartphone with Android 677# used by flash software Odin 6780 ulelong 0x12349876 679# 1st pit entry marker 680>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 681# minimal 13 and maximal 18 PIT entries found 682>>4 ulelong <128 Partition Information Table for Samsung smartphone 683>>>4 ulelong x \b, %d entries 684# 1. pit entry 685>>>4 ulelong >0 \b; #1 686>>>0x01C use PIT-entry 687>>>4 ulelong >1 \b; #2 688>>>0x0A0 use PIT-entry 689>>>4 ulelong >2 \b; #3 690>>>0x124 use PIT-entry 691>>>4 ulelong >3 \b; #4 692>>>0x1A8 use PIT-entry 693>>>4 ulelong >4 \b; #5 694>>>0x22C use PIT-entry 695>>>4 ulelong >5 \b; #6 696>>>0x2B0 use PIT-entry 697>>>4 ulelong >6 \b; #7 698>>>0x334 use PIT-entry 699>>>4 ulelong >7 \b; #8 700>>>0x3B8 use PIT-entry 701>>>4 ulelong >8 \b; #9 702>>>0x43C use PIT-entry 703>>>4 ulelong >9 \b; #10 704>>>0x4C0 use PIT-entry 705>>>4 ulelong >10 \b; #11 706>>>0x544 use PIT-entry 707>>>4 ulelong >11 \b; #12 708>>>0x5C8 use PIT-entry 709>>>4 ulelong >12 \b; #13 710>>>>0x64C use PIT-entry 711# 14. pit entry 712>>>4 ulelong >13 \b; #14 713>>>>0x6D0 use PIT-entry 714>>>4 ulelong >14 \b; #15 715>>>0x754 use PIT-entry 716>>>4 ulelong >15 \b; #16 717>>>0x7D8 use PIT-entry 718>>>4 ulelong >16 \b; #17 719>>>0x85C use PIT-entry 720# 18. pit entry 721>>>4 ulelong >17 \b; #18 722>>>0x8E0 use PIT-entry 723 7240 name PIT-entry 725# garbage value implies end of pit entries 726>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 727# skip empty partition name 728>>0x24 ubyte !0 729# partition name 730>>>0x24 string >\0 %-.32s 731# flags 732>>>0x0C ulelong&0x00000002 2 \b+RW 733# partition ID: 734# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER 735# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 736>>>0x08 ulelong x (%#x) 737# filename 738>>>0x44 string >\0 "%-.64s" 739#>>>0x18 ulelong >0 740# blocksize in 512 byte units ? 741#>>>>0x18 ulelong x \b, %db 742# partition size in blocks ? 743#>>>>0x22 ulelong x \b*%d 744 745# Android sparse img format 746# From https://android.googlesource.com/\ 747# platform/system/core/+/master/libsparse/sparse_format.h 7480 lelong 0xed26ff3a Android sparse image 749>4 leshort x \b, version: %d 750>6 leshort x \b.%d 751>16 lelong x \b, Total of %d 752>12 lelong x \b %d-byte output blocks in 753>20 lelong x \b %d input chunks. 754 755# Android binary XML magic 756# In include/androidfw/ResourceTypes.h: 757# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), 758# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 7590 lelong 0x00080003 Android binary XML 760 761# Android cryptfs footer 762# From https://android.googlesource.com/\ 763# platform/system/vold/+/refs/heads/master/cryptfs.h 7640 lelong 0xd0b5b1c4 Android cryptfs footer 765>4 leshort x \b, version: %d 766>6 leshort x \b.%d 767 768# Android Vdex format 769# From https://android.googlesource.com/\ 770# platform/art/+/master/runtime/vdex_file.h 7710 string vdex Android vdex file, 772>4 string >000 verifier deps version: %s, 773>8 string >000 dex section version: %s, 774>12 lelong >0 number of dex files: %d, 775>16 lelong >0 verifier deps size: %d 776 777# Android Vdex format, dexfile is currently being updated 778# by android system 779# From https://android.googlesource.com/\ 780# platform/art/+/master/dex2oat/dex2oat.cc 7810 string wdex Android vdex file, being processed by dex2oat, 782>4 string >000 verifier deps version: %s, 783>8 string >000 dex section version: %s, 784>12 lelong >0 number of dex files: %d, 785>16 lelong >0 verifier deps size: %d 786 787#------------------------------------------------------------------------------ 788# $File: animation,v 1.90 2022/08/16 11:16:39 christos Exp $ 789# animation: file(1) magic for animation/movie formats 790# 791# animation formats 792# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 793# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 794 795# SGI and Apple formats 7960 string MOVI Silicon Graphics movie file 797!:mime video/x-sgi-movie 7984 string moov Apple QuickTime 799!:mime video/quicktime 800>12 string mvhd \b movie (fast start) 801>12 string mdra \b URL 802>12 string cmov \b movie (fast start, compressed header) 803>12 string rmra \b multiple URLs 8044 string mdat Apple QuickTime movie (unoptimized) 805!:mime video/quicktime 806#4 string wide Apple QuickTime movie (unoptimized) 807#!:mime video/quicktime 808#4 string skip Apple QuickTime movie (modified) 809#!:mime video/quicktime 810#4 string free Apple QuickTime movie (modified) 811#!:mime video/quicktime 8124 string idsc Apple QuickTime image (fast start) 813!:mime image/x-quicktime 814#4 string idat Apple QuickTime image (unoptimized) 815#!:mime image/x-quicktime 8164 string pckg Apple QuickTime compressed archive 817!:mime application/x-quicktime-player 818 819#### MP4 #### 820# https://www.ftyps.com/ with local additions 821# https://cconcolato.github.io/mp4ra/filetype.html 8224 string ftyp ISO Media 823# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ 824>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec 825>>96 string x \b, Audio "%.4s" 826>>118 beshort x at %dHz 827>>140 string x \b, Video "%.4s" 828>>168 beshort x %d 829>>170 beshort x \bx%d 830>8 string 3g2 \b, MPEG v4 system, 3GPP2 831!:mime video/3gpp2 832>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 833>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 834>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 835# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf 836# Section 8.1.1, corresponds to a, b, c 837>>11 byte 0x61 \b C.S0050-0 V1.0 838>>11 byte 0x62 \b C.S0050-0-A V1.0.0 839>>11 byte 0x63 \b C.S0050-0-B V1.0 840>8 string 3ge \b, MPEG v4 system, 3GPP 841!:mime video/3gpp 842>>11 byte 6 \b, Release %d MBMS Extended Presentations 843>>11 byte 7 \b, Release %d MBMS Extended Presentations 844>>11 byte 9 \b, Release %d MBMS Extended Presentations 845>8 string 3gf \b, MPEG v4 system, 3GPP 846>>11 byte 9 \b, Release %d File-delivery profile 847>8 string 3gg \b, MPEG v4 system, 3GPP 848!:mime video/3gpp 849>>11 byte 6 \b, Release %d General Profile 850>>11 byte 9 \b, Release %d General Profile 851>8 string 3gh \b, MPEG v4 system, 3GPP 852!:mime video/3gpp 853>>11 byte 9 \b, Release %d Adaptive Streaming Profile 854>8 string 3gm \b, MPEG v4 system, 3GPP 855!:mime video/3gpp 856>>11 byte 9 \b, Release %d Media Segment Profile 857>8 string 3gp \b, MPEG v4 system, 3GPP 858!:mime video/3gpp 859>>11 byte 1 \b, Release %d (non existent) 860>>11 byte 2 \b, Release %d (non existent) 861>>11 byte 3 \b, Release %d (non existent) 862>>11 byte 4 \b, Release %d 863>>11 byte 5 \b, Release %d 864>>11 byte 6 \b, Release %d 865>>11 byte 7 \b, Release %d Streaming Servers 866>8 string 3gr \b, MPEG v4 system, 3GPP 867!:mime video/3gpp 868>>11 byte 6 \b, Release %d Progressive Download Profile 869>>11 byte 9 \b, Release %d Progressive Download Profile 870>8 string 3gs \b, MPEG v4 system, 3GPP 871!:mime video/3gpp 872>>11 byte 6 \b, Release %d Streaming Servers 873>>11 byte 7 \b, Release %d Streaming Servers 874>>11 byte 9 \b, Release %d Streaming Servers 875>8 string 3gt \b, MPEG v4 system, 3GPP 876!:mime video/3gpp 877>>11 byte 8 \b, Release %d Media Stream Recording Profile 878>>11 byte 9 \b, Release %d Media Stream Recording Profile 879>8 string ARRI \b, MPEG v4 system, ARRI Digital Camera 880!:mime video/mp4 881>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 882!:mime video/mp4 883>8 string bbxm \b, Blinkbox Master File: H.264 video/16-bit LE LPCM audio 884!:mime video/mp4 885>8 string/W qt \b, Apple QuickTime movie 886!:mime video/quicktime 887>8 string CAEP \b, Canon Digital Camera 888>8 string caqv \b, Casio Digital Camera 889>8 string CDes \b, Convergent Design 890>8 string caaa \b, CMAF Media Profile - AAC Adaptive Audio 891>8 string caac \b, CMAF Media Profile - AAC Core 892>8 string caqv \b, Casio Digital Camera Casio 893>8 string ccea \b, CMAF Supplemental Data - CEA-608/708 894>8 string ccff \b, Common container file format 895>8 string cfhd \b, CMAF Media Profile - AVC HD 896>8 string cfsd \b, CMAF Media Profile - AVC SD 897>8 string chd1 \b, CMAF Media Profile - HEVC HDR10 898>8 string chdf \b, CMAF Media Profile - AVC HDHF 899>8 string chhd \b, CMAF Media Profile - HEVC HHD8 900>8 string chh1 \b, CMAF Media Profile - HEVC HHD10 901>8 string clg1 \b, CMAF Media Profile - HEVC HLG10 902>8 string cmfc \b, CMAF Track Format 903>8 string cmff \b, CMAF Fragment Format 904>8 string cmfl \b, CMAF Chunk Format 905>8 string cmfs \b, CMAF Segment Format 906>8 string cud1 \b, CMAF Media Profile - HEVC UHD10 907>8 string cud8 \b, CMAF Media Profile - HEVC UHD8 908>8 string cwvt \b, CMAF Media Profile - WebVTT 909>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 910>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 911>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 912>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 913>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 914>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 915>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 916>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 917>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP 918!:mime video/mp4 919>8 string dby1 \b, MP4 files with Dolby content 920>8 string dsms \b, Media Segment DASH conformant 921>8 string dts1 \b, MP4 track file with audio codecs dtsc dtsh or dtse 922>8 string dts2 \b, MP4 track file with audio codec dtsx 923>8 string dts3 \b, MP4 track file with audio codec dtsy 924>8 string dxo$20 \b, DxO ONE camera 925>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 926>8 string dmpf \b, Digital Media Project 927>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 928>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 929>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 930>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 931>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 932>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 933>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 934>8 string dvr1 \b, DVB (.DVB) over RTP 935!:mime video/vnd.dvb.file 936>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 937>8 string emsg \b, Event message box present 938!:mime video/vnd.dvb.file 939>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 940!:mime video/mp4 941>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 942!:mime video/mp4 943>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 944!:mime audio/mp4 945>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 946!:mime audio/mp4 947>8 string ifrm \b, Apple iFrame Specification, Version 8.1 Jan 2013 948>8 string im1i \b, CMAF Media Profile - IMSC1 Image 949>8 string im1t \b, CMAF Media Profile - IMSC1 Text 950>8 string isc2 \b, ISMACryp 2.0 Encrypted File 951# ?/enc-isoff-generic 952>8 string iso \b, MP4 Base Media 953!:mime video/mp4 954!:ext mp4 955>>11 string m v1 [ISO 14496-12:2003] 956>>11 string 2 v2 [ISO 14496-12:2005] 957>>11 string 4 v4 958>>11 string 5 v5 959>>11 string 6 v6 960>8 string isml \b, MP4 Base Media v2 [ISO 14496-12:2005] 961!:mime video/mp4 962>8 string J2P0 \b, JPEG2000 Profile 0 963>8 string J2P1 \b, JPEG2000 Profile 1 964>8 string/W jp2 \b, JPEG 2000 965!:mime image/jp2 966>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 967!:mime image/jp2 968>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 969>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 970!:mime image/jpm 971>8 string jpsi \b, The JPSearch data interchange format 972>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 973!:mime image/jpx 974>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 975!:mime video/3gpp2 976>8 string LCAG \b, Leica digital camera 977>8 string lmsg \b, Last Media Segment indicator for ISO base media file format. 978>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 979!:mime audio/x-m4a 980>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 981!:mime audio/mp4 982>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 983!:mime video/mp4 984>8 string M4V \b, Apple iTunes Video (.M4V) Video 985!:mime video/x-m4v 986>8 string M4VH \b, Apple TV (.M4V) 987!:mime video/x-m4v 988>8 string M4VP \b, Apple iPhone (.M4V) 989!:mime video/x-m4v 990>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 991!:mime video/mj2 992>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 993>8 string MFSM \b, Media File for Samsung video Metadata 994>8 string MGSV \b, Sony Home and Mobile Multimedia Platform (HMMP) 995!:mime video/mj2 996>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 997!:mime video/mp4 998>8 string mobi \b, MPEG-4, MOBI format 999!:mime video/mp4 1000>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 1001>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 1002!:mime video/mp4 1003>8 string mp42 \b, MP4 v2 [ISO 14496-14] 1004!:mime video/mp4 1005>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 1006>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 1007>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 1008>8 string mpuf \b, Compliance with the MMT Processing Unit format 1009>8 string msdh \b, Media Segment conforming to ISO base media file format. 1010>8 string msix \b, Media Segment conforming to ISO base media file format. 1011>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 1012!:mime video/mp4 1013>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 1014>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 1015!:mime video/quicktime 1016>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 1017!:mime audio/mp4 1018>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 1019!:mime audio/mp4 1020>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 1021!:mime video/mp4 1022>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 1023!:mime video/mp4 1024>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 1025!:mime video/mp4 1026>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 1027!:mime video/mp4 1028>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 1029!:mime video/mp4 1030>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 1031!:mime video/mp4 1032>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 1033!:mime video/mp4 1034>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 1035!:mime video/mp4 1036>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 1037!:mime video/mp4 1038>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 1039>8 string niko \b, Nikon Digital Camera 1040!:mime video/mp4 1041>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 1042>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 1043>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 1044>8 string pana \b, Panasonic Digital Camera 1045>8 string piff \b, Protected Interoperable File Format 1046>8 string pnvi ]b, Panasonic Video Intercom 1047>8 string qt \b, Apple QuickTime (.MOV/QT) 1048!:mime video/quicktime 1049# HEIF image format 1050# see https://nokiatech.github.io/heif/technical.html 1051>8 string mif1 \b, HEIF Image 1052!:mime image/heif 1053>8 string msf1 \b, HEIF Image Sequence 1054!:mime image/heif-sequence 1055>8 string heic \b, HEIF Image HEVC Main or Main Still Picture Profile 1056!:mime image/heic 1057>8 string heix \b, HEIF Image HEVC Main 10 Profile 1058!:mime image/heic 1059>8 string hevc \b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile 1060!:mime image/heic-sequence 1061>8 string hevx \b, HEIF Image Sequence HEVC Main 10 Profile 1062!:mime image/heic-sequence 1063# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017) 1064# but used in the reference implementation: 1065# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp 1066>8 string heim \b, HEIF Image L-HEVC 1067!:mime image/heif 1068>8 string heis \b, HEIF Image L-HEVC 1069!:mime image/heif 1070>8 string avic \b, HEIF Image AVC 1071!:mime image/heif 1072>8 string hevm \b, HEIF Image Sequence L-HEVC 1073!:mime image/heif-sequence 1074>8 string hevs \b, HEIF Image Sequence L-HEVC 1075!:mime image/heif-sequence 1076>8 string avcs \b, HEIF Image Sequence AVC 1077!:mime image/heif-sequence 1078# AVIF image format 1079# see https://aomediacodec.github.io/av1-avif/ 1080>8 string avif \b, AVIF Image 1081!:mime image/avif 1082>8 string avis \b, AVIF Image Sequence 1083!:mime image/avif 1084>8 string risx \b, Representation Index Segment for MPEG-2 TS Segments 1085>8 string ROSS \b, Ross Video 1086>8 string sdv \b, SD Memory Card Video 1087>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 1088>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 1089>8 string SEAU \b, Sony Home and Mobile Multimedia Platform (HMMP) 1090>8 string SEBK \b, Sony Home and Mobile Multimedia Platform (HMMP) 1091>8 string senv \b, Video contents Sony Entertainment Network 1092>8 string sims \b, Media Segment for Sub-Indexed Media Segment format 1093>8 string sisx \b, Single Index Segment forindex MPEG-2 TS 1094>8 string ssss \b, Subsegment Index Segment used to index MPEG-2 Segments 1095>8 string uvvu \b, UltraViolet file brand for DECE Common Format 1096 1097# MPEG sequences 1098# Scans for all common MPEG header start codes 10990 belong 0x00000001 1100>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 1101>>5 byte 66 \b, baseline 1102>>5 byte 77 \b, main 1103>>5 byte 88 \b, extended 1104>>7 byte x \b @ L %u 11050 belong&0xFFFFFF00 0x00000100 1106>3 byte 0xBA MPEG sequence 1107!:mime video/mpeg 1108# http://fileformats.archiveteam.org/wiki/Enhanced_VOB 1109# https://reposcope.com/mimetype/video/mpeg 1110!:ext vob/evo/mpg/mpeg 1111>>4 byte &0x40 \b, v2, program multiplex 1112>>4 byte ^0x40 \b, v1, system multiplex 1113>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 1114>3 byte&0x1F 0x07 MPEG sequence, H.264 video 1115>>4 byte 66 \b, baseline 1116>>4 byte 77 \b, main 1117>>4 byte 88 \b, extended 1118>>6 byte x \b @ L %u 1119# GRR too general as it catches also FoxPro Memo example NG.FPT 1120>3 byte 0xB0 MPEG sequence, v4 1121# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 1122#>>4 byte !0 MPEG sequence, v4 1123!:mime video/mpeg4-generic 1124>>5 belong 0x000001B5 1125>>>9 byte &0x80 1126>>>>10 byte&0xF0 16 \b, video 1127>>>>10 byte&0xF0 32 \b, still texture 1128>>>>10 byte&0xF0 48 \b, mesh 1129>>>>10 byte&0xF0 64 \b, face 1130>>>9 byte&0xF8 8 \b, video 1131>>>9 byte&0xF8 16 \b, still texture 1132>>>9 byte&0xF8 24 \b, mesh 1133>>>9 byte&0xF8 32 \b, face 1134>>4 byte 1 \b, simple @ L1 1135>>4 byte 2 \b, simple @ L2 1136>>4 byte 3 \b, simple @ L3 1137>>4 byte 4 \b, simple @ L0 1138>>4 byte 17 \b, simple scalable @ L1 1139>>4 byte 18 \b, simple scalable @ L2 1140>>4 byte 33 \b, core @ L1 1141>>4 byte 34 \b, core @ L2 1142>>4 byte 50 \b, main @ L2 1143>>4 byte 51 \b, main @ L3 1144>>4 byte 53 \b, main @ L4 1145>>4 byte 66 \b, n-bit @ L2 1146>>4 byte 81 \b, scalable texture @ L1 1147>>4 byte 97 \b, simple face animation @ L1 1148>>4 byte 98 \b, simple face animation @ L2 1149>>4 byte 99 \b, simple face basic animation @ L1 1150>>4 byte 100 \b, simple face basic animation @ L2 1151>>4 byte 113 \b, basic animation text @ L1 1152>>4 byte 114 \b, basic animation text @ L2 1153>>4 byte 129 \b, hybrid @ L1 1154>>4 byte 130 \b, hybrid @ L2 1155>>4 byte 145 \b, advanced RT simple @ L! 1156>>4 byte 146 \b, advanced RT simple @ L2 1157>>4 byte 147 \b, advanced RT simple @ L3 1158>>4 byte 148 \b, advanced RT simple @ L4 1159>>4 byte 161 \b, core scalable @ L1 1160>>4 byte 162 \b, core scalable @ L2 1161>>4 byte 163 \b, core scalable @ L3 1162>>4 byte 177 \b, advanced coding efficiency @ L1 1163>>4 byte 178 \b, advanced coding efficiency @ L2 1164>>4 byte 179 \b, advanced coding efficiency @ L3 1165>>4 byte 180 \b, advanced coding efficiency @ L4 1166>>4 byte 193 \b, advanced core @ L1 1167>>4 byte 194 \b, advanced core @ L2 1168>>4 byte 209 \b, advanced scalable texture @ L1 1169>>4 byte 210 \b, advanced scalable texture @ L2 1170>>4 byte 211 \b, advanced scalable texture @ L3 1171>>4 byte 225 \b, simple studio @ L1 1172>>4 byte 226 \b, simple studio @ L2 1173>>4 byte 227 \b, simple studio @ L3 1174>>4 byte 228 \b, simple studio @ L4 1175>>4 byte 229 \b, core studio @ L1 1176>>4 byte 230 \b, core studio @ L2 1177>>4 byte 231 \b, core studio @ L3 1178>>4 byte 232 \b, core studio @ L4 1179>>4 byte 240 \b, advanced simple @ L0 1180>>4 byte 241 \b, advanced simple @ L1 1181>>4 byte 242 \b, advanced simple @ L2 1182>>4 byte 243 \b, advanced simple @ L3 1183>>4 byte 244 \b, advanced simple @ L4 1184>>4 byte 245 \b, advanced simple @ L5 1185>>4 byte 247 \b, advanced simple @ L3b 1186>>4 byte 248 \b, FGS @ L0 1187>>4 byte 249 \b, FGS @ L1 1188>>4 byte 250 \b, FGS @ L2 1189>>4 byte 251 \b, FGS @ L3 1190>>4 byte 252 \b, FGS @ L4 1191>>4 byte 253 \b, FGS @ L5 1192>3 byte 0xB5 MPEG sequence, v4 1193!:mime video/mpeg4-generic 1194>>4 byte &0x80 1195>>>5 byte&0xF0 16 \b, video (missing profile header) 1196>>>5 byte&0xF0 32 \b, still texture (missing profile header) 1197>>>5 byte&0xF0 48 \b, mesh (missing profile header) 1198>>>5 byte&0xF0 64 \b, face (missing profile header) 1199>>4 byte&0xF8 8 \b, video (missing profile header) 1200>>4 byte&0xF8 16 \b, still texture (missing profile header) 1201>>4 byte&0xF8 24 \b, mesh (missing profile header) 1202>>4 byte&0xF8 32 \b, face (missing profile header) 1203>3 byte 0xB3 MPEG sequence 1204!:mime video/mpeg 1205>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1206>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1207>>12 belong 0x000001B5 \b, v2, 1208>>>16 byte&0x0F 1 \b HP 1209>>>16 byte&0x0F 2 \b Spt 1210>>>16 byte&0x0F 3 \b SNR 1211>>>16 byte&0x0F 4 \b MP 1212>>>16 byte&0x0F 5 \b SP 1213>>>17 byte&0xF0 64 \b@HL 1214>>>17 byte&0xF0 96 \b@H-14 1215>>>17 byte&0xF0 128 \b@ML 1216>>>17 byte&0xF0 160 \b@LL 1217>>>17 byte &0x08 \b progressive 1218>>>17 byte ^0x08 \b interlaced 1219>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 1220>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 1221>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 1222>>11 byte &0x02 1223>>>75 byte &0x01 1224>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1225>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1226>>>>140 belong 0x000001B5 \b, v2, 1227>>>>>144 byte&0x0F 1 \b HP 1228>>>>>144 byte&0x0F 2 \b Spt 1229>>>>>144 byte&0x0F 3 \b SNR 1230>>>>>144 byte&0x0F 4 \b MP 1231>>>>>144 byte&0x0F 5 \b SP 1232>>>>>145 byte&0xF0 64 \b@HL 1233>>>>>145 byte&0xF0 96 \b@H-14 1234>>>>>145 byte&0xF0 128 \b@ML 1235>>>>>145 byte&0xF0 160 \b@LL 1236>>>>>145 byte &0x08 \b progressive 1237>>>>>145 byte ^0x08 \b interlaced 1238>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 1239>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 1240>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 1241>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 1242>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 1243>>76 belong 0x000001B5 \b, v2, 1244>>>80 byte&0x0F 1 \b HP 1245>>>80 byte&0x0F 2 \b Spt 1246>>>80 byte&0x0F 3 \b SNR 1247>>>80 byte&0x0F 4 \b MP 1248>>>80 byte&0x0F 5 \b SP 1249>>>81 byte&0xF0 64 \b@HL 1250>>>81 byte&0xF0 96 \b@H-14 1251>>>81 byte&0xF0 128 \b@ML 1252>>>81 byte&0xF0 160 \b@LL 1253>>>81 byte &0x08 \b progressive 1254>>>81 byte ^0x08 \b interlaced 1255>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 1256>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 1257>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 1258>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 1259>>>7 byte&0xF0 0x10 \b, 16:9 1260>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 1261>>>7 byte&0xF0 0x10 \b, 16:9 1262>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 1263>>>7 byte&0xF0 0x10 \b, 4:3 1264>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 1265>>>5 beshort&0x0FFF 0x01E0 \b NTSC 1266>>>5 beshort&0x0FFF 0x0240 \b PAL 1267>>>7 byte&0xF0 0x20 \b, 4:3 1268>>>7 byte&0xF0 0x30 \b, 16:9 1269>>>7 byte&0xF0 0x40 \b, 11:5 1270>>>7 byte&0xF0 0x80 \b, PAL 4:3 1271>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 1272>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 1273>>>7 byte&0xF0 0x10 \b, 4:3 1274>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 1275>>>7 byte&0xF0 0x10 \b, 4:3 1276>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 1277>>>7 byte&0xF0 0x10 \b, 4:3 1278>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 1279>>>7 byte&0xF0 0x10 \b, 4:3 1280>>4 beshort&0xFFF0 0x1600 \b, CIF 1281>>>5 beshort&0x0FFF 0x00F0 \b NTSC 1282>>>5 beshort&0x0FFF 0x0120 \b PAL 1283>>>7 byte&0xF0 0x20 \b, 4:3 1284>>>7 byte&0xF0 0x30 \b, 16:9 1285>>>7 byte&0xF0 0x40 \b, 11:5 1286>>>7 byte&0xF0 0x80 \b, PAL 4:3 1287>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 1288>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1289>>>>7 byte&0xF0 0x20 \b, 4:3 1290>>>>7 byte&0xF0 0x30 \b, 16:9 1291>>>>7 byte&0xF0 0x40 \b, 11:5 1292>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 1293>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1294>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1295>>>7 byte&0xF0 0x20 \b, 4:3 1296>>>7 byte&0xF0 0x30 \b, 16:9 1297>>>7 byte&0xF0 0x40 \b, 11:5 1298>>4 beshort&0xFFF0 0x1E00 \b, SVCD 1299>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1300>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1301>>>7 byte&0xF0 0x20 \b, 4:3 1302>>>7 byte&0xF0 0x30 \b, 16:9 1303>>>7 byte&0xF0 0x40 \b, 11:5 1304>>7 byte&0x0F 1 \b, 23.976 fps 1305>>7 byte&0x0F 2 \b, 24 fps 1306>>7 byte&0x0F 3 \b, 25 fps 1307>>7 byte&0x0F 4 \b, 29.97 fps 1308>>7 byte&0x0F 5 \b, 30 fps 1309>>7 byte&0x0F 6 \b, 50 fps 1310>>7 byte&0x0F 7 \b, 59.94 fps 1311>>7 byte&0x0F 8 \b, 60 fps 1312>>11 byte &0x04 \b, Constrained 1313 1314# MPEG ADTS Audio (*.mpx/mxa/aac) 1315# from dreesen@math.fu-berlin.de 1316# modified to fully support MPEG ADTS 1317 1318# MP3, M1A 1319# modified by Joerg Jenderek 1320# GRR the original test are too common for many DOS files 1321# so don't accept as MP3 until we've tested the rate 1322# But also beat GEMDOS fonts 13230 beshort&0xFFFE 0xFFFA 1324# rates 1325>2 byte&0xF0 !0 1326>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1 1327!:strength +20 1328!:mime audio/mpeg 1329>2 byte&0xF0 0x10 \b, 32 kbps 1330>2 byte&0xF0 0x20 \b, 40 kbps 1331>2 byte&0xF0 0x30 \b, 48 kbps 1332>2 byte&0xF0 0x40 \b, 56 kbps 1333>2 byte&0xF0 0x50 \b, 64 kbps 1334>2 byte&0xF0 0x60 \b, 80 kbps 1335>2 byte&0xF0 0x70 \b, 96 kbps 1336>2 byte&0xF0 0x80 \b, 112 kbps 1337>2 byte&0xF0 0x90 \b, 128 kbps 1338>2 byte&0xF0 0xA0 \b, 160 kbps 1339>2 byte&0xF0 0xB0 \b, 192 kbps 1340>2 byte&0xF0 0xC0 \b, 224 kbps 1341>2 byte&0xF0 0xD0 \b, 256 kbps 1342>2 byte&0xF0 0xE0 \b, 320 kbps 1343# timing 1344>2 byte&0x0C 0x00 \b, 44.1 kHz 1345>2 byte&0x0C 0x04 \b, 48 kHz 1346>2 byte&0x0C 0x08 \b, 32 kHz 1347# channels/options 1348>3 byte&0xC0 0x00 \b, Stereo 1349>3 byte&0xC0 0x40 \b, JntStereo 1350>3 byte&0xC0 0x80 \b, 2x Monaural 1351>3 byte&0xC0 0xC0 \b, Monaural 1352#>1 byte ^0x01 \b, Data Verify 1353#>2 byte &0x02 \b, Packet Pad 1354#>2 byte &0x01 \b, Custom Flag 1355#>3 byte &0x08 \b, Copyrighted 1356#>3 byte &0x04 \b, Original Source 1357#>3 byte&0x03 1 \b, NR: 50/15 ms 1358#>3 byte&0x03 3 \b, NR: CCIT J.17 1359 1360# MP2, M1A 13610 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 1362!:mime audio/mpeg 1363# rates 1364>2 byte&0xF0 0x10 \b, 32 kbps 1365>2 byte&0xF0 0x20 \b, 48 kbps 1366>2 byte&0xF0 0x30 \b, 56 kbps 1367>2 byte&0xF0 0x40 \b, 64 kbps 1368>2 byte&0xF0 0x50 \b, 80 kbps 1369>2 byte&0xF0 0x60 \b, 96 kbps 1370>2 byte&0xF0 0x70 \b, 112 kbps 1371>2 byte&0xF0 0x80 \b, 128 kbps 1372>2 byte&0xF0 0x90 \b, 160 kbps 1373>2 byte&0xF0 0xA0 \b, 192 kbps 1374>2 byte&0xF0 0xB0 \b, 224 kbps 1375>2 byte&0xF0 0xC0 \b, 256 kbps 1376>2 byte&0xF0 0xD0 \b, 320 kbps 1377>2 byte&0xF0 0xE0 \b, 384 kbps 1378# timing 1379>2 byte&0x0C 0x00 \b, 44.1 kHz 1380>2 byte&0x0C 0x04 \b, 48 kHz 1381>2 byte&0x0C 0x08 \b, 32 kHz 1382# channels/options 1383>3 byte&0xC0 0x00 \b, Stereo 1384>3 byte&0xC0 0x40 \b, JntStereo 1385>3 byte&0xC0 0x80 \b, 2x Monaural 1386>3 byte&0xC0 0xC0 \b, Monaural 1387#>1 byte ^0x01 \b, Data Verify 1388#>2 byte &0x02 \b, Packet Pad 1389#>2 byte &0x01 \b, Custom Flag 1390#>3 byte &0x08 \b, Copyrighted 1391#>3 byte &0x04 \b, Original Source 1392#>3 byte&0x03 1 \b, NR: 50/15 ms 1393#>3 byte&0x03 3 \b, NR: CCIT J.17 1394 1395# MPA, M1A 1396# updated by Joerg Jenderek 1397# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 1398# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 1399# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 1400#0 beshort&0xFFFE 0xFFFE 1401#>2 ubyte&0xF0 >0x0F 1402#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 1403## rate 1404#>>>2 byte&0xF0 0x10 \b, 32 kbps 1405#>>>2 byte&0xF0 0x20 \b, 64 kbps 1406#>>>2 byte&0xF0 0x30 \b, 96 kbps 1407#>>>2 byte&0xF0 0x40 \b, 128 kbps 1408#>>>2 byte&0xF0 0x50 \b, 160 kbps 1409#>>>2 byte&0xF0 0x60 \b, 192 kbps 1410#>>>2 byte&0xF0 0x70 \b, 224 kbps 1411#>>>2 byte&0xF0 0x80 \b, 256 kbps 1412#>>>2 byte&0xF0 0x90 \b, 288 kbps 1413#>>>2 byte&0xF0 0xA0 \b, 320 kbps 1414#>>>2 byte&0xF0 0xB0 \b, 352 kbps 1415#>>>2 byte&0xF0 0xC0 \b, 384 kbps 1416#>>>2 byte&0xF0 0xD0 \b, 416 kbps 1417#>>>2 byte&0xF0 0xE0 \b, 448 kbps 1418## timing 1419#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 1420#>>>2 byte&0x0C 0x04 \b, 48 kHz 1421#>>>2 byte&0x0C 0x08 \b, 32 kHz 1422## channels/options 1423#>>>3 byte&0xC0 0x00 \b, Stereo 1424#>>>3 byte&0xC0 0x40 \b, JntStereo 1425#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1426#>>>3 byte&0xC0 0xC0 \b, Monaural 1427##>1 byte ^0x01 \b, Data Verify 1428##>2 byte &0x02 \b, Packet Pad 1429##>2 byte &0x01 \b, Custom Flag 1430##>3 byte &0x08 \b, Copyrighted 1431##>3 byte &0x04 \b, Original Source 1432##>3 byte&0x03 1 \b, NR: 50/15 ms 1433##>3 byte&0x03 3 \b, NR: CCIT J.17 1434 1435# MP3, M2A 14360 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1437!:mime audio/mpeg 1438# rate 1439>2 byte&0xF0 0x10 \b, 8 kbps 1440>2 byte&0xF0 0x20 \b, 16 kbps 1441>2 byte&0xF0 0x30 \b, 24 kbps 1442>2 byte&0xF0 0x40 \b, 32 kbps 1443>2 byte&0xF0 0x50 \b, 40 kbps 1444>2 byte&0xF0 0x60 \b, 48 kbps 1445>2 byte&0xF0 0x70 \b, 56 kbps 1446>2 byte&0xF0 0x80 \b, 64 kbps 1447>2 byte&0xF0 0x90 \b, 80 kbps 1448>2 byte&0xF0 0xA0 \b, 96 kbps 1449>2 byte&0xF0 0xB0 \b, 112 kbps 1450>2 byte&0xF0 0xC0 \b, 128 kbps 1451>2 byte&0xF0 0xD0 \b, 144 kbps 1452>2 byte&0xF0 0xE0 \b, 160 kbps 1453# timing 1454>2 byte&0x0C 0x00 \b, 22.05 kHz 1455>2 byte&0x0C 0x04 \b, 24 kHz 1456>2 byte&0x0C 0x08 \b, 16 kHz 1457# channels/options 1458>3 byte&0xC0 0x00 \b, Stereo 1459>3 byte&0xC0 0x40 \b, JntStereo 1460>3 byte&0xC0 0x80 \b, 2x Monaural 1461>3 byte&0xC0 0xC0 \b, Monaural 1462#>1 byte ^0x01 \b, Data Verify 1463#>2 byte &0x02 \b, Packet Pad 1464#>2 byte &0x01 \b, Custom Flag 1465#>3 byte &0x08 \b, Copyrighted 1466#>3 byte &0x04 \b, Original Source 1467#>3 byte&0x03 1 \b, NR: 50/15 ms 1468#>3 byte&0x03 3 \b, NR: CCIT J.17 1469 1470# MP2, M2A 14710 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1472!:mime audio/mpeg 1473# rate 1474>2 byte&0xF0 0x10 \b, 8 kbps 1475>2 byte&0xF0 0x20 \b, 16 kbps 1476>2 byte&0xF0 0x30 \b, 24 kbps 1477>2 byte&0xF0 0x40 \b, 32 kbps 1478>2 byte&0xF0 0x50 \b, 40 kbps 1479>2 byte&0xF0 0x60 \b, 48 kbps 1480>2 byte&0xF0 0x70 \b, 56 kbps 1481>2 byte&0xF0 0x80 \b, 64 kbps 1482>2 byte&0xF0 0x90 \b, 80 kbps 1483>2 byte&0xF0 0xA0 \b, 96 kbps 1484>2 byte&0xF0 0xB0 \b, 112 kbps 1485>2 byte&0xF0 0xC0 \b, 128 kbps 1486>2 byte&0xF0 0xD0 \b, 144 kbps 1487>2 byte&0xF0 0xE0 \b, 160 kbps 1488# timing 1489>2 byte&0x0C 0x00 \b, 22.05 kHz 1490>2 byte&0x0C 0x04 \b, 24 kHz 1491>2 byte&0x0C 0x08 \b, 16 kHz 1492# channels/options 1493>3 byte&0xC0 0x00 \b, Stereo 1494>3 byte&0xC0 0x40 \b, JntStereo 1495>3 byte&0xC0 0x80 \b, 2x Monaural 1496>3 byte&0xC0 0xC0 \b, Monaural 1497#>1 byte ^0x01 \b, Data Verify 1498#>2 byte &0x02 \b, Packet Pad 1499#>2 byte &0x01 \b, Custom Flag 1500#>3 byte &0x08 \b, Copyrighted 1501#>3 byte &0x04 \b, Original Source 1502#>3 byte&0x03 1 \b, NR: 50/15 ms 1503#>3 byte&0x03 3 \b, NR: CCIT J.17 1504 1505# MPA, M2A 15060 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1507!:mime audio/mpeg 1508# rate 1509>2 byte&0xF0 0x10 \b, 32 kbps 1510>2 byte&0xF0 0x20 \b, 48 kbps 1511>2 byte&0xF0 0x30 \b, 56 kbps 1512>2 byte&0xF0 0x40 \b, 64 kbps 1513>2 byte&0xF0 0x50 \b, 80 kbps 1514>2 byte&0xF0 0x60 \b, 96 kbps 1515>2 byte&0xF0 0x70 \b, 112 kbps 1516>2 byte&0xF0 0x80 \b, 128 kbps 1517>2 byte&0xF0 0x90 \b, 144 kbps 1518>2 byte&0xF0 0xA0 \b, 160 kbps 1519>2 byte&0xF0 0xB0 \b, 176 kbps 1520>2 byte&0xF0 0xC0 \b, 192 kbps 1521>2 byte&0xF0 0xD0 \b, 224 kbps 1522>2 byte&0xF0 0xE0 \b, 256 kbps 1523# timing 1524>2 byte&0x0C 0x00 \b, 22.05 kHz 1525>2 byte&0x0C 0x04 \b, 24 kHz 1526>2 byte&0x0C 0x08 \b, 16 kHz 1527# channels/options 1528>3 byte&0xC0 0x00 \b, Stereo 1529>3 byte&0xC0 0x40 \b, JntStereo 1530>3 byte&0xC0 0x80 \b, 2x Monaural 1531>3 byte&0xC0 0xC0 \b, Monaural 1532#>1 byte ^0x01 \b, Data Verify 1533#>2 byte &0x02 \b, Packet Pad 1534#>2 byte &0x01 \b, Custom Flag 1535#>3 byte &0x08 \b, Copyrighted 1536#>3 byte &0x04 \b, Original Source 1537#>3 byte&0x03 1 \b, NR: 50/15 ms 1538#>3 byte&0x03 3 \b, NR: CCIT J.17 1539 1540# MP3, M25A 15410 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1542!:mime audio/mpeg 1543# rate 1544>2 byte&0xF0 0x10 \b, 8 kbps 1545>2 byte&0xF0 0x20 \b, 16 kbps 1546>2 byte&0xF0 0x30 \b, 24 kbps 1547>2 byte&0xF0 0x40 \b, 32 kbps 1548>2 byte&0xF0 0x50 \b, 40 kbps 1549>2 byte&0xF0 0x60 \b, 48 kbps 1550>2 byte&0xF0 0x70 \b, 56 kbps 1551>2 byte&0xF0 0x80 \b, 64 kbps 1552>2 byte&0xF0 0x90 \b, 80 kbps 1553>2 byte&0xF0 0xA0 \b, 96 kbps 1554>2 byte&0xF0 0xB0 \b, 112 kbps 1555>2 byte&0xF0 0xC0 \b, 128 kbps 1556>2 byte&0xF0 0xD0 \b, 144 kbps 1557>2 byte&0xF0 0xE0 \b, 160 kbps 1558# timing 1559>2 byte&0x0C 0x00 \b, 11.025 kHz 1560>2 byte&0x0C 0x04 \b, 12 kHz 1561>2 byte&0x0C 0x08 \b, 8 kHz 1562# channels/options 1563>3 byte&0xC0 0x00 \b, Stereo 1564>3 byte&0xC0 0x40 \b, JntStereo 1565>3 byte&0xC0 0x80 \b, 2x Monaural 1566>3 byte&0xC0 0xC0 \b, Monaural 1567#>1 byte ^0x01 \b, Data Verify 1568#>2 byte &0x02 \b, Packet Pad 1569#>2 byte &0x01 \b, Custom Flag 1570#>3 byte &0x08 \b, Copyrighted 1571#>3 byte &0x04 \b, Original Source 1572#>3 byte&0x03 1 \b, NR: 50/15 ms 1573#>3 byte&0x03 3 \b, NR: CCIT J.17 1574 1575# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1576 1577# Stored AAC streams (instead of the MP4 format) 15780 string ADIF MPEG ADIF, AAC 1579!:mime audio/x-hx-aac-adif 1580>4 byte &0x80 1581>>13 byte &0x10 \b, VBR 1582>>13 byte ^0x10 \b, CBR 1583>>16 byte&0x1E 0x02 \b, single stream 1584>>16 byte&0x1E 0x04 \b, 2 streams 1585>>16 byte&0x1E 0x06 \b, 3 streams 1586>>16 byte &0x08 \b, 4 or more streams 1587>>16 byte &0x10 \b, 8 or more streams 1588>>4 byte &0x80 \b, Copyrighted 1589>>13 byte &0x40 \b, Original Source 1590>>13 byte &0x20 \b, Home Flag 1591>4 byte ^0x80 1592>>4 byte &0x10 \b, VBR 1593>>4 byte ^0x10 \b, CBR 1594>>7 byte&0x1E 0x02 \b, single stream 1595>>7 byte&0x1E 0x04 \b, 2 streams 1596>>7 byte&0x1E 0x06 \b, 3 streams 1597>>7 byte &0x08 \b, 4 or more streams 1598>>7 byte &0x10 \b, 8 or more streams 1599>>4 byte &0x40 \b, Original Stream(s) 1600>>4 byte &0x20 \b, Home Source 1601 1602# Live or stored single AAC stream (used with MPEG-2 systems) 16030 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1604!:mime audio/x-hx-aac-adts 1605>1 byte &0x08 \b, v2 1606>1 byte ^0x08 \b, v4 1607# profile 1608>>2 byte &0xC0 \b LTP 1609>2 byte&0xc0 0x00 \b Main 1610>2 byte&0xc0 0x40 \b LC 1611>2 byte&0xc0 0x80 \b SSR 1612# timing 1613>2 byte&0x3c 0x00 \b, 96 kHz 1614>2 byte&0x3c 0x04 \b, 88.2 kHz 1615>2 byte&0x3c 0x08 \b, 64 kHz 1616>2 byte&0x3c 0x0c \b, 48 kHz 1617>2 byte&0x3c 0x10 \b, 44.1 kHz 1618>2 byte&0x3c 0x14 \b, 32 kHz 1619>2 byte&0x3c 0x18 \b, 24 kHz 1620>2 byte&0x3c 0x1c \b, 22.05 kHz 1621>2 byte&0x3c 0x20 \b, 16 kHz 1622>2 byte&0x3c 0x24 \b, 12 kHz 1623>2 byte&0x3c 0x28 \b, 11.025 kHz 1624>2 byte&0x3c 0x2c \b, 8 kHz 1625# channels 1626>2 beshort&0x01c0 0x0040 \b, monaural 1627>2 beshort&0x01c0 0x0080 \b, stereo 1628>2 beshort&0x01c0 0x00c0 \b, stereo + center 1629>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1630>2 beshort&0x01c0 0x0140 \b, surround 1631>2 beshort&0x01c0 0x0180 \b, surround + LFE 1632>2 beshort &0x01C0 \b, surround + side 1633#>1 byte ^0x01 \b, Data Verify 1634#>2 byte &0x02 \b, Custom Flag 1635#>3 byte &0x20 \b, Original Stream 1636#>3 byte &0x10 \b, Home Source 1637#>3 byte &0x08 \b, Copyrighted 1638 1639# Live MPEG-4 audio streams (instead of RTP FlexMux) 16400 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1641!:mime audio/x-mp4a-latm 1642#>1 beshort&0x1FFF x \b, %hu byte packet 1643>3 byte&0xE0 0x40 1644>>4 byte&0x3C 0x04 \b, single stream 1645>>4 byte&0x3C 0x08 \b, 2 streams 1646>>4 byte&0x3C 0x0C \b, 3 streams 1647>>4 byte &0x08 \b, 4 or more streams 1648>>4 byte &0x20 \b, 8 or more streams 1649>3 byte&0xC0 0 1650>>4 byte&0x78 0x08 \b, single stream 1651>>4 byte&0x78 0x10 \b, 2 streams 1652>>4 byte&0x78 0x18 \b, 3 streams 1653>>4 byte &0x20 \b, 4 or more streams 1654>>4 byte &0x40 \b, 8 or more streams 1655# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1656#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1657#!:mime audio/x-mp4a-latm 1658 1659# Summary: FLI animation format 1660# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1661# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 16624 leshort 0xAF11 1663# standard FLI always has 320x200 resolution and 8 bit color 1664>8 leshort 320 1665>>10 leshort 200 1666>>>12 leshort 8 FLI animation, 320x200x8 1667!:mime video/x-fli 1668>>>>6 leshort x \b, %d frames 1669# frame speed is multiple of 1/70s 1670>>>>16 leshort x \b, %d/70s per frame 1671 1672# Summary: FLC animation format 1673# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1674# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 16754 leshort 0xAF12 1676# standard FLC always use 8 bit color 1677>12 leshort 8 FLC animation 1678!:mime video/x-flc 1679>>8 leshort x \b, %d 1680>>10 leshort x \bx%dx8 1681>>6 uleshort x \b, %d frames 1682>>16 uleshort x \b, %dms per frame 1683 1684# DL animation format 1685# XXX - collision with most `mips' magic 1686# 1687# I couldn't find a real magic number for these, however, this 1688# -appears- to work. Note that it might catch other files, too, so be 1689# careful! 1690# 1691# Note that title and author appear in the two 20-byte chunks 1692# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1693# 255 (hex FF)! The DL format is really bad. 1694# 1695#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1696#!:mime video/x-unknown 1697#>42 byte x - %d screens, 1698#>43 byte x %d commands 1699#0 byte 2 DL version 2 1700#!:mime video/x-unknown 1701#>1 byte 1 - large format (320x200,1 image/screen), 1702#>1 byte 2 - medium format (160x100,4 images/screen), 1703#>1 byte >2 - unknown format, 1704#>42 byte x %d screens, 1705#>43 byte x %d commands 1706# Based on empirical evidence, DL version 3 have several nulls following the 1707# \003. Most of them start with non-null values at hex offset 0x34 or so. 1708#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1709 1710# iso 13818 transport stream 1711# 1712# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1713# syncbyte 8 bit 0x47 1714# error_ind 1 bit - 1715# payload_start 1 bit 1 1716# priority 1 bit - 1717# PID 13 bit 0x0000 1718# scrambling 2 bit - 1719# adaptfld_ctrl 2 bit 1 or 3 1720# conti_count 4 bit - 17210 belong&0xFF5FFF10 0x47400010 1722>188 byte 0x47 MPEG transport stream data 1723!:mime video/MP2T 1724!:ext ts 1725 1726# DIF digital video file format <mpruett@sgi.com> 17270 belong&0xffffff00 0x1f070000 DIF 1728!:mime video/x-dv 1729>4 byte &0x01 (DVCPRO) movie file 1730>4 byte ^0x01 (DV) movie file 1731>3 byte &0x80 (PAL) 1732>3 byte ^0x80 (NTSC) 1733 1734# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 17350 string \x8aMNG MNG video data, 1736!:mime video/x-mng 1737>4 belong !0x0d0a1a0a CORRUPTED, 1738>4 belong 0x0d0a1a0a 1739>>16 belong x %d x 1740>>20 belong x %d 1741 1742# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 17430 string \x8bJNG JNG video data, 1744!:mime video/x-jng 1745>4 belong !0x0d0a1a0a CORRUPTED, 1746>4 belong 0x0d0a1a0a 1747>>16 belong x %d x 1748>>20 belong x %d 1749 1750# Vivo video (Wolfram Kleff) 17513 string \x0D\x0AVersion:Vivo Vivo video data 1752 1753# ABC (alembic.io 3d models) 17540 string 0gawa ABC 3d model 1755 1756#--------------------------------------------------------------------------- 1757# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1758# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1759# 17600 string HVQM4 %s 1761>6 string >\0 v%s 1762>0 byte x GameCube movie, 1763>0x34 ubeshort x %d x 1764>0x36 ubeshort x %d, 1765>0x26 ubeshort x %dus, 1766>0x42 ubeshort 0 no audio 1767>0x42 ubeshort >0 %dHz audio 1768 1769# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org> 1770# Update: Joerg Jenderek 1771# URL: https://en.wikipedia.org/wiki/VOB 17720 string DVDVIDEO-VTS Video title set, 1773!:mime video/x-ifo 1774!:ext ifo/bup 1775>0x21 byte x v%x 17760 string DVDVIDEO-VMG Video manager, 1777!:mime video/x-ifo 1778!:ext ifo/bup 1779>0x21 byte x v%x 1780 1781# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org> 17820 string xMovieSetter MovieSetter movie 17830 string xSceneEditor MovieSetter movie 1784 1785# From: Behan Webster <behanw@websterwood.com> 1786# NuppelVideo used by Mythtv (*.nuv) 1787# Note: there are two identical stanzas here differing only in the 1788# initial string matched. It used to be done with a regex, but we're 1789# trying to get rid of those. 17900 string NuppelVideo MythTV NuppelVideo 1791>12 string x v%s 1792>20 lelong x (%d 1793>24 lelong x \bx%d), 1794>36 string P \bprogressive, 1795>36 string I \binterlaced, 1796>40 ledouble x \baspect:%.2f, 1797>48 ledouble x \bfps:%.2f 17980 string MythTV MythTV NuppelVideo 1799>12 string x v%s 1800>20 lelong x (%d 1801>24 lelong x \bx%d), 1802>36 string P \bprogressive, 1803>36 string I \binterlaced, 1804>40 ledouble x \baspect:%.2f, 1805>48 ledouble x \bfps:%.2f 1806 1807# MPEG file 1808# MPEG sequences 1809# FIXME: This section is from the old magic.mime file and needs 1810# integrating with the rest 1811#0 belong 0x000001BA 1812#>4 byte &0x40 1813#!:mime video/mp2p 1814#>4 byte ^0x40 1815#!:mime video/mpeg 1816#0 belong 0x000001BB 1817#!:mime video/mpeg 1818#0 belong 0x000001B0 1819#!:mime video/mp4v-es 1820#0 belong 0x000001B5 1821#!:mime video/mp4v-es 1822#0 belong 0x000001B3 1823#!:mime video/mpv 1824#0 belong&0xFF5FFF10 0x47400010 1825#!:mime video/mp2t 1826#0 belong 0x00000001 1827#>4 byte&0x1F 0x07 1828#!:mime video/h264 1829 1830# Type: Bink Video 1831# Extension: .bik 1832# URL: https://wiki.multimedia.cx/index.php?title=Bink_Container 1833# From: <hoehle@users.sourceforge.net> 2008-07-18 18340 name bik 1835#>4 ulelong x size %d 1836>20 ulelong x \b, %d 1837>24 ulelong x \bx%d 1838>8 ulelong x \b, %d frames 1839>32 ulelong x at rate %d/ 1840>28 ulelong >1 \b%d 1841>40 ulelong =0 \b, no audio 1842>40 ulelong !0 \b, %d audio track 1843>>40 ulelong !1 \bs 1844# follow properties of the first audio track only 1845>>48 uleshort x %dHz 1846>>51 byte&0x20 0 mono 1847>>51 byte&0x20 !0 stereo 1848#>>51 byte&0x10 0 FFT 1849#>>51 byte&0x10 !0 DCT 1850 18510 string BIK 1852>3 regex =[bdfghi] Bink Video rev.%s 1853>>0 use bik 1854 18550 string KB2 1856>3 regex =[adfghi] Bink Video 2 rev.%s 1857>>0 use bik 1858 1859# Type: NUT Container 1860# URL: https://wiki.multimedia.cx/index.php?title=NUT 1861# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18620 string nut/multimedia\ container\0 NUT multimedia container 1863 1864# Type: Nullsoft Video (NSV) 1865# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1866# From: Mike Melanson <mike@multimedia.cx> 18670 string NSVf Nullsoft Video 1868 1869# Type: REDCode Video 1870# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode 1871# From: Mike Melanson <mike@multimedia.cx> 18724 string RED1 REDCode Video 1873 1874# Type: MTV Multimedia File 1875# URL: https://wiki.multimedia.cx/index.php?title=MTV 1876# From: Mike Melanson <mike@multimedia.cx> 18770 string AMVS MTV Multimedia File 1878 1879# Type: ARMovie 1880# URL: https://wiki.multimedia.cx/index.php?title=ARMovie 1881# From: Mike Melanson <mike@multimedia.cx> 18820 string ARMovie\012 ARMovie 1883 1884# Type: Interplay MVE Movie 1885# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE 1886# From: Mike Melanson <mike@multimedia.cx> 18870 string Interplay\040MVE\040File\032 Interplay MVE Movie 1888 1889# Type: Windows Television DVR File 1890# URL: https://wiki.multimedia.cx/index.php?title=WTV 1891# From: Mike Melanson <mike@mutlimedia.cx> 1892# This takes the form of a Windows-style GUID 18930 bequad 0xB7D800203749DA11 1894>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1895 1896# Type: Sega FILM/CPK Multimedia 1897# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM 1898# From: Mike Melanson <mike@multimedia.cx> 18990 string FILM Sega FILM/CPK Multimedia, 1900>32 belong x %d x 1901>28 belong x %d 1902 1903# Type: Nintendo THP Multimedia 1904# URL: https://wiki.multimedia.cx/index.php?title=THP 1905# From: Mike Melanson <mike@multimedia.cx> 19060 string THP\0 Nintendo THP Multimedia 1907 1908# Type: BBC Dirac Video 1909# URL: https://wiki.multimedia.cx/index.php?title=Dirac 1910# From: Mike Melanson <mike@multimedia.cx> 19110 string BBCD BBC Dirac Video 1912 1913# Type: RAD Game Tools Smacker Multimedia 1914# URL: https://wiki.multimedia.cx/index.php?title=Smacker 1915# From: Mike Melanson <mike@multimedia.cx> 19160 string SMK RAD Game Tools Smacker Multimedia 1917>3 byte x version %c, 1918>4 lelong x %d x 1919>8 lelong x %d, 1920>12 lelong x %d frames 1921 1922# Material Exchange Format 1923# More information: 1924# https://en.wikipedia.org/wiki/Material_Exchange_Format 1925# http://www.freemxf.org/ 19260 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format 1927!:ext mxf 1928!:mime application/mxf 1929 1930# Recognize LucasArts Smush video files (cf. 1931# https://wiki.multimedia.cx/index.php/Smush) 19320 string ANIM 1933>8 string AHDR LucasArts Smush Animation Format (SAN) video 19340 string SANM 1935>8 string SHDR LucasArts Smush v2 (SANM) video 1936 1937# Type: Scaleform video 1938# Extension: .usm 1939# URL: https://wiki.multimedia.cx/index.php/USM 1940# From: David Korth <gerbilsoft@gerbilsoft.com> 19410 string CRID 1942>32 string @UTF Scaleform video 1943 1944# http://www.jerrysguide.com/tips/demystify-tvs-file-format.html 19450 string TVS\015\012 1946>&0 string Version\040 TeamViewer Session File 1947>>&0 string x \b, version %s 1948 1949# SER file format - simple uncompressed video format for astronomical use 1950# Initially developed by Lucam Recorder, 1951# as of 2021 maintained by Heiko Wilkens, Grischa Hahn 1952# Typical extensions: .SER 1953# http://www.grischa-hahn.homepage.t-online.de/astro/ser/SER%20Doc%20V3b.pdf 19540 string LUCAM-RECORDER SER video sequence 1955!:ext ser 1956>18 lelong 0 \b, bayer: mono 1957>18 lelong 8 \b, bayer: RGGB 1958>18 lelong 9 \b, bayer: GRBG 1959>18 lelong 10 \b, bayer: GBRG 1960>18 lelong 11 \b, bayer: BGGR 1961>18 lelong 16 \b, bayer: CYYM 1962>18 lelong 17 \b, bayer: YCMY 1963>18 lelong 18 \b, bayer: YMCY 1964>18 lelong 19 \b, bayer: MYYC 1965>18 lelong 100 \b, bayer: RGB 1966>18 lelong 101 \b, bayer: BGR 1967>22 lelong 0 \b, big-endian 1968>22 lelong 1 \b, little-endian 1969>26 lelong x \b, width: %d 1970>30 lelong x \b, height: %d 1971>34 lelong x \b, %d bit 1972>38 lelong x \b, frames: %d 1973 1974#------------------------------------------------------------------------------ 1975# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1976# aout: file(1) magic for a.out executable/object/etc entries that 1977# handle executables on multiple platforms. 1978# 1979 1980# 1981# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1982# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1983# 1984# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1985# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1986# works only for binaries using shared libraries. Grabbing the entry 1987# point from the a.out header, using it to find the first code executed 1988# in the program, and looking at that might help. 1989# 19900 lelong 0407 a.out little-endian 32-bit executable 1991>16 lelong >0 not stripped 1992>32 byte 0x6a (uses BSD/OS shared libs) 1993 19940 lelong 0410 a.out little-endian 32-bit pure executable 1995>16 lelong >0 not stripped 1996>32 byte 0x6a (uses BSD/OS shared libs) 1997 19980 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1999>16 lelong >0 not stripped 2000>32 byte 0x6a (uses BSD/OS shared libs) 2001 2002# 2003# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 2004# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 2005# 2006# XXX - is there anything we can look at to distinguish old SunOS 68010 2007# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 2008# the first instruction or instructions in the program. 2009# 20100 belong 0407 a.out big-endian 32-bit executable 2011>16 belong >0 not stripped 2012 20130 belong 0410 a.out big-endian 32-bit pure executable 2014>16 belong >0 not stripped 2015 20160 belong 0413 a.out big-endian 32-bit demand paged executable 2017>16 belong >0 not stripped 2018 2019 2020#------------------------------------------------------------------------------ 2021# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $ 2022# apache: file(1) magic for Apache Big Data formats 2023 2024# Avro files 20250 string Obj Apache Avro 2026>3 byte x version %d 2027 2028# ORC files 2029# Important information is in file footer, which we can't index to :( 20300 string ORC Apache ORC 2031 2032# Parquet files 20330 string PAR1 Apache Parquet 2034 2035# Hive RC files 20360 string RCF Apache Hive RC file 2037>3 byte x version %d 2038 2039# Sequence files (and the careless first version of RC file) 2040 20410 string SEQ 2042>3 byte <6 Apache Hadoop Sequence file version %d 2043>3 byte >6 Apache Hadoop Sequence file version %d 2044>3 byte =6 2045>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0 2046>>3 default x Apache Hadoop Sequence file version 6 2047 2048#------------------------------------------------------------------------------ 2049# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 2050# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 2051# workspaces) 2052# 20530 long 0100554 APL workspace (Ken's original?) 2054 2055#------------------------------------------------------------------------------ 2056# $File: apple,v 1.45 2021/04/26 15:56:00 christos Exp $ 2057# apple: file(1) magic for Apple file formats 2058# 20590 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 20600 string \x0aGL Binary II (apple ][) data 20610 string \x76\xff Squeezed (apple ][) data 20620 string NuFile NuFile archive (apple ][) data 20630 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 20640 belong 0x00051600 AppleSingle encoded Macintosh file 20650 belong 0x00051607 AppleDouble encoded Macintosh file 2066 2067# Type: Apple Emulator WOZ format 2068# From: Greg Wildman <greg@apple2.org.za> 2069# Ref: https://applesaucefdc.com/woz/reference/ 2070# Ref: https://applesaucefdc.com/woz/reference2/ 2071# 2072# Note: The following test are mostly identical. I would rather not 2073# use a regex to identify the WOZ format number. 20740 string WOZ1 2075>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image 2076>12 string INFO 2077>>21 byte 01 \b, 5.25 inch 2078>>21 byte 02 \b, 3.5 inch 2079>>22 byte 01 \b, write protected 2080>>23 byte 01 \b, cross track synchronized 2081>>25 string/T x \b, %.32s 20820 string WOZ2 2083>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image 2084>12 string INFO 2085>>21 byte 01 \b, 5.25 inch 2086>>21 byte 02 \b, 3.5 inch 2087>>22 byte 01 \b, write protected 2088>>23 byte 01 \b, cross track synchronized 2089>>25 string/T x \b, %.32s 2090 2091# Type: Apple Emulator disk images 2092# From: Greg Wildman <greg@apple2.org.za> 2093# ProDOS boot loader? 20940 string \x01\x38\xB0\x03\x4C Apple ProDOS Image 2095# Detect Volume Directory block ($02) 2096>0x400 string \x00\x00\x03\x00 2097>>0x404 byte &0xF0 2098>>>0x405 string x \b, Volume /%s 2099>>>0x429 leshort x \b, %u Blocks 2100# ProDOS ordered ? 2101>0xb00 string \x00\x00\x03\x00 2102>>0xb04 byte &0xF0 2103>>>0xb05 string x \b, Volume /%s 2104>>>0xb29 leshort x \b, %u Blocks 2105# 2106# DOS3.3 boot loader? 21070 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B 2108>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image 2109>>0x11006 byte x \b, Volume %u 2110>>0x11034 byte x \b, %u Tracks 2111>>0x11035 byte x \b, %u Sectors 2112>>0x11036 leshort x \b, %u bytes per sector 2113# DOS3.2 ? 2114>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image 2115>>0x11006 byte x \b, Volume %u 2116>>0x11034 byte x \b, %u Tracks 2117>>0x11035 byte x \b, %u Sectors 2118>>0x11036 leshort x \b, %u bytes per sector 2119# DOS3.1 ? 2120>0x11001 string \x11\x0C\x01 2121>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image 2122# 2123# Pascal boot loader? 21240 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD 2125>0xd6 pstring SYSTEM.APPLE 2126>>0xb00 leshort 0x0000 2127>>>0xb04 leshort 0x0000 Apple Pascal Image 2128>>>>0xb06 pstring x \b, Volume %s: 2129>>>>0xb0e leshort x \b, %u Blocks 2130>>>>0xb10 leshort x \b, %u Files 2131# 2132# Diversi Dos boot loader? 21330 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD 2134>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image 2135>>0x11006 byte x \b, Volume %u 2136>>0x11034 byte x \b, %u Tracks 2137>>0x11035 byte x \b, %u Sectors 2138>>0x11036 leshort x \b, %u bytes per sector 2139 2140# Type: Apple Emulator 2IMG format 2141# From: Radek Vokal <rvokal@redhat.com> 2142# Update: Greg Wildman <greg@apple2.org.za> 21430 string 2IMG Apple ][ 2IMG Disk Image 2144>4 clear x 2145>4 string XGS! \b, XGS 2146>4 string CTKG \b, Catakig 2147>4 string ShIm \b, Sheppy's ImageMaker 2148>4 string SHEP \b, Sheppy's ImageMaker 2149>4 string WOOF \b, Sweet 16 2150>4 string B2TR \b, Bernie ][ the Rescue 2151>4 string \!nfc \b, ASIMOV2 2152>4 string \>BD\< \b, Brutal Deluxe's Cadius 2153>4 string CdrP \b, CiderPress 2154>4 string Vi][ \b, Virtual ][ 2155>4 string PRFS \b, ProFUSE 2156>4 string FISH \b, FishWings 2157>4 string RVLW \b, Revival for Windows 2158>4 default x 2159>>4 string x \b, Creator tag "%-4.4s" 2160>0xc byte 00 \b, DOS 3.3 sector order 2161>>0x10 byte 00 \b, Volume 254 2162>>0x10 byte&0x7f x \b, Volume %u 2163>0xc byte 01 \b, ProDOS sector order 2164# Detect Volume Directory block ($02) + 2mg header offset 2165>>0x440 string \x00\x00\x03\x00 2166>>>0x444 byte &0xF0 2167>>>>0x445 string x \b, Volume /%s 2168>>>>0x469 leshort x \b, %u Blocks 2169>0xc byte 02 \b, NIB data 2170 2171# magic for Newton PDA package formats 2172# from Ruda Moura <ruda@helllabs.org> 21730 string package0 Newton package, NOS 1.x, 2174>12 belong &0x80000000 AutoRemove, 2175>12 belong &0x40000000 CopyProtect, 2176>12 belong &0x10000000 NoCompression, 2177>12 belong &0x04000000 Relocation, 2178>12 belong &0x02000000 UseFasterCompression, 2179>16 belong x version %d 2180 21810 string package1 Newton package, NOS 2.x, 2182>12 belong &0x80000000 AutoRemove, 2183>12 belong &0x40000000 CopyProtect, 2184>12 belong &0x10000000 NoCompression, 2185>12 belong &0x04000000 Relocation, 2186>12 belong &0x02000000 UseFasterCompression, 2187>16 belong x version %d 2188 21890 string package4 Newton package, 2190>8 byte 8 NOS 1.x, 2191>8 byte 9 NOS 2.x, 2192>12 belong &0x80000000 AutoRemove, 2193>12 belong &0x40000000 CopyProtect, 2194>12 belong &0x10000000 NoCompression, 2195 2196# The following entries for the Apple II are for files that have 2197# been transferred as raw binary data from an Apple, without having 2198# been encapsulated by any of the above archivers. 2199# 2200# In general, Apple II formats are hard to identify because Apple DOS 2201# and especially Apple ProDOS have strong typing in the file system and 2202# therefore programmers never felt much need to include type information 2203# in the files themselves. 2204# 2205# Eric Fischer <enf@pobox.com> 2206 2207# AppleWorks word processor: 2208# URL: https://en.wikipedia.org/wiki/AppleWorks 2209# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 2210# Update: Joerg Jenderek 2211# NOTE: 2212# The "O" is really the magic number, but that's so common that it's 2213# necessary to check the tab stops that follow it to avoid false positives. 2214# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 2215# the newer AppleWorks is from claris with extension CWK 22164 string O 2217# test for unused bits of zoom- , paginated-boolean bytes 2218>84 ubequad ^0x00Fe00000000Fe00 2219# look for tabstop definitions "=" no tab, "|" no tab 2220# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 2221# unofficial "!" other , "\x8a" other 2222# official only if SFMinVers is nonzero 2223>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 2224# AppleWorks Word Processor File (Apple II) 2225# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 2226# application/x-appleworks is mime type for claris version with cwk extension 2227!:mime application/x-appleworks3 2228# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 2229# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 2230# $70 $1A $F8 $FF is this the apple type ? 2231#:apple pdosp^Z\xf8\xff 2232!:ext awp 2233# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 2234>>>183 ubyte 30 3.0 2235>>>183 ubyte !30 2236>>>>183 ubyte !0 %#x 2237# usual tabstop start sequence "=====<" 2238>>>5 string x \b, tabstop ruler "%6.6s" 2239# tabstop ruler 2240#>>>5 string >\0 \b, tabstops "%-79s" 2241# zoom switch 2242>>>85 byte&0x01 >0 \b, zoomed 2243# whether paginated 2244>>>90 byte&0x01 >0 \b, paginated 2245# contains any mail-merge commands 2246>>>92 byte&0x01 >0 \b, with mail merge 2247# left margin in 1/10 inches ( normally 0 or 10 ) 2248>>>91 ubyte >0 2249>>>>91 ubyte x \b, %d/10 inch left margin 2250 2251# AppleWorks database: 2252# 2253# This isn't really a magic number, but it's the closest thing to one 2254# that I could find. The 1 and 2 really mean "order in which you defined 2255# categories" and "left to right, top to bottom," respectively; the D and R 2256# mean that the cursor should move either down or right when you press Return. 2257 2258#30 string \x01D AppleWorks database data 2259#30 string \x02D AppleWorks database data 2260#30 string \x01R AppleWorks database data 2261#30 string \x02R AppleWorks database data 2262 2263# AppleWorks spreadsheet: 2264# 2265# Likewise, this isn't really meant as a magic number. The R or C means 2266# row- or column-order recalculation; the A or M means automatic or manual 2267# recalculation. 2268 2269#131 string RA AppleWorks spreadsheet data 2270#131 string RM AppleWorks spreadsheet data 2271#131 string CA AppleWorks spreadsheet data 2272#131 string CM AppleWorks spreadsheet data 2273 2274# Applesoft BASIC: 2275# 2276# This is incredibly sloppy, but will be true if the program was 2277# written at its usual memory location of 2048 and its first line 2278# number is less than 256. Yuck. 2279# update by Joerg Jenderek at Feb 2013 2280 2281# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 2282#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 22830 belong&0x00ff00ff 0x00080000 2284# assuming that line number must be positive 2285>2 leshort >0 Applesoft BASIC program data, first line number %d 2286#>2 leshort x \b, first line number %d 2287 2288# ORCA/EZ assembler: 2289# 2290# This will not identify ORCA/M source files, since those have 2291# some sort of date code instead of the two zero bytes at 6 and 7 2292# XXX Conflicts with ELF 2293#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 2294#>5 byte x \b, build number %d 2295 2296# Broderbund Fantavision 2297# 2298# I don't know what these values really mean, but they seem to recur. 2299# Will they cause too many conflicts? 2300 2301# Probably :-) 2302#2 belong&0xFF00FF 0x040008 Fantavision movie data 2303 2304# Some attempts at images. 2305# 2306# These are actually just bit-for-bit dumps of the frame buffer, so 2307# there's really no reasonably way to distinguish them except for their 2308# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 2309# or, occasionally, 8184. 2310# 2311# Nevertheless this will manage to catch a lot of images that happen 2312# to have a solid-colored line at the bottom of the screen. 2313 2314# GRR: Magic too weak 2315#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 2316#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 2317#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 2318#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 2319#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 2320 2321# Beagle Bros. Apple Mechanic fonts 2322 23230 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 2324 2325# Apple Universal Disk Image Format (UDIF) - dmg files. 2326# From Johan Gade. 2327# These entries are disabled for now until we fix the following issues. 2328# 2329# Note there might be some problems with the "VAX COFF executable" 2330# entry. Note this entry should be placed before the mac filesystem section, 2331# particularly the "Apple Partition data" entry. 2332# 2333# The intended meaning of these tests is, that the file is only of the 2334# specified type if both of the lines are correct - i.e. if the first 2335# line matches and the second doesn't then it is not of that type. 2336# 2337#0 long 0x7801730d 2338#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 2339# 2340# Note that this entry is recognized correctly by the "Apple Partition 2341# data" entry - however since this entry is more specific - this 2342# information seems to be more useful. 2343#0 long 0x45520200 2344#>0x410 string disk\ image UDIF read/write image (UDRW) 2345 2346# From: Toby Peterson <toby@apple.com> 23470 string bplist00 Apple binary property list 2348 2349# Apple binary property list (bplist) 2350# Assumes version bytes are hex. 2351# Provides content hints for version 0 files. Assumes that the root 2352# object is the first object (true for CoreFoundation implementation). 2353# From: David Remahl <dremahl@apple.com> 23540 string bplist 2355>6 byte x \bCoreFoundation binary property list data, version %#c 2356>>7 byte x \b%c 2357>6 string 00 \b 2358>>8 byte&0xF0 0x00 \b 2359>>>8 byte&0x0F 0x00 \b, root type: null 2360>>>8 byte&0x0F 0x08 \b, root type: false boolean 2361>>>8 byte&0x0F 0x09 \b, root type: true boolean 2362>>8 byte&0xF0 0x10 \b, root type: integer 2363>>8 byte&0xF0 0x20 \b, root type: real 2364>>8 byte&0xF0 0x30 \b, root type: date 2365>>8 byte&0xF0 0x40 \b, root type: data 2366>>8 byte&0xF0 0x50 \b, root type: ascii string 2367>>8 byte&0xF0 0x60 \b, root type: unicode string 2368>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 2369>>8 byte&0xF0 0xa0 \b, root type: array 2370>>8 byte&0xF0 0xd0 \b, root type: dictionary 2371 2372# Apple/NeXT typedstream data 2373# Serialization format used by NeXT and Apple for various 2374# purposes in YellowStep/Cocoa, including some nib files. 2375# From: David Remahl <dremahl@apple.com> 23762 string typedstream NeXT/Apple typedstream data, big endian 2377>0 byte x \b, version %d 2378>0 byte <5 \b 2379>>13 byte 0x81 \b 2380>>>14 ubeshort x \b, system %d 23812 string streamtyped NeXT/Apple typedstream data, little endian 2382>0 byte x \b, version %d 2383>0 byte <5 \b 2384>>13 byte 0x81 \b 2385>>>14 uleshort x \b, system %d 2386 2387#------------------------------------------------------------------------------ 2388# CAF: Apple CoreAudio File Format 2389# 2390# Container format for high-end audio purposes. 2391# From: David Remahl <dremahl@apple.com> 2392# 23930 string caff CoreAudio Format audio file 2394>4 beshort <10 version %d 2395>6 beshort x 2396 2397 2398#------------------------------------------------------------------------------ 2399# Keychain database files 24000 string kych Mac OS X Keychain File 2401 2402#------------------------------------------------------------------------------ 2403# Code Signing related file types 24040 belong 0xfade0c00 Mac OS X Code Requirement 2405>8 belong 1 (opExpr) 2406>4 belong x - %d bytes 2407 24080 belong 0xfade0c01 Mac OS X Code Requirement Set 2409>8 belong >1 containing %d items 2410>4 belong x - %d bytes 2411 24120 belong 0xfade0c02 Mac OS X Code Directory 2413>8 belong x version %x 2414>12 belong >0 flags %#x 2415>4 belong x - %d bytes 2416 24170 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 2418>4 belong x - %d bytes 2419 24200 belong 0xfade0cc1 Mac OS X Detached Code Signature 2421>8 belong >1 (%d elements) 2422>4 belong x - %d bytes 2423 2424# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2425# .vdi 24264 string innotek\ VirtualBox\ Disk\ Image %s 2427 2428# Apple disk partition stuff 2429# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2430# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 2431# Update: Joerg Jenderek 2432# "ER" is APPLE_DRVR_MAP_MAGIC signature 24330 beshort 0x4552 2434# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 2435#!:strength +0 2436# strengthen the magic by looking for used blocksizes 512 2048 2437>2 ubeshort&0xf1FF 0 Apple Driver Map 2438# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 2439#>>504 ubequad&0x0000FFffFFff0000 0 2440!:mime application/x-apple-diskimage 2441!:apple ????devr 2442# https://en.wikipedia.org/wiki/Apple_Disk_Image 2443!:ext dmg/iso 2444# sbBlkSize for driver descriptor map 512 2048 2445>>2 beshort x \b, blocksize %d 2446# sbBlkCount sometimes garbish like 2447# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 2448# 0xf2720100 for bunziped Firefox 48.0-2.dmg 2449# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 2450# 0x00009090 by syslinux-6.03/utils/isohybrid.c 2451>>4 ubelong x \b, blockcount %u 2452# following device/driver information not very useful 2453# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2454>>8 ubeshort x \b, devtype %u 2455# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2456>>10 ubeshort x \b, devid %u 2457# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2458>>12 ubelong >0 2459>>>12 ubelong x \b, driver data %u 2460# number of driver descriptors sbDrvrCount <= 61 2461# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2462>>16 ubeshort x \b, driver count %u 2463# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 2464# >>18 use apple-driver-map 2465# >>26 use apple-driver-map 2466# # ... 2467# >>500 use apple-driver-map 2468# number of partitions is always same in every partition (map block count) 2469#>>0x0204 ubelong x \b, %u partitions 2470>>0x0204 ubelong >0 \b, contains[@0x200]: 2471>>>0x0200 use apple-apm 2472>>0x0204 ubelong >1 \b, contains[@0x400]: 2473>>>0x0400 use apple-apm 2474>>0x0204 ubelong >2 \b, contains[@0x600]: 2475>>>0x0600 use apple-apm 2476>>0x0204 ubelong >3 \b, contains[@0x800]: 2477>>>0x0800 use apple-apm 2478>>0x0204 ubelong >4 \b, contains[@0xA00]: 2479>>>0x0A00 use apple-apm 2480>>0x0204 ubelong >5 \b, contains[@0xC00]: 2481>>>0x0C00 use apple-apm 2482>>0x0204 ubelong >6 \b, contains[@0xE00]: 2483>>>0x0E00 use apple-apm 2484>>0x0204 ubelong >7 \b, contains[@0x1000]: 2485>>>0x1000 use apple-apm 2486# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 24870 name apple-driver-map 2488>0 ubequad !0 2489# descBlock first block of driver 2490>>0 ubelong x \b, driver start block %u 2491# descSize driver size in blocks 2492>>4 ubeshort x \b, size %u 2493# descType driver system type 1 701h F8FFh FFFFh 2494>>6 ubeshort x \b, type %#x 2495 2496# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2497# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 2498# Update: Joerg Jenderek 2499# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 2500# magic stronger. 2501# for apple partition map stored as a single file 25020 belong 0x504d0000 2503# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 2504#!:strength +0 2505>0 use apple-apm 2506# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 2507# file: could not find any valid magic files! 2508#!:ext bin 2509# display apple partition map. Normally called after Apple driver map 25100 name apple-apm 2511>0 belong 0x504d0000 Apple Partition Map 2512# number of partitions 2513>>4 ubelong x \b, map block count %u 2514# logical block (512 bytes) start of partition 2515>>8 ubelong x \b, start block %u 2516>>12 ubelong x \b, block count %u 2517>>16 string >0 \b, name %s 2518>>48 string >0 \b, type %s 2519# processor type dpme_process_id[16] e.g. "68000" "68020" 2520>>120 string >0 \b, processor %s 2521# A/UX boot arguments BootArgs[128] 2522>>136 string >0 \b, boot arguments %s 2523# status of partition dpme_flags 2524>>88 belong & 1 \b, valid 2525>>88 belong & 2 \b, allocated 2526>>88 belong & 4 \b, in use 2527>>88 belong & 8 \b, has boot info 2528>>88 belong & 16 \b, readable 2529>>88 belong & 32 \b, writable 2530>>88 belong & 64 \b, pic boot code 2531>>88 belong & 128 \b, chain compatible driver 2532>>88 belong & 256 \b, real driver 2533>>88 belong & 512 \b, chain driver 2534# mount automatically at startup APPLE_PS_AUTO_MOUNT 2535>>88 ubelong &0x40000000 \b, mount at startup 2536# is the startup partition APPLE_PS_STARTUP 2537>>88 ubelong &0x80000000 \b, is the startup partition 2538 2539#https://wiki.mozilla.org/DS_Store_File_Format 2540#https://en.wikipedia.org/wiki/.DS_Store 25410 string \0\0\0\1Bud1\0 Apple Desktop Services Store 2542 2543# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 2544# Usually not in separate files, but have either filename rsrc with 2545# no extension, or a filename corresponding to another file, with 2546# extensions rsr/rsrc 25470 string \000\000\001\000 2548>4 leshort 0 2549>>16 lelong 0 Apple HFS/HFS+ resource fork 2550 2551#https://en.wikipedia.org/wiki/AppleScript 25520 string FasdUAS AppleScript compiled 2553 2554# AppleWorks/ClarisWorks 2555# https://github.com/joshenders/appleworks_format 2556# http://fileformats.archiveteam.org/wiki/AppleWorks 25570 name appleworks 2558>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 2559>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 2560>0 default x 2561>>0 belong x AppleWorks/ClarisWorks CWK Document 2562>0 byte x \b, version %d 2563>30 beshort x \b, %d 2564>32 beshort x \bx%d 2565!:ext cwk 2566 25674 string BOBO 2568>0 byte >4 2569>>12 belong 0 2570>>>26 belong 0 2571>>>>0 use appleworks 2572>0 belong 0x0481ad00 2573>>0 use appleworks 2574 2575# magic for Apple File System (APFS) 2576# from Alex Myczko <alex@aiei.ch> 257732 string NXSB Apple File System (APFS) 2578>36 ulelong x \b, blocksize %u 2579 2580# iTunes cover art (versions 1 and 2) 25814 string itch 2582>24 string artw 2583>>0x1e8 string data iTunes cover art 2584>>>0x1ed string PNG (PNG) 2585>>>0x1ec beshort 0xffd8 (JPEG) 2586 2587# MacPaint image 258865 string PNTGMPNT MacPaint image data 2589#0 belong 2 MacPaint image data 2590 2591#------------------------------------------------------------------------------ 2592# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $ 2593# application: file(1) magic for applications on small devices 2594# 2595# Pebble Application 25960 string PBLAPP\000\000 Pebble application 2597 2598#------------------------------------------------------------------------------ 2599# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2600# applix: file(1) magic for Applixware 2601# From: Peter Soos <sp@osb.hu> 2602# 26030 string *BEGIN Applixware 2604>7 string WORDS Words Document 2605>7 string GRAPHICS Graphic 2606>7 string RASTER Bitmap 2607>7 string SPREADSHEETS Spreadsheet 2608>7 string MACRO Macro 2609>7 string BUILDER Builder Object 2610 2611#------------------------------------------------------------------------------ 2612# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $ 2613# apt: file(1) magic for APT Cache files 2614# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html> 2615# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292> 2616 2617# before version 10 ("old format"), data was in arch-specific long/short 2618 2619# old format 64 bit 26200 name apt-cache-64bit-be 2621>12 beshort 1 \b, dirty 2622>40 bequad x \b, %llu packages 2623>48 bequad x \b, %llu versions 2624 2625# old format 32 bit 26260 name apt-cache-32bit-be 2627>8 beshort 1 \b, dirty 2628>40 belong x \b, %u packages 2629>44 belong x \b, %u versions 2630 2631# new format 26320 name apt-cache-be 2633>6 byte 1 \b, dirty 2634>24 belong x \b, %u packages 2635>28 belong x \b, %u versions 2636 26370 bequad 0x98FE76DC 2638>8 ubeshort <10 APT cache data, version %u 2639>>10 beshort x \b.%u, 64 bit big-endian 2640>>0 use apt-cache-64bit-be 2641 26420 lequad 0x98FE76DC 2643>8 uleshort <10 APT cache data, version %u 2644>>10 leshort x \b.%u, 64 bit little-endian 2645>>0 use \^apt-cache-64bit-be 2646 26470 belong 0x98FE76DC 2648>4 ubeshort <10 APT cache data, version %u 2649>>6 ubeshort x \b.%u, 32 bit big-endian 2650>>0 use apt-cache-32bit-be 2651>4 ubyte >9 APT cache data, version %u 2652>>5 ubyte x \b.%u, big-endian 2653>>0 use apt-cache-be 2654 26550 lelong 0x98FE76DC 2656>4 uleshort <10 APT cache data, version %u 2657>>6 uleshort x \b.%u, 32 bit little-endian 2658>>0 use \^apt-cache-32bit-be 2659>4 ubyte >9 APT cache data, version %u 2660>>5 ubyte x \b.%u, little-endian 2661>>0 use \^apt-cache-be 2662#------------------------------------------------------------------------------ 2663# $File: archive,v 1.169 2022/09/12 13:13:28 christos Exp $ 2664# archive: file(1) magic for archive formats (see also "msdos" for self- 2665# extracting compressed archives) 2666# 2667# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 2668# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 2669 2670# POSIX tar archives 2671# URL: https://en.wikipedia.org/wiki/Tar_(computing) 2672# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 2673# header mainly padded with nul bytes 2674500 quad 0 2675!:strength /2 2676# filename or extended attribute printable strings in range space null til umlaut ue 2677>0 ubeshort >0x1F00 2678>>0 ubeshort <0xFCFD 2679# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 2680# at https://sourceforge.net/projects/s-tar/files/testscripts/ 2681>>>508 ubelong&0x8B9E8DFF 0 2682# nul, space or ascii digit 0-7 at start of mode 2683>>>>100 ubyte&0xC8 =0 2684>>>>>101 ubyte&0xC8 =0 2685# nul, space at end of check sum 2686>>>>>>155 ubyte&0xDF =0 2687# space or ascii digit 0 at start of check sum 2688>>>>>>>148 ubyte&0xEF =0x20 2689# FOR DEBUGGING: 2690#>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp) NAME "%s" 2691# check for 1st image main name with digits used for sorting 2692# and for name extension case insensitive like: PNG JPG JPEG TIF TIFF GIF BMP 2693>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp) 2694#foo 2695>>>>>>>>>0 use tar-cbt 2696# if 1st member name without digits and without used image suffix then it is a TAR archive 2697>>>>>>>>0 default x 2698>>>>>>>>>0 use tar-file 2699# minimal check and then display tar archive information which can also be 2700# embedded inside others like Android Backup, Clam AntiVirus database 27010 name tar-file 2702>257 string !ustar 2703# header padded with nuls 2704>>257 ulong =0 2705# GNU tar version 1.29 with non pax format option without refusing 2706# creates misleading V7 header for Long path, Multi-volume, Volume type 2707>>>156 ubyte 0x4c GNU tar archive 2708!:mime application/x-gtar 2709!:ext tar/gtar 2710>>>156 ubyte 0x4d GNU tar archive 2711!:mime application/x-gtar 2712!:ext tar/gtar 2713>>>156 ubyte 0x56 GNU tar archive 2714!:mime application/x-gtar 2715!:ext tar/gtar 2716>>>156 default x tar archive (V7) 2717!:mime application/x-tar 2718!:ext tar 2719# other stuff in padding 2720# some implementations add new fields to the blank area at the end of the header record 2721# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 2722>>257 ulong !0 tar archive (old) 2723!:mime application/x-tar 2724!:ext tar 2725# magic in newer, GNU, posix variants 2726>257 string =ustar 2727# 2 last char of magic and UStar version because string expression does not work 2728# 2 space characters followed by a null for GNU variant 2729>>261 ubelong =0x72202000 POSIX tar archive (GNU) 2730!:mime application/x-gtar 2731!:ext tar/gtar 2732# UStar version with ASCII "00" 2733>>261 ubelong 0x72003030 POSIX 2734# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 2735>>>156 ubyte 0x67 \b.1-2001 2736>>>156 ubyte 0x78 \b.1-2001 2737>>>156 ubyte x tar archive 2738!:mime application/x-ustar 2739!:ext tar/ustar 2740# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 2741>>261 ubelong 0x72000000 tar archive (ustar) 2742!:mime application/x-ustar 2743!:ext tar/ustar 2744# not seen ustar variant with garbish version 2745>>261 default x tar archive (unknown ustar) 2746!:mime application/x-ustar 2747!:ext tar/ustar 2748# type flag of 1st tar archive member 2749#>156 ubyte x \b, %c-type 2750>156 ubyte x 2751>>156 ubyte 0 \b, file 2752>>156 ubyte 0x30 \b, file 2753>>156 ubyte 0x31 \b, hard link 2754>>156 ubyte 0x32 \b, symlink 2755>>156 ubyte 0x33 \b, char device 2756>>156 ubyte 0x34 \b, block device 2757>>156 ubyte 0x35 \b, directory 2758>>156 ubyte 0x36 \b, fifo 2759>>156 ubyte 0x37 \b, reserved 2760>>156 ubyte 0x4c \b, long path 2761>>156 ubyte 0x4d \b, multi volume 2762>>156 ubyte 0x56 \b, volume 2763>>156 ubyte 0x67 \b, global 2764>>156 ubyte 0x78 \b, extension 2765>>156 default x \b, type 2766>>>156 ubyte x '%c' 2767# name[100] 2768>0 string >\0 %-.60s 2769# mode mainly stored as an octal number in ASCII null or space terminated 2770>100 string >\0 \b, mode %-.7s 2771# user id mainly as octal numbers in ASCII null or space terminated 2772>108 string >\0 \b, uid %-.7s 2773# group id mainly as octal numbers in ASCII null or space terminated 2774>116 string >\0 \b, gid %-.7s 2775# size mainly as octal number in ASCII 2776>124 ubyte <0x38 2777>>124 string >\0 \b, size %-.12s 2778# coding indicated by setting the high-order bit of the leftmost byte 2779>124 ubyte >0xEF \b, size 0x 2780>>124 ubyte !0xff \b%2.2x 2781>>125 ubyte !0xff \b%2.2x 2782>>126 ubyte !0xff \b%2.2x 2783>>127 ubyte !0xff \b%2.2x 2784>>128 ubyte !0xff \b%2.2x 2785>>129 ubyte !0xff \b%2.2x 2786>>130 ubyte !0xff \b%2.2x 2787>>131 ubyte !0xff \b%2.2x 2788>>132 ubyte !0xff \b%2.2x 2789>>133 ubyte !0xff \b%2.2x 2790>>134 ubyte !0xff \b%2.2x 2791>>135 ubyte !0xff \b%2.2x 2792# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 2793>136 string >\0 \b, seconds %-.11s 2794# header checksum stored as an octal number in ASCII null or space terminated 2795#>148 string x \b, cksum %.7s 2796# linkname[100] 2797>157 string >\0 \b, linkname %-.40s 2798# additional fields for ustar 2799>257 string =ustar 2800# owner user name null terminated 2801>>265 string >\0 \b, user %-.32s 2802# group name null terminated 2803>>297 string >\0 \b, group %-.32s 2804# device major minor if not zero 2805>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 2806>>>329 string x \b, devmaj %-.7s 2807>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 2808>>>337 string x \b, devmin %-.7s 2809# prefix[155] 2810>>345 string >\0 \b, prefix %-.155s 2811# old non ustar/POSIX tar 2812>257 string !ustar 2813>>508 string =tar\0 2814# padding[255] in old star 2815>>>257 string >\0 \b, padding: %-.40s 2816>>508 default x 2817# padding[255] in old tar sometimes comment field 2818>>>257 string >\0 \b, comment: %-.40s 2819# Summary: Comic Book Archive *.CBT with TAR format 2820# URL: https://en.wikipedia.org/wiki/Comic_book_archive 2821# http://fileformats.archiveteam.org/wiki/Comic_Book_Archive 2822# Note: there exist also RAR, ZIP, ACE and 7Z packed variants 28230 name tar-cbt 2824>0 string x Comic Book archive, tar archive 2825#!:mime application/x-tar 2826!:mime application/vnd.comicbook 2827#!:mime application/vnd.comicbook+tar 2828!:ext cbt 2829# name[100] probably like: 19.jpg 0001.png 0002.png 2830# or maybe like ComicInfo.xml 2831>0 string >\0 \b, 1st image %-.60s 2832 2833# Incremental snapshot gnu-tar format from: 2834# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 28350 string GNU\ tar- GNU tar incremental snapshot data 2836>&0 regex [0-9]\\.[0-9]+-[0-9]+ version %s 2837 2838# cpio archives 2839# 2840# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2841# The idea is to indicate archives produced on machines with the same 2842# byte order as the machine running "file" with "cpio archive", and 2843# to indicate archives produced on machines with the opposite byte order 2844# from the machine running "file" with "byte-swapped cpio archive". 2845# 2846# The SVR4 "cpio(4)" hints that there are additional formats, but they 2847# are defined as "short"s; I think all the new formats are 2848# character-header formats and thus are strings, not numbers. 28490 short 070707 cpio archive 2850!:mime application/x-cpio 28510 short 0143561 byte-swapped cpio archive 2852!:mime application/x-cpio # encoding: swapped 28530 string 070707 ASCII cpio archive (pre-SVR4 or odc) 2854!:mime application/x-cpio 28550 string 070701 ASCII cpio archive (SVR4 with no CRC) 2856!:mime application/x-cpio 28570 string 070702 ASCII cpio archive (SVR4 with CRC) 2858!:mime application/x-cpio 2859 2860# 2861# Various archive formats used by various versions of the "ar" 2862# command. 2863# 2864 2865# 2866# Original UNIX archive formats. 2867# They were written with binary values in host byte order, and 2868# the magic number was a host "int", which might have been 16 bits 2869# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 2870# been ports to little-endian 16-bit-int or 32-bit-int platforms 2871# (x86?) using some of those formats; if none existed, feel free 2872# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 2873# 32-bit. There might have been big-endian ports of that sort as 2874# well. 2875# 28760 leshort 0177555 very old 16-bit-int little-endian archive 28770 beshort 0177555 very old 16-bit-int big-endian archive 28780 lelong 0177555 very old 32-bit-int little-endian archive 28790 belong 0177555 very old 32-bit-int big-endian archive 2880 28810 leshort 0177545 old 16-bit-int little-endian archive 2882>2 string __.SYMDEF random library 28830 beshort 0177545 old 16-bit-int big-endian archive 2884>2 string __.SYMDEF random library 28850 lelong 0177545 old 32-bit-int little-endian archive 2886>4 string __.SYMDEF random library 28870 belong 0177545 old 32-bit-int big-endian archive 2888>4 string __.SYMDEF random library 2889 2890# 2891# From "pdp" (but why a 4-byte quantity?) 2892# 28930 lelong 0x39bed PDP-11 old archive 28940 lelong 0x39bee PDP-11 4.0 archive 2895 2896# 2897# XXX - what flavor of APL used this, and was it a variant of 2898# some ar archive format? It's similar to, but not the same 2899# as, the APL workspace magic numbers in pdp. 2900# 29010 long 0100554 apl workspace 2902 2903# 2904# System V Release 1 portable(?) archive format. 2905# 29060 string =<ar> System V Release 1 ar archive 2907!:mime application/x-archive 2908 2909# 2910# Debian package; it's in the portable archive format, and needs to go 2911# before the entry for regular portable archives, as it's recognized as 2912# a portable archive whose first member has a name beginning with 2913# "debian". 2914# 2915# Update: Joerg Jenderek 2916# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 29170 string =!<arch>\ndebian 2918# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html 2919>14 string -split part of multipart Debian package 2920!:mime application/vnd.debian.binary-package 2921# udeb is used for stripped down deb file 2922!:ext deb/udeb 2923>14 string -binary Debian binary package 2924!:mime application/vnd.debian.binary-package 2925# For ipk packager see also https://en.wikipedia.org/wiki/Opkg 2926!:ext deb/udeb/ipk 2927# This should not happen 2928>14 default x Unknown Debian package 2929# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split 2930>68 string >\0 (format %s) 2931#>68 string !2.0\n 2932#>>68 string x (format %.3s) 2933>68 string =2.0\n 2934# 2nd archive name=control archive name like control.tar.gz or control.tar.xz 2935>>72 string >\0 \b, with %.14s 2936# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} 2937>>0 search/0x93e4f data.tar. \b, data compression 2938# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised 2939# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb 2940>>>&0 string x %.2s 2941# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name 2942>>>&2 ubyte !0x20 2943>>>>&-1 ubyte !0x2f 2944# display 3rd character of file name extension like 2 of bz2 or m of lzma 2945>>>>>&-1 ubyte x \b%c 2946>>>>>>&0 ubyte !0x20 2947>>>>>>>&-1 ubyte !0x2f 2948# display 4th character of file name extension like a of lzma 2949>>>>>>>>&-1 ubyte x \b%c 2950# split debian package case 2951>68 string =2.1\n 2952# dpkg-1.18.25/dpkg-split/info.c 2953# NL terminated ASCII package name like ckermit 2954>>&0 string x \b, %s 2955# NL terminated package version like 302-5.3 2956>>>&1 string x %s 2957# NL terminated MD5 checksum 2958>>>>&1 string x \b, MD5 %s 2959# NL terminated original package length 2960>>>>>&1 string x \b, unsplitted size %s 2961# NL terminated part length 2962>>>>>>&1 string x \b, part length %s 2963# NL terminated package part like n/m 2964>>>>>>>&1 string x \b, part %s 2965# NL terminated package architecture like armhf since dpkg 1.16.1 or later 2966>>>>>>>>&1 string x \b, %s 2967 2968# 2969# MIPS archive; they're in the portable archive format, and need to go 2970# before the entry for regular portable archives, as it's recognized as 2971# a portable archive whose first member has a name beginning with 2972# "__________E". 2973# 29740 string =!<arch>\n__________E MIPS archive 2975!:mime application/x-archive 2976>20 string U with MIPS Ucode members 2977>21 string L with MIPSEL members 2978>21 string B with MIPSEB members 2979>19 string L and an EL hash table 2980>19 string B and an EB hash table 2981>22 string X -- out of date 2982 2983# 2984# BSD/SVR2-and-later portable archive formats. 2985# 2986# Update: Joerg Jenderek 2987# URL: http://fileformats.archiveteam.org/wiki/AR 2988# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ 2989# Note: Mach-O universal binary in ./cafebabe is dependent 2990# TODO: unify current ar archive, MIPS archive, Debian package 2991# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; 2992# *.ar packages from *.a libraries. handle empty archive 29930 string =!<arch>\n current ar archive 2994# print first and possibly second ar_name[16] for debugging purpose 2995#>8 string x \b, 1st "%.16s" 2996#>68 string x \b, 2nd "%.16s" 2997!:mime application/x-archive 2998# a in most case for libraries; lib for Microsoft libraries; ar else cases 2999!:ext a/lib/ar 3000>8 string __.SYMDEF random library 3001# first member with long marked name __.SYMDEF SORTED implies BSD library 3002>68 string __.SYMDEF\ SORTED random library 3003# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf 3004# "archive file" entry moved from ./hp 3005# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture 3006# LST header a_magic 0619h~relocatable library 3007>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 3008>68 belong 0x02100619 - PA-RISC1.1 relocatable library 3009>68 belong 0x02110619 - PA-RISC1.2 relocatable library 3010>68 belong 0x02140619 - PA-RISC2.0 relocatable library 3011#EOF for common ar archives 3012 3013# 3014# "Thin" archive, as can be produced by GNU ar. 3015# 30160 string =!<thin>\n thin archive with 3017>68 belong 0 no symbol entries 3018>68 belong 1 %d symbol entry 3019>68 belong >1 %d symbol entries 3020 30210 search/1 -h- Software Tools format archive text 3022 3023# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 3024# 3025# The first byte is the magic (0x1a), byte 2 is the compression type for 3026# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 3027# filename of the first file (null terminated). Since some types collide 3028# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 3029# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 30300 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 3031!:mime application/x-arc 30320 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 3033!:mime application/x-arc 30340 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 3035!:mime application/x-arc 30360 lelong&0x8080ffff 0x0000031a ARC archive data, packed 3037!:mime application/x-arc 30380 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 3039!:mime application/x-arc 30400 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 3041!:mime application/x-arc 3042# [JW] stuff taken from idarc, obviously ARC successors: 30430 lelong&0x8080ffff 0x00000a1a PAK archive data 3044!:mime application/x-arc 30450 lelong&0x8080ffff 0x0000141a ARC+ archive data 3046!:mime application/x-arc 30470 lelong&0x8080ffff 0x0000481a HYP archive data 3048!:mime application/x-arc 3049 3050# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 3051# I can't create either SPARK or ArcFS archives so I have not tested this stuff 3052# [GRR: the original entries collide with ARC, above; replaced with combined 3053# version (not tested)] 3054#0 byte 0x1a RISC OS archive (spark format) 30550 string \032archive RISC OS archive (ArcFS format) 30560 string Archive\000 RISC OS archive (ArcFS format) 3057 3058# All these were taken from idarc, many could not be verified. Unfortunately, 3059# there were many low-quality sigs, i.e. easy to trigger false positives. 3060# Please notify me of any real-world fishy/ambiguous signatures and I'll try 3061# to get my hands on the actual archiver and see if I find something better. [JW] 3062# probably many can be enhanced by finding some 0-byte or control char near the start 3063 3064# idarc calls this Crush/Uncompressed... *shrug* 30650 string CRUSH Crush archive data 3066# Squeeze It (.sqz) 30670 string HLSQZ Squeeze It archive data 3068# SQWEZ 30690 string SQWEZ SQWEZ archive data 3070# HPack (.hpk) 30710 string HPAK HPack archive data 3072# HAP 30730 string \x91\x33HF HAP archive data 3074# MD/MDCD 30750 string MDmd MDCD archive data 3076# LIM 30770 string LIM\x1a LIM archive data 3078# SAR 30793 string LH5 SAR archive data 3080# BSArc/BS2 30810 string \212\3SB\020\0 BSArc/BS2 archive data 3082# Bethesda Softworks Archive (Oblivion) 30830 string BSA\0 BSArc archive data 3084>4 lelong x version %d 3085# MAR 30862 string =-ah MAR archive data 3087# ACB 3088#0 belong&0x00f800ff 0x00800000 ACB archive data 3089# CPZ 3090# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 3091# JRC 30920 string JRchive JRC archive data 3093# Quantum 30940 string DS\0 Quantum archive data 3095# ReSOF 30960 string PK\3\6 ReSOF archive data 3097# QuArk 30980 string 7\4 QuArk archive data 3099# YAC 310014 string YC YAC archive data 3101# X1 31020 string X1 X1 archive data 31030 string XhDr X1 archive data 3104# CDC Codec (.dqt) 31050 belong&0xffffe000 0x76ff2000 CDC Codec archive data 3106# AMGC 31070 string \xad6" AMGC archive data 3108# NuLIB 31090 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 3110# PakLeo 31110 string LEOLZW PAKLeo archive data 3112# ChArc 31130 string SChF ChArc archive data 3114# PSA 31150 string PSA PSA archive data 3116# CrossePAC 31170 string DSIGDCC CrossePAC archive data 3118# Freeze 31190 string \x1f\x9f\x4a\x10\x0a Freeze archive data 3120# KBoom 31210 string \xc2\xa8MP\xc2\xa8 KBoom archive data 3122# NSQ, must go after CDC Codec 31230 string \x76\xff NSQ archive data 3124# DPA 31250 string Dirk\ Paehl DPA archive data 3126# BA 3127# TODO: idarc says "bytes 0-2 == bytes 3-5" 3128# TTComp 3129# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 3130# Update: Joerg Jenderek 3131# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 31320 string \0\6 3133# look for first keyword of Panorama database *.pan 3134>12 search/261 DESIGN 3135# skip keyword with low entropy 3136>12 default x 3137# skip DOS 2.0 backup id file, sequence 6 with many nils like BACKUPID_xx6.@@@ handled by ./msdos 3138>>8 quad !0 3139>>>0 use ttcomp 3140# variant ASCII, 4K dictionary (strength=48=50-2). With strength=49 wrong order! WHY? 31410 string \1\6 3142# TODO: 3143# skip VAX-order 68k Blit mpx/mux executable (strength=50) handled by ./blit 3144!:strength -2 3145>0 use ttcomp 31460 string \0\5 3147# skip some DOS 2.0 backup id file, sequence 5 with many nils like BACKUPID_075.@@@ handled by ./msdos 3148>8 quad !0 3149>>0 use ttcomp 31500 string \1\5 3151# TODO: 3152# variant ASCII, 2K dictionary (strength=48=50-2). With strength=49 wrong order! WHY? 3153# skip ctab data (strength=50) handled by ./ibm6000 3154# skip locale data table (strength=50) handled by ./digital 3155!:strength -2 3156>0 use ttcomp 31570 string \0\4 3158# skip many Maple help database *.hdb with version tag handled by ./maple 3159>1028 string !version 3160# skip veclib maple.hdb by looking for Mable keyword 3161>>4 search/1091 Maple\040 3162#>4 search/34090 Maple\040 3163>>4 default x 3164# skip DOS 2.0-3.2 backed up sequence 4 with many nils like LOTUS5.RAR handled by ./msdos 3165# skip xBASE Compound Index file *.CDX with many nils 3166>>>0x54 quad !0 3167>>>>0 use ttcomp 31680 string \1\4 3169# TODO: 3170# skip Commodore PET BASIC 4.0 program *.prg 3171# variant ASCII, 1K dictionary (strength=48=50-2). With strength=49 wrong order! WHY? 3172# skip shared library (strength=50) handled by ./ibm6000 3173!:strength -2 3174>0 use ttcomp 3175# display information of TTComp archive 31760 name ttcomp 3177# (version 5.25) labeled the entry as "TTComp archive data" 3178>0 ubyte x TTComp archive data 3179!:mime application/x-compress-ttcomp 3180# PBACKSCR.PI1 3181!:ext $xe/$ts/pi1/__d 3182# compression type: 0~binary compression 1~ASCII compression 3183>0 ubyte 0 \b, binary 3184>0 ubyte 1 \b, ASCII 3185# size of the dictionary: 4~1024 bytes 5~2048 bytes 6~4096 bytes 3186>1 ubyte 4 \b, 1K 3187>1 ubyte 5 \b, 2K 3188>1 ubyte 6 \b, 4K 3189>1 ubyte x dictionary 3190# https://mark0.net/forum/index.php?topic=848 3191# last 3 bytes probably have only 8 possible bit sequences 3192# xxxxxxxx 0000000x 11111111 ____FFh 3193# xxxxxxxx 10000000 01111111 __807Fh 3194# 0xxxxxxx 11000000 00111111 __C03Fh 3195# 00xxxxxx 11100000 00011111 __E01Fh 3196# 000xxxxx 11110000 00001111 __F00Fh 3197# 0000xxxx 11111000 00000111 __F807h 3198# 00000xxx 11111100 00000011 __FC03h 3199# 000000xx 11111110 00000001 __FE01h 3200# but for quickgif.__d 0A7DD4h 3201#>-3 ubyte x \b, last 3 bytes 0x%2.2x 3202#>-2 ubeshort x \b%4.4x 3203# From: Joerg Jenderek 3204# URL: https://en.wikipedia.org/wiki/Disk_Copy 3205# reference: http://nulib.com/library/FTN.e00005.htm 32060x52 ubeshort 0x0100 3207# test for disk image size equal or above 400k 3208>0x40 ubelong >409599 3209# test also for disk image size equal or below 1440k to skip 3210# windows7en.mbr UNICODE.DAT 3211#>>0x40 ubelong <1474561 3212# test now for "low" disk image size equal or below 64 MiB to skip 3213# windows7en.mbr (B441BBAAh) UNICODE.DAT (0400AF05h) 3214>>0x40 ubelong <0x04000001 3215# To skip Flags$StringJoiner.class with size 00106A61h test also for valid disk image sizes 3216# 00064000 for 400k GCR disks dc42-400k-gcr.trid.xml 3217# 000c8000 for 800k GCR disks dc42-800k-gcr.trid.xml 3218# 000b4000 for 720k MFM disks dc42-720k-mfm.trid.xml 3219# 00168000 for 1440k MFM disks dc42-1440k-mfm.trid.xml 3220# https://lisaem.sunder.net/LisaProjectDocs.txt 3221# 00500000 05M available 3222# 00A00000 10M available 3223# 01800000 24M possible 3224# 02000000 32M uncertain 3225# 04000000 64M uncertain 3226>>>0x40 ubelong&0xf8003fFF 0 3227# skip samples with invalid disk name length like: 3228# 181 (biosmd80.rom) 202 (Flags$StringJoiner.class) 90 (UNICODE.DAT) 3229>>>>0x0 ubyte <64 3230>>>>>0 use dc42-floppy 3231# display information of Apple DiskCopy 4.2 floppy image 32320 name dc42-floppy 3233# disk name length; maximal 63 3234#>0 ubyte x DISK NAME LENGTH %u 3235# ASCII image pascal (maximal 63 bytes) name padded with NULs like: 3236# "Microsoft Mail" "Disquette 2" "IIe Installer Disk" 3237# "-lisaem.sunder.net hd-" (dc42-lisaem.trid.xml) "-not a Macintosh disk" (dc42-nonmac.trid.xml) 3238>00 pstring/B x Apple DiskCopy 4.2 image %s 3239#!:mime application/octet-stream 3240!:mime application/x-dc42-floppy-image 3241!:apple dCpydImg 3242# probably also img like: "Utilitaires 2.img" "Installation 7.img" 3243!:ext image/dc42/img 3244# data size in bytes like: 409600 737280 819200 1474560 3245>0x40 ubelong x \b, %u bytes 3246# for debugging purpose size in hexadecimal 3247#>0x40 ubelong x (%#8.8x) 3248# tag size in bytes like: 0 (often) 2580h (PUID fmt/625) 4B00h (Microsoft Mail.image) 3249>0x44 ubelong >0 \b, %#x tag size 3250# data checksum 3251#>0x48 ubelong x \b, %#x checksum 3252# tag checksum 3253#>0x4c ubelong x \b, %#x tag checksum 3254# disk encoding like: 0 1 2 3 (PUID: fmt/625) 3255>0x50 ubyte 0 \b, GCR CLV ssdd (400k) 3256>0x50 ubyte 1 \b, GCR CLV dsdd (800k) 3257>0x50 ubyte 2 \b, MFM CAV dsdd (720k) 3258>0x50 ubyte 3 \b, MFM CAV dshd (1440k) 3259>0x50 ubyte >3 \b, %#x encoding 3260# format byte like: 12h (Lisa 400K) 24h (400K Macintosh) 96h (800K Apple II disk) 3261# 2 (Mac 400k "Disquette Installation 13.image") 3262# 22h (double-sided MFM or Mac 800k "Disco 12.image" "IIe Installer Disk.image") 3263>0x51 ubyte x \b, %#x format 3264#>0x54 ubequad x \b, data %#16.16llx 3265# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 32660 string ESP ESP archive data 3267# ZPack 32680 string \1ZPK\1 ZPack archive data 3269# Sky 32700 string \xbc\x40 Sky archive data 3271# UFA 32720 string UFA UFA archive data 3273# Dry 32740 string =-H2O DRY archive data 3275# FoxSQZ 32760 string FOXSQZ FoxSQZ archive data 3277# AR7 32780 string ,AR7 AR7 archive data 3279# PPMZ 32800 string PPMZ PPMZ archive data 3281# MS Compress 3282# Update: Joerg Jenderek 3283# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 3284# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 3285# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 32864 string \x88\xf0\x27 3287# KWAJ variant 3288>0 string KWAJ MS Compress archive data, KWAJ variant 3289!:mime application/x-ms-compress-kwaj 3290# extension not working in version 5.32 3291# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 3292# file: line 284: Bad magic entry ' ??_' 3293!:ext ??_ 3294# compression method (0-4) 3295>>8 uleshort x \b, %u method 3296# offset of compressed data 3297>>10 uleshort x \b, %#x offset 3298#>>(10.s) uleshort x 3299#>>>&-6 string x \b, TEST extension %-.3s 3300# header flags to mark header extensions 3301>>12 uleshort >0 \b, %#x flags 3302# 4 bytes: decompressed length of file 3303>>12 uleshort &0x01 3304>>>14 ulelong x \b, original size: %u bytes 3305# 2 bytes: unknown purpose 3306# 2 bytes: length of unknown data + mentioned bytes 3307# 1-9 bytes: null-terminated file name 3308# 1-4 bytes: null-terminated file extension 3309>>12 uleshort &0x08 3310>>>12 uleshort ^0x01 3311>>>>12 uleshort ^0x02 3312>>>>>12 uleshort ^0x04 3313>>>>>>12 uleshort ^0x10 3314>>>>>>>14 string x \b, %-.8s 3315>>>>>>12 uleshort &0x10 3316>>>>>>>14 string x \b, %-.8s 3317>>>>>>>>&1 string x \b.%-.3s 3318>>>>>12 uleshort &0x04 3319>>>>>>12 uleshort ^0x10 3320>>>>>>>(14.s) uleshort x 3321>>>>>>>>&14 string x \b, %-.8s 3322>>>>>>12 uleshort &0x10 3323>>>>>>>(14.s) uleshort x 3324>>>>>>>>&14 string x \b, %-.8s 3325>>>>>>>>>&1 string x \b.%-.3s 3326>>>>12 uleshort &0x02 3327>>>>>12 uleshort ^0x04 3328>>>>>>12 uleshort ^0x10 3329>>>>>>>16 string x \b, %-.8s 3330>>>>>>12 uleshort &0x10 3331>>>>>>>16 string x \b, %-.8s 3332>>>>>>>>&1 string x \b.%-.3s 3333>>>>>12 uleshort &0x04 3334>>>>>>12 uleshort ^0x10 3335>>>>>>>(16.s) uleshort x 3336>>>>>>>>&16 string x \b, %-.8s 3337>>>>>>12 uleshort &0x10 3338>>>>>>>(16.s) uleshort x 3339>>>>>>>&16 string x %-.8s 3340>>>>>>>>&1 string x \b.%-.3s 3341>>>12 uleshort &0x01 3342>>>>12 uleshort ^0x02 3343>>>>>12 uleshort ^0x04 3344>>>>>>12 uleshort ^0x10 3345>>>>>>>18 string x \b, %-.8s 3346>>>>>>12 uleshort &0x10 3347>>>>>>>18 string x \b, %-.8s 3348>>>>>>>>&1 string x \b.%-.3s 3349>>>>>12 uleshort &0x04 3350>>>>>>12 uleshort ^0x10 3351>>>>>>>(18.s) uleshort x 3352>>>>>>>>&18 string x \b, %-.8s 3353>>>>>>12 uleshort &0x10 3354>>>>>>>(18.s) uleshort x 3355>>>>>>>>&18 string x \b, %-.8s 3356>>>>>>>>>&1 string x \b.%-.3s 3357>>>>12 uleshort &0x02 3358>>>>>12 uleshort ^0x04 3359>>>>>>12 uleshort ^0x10 3360>>>>>>>20 string x \b, %-.8s 3361>>>>>>12 uleshort &0x10 3362>>>>>>>20 string x \b, %-.8s 3363>>>>>>>>&1 string x \b.%-.3s 3364>>>>>12 uleshort &0x04 3365>>>>>>12 uleshort ^0x10 3366>>>>>>>(20.s) uleshort x 3367>>>>>>>>&20 string x \b, %-.8s 3368>>>>>>12 uleshort &0x10 3369>>>>>>>(20.s) uleshort x 3370>>>>>>>>&20 string x \b, %-.8s 3371>>>>>>>>>&1 string x \b.%-.3s 3372# 2 bytes: length of data + mentioned bytes 3373# 3374# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 3375# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 3376# Reference: http://www.cabextract.org.uk/libmspack/doc/szdd_kwaj_format.html 3377# http://mark0.net/download/triddefs_xml.7z/defs/s/szdd.trid.xml 3378# Note: called "Microsoft SZDD compressed (Haruhiko Okumura's LZSS)" by TrID 3379# verfied by 7-Zip `7z l -tMsLZ -slt *.??_` as MsLZ 3380# `deark -l -m lzss_oku -d2 setup-1-41.bin` as "LZSS.C by Haruhiko Okumura" 3381>0 string SZDD MS Compress archive data, SZDD variant 3382# 2nd part of signature 3383#>>4 ubelong 0x88F02733 \b, SIGNATURE OK 3384!:mime application/x-ms-compress-szdd 3385!:ext ??_ 3386# The character missing from the end of the filename (0=unknown) 3387>>9 string >\0 \b, %-.1s is last character of original name 3388# https://www.betaarchive.com/forum/viewtopic.php?t=26161 3389# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 3390>>8 string !A \b, %-.1s method 3391>>10 ulelong >0 \b, original size: %u bytes 3392# Summary: InstallShield archive with SZDD compressed 3393# URL: https://community.flexera.com/t5/InstallShield-Knowledge-Base/InstallShield-Redistributable-Files/ta-p/5647 3394# From: Joerg Jenderek 33951 search/48/bs SZDD\x88\xF0\x27\x33 InstallShield archive 3396#!:mime application/octet-stream 3397!:mime application/x-installshield-compress-szdd 3398!:ext ibt 3399# name of compressed archive member like: setup.dl_ _setup7int.dl_ _setup2k.dl_ _igdi.dl_ cabinet.dl_ 3400>0 string x %s 3401# name of uncompressed archive member like: setup.dll _Setup.dll IGdi.dll CABINET.DLL 3402>>&1 string x (%s) 3403# probably version like: 9.0.0.333 9.1.0.429 11.50.0.42618 3404>>>&1 string x \b, version %s 3405# SZDD member length like: 168048 169333 181842 3406>>>>&1 string x \b, %s bytes 3407# MS Compress archive data 3408#>&0 string SZDD \b, SIGNATURE FOUND 3409>&0 indirect x 3410# QBasic SZDD variant 34113 string \x88\xf0\x27 3412>0 string SZ\x20 MS Compress archive data, QBasic variant 3413!:mime application/x-ms-compress-sz 3414!:ext ??$ 3415>>8 ulelong >0 \b, original size: %u bytes 3416 3417# Summary: CAZIP compressed file 3418# From: Joerg Jenderek 3419# URL: http://fileformats.archiveteam.org/wiki/CAZIP 3420# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/caz.trid.xml 3421# Note: Format is distinct from CAZIPXP compressed 34220 string \x0D\x0A\x1ACAZIP CAZIP compressed file 3423#!:mime application/octet-stream 3424!:mime application/x-compress-cazip 3425# like: BLINKER.WR_ CLIPDEFS._ CAOSETUP.EX_ CLIPPER.EX_ FILEIO.C_ 3426!:ext ??_/?_/_ 3427 3428# Summary: FTCOMP compressed archive 3429# From: Joerg Jenderek 3430# URL: http://fileformats.archiveteam.org/wiki/FTCOMP 3431# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-ftcomp.trid.xml 3432# Note: called by TrID "FTCOMP compressed archive" 3433# extracted by `unpack seahelp.hl_` 343424 string/b FTCOMP FTCOMP compressed archive 3435#!:mime application/octet-stream 3436!:mime application/x-compress-ftcomp 3437!:ext ??_/??@/dll/drv/pk2/ 3438# probably A596FDFF magic at the beginning 3439>0 ubelong !0xA596FDFF \b, at beginning %#x 3440# probably original file name with directory like: \OS2\unpack.exe \SYSTEM\8514.DRV MAHJONGG.EXE 3441>41 string x "%s" 3442 3443# MP3 (archiver, not lossy audio compression) 34440 string MP3\x1a MP3-Archiver archive data 3445# ZET 34460 string OZ\xc3\x9d ZET archive data 3447# TSComp 34480 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 3449# ARQ 34500 string gW\4\1 ARQ archive data 3451# Squash 34523 string OctSqu Squash archive data 3453# Terse 34540 string \5\1\1\0 Terse archive data 3455# PUCrunch 34560 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 3457# UHarc 34580 string UHA UHarc archive data 3459# ABComp 34600 string \2AB ABComp archive data 34610 string \3AB2 ABComp archive data 3462# CMP 34630 string CO\0 CMP archive data 3464# Splint 34650 string \x93\xb9\x06 Splint archive data 3466# InstallShield 34670 string \x13\x5d\x65\x8c InstallShield Z archive Data 3468# Gather 34691 string GTH Gather archive data 3470# BOA 34710 string BOA BOA archive data 3472# RAX 34730 string ULEB\xa RAX archive data 3474# Xtreme 34750 string ULEB\0 Xtreme archive data 3476# Pack Magic 34770 string @\xc3\xa2\1\0 Pack Magic archive data 3478# BTS 34790 belong&0xfeffffff 0x1a034465 BTS archive data 3480# ELI 5750 34810 string Ora\ ELI 5750 archive data 3482# QFC 34830 string \x1aFC\x1a QFC archive data 34840 string \x1aQF\x1a QFC archive data 3485# PRO-PACK 34860 string RNC PRO-PACK archive data 3487# 777 34880 string 777 777 archive data 3489# LZS221 34900 string sTaC LZS221 archive data 3491# HPA 34920 string HPA HPA archive data 3493# Arhangel 34940 string LG Arhangel archive data 3495# EXP1, uses bzip2 34960 string 0123456789012345BZh EXP1 archive data 3497# IMP 34980 string IMP\xa IMP archive data 3499# NRV 35000 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 3501# Squish 35020 string \x73\xb2\x90\xf4 Squish archive data 3503# Par 35040 string PHILIPP Par archive data 35050 string PAR Par archive data 3506# HIT 35070 string UB HIT archive data 3508# SBX 35090 belong&0xfffff000 0x53423000 SBX archive data 3510# NaShrink 35110 string NSK NaShrink archive data 3512# SAPCAR 35130 string #\ CAR\ archive\ header SAPCAR archive data 35140 string CAR\ 2.00 SAPCAR archive data 35150 string CAR\ 2.01 SAPCAR archive data 3516#!:mime application/octet-stream 3517!:mime application/vnd.sar 3518!:ext sar 3519# Disintegrator 35200 string DST Disintegrator archive data 3521# ASD 35220 string ASD ASD archive data 3523# InstallShield CAB 3524# Update: Joerg Jenderek at Nov 2021 3525# URL: https://en.wikipedia.org/wiki/InstallShield 3526# Reference: https://github.com/twogood/unshield/blob/master/lib/cabfile.h 3527# Note: Not compatible with Microsoft CAB files 3528# http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield.trid.xml 3529# CAB_SIGNATURE 0x28635349 35300 string ISc( InstallShield 3531#!:mime application/octet-stream 3532!:mime application/x-installshield 3533# http://mark0.net/download/triddefs_xml.7z/defs/a/ark-cab-ishield-hdr.trid.xml 3534>16 ulelong !0 setup header 3535# like: _SYS1.HDR _USER1.HDR data1.hdr 3536!:ext hdr 3537>16 ulelong =0 CAB 3538# like: _SYS1.CAB _USER1.CAB DATA1.CAB data2.cab 3539!:ext cab 3540# https://github.com/twogood/unshield/blob/master/lib/helper.c 3541# version like: 0x1005201 0x100600c 0x1007000 0x1009500 3542# 0x2000578 0x20005dc 0x2000640 0x40007d0 0x4000834 3543>4 ulelong x \b, version %#x 3544# volume_info like: 0 3545>8 ulelong !0 \b, volume_info %#x 3546# cab_descriptor_offset like: 0x200 3547>12 ulelong !0x200 \b, offset %#x 3548#>0x200 ubequad x \b, at 0x200 %#16.16llx 3549# cab_descriptor_size like: 0 (*.cab) BD5 C8B DA5 E2A E36 116C 251D 4DA9 56F0 5CC2 6E4B 777D 779E 1F7C2 3550>16 ulelong !0 \b, descriptor size %#x 3551# TOP4 35520 string T4\x1a TOP4 archive data 3553# BatComp left out: sig looks like COM executable 3554# so TODO: get real 4dos batcomp file and find sig 3555# BlakHole 35560 string BH\5\7 BlakHole archive data 3557# BIX 35580 string BIX0 BIX archive data 3559# ChiefLZA 35600 string ChfLZ ChiefLZA archive data 3561# Blink 35620 string Blink Blink archive data 3563# Logitech Compress 35640 string \xda\xfa Logitech Compress archive data 3565# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 35661 string (C)\ STEPANYUK ARS-Sfx archive data 3567# AKT/AKT32 35680 string AKT32 AKT32 archive data 35690 string AKT AKT archive data 3570# NPack 35710 string MSTSM NPack archive data 3572# PFT 35730 string \0\x50\0\x14 PFT archive data 3574# SemOne 35750 string SEM SemOne archive data 3576# PPMD 35770 string \x8f\xaf\xac\x84 PPMD archive data 3578# FIZ 35790 string FIZ FIZ archive data 3580# MSXiE 35810 belong&0xfffff0f0 0x4d530000 MSXiE archive data 3582# DeepFreezer 35830 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 3584# DC 35850 string =<DC- DC archive data 3586# TPac 35870 string \4TPAC\3 TPac archive data 3588# Ai 35890 string Ai\1\1\0 Ai archive data 35900 string Ai\1\0\0 Ai archive data 3591# Ai32 35920 string Ai\2\0 Ai32 archive data 35930 string Ai\2\1 Ai32 archive data 3594# SBC 35950 string SBC SBC archive data 3596# Ybs 35970 string YBS Ybs archive data 3598# DitPack 35990 string \x9e\0\0 DitPack archive data 3600# DMS 36010 string DMS! DMS archive data 3602# EPC 36030 string \x8f\xaf\xac\x8c EPC archive data 3604# VSARC 36050 string VS\x1a VSARC archive data 3606# PDZ 36070 string PDZ PDZ archive data 3608# ReDuq 36090 string rdqx ReDuq archive data 3610# GCA 36110 string GCAX GCA archive data 3612# PPMN 36130 string pN PPMN archive data 3614# WinImage 36153 string WINIMAGE WinImage archive data 3616# Compressia 36170 string CMP0CMP Compressia archive data 3618# UHBC 36190 string UHB UHBC archive data 3620# WinHKI 36210 string \x61\x5C\x04\x05 WinHKI archive data 3622# WWPack data file 36230 string WWP WWPack archive data 3624# BSN (BSA, PTS-DOS) 36250 string \xffBSG BSN archive data 36261 string \xffBSG BSN archive data 36273 string \xffBSG BSN archive data 36281 string \0\xae\2 BSN archive data 36291 string \0\xae\3 BSN archive data 36301 string \0\xae\7 BSN archive data 3631# AIN 36320 string \x33\x18 AIN archive data 36330 string \x33\x17 AIN archive data 3634# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 3635# SZip (TODO: doesn't catch all versions) 36360 string SZ\x0a\4 SZip archive data 3637# XPack DiskImage 3638# *.XDI updated by Joerg Jenderek Sep 2015 3639# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 3640# GRR: this test is still too general as it catches also text files starting with jm 36410 string jm 3642# only found examples with this additional characteristic 2 bytes 3643>2 string \x2\x4 Xpack DiskImage archive data 3644#!:ext xdi 3645# XPack Data 3646# *.xpa updated by Joerg Jenderek Sep 2015 3647# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 36480 string xpa XPA 3649!:ext xpa 3650# XPA32 3651# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 3652# created by XPA32.EXE version 1.0.2 for Windows 3653>0 string xpa\0\1 \b32 archive data 3654# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 3655>3 ubeshort !0x0001 \bck archive data 3656# XPack Single Data 3657# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 3658# letter 'I'+ acute accent is equivalent to \xcd 36590 string \xcd\ jm Xpack single archive data 3660#!:mime application/x-xpa-compressed 3661!:ext xpa 3662 3663# TODO: missing due to unknown magic/magic at end of file: 3664#DWC 3665#ARG 3666#ZAR 3667#PC/3270 3668#InstallIt 3669#RKive 3670#RK 3671#XPack Diskimage 3672 3673# These were inspired by idarc, but actually verified 3674# Dzip archiver (.dz) 3675# Update: Joerg Jenderek 3676# URL: http://speeddemosarchive.com/dzip/ 3677# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 3678# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 36790 string DZ 3680# latest version is 2.9 dated 7 may 2003 3681>2 byte <4 Dzip archive data 3682!:mime application/x-dzip 3683!:ext dz 3684>>2 byte x \b, version %i 3685>>3 byte x \b.%i 3686>>4 ulelong x \b, offset %#x 3687>>8 ulelong x \b, %u files 3688# ZZip archiver (.zz) 36890 string ZZ\ \0\0 ZZip archive data 36900 string ZZ0 ZZip archive data 3691# PAQ archiver (.paq) 36920 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 36930 string PAQ PAQ archive data 3694>3 byte&0xf0 0x30 3695>>3 byte x (v%c) 3696# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 3697# Update: Joerg Jenderek 3698# URL: http://fileformats.archiveteam.org/wiki/JAR_(ARJ_Software) 3699# reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jar.trid.xml 3700# https://www.sac.sk/download/pack/jar102x.exe/TECHNOTE.DOC 3701# Note: called "JAR compressed archive" by TrID 37020xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 3703#!:mime application/octet-stream 3704!:mime application/x-compress-j 3705>0 ulelong x \b, CRC32 %#x 3706# standard suffix is ".j"; for multi volumes following order j01 j02 ... j99 100 ... 990 3707!:ext j/j01/j02 3708# URL: http://fileformats.archiveteam.org/wiki/JARCS 3709# reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-jarcs.trid.xml 3710# Note: called "JARCS compressed archive" by TrID 37110 string JARCS JAR (ARJ Software, Inc.) archive data 3712#!:mime application/octet-stream 3713!:mime application/x-compress-jar 3714!:ext jar 3715 3716# ARJ archiver (jason@jarthur.Claremont.EDU) 3717# URL: http://fileformats.archiveteam.org/wiki/ARJ 3718# reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-arj.trid.xml 3719# https://github.com/FarGroup/FarManager/ 3720# blob/master/plugins/multiarc/arc.doc/arj.txt 3721# Note: called "ARJ compressed archive" by TrID and 3722# "ARJ File Format" by DROID via PUID fmt/610 3723# verified by `7z l -tarj PHRACK1.ARJ` and 3724# `arj.exe l TEST-hk9.ARJ` 37250 leshort 0xea60 3726# skip DROID fmt-610-signature-id-946.arj by check for valid file type of main header 3727>0xA ubyte 2 3728>>0 use arj-archive 37290 name arj-archive 3730>0 leshort x ARJ archive 3731!:mime application/x-arj 3732# look for terminating 0-character of filename 3733>0x26 search/1024 \0 3734# file name extension is normally .arj but not for parts of multi volume 3735#>>&-5 string x extension %.4s 3736>>&-5 string/c .arj data 3737!:ext arj 3738>>&-5 default x 3739# for multi volume first name is archive.arj then following parts archive.a01 archive.a02 ... 3740>>>8 byte &0x04 data 3741!:ext a01/a02 3742# for SFX first name is archive.exe then following parts archive.e01 archive.e02 ... 3743>>>8 byte ^0x04 data, SFX multi-volume 3744!:ext e01/e02 3745# basic header size like: 0x002b 0x002c 0x04e0 0x04e3 0x04e7 3746#>2 uleshort x basic header size %#4.4x 3747# next fragment content like: 0x0a200a003a8fc713 0x524a000010bb3471 0x524a0000c73c70f9 3748#>(2.s) ubequad x NEXT FRAGMENT CONTENT %#16.16llx 3749# first_hdr_size; seems to be same as basic header size 3750#>2 uleshort x 1st header size %#x 3751# archiver version number like: 3 4 6 11 102 3752>5 byte x \b, v%d 3753# minimum archiver version to extract like: 1 3754>6 ubyte !1 \b, minimum %u to extract 3755# FOR DEBUGGING 3756#>8 byte x \b, FLAGS %#x 3757# GARBLED_FLAG1; garble with password; g switch 3758>8 byte &0x01 \b, password-protected 3759# encryption version: 0~old 1~old 2~new 3~reserved 4~40 bit key GOST 3760>>0x20 ubyte x (v%u) 3761#>8 byte &0x02 \b, secured 3762# ANSIPAGE_FLAG; indicates ANSI codepage used by ARJ32; hy switch 3763>8 byte &0x02 \b, ANSI codepage 3764# VOLUME_FLAG indicates presence of succeeding volume; but apparently not for SFX 3765>8 byte &0x04 \b, multi-volume 3766#>8 byte &0x08 \b, file-offset 3767# ARJPROT_FLAG; build with data protection record; hk switch 3768>8 byte &0x08 \b, recoverable 3769# arj protection factor; maximal 10; switch hky -> factor=y+1 3770>>0x22 byte x (factor %u) 3771>8 byte &0x10 \b, slash-switched 3772# BACKUP_FLAG; obsolete 3773>8 byte &0x20 \b, backup 3774# SECURED_FLAG; 3775>8 byte &0x40 \b, secured, 3776# ALTNAME_FLAG; indicates dual-name archive 3777>8 byte &0x80 \b, dual-name 3778# security version; 0~old 2~current 3779>9 ubyte !0 3780>>9 ubyte !2 \b, security version %u 3781# file type; 2 in main header; 0~binary 1~7-bitText 2~comment 3~directory 4~VolumeLabel 5=ChapterLabel 3782>0xA ubyte !2 \b, file type %u 3783# date+time when original archive was created in MS-DOS format via ./msdos 3784>0xC ulelong x \b, created 3785>0xC use dos-date 3786# or date and time by new internal function 3787#>0xE lemsdosdate x %s 3788#>0xC lemsdostime x %s 3789# FOR DEBUGGING 3790#>0x12 uleshort x RAW DATE %#4.4x 3791#>0x10 uleshort x RAW TIME %#4.4x 3792# date+time when archive was last modified; sometimes nil or 3793# maybe wrong like in HP4DRVR.ARJ 3794#>0x10 ulelong >0 \b, modified 3795#>>0x10 use dos-date 3796# or date and time by new internal function 3797#>>0x12 lemsdosdate x %s 3798#>>0x10 lemsdostime x %s 3799# archive size (currently used only for secured archives); MAYBE? 3800#>0x14 ulelong !0 \b, file size %u 3801# security envelope file position; MAYBE? 3802#>0x18 ulelong !0 \b, at %#x security envelope 3803# filespec position in filename; WHAT IS THAT? 3804#>0x1C uleshort >0 \b, filespec position %#x 3805# length in bytes of security envelope data like: 2CAh 301h 364h 471h 3806>0x1E uleshort !0 \b, security envelope length %#x 3807# last chapter like: 0 1 3808>0x21 ubyte !0 \b, last chapter %u 3809# filename (null-terminated string); sometimes at 0x26 when 4 bytes for extra data 3810>34 byte x \b, original name: 3811# with extras data 3812>34 byte <0x0B 3813>>38 string x %s 3814# without extras data 3815>34 byte >0x0A 3816>>34 string x %s 3817# host OS: 0~MSDOS ... 11~WIN32 3818>7 byte 0 \b, os: MS-DOS 3819>7 byte 1 \b, os: PRIMOS 3820>7 byte 2 \b, os: Unix 3821>7 byte 3 \b, os: Amiga 3822>7 byte 4 \b, os: Macintosh 3823>7 byte 5 \b, os: OS/2 3824>7 byte 6 \b, os: Apple ][ GS 3825>7 byte 7 \b, os: Atari ST 3826>7 byte 8 \b, os: NeXT 3827>7 byte 9 \b, os: VAX/VMS 3828>7 byte 10 \b, os: WIN95 3829>7 byte 11 \b, os: WIN32 3830# [JW] idarc says this is also possible 38312 leshort 0xea60 ARJ archive data 3832#2 leshort 0xea60 3833#>2 use arj-archive 3834 3835# HA archiver (Greg Roelofs, newt@uchicago.edu) 3836# This is a really bad format. A file containing HAWAII will match this... 3837#0 string HA HA archive data, 3838#>2 leshort =1 1 file, 3839#>2 leshort >1 %hu files, 3840#>4 byte&0x0f =0 first is type CPY 3841#>4 byte&0x0f =1 first is type ASC 3842#>4 byte&0x0f =2 first is type HSC 3843#>4 byte&0x0f =0x0e first is type DIR 3844#>4 byte&0x0f =0x0f first is type SPECIAL 3845# suggestion: at least identify small archives (<1024 files) 38460 belong&0xffff00fc 0x48410000 HA archive data 3847>2 leshort =1 1 file, 3848>2 leshort >1 %u files, 3849>4 byte&0x0f =0 first is type CPY 3850>4 byte&0x0f =1 first is type ASC 3851>4 byte&0x0f =2 first is type HSC 3852>4 byte&0x0f =0x0e first is type DIR 3853>4 byte&0x0f =0x0f first is type SPECIAL 3854 3855# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 38560 string HPAK HPACK archive data 3857 3858# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 38590 string \351,\001JAM\ JAM archive, 3860>7 string >\0 version %.4s 3861>0x26 byte =0x27 - 3862>>0x2b string >\0 label %.11s, 3863>>0x27 lelong x serial %08x, 3864>>0x36 string >\0 fstype %.8s 3865 3866# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 3867# Update: Joerg Jenderek 3868# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3869# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 3870# 3871# check and display information of lharc (LHa,PMarc) file 38720 name lharc-file 3873# check 1st character of method id like -lz4- -lh5- or -pm2- 3874>2 string - 3875# check 5th character of method id 3876>>6 string - 3877# check header level 0 1 2 3 3878>>>20 ubyte <4 3879# check 2nd, 3th and 4th character of method id 3880>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 3881!:mime application/x-lzh-compressed 3882# creator type "LHA " 3883!:apple ????LHA 3884# display archive type name like "LHa/LZS archive data" or "LArc archive" 3885>>>>>2 string -lz \b 3886!:ext lzs 3887# already known -lzs- -lz4- -lz5- with old names 3888>>>>>>2 string -lzs LHa/LZS archive data 3889>>>>>>3 regex \^lz[45] LHarc 1.x archive data 3890# missing -lz?- with wikipedia names 3891>>>>>>3 regex \^lz[2378] LArc archive 3892# display archive type name like "LHa (2.x) archive data" 3893>>>>>2 string -lh \b 3894# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 3895>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 3896# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 3897# FOOBAR archiver use ".foo" as name extension instead usual one 3898# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 3899>>>>>>>2 string -lh1 \b 3900!:ext lha/lzh/ice 3901>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 3902>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 3903>>>>>>3 regex \^lh[456] LHa (2.x) archive data 3904>>>>>>>2 string -lh5 \b 3905# https://en.wikipedia.org/wiki/BIOS 3906# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like 3907# bios.rom , kd7_v14.bin, 1010.004, ... 3908!:ext lha/lzh/rom/bin 3909# missing -lh?- variants (Joe Jared) 3910>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 3911# UNLHA32 2.67a 3912>>>>>>2 string -lhx LHa (UNLHA32) archive 3913# lha archives with standard file name extensions ".lha" ".lzh" 3914>>>>>>3 regex !\^(lh1|lh5) \b 3915!:ext lha/lzh 3916# this should not happen if all -lh variants are described 3917>>>>>>2 default x LHa (unknown) archive 3918#!:ext lha 3919# PMarc 3920>>>>>3 regex \^pm[012] PMarc archive data 3921!:ext pma 3922# append method id without leading and trailing minus character 3923>>>>>3 string x [%3.3s] 3924>>>>>>0 use lharc-header 3925# 3926# check and display information of lharc header 39270 name lharc-header 3928# header size 0x4 , 0x1b-0x61 3929>0 ubyte x 3930# compressed data size != compressed file size 3931#>7 ulelong x \b, data size %d 3932# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 3933#>19 ubyte x \b, 19_%#x 3934# level identifier 0 1 2 3 3935#>20 ubyte x \b, level %d 3936# time stamp 3937#>15 ubelong x DATE %#8.8x 3938# OS ID for level 1 3939>20 ubyte 1 3940# 0x20 types find for *.rom files 3941>>(21.b+24) ubyte <0x21 \b, %#x OS 3942# ascii type like M for MSDOS 3943>>(21.b+24) ubyte >0x20 \b, '%c' OS 3944# OS ID for level 2 3945>20 ubyte 2 3946#>>23 ubyte x \b, OS ID %#x 3947>>23 ubyte <0x21 \b, %#x OS 3948>>23 ubyte >0x20 \b, '%c' OS 3949# filename only for level 0 and 1 3950>20 ubyte <2 3951# length of filename 3952>>21 ubyte >0 \b, with 3953# filename 3954>>>21 pstring x "%s" 3955# 3956#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 3957#!:mime application/x-lharc 39582 string -lh0- 3959>0 use lharc-file 3960#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 3961#!:mime application/x-lharc 39622 string -lh1- 3963>0 use lharc-file 3964# NEW -lz2- ... -lz8- 39652 string -lz2- 3966>0 use lharc-file 39672 string -lz3- 3968>0 use lharc-file 39692 string -lz4- 3970>0 use lharc-file 39712 string -lz5- 3972>0 use lharc-file 39732 string -lz7- 3974>0 use lharc-file 39752 string -lz8- 3976>0 use lharc-file 3977# [never seen any but the last; -lh4- reported in comp.compression:] 3978#2 string -lzs- LHa/LZS archive data [lzs] 39792 string -lzs- 3980>0 use lharc-file 3981# According to wikipedia and others such a version does not exist 3982#2 string -lh\40- LHa 2.x? archive data [lh ] 3983#2 string -lhd- LHa 2.x? archive data [lhd] 39842 string -lhd- 3985>0 use lharc-file 3986#2 string -lh2- LHa 2.x? archive data [lh2] 39872 string -lh2- 3988>0 use lharc-file 3989#2 string -lh3- LHa 2.x? archive data [lh3] 39902 string -lh3- 3991>0 use lharc-file 3992#2 string -lh4- LHa (2.x) archive data [lh4] 39932 string -lh4- 3994>0 use lharc-file 3995#2 string -lh5- LHa (2.x) archive data [lh5] 39962 string -lh5- 3997>0 use lharc-file 3998#2 string -lh6- LHa (2.x) archive data [lh6] 39992 string -lh6- 4000>0 use lharc-file 4001#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 40022 string -lh7- 4003# !:mime application/x-lha 4004# >20 byte x - header level %d 4005>0 use lharc-file 4006# NEW -lh8- ... -lhe- , -lhx- 40072 string -lh8- 4008>0 use lharc-file 40092 string -lh9- 4010>0 use lharc-file 40112 string -lha- 4012>0 use lharc-file 40132 string -lhb- 4014>0 use lharc-file 40152 string -lhc- 4016>0 use lharc-file 40172 string -lhe- 4018>0 use lharc-file 40192 string -lhx- 4020>0 use lharc-file 4021# taken from idarc [JW] 40222 string -lZ PUT archive data 4023# already done by LHarc magics 4024# this should never happen if all sub types of LZS archive are identified 4025#2 string -lz LZS archive data 40262 string -sw1- Swag archive data 4027 40280 name rar-file-header 4029>24 byte 15 \b, v1.5 4030>24 byte 20 \b, v2.0 4031>24 byte 29 \b, v4 4032>15 byte 0 \b, os: MS-DOS 4033>15 byte 1 \b, os: OS/2 4034>15 byte 2 \b, os: Win32 4035>15 byte 3 \b, os: Unix 4036>15 byte 4 \b, os: Mac OS 4037>15 byte 5 \b, os: BeOS 4038 40390 name rar-archive-header 4040>3 leshort&0x1ff >0 \b, flags: 4041>>3 leshort &0x01 ArchiveVolume 4042>>3 leshort &0x02 Commented 4043>>3 leshort &0x04 Locked 4044>>3 leshort &0x10 NewVolumeNaming 4045>>3 leshort &0x08 Solid 4046>>3 leshort &0x20 Authenticated 4047>>3 leshort &0x40 RecoveryRecordPresent 4048>>3 leshort &0x80 EncryptedBlockHeader 4049>>3 leshort &0x100 FirstVolume 4050 4051# RAR (Roshal Archive) archive 40520 string Rar!\x1a\7\0 RAR archive data 4053!:mime application/x-rar 4054!:ext rar/cbr 4055# file header 4056>(0xc.l+9) byte 0x74 4057>>(0xc.l+7) use rar-file-header 4058# subblock seems to share information with file header 4059>(0xc.l+9) byte 0x7a 4060>>(0xc.l+7) use rar-file-header 4061>9 byte 0x73 4062>>7 use rar-archive-header 4063 40640 string Rar!\x1a\7\1\0 RAR archive data, v5 4065!:mime application/x-rar 4066!:ext rar 4067 4068# Very old RAR archive 4069# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 40700 string RE\x7e\x5e RAR archive data (<v1.5) 4071!:mime application/x-rar 4072!:ext rar/cbr 4073 4074# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 40750 string SQSH squished archive data (Acorn RISCOS) 4076 4077# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 4078# [JW] see exe section for self-extracting version 40790 string UC2\x1a UC2 archive data 4080 4081# PKZIP multi-volume archive 40820 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 4083!:mime application/zip 4084!:ext zip/cbz 4085 4086# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 40870 string PK\005\006 Zip archive data (empty) 4088!:mime application/zip 4089!:ext zip/cbz 4090!:strength +1 40910 string PK\003\004 4092!:strength +1 4093 4094# Specialised zip formats which start with a member named 'mimetype' 4095# (stored uncompressed, with no 'extra field') containing the file's MIME type. 4096# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 4097# contents starting with "application/": 4098>26 string \x8\0\0\0mimetypeapplication/ 4099 4100# KOffice / OpenOffice & StarOffice / OpenDocument formats 4101# From: Abel Cheung <abel@oaka.org> 4102 4103# KOffice (1.2 or above) formats 4104# (mimetype contains "application/vnd.kde.<SUBTYPE>") 4105>>50 string vnd.kde. KOffice (>=1.2) 4106>>>58 string karbon Karbon document 4107>>>58 string kchart KChart document 4108>>>58 string kformula KFormula document 4109>>>58 string kivio Kivio document 4110>>>58 string kontour Kontour document 4111>>>58 string kpresenter KPresenter document 4112>>>58 string kspread KSpread document 4113>>>58 string kword KWord document 4114 4115# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 4116# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 4117# URL: https://en.wikipedia.org/wiki/OpenOffice.org_XML 4118# reference: http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML 4119>>50 string vnd.sun.xml. OpenOffice.org 1.x 4120>>>62 string writer Writer 4121>>>>68 byte !0x2e document 4122!:mime application/vnd.sun.xml.writer 4123!:ext sxw 4124>>>>68 string .template template 4125!:mime application/vnd.sun.xml.writer.template 4126!:ext stw 4127>>>>68 string .web Web template 4128!:mime application/vnd.sun.xml.writer.web 4129!:ext stw 4130>>>>68 string .global global document 4131!:mime application/vnd.sun.xml.writer.global 4132!:ext sxg 4133>>>62 string calc Calc 4134>>>>66 byte !0x2e spreadsheet 4135!:mime application/vnd.sun.xml.calc 4136!:ext sxc 4137>>>>66 string .template template 4138!:mime application/vnd.sun.xml.calc.template 4139!:ext stc 4140>>>62 string draw Draw 4141>>>>66 byte !0x2e document 4142!:mime application/vnd.sun.xml.draw 4143!:ext sxd 4144>>>>66 string .template template 4145!:mime application/vnd.sun.xml.draw.template 4146!:ext std 4147>>>62 string impress Impress 4148>>>>69 byte !0x2e presentation 4149!:mime application/vnd.sun.xml.impress 4150!:ext sxi 4151>>>>69 string .template template 4152!:mime application/vnd.sun.xml.impress.template 4153!:ext sti 4154>>>62 string math Math document 4155!:mime application/vnd.sun.xml.math 4156!:ext sxm 4157>>>62 string base Database file 4158!:mime application/vnd.sun.xml.base 4159!:ext sdb 4160 4161# URL: https://wiki.openoffice.org/wiki/Documentation/DevGuide/Extensions/File_Format 4162# From: Joerg Jenderek 4163# Note: only few OXT samples are detected here by mimetype member 4164# is used by OpenOffice and LibreOffice and probably also NeoOffice 4165# verified by `unzip -Zv *.oxt` or `7z l -slt *.oxt` 4166>>50 string vnd.openofficeorg. OpenOffice 4167>>>68 string extension \b/LibreOffice Extension 4168# http://extension.nirsoft.net/oxt 4169!:mime application/vnd.openofficeorg.extension 4170# like: Gallery-Puzzle.2.1.0.1.oxt 4171!:ext oxt 4172 4173# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 4174# URL: http://fileformats.archiveteam.org/wiki/OpenDocument 4175# https://lists.oasis-open.org/archives/office/200505/msg00006.html 4176# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 4177>>50 string vnd.oasis.opendocument. OpenDocument 4178>>>73 string text 4179>>>>77 byte !0x2d Text 4180!:mime application/vnd.oasis.opendocument.text 4181!:ext odt 4182>>>>77 string -template Text Template 4183!:mime application/vnd.oasis.opendocument.text-template 4184!:ext ott 4185>>>>77 string -web HTML Document Template 4186!:mime application/vnd.oasis.opendocument.text-web 4187!:ext oth 4188>>>>77 string -master Master Document 4189!:mime application/vnd.oasis.opendocument.text-master 4190!:ext odm 4191>>>73 string graphics 4192>>>>81 byte !0x2d Drawing 4193!:mime application/vnd.oasis.opendocument.graphics 4194!:ext odg 4195>>>>81 string -template Drawing Template 4196!:mime application/vnd.oasis.opendocument.graphics-template 4197!:ext otg 4198>>>73 string presentation 4199>>>>85 byte !0x2d Presentation 4200!:mime application/vnd.oasis.opendocument.presentation 4201!:ext odp 4202>>>>85 string -template Presentation Template 4203!:mime application/vnd.oasis.opendocument.presentation-template 4204!:ext otp 4205>>>73 string spreadsheet 4206>>>>84 byte !0x2d Spreadsheet 4207!:mime application/vnd.oasis.opendocument.spreadsheet 4208!:ext ods 4209>>>>84 string -template Spreadsheet Template 4210!:mime application/vnd.oasis.opendocument.spreadsheet-template 4211!:ext ots 4212>>>73 string chart 4213>>>>78 byte !0x2d Chart 4214!:mime application/vnd.oasis.opendocument.chart 4215!:ext odc 4216>>>>78 string -template Chart Template 4217!:mime application/vnd.oasis.opendocument.chart-template 4218!:ext otc 4219>>>73 string formula 4220>>>>80 byte !0x2d Formula 4221!:mime application/vnd.oasis.opendocument.formula 4222!:ext odf 4223>>>>80 string -template Formula Template 4224!:mime application/vnd.oasis.opendocument.formula-template 4225!:ext otf 4226# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml 4227>>>73 string database Database 4228!:mime application/vnd.oasis.opendocument.database 4229!:ext odb 4230# Valid for LibreOffice Base 6.0.1.1 at least 4231>>>73 string base Database 4232# https://bugs.documentfoundation.org/show_bug.cgi?id=45854 4233!:mime application/vnd.oasis.opendocument.database 4234#!:mime application/vnd.oasis.opendocument.base 4235!:ext odb 4236>>>73 string image 4237>>>>78 byte !0x2d Image 4238!:mime application/vnd.oasis.opendocument.image 4239!:ext odi 4240>>>>78 string -template Image Template 4241!:mime application/vnd.oasis.opendocument.image-template 4242!:ext oti 4243 4244# EPUB (OEBPS) books using OCF (OEBPS Container Format) 4245# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 4246# From: Ralf Brown <ralf.brown@gmail.com> 4247>>50 string epub+zip EPUB document 4248!:mime application/epub+zip 4249 4250# From: Joerg Jenderek 4251# URL: http://en.wikipedia.org/wiki/CorelDRAW 4252# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based 4253>>50 string x-vnd.corel. Corel 4254>>>62 string draw.document+zip Draw drawing, version 14-16 4255!:mime application/x-vnd.corel.draw.document+zip 4256!:ext cdr 4257>>>62 string draw.template+zip Draw template, version 14-16 4258!:mime application/x-vnd.corel.draw.template+zip 4259!:ext cdrt 4260>>>62 string zcf.draw.document+zip Draw drawing, version 17-22 4261!:mime application/x-vnd.corel.zcf.draw.document+zip 4262!:ext cdr 4263>>>62 string zcf.draw.template+zip Draw template, version 17-22 4264!:mime application/x-vnd.corel.zcf.draw.template+zip 4265!:ext cdt/cdrt 4266# URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html 4267>>>62 string zcf.pattern+zip Draw pattern, version 22 4268!:mime application/x-vnd.corel.zcf.pattern+zip 4269!:ext pat 4270# URL: https://en.wikipedia.org/wiki/Corel_Designer 4271# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 4272# Note: called by TrID "Corel DESIGN graphics" 4273>>>62 string designer.document+zip DESIGNER graphics, version 14-16 4274!:mime application/x-vnd.corel.designer.document+zip 4275!:ext des 4276>>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21 4277!:mime application/x-vnd.corel.zcf.designer.document+zip 4278!:ext des 4279# URL: http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/ 4280# CorelDRAW-Corel-Symbol-Library-CSL.html 4281>>>62 string symbol.library+zip Symbol Library, version 6-16.3 4282!:mime application/x-vnd.corel.symbol.library+zip 4283!:ext csl 4284>>>62 string zcf.symbol.library+zip Symbol Library, version 17-22 4285!:mime application/x-vnd.corel.zcf.symbol.library+zip 4286!:ext csl 4287 4288# Catch other ZIP-with-mimetype formats 4289# In a ZIP file, the bytes immediately after a member's contents are 4290# always "PK". The 2 regex rules here print the "mimetype" member's 4291# contents up to the first 'P'. Luckily, most MIME types don't contain 4292# any capital 'P's. This is a kludge. 4293# (mimetype contains "application/<OTHER>") 4294>>50 default x Zip data 4295>>>38 regex [!-OQ-~]+ (MIME type "%s"?) 4296!:mime application/zip 4297# (mimetype contents other than "application/*") 4298>26 string \x8\0\0\0mimetype 4299>>38 string !application/ 4300>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 4301!:mime application/zip 4302 4303# Java Jar files 4304>(26.s+30) leshort 0xcafe Java archive data (JAR) 4305!:mime application/java-archive 4306 4307# iOS App 4308>(26.s+30) leshort !0xcafe 4309>>26 string !\x8\0\0\0mimetype 4310>>>30 string Payload/ 4311>>>>38 search/64 .app/ iOS App 4312!:mime application/x-ios-app 4313 4314# Dup, see above. 4315#>30 search/100/b application/epub+zip EPUB document 4316#!:mime application/epub+zip 4317 4318# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 4319# Next line excludes specialized formats: 4320>(26.s+30) leshort !0xcafe 4321>>30 search/100/b !application/epub+zip 4322>>>26 string !\x8\0\0\0mimetype Zip archive data 4323!:mime application/zip 4324>>>>4 beshort x \b, at least 4325>>>>4 use zipversion 4326>>>>4 beshort x to extract 4327>>>>8 beshort x \b, compression method= 4328>>>>8 use zipcompression 4329>>>>0x161 string WINZIP \b, WinZIP self-extracting 4330 4331# StarView Metafile 4332# From Pierre Ducroquet <pinaraf@pinaraf.info> 43330 string VCLMTF StarView MetaFile 4334>6 beshort x \b, version %d 4335>8 belong x \b, size %d 4336 4337# Zoo archiver 433820 lelong 0xfdc4a7dc Zoo archive data 4339!:mime application/x-zoo 4340>4 byte >48 \b, v%c. 4341>>6 byte >47 \b%c 4342>>>7 byte >47 \b%c 4343>32 byte >0 \b, modify: v%d 4344>>33 byte x \b.%d+ 4345>42 lelong 0xfdc4a7dc \b, 4346>>70 byte >0 extract: v%d 4347>>>71 byte x \b.%d+ 4348 4349# Shell archives 435010 string #\ This\ is\ a\ shell\ archive shell archive text 4351!:mime application/octet-stream 4352 4353# 4354# LBR. NB: May conflict with the questionable 4355# "binary Computer Graphics Metafile" format. 4356# 43570 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 4358# 4359# PMA (CP/M derivative of LHA) 4360# Update: Joerg Jenderek 4361# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 4362# 4363#2 string -pm0- PMarc archive data [pm0] 43642 string -pm0- 4365>0 use lharc-file 4366#2 string -pm1- PMarc archive data [pm1] 43672 string -pm1- 4368>0 use lharc-file 4369#2 string -pm2- PMarc archive data [pm2] 43702 string -pm2- 4371>0 use lharc-file 43722 string -pms- PMarc SFX archive (CP/M, DOS) 4373#!:mime application/x-foobar-exec 4374!:ext com 43755 string -pc1- PopCom compressed executable (CP/M) 4376#!:mime application/x- 4377#!:ext com 4378 4379# From Rafael Laboissiere <rafael@laboissiere.net> 4380# The Project Revision Control System (see 4381# http://prcs.sourceforge.net) generates a packaged project 4382# file which is recognized by the following entry: 43830 leshort 0xeb81 PRCS packaged project 4384 4385# Microsoft cabinets 4386# by David Necas (Yeti) <yeti@physics.muni.cz> 4387#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 4388#>25 byte x v%d 4389#>24 byte x \b.%d 4390# MPi: All CABs have version 1.3, so this is pointless. 4391# Better magic in debian-additions. 4392 4393# GTKtalog catalogs 4394# by David Necas (Yeti) <yeti@physics.muni.cz> 43954 string gtktalog\ GTKtalog catalog data, 4396>13 string 3 version 3 4397>>14 beshort 0x677a (gzipped) 4398>>14 beshort !0x677a (not gzipped) 4399>13 string >3 version %s 4400 4401############################################################################ 4402# Parity archive reconstruction file, the 'par' file format now used on Usenet. 44030 string PAR\0 PARity archive data 4404>48 leshort =0 - Index file 4405>48 leshort >0 - file number %d 4406 4407# Felix von Leitner <felix-file@fefe.de> 44080 string d8:announce BitTorrent file 4409!:mime application/x-bittorrent 4410!:ext torrent 4411# Durval Menezes, <jmgthbfile at durval dot com> 44120 string d13:announce-list BitTorrent file 4413!:mime application/x-bittorrent 4414!:ext torrent 44150 string d7:comment BitTorrent file 4416!:mime application/x-bittorrent 4417!:ext torrent 44180 string d4:info BitTorrent file 4419!:mime application/x-bittorrent 4420!:ext torrent 4421 4422# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 4423# URL: http://fileformats.archiveteam.org/wiki/MSA_(Magic_Shadow_Archiver) 4424# Reference: http://info-coach.fr/atari/documents/_mydoc/FD_Image_File_Format.pdf 4425# http://mark0.net/download/triddefs_xml.7z/defs/m/msa.trid.xml 4426# Update: Joerg Jenderek 4427# Note: called by TrID "Atari MSA Disk Image" and verified by 4428# command like `deark -l -m msa -d2 PDATS578.msa` as " Atari ST floppy disk image" 4429# GRR: line below is too general as it matches setup.skin 44300 beshort 0x0e0f 4431# skip foo setup.skin with unrealistic high number 52255 of sides by check for valid "low" value 4432>4 ubeshort <2 Atari MSA archive data 4433#!:mime application/octet-stream 4434!:mime application/x-atari-msa 4435!:ext msa 4436# sectors per track like: 9 10 4437>>2 beshort x \b, %d sectors per track 4438# sides (0 or 1; add 1 to this to get correct number of sides) 4439>>4 beshort 0 \b, 1 sided 4440>>4 beshort 1 \b, 2 sided 4441# starting track like: 0 4442>>6 beshort x \b, starting track: %d 4443# ending track like: 39 79 80 81 4444>>8 beshort x \b, ending track: %d 4445# tracks content 4446#>>10 ubequad x \b, track content %#16.16llx 4447 4448# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 44490 string PK00PK\003\004 Zip archive data 4450!:mime application/zip 4451!:ext zip/cbz 4452 4453# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 4454# by Stefan `Sec` Zehl <sec@42.org> 44557 string **ACE** ACE archive data 4456!:mime application/x-ace-compressed 4457!:ext ace 4458>15 byte >0 version %d 4459>16 byte =0x00 \b, from MS-DOS 4460>16 byte =0x01 \b, from OS/2 4461>16 byte =0x02 \b, from Win/32 4462>16 byte =0x03 \b, from Unix 4463>16 byte =0x04 \b, from MacOS 4464>16 byte =0x05 \b, from WinNT 4465>16 byte =0x06 \b, from Primos 4466>16 byte =0x07 \b, from AppleGS 4467>16 byte =0x08 \b, from Atari 4468>16 byte =0x09 \b, from Vax/VMS 4469>16 byte =0x0A \b, from Amiga 4470>16 byte =0x0B \b, from Next 4471>14 byte x \b, version %d to extract 4472>5 leshort &0x0080 \b, multiple volumes, 4473>>17 byte x \b (part %d), 4474>5 leshort &0x0002 \b, contains comment 4475>5 leshort &0x0200 \b, sfx 4476>5 leshort &0x0400 \b, small dictionary 4477>5 leshort &0x0800 \b, multi-volume 4478>5 leshort &0x1000 \b, contains AV-String 4479>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 4480>5 leshort &0x2000 \b, with recovery record 4481>5 leshort &0x4000 \b, locked 4482>5 leshort &0x8000 \b, solid 4483# Date in MS-DOS format (whatever that is) 4484#>18 lelong x Created on 4485 4486# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 4487# <doj@cubic.org> 44880x1A string sfArk sfArk compressed Soundfont 4489>0x15 string 2 4490>>0x1 string >\0 Version %s 4491>>0x2A string >\0 : %s 4492 4493# DR-DOS 7.03 Packed File *.??_ 4494# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 4495# Note: unpacked by PNUNPACK.EXE 44960 string Packed\ File\ 4497# by looking for Control-Z skip ASCII text starting with Packed File 4498>0x18 ubyte 0x1a Personal NetWare Packed File 4499!:mime application/x-novell-compress 4500!:ext ??_ 4501>>12 string x \b, was "%.12s" 4502# 1 or 2 4503#>>0x19 ubyte x \b, at 0x19 %u 4504>>0x1b ulelong x with %u bytes 4505 4506# EET archive 4507# From: Tilman Sauerbeck <tilman@code-monkey.de> 45080 belong 0x1ee7ff00 EET archive 4509!:mime application/x-eet 4510 4511# rzip archives 45120 string RZIP rzip compressed data 4513>4 byte x - version %d 4514>5 byte x \b.%d 4515>6 belong x (%d bytes) 4516 4517# From: Joerg Jenderek 4518# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php 4519# reference: http://mark0.net/download/triddefs_xml.7z/ 4520# defs/f/fzip.trid.xml 4521# Note: unknown compression; No "PK" zip magic; normally in directory like 4522# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" 45230 ubequad 0x2506781901010000 Foxit add-on/update 4524!:mime application/x-fzip 4525!:ext fzip 4526 4527# From: "Robert Dale" <robdale@gmail.com> 45280 belong 123 dar archive, 4529>4 belong x label "%.8x 4530>>8 belong x %.8x 4531>>>12 beshort x %.4x" 4532>14 byte 0x54 end slice 4533>14 beshort 0x4e4e multi-part 4534>14 beshort 0x4e53 multi-part, with -S 4535 4536# Symbian installation files 4537# https://www.thouky.co.uk/software/psifs/sis.html 4538# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 45398 lelong 0x10000419 Symbian installation file 4540!:mime application/vnd.symbian.install 4541>4 lelong 0x1000006D (EPOC release 3/4/5) 4542>4 lelong 0x10003A12 (EPOC release 6) 45430 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 4544!:mime x-epoc/x-sisx-app 4545 4546# From "Nelson A. de Oliveira" <naoliv@gmail.com> 45470 string MPQ\032 MoPaQ (MPQ) archive 4548 4549# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 4550# .kgb 45510 string KGB_arch KGB Archiver file 4552>10 string x with compression level %.1s 4553 4554# xar (eXtensible ARchiver) archive 4555# URL: https://en.wikipedia.org/wiki/Xar_(archiver) 4556# xar archive format: https://code.google.com/p/xar/ 4557# From: "David Remahl" <dremahl@apple.com> 4558# Update: Joerg Jenderek 4559# TODO: lzma compression; X509Data for pkg and xip 4560# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or 4561# 7z t -txar Xcode_10.2_beta_4.xip` 45620 string xar! xar archive 4563!:mime application/x-xar 4564# pkg for Mac OSX installer package like FullBundleUpdate.pkg 4565# xip for signed Apple software like Xcode_10.2_beta_4.xip 4566!:ext xar/pkg/xip 4567# always 28 in older archives 4568>4 ubeshort >28 \b, header size %u 4569# currently there exit only version 1 since about 2014 4570>6 ubeshort >1 version %u, 4571>8 ubequad x compressed TOC: %llu, 4572#>16 ubequad x uncompressed TOC: %llu, 4573# cksum_alg 0-2 in older and also 3-4 in newer 4574>24 belong 0 no checksum 4575>24 belong 1 SHA-1 checksum 4576>24 belong 2 MD5 checksum 4577>24 belong 3 SHA-256 checksum 4578>24 belong 4 SHA-512 checksum 4579>24 belong >4 unknown %#x checksum 4580#>24 belong >4 checksum 4581# For no compression jump 0 bytes 4582>24 belong 0 4583>>0 ubyte x 4584# jump more bytes forward by header size 4585>>>&(4.S) ubyte x 4586# jump more bytes forward by compressed table of contents size 4587#>>>>&(8.Q) ubequad x \b, heap data %#llx 4588>>>>&(8.Q) ubyte x 4589# look for data by ./compress after message with 1 space at end 4590>>>>>&-3 indirect x \b, contains 4591# For SHA-1 jump 20 minus 2 bytes 4592>24 belong 1 4593>>18 ubyte x 4594# jump more bytes forward by header size 4595>>>&(4.S) ubyte x 4596# jump more bytes forward by compressed table of contents size 4597>>>>&(8.Q) ubyte x 4598# data compressed by gzip, bzip, lzma or none 4599>>>>>&-1 indirect x \b, contains 4600# For SHA-256 jump 32 minus 2 bytes 4601>24 belong 3 4602>>30 ubyte x 4603# jump more bytes forward by header size 4604>>>&(4.S) ubyte x 4605# jump more bytes forward by compressed table of contents size 4606>>>>&(8.Q) ubyte x 4607>>>>>&-1 indirect x \b, contains 4608# For SHA-512 jump 64 minus 2 bytes 4609>24 belong 4 4610>>62 ubyte x 4611# jump more bytes forward by header size 4612>>>&(4.S) ubyte x 4613# jump more bytes forward by compressed table of contents size 4614>>>>&(8.Q) ubyte x 4615>>>>>&-1 indirect x \b, contains 4616 4617# Type: Parity Archive 4618# From: Daniel van Eeden <daniel_e@dds.nl> 46190 string PAR2 Parity Archive Volume Set 4620 4621# Bacula volume format. (Volumes always start with a block header.) 4622# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 4623# From: Adam Buchbinder <adam.buchbinder@gmail.com> 462412 string BB02 Bacula volume 4625>20 bedate x \b, started %s 4626 4627# ePub is XHTML + XML inside a ZIP archive. The first member of the 4628# archive must be an uncompressed file called 'mimetype' with contents 4629# 'application/epub+zip' 4630 4631 4632# From: "Michael Gorny" <mgorny@gentoo.org> 4633# ZPAQ: http://mattmahoney.net/dc/zpaq.html 46340 string zPQ ZPAQ stream 4635>3 byte x \b, level %d 4636# From: Barry Carter <carter.barry@gmail.com> 4637# https://encode.ru/threads/456-zpaq-updates/page32 46380 string 7kSt ZPAQ file 4639 4640# BBeB ebook, unencrypted (LRF format) 4641# URL: https://www.sven.de/librie/Librie/LrfFormat 4642# From: Adam Buchbinder <adam.buchbinder@gmail.com> 46430 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 4644>8 beshort x \b, version %d 4645>36 byte 1 \b, front-to-back 4646>36 byte 16 \b, back-to-front 4647>42 beshort x \b, (%dx, 4648>44 beshort x %d) 4649 4650# Symantec GHOST image by Joerg Jenderek at May 2014 4651# https://us.norton.com/ghost/ 4652# https://www.garykessler.net/library/file_sigs.html 46530 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 4654# *.GHO 4655>2 ubyte&0x08 0x00 \b, first file 4656# *.GHS or *.[0-9] with cns program option 4657>2 ubyte&0x08 0x08 \b, split file 4658# part of split index interesting for *.ghs 4659>>4 ubyte x id=%#x 4660# compression tag minus one equals numeric compression command line switch z[1-9] 4661>3 ubyte 0 \b, no compression 4662>3 ubyte 2 \b, fast compression (Z1) 4663>3 ubyte 3 \b, medium compression (Z2) 4664>3 ubyte >3 4665>>3 ubyte <11 \b, compression (Z%d-1) 4666>2 ubyte&0x08 0x00 4667# ~ 30 byte password field only for *.gho 4668>>12 ubequad !0 \b, password protected 4669>>44 ubyte !1 4670# 1~Image All, sector-by-sector only for *.gho 4671>>>10 ubyte 1 \b, sector copy 4672# 1~Image Boot track only for *.gho 4673>>>43 ubyte 1 \b, boot track 4674# 1~Image Disc only for *.gho implies Image Boot track and sector copy 4675>>44 ubyte 1 \b, disc sector copy 4676# optional image description only *.gho 4677>>0xff string >\0 "%-.254s" 4678# look for DOS sector end sequence 4679>0xE08 search/7776 \x55\xAA 4680>>&-512 indirect x \b; contains 4681 4682# Google Chrome extensions 4683# https://developer.chrome.com/extensions/crx 4684# https://developer.chrome.com/extensions/hosting 46850 string Cr24 Google Chrome extension 4686!:mime application/x-chrome-extension 4687>4 ulong x \b, version %u 4688 4689# SeqBox - Sequenced container 4690# ext: sbx, seqbox 4691# Marco Pontello marcopon@gmail.com 4692# reference: https://github.com/MarcoPon/SeqBox 46930 string SBx SeqBox, 4694>3 byte x version %d 4695 4696# LyNX archive 469756 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 4698 4699# From: Joerg Jenderek 4700# URL: https://www.acronis.com/ 4701# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) 4702# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 47030 ubequad 0xce24b9a220000000 Acronis True Image backup 4704!:mime application/x-acronis-tib 4705!:ext tib 4706# 01000000 4707#>20 ubelong x \b, at 20 %#x 4708# 20000000 4709#>28 ubelong x \b, at 28 %#x 4710# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" 4711# ??? 4712# strings like "\Device\0000011e" "\Device\0000015a" 4713#>0 search/0x6852300/cs \\Device\\ 4714#>>&-1 pstring x \b, %s 4715# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" 4716#>>>&1 search/180/cs \\Device\\ 4717#>>>>&-1 pstring x \b, %s 4718#>>>>>&0 search/29/cs \0\0\xc8\0 4719# disk label 4720#>>>>>>&10 lestring16 x \b, disk label %11.11s 4721#>>>>>>&9 plestring16 x \b, disk label "%11.11s" 4722#>>>>>>&10 ubequad x %16.16llx 4723 4724 4725# Gentoo XPAK binary package 4726# by Michal Gorny <mgorny@gentoo.org> 4727# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 4728-4 string STOP 4729>-16 string XPAKSTOP Gentoo binary package (XPAK) 4730 4731# From: Joerg Jenderek 4732# URL: https://kodi.wiki/view/TexturePacker 4733# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz 4734# /xbmc-Krypton/xbmc/guilib/XBTF.h 4735# /xbmc-Krypton/xbmc/guilib/XBTF.cpp 47360 string XBTF 4737# skip ASCII text by looking for terminating \0 of path 4738>264 ubyte 0 XBMC texture package 4739!:mime application/x-xbmc-xbt 4740!:ext xbt 4741# XBTF_VERSION 2 4742>>4 string !2 \b, version %-.1s 4743# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp 4744>>5 ulelong x \b, %u file 4745# plural s 4746>>5 ulelong >1 \bs 4747# path[CXBTFFile[MaximumPathLength=256] 4748>>9 string x \b, 1st %s 4749 4750# ALZIP archive 4751# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com> 4752# http://kippler.com/win/unalz/ 4753# https://salsa.debian.org/l10n-korean-team/unalz 47540 string ALZ\001 ALZ archive data 4755!:ext alz 4756 4757# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip 47580 string EGGA EGG archive data, 4759!:ext egg 4760>5 byte x version %u 4761>4 byte x \b.%u 4762>>0x0E ulelong =0x08E28222 4763>>0x0E ulelong =0x24F5A262 \b, split 4764>>0x0E ulelong =0x24E5A060 \b, solid 4765>>0x0E default x \b, unknown 4766 4767# PAQ9A archive 4768# URL: http://mattmahoney.net/dc/#paq9a 4769# Note: Line 1186 of paq9a.cpp gives the magic bytes 47700 string pQ9\001 PAQ9A archive 4771 4772# From wof (wof@stachelkaktus.net) 47730 string Unison\ archive\ format Unison archive format 4774 4775#------------------------------------------------------------------------------ 4776# URL: https://de.wikipedia.org/wiki/Aria_(Software) 4777# Reference: https://github.com/aria2/aria2/blob/master/doc/manual-src/en/technical-notes.rst 4778# From: Joerg Jenderek 4779# Note: only version 1 suited 4780# check for valid version one 47810 beshort 0x0001 4782# skip most uncompressed DEGAS med-res bitmap *.PI2 and GEM bitmap (v1) *.IMG 4783# by test for valid infoHashCheck extension 4784>2 ubelong&0xffFFffFE 0x00000000 4785# skip DEGAS med-res bitmap DIAGRAM1.PI2 by test for valid length of download 4786>>(6.L+14) ubequad >0 4787>>>0 use aria 47880 name aria 4789# version; (0x0000) or (0x0001); for 0 all multi-byte are in host byte order. For 1 big endian 4790>0 beshort x aria2 control file, version %u 4791#!:mime application/octet-stream 4792!:mime application/x-aria 4793!:ext aria2 4794# EXTension; if EXT[3]&1 == 1 checks whether saved InfoHash and current downloading the same; infoHashCheck extension 4795>2 ubelong !0 \b, infoHashCheck %#x 4796# info hash length like: 0 14h 4797>6 ubelong !0 \b, %#x bytes info hash 4798# info hash; BitTorrent InfoHash 4799>>10 ubequad x %#16.16llx... 4800# piece length; the length of the piece like: 400h 100000h 4801>(6.L+10) ubelong x \b, piece length 0x%x 4802# total length; the total length of the download 4803>(6.L+14) ubequad x \b, total length %llu 4804#>(6.L+14) ubequad x \b, total length %#llx 4805# upload length; the uploaded length of download like: 0 400h 4806>(6.L+22) ubequad !0 \b, upload length %#llx 4807# bitfield length; the length of bitfield like: 4 6 Ah 10h 13h 167h 4808>(6.L+30) ubelong x \b, %#x bytes bitfield 4809# bitfield; bitfield which represents current download progress 4810>(6.L+34) ubequad !0 %#llx... 4811 4812#------------------------------------------------------------------------------ 4813# $File: arm,v 1.2 2021/07/14 17:40:31 christos Exp $ 4814# arm: file(1) magic for ARM COFF 4815# 4816# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format 4817 4818# Aarch64 48190 leshort 0xaa64 4820# test for unused flag bits in f_flags 4821>18 uleshort&0x8E80 0 4822# use little endian variant of subroutine to 4823# display name+variables+flags for common object formatted files 4824>>0 use display-coff 4825!:strength -10 4826 4827# ARM 48280 leshort 0x01c0 4829# test for unused flag bits in f_flags 4830>18 uleshort&0x8E80 0 4831# use little endian variant of subroutine to 4832# display name+variables+flags for common object formatted files 4833>>0 use display-coff 4834!:strength -10 4835 4836# ARM Thumb 48370 leshort 0x01c2 4838# test for unused flag bits in f_flags 4839>18 uleshort&0x8E80 0 4840# use little endian variant of subroutine to 4841# display name+variables+flags for common object formatted files 4842>>0 use display-coff 4843!:strength -10 4844 4845# ARMv7 Thumb 48460 leshort 0x01c4 4847# test for unused flag bits in f_flags 4848>18 uleshort&0x8E80 0 4849# use little endian variant of subroutine to 4850# display name+variables+flags for common object formatted files 4851>>0 use display-coff 4852!:strength -10 4853 4854#------------------------------------------------------------------------------ 4855# $File: asf,v 1.3 2022/04/25 17:33:13 christos Exp $ 4856# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files 4857# http://www.staroceans.org/e-book/ASF_Specification.pdf 4858 48590 name asf-name 4860# ASF_Data_Object 4861#>0 guid 75B22636-668E-11CF-A6D9-00AA0062CE6C 4862#>16 lequad >0 4863#>>(16.q) use asf-object 4864# ASF_Simple_Index_Object 4865>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB 4866>0 guid D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object 4867>0 guid FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object 4868>0 guid 3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object 4869 4870# ASF_File_Properties_Object 4871>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365 4872 4873# ASF_Stream_Properties_Object 4874>0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365 4875#>>56 lequad x Time Offset %lld 4876#>>64 lelong x Type-Specicic Data Length %d 4877#>>68 lelong x Error Correction Data Length %d 4878#>>72 leshort x Flags %#x 4879#>>74 lelong x Reserved %x 4880# ASF_Audio_Media 4881>>24 guid F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media ( 4882>>>78 leshort x \bCodec Id %d 4883>>>80 leshort x \b, Number of channels %d 4884>>>82 lelong x \b, Samples Per Second %d 4885>>>86 lelong x \b, Average Number of Bytes Per Second %d 4886>>>90 lelong x \b, Block Alignment %d 4887>>>94 leshort x \b, Bits Per Sample %d 4888# ASF_Video_Media 4889>>24 guid BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media ( 4890>>>78 lelong x \bEncoded Image Width %d 4891>>>82 lelong x \b, Encoded Image Height %d 4892#>>>85 leshort x \b, Format Data Size %x 4893>>>93 lelong x \b, Image Width %d 4894>>>97 lelong x \b, Image Height %d 4895#>>>101 leshort x \b, Reserved %#x 4896>>>103 leshort x \b, Bits Per Pixel Count %d 4897#>>>105 lelong x \b, Compression ID %d 4898#>>>109 lelong x \b, Image Size %d 4899#>>>113 lelong x \b, Horizontal Pixels Per Meter %d 4900#>>>117 lelong x \b, Vertical Pixels Per Meter %d 4901#>>>121 lelong x \b, Colors Used Count %d 4902#>>>125 lelong x \b, Important Colors Count %d 4903>>0 lelong x \b, Error correction type 4904>>40 use asf-name 4905>>0 lelong x \b) 4906#ASF_Header_Extension_Object 4907>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365 4908# ASF_Codec_List_Object 4909>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6 4910>0 guid 1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object 4911>0 guid F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object 4912>0 guid D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object 4913>0 guid 75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object 4914# ASF_Content_Description_Object 4915>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C 4916#>>24 leshort title length %d 4917#>>26 leshort author length %d 4918#>>28 leshort copyright length %d 4919#>>30 leshort descriptor length %d 4920#>>32 leshort rating length %d 4921>0 guid D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object 4922>0 guid 2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object 4923>0 guid 7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object 4924>0 guid 2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object 4925>0 guid 298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object 4926>0 guid 2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object 4927# ASF_Padding_Object 4928>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8 4929>0 guid 14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object 4930>0 guid A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object 4931>0 guid D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object 4932>0 guid D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object 4933>0 guid A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object 4934>0 guid 7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object 4935>0 guid C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object 4936>0 guid 44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object 4937>0 guid D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object 4938>0 guid 6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object 4939>0 guid F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object 4940>0 guid 26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object 4941>0 guid 43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object 4942>0 guid 59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media 4943>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C442B ASF_JFIF_Media 4944>0 guid 35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media 4945>0 guid 91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media 4946>0 guid 3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media 4947>0 guid 776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype 4948>0 guid DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format 4949>0 guid 20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction 4950>0 guid BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread 4951>0 guid ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1 4952>0 guid 7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM 4953# _Network_Devices 4954>0 guid 86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2 4955>0 guid 4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3 4956>0 guid 4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4 4957>0 guid D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language 4958>0 guid D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate 4959>0 guid D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown 4960>0 guid AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive 4961>0 guid AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial 4962>0 guid 399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode 4963>0 guid E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name 4964>0 guid D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type 4965>0 guid 1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio 4966>0 guid C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration 4967>0 guid 6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID 4968>0 guid 00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG 4969 49700 name asf-object 4971>0 use asf-name 4972#>>16 lequad >0 (size %lld) [ 4973>>16 lequad >0 4974>>>(16.q) use asf-object 4975#>>16 lequad 0 ] 4976 4977# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 49780 guid 75B22630-668E-11CF-A6D9-00AA0062CE6C Microsoft ASF 4979!:mime video/x-ms-asf 4980#>16 lequad >0 (size %lld 4981#>>24 lelong x \b, %d header objects) 4982>16 lequad >0 4983>>30 use asf-object 4984>>(16.q) use asf-object 4985#------------------------------------------------------------------------------ 4986# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 4987# make: file(1) magic for assembler source 4988# 49890 regex \^[\040\t]{0,50}\\.asciiz assembler source text 4990!:mime text/x-asm 49910 regex \^[\040\t]{0,50}\\.byte assembler source text 4992!:mime text/x-asm 49930 regex \^[\040\t]{0,50}\\.even assembler source text 4994!:mime text/x-asm 49950 regex \^[\040\t]{0,50}\\.globl assembler source text 4996!:mime text/x-asm 49970 regex \^[\040\t]{0,50}\\.text assembler source text 4998!:mime text/x-asm 49990 regex \^[\040\t]{0,50}\\.file assembler source text 5000!:mime text/x-asm 50010 regex \^[\040\t]{0,50}\\.type assembler source text 5002!:mime text/x-asm 5003 5004#------------------------------------------------------------------------------ 5005# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 5006# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 5007# strings as "long" - we assume they're just strings: 5008# From: guy@netapp.com (Guy Harris) 5009# 50100 string *STA Aster*x 5011>7 string WORD Words Document 5012>7 string GRAP Graphic 5013>7 string SPRE Spreadsheet 5014>7 string MACR Macro 50150 string 2278 Aster*x Version 2 5016>29 byte 0x36 Words Document 5017>29 byte 0x35 Graphic 5018>29 byte 0x32 Spreadsheet 5019>29 byte 0x38 Macro 5020 5021 5022#------------------------------------------------------------------------------ 5023# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $ 5024# att3b: file(1) magic for AT&T 3B machines 5025# 5026# The `versions' should be un-commented if they work for you. 5027# (Was the problem just one of endianness?) 5028# 5029# 3B20 5030# 5031# The 3B20 conflicts with SCCS. 5032#0 beshort 0550 3b20 COFF executable 5033#>12 belong >0 not stripped 5034#>22 beshort >0 - version %d 5035#0 beshort 0551 3b20 COFF executable (TV) 5036#>12 belong >0 not stripped 5037#>22 beshort >0 - version %d 5038# 5039# WE32K 5040# 50410 beshort 0560 WE32000 COFF 5042>18 beshort ^00000020 object 5043>18 beshort &00000020 executable 5044>12 belong >0 not stripped 5045>18 beshort ^00010000 N/A on 3b2/300 w/paging 5046>18 beshort &00020000 32100 required 5047>18 beshort &00040000 and MAU hardware required 5048>20 beshort 0407 (impure) 5049>20 beshort 0410 (pure) 5050>20 beshort 0413 (demand paged) 5051>20 beshort 0443 (target shared library) 5052>22 beshort >0 - version %d 50530 beshort 0561 WE32000 COFF executable (TV) 5054>12 belong >0 not stripped 5055#>18 beshort &00020000 - 32100 required 5056#>18 beshort &00040000 and MAU hardware required 5057#>22 beshort >0 - version %d 5058# 5059# core file for 3b2 50600 string \000\004\036\212\200 3b2 core file 5061>364 string >\0 of '%s' 5062 5063#------------------------------------------------------------------------------ 5064# $File: audio,v 1.124 2022/08/28 08:58:20 christos Exp $ 5065# audio: file(1) magic for sound formats (see also "iff") 5066# 5067# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 5068# and others 5069# 5070 5071# Sun/NeXT audio data 50720 string .snd Sun/NeXT audio data: 5073>12 belong 1 8-bit ISDN mu-law, 5074!:mime audio/basic 5075>12 belong 2 8-bit linear PCM [REF-PCM], 5076!:mime audio/basic 5077>12 belong 3 16-bit linear PCM, 5078!:mime audio/basic 5079>12 belong 4 24-bit linear PCM, 5080!:mime audio/basic 5081>12 belong 5 32-bit linear PCM, 5082!:mime audio/basic 5083>12 belong 6 32-bit IEEE floating point, 5084!:mime audio/basic 5085>12 belong 7 64-bit IEEE floating point, 5086!:mime audio/basic 5087>12 belong 8 Fragmented sample data, 5088>12 belong 10 DSP program, 5089>12 belong 11 8-bit fixed point, 5090>12 belong 12 16-bit fixed point, 5091>12 belong 13 24-bit fixed point, 5092>12 belong 14 32-bit fixed point, 5093>12 belong 18 16-bit linear with emphasis, 5094>12 belong 19 16-bit linear compressed, 5095>12 belong 20 16-bit linear with emphasis and compression, 5096>12 belong 21 Music kit DSP commands, 5097>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 5098!:mime audio/x-adpcm 5099>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 5100>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 5101>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 5102>12 belong 27 8-bit A-law (CCITT G.711), 5103>20 belong 1 mono, 5104>20 belong 2 stereo, 5105>20 belong 4 quad, 5106>16 belong >0 %d Hz 5107 5108# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 5109# that uses little-endian encoding and has a different magic number 51100 lelong 0x0064732E DEC audio data: 5111>12 lelong 1 8-bit ISDN mu-law, 5112!:mime audio/x-dec-basic 5113>12 lelong 2 8-bit linear PCM [REF-PCM], 5114!:mime audio/x-dec-basic 5115>12 lelong 3 16-bit linear PCM, 5116!:mime audio/x-dec-basic 5117>12 lelong 4 24-bit linear PCM, 5118!:mime audio/x-dec-basic 5119>12 lelong 5 32-bit linear PCM, 5120!:mime audio/x-dec-basic 5121>12 lelong 6 32-bit IEEE floating point, 5122!:mime audio/x-dec-basic 5123>12 lelong 7 64-bit IEEE floating point, 5124!:mime audio/x-dec-basic 5125>12 belong 8 Fragmented sample data, 5126>12 belong 10 DSP program, 5127>12 belong 11 8-bit fixed point, 5128>12 belong 12 16-bit fixed point, 5129>12 belong 13 24-bit fixed point, 5130>12 belong 14 32-bit fixed point, 5131>12 belong 18 16-bit linear with emphasis, 5132>12 belong 19 16-bit linear compressed, 5133>12 belong 20 16-bit linear with emphasis and compression, 5134>12 belong 21 Music kit DSP commands, 5135>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 5136!:mime audio/x-dec-basic 5137>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 5138>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 5139>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 5140>12 belong 27 8-bit A-law (CCITT G.711), 5141>20 lelong 1 mono, 5142>20 lelong 2 stereo, 5143>20 lelong 4 quad, 5144>16 lelong >0 %d Hz 5145 5146# Creative Labs AUDIO stuff 51470 string MThd Standard MIDI data 5148!:mime audio/midi 5149>8 beshort x (format %d) 5150>10 beshort x using %d track 5151>10 beshort >1 \bs 5152>12 beshort&0x7fff x at 1/%d 5153>12 beshort&0x8000 >0 SMPTE 5154 51550 string CTMF Creative Music (CMF) data 5156!:mime audio/x-unknown 51570 string SBI SoundBlaster instrument data 5158!:mime audio/x-unknown 51590 string Creative\ Voice\ File Creative Labs voice data 5160!:mime audio/x-unknown 5161# is this next line right? it came this way... 5162>19 byte 0x1A 5163>23 byte >0 - version %d 5164>22 byte >0 \b.%d 5165 5166# first entry is also the string "NTRK" 51670 belong 0x4e54524b MultiTrack sound data 5168>4 belong x - version %d 5169 5170# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 5171# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 51720 string EMOD Extended MOD sound data, 5173>4 byte&0xf0 x version %d 5174>4 byte&0x0f x \b.%d, 5175>45 byte x %d instruments 5176>83 byte 0 (module) 5177>83 byte 1 (song) 5178 5179# Real Audio (Magic .ra\0375) 51800 belong 0x2e7261fd RealAudio sound file 5181!:mime audio/x-pn-realaudio 51820 string .RMF\0\0\0 RealMedia file 5183!:mime application/vnd.rn-realmedia 5184#video/x-pn-realvideo 5185#video/vnd.rn-realvideo 5186#application/vnd.rn-realmedia 5187# sigh, there are many mimes for that but the above are the most common. 5188 5189# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 5190# Oct 31, 1995 5191# fixed by <doj@cubic.org> 2003-06-24 5192# Too short... 5193#0 string MTM MultiTracker Module sound file 5194#0 string if Composer 669 Module sound data 5195#0 string JN Composer 669 Module sound data (extended format) 51960 string MAS_U ULT(imate) Module sound data 5197 5198#0 string FAR Module sound data 5199#>4 string >\15 Title: "%s" 5200 52010x2c string SCRM ScreamTracker III Module sound data 5202>0 string >\0 Title: "%s" 5203!:mime audio/x-s3m 5204 5205# .stm before it got above .s3m extension 52060x16 string \!Scream\! ScreamTracker Module sound data 5207>0 string >\0 Title: "%s" 5208 5209# Gravis UltraSound patches 5210# From <ache@nagual.ru> 5211 52120 string GF1PATCH110\0ID#000002\0 GUS patch 52130 string GF1PATCH100\0ID#000002\0 Old GUS patch 5214 5215# mime types according to http://www.geocities.com/nevilo/mod.htm: 5216# audio/it .it 5217# audio/x-zipped-it .itz 5218# audio/xm fasttracker modules 5219# audio/x-s3m screamtracker modules 5220# audio/s3m screamtracker modules 5221# audio/x-zipped-mod mdz 5222# audio/mod mod 5223# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 5224 5225# 5226# Taken from loader code from mikmod version 2.14 5227# by Steve McIntyre (stevem@chiark.greenend.org.uk) 5228# <doj@cubic.org> added title printing on 2003-06-24 52290 string MAS_UTrack_V00 5230>14 string >/0 ultratracker V1.%.1s module sound data 5231!:mime audio/x-mod 5232#audio/x-tracker-module 5233 52340 string UN05 MikMod UNI format module sound data 5235 52360 string Extended\ Module: Fasttracker II module sound data 5237!:mime audio/x-mod 5238#audio/x-tracker-module 5239>17 string >\0 Title: "%s" 5240 524121 string/c =!SCREAM! Screamtracker 2 module sound data 5242!:mime audio/x-mod 5243#audio/x-screamtracker-module 524421 string BMOD2STM Screamtracker 2 module sound data 5245!:mime audio/x-mod 5246#audio/x-screamtracker-module 52471080 string M.K. 4-channel Protracker module sound data 5248!:mime audio/x-mod 5249#audio/x-protracker-module 5250>0 string >\0 Title: "%s" 52511080 string M!K! 4-channel Protracker module sound data 5252!:mime audio/x-mod 5253#audio/x-protracker-module 5254>0 string >\0 Title: "%s" 52551080 string FLT4 4-channel Startracker module sound data 5256!:mime audio/x-mod 5257#audio/x-startracker-module 5258>0 string >\0 Title: "%s" 52591080 string FLT8 8-channel Startracker module sound data 5260!:mime audio/x-mod 5261#audio/x-startracker-module 5262>0 string >\0 Title: "%s" 52631080 string 4CHN 4-channel Fasttracker module sound data 5264!:mime audio/x-mod 5265#audio/x-fasttracker-module 5266>0 string >\0 Title: "%s" 52671080 string 6CHN 6-channel Fasttracker module sound data 5268!:mime audio/x-mod 5269#audio/x-fasttracker-module 5270>0 string >\0 Title: "%s" 52711080 string 8CHN 8-channel Fasttracker module sound data 5272!:mime audio/x-mod 5273#audio/x-fasttracker-module 5274>0 string >\0 Title: "%s" 52751080 string CD81 8-channel Octalyser module sound data 5276!:mime audio/x-mod 5277#audio/x-octalysertracker-module 5278>0 string >\0 Title: "%s" 52791080 string OKTA 8-channel Octalyzer module sound data 5280!:mime audio/x-mod 5281#audio/x-octalysertracker-module 5282>0 string >\0 Title: "%s" 5283# Not good enough. 5284#1082 string CH 5285#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 52861080 string 16CN 16-channel Taketracker module sound data 5287!:mime audio/x-mod 5288#audio/x-taketracker-module 5289>0 string >\0 Title: "%s" 52901080 string 32CN 32-channel Taketracker module sound data 5291!:mime audio/x-mod 5292#audio/x-taketracker-module 5293>0 string >\0 Title: "%s" 5294 5295# TOC sound files -Trevor Johnson <trevor@jpj.net> 5296# 52970 string TOC TOC sound file 5298 5299# sidfiles <pooka@iki.fi> 5300# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 53010 string SIDPLAY\ INFOFILE Sidplay info file 5302 53030 string PSID PlaySID v2.2+ (AMIGA) sidtune 5304>4 beshort >0 w/ header v%d, 5305>14 beshort =1 single song, 5306>14 beshort >1 %d songs, 5307>16 beshort >0 default song: %d 5308>0x16 string >\0 name: "%s" 5309>0x36 string >\0 author: "%s" 5310>0x56 string >\0 copyright: "%s" 5311 53120 string RSID RSID sidtune PlaySID compatible 5313>4 beshort >0 w/ header v%d, 5314>14 beshort =1 single song, 5315>14 beshort >1 %d songs, 5316>16 beshort >0 default song: %d 5317>0x16 string >\0 name: "%s" 5318>0x36 string >\0 author: "%s" 5319>0x56 string >\0 copyright: "%s" 5320 5321# IRCAM sound files - Michael Pruett <michael@68k.org> 5322# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 53230 belong 0x64a30100 IRCAM file (VAX little-endian) 53240 belong 0x0001a364 IRCAM file (VAX big-endian) 53250 belong 0x64a30200 IRCAM file (Sun big-endian) 53260 belong 0x0002a364 IRCAM file (Sun little-endian) 53270 belong 0x64a30300 IRCAM file (MIPS little-endian) 53280 belong 0x0003a364 IRCAM file (MIPS big-endian) 53290 belong 0x64a30400 IRCAM file (NeXT big-endian) 53300 belong 0x64a30400 IRCAM file (NeXT big-endian) 53310 belong 0x0004a364 IRCAM file (NeXT little-endian) 5332 5333# NIST SPHERE <mpruett@sgi.com> 53340 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 5335 5336# Sample Vision <mpruett@sgi.com> 53370 string SOUND\ SAMPLE\ DATA\ Sample Vision file 5338 5339# Audio Visual Research <tonigonenstein@users.sourceforge.net> 53400 string 2BIT Audio Visual Research file, 5341>12 beshort =0 mono, 5342>12 beshort =-1 stereo, 5343>14 beshort x %d bits 5344>16 beshort =0 unsigned, 5345>16 beshort =-1 signed, 5346>22 belong&0x00ffffff x %d Hz, 5347>18 beshort =0 no loop, 5348>18 beshort =-1 loop, 5349>21 ubyte <128 note %d, 5350>22 byte =0 replay 5.485 KHz 5351>22 byte =1 replay 8.084 KHz 5352>22 byte =2 replay 10.971 KHz 5353>22 byte =3 replay 16.168 KHz 5354>22 byte =4 replay 21.942 KHz 5355>22 byte =5 replay 32.336 KHz 5356>22 byte =6 replay 43.885 KHz 5357>22 byte =7 replay 47.261 KHz 5358 5359# SGI SoundTrack <mpruett@sgi.com> 53600 string _SGI_SoundTrack SGI SoundTrack project file 5361# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 53620 string ID3 Audio file with ID3 version 2 5363>3 byte x \b.%d 5364>4 byte x \b.%d 5365>>5 byte &0x80 \b, unsynchronized frames 5366>>5 byte &0x40 \b, extended header 5367>>5 byte &0x20 \b, experimental 5368>>5 byte &0x10 \b, footer present 5369>(6.I+10) indirect x \b, contains: 5370 5371# NSF (NES sound file) magic 53720 string NESM\x1a NES Sound File 5373>14 string >\0 ("%s" by 5374>46 string >\0 %s, copyright 5375>78 string >\0 %s), 5376>5 byte x version %d, 5377>6 byte x %d tracks, 5378>122 byte&0x2 =1 dual PAL/NTSC 5379>122 byte&0x1 =1 PAL 5380>122 byte&0x1 =0 NTSC 5381 5382# NSFE (Extended NES sound file) magic 5383# http://slickproductions.org/docs/NSF/nsfespec.txt 5384# From: David Pflug <david@pflug.email> 53850 string NSFE Extended NES Sound File 5386>48 search/0x1000 auth 5387>>&0 string >\0 ("%s" 5388>>>&1 string >\0 by %s 5389>>>>&1 string >\0 \b, copyright %s 5390>>>>>&1 string >\0 \b, ripped by %s 5391>20 byte x \b), %d tracks, 5392>18 byte&0x2 =1 dual PAL/NTSC 5393>18 byte&0x2 =0 5394>>18 byte&0x1 =1 PAL 5395>>18 byte&0x1 =0 NTSC 5396 5397# Type: SNES SPC700 sound files 5398# From: Josh Triplett <josh@freedesktop.org> 53990 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 5400>&0 string 0.30 \b, version %s 5401>>0x23 byte 0x1B \b, without ID666 tag 5402>>0x23 byte 0x1A \b, with ID666 tag 5403>>>0x2E string >\0 \b, song "%.32s" 5404>>>0x4E string >\0 \b, game "%.32s" 5405 5406# Impulse tracker module (audio/x-it) 54070 string IMPM Impulse Tracker module sound data - 5408!:mime audio/x-mod 5409>4 string >\0 "%s" 5410>40 leshort !0 compatible w/ITv%x 5411>42 leshort !0 created w/ITv%x 5412 5413# Imago Orpheus module (audio/x-imf) 541460 string IM10 Imago Orpheus module sound data - 5415>0 string >\0 "%s" 5416 5417# From <collver1@attbi.com> 5418# These are the /etc/magic entries to decode modules, instruments, and 5419# samples in Impulse Tracker's native format. 5420 54210 string IMPS Impulse Tracker Sample 5422>18 byte &2 16 bit 5423>18 byte ^2 8 bit 5424>18 byte &4 stereo 5425>18 byte ^4 mono 54260 string IMPI Impulse Tracker Instrument 5427>28 leshort !0 ITv%x 5428>30 byte !0 %d samples 5429 5430# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 5431# From <collver1@attbi.com> 54320 string LM8953 Yamaha TX Wave 5433>22 byte 0x49 looped 5434>22 byte 0xC9 non-looped 5435>23 byte 1 33kHz 5436>23 byte 2 50kHz 5437>23 byte 3 16kHz 5438 5439# scream tracker: file(1) magic for Scream Tracker sample files 5440# 5441# From <collver1@attbi.com> 544276 string SCRS Scream Tracker Sample 5443>0 byte 1 sample 5444>0 byte 2 adlib melody 5445>0 byte >2 adlib drum 5446>31 byte &2 stereo 5447>31 byte ^2 mono 5448>31 byte &4 16bit little endian 5449>31 byte ^4 8bit 5450>30 byte 0 unpacked 5451>30 byte 1 packed 5452 5453# audio 5454# From: Cory Dikkers <cdikkers@swbell.net> 54550 string MMD0 MED music file, version 0 54560 string MMD1 OctaMED Pro music file, version 1 54570 string MMD3 OctaMED Soundstudio music file, version 3 54580 string OctaMEDCmpr OctaMED Soundstudio compressed file 54590 string MED MED_Song 54600 string SymM Symphonie SymMOD music file 5461# 5462# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS) 5463# http://lclevy.free.fr/exotica/ahx/ahxformat.txt 54640 string THX AHX version 5465>3 byte =0 1 module data 5466>3 byte =1 2 module data 5467>11 ubyte x TRK: %u 5468>10 ubyte x TRL: %u 5469>12 ubyte x SMP: %u 5470>13 ubyte x SS: %u 5471>(4.H) string x Title: "%.128s" 5472 5473# header is mostly AHX format 54740 string HVL 5475>3 byte <2 Hively Tracker Song 5476>3 byte =0 v1 module data 5477>3 byte =1 v2 module data 5478>11 ubyte x TRK: %u 5479>10 ubyte x TRL: %u 5480>12 ubyte x SMP: %u 5481>13 ubyte x SS: %u 5482>8 ubyte/4 =0 CHN: 4 5483>8 ubyte/4 >0 CHN: 4+%u 5484#>-0 offset <0xffff 5485>(4.H) string x Title: "%.128s" 5486 5487# 54880 string OKTASONG Oktalyzer module data 5489# 54900 string DIGI\ Booster\ module\0 %s 5491>20 byte >0 %c 5492>>21 byte >0 \b%c 5493>>>22 byte >0 \b%c 5494>>>>23 byte >0 \b%c 5495>610 string >\0 \b, "%s" 5496# 54970 string DBM0 DIGI Booster Pro Module 5498>4 byte >0 V%X. 5499>>5 byte x \b%02X 5500>16 string >\0 \b, "%s" 5501# 55020 string FTMN FaceTheMusic module 5503>16 string >\0d \b, "%s" 5504 5505# From: <doj@cubic.org> 2003-06-24 55060 string AMShdr\32 Velvet Studio AMS Module v2.2 55070 string Extreme Extreme Tracker AMS Module v1.3 55080 string DDMF Xtracker DMF Module 5509>4 byte x v%i 5510>0xD string >\0 Title: "%s" 5511>0x2B string >\0 Composer: "%s" 55120 string DSM\32 Dynamic Studio Module DSM 55130 string SONG DigiTrekker DTM Module 55140 string DMDL DigiTrakker MDL Module 55150 string PSM\32 Protracker Studio PSM Module 551644 string PTMF Poly Tracker PTM Module 5517>0 string >\32 Title: "%s" 55180 string MT20 MadTracker 2.0 Module MT2 55190 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 55200 string RTMM RTM Module 55210x426 string MaDoKaN96 XMS Adlib Module 5522>0 string >\0 Composer: "%s" 55230 string AMF AMF Module 5524>4 string >\0 Title: "%s" 55250 string MODINFO1 Open Cubic Player Module Information MDZ 55260 string Extended\40Instrument: Fast Tracker II Instrument 5527 5528# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 5529# NOA Nancy Codec file 55300 string \210NOA\015\012\032 NOA Nancy Codec Movie file 5531# Yamaha SMAF format 55320 string MMMD Yamaha SMAF file 5533# Sharp Jisaku Melody format for PDC 55340 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 5535>20 string Ver01.00 Ver. 1.00 5536>>32 byte x , %d tracks 5537 5538# Free lossless audio codec <http://flac.sourceforge.net> 5539# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 55400 string fLaC FLAC audio bitstream data 5541!:mime audio/flac 5542>4 byte&0x7f >0 \b, unknown version 5543>4 byte&0x7f 0 \b 5544# some common bits/sample values 5545>>20 beshort&0x1f0 0x030 \b, 4 bit 5546>>20 beshort&0x1f0 0x050 \b, 6 bit 5547>>20 beshort&0x1f0 0x070 \b, 8 bit 5548>>20 beshort&0x1f0 0x0b0 \b, 12 bit 5549>>20 beshort&0x1f0 0x0f0 \b, 16 bit 5550>>20 beshort&0x1f0 0x170 \b, 24 bit 5551>>20 byte&0xe 0x0 \b, mono 5552>>20 byte&0xe 0x2 \b, stereo 5553>>20 byte&0xe 0x4 \b, 3 channels 5554>>20 byte&0xe 0x6 \b, 4 channels 5555>>20 byte&0xe 0x8 \b, 5 channels 5556>>20 byte&0xe 0xa \b, 6 channels 5557>>20 byte&0xe 0xc \b, 7 channels 5558>>20 byte&0xe 0xe \b, 8 channels 5559# sample rates derived from known oscillator frequencies; 5560# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and 5561# 16.384 (other/fs=32kHz). 5562>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 5563>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 5564>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 5565>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 5566>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 5567>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 5568>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 5569>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 5570>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz 5571>>17 belong&0xfffff0 0x177000 \b, 96 kHz 5572>>17 belong&0xfffff0 0x1f4000 \b, 128 kHz 5573>>17 belong&0xfffff0 0x2b1100 \b, 176.4 kHz 5574>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz 5575>>17 belong&0xfffff0 0x3e8000 \b, 256 kHz 5576>>17 belong&0xfffff0 0x562200 \b, 352.8 kHz 5577>>17 belong&0xfffff0 0x5dc000 \b, 384 kHz 5578>>21 byte&0xf >0 \b, >4G samples 5579>>21 byte&0xf 0 \b 5580>>>22 belong >0 \b, %u samples 5581>>>22 belong 0 \b, length unknown 5582 5583# (ISDN) VBOX voice message file (Wolfram Kleff) 55840 string VBOX VBOX voice message data 5585 5586# ReBorn Song Files (.rbs) 5587# David J. Singer <doc@deadvirgins.org.uk> 55888 string RB40 RBS Song file 5589>29 string ReBorn created by ReBorn 5590>37 string Propellerhead created by ReBirth 5591 5592# Synthesizer Generator and Kimwitu share their file format 55930 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 5594# Kimwitu++ uses a slightly different magic 55950 string A#S#C#S#S#L#HUB Kimwitu++ data 5596 5597# From "Simon Hosie 55980 string TFMX-SONG TFMX module sound data 5599 5600# Monkey's Audio compressed audio format (.ape) 5601# From danny.milo@gmx.net (Danny Milosavljevic) 5602# New version from Abel Cheung <abel (@) oaka.org> 56030 string MAC\040 Monkey's Audio compressed format 5604!:mime audio/x-ape 5605>4 uleshort >0x0F8B version %d 5606>>(0x08.l) uleshort =1000 with fast compression 5607>>(0x08.l) uleshort =2000 with normal compression 5608>>(0x08.l) uleshort =3000 with high compression 5609>>(0x08.l) uleshort =4000 with extra high compression 5610>>(0x08.l) uleshort =5000 with insane compression 5611>>(0x08.l+18) uleshort =1 \b, mono 5612>>(0x08.l+18) uleshort =2 \b, stereo 5613>>(0x08.l+20) ulelong x \b, sample rate %d 5614>4 uleshort <0x0F8C version %d 5615>>6 uleshort =1000 with fast compression 5616>>6 uleshort =2000 with normal compression 5617>>6 uleshort =3000 with high compression 5618>>6 uleshort =4000 with extra high compression 5619>>6 uleshort =5000 with insane compression 5620>>10 uleshort =1 \b, mono 5621>>10 uleshort =2 \b, stereo 5622>>12 ulelong x \b, sample rate %d 5623 5624# adlib sound files 5625# From: Alex Myczko <alex@aiei.ch> 5626 5627# https://github.com/rerrahkr/BambooTracker 56280 string BambooTracker BambooTracker 5629>13 string Mod Module 5630>13 string Ist Instrument 5631>13 string Bnk Bank 5632>22 byte x \b, version %u 5633>21 byte x \b.%u 5634>20 byte x \b.%u 5635 56360 string CC2x CheeseCutter 2 song 5637 56380 string RAWADATA RdosPlay RAW 5639 56401068 string RoR AMUSIC Adlib Tracker 5641 56420 string JCH EdLib 5643 56440 string mpu401tr MPU-401 Trakker 5645 56460 string SAdT Surprise! Adlib Tracker 5647>4 byte x Version %d 5648 56490 string XAD! eXotic ADlib 5650 56510 string ofTAZ! eXtra Simple Music 5652 56530 string FMK! FM Kingtracker Song 5654 56550 string DFM DFM Song 5656 56570 string \<CUD-FM-File\> CFF Song 5658 56590 string _A2module A2M Song 5660 5661# Spectrum 128 tunes (.ay files). 5662# From: Emanuel Haupt <ehaupt@critical.ch> 56630 string ZXAYEMUL Spectrum 128 tune 5664 56650 string \0BONK BONK, 5666#>5 byte x version %d 5667>14 byte x %d channel(s), 5668>15 byte =1 lossless, 5669>15 byte =0 lossy, 5670>16 byte x mid-side 5671 5672384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 5673 5674# format VQF (proprietary codec for sound) 5675# some infos on the header file available at : 5676# http://www.twinvq.org/english/technology_format.html 56770 string TWIN97012000 VQF data 5678>27 short 0 \b, Mono 5679>27 short 1 \b, Stereo 5680>31 short >0 \b, %d kbit/s 5681>35 short >0 \b, %d kHz 5682 5683# Nelson A. de Oliveira (naoliv@gmail.com) 5684# .eqf 56850 string Winamp\ EQ\ library\ file %s 5686# it will match only versions like v<digit>.<digit> 5687# Since I saw only eqf files with version v1.1 I think that it's OK 5688>23 string x \b%.4s 5689# .preset 56900 string [Equalizer\ preset] XMMS equalizer preset 5691# .m3u 56920 search/1 #EXTM3U M3U playlist text 5693# .pls 56940 search/1 [playlist] PLS playlist text 5695# licq.conf 56961 string [licq] LICQ configuration file 5697 5698# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 5699# NOTE: Most SNDH music is packed using ICE, which has 5700# magic numbers "ICE!" and "Ice!". Some SNDH music is 5701# not packed, so we check for both packed and unpacked. 570212 string SNDH SNDH Atari ST music 57030 belong&0xFFDFDFFF 0x49434521 5704>14 search/40 NDH SNDH Atari ST music 5705>14 search/40 TITL SNDH Atari ST music 57060 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 5707 5708# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 57090 string MP+ Musepack audio (MP+) 5710!:mime audio/x-musepack 5711>3 byte 255 \b, SV pre8 5712>3 byte&0xF 0x6 \b, SV 6 5713>3 byte&0xF 0x8 \b, SV 8 5714>3 byte&0xF 0x7 \b, SV 7 5715>>3 byte&0xF0 0x0 \b.0 5716>>3 byte&0xF0 0x10 \b.1 5717>>3 byte&0xF0 240 \b.15 5718>>10 byte&0xF0 0x0 \b, no profile 5719>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 5720>>10 byte&0xF0 0x50 \b, quality 0 5721>>10 byte&0xF0 0x60 \b, quality 1 5722>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 5723>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 5724>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 5725>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 5726>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 5727>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 5728>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 5729>>10 byte&0xF0 0xE0 \b, quality 9 5730>>10 byte&0xF0 0xF0 \b, quality 10 5731>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 5732>>27 byte 102 \b, Beta 1.02 5733>>27 byte 104 \b, Beta 1.04 5734>>27 byte 105 \b, Alpha 1.05 5735>>27 byte 106 \b, Beta 1.06 5736>>27 byte 110 \b, Release 1.1 5737>>27 byte 111 \b, Alpha 1.11 5738>>27 byte 112 \b, Beta 1.12 5739>>27 byte 113 \b, Alpha 1.13 5740>>27 byte 114 \b, Beta 1.14 5741>>27 byte 115 \b, Alpha 1.15 5742 57430 string MPCK Musepack audio (MPCK) 5744!:mime audio/x-musepack 5745 5746# IMY 5747# from http://filext.com/detaillist.php?extdetail=IMY 5748# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 5749# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 5750# http://www.wx800.com/msg/download/irda/iMelody.pdf 57510 string BEGIN:IMELODY iMelody Ringtone Format 5752 5753# From: "Mateus Caruccio" <mateus@caruccio.com> 5754# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 57550 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 5756 5757# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 575860 string SONG SoundFX Module sound file 5759 5760# Type: Adaptive Multi-Rate Codec 5761# URL: http://filext.com/detaillist.php?extdetail=AMR 5762# From: Russell Coker <russell@coker.com.au> 57630 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 5764!:mime audio/amr 5765!:ext amr 5766 5767# Type: SuperCollider 3 Synth Definition File Format 5768# From: Mario Lang <mlang@debian.org> 57690 string SCgf SuperCollider3 Synth Definition file, 5770>4 belong x version %d 5771 5772# Type: True Audio Lossless Audio 5773# URL: https://wiki.multimedia.cx/index.php?title=True_Audio 5774# From: Mike Melanson <mike@multimedia.cx> 57750 string TTA1 True Audio Lossless Audio 5776 5777# Type: WavPack Lossless Audio 5778# URL: https://wiki.multimedia.cx/index.php?title=WavPack 5779# From: Mike Melanson <mike@multimedia.cx> 57800 string wvpk WavPack Lossless Audio 5781 5782# From Fabio R. Schmidlin <frs@pop.com.br> 5783# VGM music file 57840 string Vgm\040 5785>9 ubyte >0 VGM Video Game Music dump v 5786!:mime audio/x-vgm 5787!:ext vgm 5788>>9 ubyte/16 >0 \b%d 5789>>9 ubyte&0x0F x \b%d 5790>>8 ubyte/16 x \b.%d 5791>>8 ubyte&0x0F >0 \b%d 5792#Get soundchips 5793>>8 ubyte x \b, soundchip(s)= 5794>>0x0C ulelong >0 SN76489 (PSG), 5795>>0x10 ulelong >0 YM2413 (OPLL), 5796>>0x2C ulelong >0 YM2612 (OPN2), 5797>>0x30 ulelong >0 YM2151 (OPM), 5798>>0x38 ulelong >0 Sega PCM, 5799>>0x34 ulelong >0xC 5800>>>0x40 ulelong >0 RF5C68 (PCM), 5801>>0x34 ulelong >0x10 5802>>>0x44 ulelong >0 YM2203 (OPN), 5803>>0x34 ulelong >0x14 5804>>>0x48 ulelong >0 YM2608 (OPNA), 5805>>0x34 ulelong >0x18 5806>>>0x4C lelong >0 YM2610 (OPNB), 5807>>>0x4C lelong <0 YM2610B (OPNB+2FM), 5808>>0x34 ulelong >0x1C 5809>>>0x50 ulelong >0 YM3812 (OPL2), 5810>>0x34 ulelong >0x20 5811>>>0x54 ulelong >0 YM3526 (OPL), 5812>>0x34 ulelong >0x24 5813>>>0x58 ulelong >0 Y8950 (MSX-Audio), 5814>>0x34 ulelong >0x28 5815>>>0x5C ulelong >0 YMF262 (OPL3), 5816>>0x34 ulelong >0x2C 5817>>>0x60 ulelong >0 YMF278B (OPL4), 5818>>0x34 ulelong >0x30 5819>>>0x64 ulelong >0 YMF271 (OPX), 5820>>0x34 ulelong >0x34 5821>>>0x68 ulelong >0 YMZ280B (PCMD8), 5822>>0x34 ulelong >0x38 5823>>>0x6C ulelong >0 RF5C164 (PCM), 5824>>0x34 ulelong >0x3C 5825>>>0x70 ulelong >0 PWM, 5826>>0x34 ulelong >0x40 5827>>>0x74 ulelong >0 5828>>>>0x78 ubyte 0x00 AY-3-8910, 5829>>>>0x78 ubyte 0x01 AY-3-8912, 5830>>>>0x78 ubyte 0x02 AY-3-8913, 5831>>>>0x78 ubyte 0x03 AY-3-8930, 5832>>>>0x78 ubyte 0x10 YM2149, 5833>>>>0x78 ubyte 0x11 YM3439, 5834>>>>0x78 ubyte 0x12 YMZ284, 5835>>>>0x78 ubyte 0x13 YMZ294, 5836# VGM 1.61 5837>>0x34 ulelong >0x4C 5838>>>0x80 ulelong >0 DMG, 5839>>0x34 ulelong >0x50 5840>>>0x84 lelong >0 NES APU, 5841>>>0x84 lelong <0 NES APU with FDS, 5842>>0x34 ulelong >0x54 5843>>>0x88 ulelong >0 MultiPCM, 5844>>0x34 ulelong >0x58 5845>>>0x8C ulelong >0 uPD7759 (ADPCM Speech), 5846>>0x34 ulelong >0x5C 5847>>>0x90 ulelong >0 OKIM6258 (ADPCM Speech), 5848>>0x34 ulelong >0x64 5849>>>0x98 ulelong >0 OKIM6295 (ADPCM), 5850>>0x34 ulelong >0x68 5851>>>0x9C ulelong >0 K051649, 5852>>0x34 ulelong >0x6C 5853>>>0xA0 ulelong >0 K054539, 5854>>0x34 ulelong >0x70 5855>>>0xA4 ulelong >0 HuC6280, 5856>>0x34 ulelong >0x74 5857>>>0xA8 ulelong >0 C140, 5858>>0x34 ulelong >0x78 5859>>>0xAC ulelong >0 K053260, 5860>>0x34 ulelong >0x7C 5861>>>0xB0 ulelong >0 Pokey, 5862>>0x34 ulelong >0x80 5863>>>0xB4 ulelong >0 QSound, 5864# VGM 1.71 5865>>0x34 ulelong >0x84 5866>>>0xB8 ulelong >0 SCSP, 5867>>0x34 ulelong >0x8C 5868>>>0xC0 ulelong >0 WonderSwan, 5869>>0x34 ulelong >0x90 5870>>>0xC4 ulelong >0 VSU, 5871>>0x34 ulelong >0x94 5872>>>0xC8 ulelong >0 SAA1099, 5873>>0x34 ulelong >0x98 5874>>>0xCC ulelong >0 ES5503 (DOC), 5875>>0x34 ulelong >0x9C 5876>>>0xD0 lelong >0 ES5505 (OTIS), 5877>>>0xD0 lelong <0 ES5506 (OTTO), 5878>>0x34 ulelong >0xA4 5879>>>0xD8 ulelong >0 X1-010, 5880>>0x34 ulelong >0xA8 5881>>>0xDC ulelong >0 C352, 5882>>0x34 ulelong >0xAC 5883>>>0xE0 ulelong >0 GA20, 5884 5885# GVOX Encore file format 5886# Since this is a proprietary file format and there is no publicly available 5887# format specification, this is just based on induction 5888# 58890 string SCOW 5890>4 byte 0xc4 GVOX Encore music, version 5.0 or above 5891>4 byte 0xc2 GVOX Encore music, version < 5.0 5892 58930 string ZBOT 5894>4 byte 0xc5 GVOX Encore music, version < 5.0 5895 5896# Summary: Garmin Voice Processing Module (WAVE audios) 5897# From: Joerg Jenderek 5898# URL: https://www.garmin.com/ 5899# Reference: http://www.poi-factory.com/node/19580 5900# NOTE: there exist 2 other Garmin VPM formats 59010 string AUDIMG 5902# skip text files starting with string "AUDIMG" 5903>13 ubyte <13 Garmin Voice Processing Module 5904!:mime audio/x-vpm-wav-garmin 5905!:ext vpm 5906# 3 bytes indicating the voice version (200,220) 5907>>6 string x \b, version %3.3s 5908# day of release (01-31) 5909>>12 ubyte x \b, %.2d 5910# month of release (01-12) 5911>>13 ubyte x \b.%.2d 5912# year of release (like 2006, 2007, 2008) 5913>>14 uleshort x \b.%.4d 5914# hour of release (0-23) 5915>>11 ubyte x %.2d 5916# minute of release (0-59) 5917>>10 ubyte x \b:%.2d 5918# second of release (0-59) 5919>>9 ubyte x \b:%.2d 5920# if you select a language like german on your garmin device 5921# you can only select voice modules with corresponding language byte ID like 1 5922>>18 ubyte x \b, language ID %d 5923# structure for phrases/sentences? 5924# number of voice sample in the 1st phrase? 5925#>>19 uleshort x \b, %#x samples 5926#>>>21 uleshort >0 \b, at %#4.4x 5927#>>>(21.s) ubequad x %#llx 5928# 2nd phrase? 5929#>>23 uleshort x \b, %#x samples 5930#>>>25 uleshort >0 \b, at %#4.4x 5931#>>>(25.s) ubequad x %#llx 5932# pointer to 1st audio WAV sample 5933>>16 uleshort >0 5934>>>(16.s) ulelong >0 \b, at %#x 5935# WAV length 5936# 1 space char after "bytes" to get phrase "bytes RIFF" 5937>>>>(16.s+4) ulelong >0 %u bytes 5938# look for magic 5939>>>>>(&-8.l) string RIFF 5940# determine type by ./riff 5941>>>>>>&-4 indirect x 5942# 2 - ~ 131 WAV samples following same way 5943# 5944# Summary: encrypted Garmin Voice Processing Module 5945# From: Joerg Jenderek 5946# URL: https://www.garmin.com/us/products/ontheroad/voicestudio 5947# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti. 5948# There exist 2 other Garmin VPM formats 59490 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted) 5950!:mime audio/x-vpm-garmin 5951!:ext vpm 5952 5953# From Martin Mueller Skarbiniks Pedersen 59540 string GDM 5955>0x3 byte 0xFE General Digital Music. 5956>0x4 string >\0 title: "%s" 5957>0x24 string >\0 musician: "%s" 5958>>0x44 beshort 0x0D0A 5959>>>0x46 byte 0x1A 5960>>>>0x47 string GMFS Version 5961>>>>0x4B byte x %d. 5962>>>>0x4C byte x \b%02d 5963>>>>0x4D beshort 0x000 (2GDM v 5964>>>>0x4F byte x \b%d. 5965>>>>>0x50 byte x \b%d) 5966 59670 string MTM Multitracker 5968>0x3 byte/16 x Version %d. 5969>0x3 byte&0x0F x \b%02d 5970>>0x4 string >\0 title: "%s" 5971 59720 string MO3 5973>3 ubyte <6 MOdule with MP3 5974>>3 byte 0 Version 0 (With MP3 and lossless) 5975>>3 byte 1 Version 1 (With ogg and lossless) 5976>>3 byte 3 Version 2.2 5977>>3 byte 4 (With no LAME header) 5978>>3 byte 5 Version 2.4 5979 59800 string ADRVPACK AProSys module 5981 5982# ftp://ftp.modland.com/pub/documents/format_documentation/\ 5983# Art%20Of%20Noise%20(.aon).txt 59840 string AON 5985>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)" 5986>0x2e string NAME Art of Noise Tracker Song 5987>3 string <9 5988>3 string 4 (4 voices) 5989>3 string 8 (8 voices) 5990>>0x36 string >\0 Title: "%s" 5991 59920 string FAR 5993>0x2c byte 0x0d 5994>0x2d byte 0x0a 5995>0x2e byte 0x1a 5996>>0x3 byte 0xFE Farandole Tracker Song 5997>>>0x31 byte/16 x Version %d. 5998>>>0x31 byte&0x0F x \b%02d 5999>>>>0x4 string >\0 \b, title: "%s" 6000 6001# magic for Klystrack, https://kometbomb.github.io/klystrack/ 6002# from Alex Myczko <alex@aiei.ch> 60030 string cyd!song Klystrack song 6004>8 byte >0 \b, version %u 6005>8 byte >26 6006#>>9 byte x \b, channels %u 6007#>>10 leshort x \b, time signature %u 6008#>>12 leshort x \b, sequence step %u 6009#>>14 byte x \b, instruments %u 6010#>>15 leshort x \b, patterns %u 6011#>>17 leshort x \b, sequences %u 6012#>>19 leshort x \b, length %u 6013#>>21 leshort x \b, loop point %u 6014#>>23 byte x \b, master volume %u 6015#>>24 byte x \b, song speed %u 6016#>>25 byte x \b, song speed2 %u 6017#>>26 byte x \b, song rate %u 6018#>>27 belong x \b, flags %#x 6019#>>31 byte x \b, multiplex period %u 6020#>>32 byte x \b, pitch inaccuracy %u 6021>>149 pstring x \b, title %s 6022 60230 string cyd!inst Klystrack instrument 6024 6025# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor 6026# see Specifications/WOPL-and-OPLI-Specification.txt 6027 60280 string WOPL3-INST\0 WOPL instrument 6029>11 leshort x \b, version %u 60300 string WOPL3-BANK\0 WOPL instrument bank 6031>11 leshort x \b, version %u 6032 6033# AdLib/OPL instrument files. Format specifications on 6034# http://www.shikadi.net/moddingwiki 60350 string Junglevision\ Patch\ File Junglevision instrument data 60360 string #OPL_II# DMX OP2 instrument data 60370 string IBK\x1a IBK instrument data 60380 string 2OP\x1a IBK instrument data, 2 operators 60390 string 4OP\x1a IBK instrument data, 4 operators 60402 string ADLIB- AdLib instrument data 6041>0 byte x \b, version %u 6042>1 byte x \b.%u 6043 6044# CRI ADX ADPCM audio 6045# Used by various Sega games. 6046# https://en.wikipedia.org/wiki/ADX_(file_format) 6047# https://wiki.multimedia.cx/index.php/CRI_ADX_file 6048# Added by David Korth <gerbilsoft@gerbilsoft.com> 60490x00 beshort 0x8000 6050>(2.S-2) string (c)CRI CRI ADX ADPCM audio 6051!:ext adx 6052!:mime audio/x-adx 6053!:strength +50 6054>>0x12 byte x v%u 6055>>0x04 byte 0x02 \b, pre-set prediction coefficients 6056>>0x04 byte 0x03 \b, standard ADX 6057>>0x04 byte 0x04 \b, exponential scale 6058>>0x04 byte 0x10 \b, AHX (Dreamcast) 6059>>0x04 byte 0x11 \b, AHX 6060>>0x08 belong x \b, %u Hz 6061>>0x12 byte 0x03 6062>>>0x02 beshort >0x2B 6063>>>>0x18 belong !0 \b, looping 6064>>0x12 byte 0x04 6065>>>0x02 beshort >0x37 6066>>>>0x24 belong !0 \b, looping 6067>>0x13 byte&0x08 0x08 \b, encrypted 6068 6069# Lossless audio (.la) (http://www.lossless-audio.com/) 60700 string LA 6071>2 string 03 Lossless audio version 0.3 6072>2 string 04 Lossless audio version 0.4 6073 6074# Sony PlayStation Audio (.xa) 60750 leshort 0x4158 Sony PlayStation Audio 6076 6077# Portable Sound Format 6078# Used for audio rips for various consoles. 6079# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format 6080# Added by David Korth <gerbilsoft@gerbilsoft.com> 60810 string PSF 6082>3 byte 0x01 6083>3 byte 0x02 6084>3 byte 0x11 6085>3 byte 0x12 6086>3 byte 0x13 6087>3 byte 0x21 6088>3 byte 0x22 6089>3 byte 0x23 6090>3 byte 0x41 6091>>0 string PSF Portable Sound Format 6092!:mime audio/x-psf 6093>>>3 byte 0x01 (Sony PlayStation) 6094>>>3 byte 0x02 (Sony PlayStation 2) 6095>>>3 byte 0x11 (Sega Saturn) 6096>>>3 byte 0x12 (Sega Dreamcast) 6097>>>3 byte 0x13 (Sega Mega Drive) 6098>>>3 byte 0x21 (Nintendo 64) 6099>>>3 byte 0x22 (Game Boy Advance) 6100>>>3 byte 0x23 (Super NES) 6101>>>3 byte 0x41 (Capcom QSound) 6102 6103# Atari 8-bit SAP audio format 6104# http://asap.sourceforge.net/sap-format.html 6105# Added by David Korth <gerbilsoft@gerbilsoft.com> 61060 string SAP\r\n Atari 8-bit SAP audio file 6107!:mime audio/x-sap 6108!:ext sap 6109>5 search/1024 NAME 6110>>&1 string x \b: %s 6111>>5 search/1024 AUTHOR 6112>>>&1 string x by %s 6113 6114# Nintendo Wii BRSTM audio format (fields) 6115# NOTE: Assuming HEAD starts at 0x40. 6116# FIXME: Replace 0x48 with HEAD offset plus 8. 61170 name nintendo-wii-brstm-fields 6118>(0x10.L) string HEAD \b: 6119>>(0x10.L+0x0C) belong x 6120>>>(&-4.L+0x48) belong x 6121>>>>&-4 byte 0 PCM, signed 8-bit, 6122>>>>&-4 byte 1 PCM, signed 16-bit, 6123>>>>&-4 byte 2 THP ADPCM, 6124>>>>&-3 byte !0 looping, 6125>>>>&-2 byte 1 mono 6126>>>>&-2 byte 2 stereo 6127>>>>&-2 byte 3 3 channels 6128>>>>&-2 byte 4 quad 6129>>>>&-2 byte >4 %u channels 6130>>>>&0 beshort !0 %u Hz 6131 6132# Nintendo Wii BRSTM audio format 6133# https://wiibrew.org/wiki/BRSTM_file 6134# Added by David Korth <gerbilsoft@gerbilsoft.com> 61350 string RSTM Nintendo Wii BRSTM audio file 6136!:mime audio/x-brstm 6137!:ext brstm 6138# Wii is big-endian, so default to BE. 6139>4 beshort 0xFEFF 6140>>0 use nintendo-wii-brstm-fields 6141>4 leshort 0xFEFF 6142>>0 use \^nintendo-wii-brstm-fields 6143 6144# Nintendo 3DS BCSTM audio format (fields) 61450 name nintendo-3ds-bcstm-fields 6146>(0x18.l) string INFO \b: 6147# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic) 6148>>&0x1C byte 0 PCM, signed 8-bit, 6149>>&0x1C byte 1 PCM, signed 16-bit, 6150>>&0x1C byte 2 DSP ADPCM, 6151>>&0x1C byte 3 IMA ADPCM, 6152>>&0x1D byte !0 looping, 6153>>&0x1E byte 1 mono 6154>>&0x1E byte 2 stereo 6155>>&0x1E byte 3 3 channels 6156>>&0x1E byte 4 quad 6157>>&0x1E byte >4 %u channels 6158>>&0x20 lelong !0 %u Hz 6159 6160# Nintendo 3DS BCSTM audio format 6161# https://www.3dbrew.org/wiki/BCSTM 6162# Added by David Korth <gerbilsoft@gerbilsoft.com> 61630 string CSTM Nintendo 3DS BCSTM audio file 6164!:mime audio/x-bcstm 6165!:ext bcstm 6166# 3DS is little-endian, so default to LE. 6167>4 leshort 0xFEFF 6168>>0 use nintendo-3ds-bcstm-fields 6169>4 beshort 0xFEFF 6170>>0 use \^nintendo-3ds-bcstm-fields 6171 6172# Nintendo Wii U BFSTM audio format 6173# http://mk8.tockdom.com/wiki/BFSTM_(File_Format) 6174# NOTE: This format is very similar to BCSTM. 6175# Added by David Korth <gerbilsoft@gerbilsoft.com> 61760 string FSTM Nintendo Wii U BFSTM audio file 6177!:mime audio/x-bfstm 6178!:ext bfstm 6179# BFSTM is used on both Wii U (BE) and Switch (LE), 6180# so default to LE. 6181>4 leshort 0xFEFF 6182>>0 use nintendo-3ds-bcstm-fields 6183>4 beshort 0xFEFF 6184>>0 use \^nintendo-3ds-bcstm-fields 6185 6186# Nintendo 3DS BCSTM audio format (fields) 61870 name nintendo-3ds-bcwav-fields 6188>(0x18.l) string INFO \b: 6189# INFO block (minus 4 for INFO magic) 6190>>&0x4 byte 0 PCM, signed 8-bit, 6191>>&0x4 byte 1 PCM, signed 16-bit, 6192>>&0x4 byte 2 DSP ADPCM, 6193>>&0x4 byte 3 IMA ADPCM, 6194>>&0x5 byte !0 looping, 6195>>&0x8 lelong x stereo 6196>>&0x8 lelong !0 %u Hz 6197 6198# Nintendo 3DS BCWAV audio format 6199# https://www.3dbrew.org/wiki/BCWAV 6200# Added by David Korth <gerbilsoft@gerbilsoft.com> 62010 string CWAV Nintendo 3DS BCWAV audio file 6202!:mime audio/x-bcwav 6203!:ext bcwav 6204# 3DS is little-endian, so default to LE. 6205>4 leshort 0xFEFF 6206>>0 use nintendo-3ds-bcwav-fields 6207>4 beshort 0xFEFF 6208>>0 use \^nintendo-3ds-bcwav-fields 6209 6210# Philips DSDIFF audio format (Direct Stream Digital Interchange File Format) 6211# Used for DSD audio recordings and Super Audio CD (SACD) mastering annotations 6212# https://dsd-guide.com/sites/default/files/white-papers/DSDIFF_1.5_Spec.pdf 6213# From: Toni Ruottu <toni.ruottu@iki.fi> 62140 string FRM8 621512 string DSD\x20 DSDIFF audio bitstream data 6216!:mime audio/x-dff 6217!:ext dff 6218 6219# format version chunk 6220>&0 string FVER 6221# version 1 6222>>&8 byte 1 6223 6224# v1 / sampling resolution ( 1 bit PDM only ) 6225>>>&0 string x \b, 1 bit 6226 6227# v1 / sound property chunk 6228>>>&0 search/0xff PROP 6229>>>>&8 string SND 6230 6231# v1 / sound property chunk / channel configuration chunk 6232>>>>>&0 search/0xff CHNL 6233>>>>>>&8 ubeshort 1 \b, mono 6234>>>>>>&8 ubeshort 2 6235>>>>>>>&0 string SLFTSRGT \b, stereo 6236>>>>>>>&0 default x \b, 2 channels 6237>>>>>>&8 ubeshort 3 6238>>>>>>>&0 string SLFTSRGTLFE\x20 \b, 2.1 stereo 6239>>>>>>>&0 string SLFTSRGTC\x20\x20\x20 \b, 3.0 stereo 6240>>>>>>>&0 default x \b, 3 channels 6241>>>>>>&8 ubeshort 4 6242>>>>>>>&0 string MLFTMRGTLS\x20\x20RS\x20\x20 \b, 4.0 surround 6243>>>>>>>&0 string SLFTSRGTC\x20\x20\x20LFE\x20 \b, 3.1 stereo 6244>>>>>>>&0 default x \b, 4 channels 6245>>>>>>&8 ubeshort 5 6246>>>>>>>&0 string MLFTMRGTC\x20\x20\x20LS\x20\x20RS\x20\x20 \b, 5.0 surround 6247>>>>>>>&0 string MLFTMRGTLFE\x20LS\x20\x20RS\x20\x20 \b, 4.1 surround 6248>>>>>>>&0 default x \b, 5 channels 6249>>>>>>&8 ubeshort 6 6250>>>>>>>&0 string MLFTMRGTC\x20\x20\x20LFE\x20LS\x20\x20RS\x20\x20 \b, 5.1 surround 6251>>>>>>>&0 default x \b, 6 channels 6252>>>>>>&8 ubeshort >6 \b, %u channels 6253 6254# v1 / sound property chunk / sample rate chunk 6255>>>>>&0 search/0xff FS\x20\x20 6256>>>>>>&0 string x \b, 6257>>>>>>&8 ubelong%44100 0 6258>>>>>>>&-4 ubelong/44100 x "DSD %u" 6259>>>>>>>&-4 ubelong x %u Hz 6260 6261# v1 / sound property chunk / compression type chunk 6262>>>>>&0 search/0xff CMPR 6263>>>>>>&8 string DSD\x20 \b, no compression 6264>>>>>>&8 string DST\x20 \b, DST compression 6265>>>>>>&8 default x \b, unknown compression 6266 6267# v1 / quest for metadata 6268>>>&0 string x 6269 6270# v1 / quest for metadata / edited master information chunk 6271>>>>&0 search DIIN 6272>>>>>&0 ubequad >0 \b, "edited master" metadata 6273 6274# v1 / quest for metadata / ID3 chunk ( defacto standard ) 6275>>>>&0 search ID3\x20 6276>>>>>&8 string ID3 \b, ID3 version 2 6277>>>>>&0 byte x \b.%u 6278>>>>>&1 byte x \b.%u 6279 6280# v1 / quest for metadata / failure ( possibly due to -P bytes=... being too low ) 6281>>>>&0 default x \b, ID3 missing (or unreachable) 6282 6283# version > 1 or 0 6284>>&0 default x \b, unknown version 6285 6286# Sony DSF audio format (Direct Stream Digital Stream File) 6287# Used for lossless digital storage of songs produced as DSD audio 6288# Portable analog of a track stored on a Super Audio CD (SACD) 6289# https://dsd-guide.com/sites/default/files/white-papers/DSFFileFormatSpec_E.pdf 6290# From: Toni Ruottu <toni.ruottu@iki.fi> 62910 string DSD\x20 DSF audio bitstream data 6292!:mime audio/x-dsf 6293!:ext dsf 6294 6295# format chunk 6296>28 string fmt\x20 6297# version 1 6298>>&8 ulelong 1 6299 6300# v1 / sampling resolution ( 1 bit PDM only ) 6301# NOTE: the spec incorrectly uses "bits per sample" instead of "bits per byte" 6302>>>&0 string x \b, 1 bit 6303 6304# v1 / channel configuration 6305>>>>&4 ulelong 1 \b, mono 6306>>>>&4 ulelong 2 \b, stereo 6307>>>>&4 ulelong 3 \b, 3.0 stereo 6308>>>>&4 ulelong 4 \b, 4.0 surround 6309>>>>&4 ulelong 5 \b, 3.1 stereo 6310>>>>&4 ulelong 6 \b, 5.0 surround 6311>>>>&4 ulelong 7 \b, 5.1 surround 6312>>>>&0 default x 6313>>>>>&4 ulelong x \b, %u channels 6314 6315# v1 / sample rate chunk 6316>>>>&0 string x \b, 6317>>>>&12 ulelong%44100 0 6318>>>>>&-4 ulelong/44100 x "DSD %u" 6319>>>>&12 ulelong x %u Hz 6320 6321# v1 / compression 6322>>>>&0 string x 6323>>>>>&0 ulelong 0 \b, no compression 6324>>>>>&0 default x \b, unknown compression 6325 6326# v1 / embedded ID3v2 metadata 6327>>>0 string x \b, ID3 6328>>>>20 ulequad !0 6329>>>>>(20.q) string ID3 version 2 6330>>>>>>&0 byte x \b.%u 6331>>>>>>&1 byte x \b.%u 6332# unable to verify ID3 ( possibly due to -P bytes=... being too low ) 6333>>>>>&0 default x unreachable 6334>>>>&0 default x missing 6335 6336# version > 1 or 0 6337>>&0 default x \b, unknown version 6338 6339#------------------------------------------------------------------------------ 6340# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $ 6341# avm: file(1) magic for avm files; this is not use 6342 6343# Summary: FRITZ!Box router configuration backup 6344# From: Joerg Jenderek 6345# URL: https://en.wikipedia.org/wiki/Fritz!Box 6346# Reference: http://www.mengelke.de/Projekte/FritzBoxTools2 6347# Note: only tested with models 4040 and 6490 Cable (lgi) 63480 string ****\ FRITZ!Box\ FRITZ!Box configuration backup 6349#!:mime text/plain 6350!:mime application/x-avm-export 6351!:ext export 6352# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT" 6353>15 string x of %-.4s 6354# on 2nd line hashed password 6355#>41 search/54 Password= \b, password 6356# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83 6357>41 search/172 FirmwareVersion= \b, firmware version 6358>>&0 string x %s 6359# on 5th line oem like: avme lgi 6360>41 search/285 OEM= \b, oem 6361>>&0 string x %s 6362# on 7th line language like: de en 6363>41 search/305 Language= \b, language 6364>>&0 string x %s 6365# on 10th line cfg file name like: /var/tmp.cfg 6366>41 search/349 tmp.cfg 6367# on 11th line date inside c-comment like: Thu Jun 4 22:25:19 2015 6368>>&4 string x \b, %s 6369# 6370 6371 6372#---------------------------------------------------------------- 6373# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $ 6374# basis: file(1) magic for BBx/Pro5-files 6375# Oliver Dammer <dammer@olida.de> 2005/11/07 6376# https://www.basis.com business-basic-files. 6377# 63780 string \074\074bbx\076\076 BBx 6379>7 string \000 indexed file 6380>7 string \001 serial file 6381>7 string \002 keyed file 6382>>13 short 0 (sort) 6383>7 string \004 program 6384>>18 byte x (LEVEL %d) 6385>>>23 string >\000 psaved 6386>7 string \006 mkeyed file 6387>>13 short 0 (sort) 6388>>8 string \000 (mkey) 6389#------------------------------------------------------------------------------ 6390# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $ 6391# beetle: file(1) magic for Beetle VM object files 6392# https://github.com/rrthomas/beetle/ 6393 6394# Beetle object module 63950 string BEETLE\000 Beetle VM object file 6396 6397#------------------------------------------------------------------------------ 6398# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $ 6399# ber: file(1) magic for several BER formats used in the mobile 6400# telecommunications industry (Georg Sauthoff) 6401 6402# The file formats are standardized by the GSMA (GSM association). 6403# They are specified via ASN.1 schemas and some prose. Basic encoding 6404# rules (BER) is the used encoding. The formats are used for exchanging 6405# call data records (CDRs) between mobile operators and associated 6406# parties for roaming clearing purposes and fraud detection. 6407 6408# The magic file covers: 6409 6410# - TAP files (TD.57) - CDR batches and notifications 6411# - RAP files (TD.32) - return batches and acknowledgements 6412# - NRT files (TD.35) - CDR batches for 'near real time' processing 6413 6414# 6415# TAP 3 Files 6416# TAP -> Transferred Account Procedure 6417# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf 6418# TransferBatch short tag 64190 byte 0x61 6420# BatchControlInfo short tag 6421>&1 search/b5 \x64 6422# Sender long tag #TAP 3.x (BER encoded) 6423>>&1 search/b8 \x5f\x81\x44 6424# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 6425>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 6426>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account) 6427 6428# Notification short tag 64290 byte 0x62 6430# Sender long tag 6431>2 search/b8 \x5f\x81\x44 6432# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 6433>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 6434>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account) 6435 6436 6437# NRT Files 6438# NRT a.k.a. NRTRDE 64390 byte 0x61 6440# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block 6441>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01 6442>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) 6443 6444# RAP Files 6445# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf 6446# Long ReturnBatch tag 64470 string \x7f\x84\x16 6448# Long RapBatchControlInfo tag 6449>&1 search/b8 \x7f\x84\x19 6450# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 6451>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 6452# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block 6453>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01 6454>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure), 6455>>>&0 byte x TAP 3.%d 6456 6457# Long Acknowledgement tag 64580 string \x7f\x84\x17 6459# Long Sender tag 6460>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure) 6461 6462#------------------------------------------------------------------------------ 6463# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $ 6464# bFLT: file(1) magic for BFLT uclinux binary files 6465# 6466# From Philippe De Muyter <phdm@macqel.be> 6467# 64680 string bFLT BFLT executable 6469>4 belong x - version %d 6470>4 belong 4 6471>>36 belong&0x1 0x1 ram 6472>>36 belong&0x2 0x2 gotpic 6473>>36 belong&0x4 0x4 gzip 6474>>36 belong&0x8 0x8 gzdata 6475 6476#------------------------------------------------------------------------------ 6477# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $ 6478# BlockHashLoc 6479# ext: bhl 6480# Marco Pontello marcopon@gmail.com 6481# reference: https://github.com/MarcoPon/BlockHashLoc 64820 string BlockHashLoc\x1a BlockHashLoc recovery info, 6483>13 byte x version %d 6484!:ext bhl 6485 6486#------------------------------------------------------------------------------ 6487# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $ 6488# bioinfomatics: file(1) magic for Bioinfomatics file formats 6489 6490############################################################################### 6491# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable 6492# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 6493############################################################################### 64940 string \037\213 6495>3 byte &0x04 6496>>12 string BC 6497>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible) 6498>>>>16 leshort x \b, block length %d 6499!:mime application/x-gzip 6500 6501 6502############################################################################### 6503# Tabix index file 6504# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 6505############################################################################### 65060 string TBI\1 SAMtools TBI (Tabix index format) 6507>0x04 lelong =1 \b, with %d reference sequence 6508>0x04 lelong >1 \b, with %d reference sequences 6509>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style) 6510>0x08 lelong ^0x10000 6511>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style) 6512>>0x08 lelong =1 \b, using SAM format 6513>>0x08 lelong =2 \b, using VCF format 6514>0x0c lelong x \b, sequence name column: %d 6515>0x10 lelong x \b, region start column: %d 6516>0x08 lelong =0 6517>>0x14 lelong x \b, region end column: %d 6518>0x18 byte x \b, comment character: %c 6519>0x1c lelong x \b, skip line count: %d 6520 6521 6522############################################################################### 6523# BAM (Binary Sequence Alignment/Map format) 6524# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 6525# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 6526############################################################################### 65270 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map) 6528>0x04 lelong >0 6529>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header 6530>>>&0 regex =[0-9.]+ \b version %s 6531>>&(0x04) lelong >0 \b, with %d reference sequences 6532 6533 6534############################################################################### 6535# BAI (BAM indexing format) 6536# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 6537############################################################################### 65380 string BAI\1 SAMtools BAI (BAM indexing format) 6539>0x04 lelong >0 \b, with %d reference sequences 6540 6541 6542############################################################################### 6543# CRAM (Binary Sequence Alignment/Map format) 6544############################################################################### 65450 string CRAM CRAM 6546>0x04 byte >-1 version %d. 6547>0x05 byte >-1 \b%d 6548>0x06 string >\0 (identified as %s) 6549 6550 6551############################################################################### 6552# BCF (Binary Call Format), version 1 6553# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf) 6554# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 6555############################################################################### 65560 string BCF\4 6557# length of seqnm data in bytes is positive 6558>&0x00 lelong >0 6559# length of smpl data in bytes is positive 6560>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format) 6561# length of meta in bytes 6562>>>&(&-0x04) lelong >0 6563# have meta text string 6564>>>>&0x00 search ##samtoolsVersion= 6565>>>>>&0x00 string x \b, generated by SAMtools version %s 6566 6567 6568############################################################################### 6569# BCF (Binary Call Format), version 2.1 6570# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 6571# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 6572############################################################################### 65730 string BCF\2\1 Binary Call Format (BCF) version 2.1 6574# length of header text 6575>&0x00 lelong >0 6576# have header string 6577>>&0x00 search ##samtoolsVersion= 6578>>>&0x00 string x \b, generated by SAMtools version %s 6579 6580 6581############################################################################### 6582# BCF (Binary Call Format), version 2.2 6583# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 6584# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 6585############################################################################### 65860 string BCF\2\2 Binary Call Format (BCF) version 2.2 6587# length of header text 6588>&0x00 lelong >0 6589# have header string 6590>>&0x00 search ##samtoolsVersion= 6591>>>&0x00 string x \b, generated by SAMtools version %s 6592 6593############################################################################### 6594# VCF (Variant Call Format) 6595# used by VCFtools (http://vcftools.sourceforge.net/) 6596############################################################################### 65970 search ##fileformat=VCFv Variant Call Format (VCF) 6598>&0 string x \b version %s 6599 6600############################################################################### 6601# FASTQ 6602# used by MAQ (http://maq.sourceforge.net/fastq.shtml) 6603############################################################################### 6604# XXX Broken? 6605# @<seqname> 6606#0 regex =^@[A-Za-z0-9_.:-]+\?\n 6607# <seq> 6608#>&1 regex =^[A-Za-z\n.~]++ 6609# +[<seqname>] 6610#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n 6611# <qual> 6612#>>>&1 regex =^[!-~\n]+\n FASTQ 6613 6614############################################################################### 6615# FASTA 6616# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) 6617############################################################################### 6618#0 byte 0x3e 6619# q>0 regex =^[>][!-~\t\ ]+$ 6620# Amino Acid codes: [A-IK-Z*-]+ 6621#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA 6622# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+ 6623# not in IUPAC codes/gaps: [EFIJLOPQZ] 6624#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes 6625#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes 6626 6627############################################################################### 6628# SAM (Sequence Alignment/Map format) 6629# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 6630############################################################################### 6631# Short-cut version to recognise SAM files with (optional) header at beginning 6632############################################################################### 66330 string @HD\t 6634>4 search VN: Sequence Alignment/Map (SAM), with header 6635>>&0 regex [0-9.]+ \b version %s 6636############################################################################### 6637# Longer version to recognise SAM alignment lines using (many) regexes 6638############################################################################### 6639# SAM Alignment QNAME 66400 regex =^[!-?A-~]{1,255}(\t[^\t]+){11} 6641# SAM Alignment FLAG 6642>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t 6643# SAM Alignment RNAME 6644>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t 6645# SAM Alignment POS 6646>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t 6647# SAM Alignment MAPQ 6648>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t 6649# SAM Alignment CIGAR 6650>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t 6651# SAM Alignment RNEXT 6652>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t 6653# SAM Alignment PNEXT 6654>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t 6655# SAM Alignment TLEN 6656>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t 6657# SAM Alignment SEQ 6658>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t 6659# SAM Alignment QUAL 6660>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM) 6661>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header 6662>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s 6663 6664############################################################################## 6665# 6666# Magic ids for biomedical signal file formats 6667# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com> 6668# 6669# The list has been derived from biosig projects 6670# http://biosig.sourceforge.net 6671# https://pub.ist.ac.at/~schloegl/matlab/eeg/ 6672# https://pub.ist.ac.at/~schloegl/biosig/TESTED 6673# 6674############################################################################## 6675# 66760 string ABF\x20 Biosig/Axon Binary format 6677!:mime biosig/abf2 66780 string ABF2\0\0 Biosig/Axon Binary format 6679!:mime biosig/abf2 6680# 66810 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows 6682!:mime biosig/ates 6683# 66840 string ATF\x09 Biosig/Axon Text format 6685!:mime biosig/atf 6686# 66870 string ADU1 Biosig/Axona file format 6688!:mime biosig/axona 66890 string ADU2 Biosig/Axona file format 6690!:mime biosig/axona 6691# 66920 string ALPHA-TRACE-MEDICAL Biosig/alpha trace 6693!:mime biosig/alpha 6694# 66950 string AxGr Biosig/AXG 66960 string axgx Biosig/AXG 6697!:mime biosig/axg 6698# 66990 string HeaderLen= Biosig/BCI2000 67000 string BCI2000V Biosig/BCI2000 6701!:mime biosig/bci2000 6702# 6703### Specification: https://www.biosemi.com/faq/file_format.htm 67040 string \xffBIOSEMI Biosig/Biosemi data format 6705!:mime biosig/bdf 6706# 67070 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file 67080 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file 67090 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file 6710!:mime biosig/brainvision 6711# 67120 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format 6713!:mime biosig/ced 6714# 6715### Specification: https://www.edfplus.info/specs/index.html 67160 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format 6717!:mime biosig/edf 6718# 6719### Specifications: https://arxiv.org/abs/cs/0608052 67200 string GDF Biosig/GDF: General data format for biosignals 6721!:mime biosig/gdf 6722# 67230 string DATA\0\0\0\0 Biosig/Heka Patchmaster 67240 string DAT1\0\0\0\0 Biosig/Heka Patchmaster 67250 string DAT2\0\0\0\0 Biosig/Heka Patchmaster 6726!:mime biosig/heka 6727# 67280 string (C)\x20CED\x2087 Biosig/CED SMR 6729!:mime biosig/ced-smr 6730# 67310 string CFWB\1\0\0\0 Biosig/CFWB 6732!:mime biosig/cfwb 6733# 67340 string DEMG Biosig/DEMG 6735!:mime biosig/demg 6736# 67370 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS 6738!:mime biosig/ebs 6739# 67400 string Embla\x20data\x20file Biosig/Embla 6741!:mime biosig/embla 6742# 67430 string Header\r\nFile Version Biosig/ETG4000 6744!:mime biosig/etg4000 6745# 67460 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo 6747!:mime biosig/galileo 6748# 67490 string IGOR Biosig/IgorPro ITX file 6750!:mime biosig/igorpro 6751# 6752# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf 67530 string ISHNE1.0 Biosig/ISHNE 6754!:mime biosig/ishne 6755# 6756# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm 67570 string @\x20\x20MFER\x20 Biosig/MFER 67580 string @\x20MFR\x20 Biosig/MFER 6759!:mime biosig/mfer 6760# 67610 string NEURALEV Biosig/NEV 67620 string N.EV.\0 Biosig/NEV 6763!:mime biosig/nev 6764# 67650 string NEX1 Biosig/NEX 6766!:mime biosig/nex1 6767# 67680 string PLEX Biosig/Plexon v1.0 676910 string PLEXON Biosig/Plexon v2.0 6770!:mime biosig/plexon 6771# 67720 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format 6773# 6774# Specification: CEN 1064:2005/ISO 11073:91064 677516 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 6776!:mime biosig/scpecg 6777# 67780 string IAvSFo Biosig/SIGIF 6779!:mime biosig/sigif 6780# 67810 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32 6782!:mime biosig/tms32 6783# 67840 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG 6785!:mime biosig/tmsilog 6786# 67874 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0 6788>63 string CRawDataElement 6789>>85 string CRawDataBuffer Biosig/SYNERGY 6790!:mime biosig/synergy 6791# 67924 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO 6793!:mime biosig/unipro 6794# 67950 string VER=9\r\nCTIME= Biosig/WCP 6796!:mime biosig/wcp 6797# 67980 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek 67990 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek 68000 string \x55\x55\xFE\xAF Biosig/Walter Graphtek 6801!:mime biosig/walter-graphtek 6802# 68030 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 6804>32 string [PatInfo] Biosig/Sigma 6805!:mime biosig/sigma 6806# 68070 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF) 6808!:mime biosig/fef 68090 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF) 6810!:mime biosig/fef 6811# 68120 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1 6813>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0 6814>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF 6815!:mime biosig/fiff 6816# 6817 6818#------------------------------------------------------------------------------ 6819# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $ 6820# blackberry: file(1) magic for BlackBerry file formats 6821# 68225 belong 0 6823>8 belong 010010010 BlackBerry RIM ETP file 6824>>22 string x \b for %s 6825# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 6826# https://ftg.lbl.gov/checkpoint 68270 string C\0\0\0R\0\0\0 BLCR 6828>16 lelong 1 x86 6829>16 lelong 3 alpha 6830>16 lelong 5 x86-64 6831>16 lelong 7 ARM 6832>8 lelong x context data (little endian, version %d) 6833# Uncomment the following only of your "file" program supports "search" 6834#>0 search/1024 VMA\06 for kernel 6835#>>&1 byte x %d. 6836#>>&2 byte x %d. 6837#>>&3 byte x %d 68380 string \0\0\0C\0\0\0R BLCR 6839>16 belong 2 SPARC 6840>16 belong 4 ppc 6841>16 belong 6 ppc64 6842>16 belong 7 ARMEB 6843>16 belong 8 SPARC64 6844>8 belong x context data (big endian, version %d) 6845# Uncomment the following only of your "file" program supports "search" 6846#>0 search/1024 VMA\06 for kernel 6847#>>&1 byte x %d. 6848#>>&2 byte x \b%d. 6849#>>&3 byte x \b%d 6850 6851#------------------------------------------------------------------------------ 6852# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $ 6853# blender: file(1) magic for Blender 3D related files 6854# 6855# Native format rule v1.2. For questions use the developers list 6856# https://lists.blender.org/mailman/listinfo/bf-committers 6857# GLOB chunk was moved near start and provides subversion info since 2.42 6858 68590 string =BLENDER Blender3D, 6860>7 string =_ saved as 32-bits 6861>>8 string =v little endian 6862>>>9 byte x with version %c. 6863>>>10 byte x \b%c 6864>>>11 byte x \b%c 6865>>>0x40 string =GLOB \b. 6866>>>>0x58 leshort x \b%.4d 6867>>8 string =V big endian 6868>>>9 byte x with version %c. 6869>>>10 byte x \b%c 6870>>>11 byte x \b%c 6871>>>0x40 string =GLOB \b. 6872>>>>0x58 beshort x \b%.4d 6873>7 string =- saved as 64-bits 6874>>8 string =v little endian 6875>>9 byte x with version %c. 6876>>10 byte x \b%c 6877>>11 byte x \b%c 6878>>0x44 string =GLOB \b. 6879>>>0x60 leshort x \b%.4d 6880>>8 string =V big endian 6881>>>9 byte x with version %c. 6882>>>10 byte x \b%c 6883>>>11 byte x \b%c 6884>>>0x44 string =GLOB \b. 6885>>>>0x60 beshort x \b%.4d 6886 6887# Scripts that run in the embedded Python interpreter 68880 string #!BPY Blender3D BPython script 6889 6890#------------------------------------------------------------------------------ 6891# $File: blit,v 1.9 2021/07/03 14:01:46 christos Exp $ 6892# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 6893# 6894# Note that this 0407 conflicts with several other a.out formats... 6895# 6896# XXX - should this be redone with "be" and "le", so that it works on 6897# little-endian machines as well? If so, what's the deal with 6898# "VAX-order" and "VAX-order2"? 6899# 6900#0 long 0407 68K Blit (standalone) executable 6901#0 short 0407 VAX-order2 68K Blit (standalone) executable 69020 short 03401 VAX-order 68K Blit (standalone) executable 69030 long 0406 68k Blit mpx/mux executable 69040 short 0406 VAX-order2 68k Blit mpx/mux executable 6905# GRR: line below is too general as it matches also TTComp archive, ASCII, 4K handled by ./archive 69060 short 03001 VAX-order 68k Blit mpx/mux executable 6907# TODO: 6908# skip TTComp archive, ASCII, 4K by looking for executable keyword like main 6909#>0 search/5536 main\0 VAX-order 68k Blit mpx/mux executable 6910# Need more values for WE32 DMD executables. 6911# Note that 0520 is the same as COFF 6912#0 short 0520 tty630 layers executable 6913 6914#------------------------------------------------------------------------------ 6915# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $ 6916# bm: file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm 6917 69180 string bm\001\244 Birtual Machine 6919>4 leshort x \b, version %d 6920>6 lelong x \b, program size %u 6921>14 lelong x \b, memory size %u 6922>22 lelong x \b, memory capacity %u 6923 6924#------------------------------------------------------------------------------ 6925# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 6926# i80960 b.out objects and archives 6927# 69280 long 0x10d i960 b.out relocatable object 6929>16 long >0 not stripped 6930# 6931# b.out archive (hp-rt on i960) 69320 string =!<bout> b.out archive 6933>8 string __.SYMDEF random library 6934 6935#------------------------------------------------------------------------------ 6936# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $ 6937# bsdi: file(1) magic for BSD/OS (from BSDI) objects 6938# Some object/executable formats use the same magic numbers as are used 6939# in other OSes; those are handled by entries in aout. 6940# 6941 69420 lelong 0314 386 compact demand paged pure executable 6943>16 lelong >0 not stripped 6944>32 byte 0x6a (uses shared libs) 6945 6946# same as in SunOS 4.x, except for static shared libraries 69470 belong&077777777 0600413 SPARC demand paged 6948>0 byte &0x80 6949>>20 belong <4096 shared library 6950>>20 belong =4096 dynamically linked executable 6951>>20 belong >4096 dynamically linked executable 6952>0 byte ^0x80 executable 6953>16 belong >0 not stripped 6954>36 belong 0xb4100001 (uses shared libs) 6955 69560 belong&077777777 0600410 SPARC pure 6957>0 byte &0x80 dynamically linked executable 6958>0 byte ^0x80 executable 6959>16 belong >0 not stripped 6960>36 belong 0xb4100001 (uses shared libs) 6961 69620 belong&077777777 0600407 SPARC 6963>0 byte &0x80 dynamically linked executable 6964>0 byte ^0x80 executable 6965>16 belong >0 not stripped 6966>36 belong 0xb4100001 (uses shared libs) 6967# Chiasmus is an encryption standard developed by the German Federal 6968# Office for Information Security (Bundesamt fuer Sicherheit in der 6969# Informationstechnik). 6970 6971# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html 69720 string XIA1\r Chiasmus Encrypted data 6973!:ext xia 6974 69750 string XIS Chiasmus key 6976!:ext xis 6977 6978#------------------------------------------------------------------------------ 6979# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 6980# BTSnoop: file(1) magic for BTSnoop files 6981# 6982# From <marcel@holtmann.org> 69830 string btsnoop\0 BTSnoop 6984>8 belong x version %d, 6985>12 belong 1001 Unencapsulated HCI 6986>12 belong 1002 HCI UART (H4) 6987>12 belong 1003 HCI BCSP 6988>12 belong 1004 HCI Serial (H5) 6989>>12 belong x type %d 6990 6991#------------------------------------------------------------ 6992# $File: burp,v 1.1 2022/07/04 17:15:09 christos Exp $ 6993# Burp file, I don't know the version 6994#------------------------------------------------------------ 6995# From wof (wof@stachelkaktus.net) 69960 bequad 0x6685828000000001 Burp project save file 6997 6998#------------------------------------------------------------ 6999# $File: bytecode,v 1.3 2022/03/24 15:48:58 christos Exp $ 7000# magic for various bytecodes 7001 7002# From: Mikhail Gusarov <dottedmag@dottedmag.net> 7003# NekoVM (https://nekovm.org/) bytecode 70040 string NEKO NekoVM bytecode 7005>4 lelong x (%d global symbols, 7006>8 lelong x %d global fields, 7007>12 lelong x %d bytecode ops) 7008!:mime application/x-nekovm-bytecode 7009 7010# https://www.iana.org/assignments/media-types/application/vnd.resilient.logic 7011# From: Benedikt Muessig <benedikt@resilient-group.de> 70120 belong 0x07524c4d Resilient Logic bytecode 7013!:mime application/vnd.resilient.logic 7014>4 byte/16 x \b, version %d 7015>4 byte&0x0f x \b.%d 7016 7017# Guile file magic from <dalepsmith@gmail.com> 7018# https://www.gnu.org/s/guile/ 7019# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 7020 70210 string GOOF---- Guile Object 7022>8 string LE \b, little endian 7023>8 string BE \b, big endian 7024>11 string 4 \b, 32bit 7025>11 string 8 \b, 64bit 7026>13 regex .\\.. \b, bytecode v%s 7027 7028#------------------------------------------------------------------------------ 7029# $File: c64,v 1.12 2022/05/14 20:03:39 christos Exp $ 7030# c64: file(1) magic for various commodore 64 related files 7031# 7032# From: Dirk Jagdmann <doj@cubic.org> 7033 70340x16500 belong 0x12014100 D64 Image 70350x16500 belong 0x12014180 D71 Image 70360x61800 belong 0x28034400 D81 Image 70370 belong 0x43154164 X64 Image 7038 7039# C64 (and other CBM) cartridges 7040# Extended by David Korth <gerbilsoft@gerbilsoft.com> 7041# Reference: https://vice-emu.sourceforge.io/vice_17.html#SEC391 7042 70430 string C64\40CARTRIDGE Commodore 64 cartridge 7044>0x20 ubyte 0 \b, 7045>0x20 ubyte !0 7046>>0x20 string/T x \b: "%.32s", 7047>0x16 beshort 0 7048>>0x18 beshort 0x0000 16 KB game 7049>>0x18 beshort 0x0001 8 KB game 7050>>0x18 beshort 0x0100 UltiMax mode 7051>>0x18 beshort 0x0101 RAM/disabled 7052>0x16 beshort 1 Action Replay 7053>0x16 beshort 2 KCS Power Cartridge 7054>0x16 beshort 3 Final Cartridge III 7055>0x16 beshort 4 Simons' BASIC 7056>0x16 beshort 5 Ocean type 1 7057>0x16 beshort 6 Expert Cartridge 7058>0x16 beshort 7 Fun Play, Power Play 7059>0x16 beshort 8 Super Games 7060>0x16 beshort 9 Atomic Power 7061>0x16 beshort 10 Epyx Fastload 7062>0x16 beshort 11 Westermann Learning 7063>0x16 beshort 12 Rex Utility 7064>0x16 beshort 13 Final Cartridge I 7065>0x16 beshort 14 Magic Formel 7066>0x16 beshort 15 C64 Game System, System 3 7067>0x16 beshort 16 Warp Speed 7068>0x16 beshort 17 Dinamic 7069>0x16 beshort 18 Zaxxon / Super Zaxxon (Sega) 7070>0x16 beshort 19 Magic Desk, Domark, HES Australia 7071>0x16 beshort 20 Super Snapshot V5 7072>0x16 beshort 21 Comal-80 7073>0x16 beshort 22 Structured BASIC 7074>0x16 beshort 23 Ross 7075>0x16 beshort 24 Dela EP64 7076>0x16 beshort 25 Dela EP7x8 7077>0x16 beshort 26 Dela EP256 7078>0x16 beshort 27 Rex EP256 7079>0x16 beshort 28 Mikro Assembler 7080>0x16 beshort 29 Final Cartridge Plus 7081>0x16 beshort 30 Action Replay 4 7082>0x16 beshort 31 Stardos 7083>0x16 beshort 32 EasyFlash 7084>0x16 beshort 33 EasyFlash Xbank 7085>0x16 beshort 34 Capture 7086>0x16 beshort 35 Action Replay 3 7087>0x16 beshort 36 7088>>0x1A ubyte 1 Nordic Replay 7089>>0x1A ubyte !1 Retro Replay 7090>0x16 beshort 37 MMC64 7091>0x16 beshort 38 MMC Replay 7092>0x16 beshort 39 IDE64 7093>0x16 beshort 40 Super Snapshot V4 7094>0x16 beshort 41 IEEE-488 7095>0x16 beshort 42 Game Killer 7096>0x16 beshort 43 Prophet64 7097>0x16 beshort 44 EXOS 7098>0x16 beshort 45 Freeze Frame 7099>0x16 beshort 46 Freeze Machine 7100>0x16 beshort 47 Snapshot64 7101>0x16 beshort 48 Super Explode V5.0 7102>0x16 beshort 49 Magic Voice 7103>0x16 beshort 50 Action Replay 2 7104>0x16 beshort 51 MACH 5 7105>0x16 beshort 52 Diashow-Maker 7106>0x16 beshort 53 Pagefox 7107>0x16 beshort 54 Kingsoft 7108>0x16 beshort 55 Silverrock 128K Cartridge 7109>0x16 beshort 56 Formel 64 7110>0x16 beshort 57 7111>>0x1A ubyte 1 Hucky 7112>>0x1A ubyte !1 RGCD 7113>0x16 beshort 58 RR-Net MK3 7114>0x16 beshort 59 EasyCalc 7115>0x16 beshort 60 GMod2 7116>0x16 beshort 61 MAX Basic 7117>0x16 beshort 62 GMod3 7118>0x16 beshort 63 ZIPP-CODE 48 7119>0x16 beshort 64 Blackbox V8 7120>0x16 beshort 65 Blackbox V3 7121>0x16 beshort 66 Blackbox V4 7122>0x16 beshort 67 REX RAM-Floppy 7123>0x16 beshort 68 BIS-Plus 7124>0x16 beshort 69 SD-BOX 7125>0x16 beshort 70 MultiMAX 7126>0x16 beshort 71 Blackbox V9 7127>0x16 beshort 72 Lt. Kernal Host Adaptor 7128>0x16 beshort 73 RAMLink 7129>0x16 beshort 74 H.E.R.O. 7130>0x16 beshort 75 IEEE Flash! 64 7131>0x16 beshort 76 Turtle Graphics II 7132>0x16 beshort 77 Freeze Frame MK2 7133 71340 string C128\40CARTRIDGE Commodore 128 cartridge 7135>0x20 ubyte 0 \b, 7136>0x20 ubyte !0 7137>>0x20 string/T x \b: "%.32s", 7138>0x16 beshort 0 generic cartridge 7139>0x16 beshort 1 Warpspeed128 7140>>0x1A ubyte 1 \b, REU support 7141>>0x1A ubyte 2 \b, REU support, with I/O and ROM banking 7142 71430 string CBM2\40CARTRIDGE Commodore CBM-II cartridge 7144>0x20 ubyte !0 7145>>0x20 string/T x \b: "%.32s" 7146 71470 string VIC20\40CARTRIDGE Commodore VIC-20 cartridge 7148>0x20 ubyte 0 \b, 7149>0x20 ubyte !0 7150>>0x20 string/T x \b: "%.32s", 7151>0x16 beshort 0 generic cartridge 7152>0x16 beshort 1 Mega-Cart 7153>0x16 beshort 2 Behr Bonz 7154>0x16 beshort 3 Vic Flash Plugin 7155>0x16 beshort 4 UltiMem 7156>0x16 beshort 5 Final Expansion 7157 71580 string PLUS4\40CARTRIDGE Commodore 16/Plus4 cartridge 7159>0x20 ubyte !0 7160>>0x20 string/T x \b: "%.32s" 7161 7162 7163# DreamLoad archives see: 7164# https://www.lemon64.com/forum/viewtopic.php?t=37415\ 7165# &sid=494dc2ca91289e05dadf80a7f8a968fe (at the bottom). 7166# https://www.c64-wiki.com/wiki/DreamLoad. 7167# Example HVSC Commodore 64 music collection: 7168# https://kohina.duckdns.org/HVSC/C64Music/10_Years_HVSC.dfi 7169 71700 byte 0 7171>1 string DREAMLOAD\40FILE\40ARCHIVE 7172>>0x17 byte 0 DFI Image 7173>>>0x1a leshort x version: %d. 7174>>>0x18 leshort x \b%d 7175>>>0x1c lelong x tracks: %d 7176 71770 string GCR-1541 GCR Image 7178>8 byte x version: %i 7179>9 byte x tracks: %i 7180 71819 string PSUR ARC archive (c64) 71822 string -LH1- LHA archive (c64) 7183 71840 string C64File PC64 Emulator file 7185>8 string >\0 "%s" 71860 string C64Image PC64 Freezer Image 7187 71880 beshort 0x38CD C64 PCLink Image 71890 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 7190 71910 belong 0xFF424CFF WRAptor packer (c64) 7192 71930 string C64S\x20tape\x20file T64 tape Image 7194>32 leshort x Version:%#x 7195>36 leshort !0 Entries:%i 7196>40 string x Name:%.24s 7197 71980 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 7199>32 leshort x Version:%#x 7200>36 leshort !0 Entries:%i 7201>40 string x Name:%.24s 7202 72030 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 7204>32 leshort x Version:%#x 7205>36 leshort !0 Entries:%i 7206>40 string x Name:%.24s 7207 7208# Raw tape file format (.tap files) 7209# Esa Hyyti <esa@netlab.tkk.fi> 72100 string C64-TAPE-RAW C64 Raw Tape File (.tap), 7211>0x0c byte x Version:%u, 7212>0x10 lelong x Length:%u cycles 7213 7214# magic for Goattracker2, http://covertbitops.c64.org/ 7215# from Alex Myczko <alex@aiei.ch> 72160 string GTS5 GoatTracker 2 song 7217>4 string >\0 \b, "%s" 7218>36 string >\0 \b by %s 7219>68 string >\0 \b (C) %s 7220>100 byte >0 \b, %u subsong(s) 7221 7222# CBM BASIC (cc65 compiled) 72230 leshort 0x0801 7224>2 leshort 0x080b 7225>6 string \x9e CBM BASIC 7226>7 string >\0 \b, SYS %s 7227 7228#------------------------------------------------------------------------------ 7229# $File: cad,v 1.29 2021/12/06 19:33:27 christos Exp $ 7230# autocad: file(1) magic for cad files 7231# 7232 7233# Microstation DGN/CIT Files (www.bentley.com) 7234# Last updated July 29, 2005 by Lester Hightower 7235# DGN is the default file extension of Microstation/Intergraph CAD files. 7236# CIT is the proprietary raster format (similar to TIFF) used to attach 7237# raster underlays to Microstation DGN (vector) drawings. 7238# 7239# http://www.wotsit.org/search.asp 7240# https://filext.com/detaillist.php?extdetail=DGN 7241# https://filext.com/detaillist.php?extdetail=CIT 7242# 7243# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 7244# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 7245# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 7246# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 7247# 7248# URL: https://en.wikipedia.org/wiki/MicroStation 7249# reference: http://dgnlib.maptools.org/dgn.html 7250# http://dgnlib.maptools.org/dl/ref18.pdf 7251# Update: Joerg Jenderek 7252# Note: verfied by command like `dgndump seed2d_b.dgn` 7253# test for level 8 and type 5 or 9 72540 beshort&0x3F73 0x0801 7255# level of element like 8 7256#>0 ubyte&0x3F x \b, level %u 7257#>0 ubyte &0x80 \b, complex 7258#>0 ubyte &0x40 \b, reserved 7259# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements 7260#>1 ubyte&0x7F x \b, type %u 7261# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT 7262#>2 uleshort x \b, words %#4.4x to follow 7263# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL) 7264#>508 ubelong x \b, RESERVED %8.8x 7265>508 ubelong&0xFFffFF00 =0 7266# test for level 8 and type 9 for INGR raster image 7267>>0 beshort 0x0809 7268# test for length of 1st element is multiple of blocks a 512 bytes 7269>>>2 ubyte 0xfe 7270>>>>0 use ingr-image 7271# test for DGN or CEL by jump words (uleshort) forward to next element 7272>(2.s*2) ulong x 7273# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT 7274#>>&1 ubyte&0x7F x \b, 2nd type %u 7275# DGN 7276>>&1 ubyte&0x7F 8 7277>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing 7278!:mime application/x-bentley-dgn 7279!:ext dgn 7280# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0 7281>>>>1214 ubyte &0x40 3D 7282>>>>1214 ubyte ^0x40 2D 7283# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040 7284>>>>1120 string x \b, units %-.2s 7285# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0 7286>>>>1122 string >\0 %-.2s 7287#>>>>1120 ubelong x \b, units %#8.8x 7288# element range low,high x y z like xlow=0 08010000h 01080000h 7289#>>>>4 ubelong !0 \b, xlow %8.8x 7290#>>>>8 ubelong !0 \b, ylow %8.8x 7291#>>>>12 ubelong !0 \b, zlow %8.8x 7292#>>>>16 ubelong !0 \b, xhigh %8.8x 7293#>>>>20 ubelong !0 \b, yhigh %8.8x 7294#>>>>24 ubelong !0 \b, zhigh %8.8x 7295# graphic group number; all other elements in that group have same non-0 number 7296#>>>>28 leshort x \b, grphgrp %#4.4x 7297# words to optional attribute linkage 7298#>>>>30 ubyte x \b, attindx \%o 7299#>>>>31 ubyte x \b\%o 7300# >>30 string \026\105 DGNFile 7301# >>30 string \034\105 DGNFile 7302# >>30 string \073\107 DGNFile 7303# >>30 string \073\110 DGNFile 7304# >>30 string \106\107 DGNFile 7305# >>30 string \110\103 DGNFile 7306# >>30 string \120\104 DGNFile 7307# >>30 string \172\104 DGNFile 7308# >>30 string \172\105 DGNFile 7309# >>30 string \172\106 DGNFile 7310# >>30 string \234\106 DGNFile 7311# >>30 string \273\105 DGNFile 7312# >>30 string \306\106 DGNFile 7313# >>30 string \310\104 DGNFile 7314# >>30 string \341\104 DGNFile 7315# >>30 string \372\103 DGNFile 7316# >>30 string \372\104 DGNFile 7317# >>30 string \372\106 DGNFile 7318# >>30 string \376\103 DGNFile 7319# elements properties indicator 7320#>>>>32 uleshort !0 \b, properties %#4.4x 7321# class 0~Primary 7322#>>>>>32 uleshort&0x000F !0 \b, class %#4.4x 7323# Symbology 7324#>>>>>34 uleshort x \b, Symbology %#4.4x 7325# test for 2nd element type 1~library cell header 7326>>&1 ubyte&0x7F 1 7327# test for 1st element with level 8 and type 5 for cell library 7328>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library 7329!:mime application/x-bentley-cel 7330!:ext cel 7331# 7332# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster 7333# reference: https://web.archive.org/web/20140903185431/ 7334# http://oreilly.com/www/centers/gff/formats/ingr/index.htm 7335# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT` 7336# display information for intergraph raster bitmap 73370 name ingr-image 7338# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD" 7339# DataTypeCode indicates format, depth of the pixel data and used compression 7340>4 uleshort x Intergraph raster image 7341>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit 7342!:mime image/x-intergraph-rle 7343!:ext rel 7344>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit 7345!:mime image/x-intergraph-cit 7346!:ext cit 7347>>4 uleshort 27 \b, Adaptive RLE RGB 7348!:mime image/x-intergraph-rgb 7349!:ext rgb 7350>>4 default x 7351>>>4 uleshort x \b, Type %u 7352!:mime image/x-intergraph 7353# TODO: 7354#>4 uleshort 0 \b, no data 7355# ... 7356#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed) 7357# ApplicationType: 0~generic raster image 3~drawing, scanning 7358# 8~I/IMAGE and MicroStation Imager 9~ModelView 7359>6 uleshort !0 \b, ApplicationType %u 7360#>6 uleshort x \b, ApplicationType %u 7361# XViewOrigin; Raster grid data X origin 7362#>8 ulequad !0 \b, XViewOrigin %llx 7363# PixelsPerLine is the number of pixels in a scan line of bitmapp 7364>184 ulelong x \b, %u x 7365# NumberOfLines is height of the raster data in scanlines 7366>188 ulelong x %u 7367# DeviceResolution; resolution of scanning device 7368# positive indicates number of micros between lines; negative indicates DPI 7369#>192 leshort x \b, DeviceResolution %d 7370# ScanlineOrient indicates the origin and the orientation of the scan lines 7371#>194 ubyte x \b, ScanlineOrient %x 7372>194 ubyte x \b, orientation 7373>194 ubyte &0x01 right 7374>194 ubyte ^0x01 left 7375>194 ubyte &0x02 down 7376>194 ubyte ^0x02 top 7377>194 ubyte &0x04 horizontal 7378>194 ubyte ^0x04 vertical 7379# ScannableFlag; Scanline indexing method used 7380#>195 ubyte !0 \b, ScannableFlag %#x 7381# RotationAngle; Rotation angle of raster data 7382#>196 ubequad !0 \b, RotationAngle %#llx 7383# SkewAngle; Skew angle of raster data 7384#>204 ubequad !0 \b, SkewAngle %llx 7385# DataTypeModifier; Additional raster data format info 7386#>212 uleshort !0 \b, DataTypeModifier %#4.4x 7387# DesignFile[66]; Name of the design file 7388>214 string >\0 \b, DesignFile %-.66s 7389# DatabaseFile[66]; Name of the database file 7390>280 string >\0 \b, DatabaseFile %-.66s 7391# ParentGridFile[66]; Name of parent grid file 7392>346 string >\0 \b, ParentGridFile %-.66s 7393# FileDescription[80]; Text description of file and contents 7394>412 string >\0 \b, FileDescription %-.80s 7395# MinValue 7396#>492 ubequad !0 \b, MinValue %#llx 7397# MaxValue 7398#>500 ubequad !0 \b, MaxValue %#llx 7399# Reserved[3]; Unused (always 0) 7400#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x 7401# GridFileVersion; Grid File Version like 2 3 7402#>511 ubyte x \b, GridFileVersion %x 7403 7404# AutoCAD 7405# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg 7406# and https://www.iana.org/assignments/media-types/image/vnd.dwg 74070 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 7408!:mime image/vnd.dwg 74090 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 7410!:mime image/vnd.dwg 74110 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 7412!:mime image/vnd.dwg 74130 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 7414!:mime image/vnd.dwg 74150 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 7416!:mime image/vnd.dwg 74170 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 7418!:mime image/vnd.dwg 74190 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 7420!:mime image/vnd.dwg 74210 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 7422!:mime image/vnd.dwg 74230 string AC1001 DWG AutoDesk AutoCAD Release 2.22 7424!:mime image/vnd.dwg 74250 string AC1002 DWG AutoDesk AutoCAD Release 2.50 7426!:mime image/vnd.dwg 74270 string AC1003 DWG AutoDesk AutoCAD Release 2.60 7428!:mime image/vnd.dwg 74290 string AC1004 DWG AutoDesk AutoCAD Release 9 7430!:mime image/vnd.dwg 74310 string AC1006 DWG AutoDesk AutoCAD Release 10 7432!:mime image/vnd.dwg 74330 string AC1009 DWG AutoDesk AutoCAD Release 11/12 7434!:mime image/vnd.dwg 7435# AutoCAD DWG versions R13/R14 (www.autodesk.com) 7436# Written December 01, 2003 by Lester Hightower 7437# Based on the DWG File Format Specifications at http://www.opendwg.org/ 7438# AutoCad, from Nahuel Greco 7439# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 74400 string AC1012 DWG AutoDesk AutoCAD Release 13 7441!:mime image/vnd.dwg 74420 string AC1013 DWG AutoDesk AutoCAD Release 13c3 7443!:mime image/vnd.dwg 74440 string AC1014 DWG AutoDesk AutoCAD Release 14 7445!:mime image/vnd.dwg 74460 string AC1015 DWG AutoDesk AutoCAD 2000 7447!:mime image/vnd.dwg 7448 7449# A new version of AutoCAD DWG 7450# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 7451# ICQ 358572321) 7452# From various sources like: 7453# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html 74540 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 7455!:mime image/vnd.dwg 74560 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 7457!:mime image/vnd.dwg 74580 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 7459!:mime image/vnd.dwg 74600 string AC1027 DWG AutoDesk AutoCAD 2013-2017 7461!:mime image/vnd.dwg 7462 7463# From GNU LibreDWG 74640 string AC1032 DWG AutoDesk AutoCAD 2018/2019/2020 7465!:mime image/vnd.dwg 74660 string AC1035 DWG AutoDesk AutoCAD 2021 7467!:mime image/vnd.dwg 7468 7469# KOMPAS 2D drawing from ASCON 7470# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 7471# gathered nor specification 7472# ASCON https://ascon.net/main/ in English, 7473# https://ascon.ru/ main site in Russian 7474# Extension is CDW for drawing and FRW for fragment of drawing 7475# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 7476# ICQ 358572321, https://vkontakte.ru/id16076543) 7477# From: 7478# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 7479# (in russian) and my experiments 74800 string KF 7481>2 belong 0x4E00000C Kompas drawing 12.0 SP1 7482>2 belong 0x4D00000C Kompas drawing 12.0 7483>2 belong 0x3200000B Kompas drawing 11.0 SP1 7484>2 belong 0x3100000B Kompas drawing 11.0 7485>2 belong 0x2310000A Kompas drawing 10.0 SP1 7486>2 belong 0x2110000A Kompas drawing 10.0 7487>2 belong 0x08000009 Kompas drawing 9.0 SP1 7488>2 belong 0x05000009 Kompas drawing 9.0 7489>2 belong 0x33010008 Kompas drawing 8+ 7490>2 belong 0x1A000008 Kompas drawing 8.0 7491>2 belong 0x2C010107 Kompas drawing 7+ 7492>2 belong 0x05000007 Kompas drawing 7.0 7493>2 belong 0x32000006 Kompas drawing 6+ 7494>2 belong 0x09000006 Kompas drawing 6.0 7495>2 belong 0x5C009005 Kompas drawing 5.11R03 7496>2 belong 0x54009005 Kompas drawing 5.11R02 7497>2 belong 0x51009005 Kompas drawing 5.11R01 7498>2 belong 0x22009005 Kompas drawing 5.10R03 7499>2 belong 0x22009005 Kompas drawing 5.10R02 mar 7500>2 belong 0x21009005 Kompas drawing 5.10R02 febr 7501>2 belong 0x19009005 Kompas drawing 5.10R01 7502>2 belong 0xF4008005 Kompas drawing 5.9R01.003 7503>2 belong 0x1C008005 Kompas drawing 5.9R01.002 7504>2 belong 0x11008005 Kompas drawing 5.8R01.003 7505 7506# CAD: file(1) magic for computer aided design files 7507# Phillip Griffith <phillip dot griffith at gmail dot com> 7508# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 7509# 7510 7511# 3DS (3d Studio files) 75120 leshort 0x4d4d 7513>6 leshort 0x2 7514>>8 lelong 0xa 7515>>>16 leshort 0x3d3d 3D Studio model 7516# Beat sgi MMV 7517!:strength +20 7518!:mime image/x-3ds 7519!:ext 3ds 7520 7521# MegaCAD 2D/3D drawing (.prt) 7522# https://megacad.de/ 7523# From: Markus Heidelberg <markus.heidelberg@web.de> 75240 string MegaCad23\0 MegaCAD 2D/3D drawing 7525 7526# Hoops CAD files 7527# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\ 7528# HSF_architecture.html 7529# Stephane Charette <stephane.charette@gmail.com> 75300 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) 7531>7 regex/9 V[.0-9]{4,5}\020 %s 7532!:ext hsf 7533 7534# AutoCAD Drawing Exchange Format 75350 regex \^[\ \t]*0\r?\000$ 7536>1 regex \^[\ \t]*SECTION\r?$ 7537>>2 regex \^[\ \t]*2\r?$ 7538>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format 7539!:mime application/x-dxf 7540!:ext dxf 7541>>>>&1 search/8192 AC1006 \b, R10 7542>>>>&1 search/8192 AC1009 \b, R11/R12 7543>>>>&1 search/8192 AC1012 \b, R13 7544>>>>&1 search/8192 AC1013 \b, R13c3 7545>>>>&1 search/8192 AC1014 \b, R14 7546>>>>&1 search/8192 AC1015 \b, version 2000 7547>>>>&1 search/8192 AC1018 \b, version 2004 7548>>>>&1 search/8192 AC1021 \b, version 2007 7549>>>>&1 search/8192 AC1024 \b, version 2010 7550>>>>&1 search/8192 AC1027 \b, version 2013 7551>>>>&1 search/8192 AC1032 \b, version 2018 7552>>>>&1 search/8192 AC1035 \b, version 2021 7553 7554# The Sketchup 3D model format https://www.sketchup.com/ 75550 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model 7556!:mime application/vnd.sketchup.skp 7557!:ext skp 7558 75594 regex/b P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9] NAXOS CAD System file from version %s 7560!:strength +40 7561 7562# glTF (GL Transmission Format) - by the Khronos Group 7563# Reference: https://github.com/KhronosGroup/glTF/tree/master/specification/2.0#glb-file-format-specification 75640 string glTF glTF binary model 7565>4 ulelong x \b, version %d 7566>8 ulelong x \b, length %d bytes 7567!:mime model/gltf-binary 7568!:ext glb 7569 7570# FBX (FilmBoX) - by Kaydara/Autodesk 7571# Reference: https://code.blender.org/2013/08/fbx-binary-file-format-specification 75720 string Kaydara\ FBX\ Binary\ \ \0 Kaydara FBX model, 7573>&2 ulelong x version %d 7574!:ext fbx 7575 7576# PLY (Polygon File Format/Stanford Triangle Format) - by Greg Turk 7577# Reference: https://web.archive.org/web/20161204152348/http://www.dcs.ed.ac.uk/teaching/cs4/www/graphics/Web/ply.html 75780 string ply\n PLY model, 7579!:ext ply 7580>4 string format\ ascii\ ASCII, 7581>>&0 regex/6 [0-9.]+ version %s 7582>4 string format\ binary binary, 7583>>&0 string _little_endian\ little endian, 7584>>>&0 regex/6 [0-9.]+ version %s 7585>>&0 string _big_endian\ big endian, 7586>>>&0 regex/6 [0-9.]+ version %s 7587 7588# VRML (Virtual Reality Modeling Language) - by the Web3D Consortium 7589# From: Michel Briand <michelbriand@free.fr> 7590# Reference: https://www.web3d.org/standards 75910 string/w #VRML\ V1.0\ ascii VRML 1 file 7592!:mime model/vrml 7593!:ext wrl 75940 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 7595!:mime model/vrml 7596!:ext wrl 7597# X3D, VRML encoded 75980 string #X3D X3D (Extensible 3D) model, VRML format 7599>4 string V 7600>>5 regex/6 [0-9.]+ \b, version %s 7601!:mime model/x3d+vrml 7602!:ext x3dv 7603 7604## XML-based 3D CAD Formats 7605# From: Michel Briand <michelbriand@free.fr>, Oliver Galvin <odg@riseup.net> 76060 string/w \<?xml\ version= 7607!:strength + 5 7608# X3D (Extensible 3D) 7609# Schema: https://www.web3d.org/specifications/x3d-3.2.dtd 7610# MIME Type: https://www.iana.org/assignments/media-types/model/x3d+xml 7611# Example: https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 7612>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model, XML document 7613!:mime model/x3d+xml 7614!:ext x3d 7615# COLLADA (COLLAborative Design Activity) - by the Khronos Group 7616# Schema: http://www.collada.org/2005/11/COLLADASchema 7617# Reference: https://www.khronos.org/collada 7618>20 search/1000/w \<COLLADA COLLADA model, XML document 7619!:mime model/vnd.collada+xml 7620!:ext dae 7621# 3MF (3D Manufacturing Format) - by the 3MF Consortium 7622# Schema: http://schemas.microsoft.com/3dmanufacturing/core/2015/02 7623# Reference: https://3mf.io/specification 7624>20 search/1000/w xmlns="http://schemas.microsoft.com/3dmanufacturing 3MF (3D Manufacturing Format) model, XML document 7625!:mime model/3mf 7626!:ext 3mf 7627# AMF (Additive Manufacturing File) 7628# Reference: https://www.astm.org/Standards/ISOASTM52915.htm 7629>20 search/1000/w \<amf AMF (Additive Manufacturing Format) model, XML document 7630!:mime application/x-amf 7631!:ext amf 7632 7633#------------------------------------------------------------------------------ 7634# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $ 7635# Cafe Babes unite! 7636# 7637# Since Java bytecode and Mach-O universal binaries have the same magic number, 7638# the test must be performed in the same "magic" sequence to get both right. 7639# The long at offset 4 in a Mach-O universal binary tells the number of 7640# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 7641# version and the short at offset 6 is the JVM major version. Since there are only 7642# only 18 labeled Mach-O architectures at current, and the first released 7643# Java class format was version 43.0, we can safely choose any number 7644# between 18 and 39 to test the number of architectures against 7645# (and use as a hack). Let's not use 18, because the Mach-O people 7646# might add another one or two as time goes by... 7647# 7648### JAVA START ### 7649# Reference: http://en.wikipedia.org/wiki/Java_class_file 7650# Update: Joerg Jenderek 76510 belong 0xcafebabe 7652>4 ubelong >30 compiled Java class data, 7653!:mime application/x-java-applet 7654#!:mime application/java-byte-code 7655!:ext class 7656>>6 ubeshort x version %d. 7657>>4 ubeshort x \b%d 7658# for debugging purpose version as hexadecimal to compare with Mach-O universal binary 7659#>>4 ubelong x (%#8.8x) 7660# Which is which? 7661# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html 7662#>>4 belong 0x002b (Java 0.?) 7663#>>4 belong 0x032d (Java 1.0) 7664#>>4 belong 0x032d (Java 1.1) 7665>>4 belong 0x002e (Java 1.2) 7666>>4 belong 0x002f (Java 1.3) 7667>>4 belong 0x0030 (Java 1.4) 7668>>4 belong 0x0031 (Java 1.5) 7669>>4 belong 0x0032 (Java 1.6) 7670>>4 belong 0x0033 (Java 1.7) 7671>>4 belong 0x0034 (Java 1.8) 7672>>4 belong 0x0035 (Java SE 9) 7673>>4 belong 0x0036 (Java SE 10) 7674>>4 belong 0x0037 (Java SE 11) 7675>>4 belong 0x0038 (Java SE 12) 7676>>4 belong 0x0039 (Java SE 13) 7677>>4 belong 0x003A (Java SE 14) 7678>>4 belong 0x003B (Java SE 15) 7679>>4 belong 0x003C (Java SE 16) 7680>>4 belong 0x003D (Java SE 17) 7681>>4 belong 0x003E (Java SE 18) 7682>>4 belong 0x003F (Java SE 19) 7683>>4 belong 0x0040 (Java SE 20) 7684# pool count unequal zero 7685#>>8 beshort x \b, pool count %#x 7686# pool table 7687#>>10 ubequad x \b, pool %#16.16llx... 7688 76890 belong 0xcafed00d JAR compressed with pack200, 7690>5 byte x version %d. 7691>4 byte x \b%d 7692!:mime application/x-java-pack200 7693 7694 76950 belong 0xcafed00d JAR compressed with pack200, 7696>5 byte x version %d. 7697>4 byte x \b%d 7698!:mime application/x-java-pack200 7699 7700### JAVA END ### 7701### MACH-O START ### 7702# URL: https://en.wikipedia.org/wiki/Mach-O 7703 77040 name mach-o \b [ 7705# for debugging purpose CPU type as hexadecimal 7706#>0 ubequad x CPU=%16.16llx 7707# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 7708>0 use mach-o-cpu \b 7709# for debugging purpose print offset to 1st mach_header like: 7710# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h 7711#>8 ubelong x at %#x offset 7712>(8.L) indirect x \b: 7713>0 belong x \b] 7714 7715# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 7716# include/mach-o/fat.h 7717# include/mach/machine.h 77180 belong 0xcafebabe 7719>4 belong 1 Mach-O universal binary with 1 architecture: 7720!:mime application/x-mach-binary 7721>>8 use mach-o \b 7722# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020 7723>4 ubelong >1 7724>>4 ubelong <20 Mach-O universal binary with %d architectures: 7725!:mime application/x-mach-binary 7726>>>8 use mach-o \b 7727>>>4 ubelong >1 7728>>>>28 use mach-o \b 7729>>>4 ubelong >2 7730>>>>48 use mach-o \b 7731>>>4 ubelong >3 7732>>>>68 use mach-o \b 7733>>>4 ubelong >4 7734>>>>88 use mach-o \b 7735>>>4 ubelong >5 7736>>>>108 use mach-o \b 7737 7738### MACH-O END ### 7739 7740#------------------------------------------------------------------------------ 7741# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $ 7742# cbor: file(1) magic for CBOR files as defined in RFC 7049 7743 77440 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 7745!:mime application/cbor 7746>3 ubyte <0x20 (positive integer) 7747>3 ubyte <0x40 7748>>3 ubyte >0x1f (negative integer) 7749>3 ubyte <0x60 7750>>3 ubyte >0x3f (byte string) 7751>3 ubyte <0x80 7752>>3 ubyte >0x5f (text string) 7753>3 ubyte <0xa0 7754>3 ubyte >0x7f (array) 7755>3 ubyte <0xc0 7756>>3 ubyte >0x9f (map) 7757>3 ubyte <0xe0 7758>>3 ubyte >0xbf (tagged) 7759>3 ubyte >0xdf (other) 7760 7761#------------------------------------------------------------------------------ 7762# $File: ccf,v 1.1 2022/02/15 12:57:45 christos Exp $ 7763# file(1) magic(5) data for Phillips remote controls 7764 7765# Exchange format for Philips Pronto universal infrared remote controls 7766# A CCF file describes a learned/customized remote control, 7767# i.e. it contains button UI and infrared pulse code definitions 7768# (Georg Sauthoff) 7769# http://files.remotecentral.com/download/45/pan-air-csakr.zip.html 7770# https://github.com/gsauthof/pronto-ccf/blob/ 7771 77728 string @\xa5Z@_CCF 7773>32 string CCF\x00 Philips Pronto IR remote control CCF 7774 7775#------------------------------------------------------------------------------ 7776# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 7777# CDDB: file(1) magic for CDDB(tm) format CD text data files 7778# 7779# From <steve@gracenote.com> 7780# 7781# This is the /etc/magic entry to decode datafiles as used by 7782# CDDB-enabled CD player applications. 7783# 7784 77850 search/1/w #\040xmcd CDDB(tm) format CD text data 7786 7787#------------------------------------------------------------------------------ 7788# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 7789# chord: file(1) magic for Chord music sheet typesetting utility input files 7790# 7791# From Philippe De Muyter <phdm@macqel.be> 7792# File format is actually free, but many distributed files begin with `{title' 7793# 77940 string {title Chord text file 7795 7796# Type: PowerTab file format 7797# URL: http://www.power-tab.net/ 7798# From: Jelmer Vernooij <jelmer@samba.org> 77990 string ptab\003\000 Power-Tab v3 Tablature File 78000 string ptab\004\000 Power-Tab v4 Tablature File 7801 7802#------------------------------------------------------------------------------ 7803# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 7804# cisco: file(1) magic for cisco Systems routers 7805# 7806# Most cisco file-formats are covered by the generic elf code 7807# 7808# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 78090 belong&0xffffff00 0x85011400 cisco IOS microcode 7810>7 string >\0 for '%s' 78110 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 7812>7 string >\0 for '%s' 7813 7814#------------------------------------------------------------------------------ 7815# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $ 7816# citrus locale declaration 7817# 7818 78190 string RuneCT Citrus locale declaration for LC_CTYPE 78200 string CtrsME Citrus locale declaration for LC_MESSAGES 78210 string CtrsMO Citrus locale declaration for LC_MONETARY 78220 string CtrsNU Citrus locale declaration for LC_NUMERIC 78230 string CtrsTI Citrus locale declaration for LC_TIME 7824 7825#------------------------------------------------------------------------------ 7826# $File: c-lang,v 1.30 2021/08/16 10:17:05 christos Exp $ 7827# c-lang: file(1) magic for C and related languages programs 7828# 7829# The strength is to beat standard HTML 7830 7831# BCPL 78320 search/8192 "libhdr" BCPL source text 7833!:mime text/x-bcpl 78340 search/8192 "LIBHDR" BCPL source text 7835!:mime text/x-bcpl 7836 7837# C 7838# Check for class if include is found, otherwise class is beaten by include because of lowered strength 78390 search/8192 #include 7840>0 regex \^#include C 7841>>0 regex \^class[[:space:]]+ 7842>>>&0 regex \\{[\.\*]\\}(;)?$ \b++ 7843>>&0 clear x source text 7844!:strength + 13 7845!:mime text/x-c 78460 search/8192 pragma 7847>0 regex \^#[[:space:]]*pragma C source text 7848!:mime text/x-c 78490 search/8192 endif 7850>0 regex \^#[[:space:]]*(if\|ifn)def 7851>>&0 regex \^#[[:space:]]*endif$ C source text 7852!:mime text/x-c 78530 search/8192 define 7854>0 regex \^#[[:space:]]*(if\|ifn)def 7855>>&0 regex \^#[[:space:]]*define C source text 7856!:mime text/x-c 78570 search/8192 char 7858>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 7859!:mime text/x-c 78600 search/8192 double 7861>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 7862!:mime text/x-c 78630 search/8192 extern 7864>0 regex \^[[:space:]]*extern[[:space:]]+ C source text 7865!:mime text/x-c 78660 search/8192 float 7867>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 7868!:mime text/x-c 78690 search/8192 struct 7870>0 regex \^struct[[:space:]]+ C source text 7871!:mime text/x-c 78720 search/8192 union 7873>0 regex \^union[[:space:]]+ C source text 7874!:mime text/x-c 78750 search/8192 main( 7876>&0 search/64 String Java source text 7877!:mime text/x-java 7878>&0 default x 7879>>&0 regex \\)[[:space:]]*\\{ C source text 7880!:mime text/x-c 7881 7882# C++ 7883# The strength of these rules is increased so they beat the C rules above 78840 search/8192 namespace 7885>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text 7886!:strength + 30 7887!:mime text/x-c++ 7888# using namespace [namespace] or using std::[lib] 78890 search/8192 using 7890>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text 7891!:strength + 30 7892!:mime text/x-c++ 78930 search/8192 template 7894>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text 7895!:strength + 30 7896!:mime text/x-c++ 78970 search/8192 virtual 7898>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text 7899!:strength + 30 7900!:mime text/x-c++ 7901# But class alone is reduced to avoid beating php (Jens Schleusener) 79020 search/8192 class 7903>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text 7904!:strength + 13 7905!:mime text/x-c++ 79060 search/8192 public 7907>0 regex \^[[:space:]]*public: C++ source text 7908!:strength + 30 7909!:mime text/x-c++ 79100 search/8192 private 7911>0 regex \^[[:space:]]*private: C++ source text 7912!:strength + 30 7913!:mime text/x-c++ 79140 search/8192 protected 7915>0 regex \^[[:space:]]*protected: C++ source text 7916!:strength + 30 7917!:mime text/x-c++ 7918 7919# Objective-C 79200 search/8192 #import 7921>0 regex \^#import Objective-C source text 7922!:strength + 25 7923!:mime text/x-objective-c 7924 7925# From: Mikhail Teterin <mi@aldan.algebra.com> 79260 string cscope cscope reference data 7927>7 string x version %.2s 7928# We skip the path here, because it is often long (so file will 7929# truncate it) and mostly redundant. 7930# The inverted index functionality was added some time between 7931# versions 11 and 15, so look for -q if version is above 14: 7932>7 string >14 7933>>10 search/100 \ -q\ with inverted index 7934>10 search/100 \ -c\ text (non-compressed) 7935 7936#------------------------------------------------------------------------------ 7937# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $ 7938# clarion: file(1) magic for # Clarion Personal/Professional Developer 7939# (v2 and above) 7940# From: Julien Blache <jb@jblache.org> 7941 7942# Database files 7943# signature 79440 leshort 0x3343 Clarion Developer (v2 and above) data file 7945# attributes 7946>2 leshort &0x0001 \b, locked 7947>2 leshort &0x0004 \b, encrypted 7948>2 leshort &0x0008 \b, memo file exists 7949>2 leshort &0x0010 \b, compressed 7950>2 leshort &0x0040 \b, read only 7951# number of records 7952>5 lelong x \b, %d records 7953 7954# Memo files 79550 leshort 0x334d Clarion Developer (v2 and above) memo data 7956 7957# Key/Index files 7958# No magic? :( 7959 7960# Help files 79610 leshort 0x49e0 Clarion Developer (v2 and above) help data 7962 7963#------------------------------------------------------------------------------ 7964# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $ 7965# claris: file(1) magic for claris 7966# "H. Nanosecond" <aldomel@ix.netcom.com> 7967# Claris Works a word processor, etc. 7968# Version 3.0 7969 7970# .pct claris works clip art files 7971#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 7972#* 7973#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 7974#null to byte 1000 octal 7975514 string \377\377\377\377\000 7976>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 7977514 string \377\377\377\377\001 7978>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 7979 7980# Claris works files 7981# .cwk 7982# Moved to Apple AppleWorks document 7983#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 7984# .plt 79850 string \020\341\000\000\010\010 Claris Works palette files .plt 7986 7987# .msp a dictionary file I am not sure about this I have only one .msp file 79880 string \002\271\262\000\040\002\000\164 Claris works dictionary 7989 7990# .usp are user dictionary bits 7991# I am not sure about a magic header: 7992#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 7993# soh S p f 8 U D sp ^ S cr nl p o d i 7994#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 7995# a t r i s t sp ^ S cr nl d i v sp # 7996 7997# .mth Thesaurus 7998# starts with \0 but no magic header 7999 8000# .chy Hyphenation file 8001# I am not sure: 000 210 034 000 000 8002 8003# other claris files 8004#./windows/claris/useng.ndx: data 8005#./windows/claris/xtndtran.l32: data 8006#./windows/claris/xtndtran.lst: data 8007#./windows/claris/clworks.lbl: data 8008#./windows/claris/clworks.prf: data 8009#./windows/claris/userd.spl: data 8010 8011#------------------------------------------------------------------------------ 8012# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $ 8013# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 8014# 8015# XXX - what byte order does the Clipper use? 8016# 8017# XXX - what's the "!" stuff: 8018# 8019# >18 short !074000,000000 C1 R1 8020# >18 short !074000,004000 C2 R1 8021# >18 short !074000,010000 C3 R1 8022# >18 short !074000,074000 TEST 8023# 8024# I shall assume it's ANDing the field with the first value and 8025# comparing it with the second, and rewrite it as: 8026# 8027# >18 short&074000 000000 C1 R1 8028# >18 short&074000 004000 C2 R1 8029# >18 short&074000 010000 C3 R1 8030# >18 short&074000 074000 TEST 8031# 8032# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 8033# sort, nor does SunOS 4.x, so either it's something Intergraph added 8034# in CLIX, or something AT&T added in SVR3.2 or later, or something 8035# somebody else thought was a good idea; it's not documented in the 8036# man page for this version of "magic", nor does it appear to be 8037# implemented (at least not after I blew off the bogus code to turn 8038# old-style "&"s into new-style "&"s, which just didn't work at all). 8039# 80400 short 0575 CLIPPER COFF executable (VAX #) 8041>20 short 0407 (impure) 8042>20 short 0410 (5.2 compatible) 8043>20 short 0411 (pure) 8044>20 short 0413 (demand paged) 8045>20 short 0443 (target shared library) 8046>12 long >0 not stripped 8047>22 short >0 - version %d 80480 short 0577 CLIPPER COFF executable 8049>18 short&074000 000000 C1 R1 8050>18 short&074000 004000 C2 R1 8051>18 short&074000 010000 C3 R1 8052>18 short&074000 074000 TEST 8053>20 short 0407 (impure) 8054>20 short 0410 (pure) 8055>20 short 0411 (separate I&D) 8056>20 short 0413 (paged) 8057>20 short 0443 (target shared library) 8058>12 long >0 not stripped 8059>22 short >0 - version %d 8060>48 long&01 01 alignment trap enabled 8061>52 byte 1 -Ctnc 8062>52 byte 2 -Ctsw 8063>52 byte 3 -Ctpw 8064>52 byte 4 -Ctcb 8065>53 byte 1 -Cdnc 8066>53 byte 2 -Cdsw 8067>53 byte 3 -Cdpw 8068>53 byte 4 -Cdcb 8069>54 byte 1 -Csnc 8070>54 byte 2 -Cssw 8071>54 byte 3 -Cspw 8072>54 byte 4 -Cscb 8073#4 string pipe CLIPPER instruction trace 8074#4 string prof CLIPPER instruction profile 8075#------------------------------------------------------------------------------ 8076# file: file(1) magic for Clojure 8077# URL: https://clojure.org/ 8078# From: Jason Felice <jason.m.felice@gmail.com> 8079 80800 string/w #!\ /usr/bin/clj Clojure script text executable 8081!:mime text/x-clojure 80820 string/w #!\ /usr/local/bin/clj Clojure script text executable 8083!:mime text/x-clojure 80840 string/w #!\ /usr/bin/clojure Clojure script text executable 8085!:mime text/x-clojure 80860 string/w #!\ /usr/local/bin/clojure Clojure script text executable 8087!:mime text/x-clojure 80880 string/W #!/usr/bin/env\ clj Clojure script text executable 8089!:mime text/x-clojure 80900 string/W #!/usr/bin/env\ clojure Clojure script text executable 8091!:mime text/x-clojure 80920 string/W #!\ /usr/bin/env\ clj Clojure script text executable 8093!:mime text/x-clojure 80940 string/W #!\ /usr/bin/env\ clojure Clojure script text executable 8095!:mime text/x-clojure 8096 80970 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text 8098!:mime text/x-clojure 8099 81000 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text 8101!:mime text/x-clojure 8102 81030 regex \^\\\(defn-?[[:space:]] Clojure module source text 8104!:mime text/x-clojure 8105 8106#------------------------------------------------------------------------------ 8107# $File: coff,v 1.6 2021/04/26 15:56:00 christos Exp $ 8108# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 8109# 8110# COFF 8111# 8112# by Joerg Jenderek at Oct 2015, Feb 2021 8113# https://en.wikipedia.org/wiki/COFF 8114# https://de.wikipedia.org/wiki/Common_Object_File_Format 8115# http://www.delorie.com/djgpp/doc/coff/filhdr.html 8116 8117# display name+variables+flags of Common Object Files Format (32bit) 8118# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 8119# mips,motorola,msdos,osf1,sharc,varied.out,vax 81200 name display-coff 8121# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 8122>18 uleshort&0x8E80 0 8123# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections 8124>>2 uleshort >0 8125# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections 8126>>>2 uleshort <4207 8127>>>>0 clear x 8128# f_magic - magic number 8129# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 8130>>>>0 uleshort 0x014C Intel 80386 8131# Hitachi SH big-endian COFF (./hitachi-sh) 8132>>>>0 uleshort 0x0500 Hitachi SH big-endian 8133# Hitachi SH little-endian COFF (./hitachi-sh) 8134>>>>0 uleshort 0x0550 Hitachi SH little-endian 8135# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 8136#>>>>0 uleshort 0x01DF 8137# MS Windows COFF Intel Itanium, AMD64 8138# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx 8139>>>>0 uleshort 0x0200 Intel ia64 8140>>>>0 uleshort 0x8664 Intel amd64 8141# ARM COFF (./arm) 8142>>>>0 uleshort 0xaa64 Aarch64 8143>>>>0 uleshort 0x01c0 ARM 8144>>>>0 uleshort 0x01c2 ARM Thumb 8145>>>>0 uleshort 0x01c4 ARMv7 Thumb 8146# TODO for other COFFs 8147#>>>>0 uleshort 0xABCD COFF_TEMPLATE 8148>>>>0 default x 8149>>>>>0 uleshort x type %#04x 8150>>>>0 uleshort x COFF 8151# F_EXEC flag bit 8152>>>>18 leshort ^0x0002 object file 8153!:mime application/x-coff 8154!:ext o/obj/lib 8155# no cof sample found 8156#!:ext cof/o/obj/lib 8157>>>>18 leshort &0x0002 executable 8158#!:mime application/x-coffexec 8159# F_RELFLG flag bit,static object 8160>>>>18 leshort &0x0001 \b, no relocation info 8161# F_LNNO flag bit 8162>>>>18 leshort &0x0004 \b, no line number info 8163# F_LSYMS flag bit 8164>>>>18 leshort &0x0008 \b, stripped 8165>>>>18 leshort ^0x0008 \b, not stripped 8166# flags in other COFF versions 8167#0x0010 F_FDPR_PROF 8168#0x0020 F_FDPR_OPTI 8169#0x0040 F_DSA 8170# F_AR32WR flag bit 8171#>>>>18 leshort &0x0100 \b, 32 bit little endian 8172#0x1000 F_DYNLOAD 8173#0x2000 F_SHROBJ 8174#0x4000 F_LOADONLY 8175# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124 8176>>>>2 uleshort <2 \b, %u section 8177>>>>2 uleshort >1 \b, %u sections 8178# f_symptr - symbol table pointer, only for not stripped 8179# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0 8180>>>>8 ulelong >0 \b, symbol offset=%#x 8181# f_nsyms - number of symbols, only for not stripped 8182# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546 8183>>>>12 ulelong >0 \b, %d symbols 8184# f_opthdr - optional header size. An object file should have a value of 0 8185>>>>16 uleshort >0 \b, optional header size %u 8186# f_timdat - file time & date stamp only for little endian 8187>>>>4 ledate >0 \b, created %s 8188# at offset 20 can be optional header, extra bytes FILHSZ-20 because 8189# do not rely on sizeof(FILHDR) to give the correct size for header. 8190# or first section header 8191# additional variables for other COFF files 8192>>>>16 uleshort =0 8193# first section name s_name[8] like: .text .data .debug$S .drectve .testseg 8194>>>>>20 string x \b, 1st section name "%.8s" 8195# >20 beshort 0407 (impure) 8196# >20 beshort 0410 (pure) 8197# >20 beshort 0413 (demand paged) 8198# >20 beshort 0421 (standalone) 8199# >22 leshort >0 - version %d 8200# >168 string .lowmem Apple toolbox 8201 8202 8203#------------------------------------------------------------------------------ 8204# $File: commands,v 1.69 2022/04/20 21:14:23 christos Exp $ 8205# commands: file(1) magic for various shells and interpreters 8206# 8207#0 string/w : shell archive or script for antique kernel text 82080 string/fwt #!\ /bin/sh POSIX shell script text executable 8209!:mime text/x-shellscript 82100 string/fwb #!\ /bin/sh POSIX shell script executable (binary data) 8211!:mime text/x-shellscript 8212 82130 string/fwt #!\ /bin/csh C shell script text executable 8214!:mime text/x-shellscript 8215 8216# korn shell magic, sent by George Wu, gwu@clyde.att.com 82170 string/fwt #!\ /bin/ksh Korn shell script text executable 8218!:mime text/x-shellscript 82190 string/fwb #!\ /bin/ksh Korn shell script executable (binary data) 8220!:mime text/x-shellscript 8221 82220 string/fwt #!\ /bin/tcsh Tenex C shell script text executable 8223!:mime text/x-shellscript 82240 string/fwt #!\ /usr/bin/tcsh Tenex C shell script text executable 8225!:mime text/x-shellscript 82260 string/fwt #!\ /usr/local/tcsh Tenex C shell script text executable 8227!:mime text/x-shellscript 82280 string/fwt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 8229!:mime text/x-shellscript 8230 8231# 8232# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 82330 string/fwt #!\ /bin/zsh Paul Falstad's zsh script text executable 8234!:mime text/x-shellscript 82350 string/fwt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 8236!:mime text/x-shellscript 82370 string/fwt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 8238!:mime text/x-shellscript 82390 string/fwt #!\ /usr/bin/env\ zsh Paul Falstad's zsh script text executable 8240!:mime text/x-shellscript 8241 82420 string/fwt #!\ /bin/ash Neil Brown's ash script text executable 8243!:mime text/x-shellscript 82440 string/fwt #!\ /usr/bin/ash Neil Brown's ash script text executable 8245!:mime text/x-shellscript 82460 string/fwt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 8247!:mime text/x-shellscript 82480 string/fwt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 8249!:mime text/x-shellscript 82500 string/fwt #!\ /bin/nawk new awk script text executable 8251!:mime text/x-nawk 82520 string/fwt #!\ /usr/bin/nawk new awk script text executable 8253!:mime text/x-nawk 82540 string/fwt #!\ /usr/local/bin/nawk new awk script text executable 8255!:mime text/x-nawk 82560 string/fwt #!\ /bin/gawk GNU awk script text executable 8257!:mime text/x-gawk 82580 string/wt #!\ /usr/bin/gawk GNU awk script text executable 8259!:mime text/x-gawk 82600 string/fwt #!\ /usr/local/bin/gawk GNU awk script text executable 8261!:mime text/x-gawk 8262# 82630 string/fwt #!\ /bin/awk awk script text executable 8264!:mime text/x-awk 82650 string/fwt #!\ /usr/bin/awk awk script text executable 8266!:mime text/x-awk 82670 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text 8268 8269# AT&T Bell Labs' Plan 9 shell 82700 string/fwt #!\ /bin/rc Plan 9 rc shell script text executable 8271 8272# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 82730 string/fwt #!\ /bin/bash Bourne-Again shell script text executable 8274!:mime text/x-shellscript 82750 string/fwb #!\ /bin/bash Bourne-Again shell script executable (binary data) 8276!:mime text/x-shellscript 82770 string/fwt #!\ /usr/bin/bash Bourne-Again shell script text executable 8278!:mime text/x-shellscript 82790 string/fwb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 8280!:mime text/x-shellscript 82810 string/fwt #!\ /usr/local/bash Bourne-Again shell script text executable 8282!:mime text/x-shellscript 82830 string/fwb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 8284!:mime text/x-shellscript 82850 string/fwt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 8286!:mime text/x-shellscript 82870 string/fwb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 8288!:mime text/x-shellscript 82890 string/fwt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable 8290!:mime text/x-shellscript 8291 8292# Fish shell magic 8293# From: Benjamin Lowry <ben@ben.gmbh> 82940 string/fwt #!\ /usr/local/bin/fish fish shell script text executable 8295!:mime text/x-shellscript 82960 string/fwt #!\ /usr/bin/fish fish shell script text executable 8297!:mime text/x-shellscript 82980 string/fwt #!\ /usr/bin/env\ fish fish shell script text executable 8299!:mime text/x-shellscript 8300 83010 string/wt #!\ a 8302>&-1 string/T x %s script text executable 8303 83040 search/1/fwt #!\ /usr/bin/tclsh Tcl/Tk script text executable 8305!:mime text/x-tcl 8306 83070 search/1/fwt #!\ /usr/bin/texlua LuaTex script text executable 8308!:mime text/x-luatex 8309 83100 search/1/fwt #!\ /usr/bin/luatex LuaTex script text executable 8311!:mime text/x-luatex 8312 83130 search/1/fwt #!\ /usr/bin/stap Systemtap script text executable 8314!:mime text/x-systemtap 8315 8316# From: Kylie McClain <kylie@somas.is> 8317# Type: execline scripts 8318# URL: https://skarnet.org/software/execline/ 83190 string/fwt #!\ /command/execlineb execline script text executable 8320!:mime text/x-execline 83210 string/fwt #!\ /bin/execlineb execline script text executable 8322!:mime text/x-execline 83230 string/fwt #!\ /usr/bin/execlineb execline script text executable 8324!:mime text/x-execline 83250 string/fwt #!\ /usr/bin/env\ execlineb execline script text executable 8326!:mime text/x-execline 8327 83280 string #! 8329>0 regex \^#!.*/bin/execlineb([[:space:]].*)*$ execline script text executable 8330!:mime text/x-execline 8331 8332# PHP scripts 8333# Ulf Harnhammar <ulfh@update.uu.se> 83340 search/1/c =<?php PHP script text 8335!:strength + 30 8336!:mime text/x-php 83370 search/1 =<?\n PHP script text 8338!:mime text/x-php 83390 search/1 =<?\r PHP script text 8340!:mime text/x-php 83410 search/1/w #!\ /usr/local/bin/php PHP script text executable 8342!:strength + 10 8343!:mime text/x-php 83440 search/1/w #!\ /usr/bin/php PHP script text executable 8345!:strength + 10 8346!:mime text/x-php 8347# Smarty compiled template, https://www.smarty.net/ 8348# Elan Ruusamae <glen@delfi.ee> 83490 string =<?php 8350>5 regex [\ \n] 8351>>6 string /*\ Smarty\ version Smarty compiled template 8352>>>24 regex [0-9.]+ \b, version %s 8353!:mime text/x-php 8354 83550 string Zend\x00 PHP script Zend Optimizer data 8356 8357# From: Anatol Belski <ab@php.net> 83580 string OPCACHE 8359>7 ubyte 0 PHP opcache filecache data 8360 83610 search/64 --TEST-- 8362>16 search/64 --FILE-- 8363>24 search/8192 --EXPECT PHP core test 8364!:ext phpt 8365 8366# https://www.php.net/manual/en/phar.fileformat.signature.php 8367-4 string GBMB PHP phar archive 8368>-8 ubyte 0x1 with MD5 signature 8369!:ext phar 8370>-8 ubyte 0x2 with SHA1 signature 8371!:ext phar 8372>-8 ubyte 0x3 with SHA256 signature 8373!:ext phar 8374>-8 ubyte 0x4 with SHA512 signature 8375!:ext phar 8376>-8 ubyte 0x10 with OpenSSL signature 8377!:ext phar 8378>-8 ubyte 0x11 with OpenSSL SHA256 signature 8379!:ext phar 8380>-8 ubyte 0x12 with OpenSSL SHA512 signature 8381!:ext phar 8382 83830 string/t $! DCL command file 8384 8385# Type: Pdmenu 8386# URL: https://packages.debian.org/pdmenu 8387# From: Edward Betts <edward@debian.org> 83880 string #!/usr/bin/pdmenu Pdmenu configuration file text 8389 8390# From Danny Weldon 83910 string \x0b\x13\x08\x00 8392>0x04 uleshort <4 ksh byte-code version %d 8393 8394#---------------------------------------------------------------------------- 8395# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 8396# communication 8397 8398# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 8399# It is used for conformance testing of communication protocols. 8400# Added by W. Borgert <debacle@debian.org>. 84010 string $Suite TTCN Abstract Test Suite 8402>&1 string $SuiteId 8403>>&1 string >\n %s 8404>&2 string $SuiteId 8405>>&1 string >\n %s 8406>&3 string $SuiteId 8407>>&1 string >\n %s 8408 8409# MSC (message sequence charts) are a formal description technique, 8410# described in ITU-T Z.120, mainly used for communication protocols. 8411# Added by W. Borgert <debacle@debian.org>. 84120 string mscdocument Message Sequence Chart (document) 84130 string msc Message Sequence Chart (chart) 84140 string submsc Message Sequence Chart (subchart) 8415#------------------------------------------------------------------------------ 8416# $File: compress,v 1.83 2022/08/16 11:16:39 christos Exp $ 8417# compress: file(1) magic for pure-compression formats (no archives) 8418# 8419# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 8420# 8421# Formats for various forms of compressed data 8422# Formats for "compress" proper have been moved into "compress.c", 8423# because it tries to uncompress it to figure out what's inside. 8424 8425# standard unix compress 84260 string \037\235 compress'd data 8427!:mime application/x-compress 8428!:apple LZIVZIVU 8429>2 byte&0x80 >0 block compressed 8430>2 byte&0x1f x %d bits 8431 8432# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 8433# URL: https://en.wikipedia.org/wiki/Gzip 8434# Reference: https://tools.ietf.org/html/rfc1952 8435# Update: Joerg Jenderek, Apr 2019 8436# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 8437# * Original filename is only at offset 10 if "extra field" absent 8438# * Produce shorter output - notably, only report compression methods 8439# other than 8 ("deflate", the only method defined in RFC 1952). 8440# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls 8441# TODO: 8442# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/ 8443# KPR KOffice/Calligra KPresenter application/x-kpresenter 8444# KPT KOffice/Calligra KPresenter template? application/x-kpresenter 8445# SAV Diggles Saved Game File http://www.innonics.com 8446# SAV FarCry (demo) saved game http://www.farcry-thegame.com 8447# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter 84480 string \037\213 8449# to display gzip compressed (strength=100=2*50) before other (strength=50)? 8450#!:strength * 2 8451# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary 8452>3 byte&0x18 =0 8453# For binary gzipped no ASCII text should occur 8454# mcd-monu-cad.trid.xml 8455>>10 string MCD Monu-Cad Drawing, Component or Font 8456#>>36 string Created\ with\ MONU-CAD 8457#!:mime application/octet-stream 8458# http://fileformats.archiveteam.org/wiki/Monu-CAD 8459# http://www.monucad.com/downloads/FullDemo-2005.EXE 8460# /HANDS96.MCC Component 8461# /DEMO_DD01.MCD Drawing 8462# /MCALF020.FNT Font 8463!:ext mcc/mcd/fnt 8464# http://www.generalcadd.com 8465>>10 string GXD General CADD, Drawing or Component 8466#!:mime application/octet-stream 8467# /gxc/BUILDINGEDGE.gxc Component 8468# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing 8469# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06 8470!:ext gxc/gxd 8471#>>>13 ubyte 0 \b, version 0 8472>>>13 string 09 \b, version 9 8473# other gzipped binary like gzipped tar, VirtualBox extension package,... 8474>>10 default x gzip compressed data 8475!:mime application/gzip 8476>>>0 use gzip-info 8477# size of the original (uncompressed) input data modulo 2^32 8478>>-0 offset >48 8479>>>-4 ulelong x \b, original size modulo 2^32 %u 8480>>-0 offset <48 \b, truncated 8481# gzipped TAR or VirtualBox extension package 8482#!:mime application/x-compressed-tar 8483#!:mime application/x-virtualbox-vbox-extpack 8484# https://www.w3.org/TR/SVG/mimereg.html 8485#!:mime image/image/svg+xml-compressed 8486# zlib.3.gz 8487# microcode-20180312.tgz 8488# tpz same as tgz 8489# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg 8490# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack 8491!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz 8492# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text 8493>3 byte&0x18 >0 gzip compressed data 8494!:mime application/gzip 8495# gzipped tar, gzipped Abiword document 8496#!:mime application/x-compressed-tar 8497#!:mime application/x-abiword-compressed 8498#!:mime image/image/svg+xml-compressed 8499# kleopatra_splashscreen.svgz gzipped .svg 8500!:ext gz/tgz/tpz/zabw/svgz 8501>>0 use gzip-info 8502# size of the original (uncompressed) input data modulo 2^32 8503>>-0 offset >48 8504>>>-4 ulelong x \b, original size modulo 2^32 %u 8505>>-0 offset <48 \b, truncated 8506# display information of gzip compressed files 85070 name gzip-info 8508#>2 byte x THIS iS GZIP 8509>2 byte <8 \b, reserved method 8510>2 byte >8 \b, unknown method 8511>3 byte &0x01 \b, ASCII 8512>3 byte &0x02 \b, has CRC 8513>3 byte &0x04 \b, extra field 8514>3 byte&0xC =0x08 8515>>10 string x \b, was "%s" 8516>3 byte &0x10 \b, has comment 8517>3 byte &0x20 \b, encrypted 8518>4 ledate >0 \b, last modified: %s 8519>8 byte 2 \b, max compression 8520>8 byte 4 \b, max speed 8521>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 8522>9 byte =0x01 \b, from Amiga 8523>9 byte =0x02 \b, from VMS 8524>9 byte =0x03 \b, from Unix 8525>9 byte =0x04 \b, from VM/CMS 8526>9 byte =0x05 \b, from Atari 8527>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 8528>9 byte =0x07 \b, from MacOS 8529>9 byte =0x08 \b, from Z-System 8530>9 byte =0x09 \b, from CP/M 8531>9 byte =0x0A \b, from TOPS/20 8532>9 byte =0x0B \b, from NTFS filesystem (NT) 8533>9 byte =0x0C \b, from QDOS 8534>9 byte =0x0D \b, from Acorn RISCOS 8535# size of the original (uncompressed) input data modulo 2^32 8536#>-4 ulelong x \b, original size modulo 2^32 %u 8537#ERROR: line 114: non zero offset 1048572 at level 1 8538 8539# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 85400 string \037\036 packed data 8541!:mime application/octet-stream 8542>2 belong >1 \b, %d characters originally 8543>2 belong =1 \b, %d character originally 8544# 8545# This magic number is byte-order-independent. 85460 short 0x1f1f old packed data 8547!:mime application/octet-stream 8548 8549# XXX - why *two* entries for "compacted data", one of which is 8550# byte-order independent, and one of which is byte-order dependent? 8551# 85520 short 0x1fff compacted data 8553!:mime application/octet-stream 8554# This string is valid for SunOS (BE) and a matching "short" is listed 8555# in the Ultrix (LE) magic file. 85560 string \377\037 compacted data 8557!:mime application/octet-stream 85580 short 0145405 huf output 8559!:mime application/octet-stream 8560 8561# bzip2 85620 string BZh bzip2 compressed data 8563!:mime application/x-bzip2 8564!:ext bz2 8565>3 byte >47 \b, block size = %c00k 8566 8567# bzip a block-sorting file compressor 8568# by Julian Seward <sewardj@cs.man.ac.uk> and others 85690 string BZ0 bzip compressed data 8570!:mime application/x-bzip 8571>3 byte >47 \b, block size = %c00k 8572 8573# lzip 85740 string LZIP lzip compressed data 8575!:mime application/x-lzip 8576>4 byte x \b, version: %d 8577 8578# squeeze and crunch 8579# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 85800 beshort 0x76FF squeezed data, 8581>4 string x original name %s 85820 beshort 0x76FE crunched data, 8583>2 string x original name %s 85840 beshort 0x76FD LZH compressed data, 8585>2 string x original name %s 8586 8587# Freeze 85880 string \037\237 frozen file 2.1 85890 string \037\236 frozen file 1.0 (or gzip 0.5) 8590 8591# SCO compress -H (LZH) 85920 string \037\240 SCO compress -H (LZH) data 8593 8594# European GSM 06.10 is a provisional standard for full-rate speech 8595# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 8596# excitation/long term prediction) coding at 13 kbit/s. 8597# 8598# There's only a magic nibble (4 bits); that nibble repeats every 33 8599# bytes. This isn't suited for use, but maybe we can use it someday. 8600# 8601# This will cause very short GSM files to be declared as data and 8602# mismatches to be declared as data too! 8603#0 byte&0xF0 0xd0 data 8604#>33 byte&0xF0 0xd0 8605#>66 byte&0xF0 0xd0 8606#>99 byte&0xF0 0xd0 8607#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 8608 8609# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 86100 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 8611>9 beshort <0x0940 8612>>9 byte&0xf0 =0x00 - version 0. 8613>>9 beshort&0x0fff x \b%03x, 8614>>13 byte 1 LZO1X-1, 8615>>13 byte 2 LZO1X-1(15), 8616>>13 byte 3 LZO1X-999, 8617## >>22 bedate >0 last modified: %s, 8618>>14 byte =0x00 os: MS-DOS 8619>>14 byte =0x01 os: Amiga 8620>>14 byte =0x02 os: VMS 8621>>14 byte =0x03 os: Unix 8622>>14 byte =0x05 os: Atari 8623>>14 byte =0x06 os: OS/2 8624>>14 byte =0x07 os: MacOS 8625>>14 byte =0x0A os: Tops/20 8626>>14 byte =0x0B os: WinNT 8627>>14 byte =0x0E os: Win32 8628>9 beshort >0x0939 8629>>9 byte&0xf0 =0x00 - version 0. 8630>>9 byte&0xf0 =0x10 - version 1. 8631>>9 byte&0xf0 =0x20 - version 2. 8632>>9 beshort&0x0fff x \b%03x, 8633>>15 byte 1 LZO1X-1, 8634>>15 byte 2 LZO1X-1(15), 8635>>15 byte 3 LZO1X-999, 8636## >>25 bedate >0 last modified: %s, 8637>>17 byte =0x00 os: MS-DOS 8638>>17 byte =0x01 os: Amiga 8639>>17 byte =0x02 os: VMS 8640>>17 byte =0x03 os: Unix 8641>>17 byte =0x05 os: Atari 8642>>17 byte =0x06 os: OS/2 8643>>17 byte =0x07 os: MacOS 8644>>17 byte =0x0A os: Tops/20 8645>>17 byte =0x0B os: WinNT 8646>>17 byte =0x0E os: Win32 8647 8648# 4.3BSD-Quasijarus Strong Compression 8649# https://minnie.tuhs.org/Quasijarus/compress.html 86500 string \037\241 Quasijarus strong compressed data 8651 8652# From: Cory Dikkers <cdikkers@swbell.net> 86530 string XPKF Amiga xpkf.library compressed data 86540 string PP11 Power Packer 1.1 compressed data 86550 string PP20 Power Packer 2.0 compressed data, 8656>4 belong 0x09090909 fast compression 8657>4 belong 0x090A0A0A mediocre compression 8658>4 belong 0x090A0B0B good compression 8659>4 belong 0x090A0C0C very good compression 8660>4 belong 0x090A0C0D best compression 8661 8662# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 8663# https://www.7-zip.org or DOC/7zFormat.txt 8664# 86650 string 7z\274\257\047\034 7-zip archive data, 8666>6 byte x version %d 8667>7 byte x \b.%d 8668!:mime application/x-7z-compressed 8669!:ext 7z/cb7 8670 8671# Type: LZMA 86720 lelong&0xffffff =0x5d 8673>12 leshort 0xff LZMA compressed data, 8674!:mime application/x-lzma 8675>>5 lequad =0xffffffffffffffff streamed 8676>>5 lequad !0xffffffffffffffff non-streamed, size %lld 8677>12 leshort 0 LZMA compressed data, 8678>>5 lequad =0xffffffffffffffff streamed 8679>>5 lequad !0xffffffffffffffff non-streamed, size %lld 8680 8681# http://tukaani.org/xz/xz-file-format.txt 86820 ustring \xFD7zXZ\x00 XZ compressed data, checksum 8683!:strength * 2 8684!:mime application/x-xz 8685>7 byte&0xf 0x0 NONE 8686>7 byte&0xf 0x1 CRC32 8687>7 byte&0xf 0x4 CRC64 8688>7 byte&0xf 0xa SHA-256 8689 8690# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 86910 string LRZI LRZIP compressed data 8692>4 byte x - version %d 8693>5 byte x \b.%d 8694>22 byte 1 \b, encrypted 8695!:mime application/x-lrzip 8696 8697# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 86980 lelong 0x184d2204 LZ4 compressed data (v1.4+) 8699!:mime application/x-lz4 8700# Added by osm0sis@xda-developers.com 87010 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 8702!:mime application/x-lz4 87030 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 8704!:mime application/x-lz4 8705 8706# Zstandard/LZ4 skippable frames 8707# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 87080 lelong&0xFFFFFFF0 0x184D2A50 8709>(4.l+8) indirect x 8710 8711# Zstandard Dictionary ID subroutine 87120 name zstd-dictionary-id 8713# Single Segment = True 8714>0 byte &0x20 \b, Dictionary ID: 8715>>0 byte&0x03 0 None 8716>>0 byte&0x03 1 8717>>>1 byte x %u 8718>>0 byte&0x03 2 8719>>>1 leshort x %u 8720>>0 byte&0x03 3 8721>>>1 lelong x %u 8722# Single Segment = False 8723>0 byte ^0x20 \b, Dictionary ID: 8724>>0 byte&0x03 0 None 8725>>0 byte&0x03 1 8726>>>2 byte x %u 8727>>0 byte&0x03 2 8728>>>2 leshort x %u 8729>>0 byte&0x03 3 8730>>>2 lelong x %u 8731 8732# Zstandard compressed data 8733# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 87340 lelong 0xFD2FB522 Zstandard compressed data (v0.2) 8735!:mime application/zstd 87360 lelong 0xFD2FB523 Zstandard compressed data (v0.3) 8737!:mime application/zstd 87380 lelong 0xFD2FB524 Zstandard compressed data (v0.4) 8739!:mime application/zstd 87400 lelong 0xFD2FB525 Zstandard compressed data (v0.5) 8741!:mime application/zstd 87420 lelong 0xFD2FB526 Zstandard compressed data (v0.6) 8743!:mime application/zstd 87440 lelong 0xFD2FB527 Zstandard compressed data (v0.7) 8745!:mime application/zstd 8746>4 use zstd-dictionary-id 87470 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) 8748!:mime application/zstd 8749>4 use zstd-dictionary-id 8750 8751# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 87520 lelong 0xEC30A437 Zstandard dictionary 8753!:mime application/x-std-dictionary 8754>4 lelong x (ID %u) 8755 8756# AFX compressed files (Wolfram Kleff) 87572 string -afx- AFX compressed file data 8758 8759# Supplementary magic data for the file(1) command to support 8760# rzip(1). The format is described in magic(5). 8761# 8762# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 8763# this file. 8764# 87650 string RZIP rzip compressed data 8766>4 byte x - version %d 8767>5 byte x \b.%d 8768>6 belong x (%d bytes) 8769 87700 string ArC\x01 FreeArc archive <http://freearc.org> 8771 8772# Type: DACT compressed files 87730 long 0x444354C3 DACT compressed data 8774>4 byte >-1 (version %i. 8775>5 byte >-1 %i. 8776>6 byte >-1 %i) 8777>7 long >0 , original size: %i bytes 8778>15 long >30 , block size: %i bytes 8779 8780# Valve Pack (VPK) files 87810 lelong 0x55aa1234 Valve Pak file 8782>0x4 lelong x \b, version %u 8783>0x8 lelong x \b, %u entries 8784 8785# Snappy framing format 8786# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 87870 string \377\006\0\0sNaPpY snappy framed data 8788!:mime application/x-snappy-framed 8789 8790# qpress, https://www.quicklz.com/ 87910 string qpress10 qpress compressed data 8792!:mime application/x-qpress 8793 8794# Zlib https://www.ietf.org/rfc/rfc6713.txt 87950 string/b x 8796>0 beshort%31 =0 8797>>0 byte&0xf =8 8798>>>0 byte&0x80 =0 zlib compressed data 8799!:mime application/zlib 8800 8801# BWC compression 88020 string BWC 8803>3 byte 0 BWC compressed data 8804 8805# UCL compression 88060 bequad 0x00e955434cff011a UCL compressed data 8807 8808# Softlib archive 88090 string SLIB Softlib archive 8810>4 leshort x \b, version %d 8811>6 leshort x (contains %d files) 8812 8813# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276 8814# From: Eric Hall <eric.hall@darkart.com> 88150 string bvx- lzfse encoded, no compression 88160 string bvx1 lzfse compressed, uncompressed tables 88170 string bvx2 lzfse compressed, compressed tables 88180 string bvxn lzfse encoded, lzvn compressed 8819 8820# pcxLib.exe compression program 8821# http://www.shikadi.net/moddingwiki/PCX_Library 88220 string/b pcxLib 8823>0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed 8824 8825#------------------------------------------------------------------------------ 8826# $File: console,v 1.68 2022/05/14 20:04:43 christos Exp $ 8827# Console game magic 8828# Toby Deshane <hac@shoelace.digivill.net> 8829 8830# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format 8831# Updated by David Korth <gerbilsoft@gerbilsoft.com> 8832# References: 8833# - https://wiki.nesdev.com/w/index.php/INES 8834# - https://wiki.nesdev.com/w/index.php/NES_2.0 8835 8836# Common header for iNES, NES 2.0, and Wii U iNES. 88370 name nes-rom-image-ines 8838>7 byte&0x0C =0x8 (NES 2.0) 8839>4 byte x \b: %ux16k PRG 8840>5 byte x \b, %ux8k CHR 8841>6 byte&0x08 =0x8 [4-Scr] 8842>6 byte&0x09 =0x0 [H-mirror] 8843>6 byte&0x09 =0x1 [V-mirror] 8844>6 byte&0x02 =0x2 [SRAM] 8845>6 byte&0x04 =0x4 [Trainer] 8846>7 byte&0x03 =0x2 [PC10] 8847>7 byte&0x03 =0x1 [VS] 8848>>7 byte&0x0C =0x8 8849# NES 2.0: VS PPU 8850>>>13 byte&0x0F =0x0 \b, RP2C03B 8851>>>13 byte&0x0F =0x1 \b, RP2C03G 8852>>>13 byte&0x0F =0x2 \b, RP2C04-0001 8853>>>13 byte&0x0F =0x3 \b, RP2C04-0002 8854>>>13 byte&0x0F =0x4 \b, RP2C04-0003 8855>>>13 byte&0x0F =0x5 \b, RP2C04-0004 8856>>>13 byte&0x0F =0x6 \b, RP2C03B 8857>>>13 byte&0x0F =0x7 \b, RP2C03C 8858>>>13 byte&0x0F =0x8 \b, RP2C05-01 8859>>>13 byte&0x0F =0x9 \b, RP2C05-02 8860>>>13 byte&0x0F =0xA \b, RP2C05-03 8861>>>13 byte&0x0F =0xB \b, RP2C05-04 8862>>>13 byte&0x0F =0xC \b, RP2C05-05 8863# TODO: VS protection hardware? 8864>>7 byte x \b] 8865# NES 2.0-specific flags. 8866>7 byte&0x0C =0x8 8867>>12 byte&0x03 =0x0 [NTSC] 8868>>12 byte&0x03 =0x1 [PAL] 8869>>12 byte&0x02 =0x2 [NTSC+PAL] 8870 8871# Standard iNES ROM header. 88720 string NES\x1A NES ROM image (iNES) 8873!:mime application/x-nes-rom 8874>0 use nes-rom-image-ines 8875 8876# Wii U Virtual Console iNES ROM header. 88770 belong 0x4E455300 NES ROM image (Wii U Virtual Console) 8878!:mime application/x-nes-rom 8879>0 use nes-rom-image-ines 8880 8881#------------------------------------------------------------------------------ 8882# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images 8883# Reference: https://wiki.nesdev.com/w/index.php/UNIF 8884# From: David Korth <gerbilsoft@gerbilsoft.com> 8885# 8886# NOTE: The UNIF format uses chunks instead of a fixed header, 8887# so most of the data isn't easily parseable. 8888# 88890 string UNIF 8890>4 lelong <16 NES ROM image (UNIF v%d format) 8891!:mime application/x-nes-rom 8892 8893#------------------------------------------------------------------------------ 8894# fds: file(1) magic for Famciom Disk System disk images 8895# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format 8896# From: David Korth <gerbilsoft@gerbilsoft.com> 8897# TODO: Check "Disk info block" and get info from that in addition to the optional header. 8898 8899# Disk info block. (block 1) 89000 name nintendo-fds-disk-info-block 8901>23 byte !1 FMC- 8902>23 byte 1 FSC- 8903>16 string x \b%.3s 8904>15 ubyte x \b, mfr %02X 8905>20 ubyte x (Rev.%02u) 8906 8907# Headered version. 89080 string FDS\x1A 8909>0x11 string *NINTENDO-HVC* Famicom Disk System disk image: 8910!:mime application/x-fds-disk 8911>>0x10 use nintendo-fds-disk-info-block 8912>4 byte 1 (%u side) 8913>4 byte !1 (%u sides) 8914 8915# Unheadered version. 89161 string *NINTENDO-HVC* Famicom Disk System disk image: 8917!:mime application/x-fds-disk 8918>0 use nintendo-fds-disk-info-block 8919 8920#------------------------------------------------------------------------------ 8921# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images 8922# Used by Nintendo 3DS NES Virtual Console games. 8923# From: David Korth <gerbilsoft@gerbilsoft.com> 8924# 89250 string TNES NES ROM image (Nintendo 3DS Virtual Console) 8926!:mime application/x-nes-rom 8927>4 byte 100 \b: FDS, 8928>>0x2010 use nintendo-fds-disk-info-block 8929>4 byte !100 \b: TNES mapper %u 8930>>5 byte x \b, %ux8k PRG 8931>>6 byte x \b, %ux8k CHR 8932>>7 byte&0x08 =1 [WRAM] 8933>>8 byte&0x09 =1 [H-mirror] 8934>>8 byte&0x09 =2 [V-mirror] 8935>>8 byte&0x02 =3 [VRAM] 8936 8937#------------------------------------------------------------------------------ 8938# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 8939# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header 8940# 89410x104 bequad 0xCEED6666CC0D000B Game Boy ROM image 8942# TODO: application/x-gameboy-color-rom for GBC. 8943!:mime application/x-gameboy-rom 8944>0x143 byte&0x80 0x80 8945>>0x134 string >\0 \b: "%.15s" 8946>0x143 byte&0x80 !0x80 8947>>0x134 string >\0 \b: "%.16s" 8948>0x14c byte x (Rev.%02u) 8949 8950# Machine type. (SGB, CGB, SGB+CGB) 8951# Old licensee code 0x33 is required for SGB, but not CGB. 8952>0x14b byte 0x33 8953>>0x146 byte 0x03 8954>>>0x143 byte&0x80 0x80 [SGB+CGB] 8955>>>0x143 byte&0x80 !0x80 [SGB] 8956>>0x146 byte !0x03 8957>>>0x143 byte&0xC0 0x80 [CGB] 8958>>>0x143 byte&0xC0 0xC0 [CGB ONLY] 8959>0x14b byte !0x33 8960>>0x143 byte&0xC0 0x80 [CGB] 8961>>0x143 byte&0xC0 0xC0 [CGB ONLY] 8962 8963# Mapper. 8964>0x147 byte 0x00 [ROM ONLY] 8965>0x147 byte 0x01 [MBC1] 8966>0x147 byte 0x02 [MBC1+RAM] 8967>0x147 byte 0x03 [MBC1+RAM+BATT] 8968>0x147 byte 0x05 [MBC2] 8969>0x147 byte 0x06 [MBC2+BATTERY] 8970>0x147 byte 0x08 [ROM+RAM] 8971>0x147 byte 0x09 [ROM+RAM+BATTERY] 8972>0x147 byte 0x0B [MMM01] 8973>0x147 byte 0x0C [MMM01+SRAM] 8974>0x147 byte 0x0D [MMM01+SRAM+BATT] 8975>0x147 byte 0x0F [MBC3+TIMER+BATT] 8976>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT] 8977>0x147 byte 0x11 [MBC3] 8978>0x147 byte 0x12 [MBC3+RAM] 8979>0x147 byte 0x13 [MBC3+RAM+BATT] 8980>0x147 byte 0x19 [MBC5] 8981>0x147 byte 0x1A [MBC5+RAM] 8982>0x147 byte 0x1B [MBC5+RAM+BATT] 8983>0x147 byte 0x1C [MBC5+RUMBLE] 8984>0x147 byte 0x1D [MBC5+RUMBLE+SRAM] 8985>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT] 8986>0x147 byte 0xFC [Pocket Camera] 8987>0x147 byte 0xFD [Bandai TAMA5] 8988>0x147 byte 0xFE [Hudson HuC-3] 8989>0x147 byte 0xFF [Hudson HuC-1] 8990 8991# ROM size. 8992>0x148 byte 0 \b, ROM: 256Kbit 8993>0x148 byte 1 \b, ROM: 512Kbit 8994>0x148 byte 2 \b, ROM: 1Mbit 8995>0x148 byte 3 \b, ROM: 2Mbit 8996>0x148 byte 4 \b, ROM: 4Mbit 8997>0x148 byte 5 \b, ROM: 8Mbit 8998>0x148 byte 6 \b, ROM: 16Mbit 8999>0x148 byte 7 \b, ROM: 32Mbit 9000>0x148 byte 0x52 \b, ROM: 9Mbit 9001>0x148 byte 0x53 \b, ROM: 10Mbit 9002>0x148 byte 0x54 \b, ROM: 12Mbit 9003 9004# RAM size. 9005>0x149 byte 1 \b, RAM: 16Kbit 9006>0x149 byte 2 \b, RAM: 64Kbit 9007>0x149 byte 3 \b, RAM: 256Kbit 9008>0x149 byte 4 \b, RAM: 1Mbit 9009>0x149 byte 5 \b, RAM: 512Kbit 9010 9011#------------------------------------------------------------------------------ 9012# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats 9013# Updated by David Korth <gerbilsoft@gerbilsoft.com> 9014# References: 9015# - https://www.retrodev.com/segacd.html 9016# - http://devster.monkeeh.com/sega/32xguide1.txt 9017# 9018 9019# Common Sega Mega Drive header format. 9020# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s. 90210 name sega-mega-drive-header 9022# ROM title. (Use domestic if present; if not, use international.) 9023>0x120 byte >0x20 9024>>0x120 string >\0 \b: "%.16s" 9025>0x120 byte <0x21 9026>>0x150 string >\0 \b: "%.16s" 9027# Other information. 9028>0x180 string >\0 (%.14s 9029>>0x110 string >\0 \b, %.16s 9030>0x180 byte 0 9031>>0x110 string >\0 (%.16s 9032>0 byte x \b) 9033 9034# TODO: Check for 32X CD? 9035# Sega Mega CD disc images: 2048-byte sectors. 90360 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 9037!:mime application/x-sega-cd-rom 9038>0 use sega-mega-drive-header 9039>0 byte x \b, 2048-byte sectors 90400 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 9041!:mime application/x-sega-cd-rom 9042>0 use sega-mega-drive-header 9043>0 byte x \b, 2048-byte sectors 9044# Sega Mega CD disc images: 2352-byte sectors. 90450x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 9046!:mime application/x-sega-cd-rom 9047>0x10 use sega-mega-drive-header 9048>0 byte x \b, 2352-byte sectors 90490x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 9050!:mime application/x-sega-cd-rom 9051>0x10 use sega-mega-drive-header 9052>0 byte x \b, 2352-byte sectors 9053 9054# Sega Mega Drive: Identify the system ID. 90550x100 string SEGA 9056>0x3C0 string MARS\ CHECK\ MODE Sega 32X ROM image 9057!:mime application/x-genesis-32x-rom 9058>>0 use sega-mega-drive-header 9059>0x104 string \ PICO Sega Pico ROM image 9060!:mime application/x-sega-pico-rom 9061>>0 use sega-mega-drive-header 9062>0x104 string TOYS\ PICO Sega Pico ROM image 9063!:mime application/x-sega-pico-rom 9064>>0 use sega-mega-drive-header 9065>0x104 string \ TOYS\ PICO Sega Pico ROM image 9066!:mime application/x-sega-pico-rom 9067>>0 use sega-mega-drive-header 9068>0x104 string \ IAC Sega Pico ROM image 9069!:mime application/x-sega-pico-rom 9070>>0 use sega-mega-drive-header 9071>0x104 string \ TERA68K Sega Teradrive (68K) ROM image 9072!:mime application/x-sega-teradrive-rom 9073>>0 use sega-mega-drive-header 9074>0x104 string \ TERA286 Sega Teradrive (286) ROM image 9075!:mime application/x-sega-teradrive-rom 9076>>0 use sega-mega-drive-header 9077>0x180 string BR Sega Mega CD Boot ROM image 9078!:mime application/x-genesis-rom 9079>>0 use sega-mega-drive-header 9080>0x104 default x Sega Mega Drive / Genesis ROM image 9081!:mime application/x-genesis-rom 9082>>0 use sega-mega-drive-header 9083 9084# Sega Mega Drive: Some ROMs have "SEGA" at 0x101, not 0x100. 90850x100 string \ SEGA Sega Mega Drive / Genesis ROM image 9086>0 use sega-mega-drive-header 9087 9088# Sega Pico ROMs that don't start with "SEGA". 90890x100 string SAMSUNG\ PICO Samsung Pico ROM image 9090!:mime application/x-sega-pico-rom 9091>0 use sega-mega-drive-header 90920x100 string IMA\ IKUNOUJYUKU Samsung Pico ROM image 9093!:mime application/x-sega-pico-rom 9094>0 use sega-mega-drive-header 90950x100 string IMA IKUNOJYUKU Samsung Pico ROM image 9096!:mime application/x-sega-pico-rom 9097>0 use sega-mega-drive-header 9098 9099# Sega Picture Magic (modified 32X) 91000x100 string Picture\ Magic 9101>0x3C0 string PICTURE MAGIC-01 Sega 32X ROM image 9102!:mime application/x-genesis-32x-rom 9103>>0 use sega-mega-drive-header 9104 9105#------------------------------------------------------------------------------ 9106# genesis: file(1) magic for the Super MegaDrive ROM dump format 9107# 9108 9109# NOTE: Due to interleaving, we can't display anything 9110# other than the copier header information. 91110 name sega-genesis-smd-header 9112>0 byte x %dx16k blocks 9113>2 byte 0 \b, last in series or standalone 9114>2 byte >0 \b, split ROM 9115 9116# "Sega Genesis" header. 91170x280 string EAGN 9118>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 9119!:mime application/x-genesis-rom 9120>>0 use sega-genesis-smd-header 9121 9122# "Sega Mega Drive" header. 91230x280 string EAMG 9124>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 9125!:mime application/x-genesis-rom 9126>>0 use sega-genesis-smd-header 9127 9128#------------------------------------------------------------------------------ 9129# smsgg: file(1) magic for Sega Master System and Game Gear ROM images 9130# Detects all Game Gear and export Sega Master System ROM images, 9131# and some Japanese Sega Master System ROM images. 9132# From: David Korth <gerbilsoft@gerbilsoft.com> 9133# Reference: https://www.smspower.org/Development/ROMHeader 9134# 9135 9136# General SMS header rule. 9137# The SMS boot ROM checks the header at three locations. 91380 name sega-master-system-rom-header 9139# Machine type. 9140>0x0F byte&0xF0 0x30 Sega Master System 9141!:mime application/x-sms-rom 9142>0x0F byte&0xF0 0x40 Sega Master System 9143!:mime application/x-sms-rom 9144>0x0F byte&0xF0 0x50 Sega Game Gear 9145!:mime application/x-gamegear-rom 9146>0x0F byte&0xF0 0x60 Sega Game Gear 9147!:mime application/x-gamegear-rom 9148>0x0F byte&0xF0 0x70 Sega Game Gear 9149!:mime application/x-gamegear-rom 9150>0x0F default x Sega Master System / Game Gear 9151!:mime application/x-sms-rom 9152>0 byte x ROM image: 9153# Product code. 9154>0x0E byte&0xF0 0x10 1 9155>0x0E byte&0xF0 0x20 2 9156>0x0E byte&0xF0 0x30 3 9157>0x0E byte&0xF0 0x40 4 9158>0x0E byte&0xF0 0x50 5 9159>0x0E byte&0xF0 0x60 6 9160>0x0E byte&0xF0 0x70 7 9161>0x0E byte&0xF0 0x80 8 9162>0x0E byte&0xF0 0x90 9 9163>0x0E byte&0xF0 0xA0 10 9164>0x0E byte&0xF0 0xB0 11 9165>0x0E byte&0xF0 0xC0 12 9166>0x0E byte&0xF0 0xD0 13 9167>0x0E byte&0xF0 0xE0 14 9168>0x0E byte&0xF0 0xF0 15 9169# If the product code is 5 digits, we'll need to backspace here. 9170>0x0E byte&0xF0 !0 9171>>0x0C leshort x \b%04x 9172>0x0E byte&0xF0 0 9173>>0x0C leshort x %04x 9174# Revision. 9175>0x0E byte&0x0F x (Rev.%02d) 9176# ROM size. (Used for the boot ROM checksum routine.) 9177>0x0F byte&0x0F 0x0A (8 KB) 9178>0x0F byte&0x0F 0x0B (16 KB) 9179>0x0F byte&0x0F 0x0C (32 KB) 9180>0x0F byte&0x0F 0x0D (48 KB) 9181>0x0F byte&0x0F 0x0E (64 KB) 9182>0x0F byte&0x0F 0x0F (128 KB) 9183>0x0F byte&0x0F 0x00 (256 KB) 9184>0x0F byte&0x0F 0x01 (512 KB) 9185>0x0F byte&0x0F 0x02 (1 MB) 9186 9187# SMS/GG header locations. 91880x7FF0 string TMR\ SEGA 9189>0x7FF0 use sega-master-system-rom-header 91900x3FF0 string TMR\ SEGA 9191>0x3FF0 use sega-master-system-rom-header 91920x1FF0 string TMR\ SEGA 9193>0x1FF0 use sega-master-system-rom-header 9194 9195#------------------------------------------------------------------------------ 9196# saturn: file(1) magic for the Sega Saturn disc image format. 9197# From: David Korth <gerbilsoft@gerbilsoft.com> 9198# 9199 9200# Common Sega Saturn disc header format. 9201# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding. 9202# TODO: Release date, device information, region code, others? 92030 name sega-saturn-disc-header 9204>0x60 string >\0 \b: "%.32s" 9205>0x20 string >\0 (%.10s 9206>>0x2A string >\0 \b, %.6s) 9207>>0x2A byte 0 \b) 9208 9209# 2048-byte sector version. 92100 string SEGA\ SEGASATURN\ Sega Saturn disc image 9211!:mime application/x-saturn-rom 9212>0 use sega-saturn-disc-header 9213>0 byte x (2048-byte sectors) 9214# 2352-byte sector version. 92150x10 string SEGA\ SEGASATURN\ Sega Saturn disc image 9216!:mime application/x-saturn-rom 9217>0x10 use sega-saturn-disc-header 9218>0 byte x (2352-byte sectors) 9219 9220#------------------------------------------------------------------------------ 9221# dreamcast: file(1) magic for the Sega Dreamcast disc image format. 9222# From: David Korth <gerbilsoft@gerbilsoft.com> 9223# Reference: https://mc.pp.se/dc/ip0000.bin.html 9224# 9225 9226# Common Sega Dreamcast disc header format. 9227# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding. 9228# TODO: Release date, device information, region code, others? 92290 name sega-dreamcast-disc-header 9230>0x80 string >\0 \b: "%.32s" 9231>0x40 string >\0 (%.10s 9232>>0x4A string >\0 \b, %.6s) 9233>>0x4A byte 0 \b) 9234 9235# 2048-byte sector version. 92360 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 9237!:mime application/x-dc-rom 9238>0 use sega-dreamcast-disc-header 9239>0 byte x (2048-byte sectors) 9240# 2352-byte sector version. 92410x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 9242!:mime application/x-dc-rom 9243>0x10 use sega-dreamcast-disc-header 9244>0 byte x (2352-byte sectors) 9245 9246#------------------------------------------------------------------------------ 9247# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 9248# 92490 belong 0x21068028 Sega Dreamcast VMU game image 92500 string LCDi Dream Animator file 9251 9252#------------------------------------------------------------------------------ 9253# z64: file(1) magic for the Z64 format N64 ROM dumps 9254# Reference: http://forum.pj64-emu.com/showthread.php?t=2239 9255# From: David Korth <gerbilsoft@gerbilsoft.com> 9256# 92570 bequad 0x803712400000000F Nintendo 64 ROM image 9258!:mime application/x-n64-rom 9259>0x20 string >\0 \b: "%.20s" 9260>0x3B string x (%.4s 9261>0x3F byte x \b, Rev.%02u) 9262 9263#------------------------------------------------------------------------------ 9264# v64: file(1) magic for the V64 format N64 ROM dumps 9265# Same as z64 format, but with 16-bit byteswapping. 9266# 92670 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) 9268!:mime application/x-n64-rom 9269 9270#------------------------------------------------------------------------------ 9271# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps 9272# Same as z64 format, but with swapped 16-bit words. 9273# 92740 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) 9275!:mime application/x-n64-rom 9276 9277#------------------------------------------------------------------------------ 9278# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps 9279# Same as z64 format, but with 32-bit byteswapping. 9280# 92810 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) 9282!:mime application/x-n64-rom 9283 9284#------------------------------------------------------------------------------ 9285# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format 9286# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader 9287# 9288# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 9289# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 9290# 92914 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image 9292!:mime application/x-gba-rom 9293>0xA0 string >\0 \b: "%.12s" 9294>0xAC string x (%.6s 9295>0xBC byte x \b, Rev.%02u) 9296 9297#------------------------------------------------------------------------------ 9298# nds: file(1) magic for the Nintendo DS(i) raw ROM format 9299# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader 9300# 9301# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 9302# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 9303# 93040xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image 9305!:mime application/x-nintendo-ds-rom 9306>0x00 string >\0 \b: "%.12s" 9307>0x0C string x (%.6s 9308>0x1E byte x \b, Rev.%02u) 9309>0x12 byte 2 (DSi enhanced) 9310>0x12 byte 3 (DSi only) 9311# Secure Area check. 9312>0x20 lelong <0x4000 (homebrew) 9313>0x20 lelong >0x3FFF 9314>>0x4000 lequad 0x0000000000000000 (multiboot) 9315>>0x4000 lequad !0x0000000000000000 9316>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted) 9317>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF 9318>>>>0x1000 lequad 0x0000000000000000 (encrypted) 9319>>>>0x1000 lequad !0x0000000000000000 (mask ROM) 9320 9321#------------------------------------------------------------------------------ 9322# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot. 9323# This is also used for loading .nds files using the MSET exploit on 3DS. 9324# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 93250xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) 9326!:mime application/x-nintendo-ds-rom 9327 9328#------------------------------------------------------------------------------ 9329# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. 9330# From: David Korth <gerbilsoft@gerbilsoft.com> 9331# References: 9332# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp 9333# - https://www.devrs.com/ngp/files/ngpctech.txt 9334# 93350x0A string BY\ SNK\ CORPORATION Neo Geo Pocket 9336!:mime application/x-neo-geo-pocket-rom 9337>0x23 byte 0x10 Color 9338>0 byte x ROM image 9339>0x24 string >\0 \b: "%.12s" 9340>0x21 uleshort x \b, NEOP%04X 9341>0x1F ubyte 0xFF (debug mode enabled) 9342 9343#------------------------------------------------------------------------------ 9344# msx: file(1) magic for MSX game cartridge dumps 9345# Too simple - MPi 9346#0 beshort 0x4142 MSX game cartridge dump 9347 9348#------------------------------------------------------------------------------ 9349# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 93500 string PS-X\ EXE Sony Playstation executable 9351>16 lelong x PC=%#08x, 9352>20 lelong !0 GP=%#08x, 9353>24 lelong !0 .text=[%#08x, 9354>>28 lelong x \b%#x], 9355>32 lelong !0 .data=[%#08x, 9356>>36 lelong x \b%#x], 9357>40 lelong !0 .bss=[%#08x, 9358>>44 lelong x \b%#x], 9359>48 lelong !0 Stack=%#08x, 9360>48 lelong =0 No Stack!, 9361>52 lelong !0 StackSize=%#x, 9362#>76 string >\0 (%s) 9363# Area: 9364>113 string x (%s) 9365 9366# CPE executables 93670 string CPE CPE executable 9368>3 byte x (version %d) 9369 9370#------------------------------------------------------------------------------ 9371# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 93720 string XBEH Microsoft Xbox executable 9373!:mime audio/x-xbox-executable 9374!:ext xbe 9375# expect base address of 0x10000 9376>0x0104 ulelong =0x10000 9377>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" 9378>>(0x0118.l-0x0FFF5) byte x (%c 9379>>(0x0118.l-0x0FFF6) byte x \b%c- 9380>>(0x0118.l-0x0FFF8) uleshort x \b%03u) 9381>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 9382>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007 9383>>>(0x0118.l-0x0FF60) ulelong >0 (regions: 9384>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA 9385>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan 9386>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World 9387>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer 9388>>>(0x0118.l-0x0FF60) ulelong >0 \b) 9389# probabilistic checks whether signed or not 9390>0x0004 ulelong =0x0 9391>>&2 ulelong =0x0 9392>>>&2 ulelong =0x0 \b, not signed 9393>0x0004 ulelong >0 9394>>&2 ulelong >0 9395>>>&2 ulelong >0 \b, signed 9396 9397# -------------------------------- 9398# Microsoft Xbox data file formats 93990 string XIP0 XIP, Microsoft Xbox data 94000 string XTF0 XTF, Microsoft Xbox data 9401 9402#------------------------------------------------------------------------------ 9403# Microsoft Xbox 360 executables (.xex) 9404# From: David Korth <gerbilsoft@gerbilsoft.com> 9405# References: 9406# - https://free60project.github.io/wiki/XEX.html 9407# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 9408 9409# Title ID (part of Execution ID section) 94100 name xbox-360-xex-execution-id 9411>(0.L+0xC) byte x (%c 9412>(0.L+0xD) byte x \b%c 9413>(0.L+0xE) beshort x \b-%04u, media ID: 9414>(0.L) belong x %08X) 9415 9416# Region code (part of Security Info) 94170 name xbox-360-xex-region-code 9418>0 ubelong 0xFFFFFFFF \b, all regions 9419>0 ubelong !0xFFFFFFFF 9420>>0 ubelong >0 (regions: 9421>>0 ubelong&0x000000FF 0x000000FF USA 9422>>0 ubelong&0x00000100 0x00000100 Japan 9423>>0 ubelong&0x00000200 0x00000200 China 9424>>0 ubelong&0x0000FC00 0x0000FC00 Asia 9425>>0 ubelong&0x00FF0000 0x00FF0000 PAL 9426>>0 ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] 9427>>0 ubelong&0x00FF0000 0x00010000 AU/NZ 9428>>0 ubelong&0xFF000000 0xFF000000 Other 9429>>0 ubelong >0 \b) 9430 94310 string XEX2 Microsoft Xbox 360 executable 9432!:mime audio/x-xbox360-executable 9433!:ext xex 9434>0x18 search/0x100 \x00\x04\x00\x06 9435>>&0 use xbox-360-xex-execution-id 9436>(0x010.L+0x178) use xbox-360-xex-region-code 9437 94380 string XEX1 Microsoft Xbox 360 executable (XEX1) 9439!:mime audio/x-xbox360-executable 9440!:ext xex 9441>0x18 search/0x100 \x00\x04\x00\x06 9442>>&0 use xbox-360-xex-execution-id 9443>(0x010.L+0x154) use xbox-360-xex-region-code 9444 9445#------------------------------------------------------------------------------ 9446# Microsoft Xbox 360 packages 9447# From: David Korth <gerbilsoft@gerbilsoft.com> 9448# References: 9449# - https://free60project.github.io/wiki/STFS.html 9450# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 9451 9452# TODO: More information for console-signed packages. 9453 94540 name xbox-360-package 9455>0x360 byte x (%c 9456>0x361 byte x \b%c 9457>0x362 beshort x \b-%04u, media ID: 9458>0x354 belong x %08X) 9459>0x344 belong x \b, content type: 9460>>0x344 belong 0x1 Saved Game 9461>>0x344 belong 0x2 Marketplace Content 9462>>0x344 belong 0x3 Publisher 9463>>0x344 belong 0x1000 Xbox 360 Title 9464>>0x344 belong 0x2000 IPTV Pause Buffer 9465>>0x344 belong 0x4000 Installed Game 9466>>0x344 belong 0x5000 Original Xbox Game 9467>>0x344 belong 0x9000 Avatar Item 9468>>0x344 belong 0x10000 Profile 9469>>0x344 belong 0x20000 Gamer Picture 9470>>0x344 belong 0x30000 Theme 9471>>0x344 belong 0x40000 Cache File 9472>>0x344 belong 0x50000 Storage Download 9473>>0x344 belong 0x60000 Xbox Saved Game 9474>>0x344 belong 0x70000 Xbox Download 9475>>0x344 belong 0x80000 Game Demo 9476>>0x344 belong 0x90000 Video 9477>>0x344 belong 0xA0000 Game 9478>>0x344 belong 0xB0000 Installer 9479>>0x344 belong 0xC0000 Game Trailer 9480>>0x344 belong 0xD0000 Arcade Title 9481>>0x344 belong 0xE0000 XNA 9482>>0x344 belong 0xF0000 License Store 9483>>0x344 belong 0x100000 Movie 9484>>0x344 belong 0x200000 TV 9485>>0x344 belong 0x300000 Music Video 9486>>0x344 belong 0x400000 Game Video 9487>>0x344 belong 0x500000 Podcast Video 9488>>0x344 belong 0x600000 Viral Video 9489>>0x344 belong 0x2000000 Community Game 9490 94910 string CON\x20 Microsoft Xbox 360 package (console-signed) 9492>0 use xbox-360-package 94930 string PIRS 9494>0 belong 0 Microsoft Xbox 360 package (non-Xbox Live) 9495>>0 use xbox-360-package 94960 string LIVE 9497>0x104 belong 0 Microsoft Xbox 360 package (Xbox Live) 9498>>0 use xbox-360-package 9499 9500# Atari Lynx cartridge dump (EXE/BLL header) 9501# From: "Stefan A. Haubenthal" <polluks@sdf.lonestar.org> 9502# Reference: 9503# https://raw.githubusercontent.com/cc65/cc65/master/libsrc/lynx/exehdr.s 9504# Double-check that the image type matches too, 0x8008 conflicts with 9505# 8 character OMF-86 object file headers. 95060 beshort 0x8008 9507>6 string BS93 Lynx homebrew cartridge 9508!:mime application/x-atari-lynx-rom 9509>>2 beshort x \b, RAM start $%04x 95100 string LYNX Lynx cartridge 9511!:mime application/x-atari-lynx-rom 9512>4 leshort/4 >0 \b, bank 0 %dk 9513>6 leshort/4 >0 \b, bank 1 %dk 9514>10 string >\0 \b, "%.32s" 9515>42 string >\0 \b, "%.16s" 9516 9517# Opera file system that is used on the 3DO console 9518# From: Serge van den Boom <svdb@stack.nl> 95190 string \x01ZZZZZ\x01 3DO "Opera" file system 9520 9521# From: Alex Myczko <alex@aiei.ch> 9522# From: David Pflug <david@pflug.email> 9523# is the offset 12 or the offset 16 correct? 9524# GBS (Game Boy Sound) magic 9525# ftp://ftp.modland.com/pub/documents/format_documentation/\ 9526# Gameboy%20Sound%20System%20(.gbs).txt 95270 string GBS Nintendo Gameboy Music/Audio Data 9528#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 9529>16 string >\0 ("%.32s" by 9530>48 string >\0 %.32s, copyright 9531>80 string >\0 %.32s), 9532>3 byte x version %u, 9533>4 byte x %u tracks 9534 9535# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at> 9536# see https://zerosoft.zophar.net/ips.php 95370 string PATCH IPS patch file 9538!:ext ips 9539 9540# BPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 9541# Reference: https://www.romhacking.net/documents/746/ 95420 string BPS1 BPS patch file 9543!:ext bps 9544 9545# APS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 9546# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64) 95470 string APS10 APS patch file 9548!:ext aps 9549>5 byte 0 \b, simple patch 9550>5 byte 1 \b, N64-specific patch for 9551>>58 byte x N%c 9552>>59 byte x \b%c 9553>>60 byte x \b%c 9554>7 byte !0x20 9555# FIXME: /T specifier isn't working with a fixed-length string. 9556>>7 string x \b: "%.50s" 9557 9558# UPS Patch Files - from: David Korth <gerbilsoft@gerbilsoft.com> 9559# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format) 95600 string UPS1 UPS patch file 9561!:ext ups 9562 9563# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 95640 string PPF30 Playstation Patch File version 3.0 9565>5 byte 0 \b, PPF 1.0 patch 9566>5 byte 1 \b, PPF 2.0 patch 9567>5 byte 2 \b, PPF 3.0 patch 9568>>56 byte 0 \b, Imagetype BIN (any) 9569>>56 byte 1 \b, Imagetype GI (PrimoDVD) 9570>>57 byte 0 \b, Blockcheck disabled 9571>>57 byte 1 \b, Blockcheck enabled 9572>>58 byte 0 \b, Undo data not available 9573>>58 byte 1 \b, Undo data available 9574>6 string x \b, description: %s 9575 95760 string PPF20 Playstation Patch File version 2.0 9577>5 byte 0 \b, PPF 1.0 patch 9578>5 byte 1 \b, PPF 2.0 patch 9579>>56 lelong >0 \b, size of file to patch %d 9580>6 string x \b, description: %s 9581 95820 string PPF10 Playstation Patch File version 1.0 9583>5 byte 0 \b, Simple Encoding 9584>6 string x \b, description: %s 9585 9586# From: Daniel Dawson <ddawson@icehouse.net> 9587# SNES9x .smv "movie" file format. 95880 string SMV\x1A SNES9x input recording 9589>0x4 lelong x \b, version %d 9590# version 4 is latest so far 9591>0x4 lelong <5 9592>>0x8 ledate x \b, recorded at %s 9593>>0xc lelong >0 \b, rerecorded %d times 9594>>0x10 lelong x \b, %d frames long 9595>>0x14 byte >0 \b, data for controller(s): 9596>>>0x14 byte &0x1 #1 9597>>>0x14 byte &0x2 #2 9598>>>0x14 byte &0x4 #3 9599>>>0x14 byte &0x8 #4 9600>>>0x14 byte &0x10 #5 9601>>0x15 byte ^0x1 \b, begins from snapshot 9602>>0x15 byte &0x1 \b, begins from reset 9603>>0x15 byte ^0x2 \b, NTSC standard 9604>>0x15 byte &0x2 \b, PAL standard 9605>>0x17 byte &0x1 \b, settings: 9606# WIP1Timing not used as of version 4 9607>>>0x4 lelong <4 9608>>>>0x17 byte &0x2 WIP1Timing 9609>>>0x17 byte &0x4 Left+Right 9610>>>0x17 byte &0x8 VolumeEnvX 9611>>>0x17 byte &0x10 FakeMute 9612>>>0x17 byte &0x20 SyncSound 9613# New flag as of version 4 9614>>>0x4 lelong >3 9615>>>>0x17 byte &0x80 NoCPUShutdown 9616>>0x4 lelong <4 9617>>>0x18 lelong >0x23 9618>>>>0x20 leshort !0 9619>>>>>0x20 lestring16 x \b, metadata: "%s" 9620>>0x4 lelong >3 9621>>>0x24 byte >0 \b, port 1: 9622>>>>0x24 byte 1 joypad 9623>>>>0x24 byte 2 mouse 9624>>>>0x24 byte 3 SuperScope 9625>>>>0x24 byte 4 Justifier 9626>>>>0x24 byte 5 multitap 9627>>>0x24 byte >0 \b, port 2: 9628>>>>0x25 byte 1 joypad 9629>>>>0x25 byte 2 mouse 9630>>>>0x25 byte 3 SuperScope 9631>>>>0x25 byte 4 Justifier 9632>>>>0x25 byte 5 multitap 9633>>>0x18 lelong >0x43 9634>>>>0x40 leshort !0 9635>>>>>0x40 lestring16 x \b, metadata: "%s" 9636>>0x17 byte &0x40 \b, ROM: 9637>>>(0x18.l-26) lelong x CRC32 %#08x 9638>>>(0x18.l-23) string x "%s" 9639 9640# Type: scummVM savegame files 9641# From: Sven Hartge <debian@ds9.argh.org> 96420 string SCVM ScummVM savegame 9643>12 string >\0 "%s" 9644 9645#------------------------------------------------------------------------------ 9646# Nintendo GameCube / Wii file formats. 9647# 9648 9649# Type: Nintendo GameCube/Wii common disc header data. 9650# From: David Korth <gerbilsoft@gerbilsoft.com> 9651# Reference: https://wiibrew.org/wiki/Wii_Disc 96520 name nintendo-gcn-disc-common 9653>0x20 string x "%.64s" 9654>0x00 string x (%.6s 9655>0x06 byte >0 9656>>0x06 byte 1 \b, Disc 2 9657>>0x06 byte 2 \b, Disc 3 9658>>0x06 byte 3 \b, Disc 4 9659>0x07 byte x \b, Rev.%02u) 9660>0x18 belong 0x5D1C9EA3 9661>>0x60 beshort 0x0101 \b (Unencrypted) 9662>0x200 string NKIT \b (NKit compressed) 9663 9664 9665# Type: Nintendo GameCube disc image 9666# From: David Korth <gerbilsoft@gerbilsoft.com> 9667# Reference: https://wiibrew.org/wiki/Wii_Disc 96680x1C belong 0xC2339F3D Nintendo GameCube disc image: 9669!:mime application/x-gamecube-rom 9670>0 use nintendo-gcn-disc-common 9671 9672# Type: Nintendo GameCube embedded disc image 9673# Commonly found on demo discs. 9674# From: David Korth <gerbilsoft@gerbilsoft.com> 9675# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8 96760 belong 0xAE0F38A2 9677>0x0C belong 0x00100000 9678>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: 9679!:mime application/x-gamecube-rom 9680>>>(8.L) use nintendo-gcn-disc-common 9681 9682# Type: Nintendo Wii disc image 9683# From: David Korth <gerbilsoft@gerbilsoft.com> 9684# Reference: https://wiibrew.org/wiki/Wii_Disc 96850x18 belong 0x5D1C9EA3 Nintendo Wii disc image: 9686>0 use nintendo-gcn-disc-common 9687 9688# Type: Nintendo Wii disc image (WBFS format) 9689# From: David Korth <gerbilsoft@gerbilsoft.com> 9690# Reference: https://wiibrew.org/wiki/Wii_Disc 96910 string WBFS 9692>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): 9693!:mime application/x-wii-rom 9694>>0x200 use nintendo-gcn-disc-common 9695 9696# Type: Nintendo GameCube/Wii disc image (CISO format) 9697# NOTE: This is NOT the same as Compact ISO or PSP CISO, 9698# though it has the same magic number. 96990 string CISO 9700# Other fields are used to determine what type of CISO this is: 9701# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 9702# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 9703# - None of the above: Compact ISO. 9704>4 lelong 0x200000 9705>>8 byte 1 9706>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): 9707!:mime application/x-wii-rom 9708>>>>0x8000 use nintendo-gcn-disc-common 9709>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): 9710!:mime application/x-wii-rom 9711>>>>0x8000 use nintendo-gcn-disc-common 9712 9713# Type: Nintendo GameCube/Wii disc image (GCZ format) 9714# Due to zlib compression, we can't get the actual disc information. 97150 lelong 0xB10BC001 9716>4 lelong 0 Nintendo GameCube disc image (GCZ format) 9717!:mime application/x-gamecube-rom 9718>4 lelong 1 Nintendo Wii disc image (GCZ format) 9719!:mime application/x-wii-rom 9720>4 default x Nintendo GameCube/Wii disc image (GCZ format) 9721 9722# Type: Nintendo GameCube/Wii disc image (WDF format) 97230 string WII\001DISC 9724>8 belong 1 9725# WDFv1 9726>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): 9727!:mime application/x-gamecube-rom 9728>>>0x38 use nintendo-gcn-disc-common 9729>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): 9730!:mime application/x-wii-rom 9731>>>0x38 use nintendo-gcn-disc-common 9732>8 belong 2 9733# WDFv2 9734>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): 9735!:mime application/x-gamecube-rom 9736>>>(12.L) use nintendo-gcn-disc-common 9737>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): 9738!:mime application/x-wii-rom 9739>>>(12.L) use nintendo-gcn-disc-common 9740 9741# Type: Nintendo GameCube/Wii disc image (WIA format) 97420 string WIA\001 Nintendo 9743>0x48 belong 1 GameCube 9744!:mime application/x-gamecube-rom 9745>0x48 belong 2 Wii 9746!:mime application/x-wii-rom 9747>0x48 default x GameCube/Wii 9748>0x48 belong x disc image (WIA format): 9749>>0x58 use nintendo-gcn-disc-common 9750 9751# Type: Nintendo GameCube/Wii disc image (with SDK header) 9752# From: David Korth <gerbilsoft@gerbilsoft.com> 9753# Reference: https://wiibrew.org/wiki/Wii_Disc 97540 belong 0xFFFF0000 9755>0x18 belong 0x00000000 9756>>0x1C belong 0x00000000 9757>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: 9758!:mime application/x-wii-rom 9759>>>>0x8000 use nintendo-gcn-disc-common 9760>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: 9761!:mime application/x-gamecube-rom 9762>>>>0x8000 use nintendo-gcn-disc-common 9763 9764# Type: Nintendo GameCube/Wii disc image (RVZ format) 97650 string RVZ\001 Nintendo 9766>0x48 belong 1 GameCube 9767!:mime application/x-gamecube-rom 9768>0x48 belong 2 Wii 9769!:mime application/x-wii-rom 9770>0x48 default x GameCube/Wii 9771>0x48 belong x disc image (RVZ format): 9772>>0x58 use nintendo-gcn-disc-common 9773 9774#------------------------------------------------------------------------------ 9775# Nintendo 3DS file formats. 9776# 9777 9778# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC) 9779# From: David Korth <gerbilsoft@gerbilsoft.com> 9780# Reference: https://www.3dbrew.org/wiki/NCSD 97810x100 string NCSD 9782>0x118 lequad 0 Nintendo 3DS Game Card image 9783# NCCH header for partition 0. (game data) 9784>>0x1150 string >\0 \b: "%.16s" 9785>>0x312 byte x (Rev.%02u) 9786>>0x118C byte 2 (New3DS only) 9787>>0x18D byte 0 (inner device) 9788>>0x18D byte 1 (Card1) 9789>>0x18D byte 2 (Card2) 9790>>0x18D byte 3 (extended device) 9791>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS) 9792>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS) 9793 9794# Nintendo 3DS version code. 9795# Reference: https://www.3dbrew.org/wiki/Titles 9796# Format: leshort containing three fields: 9797# - 6-bit: Major 9798# - 6-bit: Minor 9799# - 4-bit: Revision 9800# NOTE: Only supporting major/minor versions from 0-15 right now. 9801# NOTE: Should be prefixed with "v". 98020 name nintendo-3ds-version-code 9803# Raw version. 9804>0 leshort x \b%u, 9805# Major version. 9806>0 leshort&0xFC00 0x0000 0 9807>0 leshort&0xFC00 0x0400 1 9808>0 leshort&0xFC00 0x0800 2 9809>0 leshort&0xFC00 0x0C00 3 9810>0 leshort&0xFC00 0x1000 4 9811>0 leshort&0xFC00 0x1400 5 9812>0 leshort&0xFC00 0x1800 6 9813>0 leshort&0xFC00 0x1C00 7 9814>0 leshort&0xFC00 0x2000 8 9815>0 leshort&0xFC00 0x2400 9 9816>0 leshort&0xFC00 0x2800 10 9817>0 leshort&0xFC00 0x2C00 11 9818>0 leshort&0xFC00 0x3000 12 9819>0 leshort&0xFC00 0x3400 13 9820>0 leshort&0xFC00 0x3800 14 9821>0 leshort&0xFC00 0x3C00 15 9822# Minor version. 9823>0 leshort&0x03F0 0x0000 \b.0 9824>0 leshort&0x03F0 0x0010 \b.1 9825>0 leshort&0x03F0 0x0020 \b.2 9826>0 leshort&0x03F0 0x0030 \b.3 9827>0 leshort&0x03F0 0x0040 \b.4 9828>0 leshort&0x03F0 0x0050 \b.5 9829>0 leshort&0x03F0 0x0060 \b.6 9830>0 leshort&0x03F0 0x0070 \b.7 9831>0 leshort&0x03F0 0x0080 \b.8 9832>0 leshort&0x03F0 0x0090 \b.9 9833>0 leshort&0x03F0 0x00A0 \b.10 9834>0 leshort&0x03F0 0x00B0 \b.11 9835>0 leshort&0x03F0 0x00C0 \b.12 9836>0 leshort&0x03F0 0x00D0 \b.13 9837>0 leshort&0x03F0 0x00E0 \b.14 9838>0 leshort&0x03F0 0x00F0 \b.15 9839# Revision. 9840>0 leshort&0x000F x \b.%u 9841 9842# Type: Nintendo 3DS "NCCH" container. 9843# https://www.3dbrew.org/wiki/NCCH 98440x100 string NCCH Nintendo 3DS 9845>0x18D byte&2 0 File Archive (CFA) 9846>0x18D byte&2 2 Executable Image (CXI) 9847>0x150 string >\0 \b: "%.16s" 9848>0x18D byte 0x05 9849>>0x10E leshort x (Old3DS System Update v 9850>>0x10E use nintendo-3ds-version-code 9851>>0x10E leshort x \b) 9852>0x18D byte 0x15 9853>>0x10E leshort x (New3DS System Update v 9854>>0x10E use nintendo-3ds-version-code 9855>>0x10E leshort x \b) 9856>0x18D byte !0x05 9857>>0x18D byte !0x15 9858>>>0x112 byte x (v 9859>>>0x112 use nintendo-3ds-version-code 9860>>>0x112 byte x \b) 9861>0x18C byte 2 (New3DS only) 9862 9863# Type: Nintendo 3DS "SMDH" file. (application description) 9864# From: David Korth <gerbilsoft@gerbilsoft.com> 9865# Reference: https://3dbrew.org/wiki/SMDH 98660 string SMDH Nintendo 3DS SMDH file 9867>0x208 leshort !0 9868>>0x208 lestring16 x \b: "%.128s" 9869>>0x388 leshort !0 9870>>>0x388 lestring16 x by %.128s 9871>0x208 leshort 0 9872>>0x008 leshort !0 9873>>>0x008 lestring16 x \b: "%.128s" 9874>>>0x188 leshort !0 9875>>>>0x188 lestring16 x by %.128s 9876 9877# Type: Nintendo 3DS Homebrew Application. 9878# From: David Korth <gerbilsoft@gerbilsoft.com> 9879# Reference: https://3dbrew.org/wiki/3DSX_Format 98800 string 3DSX Nintendo 3DS Homebrew Application (3DSX) 9881 9882# Type: Nintendo 3DS Banner Model Data. 9883# From: David Korth <gerbilsoft@gerbilsoft.com> 9884# Reference: https://3dbrew.org/wiki/CBMD 98850 string CBMD\0\0\0\0 Nintendo 3DS Banner Model Data 9886 9887#------------------------------------------------------------------------------ 9888# a7800: file(1) magic for the Atari 7800 raw ROM format. 9889# From: David Korth <gerbilsoft@gerbilsoft.com> 9890# Reference: https://sites.google.com/site/atari7800wiki/a78-header 9891 98920 byte >0 9893>0 byte <3 9894>>1 string ATARI7800 Atari 7800 ROM image 9895!:mime application/x-atari-7800-rom 9896>>>0x11 string >\0 \b: "%.32s" 9897# Display type. 9898>>>0x39 byte 0 (NTSC) 9899>>>0x39 byte 1 (PAL) 9900>>>0x36 byte&1 1 (POKEY) 9901 9902#------------------------------------------------------------------------------ 9903# vectrex: file(1) magic for the GCE Vectrex raw ROM format. 9904# From: David Korth <gerbilsoft@gerbilsoft.com> 9905# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm 9906# 9907# NOTE: Title is terminated with 0x80, not 0. 9908# The header is terminated with a 0, so that will 9909# terminate the title as well. 9910# 99110 string g\ GCE Vectrex ROM image 9912>0x11 string >\0 \b: "%.16s" 9913 9914#------------------------------------------------------------------------------ 9915# amiibo: file(1) magic for Nintendo amiibo NFC dumps. 9916# From: David Korth <gerbilsoft@gerbilsoft.com> 9917# Reference: https://www.3dbrew.org/wiki/Amiibo 99180x00 byte 0x04 9919>0x0A beshort 0x0FE0 9920>>0x0C belong 0xF110FFEE 9921>>>0x208 beshort 0x0100 9922>>>>0x020A byte 0x0F 9923>>>>>0x020C bequad 0x000000045F000000 9924>>>>>>0x5B byte 0x02 9925>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- 9926>>>>>>>0x58 belong x \b%08X 9927 9928#------------------------------------------------------------------------------ 9929# Type: Nintendo Switch XCI (Game Cartridge Image) 9930# From: Benjamin Lowry <ben@ben.gmbh> 9931# Reference: https://switchbrew.org/wiki/Gamecard_Format 99320x100 string HEAD 9933>0x10D byte 0xFA Nintendo Switch cartridge image (XCI), 1GB 9934>0x10D byte 0xF8 Nintendo Switch cartridge image (XCI), 2GB 9935>0x10D byte 0xF0 Nintendo Switch cartridge image (XCI), 4GB 9936>0x10D byte 0xE0 Nintendo Switch cartridge image (XCI), 8GB 9937>0x10D byte 0xE1 Nintendo Switch cartridge image (XCI), 16GB 9938>0x10D byte 0xE2 Nintendo Switch cartridge image (XCI), 32GB 9939 9940#------------------------------------------------------------------------------ 9941# Type: Nintendo Switch Executable 9942# From: Benjamin Lowry <ben@ben.gmbh> 9943# Reference: https://switchbrew.org/wiki/NSO 99440x00 string NSO0 Nintendo Switch executable (NSO) 9945 9946#------------------------------------------------------------------------------ 9947# Type: Nintendo Switch PFS0 9948# From: Benjamin Lowry <ben@ben.gmbh> 9949# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0 99500x00 string PFS0 Nintendo Switch partition filesystem (PFS0) 9951>0x04 ulelong x \b, %d files 9952 9953#------------------------------------------------------------------------------ 9954# amiibo: file(1) magic for Nintendo Badge Arcade files. 9955# From: David Korth <gerbilsoft@gerbilsoft.com> 9956# References: 9957# - https://github.com/GerbilSoft/rom-properties/issues/92 9958# - https://github.com/CaitSith2/BadgeArcadeTool 9959# - https://github.com/TheMachinumps/Advanced-badge-editor 9960 9961# PRBS: Individual badge and/or mega badge. 99620 string PRBS 9963>0x44 byte >0x20 Nintendo Badge Arcade 9964>>0xB8 ulelong <2 9965>>>0xBC ulelong <2 badge: 9966>>>0xBC ulelong >1 Mega Badge 9967>>>>0xB8 ulelong x (%ux 9968>>>>0xBC ulelong x \b%u): 9969>>0xB8 ulelong >1 Mega Badge 9970>>>0xB8 ulelong x (%ux 9971>>>0xBC ulelong x \b%u): 9972>0x44 string x "%s" 9973>0x3C ulelong x \b, badge ID: %u 9974>0x74 byte >0x20 9975>>0x74 string x \b, set: "%s" 9976>0xA8 ulelong !0xFFFFFFFF 9977>>0xA8 ulelong x \b, launch title ID: %08X 9978>>0xA4 ulelong x \b-%08X 9979 9980# CABS: Badge set. 99810 string CABS 9982>0x2C byte >0x20 Nintendo Badge Arcade badge set: 9983>>0x2C string x "%.48s" 9984>>0x24 ulelong x \b, set ID: %u 9985 9986#------------------------------------------------------------------------------ 9987# sufami: file(1) magic for Sufami Turbo ROM images. 9988# From: David Korth <gerbilsoft@gerbilsoft.com> 9989# References: 9990# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor 99910 string BANDAI\ SFC-ADX 9992>0x10 string !SFC-ADX\ BACKUP Sufami Turbo ROM image: 9993>>0x10 string/T x "%.14s" 9994>>0x30 byte x \b, ID %02X 9995>>0x31 byte x \b%02X 9996>>0x32 byte x \b%02X 9997>>0x33 ubyte >0 \b, series index %u 9998>>0x34 ubyte 0 [SlowROM] 9999>>0x34 ubyte 1 [FastROM] 10000>>0x35 ubyte 1 [SRAM] 10001>>0x35 ubyte 3 [Special] 10002 10003#------------------------------------------------------------------------------ 10004# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 10005# convex: file(1) magic for Convex boxes 10006# 10007# Convexes are big-endian. 10008# 10009# /*\ 10010# * Below are the magic numbers and tests added for Convex. 10011# * Added at beginning, because they are expected to be used most. 10012# \*/ 100130 belong 0507 Convex old-style object 10014>16 belong >0 not stripped 100150 belong 0513 Convex old-style demand paged executable 10016>16 belong >0 not stripped 100170 belong 0515 Convex old-style pre-paged executable 10018>16 belong >0 not stripped 100190 belong 0517 Convex old-style pre-paged, non-swapped executable 10020>16 belong >0 not stripped 100210 belong 0x011257 Core file 10022# 10023# The following are a series of dump format magic numbers. Each one 10024# corresponds to a drastically different dump format. The first on is 10025# the original dump format on a 4.1 BSD or earlier file system. The 10026# second marks the change between the 4.1 file system and the 4.2 file 10027# system. The Third marks the changing of the block size from 1K 10028# to 2K to be compatible with an IDC file system. The fourth indicates 10029# a dump that is dependent on Convex Storage Manager, because data in 10030# secondary storage is not physically contained within the dump. 10031# The restore program uses these number to determine how the data is 10032# to be extracted. 10033# 1003424 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 1003524 belong =60014 dump format, Convex Storage Manager by-reference dump 10036# 10037# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 10038# If there is no `=' sign, assume just checking for whether the bit is set? 10039# 100400 belong 0601 Convex SOFF 10041>88 belong&0x000f0000 =0x00000000 c1 10042>88 belong &0x00010000 c2 10043>88 belong &0x00020000 c2mp 10044>88 belong &0x00040000 parallel 10045>88 belong &0x00080000 intrinsic 10046>88 belong &0x00000001 demand paged 10047>88 belong &0x00000002 pre-paged 10048>88 belong &0x00000004 non-swapped 10049>88 belong &0x00000008 POSIX 10050# 10051>84 belong &0x80000000 executable 10052>84 belong &0x40000000 object 10053>84 belong&0x20000000 =0 not stripped 10054>84 belong&0x18000000 =0x00000000 native fpmode 10055>84 belong&0x18000000 =0x10000000 ieee fpmode 10056>84 belong&0x18000000 =0x18000000 undefined fpmode 10057# 100580 belong 0605 Convex SOFF core 10059# 100600 belong 0607 Convex SOFF checkpoint 10061>88 belong&0x000f0000 =0x00000000 c1 10062>88 belong &0x00010000 c2 10063>88 belong &0x00020000 c2mp 10064>88 belong &0x00040000 parallel 10065>88 belong &0x00080000 intrinsic 10066>88 belong &0x00000008 POSIX 10067# 10068>84 belong&0x18000000 =0x00000000 native fpmode 10069>84 belong&0x18000000 =0x10000000 ieee fpmode 10070>84 belong&0x18000000 =0x18000000 undefined fpmode 10071 10072#------------------------------------------------------------------------------ 10073# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $ 10074# xoverage: file(1) magic for test coverage data 10075 10076# File formats used to store test coverage data 10077# 2016-05-21, Georg Sauthoff <mail@georg.so> 10078 10079 10080# - GCC gcno - written by GCC at compile time when compiling with 10081# gcc -ftest-coverage 10082# - GCC gcda - written by a program that was compiled with 10083# gcc -fprofile-arcs 10084# - LLVM raw profiles - generated by a program compiled with 10085# clang -fprofile-instr-generate -fcoverage-mapping ... 10086# - LLVM indexed profiles - generated by 10087# llvm-profdata 10088# - GCOV reports, i.e. the annotated source code 10089# - LCOV trace files, i.e. aggregated GCC profiles 10090# 10091# GCC coverage tracefiles 10092# .gcno file are created during compile time, 10093# while data collected during runtime is stored in .gcda files 10094# cf. gcov-io.h 10095# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html 10096# Examples: 10097# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35 10098# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a 100990 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage), 10100>&3 byte x version %c. 10101>&1 byte x \b%c 10102 10103# big endian 101040 belong 0x67636e6f GCC gcno coverage (-ftest-coverage), 10105>&0 byte x version %c. 10106>&2 byte x \b%c (big-endian) 10107 10108# Examples: 10109# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35 10110# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a 101110 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs), 10112>&3 byte x version %c. 10113>&1 byte x \b%c 10114 10115# big endian 101160 belong 0x67636461 GCC gcda coverage (-fprofile-arcs), 10117>&0 byte x version %c. 10118>&2 byte x \b%c (big-endian) 10119 10120 10121# LCOV tracefiles 10122# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php 101230 string TN: 10124>&0 search/64 \nSF:/ LCOV coverage tracefile 10125 10126 10127# Coverage reports generated by gcov 10128# i.e. source code annotated with coverage information 101290 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source: 10130>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph: 10131>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report 10132 10133 10134# LLVM coverage files 10135 10136# raw data after running a program compiled with: 10137# `clang -fprofile-instr-generate -fcoverage-mapping ...` 10138# default name: default.profraw 10139# magic is: \xFF lprofr \x81 10140# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 101410 lequad 0xff6c70726f667281 LLVM raw profile data, 10142>&0 byte x version %d 10143 10144# big endian 101450 bequad 0xff6c70726f667281 LLVM raw profile data, 10146>&7 byte x version %d (big-endian) 10147 10148 10149# LLVM indexed instruction profile (as generated by llvm-profdata) 10150# magic is: reverse(\xFF lprofi \x81) 10151# cf. https://llvm.org/docs/CoverageMappingFormat.html 10152# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html 10153# https://llvm.org/docs/CommandGuide/llvm-cov.html 10154# https://llvm.org/docs/CommandGuide/llvm-profdata.html 101550 lequad 0x8169666f72706cff LLVM indexed profile data, 10156>&0 byte x version %d 10157 10158# big endian 101590 bequad 0x8169666f72706cff LLVM indexed profile data, 10160>&7 byte x version %d (big-endian) 10161 10162 10163#------------------------------------------------------------------------------ 10164# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 10165# cracklib: file (1) magic for cracklib v2.7 10166 101670 lelong 0x70775631 Cracklib password index, little endian 10168>4 long >0 (%i words) 10169>4 long 0 ("64-bit") 10170>>8 long >-1 (%i words) 101710 belong 0x70775631 Cracklib password index, big endian 10172>4 belong >-1 (%i words) 10173# really bellong 0x0000000070775631 101740 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 10175>12 belong >0 (%i words) 10176 10177#------------------------------------------------------------------------------ 10178# $File: crypto,v 1.2 2021/03/27 20:15:53 christos Exp $ 10179# crypto: file(1) magic for crypto formats 10180# 10181 10182# ---------------------------------------------------------------------------- 10183# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 10184# ctags: file (1) magic for Exuberant Ctags files 10185# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 101860 search/1 =!_TAG Exuberant Ctags tag file text 10187 10188#-------------------------------------------------------------- 10189# ctf: file(1) magic for CTF (Common Trace Format) trace files 10190# 10191# Specs. available here: <https://www.efficios.com/ctf> 10192#-------------------------------------------------------------- 10193 10194# CTF trace data 101950 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 101960 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 10197 10198# CTF metadata (packetized) 101990 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 10200>35 byte x \b, v%d 10201>36 byte x \b.%d 102020 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 10203>35 byte x \b, v%d 10204>36 byte x \b.%d 10205 10206# CTF metadata (plain text) 102070 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 10208!:strength + 5 # this is to make sure we beat C 10209>&0 regex [0-9]+\\.[0-9]+ \b, v%s 10210 10211#------------------------------------------------------------------------------ 10212# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 10213# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 10214# 102150 string ACMP Map file for the AssaultCube FPS game 102160 string CUBE Map file for cube and cube2 engine games 102170 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 10218 10219#------------------------------------------------------------------------------ 10220# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $ 10221# Cups: file(1) magic for the cups raster file format 10222# From: Laurent Martelli <martellilaurent@gmail.com> 10223# https://www.cups.org/documentation.php/spec-raster.html 10224# 10225 102260 name cups-le 10227>280 lelong x \b, %d 10228>284 lelong x \bx%d dpi 10229>376 lelong x \b, %dx 10230>380 lelong x \b%d pixels 10231>388 lelong x %d bits/color 10232>392 lelong x %d bits/pixel 10233>400 lelong 0 ColorOrder=Chunky 10234>400 lelong 1 ColorOrder=Banded 10235>400 lelong 2 ColorOrder=Planar 10236>404 lelong 0 ColorSpace=gray 10237>404 lelong 1 ColorSpace=RGB 10238>404 lelong 2 ColorSpace=RGBA 10239>404 lelong 3 ColorSpace=black 10240>404 lelong 4 ColorSpace=CMY 10241>404 lelong 5 ColorSpace=YMC 10242>404 lelong 6 ColorSpace=CMYK 10243>404 lelong 7 ColorSpace=YMCK 10244>404 lelong 8 ColorSpace=KCMY 10245>404 lelong 9 ColorSpace=KCMYcm 10246>404 lelong 10 ColorSpace=GMCK 10247>404 lelong 11 ColorSpace=GMCS 10248>404 lelong 12 ColorSpace=WHITE 10249>404 lelong 13 ColorSpace=GOLD 10250>404 lelong 14 ColorSpace=SILVER 10251>404 lelong 15 ColorSpace=CIE XYZ 10252>404 lelong 16 ColorSpace=CIE Lab 10253>404 lelong 17 ColorSpace=RGBW 10254>404 lelong 18 ColorSpace=sGray 10255>404 lelong 19 ColorSpace=sRGB 10256>404 lelong 20 ColorSpace=AdobeRGB 10257 10258# Cups Raster image format, Big Endian 102590 string RaS 10260>3 string t Cups Raster version 1, Big Endian 10261>3 string 2 Cups Raster version 2, Big Endian 10262>3 string 3 Cups Raster version 3, Big Endian 10263!:mime application/vnd.cups-raster 10264>0 use \^cups-le 10265 10266 10267# Cups Raster image format, Little Endian 102681 string SaR 10269>0 string t Cups Raster version 1, Little Endian 10270>0 string 2 Cups Raster version 2, Little Endian 10271>0 string 3 Cups Raster version 3, Little Endian 10272!:mime application/vnd.cups-raster 10273>0 use cups-le 10274 10275#------------------------------------------------------------------------------ 10276# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 10277# dact: file(1) magic for DACT compressed files 10278# 102790 long 0x444354C3 DACT compressed data 10280>4 byte >-1 (version %i. 10281>5 byte >-1 $BS%i. 10282>6 byte >-1 $BS%i) 10283>7 long >0 $BS, original size: %i bytes 10284>15 long >30 $BS, block size: %i bytes 10285 10286#------------------------------------------------------------------------------ 10287# $File: database,v 1.67 2022/07/12 18:57:42 christos Exp $ 10288# database: file(1) magic for various databases 10289# 10290# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 10291# 10292# 10293# GDBM magic numbers 10294# Will be maintained as part of the GDBM distribution in the future. 10295# <downsj@teeny.org> 102960 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 10297!:mime application/x-gdbm 102980 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 10299!:mime application/x-gdbm 103000 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 10301!:mime application/x-gdbm 103020 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 10303!:mime application/x-gdbm 103040 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 10305!:mime application/x-gdbm 103060 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 10307!:mime application/x-gdbm 103080 string GDBM GNU dbm 2.x database 10309!:mime application/x-gdbm 10310# 10311# Berkeley DB 10312# 10313# Ian Darwin's file /etc/magic files: big/little-endian version. 10314# 10315# Hash 1.85/1.86 databases store metadata in network byte order. 10316# Btree 1.85/1.86 databases store the metadata in host byte order. 10317# Hash and Btree 2.X and later databases store the metadata in host byte order. 10318 103190 long 0x00061561 Berkeley DB 10320!:mime application/x-dbm 10321>8 belong 4321 10322>>4 belong >2 1.86 10323>>4 belong <3 1.85 10324>>4 belong >0 (Hash, version %d, native byte-order) 10325>8 belong 1234 10326>>4 belong >2 1.86 10327>>4 belong <3 1.85 10328>>4 belong >0 (Hash, version %d, little-endian) 10329 103300 belong 0x00061561 Berkeley DB 10331>8 belong 4321 10332>>4 belong >2 1.86 10333>>4 belong <3 1.85 10334>>4 belong >0 (Hash, version %d, big-endian) 10335>8 belong 1234 10336>>4 belong >2 1.86 10337>>4 belong <3 1.85 10338>>4 belong >0 (Hash, version %d, native byte-order) 10339 103400 long 0x00053162 Berkeley DB 1.85/1.86 10341>4 long >0 (Btree, version %d, native byte-order) 103420 belong 0x00053162 Berkeley DB 1.85/1.86 10343>4 belong >0 (Btree, version %d, big-endian) 103440 lelong 0x00053162 Berkeley DB 1.85/1.86 10345>4 lelong >0 (Btree, version %d, little-endian) 10346 1034712 long 0x00061561 Berkeley DB 10348>16 long >0 (Hash, version %d, native byte-order) 1034912 belong 0x00061561 Berkeley DB 10350>16 belong >0 (Hash, version %d, big-endian) 1035112 lelong 0x00061561 Berkeley DB 10352>16 lelong >0 (Hash, version %d, little-endian) 10353 1035412 long 0x00053162 Berkeley DB 10355>16 long >0 (Btree, version %d, native byte-order) 1035612 belong 0x00053162 Berkeley DB 10357>16 belong >0 (Btree, version %d, big-endian) 1035812 lelong 0x00053162 Berkeley DB 10359>16 lelong >0 (Btree, version %d, little-endian) 10360 1036112 long 0x00042253 Berkeley DB 10362>16 long >0 (Queue, version %d, native byte-order) 1036312 belong 0x00042253 Berkeley DB 10364>16 belong >0 (Queue, version %d, big-endian) 1036512 lelong 0x00042253 Berkeley DB 10366>16 lelong >0 (Queue, version %d, little-endian) 10367 10368# From Max Bowsher. 1036912 long 0x00040988 Berkeley DB 10370>16 long >0 (Log, version %d, native byte-order) 1037112 belong 0x00040988 Berkeley DB 10372>16 belong >0 (Log, version %d, big-endian) 1037312 lelong 0x00040988 Berkeley DB 10374>16 lelong >0 (Log, version %d, little-endian) 10375 10376# 10377# 10378# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 103790 string/b RRD\0 RRDTool DB 10380>4 string/b x version %s 10381 10382>>10 short !0 16bit aligned 10383>>>10 bedouble 8.642135e+130 big-endian 10384>>>>18 short x 32bit long (m68k) 10385 10386>>10 short 0 10387>>>12 long !0 32bit aligned 10388>>>>12 bedouble 8.642135e+130 big-endian 10389>>>>>20 long 0 64bit long 10390>>>>>20 long !0 32bit long 10391>>>>12 ledouble 8.642135e+130 little-endian 10392>>>>>24 long 0 64bit long 10393>>>>>24 long !0 32bit long (i386) 10394>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 10395>>>>>24 short !0 32bit long (arm) 10396 10397>>8 quad 0 64bit aligned 10398>>>16 bedouble 8.642135e+130 big-endian 10399>>>>24 long 0 64bit long (s390x) 10400>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 10401>>>16 ledouble 8.642135e+130 little-endian 10402>>>>28 long 0 64bit long (alpha/amd64/ia64) 10403>>>>28 long !0 32bit long (armel/mipsel) 10404 10405#---------------------------------------------------------------------- 10406# ROOT: file(1) magic for ROOT databases 10407# 104080 string root\0 ROOT file 10409>4 belong x Version %d 10410>33 belong x (Compression: %d) 10411 10412# XXX: Weak magic. 10413# Alex Ott <ott@jet.msk.su> 10414## Paradox file formats 10415#2 leshort 0x0800 Paradox 10416#>0x39 byte 3 v. 3.0 10417#>0x39 byte 4 v. 3.5 10418#>0x39 byte 9 v. 4.x 10419#>0x39 byte 10 v. 5.x 10420#>0x39 byte 11 v. 5.x 10421#>0x39 byte 12 v. 7.x 10422#>>0x04 byte 0 indexed .DB data file 10423#>>0x04 byte 1 primary index .PX file 10424#>>0x04 byte 2 non-indexed .DB data file 10425#>>0x04 byte 3 non-incrementing secondary index .Xnn file 10426#>>0x04 byte 4 secondary index .Ynn file 10427#>>0x04 byte 5 incrementing secondary index .Xnn file 10428#>>0x04 byte 6 non-incrementing secondary index .XGn file 10429#>>0x04 byte 7 secondary index .YGn file 10430#>>>0x04 byte 8 incrementing secondary index .XGn file 10431 10432## XBase database files 10433# updated by Joerg Jenderek at Feb 2013 10434# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 10435# https://www.clicketyclick.dk/databases/xbase/format/dbf.html 10436# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 104370 ubelong&0x0000FFFF <0x00000C20 10438!:strength +10 10439# skip Infocom game Z-machine 10440>2 ubyte >0 10441# skip Androids *.xml 10442>>3 ubyte >0 10443>>>3 ubyte <32 10444# 1 < version VV 10445>>>>0 ubyte >1 10446# skip HELP.CA3 by test for reserved byte ( NULL ) 10447>>>>>27 ubyte 0 10448# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 10449#>>>>>30 ubeshort x 30NULL?%x 10450# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 10451>>>>>>24 ubelong&0xffFFFFff >0x01302000 10452# .DBF or .MDX 10453>>>>>>24 ubelong&0xffFFFFff <0x01302001 10454# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 10455>>>>>>>24 ubelong&0xffFFFFff =0 10456# test for 2 reserved NULL bytes,transaction and encryption byte flag 10457>>>>>>>>12 ubelong&0xFFFFfEfE 0 10458# test for MDX flag 10459>>>>>>>>>28 ubyte x 10460>>>>>>>>>28 ubyte&0xf8 0 10461# header size >= 32 10462>>>>>>>>>>8 uleshort >31 10463# skip PIC15736.PCX by test for language driver name or field name 10464>>>>>>>>>>>32 ubyte >0 10465#!:mime application/x-dbf; charset=unknown-8bit ?? 10466#!:mime application/x-dbase 10467>>>>>>>>>>>>0 use xbase-type 10468# database file 10469>>>>>>>>>>>>28 ubyte&0x04 =0 \b DBF 10470!:ext dbf 10471>>>>>>>>>>>>28 ubyte&0x04 =4 \b DataBaseContainer 10472!:ext dbc 10473>>>>>>>>>>>>4 lelong 0 \b, no records 10474>>>>>>>>>>>>4 lelong >0 \b, %d record 10475# plural s appended 10476>>>>>>>>>>>>>4 lelong >1 \bs 10477# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 10478# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 10479>>>>>>>>>>>>10 uleshort x * %d 10480# file size = records * record size + header size 10481>>>>>>>>>>>>1 ubyte x \b, update-date 10482>>>>>>>>>>>>1 use xbase-date 10483# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 10484#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=%#x 10485# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 10486>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=%#x 10487#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 10488# MDX or CDX index 10489>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 10490>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 10491#>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 10492# 1st record offset + 1 = header size 10493>>>>>>>>>>>>8 uleshort >0 10494>>>>>>>>>>>>(8.s+1) ubyte >0 10495>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 10496>>>>>>>>>>>>>(8.s+1) ubyte >0 10497>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 10498# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 10499>>>>>>>24 ubelong&0x0133f7ff >0 10500# test for reserved NULL byte 10501>>>>>>>>47 ubyte 0 10502# test for valid TAG key format (0x10 or 0) 10503>>>>>>>>>559 ubyte&0xeF 0 10504# test MM <= 12 10505>>>>>>>>>>45 ubeshort <0x0C20 10506>>>>>>>>>>>45 ubyte >0 10507>>>>>>>>>>>>46 ubyte <32 10508>>>>>>>>>>>>>46 ubyte >0 10509#!:mime application/x-mdx 10510>>>>>>>>>>>>>>0 use xbase-type 10511>>>>>>>>>>>>>>0 ubyte x \b MDX 10512>>>>>>>>>>>>>>1 ubyte x \b, creation-date 10513>>>>>>>>>>>>>>1 use xbase-date 10514>>>>>>>>>>>>>>44 ubyte x \b, update-date 10515>>>>>>>>>>>>>>44 use xbase-date 10516# No.of tags in use (1,2,5,12) 10517>>>>>>>>>>>>>>28 uleshort x \b, %d 10518# No. of entries in tag (0x30) 10519>>>>>>>>>>>>>>25 ubyte x \b/%d tags 10520# Length of tag 10521>>>>>>>>>>>>>>26 ubyte x * %d 10522# 1st tag name_ 10523>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 10524# 2nd tag name 10525#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 10526# 10527# Print the xBase names of different version variants 105280 name xbase-type 10529>0 ubyte <2 10530# 1 < version 10531>0 ubyte >1 10532>>0 ubyte 0x02 FoxBase 10533!:mime application/x-dbf 10534# like: ACCESS.DBF USER.DBF dbase3date.dbf mitarbei.dbf produkte.dbf umlaut-test-v2.dbf 10535# FoxBase+/dBaseIII+, no memo 10536>>0 ubyte 0x03 FoxBase+/dBase III 10537!:mime application/x-dbf 10538# like: 92DATA.DBF MSCATLOG.DBF SYLLABI2.DBF SYLLABUS.DBF T4.DBF Teleadr.dbf us_city.dbf 10539# dBASE IV no memo file 10540>>0 ubyte 0x04 dBase IV 10541!:mime application/x-dbf 10542# like: Quattro-test11.dbf umlaut-test-v4.dbf 10543# dBASE V no memo file 10544>>0 ubyte 0x05 dBase V 10545!:mime application/x-dbf 10546# like: dbase4double.dbf Quattro-test2.dbf umlaut-test7.dbf 10547!:ext dbf 10548# probably Apollo Database Server 9.7? xBase (0x6) 10549>>0 ubyte 0x06 Apollo 10550!:mime application/x-dbf 10551# like: ALIAS.DBF CRYPT.DBF PROCS.DBF USERS.DBF 10552# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80) 10553>>0 ubyte 0x2F FoxBase+/Dbase III plus, no memo 10554!:mime application/x-dbf 10555# no example 10556>>0 ubyte 0x30 Visual FoxPro 10557!:mime application/x-dbf 10558# like: 26FRX.DBF 30DBC.DBF 30DBCPRO.DBF BEHINDSC.DBF USER_LEV.DBF 10559# Microsoft Visual FoxPro Database Container File like: FOXPRO-DB-TEST.DBC TESTDATA.DBC TASTRADE.DBC 10560>>0 ubyte 0x31 Visual FoxPro, autoincrement 10561!:mime application/x-dbf 10562# like: AI_Table.DBF dbase_31.dbf w_cityFoxpro.dbf 10563# Visual FoxPro, with field type Varchar or Varbinary 10564>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 10565!:mime application/x-dbf 10566# like: dbase_32.dbf 10567# dBASE IV SQL, no memo;dbv memo var size (Flagship) 10568>>0 ubyte 0x43 dBase IV, with SQL table 10569!:mime application/x-dbf 10570# like: ASSEMBLY.DBF INVENTRY.DBF STAFF.DBF 10571# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80) 10572>>0 ubyte 0x62 dBase IV, with SQL table 10573#!:mime application/x-dbf 10574# no example 10575# dBASE IV, with memo!! 10576>>0 ubyte 0x7b dBase IV, with memo 10577!:mime application/x-dbf 10578# like: test3memo.DBF dbase5.DBF 10579# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80) 10580>>0 ubyte 0x82 dBase IV, with SQL system 10581#!:mime application/x-dbf 10582# no example 10583# FoxBase+/dBaseIII+ with memo .DBT! 10584>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 10585!:mime application/x-dbf 10586# like: T2.DBF t3.DBF biblio.dbf dbase_83.dbf dbase3dbt0_4.dbf fsadress.dbf stop.dbf 10587# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 10588>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 10589!:mime application/x-dbf 10590# like: ACCESS.DBF dbase3date.dbf dbase3float.dbf holdings.dbf mitarbei.dbf 10591# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80) 10592>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 10593#!:mime application/x-dbf 10594# no example 10595# dBASE IV with memo! 10596>>0 ubyte 0x8B dBase IV, with memo .DBT 10597!:mime application/x-dbf 10598# like: animals.dbf archive.dbf callin.dbf dbase_8b.dbf phnebook.dbf t6.dbf 10599# dBase IV with SQL Table,no memo? 10600>>0 ubyte 0x8E dBase IV, with SQL table 10601!:mime application/x-dbf 10602# like: dbase5.DBF test3memo.DBF test-memo.DBF 10603# .dbv and .dbt memo (Flagship)? 10604>>0 ubyte 0xB3 Flagship 10605!:mime application/x-dbf 10606# no example 10607# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80) 10608>>0 ubyte 0xCA dBase IV with memo .DBT 10609#!:mime application/x-dbf 10610# no example 10611# dBASE IV with SQL table, with memo .DBT 10612>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 10613!:mime application/x-dbf 10614# like: dbase5.DBF test3memo.DBF test-memo.DBF 10615# HiPer-Six format;Clipper SIX, with SMT memo file 10616>>0 ubyte 0xE5 Clipper SIX with memo 10617!:mime application/x-dbf 10618# like: dbase5.DBF test3memo.DBF test-memo.DBF testClipper.dbf DATA.DBF 10619# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80) 10620>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 10621#!:mime application/x-dbf 10622# no example 10623>>0 ubyte 0xF5 FoxPro with memo 10624!:mime application/x-dbf 10625# like: CUSTOMER.DBF FOXUSER1.DBF Invoice.DBF NG.DBF OBJSAMP.DBF dbase_f5.dbf kunde.dbf 10626# probably Apollo Database Server 9.7 with SQL and memo mask? xBase (0xF6) 10627>>0 ubyte 0xF6 Apollo, with SQL table with memo 10628!:mime application/x-dbf 10629# like: SCRIPTS.DBF 10630# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80) 10631#>>0 ubyte 0xFA FoxPro 2.x, with memo 10632#!:mime application/x-dbf 10633# no example 10634# unknown version (should not happen) 10635>>0 default x xBase 10636!:mime application/x-dbf 10637>>>0 ubyte x (%#x) 10638# flags in version byte 10639# DBT flag (with dBASE III memo .DBT)!! 10640# >>0 ubyte&0x80 >0 DBT_FLAG=%x 10641# memo flag ?? 10642# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 10643# SQL flag ?? 10644# >>0 ubyte&0x70 >0 SQL_FLAG=%x 10645# test and print the date of xBase .DBF .MDX 106460 name xbase-date 10647# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 10648>0 ubelong x 10649>1 ubyte <13 10650>>1 ubyte >0 10651>>>2 ubyte >0 10652>>>>2 ubyte <32 10653>>>>>0 ubyte x 10654# YY is interpreted as 20YY or 19YY 10655>>>>>>0 ubyte <100 \b %.2d 10656# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 10657>>>>>>0 ubyte >99 \b %d 10658>>>>>1 ubyte x \b-%d 10659>>>>>2 ubyte x \b-%d 10660 10661# dBase memo files .DBT or .FPT 10662# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 1066316 ubyte <4 10664>16 ubyte !2 10665>>16 ubyte !1 10666# next free block index is positive 10667>>>0 ulelong >0 10668# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 10669>>>>17 ubelong&0xFFfdFEff 0x00000000 10670# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 10671>>>>>20 ubelong&0xFF01209B 0x00000000 10672# dBASE III 10673>>>>>>16 ubyte 3 10674# dBASE III DBT 10675>>>>>>>0 use dbase3-memo-print 10676# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 10677>>>>>>16 ubyte 0 10678# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 10679>>>>>>>20 uleshort 0 10680# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 10681>>>>>>>>8 ulong =0 10682>>>>>>>>>6 ubeshort >0 10683# skip emacs.PIF 10684>>>>>>>>>>4 ushort 0 10685# check for valid FoxPro field type 10686>>>>>>>>>>>512 ubelong <3 10687# skip LXMDCLN4.OUT LXMDCLN6.OUT LXMDALG6.OUT with invalid blocksize 170=AAh 10688>>>>>>>>>>>>6 ubeshort&0x002f 0 10689>>>>>>>>>>>>>0 use foxpro-memo-print 10690# dBASE III DBT , garbage 10691# skip WORD1XW.DOC with improbably high free block index 10692>>>>>>>>>0 ulelong <0x400000 10693# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item 10694>>>>>>>>>>513 ubyte >037 10695# skip DOS executables CPQ0TD.DRV E30ODI.COM IBM0MONO.DRV by looking for printable 1st character of 1st memo item 10696>>>>>>>>>>>512 ubyte >037 10697# unusual dBASE III DBT like adressen.dbt 10698>>>>>>>>>>>>0 use dbase3-memo-print 10699# dBASE III DBT like angest.dbt, or garbage PCX DBF 10700>>>>>>>>8 ubelong !0 10701# skip PCX and some DBF by test for for reserved NULL bytes 10702>>>>>>>>>510 ubeshort 0 10703# skip bad symples with improbably high free block index above 2 GiB file limit 10704>>>>>>>>>>0 ulelong <0x400000 10705# skip AI070GEP.EPS by printable 1st character of 1st memo item 10706>>>>>>>>>>>512 ubyte >037 10707# skip some Microsoft Visual C, OMF library like: BZ2.LIB WATTCPWL.LIB ZLIB.LIB 10708>>>>>>>>>>>>512 ubyte <0200 10709# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character 10710>>>>>>>>>>>>>513 ubyte >037 10711>>>>>>>>>>>>>>0 use dbase3-memo-print 10712# dBASE IV DBT with positive block size 10713>>>>>>>20 uleshort >0 10714# dBASE IV DBT with valid block length like 512, 1024 10715# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 10716# skip also 3600h 3E00h size 10717>>>>>>>>20 uleshort&0xE00f 0 10718>>>>>>>>>0 use dbase4-memo-print 10719 10720# Print the information of dBase III DBT memo file 107210 name dbase3-memo-print 10722>0 ubyte x dBase III DBT 10723!:mime application/x-dbt 10724!:ext dbt 10725# instead 3 as version number 0 for unusual examples like biblio.dbt 10726>16 ubyte !3 \b, version number %u 10727# Number of next available block for appending data 10728#>0 lelong =0 \b, next free block index %u 10729>0 lelong !0 \b, next free block index %u 10730# no positive block length 10731#>20 uleshort =0 \b, block length %u 10732>20 uleshort !0 \b, block length %u 10733# dBase III memo field terminated by \032\032 10734# like: "WHAT IS XBASE" test.dbt "Borges, Malte" biblio.dbt "First memo\032\032" T2.DBT 10735>512 string >\0 \b, 1st item "%s" 10736# For DEBUGGING 10737#>512 ubelong x \b, 1ST item %#8.8x 10738# https://www.clicketyclick.dk/databases/xbase/format/dbt.html 10739# Print the information of dBase IV DBT memo file 107400 name dbase4-memo-print 10741>0 lelong x dBase IV DBT 10742!:mime application/x-dbt 10743!:ext dbt 10744# 8 character shorted main name of corresponding dBASE IV DBF file 10745>8 ubelong >0x20000000 10746# skip unusual like for angest.dbt 10747>>20 uleshort >0 10748>>>8 string >\0 \b of %-.8s.DBF 10749# value 0 implies 512 as size 10750#>4 ulelong =0 \b, blocks size %u 10751# size of blocks not reliable like 0x2020204C in angest.dbt 10752>4 ulelong !0 10753>>4 ulelong&0x0000003f 0 \b, blocks size %u 10754# dBase IV DBT with positive block length (found 512 , 1024) 10755>20 uleshort >0 \b, block length %u 10756# next available block 10757#>0 lelong =0 \b, next free block index %u 10758>0 lelong !0 \b, next free block index %u 10759>20 uleshort >0 10760>>(20.s) ubelong x 10761>>>&-4 use dbase4-memofield-print 10762# unusual dBase IV DBT without block length (implies 512 as length) 10763>20 uleshort =0 10764>>512 ubelong x 10765>>>&-4 use dbase4-memofield-print 10766# Print the information of dBase IV memo field 107670 name dbase4-memofield-print 10768# free dBase IV memo field 10769>0 ubelong !0xFFFF0800 10770>>0 lelong x \b, next free block %u 10771>>4 lelong x \b, next used block %u 10772# used dBase IV memo field 10773>0 ubelong =0xFFFF0800 10774# length of memo field 10775>>4 lelong x \b, field length %d 10776>>>8 string >\0 \b, 1st used item "%s" 10777# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm 10778# Print the information of FoxPro FPT memo file 107790 name foxpro-memo-print 10780>0 belong x FoxPro FPT 10781!:mime application/x-fpt 10782!:ext fpt 10783# Size of blocks for FoxPro ( 64,256 ); probably a multiple of two 10784>6 ubeshort x \b, blocks size %u 10785# next available block 10786#>0 belong =0 \b, next free block index %u 10787>0 belong !0 \b, next free block index %u 10788# field type ( 0~picture, 1~memo, 2~object ) 10789>512 ubelong <3 \b, field type %u 10790# length of memo field 10791>512 ubelong 1 10792>>516 belong >0 \b, field length %d 10793>>>520 string >\0 \b, 1st item "%s" 10794 10795# Summary: DBASE Compound Index file *.CDX and FoxPro index *.IDX 10796# From: Joerg Jenderek 10797# URL: https://www.clicketyclick.dk/databases/xbase/format/cdx.html 10798# https://www.clicketyclick.dk/databases/xbase/format/idx.html 10799# https://www.clicketyclick.dk/databases/xbase/format/idx_comp.html 10800# Reference: https://mark0.net/download/triddefs_xml.7z/defs/s/sybase-ianywhere-cdx.trid.xml 10801# https://mark0.net/download/triddefs_xml.7z/defs/c/cdx-vfp7.trid.xml 10802# like: kunde.cdx 108030 ulelong 0x1C00 10804>0 use xbase-index 10805# like: SYLLABI2.CDX SYLLABUS.CDX 108060 ulelong 0x0800 10807>0 use xbase-index 10808# often in xBase index pointer to root node 400h 108090 ulelong 0x0400 10810# skip most Maple help database *.hdb with version tag handled by ./maple 10811>1028 string !version 10812# skip Maple help database hsum.hdb checking for valid reserved area 10813>>492 quad =0 10814# skip remaining Maple help database *.hdb by checking key length 10815#>>>12 uleshort !0x000F KEY_LENGTHVALID 10816>>>0 use xbase-index 10817# display information about dBase/FoxPro index 108180 name xbase-index 10819>0 ulelong x xBase 10820!:mime application/x-dbase-index 10821>14 ubyte &0x40 compound index 10822# DCX for FoxPro database index like: TESTDATA.DCX 10823!:ext cdx/dcx 10824>14 ubyte ^0x40 index 10825# only 1 example like: TEST.IDX 10826!:ext idx 10827# pointer to root node like: 1C00h 800h often 400h 10828>0 ulelong !0x400 \b, root pointer %#x 10829# Pointer to free node list: often 0 but -1 if not present 10830>4 ulelong !0 \b, free node pointer %#x 10831# MAYBE number of pages in file (Foxbase, FoxPro 1.x) or 10832# http://www.foxpert.com/foxpro/knowlbits/files/knowlbits_200708_1.HTM 10833# Whenever Visual FoxPro updates the index file it increments this reserved field 10834# Reserved for internal use like: 02000000h 03000000h 460c0000h 780f0000h 89000000h 9fdc0100h often 0 10835>8 ulelong !0 \b, reserved counter %#x 10836# length of key like: mostly 000Ah 0028h (TEST.IDX) 10837>12 uleshort !0x000A \b, key length %#x 10838# index options like: 24h E0h E8h 10839# 1~a unique index 8~index has FOR clause 32~compact index format 64~compound index header 10840# 16~Bit vector (SoftC) 128~Structure index (FoxPro) 10841>14 ubyte x \b, index options (%#x 10842>14 ubyte &0x01 \b, unique 10843>14 ubyte &0x08 \b, has FOR clause 10844>14 ubyte &0x10 \b, bit vector (SoftC) 10845>14 ubyte &0x20 \b, compact format 10846#>14 ubyte &0x40 \b, compound header 10847>14 ubyte &0x80 \b, structure 10848>14 ubyte x \b) 10849# WHAT EXACTLY IS THAT? index signature like: 0 (sybase-ianywhere-cdx.trid.xml) 1 (cdx-vfp7.trid.xml) 10850>15 ubyte !0 \b, index signature %u 10851# reserved area (0-bytes) til about 500, but not for uncompressed Index files *.idx 10852>16 quad !0 \b, at 16 reserved %#llx 10853>492 quad !0 \b, at 492 reserved %#llx 10854# for IDX variant 10855#>14 ubyte ^0x40 IDX 10856# for CDX variant 10857>14 ubyte &0x40 10858# Ascending or descending: 0~ascending 1~descending 10859>>502 uleshort x \b, sort order %u 10860# Total expression length (FoxPro 2) like: 0 1 10861>>504 uleshort !0 \b, expression length %u 10862# FOR expression pool length like: 1 10863>>506 uleshort !1 \b, FOR expression pool length %#x 10864# reserved for internal use like: 0 10865>>508 uleshort !0 \b, at 0x508 reserved %#x 10866# Key expression pool length like: 1 10867>>510 uleshort !1 \b, key expression pool length %#x 10868# 512 - 1023 Key & FOR expression pool (uncompiled) 10869>>512 quad !0 \b, key expression pool %#llx 10870#>>520 quad !0 \b, key expression pool %#llx 10871 10872# Summary: dBASE IV Printer Form *.PRF 10873# From: Joerg Jenderek 10874# URL: https://en.wikipedia.org/wiki/.dbf#Other_file_types_found_in_dBASE 10875# Reference: https://mark0.net/download/triddefs_xml.7z/defs/p/prf-dbase.trid.xml 108760 ubeshort 0x0400 10877# skip some Xbase Index files *.ndx and Infocom (Z-machine 4) *.z4 handled by ./adventure 10878# by looking for valid printer driver name extension 10879>0x58 search/8 .PR2 10880>>0 use xbase-prf 10881# display information of dbase print form like printer driver *.PR2 108820 name xbase-prf dBase Printer Form 10883!:mime application/x-dbase-prf 10884!:ext prf 10885# MAYBE version? like: 4~DBASE IV 10886#>0 ubyte x \b, version %u 10887# MAYBE flag like: 1~with output file name 0~not 10888#>2 ubyte !0 \b, flag %u 10889# optional printer text output file name like E:\DBASE\IV\T6.txt 10890>3 string >\0 \b, output file %s 10891# probably padding with nils til 0x53 10892#>0x48 uquad !0 \b, at 0x48 padding %#llx 10893# dBASE IV printer driver name like: Generic.PR2 ASCII.PR2 10894>0x56 string >\0 \b, using printer driver %s 10895# 2 is probably last character of previous dBASE printer driver name 10896#>0x60 ubyte !0x32 \b, at 0x60 %#x 10897# probably padding with nils til 0xa8 10898#>0x61 uquad !0 \b, at 0x61 padding %#llx 10899# unknown 0x03020300 0x03020100 at 0xa8 10900>0xa8 ubelong x \b, at 0xa8 unknown %#8.8x 10901# probably padding with nils til 0x2aa 10902#>0x2a0 uquad !0 \b, at 0x2a0 padding %#llx 10903# unknown 0x100ff7f01000001 at 0x2AB 10904>0x2ab ubequad !0x100ff7f01000001 \b, at 0x2ab unknown %#llx 10905# unknown 0x0042 at 0x2b3 10906>0x2b3 ubeshort !0x0042 \b, at 0x2b3 unknown %#4.4x 10907# unknown last 4 bytes at 0x2b6 like: 0 0x23 10908>0x2b6 ubelong !0 \b, at 0x2b6 unknown %#8.8x 10909 10910# TODO: 10911# DBASE index file *.NDX 10912# dBASE compiled Format *.FMO 10913# FoxPro Database memo file *.DCT 10914# FoxPro Forms Memo *.SCT 10915# FoxPro Generated Menu Program *.MPR 10916# FoxPro Report *.FRX 10917# FoxPro Report Memo *.FRT 10918# Foxpro Generated Screen Program *.SPR 10919# Foxpro memo *.PJT 10920## End of XBase database stuff 10921 10922# MS Access database 109234 string Standard\ Jet\ DB Microsoft Access Database 10924!:mime application/x-msaccess 109254 string Standard\ ACE\ DB Microsoft Access Database 10926!:mime application/x-msaccess 10927 10928# From: Joerg Jenderek 10929# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 10930# Reference: https://github.com/libyal/libesedb/archive/master.zip 10931# libesedb-master/documentation/ 10932# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 10933# Note: also known as "JET Blue". Used by numerous Windows components such as 10934# Windows Search, Mail, Exchange and Active Directory. 109354 ubelong 0xefcdab89 10936# unknown1 10937>132 ubelong 0 Extensible storage engine 10938!:mime application/x-ms-ese 10939# file_type 0~database 1~stream 10940>>12 ulelong 0 DataBase 10941# Security DataBase (sdb) 10942!:ext edb/sdb 10943>>12 ulelong 1 STreaMing 10944!:ext stm 10945# format_version 620h 10946>>8 uleshort x \b, version %#x 10947>>10 uleshort >0 revision %#4.4x 10948>>0 ubelong x \b, checksum %#8.8x 10949# Page size 4096 8192 32768 10950>>236 ulequad x \b, page size %lld 10951# database_state 10952>>52 ulelong 1 \b, JustCreated 10953>>52 ulelong 2 \b, DirtyShutdown 10954#>>52 ulelong 3 \b, CleanShutdown 10955>>52 ulelong 4 \b, BeingConverted 10956>>52 ulelong 5 \b, ForceDetach 10957# Windows NT major version when the databases indexes were updated. 10958>>216 ulelong x \b, Windows version %d 10959# Windows NT minor version 10960>>220 ulelong x \b.%d 10961 10962# From: Joerg Jenderek 10963# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility 10964# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 109658 string sdbf 10966>7 ubyte 0 10967# TAG_TYPE_LIST+TAG_INDEXES 10968>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 10969# version? 2 3 10970#>>>0 ulelong x \b, version %d 10971!:mime application/x-ms-sdb 10972!:ext sdb 10973 10974# TDB database from Samba et al - Martin Pool <mbp@samba.org> 109750 string TDB\ file TDB database 10976>32 lelong 0x2601196D version 6, little-endian 10977>>36 lelong x hash size %d bytes 10978 10979# SE Linux policy database 109800 lelong 0xf97cff8c SE Linux policy 10981>16 lelong x v%d 10982>20 lelong 1 MLS 10983>24 lelong x %d symbols 10984>28 lelong x %d ocons 10985 10986# ICE authority file data (Wolfram Kleff) 109872 string ICE ICE authority data 10988 10989# X11 Xauthority file (Wolfram Kleff) 1099010 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099111 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099212 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099313 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099414 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099515 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099616 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099717 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 1099818 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 10999 11000# From: Maxime Henrion <mux@FreeBSD.org> 11001# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 110020 string PGDMP PostgreSQL custom database dump 11003>5 byte x - v%d 11004>6 byte x \b.%d 11005>5 beshort <0x101 \b-0 11006>5 beshort >0x100 11007>>7 byte x \b-%d 11008 11009# Type: Advanced Data Format (ADF) database 11010# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ 11011# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 110120 string @(#)ADF\ Database CGNS Advanced Data Format 11013 11014# Tokyo Cabinet magic data 11015# http://tokyocabinet.sourceforge.net/index.html 110160 string ToKyO\ CaBiNeT\n Tokyo Cabinet 11017>14 string x \b (%s) 11018>32 byte 0 \b, Hash 11019!:mime application/x-tokyocabinet-hash 11020>32 byte 1 \b, B+ tree 11021!:mime application/x-tokyocabinet-btree 11022>32 byte 2 \b, Fixed-length 11023!:mime application/x-tokyocabinet-fixed 11024>32 byte 3 \b, Table 11025!:mime application/x-tokyocabinet-table 11026>33 byte &1 \b, [open] 11027>33 byte &2 \b, [fatal] 11028>34 byte x \b, apow=%d 11029>35 byte x \b, fpow=%d 11030>36 byte &0x01 \b, [large] 11031>36 byte &0x02 \b, [deflate] 11032>36 byte &0x04 \b, [bzip] 11033>36 byte &0x08 \b, [tcbs] 11034>36 byte &0x10 \b, [excodec] 11035>40 lequad x \b, bnum=%lld 11036>48 lequad x \b, rnum=%lld 11037>56 lequad x \b, fsiz=%lld 11038 11039# Type: QDBM Quick Database Manager 11040# From: Benoit Sibaud <bsibaud@april.org> 110410 string \\[depot\\]\n\f Quick Database Manager, little endian 110420 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 11043 11044# Type: TokyoCabinet database 11045# URL: http://tokyocabinet.sourceforge.net/ 11046# From: Benoit Sibaud <bsibaud@april.org> 110470 string ToKyO\ CaBiNeT\n TokyoCabinet database 11048>14 string x (version %s) 11049 11050# From: Stephane Blondon https://www.yaal.fr 11051# Database file for Zope (done by FileStorage) 110520 string FS21 Zope Object Database File Storage v3 (data) 110530 string FS30 Zope Object Database File Storage v4 (data) 11054 11055# Cache file for the database of Zope (done by ClientStorage) 110560 string ZEC3 Zope Object Database Client Cache File (data) 11057 11058# IDA (Interactive Disassembler) database 110590 string IDA1 IDA (Interactive Disassembler) database 11060 11061# Hopper (reverse engineering tool) https://www.hopperapp.com/ 110620 string hopperdb Hopper database 11063 11064# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 11065# Reference: http://www.provue.com/Panorama/ 11066# From: Joerg Jenderek 11067# NOTE: test only versions 4 and 6.0 with Windows 11068# length of Panorama database name 110695 ubyte >0 11070# look after database name for "some" null bits 11071>(5.B+7) ubelong&0xF3ffF000 0 11072# look for first keyword 11073>>&1 search/2 DESIGN Panorama database 11074#!:mime application/x-panorama-database 11075!:apple KASXZEPD 11076!:ext pan 11077# database name 11078>>>5 pstring x \b, "%s" 11079 11080# 11081# 11082# askSam Database by Stefan A. Haubenthal <polluks@web.de> 110830 string askw40\0 askSam DB 11084 11085# 11086# 11087# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 110880 string MBSTV\040 MUIbase DB 11089>6 string x version %s 11090 11091# 11092# CDB database 110930 string NBCDB\012 NetBSD Constant Database 11094>7 byte x \b, version %d 11095>8 string x \b, for '%s' 11096>24 lelong x \b, datasize %d 11097>28 lelong x \b, entries %d 11098>32 lelong x \b, index %d 11099>36 lelong x \b, seed %#x 11100 11101# 11102# Redis RDB - https://redis.io/topics/persistence 111030 string REDIS Redis RDB file, 11104>5 regex [0-9][0-9][0-9][0-9] version %s 11105 11106# Mork database. 11107# Used by older versions of Mozilla Suite and Firefox, 11108# and current versions of Thunderbird. 11109# From: David Korth <gerbilsoft@gerbilsoft.com> 111100 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database 11111>23 string x \b, version %.3s 11112 11113# URL: https://en.wikipedia.org/wiki/Management_Information_Format 11114# Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf 11115# From: Joerg Jenderek 11116# Note: only tested with monitor asset reports of Dell Display Manager 11117# skip start like Language=fr|CA|iso8859-1 111180 search/27/C Start\040Component DMI Management Information Format 11119#!:mime text/plain 11120!:mime text/x-dmtf-mif 11121!:ext mif 11122 11123 11124#------------------------------------------------------------------------------ 11125# $File: dataone,v 1.3 2022/04/18 21:38:10 christos Exp $ 11126# 11127# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> & 11128# Pratik Shrivastava <pratikshrivastava23@gmail.com> 11129# 11130# file formats: https://cn.dataone.org/cn/v2/formats 11131#------------------------------------------------------------------------------ 11132 11133# EML (Ecological Metadata Language Format) 111340 string \<?xml\ version= 11135>&0 regex/1024 eml-[0-9]\\.[0-9]\\.[0-9]+ eml://ecoinformatics.org/%s 11136 11137# onedcx (DataONE Dublin Core Extended v1.0) 11138>&0 regex/1024 onedcx/v[0-9]\\.[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0 11139 11140# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata, 11141# version 001-1998) 11142>&0 search/1024 fgdc FGDC-STD-001-1998 11143 11144# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0) 11145>&0 regex/1024 mercury/terms/v[0-9]\\.[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0 11146 11147# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language) 11148>&0 search/1024 isotc211 11149>>&0 search/1024 eng;USA https://www.isotc211.org/2005/gmd 11150 11151# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language) 11152>>&0 regex/1024 gov\\.noaa\\.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa 11153 11154# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language 11155>>&0 regex/1024 pangaea\\.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea 11156!:mime text/xml 11157 11158 11159# Object Reuse and Exchange Vocabulary 111600 string \<?xml\ version= 11161>&0 search/1024 rdf 11162>>&0 search/1024 openarchives https://www.openarchives.org/ore/terms 11163!:mime application/rdf+xml 11164 11165 11166# Dryad Metadata Application Profile Version 3.1 111670 string <DryadData 11168>&0 regex/1024 dryad-bibo/v[0-9]\\.[0-9] https://datadryad.org/profile/v3.1 11169!:mime text/xml 11170 11171#------------------------------------------------------------------------------ 11172# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $ 11173# dppf: Maxis Database Packed Files, the stored data file format used by all 11174# Maxis games after the Sims: http://wiki.niotso.org/DBPF 11175# https://www.wiki.sc4devotion.com/index.php?title=DBPF 11176# 13 Oct 2017, Kip Warner <kip at thevertigo dot com> 111770 string DBPF Maxis Database Packed File 11178>4 ulelong x \b, version: %u. 11179>>8 ulelong x \b%u 11180>>>36 ulelong x \b, files: %u 11181>>24 ledate !0 \b, created: %s 11182>>28 ledate !0 \b, modified: %s 11183!:ext dbpf/package/dat/sc4 11184!:mime application/x-maxis-dbpf 11185#------------------------------------------------------------------------------ 11186# $File: der,v 1.5 2022/07/30 18:07:34 christos Exp $ 11187# der: file(1) magic for DER encoded files 11188# 11189 11190# Certificate information piece 111910 name certinfo 11192>0 der seq 11193>>&0 der set 11194>>>&0 der seq 11195>>>>&0 der obj_id3=550406 11196>>>>&0 der prt_str=x \b, countryName=%s 11197>>&0 der set 11198>>>&0 der seq 11199>>>>&0 der obj_id3=550408 11200>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s 11201>>&0 der set 11202>>>&0 der seq 11203>>>>&0 der obj_id3=55040a 11204>>>>&0 der utf8_str=x \b, organizationName=%s 11205>>&0 der set 11206>>>&0 der seq 11207>>>>&0 der obj_id3=550403 11208>>>>&0 der utf8_str=x \b, commonName=%s 11209>>&0 der seq 11210 11211# Certificate requests 112120 der seq 11213>&0 der seq 11214>>&0 der int1=00 DER Encoded Certificate request 11215>>&0 use certinfo 11216 11217# Key Pairs 112180 der seq 11219>&0 der int1=00 11220>&0 der int65=x 11221>&0 der int3=010001 DER Encoded Key Pair, 512 bits 11222 112230 der seq 11224>&0 der int1=00 11225>&0 der int129=x 11226>&0 der int3=010001 DER Encoded Key Pair, 1024 bits 11227 112280 der seq 11229>&0 der int1=00 11230>&0 der int257=x 11231>&0 der int3=010001 DER Encoded Key Pair, 2048 bits 11232 112330 der seq 11234>&0 der int1=00 11235>&0 der int513=x 11236>&0 der int3=010001 DER Encoded Key Pair, 4096 bits 11237 112380 der seq 11239>&0 der int1=00 11240>&0 der int1025=x 11241>&0 der int3=010001 DER Encoded Key Pair, 8192 bits 11242 112430 der seq 11244>&0 der int1=00 11245>&0 der int2049=x 11246>&0 der int3=010001 DER Encoded Key Pair, 16k bits 11247 112480 der seq 11249>&0 der int1=00 11250>&0 der int4097=x 11251>&0 der int3=010001 DER Encoded Key Pair, 32k bits 11252 11253# Certificates 112540 der seq 11255>&0 der seq 11256>>&0 der int2=0dfa DER Encoded Certificate, 512 bits 11257>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits 11258>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits 11259>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits 11260>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits 11261>>&0 der int2=0dff DER Encoded Certificate, 16k bits 11262>>&0 der int2=0e04 DER Encoded Certificate, 32k bits 11263>>&0 der int2=x DER Encoded Certificate, ? bits (%s) 11264>>&0 der seq 11265>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption 11266>>>&0 der obj_id9=x \b, ? Encryption (%s) 11267>>>&0 der null 11268>>&0 der seq 11269>>>&0 der set 11270>>>>&0 der seq 11271>>>>>&0 der obj_id3=550406 11272>>>>>&0 der prt_str=x \b, countryName=%s 11273>>>&0 der set 11274>>>>&0 der seq 11275>>>>>&0 der obj_id3=550408 11276>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s 11277>>>&0 der set 11278>>>>&0 der seq 11279>>>>>&0 der obj_id3=550407 11280>>>>>&0 der prt_str=x \b, localityName=%s 11281>>>&0 der set 11282>>>>&0 der seq 11283>>>>>&0 der obj_id3=55040a 11284>>>>>&0 der prt_str=x \b, organizationName=%s 11285>>>&0 der set 11286>>>>&0 der seq 11287>>>>>&0 der obj_id3=55040b 11288>>>>>&0 der prt_str=x \b, organizationUnitName=%s 11289>>>&0 der set 11290>>>>&0 der seq 11291>>>>>&0 der obj_id3=550403 11292>>>>>&0 der prt_str=x \b, commonName=%s 11293>>>&0 der set 11294>>>>&0 der seq 11295>>>>>&0 der obj_id9=2a864886f70d010901 11296>>>>>&0 der ia5_str=x \b, emailAddress=%s 11297#>>&0 der seq 11298#>>>&0 der utc_time=x \b, utcTime=%s 11299#>>>&0 der utc_time=x \b, utcTime=%s 11300>>&0 use certinfo 11301 113020 der seq 11303>&0 der seq 11304>>&0 der eoc 11305>>>&0 der int1=02 Certificate, Version=3 11306>>>&0 der int1=x Certificate, Version=%s 11307>>&0 der int9=x \b, Serial=%s 11308>>&0 der seq 11309>>>&0 der obj_id9=2a864886f70d01010b 11310>>>&0 der null 11311>>&0 der seq 11312>>>&0 der set 11313>>>>&0 der seq 11314>>>>>&0 der obj_id3=550403 11315>>>>>&0 der utf8_str=x \b, Issuer=%s 11316#>>&0 der seq 11317#>>>&0 der utc_time=x \b, not-valid-before=%s 11318#>>>&0 der utc_time=x \b, not-valid-after=%s 11319>>&0 der seq 11320>>>&0 der set 11321>>>>&0 der seq 11322>>>>>&0 der obj_id3=550403 11323>>>>>&0 der utf8_str=x \b, Subject=%s 11324 11325#------------------------------------------------------------------------------ 11326# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 11327# diamond: file(1) magic for Diamond system 11328# 11329# ... diamond is a multi-media mail and electronic conferencing system.... 11330# 11331# XXX - I think it was either renamed Slate, or replaced by Slate.... 11332# 11333# The full deal is too long... 11334#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 113350 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 11336 11337#------------------------------------------------------------------------------ 11338# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $ 11339# dif: file(1) magic for DIF text files 11340 11341#------------------------------------------------------------------------------ 11342# From: Joerg Jenderek 11343# URL: http://en.wikipedia.org/wiki/Data_Interchange_Format 11344# http://fileformats.archiveteam.org/wiki/Data_Interchange_Format 11345# Note: called by TrID "Data Interchange Format", 11346# by DROID x-fmt/368 "VisiCalc Database" 113470 string TABLE 11348# skip text starting with TABLE by looking for numeric version on 2nd line 11349>6 search/2 0, 11350# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning 11351>>27 search/128 TUPLES Data Interchange Format 11352# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html 11353#!:mime application/x-dif-spreadsheet Gnumeric 11354# https://github.com/LibreOffice/online/blob/master/discovery.xml 11355#!:mime application/x-dif-document LibreOffice 11356# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats 11357!:mime application/x-dif 11358# https://extension.nirsoft.net/dif 11359#!:mime application/vnd.ms-excel 11360#!:mime text/plain 11361!:ext dif 11362# look for double quote 0x22 on 3rd line 11363>>>10 search/3 " 11364# skip if next character also double quote 11365>>>>&0 ubyte !0x22 \b, generator or table name 11366# comment like EXCEL, pwm enclosed in double quotes 11367>>>>>&-2 string x %s 11368 11369 11370#------------------------------------------------------------------------------ 11371# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $ 11372# diff: file(1) magic for diff(1) output 11373# 113740 search/1 diff\040 diff output text 11375!:mime text/x-diff 113760 search/1 ***\040 11377>&0 search/1024 \n---\040 context diff output text 11378!:mime text/x-diff 113790 search/1 Only\040in\040 diff output text 11380!:mime text/x-diff 113810 search/1 Common\040subdirectories:\040 diff output text 11382!:mime text/x-diff 11383 113840 search/1 Index: RCS/CVS diff output text 11385!:mime text/x-diff 11386 11387# bsdiff: file(1) magic for bsdiff(1) output 113880 string/b BSDIFF40 bsdiff(1) patch file 11389 11390 11391# unified diff 113920 search/4096 ---\040 11393>&0 search/1024 \n 11394>>&0 search/1 +++\040 11395>>>&0 search/1024 \n 11396>>>>&0 search/1 @@ unified diff output text 11397!:mime text/x-diff 11398!:strength + 90 11399 11400# librsync -- the library for network deltas 11401# 11402# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 11403# this file. 11404# 114050 belong 0x72730236 rdiff network-delta data 11406 114070 belong 0x72730136 rdiff network-delta signature data 11408>4 belong x (block length=%d, 11409>8 belong x signature strength=%d) 11410 11411#------------------------------------------------------------------------------ 11412# $File: digital,v 1.12 2021/07/03 14:01:46 christos Exp $ 11413# Digital UNIX - Info 11414# 114150 string =!<arch>\n________64E Alpha archive 11416>22 string X -- out of date 11417# 11418 114190 leshort 0603 11420>24 leshort 0410 COFF format alpha pure 11421>24 leshort 0413 COFF format alpha demand paged 11422>>22 leshort&030000 !020000 executable 11423>>22 leshort&020000 !0 dynamically linked 11424>>16 lelong !0 not stripped 11425>>16 lelong 0 stripped 11426>>27 byte x - version %d 11427>>26 byte x \b.%d 11428>>28 byte x \b-%d 11429>24 leshort 0407 COFF format alpha object 11430>>22 leshort&030000 020000 shared library 11431>>27 byte x - version %d 11432>>26 byte x \b.%d 11433>>28 byte x \b-%d 11434 11435# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 11436# 11437# The actual magic number is just "Core", followed by a 2-byte version 11438# number; however, treating any file that begins with "Core" as a Digital 11439# UNIX core dump file may produce too many false hits, so we include one 11440# byte of the version number as well; DU 5.0 appears only to be up to 11441# version 2. 11442# 114430 string Core\001 Alpha COFF format core dump (Digital UNIX) 11444>24 string >\0 \b, from '%s' 114450 string Core\002 Alpha COFF format core dump (Digital UNIX) 11446>24 string >\0 \b, from '%s' 11447# 11448# The next is incomplete, we could tell more about this format, 11449# but its not worth it. 114500 leshort 0x188 Alpha compressed COFF 114510 leshort 0x18f Alpha u-code object 11452# 11453# 11454# Some other interesting Digital formats, 114550 string \377\377\177 ddis/ddif 114560 string \377\377\174 ddis/dots archive 114570 string \377\377\176 ddis/dtif table data 114580 string \033c\033 LN03 output 114590 long 04553207 X image 11460# 114610 string =!<PDF>!\n profiling data file 11462# 11463# Locale data tables (MIPS and Alpha). 11464# 11465# GRR: line below is too general as it matches also TTComp archive, ASCII, 2K handled by ./archive 114660 short 0x0501 locale data table 11467>6 short 0x24 for MIPS 11468>6 short 0x40 for Alpha 11469 11470#------------------------------------------------------------------------------ 11471# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $ 11472# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 11473# from https://www.atsc.org/standards/a_52a.pdf 11474# corrections, additions, etc. are always welcome! 11475# 11476# syncword 114770 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 11478# Proposed audio/ac3 RFC/4184 11479!:mime audio/vnd.dolby.dd-raw 11480# fscod 11481>4 byte&0xc0 = 0x00 48 kHz, 11482>4 byte&0xc0 = 0x40 44.1 kHz, 11483>4 byte&0xc0 = 0x80 32 kHz, 11484# is this one used for 96 kHz? 11485>4 byte&0xc0 = 0xc0 reserved frequency, 11486# 11487>5 byte&0x07 = 0x00 \b, complete main (CM) 11488>5 byte&0x07 = 0x01 \b, music and effects (ME) 11489>5 byte&0x07 = 0x02 \b, visually impaired (VI) 11490>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 11491>5 byte&0x07 = 0x04 \b, dialogue (D) 11492>5 byte&0x07 = 0x05 \b, commentary (C) 11493>5 byte&0x07 = 0x06 \b, emergency (E) 11494>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 11495>5 beshort&0x07e0 >0x0720 \b, karaoke 11496# acmod 11497>6 byte&0xe0 = 0x00 1+1 front, 11498>>6 byte&0x10 = 0x10 LFE on, 11499>6 byte&0xe0 = 0x20 1 front/0 rear, 11500>>6 byte&0x10 = 0x10 LFE on, 11501>6 byte&0xe0 = 0x40 2 front/0 rear, 11502# dsurmod (for stereo only) 11503>>6 byte&0x18 = 0x00 Dolby Surround not indicated 11504>>6 byte&0x18 = 0x08 not Dolby Surround encoded 11505>>6 byte&0x18 = 0x10 Dolby Surround encoded 11506>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 11507>>6 byte&0x04 = 0x04 LFE on, 11508>6 byte&0xe0 = 0x60 3 front/0 rear, 11509>>6 byte&0x04 = 0x04 LFE on, 11510>6 byte&0xe0 = 0x80 2 front/1 rear, 11511>>6 byte&0x04 = 0x04 LFE on, 11512>6 byte&0xe0 = 0xa0 3 front/1 rear, 11513>>6 byte&0x01 = 0x01 LFE on, 11514>6 byte&0xe0 = 0xc0 2 front/2 rear, 11515>>6 byte&0x04 = 0x04 LFE on, 11516>6 byte&0xe0 = 0xe0 3 front/2 rear, 11517>>6 byte&0x01 = 0x01 LFE on, 11518# 11519>4 byte&0x3e = 0x00 \b, 32 kbit/s 11520>4 byte&0x3e = 0x02 \b, 40 kbit/s 11521>4 byte&0x3e = 0x04 \b, 48 kbit/s 11522>4 byte&0x3e = 0x06 \b, 56 kbit/s 11523>4 byte&0x3e = 0x08 \b, 64 kbit/s 11524>4 byte&0x3e = 0x0a \b, 80 kbit/s 11525>4 byte&0x3e = 0x0c \b, 96 kbit/s 11526>4 byte&0x3e = 0x0e \b, 112 kbit/s 11527>4 byte&0x3e = 0x10 \b, 128 kbit/s 11528>4 byte&0x3e = 0x12 \b, 160 kbit/s 11529>4 byte&0x3e = 0x14 \b, 192 kbit/s 11530>4 byte&0x3e = 0x16 \b, 224 kbit/s 11531>4 byte&0x3e = 0x18 \b, 256 kbit/s 11532>4 byte&0x3e = 0x1a \b, 320 kbit/s 11533>4 byte&0x3e = 0x1c \b, 384 kbit/s 11534>4 byte&0x3e = 0x1e \b, 448 kbit/s 11535>4 byte&0x3e = 0x20 \b, 512 kbit/s 11536>4 byte&0x3e = 0x22 \b, 576 kbit/s 11537>4 byte&0x3e = 0x24 \b, 640 kbit/s 11538 11539#------------------------------------------------------------ 11540# $File: dsf,v 1.1 2022/01/08 16:29:18 christos Exp $ 11541# dsf: file(1) magic for DSD Stream File 11542# URL: https://en.wikipedia.org/wiki/Direct_Stream_Digital 11543# Reference: https://dsd-guide.com/sites/default/files/white-papers/DSFFileFormatSpec_E.pdf 115440 string DSD\x20 DSD Stream File, 11545>0x30 leshort 1 mono, 11546>0x30 leshort 2 stereo, 11547>0x30 leshort 3 three-channel, 11548>0x30 leshort 4 quad-channel, 11549>0x30 leshort 5 3.1 4-channel, 11550>0x30 leshort 6 five-channel, 11551>0x30 leshort 7 5.1 surround, 11552>0x30 default x 11553>>0x30 leshort x unknown channel format (%d), 11554>0x38 lelong 2822400 simple-rate, 11555>0x38 lelong 5644800 double-rate, 11556>0x38 default x 11557>>0x38 lelong x %d Hz, 11558>0x3c leshort 1 1 bit, 11559>0x3c leshort 8 8 bit, 11560>0x3c default x 11561>>0x3c leshort x %d bit, 11562>0x40 lelong x %d samples 11563 11564#------------------------------------------------------------------------------ 11565# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $ 11566# dump: file(1) magic for dump file format--for new and old dump filesystems 11567# 11568# We specify both byte orders in order to recognize byte-swapped dumps. 11569# 115700 name new-dump-be 11571>4 bedate x This dump %s, 11572>8 bedate x Previous dump %s, 11573>12 belong >0 Volume %d, 11574>692 belong 0 Level zero, type: 11575>692 belong >0 Level %d, type: 11576>0 belong 1 tape header, 11577>0 belong 2 beginning of file record, 11578>0 belong 3 map of inodes on tape, 11579>0 belong 4 continuation of file record, 11580>0 belong 5 end of volume, 11581>0 belong 6 map of inodes deleted, 11582>0 belong 7 end of medium (for floppy), 11583>676 string >\0 Label %s, 11584>696 string >\0 Filesystem %s, 11585>760 string >\0 Device %s, 11586>824 string >\0 Host %s, 11587>888 belong >0 Flags %x 11588 115890 name old-dump-be 11590#>4 bedate x This dump %s, 11591#>8 bedate x Previous dump %s, 11592>12 belong >0 Volume %d, 11593>692 belong 0 Level zero, type: 11594>692 belong >0 Level %d, type: 11595>0 belong 1 tape header, 11596>0 belong 2 beginning of file record, 11597>0 belong 3 map of inodes on tape, 11598>0 belong 4 continuation of file record, 11599>0 belong 5 end of volume, 11600>0 belong 6 map of inodes deleted, 11601>0 belong 7 end of medium (for floppy), 11602>676 string >\0 Label %s, 11603>696 string >\0 Filesystem %s, 11604>760 string >\0 Device %s, 11605>824 string >\0 Host %s, 11606>888 belong >0 Flags %x 11607 116080 name ufs2-dump-be 11609>896 beqdate x This dump %s, 11610>904 beqdate x Previous dump %s, 11611>12 belong >0 Volume %d, 11612>692 belong 0 Level zero, type: 11613>692 belong >0 Level %d, type: 11614>0 belong 1 tape header, 11615>0 belong 2 beginning of file record, 11616>0 belong 3 map of inodes on tape, 11617>0 belong 4 continuation of file record, 11618>0 belong 5 end of volume, 11619>0 belong 6 map of inodes deleted, 11620>0 belong 7 end of medium (for floppy), 11621>676 string >\0 Label %s, 11622>696 string >\0 Filesystem %s, 11623>760 string >\0 Device %s, 11624>824 string >\0 Host %s, 11625>888 belong >0 Flags %x 11626 1162724 belong 60012 new-fs dump file (big endian), 11628>0 use new-dump-be 11629 1163024 belong 60011 old-fs dump file (big endian), 11631>0 use old-dump-be 11632 1163324 lelong 60012 new-fs dump file (little endian), 11634# to correctly recognize '*.mo' GNU message catalog (little endian) 11635!:strength - 15 11636>0 use \^new-dump-be 11637 1163824 lelong 60011 old-fs dump file (little endian), 11639>0 use \^old-dump-be 11640 11641 1164224 belong 0x19540119 new-fs dump file (ufs2, big endian), 11643>0 use ufs2-dump-be 11644 1164524 lelong 0x19540119 new-fs dump file (ufs2, little endian), 11646>0 use \^ufs2-dump-be 11647 1164818 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 11649>2 medate x Previous dump %s, 11650>6 medate x This dump %s, 11651>10 leshort >0 Volume %d, 11652>0 leshort 1 tape header. 11653>0 leshort 2 beginning of file record. 11654>0 leshort 3 map of inodes on tape. 11655>0 leshort 4 continuation of file record. 11656>0 leshort 5 end of volume. 11657>0 leshort 6 map of inodes deleted. 11658>0 leshort 7 end of medium (for floppy). 11659 11660#------------------------------------------------------------------------------ 11661# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $ 11662# Dyadic: file(1) magic for Dyalog APL. 11663# 11664# updated by Joerg Jenderek at Oct 2013 11665# https://en.wikipedia.org/wiki/Dyalog_APL 11666# https://www.dyalog.com/ 11667# .DXV Dyalog APL External Variable 11668# .DIN Dyalog APL Input Table 11669# .DOT Dyalog APL Output Table 11670# .DFT Dyalog APL Format File 116710 ubeshort&0xFF60 0xaa00 11672# skip biblio.dbt 11673>1 byte !4 11674# real Dyalog APL have non zero version numbers like 7.3 or 13.4 11675>>2 ubeshort >0x0000 Dyalog APL 11676>>>1 byte 0x00 aplcore 11677#>>>1 byte 0x00 incomplete workspace 11678# *.DCF Dyalog APL Component File 11679>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 11680#>>>1 byte 0x01 component file 11681>>>1 byte 0x02 external variable exclusive 11682#>>>1 byte 0x02 external variable 11683# *.DWS Dyalog APL Workspace 11684>>>1 byte 0x03 workspace 11685>>>>7 byte&0x28 0x00 32-bit 11686>>>>7 byte&0x28 0x20 64-bit 11687>>>>7 byte&0x0c 0x00 classic 11688>>>>7 byte&0x0c 0x04 unicode 11689>>>>7 byte&0x88 0x00 big-endian 11690>>>>7 byte&0x88 0x80 little-endian 11691>>>1 byte 0x06 external variable shared 11692# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 11693>>>1 byte 0x07 session 11694>>>1 byte 0x08 mapped file 32-bit 11695>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 11696>>>1 byte 0x0a mapped file 64-bit 11697>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 11698>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 11699>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 11700>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 11701>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 11702>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 11703>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 11704>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 11705>>>1 byte 0x13 component file 32-bit non-journaled checksummed 11706>>>1 byte 0x14 component file 64-bit non-journaled checksummed 11707>>>1 byte 0x15 component file under construction 11708>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed 11709>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed 11710>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed 11711>>>1 byte 0x19 external workspace 11712>>>1 byte 0x80 DDB 11713>>>2 byte x version %d 11714>>>3 byte x \b.%d 11715#>>>2 byte x type %d 11716#>>>3 byte x subtype %d 11717 11718# *.DXF Dyalog APL Transfer File 117190 short 0x6060 Dyalog APL transfer 11720 11721#------------------------------------------------------------------------------ 11722# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $ 11723# ebml: file(1) magic for various Extensible Binary Meta Language 11724# https://www.matroska.org/technical/specs/index.html#track 117250 belong 0x1a45dfa3 EBML file 11726>4 search/b/100 \102\202 11727>>&1 string x \b, creator %.8s 11728 11729#------------------------------------------------------------------------------ 11730# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $ 11731# edid: file(1) magic for EDID dump files 11732 117330 quad 0x00ffffffffffff00 Extended display identification data dump 11734!:mime application/x-edid-dump 11735>18 byte 0x01 Version 1 11736>>19 byte <0x04 \b.%d 11737>18 byte 0x02 Version 2 11738>>19 byte 0x00 \b.0 11739 11740#------------------------------------------------------------------------------ 11741# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $ 11742# T602 editor documents 11743# by David Necas <yeti@physics.muni.cz> 117440 string @CT\ T602 document data, 11745>4 string 0 Kamenicky 11746>4 string 1 CP 852 11747>4 string 2 KOI8-CS 11748>4 string >2 unknown encoding 11749 11750# Vi IMproved Encrypted file 11751# by David Necas <yeti@physics.muni.cz> 11752# updated by Osman Surkatty 117530 string VimCrypt~ Vim encrypted file data 11754>9 string 01! with zip cryptmethod 11755>9 string 02! with blowfish cryptmethod 11756>9 string 03! with blowfish2 cryptmethod 11757 117580 name vimnanoswap 11759>67 byte 0 11760>>107 byte 0 11761#>>>2 string x %s swap file 11762>>>24 ulelong x \b, pid %d 11763>>>28 string >\0 \b, user %s 11764>>>68 string >\0 \b, host %s 11765>>>108 string >\0 \b, file %s 11766>>>1007 byte 0x55 \b, modified 11767 11768# Vi IMproved Swap file 11769# by Sven Wegener <swegener@gentoo.org> 117700 string b0VIM\ Vim swap file 11771>&0 string >\0 \b, version %s 11772>0 use vimnanoswap 11773 11774 11775# Lock/swap file for several editors, at least 11776# Vi IMproved and nano 117770 string b0nano Nano swap file 11778>0 use vimnanoswap 11779 11780# kate (K Advanced Text Editor) 117810 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file 11782 11783#------------------------------------------------------------------------------ 11784# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $ 11785# efi: file(1) magic for Universal EFI binaries 11786 117870 lelong 0x0ef1fab9 11788>4 lelong 1 Universal EFI binary with 1 architecture 11789>>&0 lelong 7 \b, i386 11790>>&0 lelong 0x01000007 \b, x86_64 11791>4 lelong 2 Universal EFI binary with 2 architectures 11792>>&0 lelong 7 \b, i386 11793>>&0 lelong 0x01000007 \b, x86_64 11794>>&20 lelong 7 \b, i386 11795>>&20 lelong 0x01000007 \b, x86_64 11796>4 lelong >2 Universal EFI binary with %d architectures 11797 11798#------------------------------------------------------------------------------ 11799# $File: elf,v 1.87 2021/05/25 15:19:51 christos Exp $ 11800# elf: file(1) magic for ELF executables 11801# 11802# We have to check the byte order flag to see what byte order all the 11803# other stuff in the header is in. 11804# 11805# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 11806# 11807# Created by: unknown 11808# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 11809# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 11810# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 11811# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 11812# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 11813 118140 name elf-mips 11815>0 lelong&0xf0000000 0x00000000 MIPS-I 11816>0 lelong&0xf0000000 0x10000000 MIPS-II 11817>0 lelong&0xf0000000 0x20000000 MIPS-III 11818>0 lelong&0xf0000000 0x30000000 MIPS-IV 11819>0 lelong&0xf0000000 0x40000000 MIPS-V 11820>0 lelong&0xf0000000 0x50000000 MIPS32 11821>0 lelong&0xf0000000 0x60000000 MIPS64 11822>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 11823>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 11824>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 11825>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 11826 118270 name elf-sparc 11828>0 lelong&0x00ffff00 0x00000100 V8+ Required, 11829>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, 11830>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, 11831>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, 11832>0 lelong&0x3 0 total store ordering, 11833>0 lelong&0x3 1 partial store ordering, 11834>0 lelong&0x3 2 relaxed memory ordering, 11835 118360 name elf-pa-risc 11837>2 leshort 0x020b 1.0 11838>2 leshort 0x0210 1.1 11839>2 leshort 0x0214 2.0 11840>0 leshort &0x0008 (LP64) 11841 118420 name elf-riscv 11843>0 lelong&0x00000001 0x00000001 RVC, 11844>0 lelong&0x00000008 0x00000008 RVE, 11845>0 lelong&0x00000006 0x00000000 soft-float ABI, 11846>0 lelong&0x00000006 0x00000002 single-float ABI, 11847>0 lelong&0x00000006 0x00000004 double-float ABI, 11848>0 lelong&0x00000006 0x00000006 quad-float ABI, 11849 118500 name elf-le 11851>16 leshort 0 no file type, 11852!:mime application/octet-stream 11853>16 leshort 1 relocatable, 11854!:mime application/x-object 11855>16 leshort 2 executable, 11856!:mime application/x-executable 11857>16 leshort 3 ${x?pie executable:shared object}, 11858 11859!:mime application/x-${x?pie-executable:sharedlib} 11860>16 leshort 4 core file, 11861!:mime application/x-coredump 11862# OS-specific 11863>7 byte 202 11864>>16 leshort 0xFE01 executable, 11865!:mime application/x-executable 11866# Core file detection is not reliable. 11867#>>>(0x38+0xcc) string >\0 of '%s' 11868#>>>(0x38+0x10) lelong >0 (signal %d), 11869>16 leshort &0xff00 11870>>18 leshort !8 processor-specific, 11871>>18 leshort 8 11872>>>16 leshort 0xFF80 PlayStation 2 IOP module, 11873!:mime application/x-sharedlib 11874>>>16 leshort !0xFF80 processor-specific, 11875>18 clear x 11876>18 leshort 0 no machine, 11877>18 leshort 1 AT&T WE32100, 11878>18 leshort 2 SPARC, 11879>18 leshort 3 Intel 80386, 11880>18 leshort 4 Motorola m68k, 11881>>4 byte 1 11882>>>36 lelong &0x01000000 68000, 11883>>>36 lelong &0x00810000 CPU32, 11884>>>36 lelong 0 68020, 11885>18 leshort 5 Motorola m88k, 11886>18 leshort 6 Intel 80486, 11887>18 leshort 7 Intel 80860, 11888# The official e_machine number for MIPS is now #8, regardless of endianness. 11889# The second number (#10) will be deprecated later. For now, we still 11890# say something if #10 is encountered, but only gory details for #8. 11891>18 leshort 8 MIPS, 11892>>4 byte 1 11893>>>36 lelong &0x20 N32 11894>18 leshort 10 MIPS, 11895>>4 byte 1 11896>>>36 lelong &0x20 N32 11897>18 leshort 8 11898# only for 32-bit 11899>>4 byte 1 11900>>>36 use elf-mips 11901# only for 64-bit 11902>>4 byte 2 11903>>>48 use elf-mips 11904>18 leshort 9 Amdahl, 11905>18 leshort 10 MIPS (deprecated), 11906>18 leshort 11 RS6000, 11907>18 leshort 15 PA-RISC, 11908# only for 32-bit 11909>>4 byte 1 11910>>>36 use elf-pa-risc 11911# only for 64-bit 11912>>4 byte 2 11913>>>48 use elf-pa-risc 11914>18 leshort 16 nCUBE, 11915>18 leshort 17 Fujitsu VPP500, 11916>18 leshort 18 SPARC32PLUS, 11917# only for 32-bit 11918>>4 byte 1 11919>>>36 use elf-sparc 11920>18 leshort 19 Intel 80960, 11921>18 leshort 20 PowerPC or cisco 4500, 11922>18 leshort 21 64-bit PowerPC or cisco 7500, 11923>>48 lelong 0 Unspecified or Power ELF V1 ABI, 11924>>48 lelong 1 Power ELF V1 ABI, 11925>>48 lelong 2 OpenPOWER ELF V2 ABI, 11926>18 leshort 22 IBM S/390, 11927>18 leshort 23 Cell SPU, 11928>18 leshort 24 cisco SVIP, 11929>18 leshort 25 cisco 7200, 11930>18 leshort 36 NEC V800 or cisco 12000, 11931>18 leshort 37 Fujitsu FR20, 11932>18 leshort 38 TRW RH-32, 11933>18 leshort 39 Motorola RCE, 11934>18 leshort 40 ARM, 11935>>4 byte 1 11936>>>36 lelong&0xff000000 0x04000000 EABI4 11937>>>36 lelong&0xff000000 0x05000000 EABI5 11938>>>36 lelong &0x00800000 BE8 11939>>>36 lelong &0x00400000 LE8 11940>18 leshort 41 Alpha, 11941>18 leshort 42 Renesas SH, 11942>18 leshort 43 SPARC V9, 11943>>4 byte 2 11944>>>48 use elf-sparc 11945>18 leshort 44 Siemens Tricore Embedded Processor, 11946>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 11947>18 leshort 46 Renesas H8/300, 11948>18 leshort 47 Renesas H8/300H, 11949>18 leshort 48 Renesas H8S, 11950>18 leshort 49 Renesas H8/500, 11951>18 leshort 50 IA-64, 11952>18 leshort 51 Stanford MIPS-X, 11953>18 leshort 52 Motorola Coldfire, 11954>18 leshort 53 Motorola M68HC12, 11955>18 leshort 54 Fujitsu MMA, 11956>18 leshort 55 Siemens PCP, 11957>18 leshort 56 Sony nCPU, 11958>18 leshort 57 Denso NDR1, 11959>18 leshort 58 Start*Core, 11960>18 leshort 59 Toyota ME16, 11961>18 leshort 60 ST100, 11962>18 leshort 61 Tinyj emb., 11963>18 leshort 62 x86-64, 11964>18 leshort 63 Sony DSP, 11965>18 leshort 64 DEC PDP-10, 11966>18 leshort 65 DEC PDP-11, 11967>18 leshort 66 FX66, 11968>18 leshort 67 ST9+ 8/16 bit, 11969>18 leshort 68 ST7 8 bit, 11970>18 leshort 69 MC68HC16, 11971>18 leshort 70 MC68HC11, 11972>18 leshort 71 MC68HC08, 11973>18 leshort 72 MC68HC05, 11974>18 leshort 73 SGI SVx or Cray NV1, 11975>18 leshort 74 ST19 8 bit, 11976>18 leshort 75 Digital VAX, 11977>18 leshort 76 Axis cris, 11978>18 leshort 77 Infineon 32-bit embedded, 11979>18 leshort 78 Element 14 64-bit DSP, 11980>18 leshort 79 LSI Logic 16-bit DSP, 11981>18 leshort 80 MMIX, 11982>18 leshort 81 Harvard machine-independent, 11983>18 leshort 82 SiTera Prism, 11984>18 leshort 83 Atmel AVR 8-bit, 11985>18 leshort 84 Fujitsu FR30, 11986>18 leshort 85 Mitsubishi D10V, 11987>18 leshort 86 Mitsubishi D30V, 11988>18 leshort 87 NEC v850, 11989>18 leshort 88 Renesas M32R, 11990>18 leshort 89 Matsushita MN10300, 11991>18 leshort 90 Matsushita MN10200, 11992>18 leshort 91 picoJava, 11993>18 leshort 92 OpenRISC, 11994>18 leshort 93 Synopsys ARCompact ARC700 cores, 11995>18 leshort 94 Tensilica Xtensa, 11996>18 leshort 95 Alphamosaic VideoCore, 11997>18 leshort 96 Thompson Multimedia, 11998>18 leshort 97 NatSemi 32k, 11999>18 leshort 98 Tenor Network TPC, 12000>18 leshort 99 Trebia SNP 1000, 12001>18 leshort 100 STMicroelectronics ST200, 12002>18 leshort 101 Ubicom IP2022, 12003>18 leshort 102 MAX Processor, 12004>18 leshort 103 NatSemi CompactRISC, 12005>18 leshort 104 Fujitsu F2MC16, 12006>18 leshort 105 TI msp430, 12007>18 leshort 106 Analog Devices Blackfin, 12008>18 leshort 107 S1C33 Family of Seiko Epson, 12009>18 leshort 108 Sharp embedded, 12010>18 leshort 109 Arca RISC, 12011>18 leshort 110 PKU-Unity Ltd., 12012>18 leshort 111 eXcess: 16/32/64-bit, 12013>18 leshort 112 Icera Deep Execution Processor, 12014>18 leshort 113 Altera Nios II, 12015>18 leshort 114 NatSemi CRX, 12016>18 leshort 115 Motorola XGATE, 12017>18 leshort 116 Infineon C16x/XC16x, 12018>18 leshort 117 Renesas M16C series, 12019>18 leshort 118 Microchip dsPIC30F, 12020>18 leshort 119 Freescale RISC core, 12021>18 leshort 120 Renesas M32C series, 12022>18 leshort 131 Altium TSK3000 core, 12023>18 leshort 132 Freescale RS08, 12024>18 leshort 134 Cyan Technology eCOG2, 12025>18 leshort 135 Sunplus S+core7 RISC, 12026>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 12027>18 leshort 137 Broadcom VideoCore III, 12028>18 leshort 138 LatticeMico32, 12029>18 leshort 139 Seiko Epson C17 family, 12030>18 leshort 140 TI TMS320C6000 DSP family, 12031>18 leshort 141 TI TMS320C2000 DSP family, 12032>18 leshort 142 TI TMS320C55x DSP family, 12033>18 leshort 144 TI Programmable Realtime Unit 12034>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 12035>18 leshort 161 Cypress M8C, 12036>18 leshort 162 Renesas R32C series, 12037>18 leshort 163 NXP TriMedia family, 12038>18 leshort 164 QUALCOMM DSP6, 12039>18 leshort 165 Intel 8051 and variants, 12040>18 leshort 166 STMicroelectronics STxP7x family, 12041>18 leshort 167 Andes embedded RISC, 12042>18 leshort 168 Cyan eCOG1X family, 12043>18 leshort 169 Dallas MAXQ30, 12044>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 12045>18 leshort 171 M2000 Reconfigurable RISC, 12046>18 leshort 172 Cray NV2 vector architecture, 12047>18 leshort 173 Renesas RX family, 12048>18 leshort 174 META, 12049>18 leshort 175 MCST Elbrus, 12050>18 leshort 176 Cyan Technology eCOG16 family, 12051>18 leshort 177 NatSemi CompactRISC, 12052>18 leshort 178 Freescale Extended Time Processing Unit, 12053>18 leshort 179 Infineon SLE9X, 12054>18 leshort 180 Intel L1OM, 12055>18 leshort 181 Intel K1OM, 12056>18 leshort 183 ARM aarch64, 12057>18 leshort 185 Atmel 32-bit family, 12058>18 leshort 186 STMicroeletronics STM8 8-bit, 12059>18 leshort 187 Tilera TILE64, 12060>18 leshort 188 Tilera TILEPro, 12061>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 12062>18 leshort 190 NVIDIA CUDA architecture, 12063>18 leshort 191 Tilera TILE-Gx, 12064>18 leshort 195 Synopsys ARCv2/HS3x/HS4x cores, 12065>18 leshort 197 Renesas RL78 family, 12066>18 leshort 199 Renesas 78K0R, 12067>18 leshort 200 Freescale 56800EX, 12068>18 leshort 201 Beyond BA1, 12069>18 leshort 202 Beyond BA2, 12070>18 leshort 203 XMOS xCORE, 12071>18 leshort 204 Microchip 8-bit PIC(r), 12072>18 leshort 210 KM211 KM32, 12073>18 leshort 211 KM211 KMX32, 12074>18 leshort 212 KM211 KMX16, 12075>18 leshort 213 KM211 KMX8, 12076>18 leshort 214 KM211 KVARC, 12077>18 leshort 215 Paneve CDP, 12078>18 leshort 216 Cognitive Smart Memory, 12079>18 leshort 217 iCelero CoolEngine, 12080>18 leshort 218 Nanoradio Optimized RISC, 12081>18 leshort 243 UCB RISC-V, 12082# only for 32-bit 12083>>4 byte 1 12084>>>36 use elf-riscv 12085# only for 64-bit 12086>>4 byte 2 12087>>>48 use elf-riscv 12088>18 leshort 244 Lanai 32-bit processor, 12089>18 leshort 245 CEVA Processor Architecture Family, 12090>18 leshort 246 CEVA X2 Processor Family, 12091>18 leshort 247 eBPF, 12092>18 leshort 248 Graphcore Intelligent Processing Unit, 12093>18 leshort 249 Imagination Technologies, 12094>18 leshort 250 Netronome Flow Processor, 12095>18 leshort 251 NEC Vector Engine, 12096>18 leshort 252 C-SKY processor family, 12097>18 leshort 253 Synopsys ARCv3 64-bit ISA/HS6x cores, 12098>18 leshort 254 MOS Technology MCS 6502 processor, 12099>18 leshort 255 Synopsys ARCv3 32-bit, 12100>18 leshort 256 Kalray VLIW core of the MPPA family, 12101>18 leshort 257 WDC 65816/65C816, 12102>18 leshort 258 LoongArch, 12103>18 leshort 259 ChipON KungFu32, 12104>18 leshort 0x1057 AVR (unofficial), 12105>18 leshort 0x1059 MSP430 (unofficial), 12106>18 leshort 0x1223 Adapteva Epiphany (unofficial), 12107>18 leshort 0x2530 Morpho MT (unofficial), 12108>18 leshort 0x3330 FR30 (unofficial), 12109>18 leshort 0x3426 OpenRISC (obsolete), 12110>18 leshort 0x4688 Infineon C166 (unofficial), 12111>18 leshort 0x5441 Cygnus FRV (unofficial), 12112>18 leshort 0x5aa5 DLX (unofficial), 12113>18 leshort 0x7650 Cygnus D10V (unofficial), 12114>18 leshort 0x7676 Cygnus D30V (unofficial), 12115>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 12116>18 leshort 0x8472 OpenRISC (obsolete), 12117>18 leshort 0x9025 Cygnus PowerPC (unofficial), 12118>18 leshort 0x9026 Alpha (unofficial), 12119>18 leshort 0x9041 Cygnus M32R (unofficial), 12120>18 leshort 0x9080 Cygnus V850 (unofficial), 12121>18 leshort 0xa390 IBM S/390 (obsolete), 12122>18 leshort 0xabc7 Old Xtensa (unofficial), 12123>18 leshort 0xad45 xstormy16 (unofficial), 12124>18 leshort 0xbaab Old MicroBlaze (unofficial),, 12125>18 leshort 0xbeef Cygnus MN10300 (unofficial), 12126>18 leshort 0xdead Cygnus MN10200 (unofficial), 12127>18 leshort 0xf00d Toshiba MeP (unofficial), 12128>18 leshort 0xfeb0 Renesas M32C (unofficial), 12129>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 12130>18 leshort 0xfebb NIOS (unofficial), 12131>18 leshort 0xfeed Moxie (unofficial), 12132>18 default x 12133>>18 leshort x *unknown arch %#x* 12134>20 lelong 0 invalid version 12135>20 lelong 1 version 1 12136 121370 string \177ELF ELF 12138!:strength *2 12139>4 byte 0 invalid class 12140>4 byte 1 32-bit 12141>4 byte 2 64-bit 12142>5 byte 0 invalid byte order 12143>5 byte 1 LSB 12144>>0 use elf-le 12145>5 byte 2 MSB 12146>>0 use \^elf-le 12147>7 byte 0 (SYSV) 12148>7 byte 1 (HP-UX) 12149>7 byte 2 (NetBSD) 12150>7 byte 3 (GNU/Linux) 12151>7 byte 4 (GNU/Hurd) 12152>7 byte 5 (86Open) 12153>7 byte 6 (Solaris) 12154>7 byte 7 (Monterey) 12155>7 byte 8 (IRIX) 12156>7 byte 9 (FreeBSD) 12157>7 byte 10 (Tru64) 12158>7 byte 11 (Novell Modesto) 12159>7 byte 12 (OpenBSD) 12160>7 byte 13 (OpenVMS) 12161>7 byte 14 (HP NonStop Kernel) 12162>7 byte 15 (AROS Research Operating System) 12163>7 byte 16 (FenixOS) 12164>7 byte 17 (Nuxi CloudABI) 12165>7 byte 97 (ARM) 12166>7 byte 202 (Cafe OS) 12167>7 byte 255 (embedded) 12168 12169#------------------------------------------------------------------------------ 12170# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $ 12171# encore: file(1) magic for Encore machines 12172# 12173# XXX - needs to have the byte order specified (NS32K was little-endian, 12174# dunno whether they run the 88K in little-endian mode or not). 12175# 121760 short 0x154 Encore 12177>20 short 0x107 executable 12178>20 short 0x108 pure executable 12179>20 short 0x10b demand-paged executable 12180>20 short 0x10f unsupported executable 12181>12 long >0 not stripped 12182>22 short >0 - version %d 12183>22 short 0 - 12184#>4 date x stamp %s 121850 short 0x155 Encore unsupported executable 12186>12 long >0 not stripped 12187>22 short >0 - version %d 12188>22 short 0 - 12189#>4 date x stamp %s 12190 12191#------------------------------------------------------------------------------ 12192# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 12193# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 12194# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 12195# Useful information for improving this file can be found at: 12196# http://software.frodo.looijaard.name/psiconv/formats/Index.html 12197#------------------------------------------------------------------------------ 121980 lelong 0x10000037 Psion Series 5 12199>4 lelong 0x10000039 font file 12200>4 lelong 0x1000003A printer driver 12201>4 lelong 0x1000003B clipboard 12202>4 lelong 0x10000042 multi-bitmap image 12203!:mime image/x-epoc-mbm 12204>4 lelong 0x1000006A application information file 12205>4 lelong 0x1000006D 12206>>8 lelong 0x1000007D Sketch image 12207!:mime image/x-epoc-sketch 12208>>8 lelong 0x1000007E voice note 12209>>8 lelong 0x1000007F Word file 12210!:mime application/x-epoc-word 12211>>8 lelong 0x10000085 OPL program (TextEd) 12212!:mime application/x-epoc-opl 12213>>8 lelong 0x10000087 Comms settings 12214>>8 lelong 0x10000088 Sheet file 12215!:mime application/x-epoc-sheet 12216>>8 lelong 0x100001C4 EasyFax initialisation file 12217>4 lelong 0x10000073 OPO module 12218!:mime application/x-epoc-opo 12219>4 lelong 0x10000074 OPL application 12220!:mime application/x-epoc-app 12221>4 lelong 0x1000008A exported multi-bitmap image 12222>4 lelong 0x1000016D 12223>>8 lelong 0x10000087 Comms names 12224 122250 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 12226 122270 lelong 0x10000050 Psion Series 5 12228>4 lelong 0x1000006D database 12229>>8 lelong 0x10000084 Agenda file 12230!:mime application/x-epoc-agenda 12231>>8 lelong 0x10000086 Data file 12232!:mime application/x-epoc-data 12233>>8 lelong 0x10000CEA Jotter file 12234!:mime application/x-epoc-jotter 12235>4 lelong 0x100000E4 ini file 12236 122370 lelong 0x10000079 Psion Series 5 binary: 12238>4 lelong 0x00000000 DLL 12239>4 lelong 0x10000049 comms hardware library 12240>4 lelong 0x1000004A comms protocol library 12241>4 lelong 0x1000005D OPX 12242>4 lelong 0x1000006C application 12243>4 lelong 0x1000008D DLL 12244>4 lelong 0x100000AC logical device driver 12245>4 lelong 0x100000AD physical device driver 12246>4 lelong 0x100000E5 file transfer protocol 12247>4 lelong 0x100000E5 file transfer protocol 12248>4 lelong 0x10000140 printer definition 12249>4 lelong 0x10000141 printer definition 12250 122510 lelong 0x1000007A Psion Series 5 executable 12252 12253#------------------------------------------------------------------------------ 12254# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $ 12255# erlang: file(1) magic for Erlang JAM and BEAM files 12256# URL: https://www.erlang.org/faq/x779.html#AEN812 12257 12258# OTP R3-R4 122590 string \0177BEAM! Old Erlang BEAM file 12260>6 short >0 - version %d 12261 12262# OTP R5 and onwards 122630 string FOR1 12264>8 string BEAM Erlang BEAM file 12265 12266# 4.2 version may have a copyright notice! 122674 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 1226879 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 12269 122704 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 12271 122720 bequad 0x0000000000ABCDEF Erlang DETS file 12273 12274# $File: espressif,v 1.3 2021/04/26 15:56:00 christos Exp $ 12275# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif 12276# URL: https://github.com/arendst/Sonoff-Tasmota/ 12277# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/ 12278# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h 12279# From: Joerg Jenderek 12280# 12281# cfg_holder=4617=0x1209 122820 uleshort 4617 12283# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e 12284>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266) 12285!:mime application/x-tasmota-dmp 12286!:ext dmp 12287# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262 12288>>11 ubyte^0x65 x \b, version %u 12289>>10 ubyte^0x64 x \b.%u 12290>>9 ubyte^0x63 x \b.%u 12291>>8 ubyte^0x62 x \b.%u 12292#>8 ubelong x (%#x) 12293# hostname[33] XORed 12294>>0x165 ubyte^0x1BF x \b, hostname %c 12295>>0x166 ubyte^0x1C0 >037 \b%c 12296>>0x167 ubyte^0x1C1 >037 \b%c 12297>>0x168 ubyte^0x1C2 >037 \b%c 12298>>0x169 ubyte^0x1C3 >037 \b%c 12299>>0x16A ubyte^0x1C4 >037 \b%c 12300>>0x16B ubyte^0x1C5 >037 \b%c 12301>>0x16C ubyte^0x1C6 >037 \b%c 12302>>0x16D ubyte^0x1C7 >037 \b%c 12303>>0x16E ubyte^0x1C8 >037 \b%c 12304>>0x16F ubyte^0x1C9 >037 \b%c 12305>>0x170 ubyte^0x1CA >037 \b%c 12306>>0x171 ubyte^0x1CB >037 \b%c 12307>>0x172 ubyte^0x1CC >037 \b%c 12308>>0x173 ubyte^0x1CD >037 \b%c 12309>>0x174 ubyte^0x1CE >037 \b%c 12310>>0x175 ubyte^0x1CF >037 \b%c 12311>>0x176 ubyte^0x1D0 >037 \b%c 12312>>0x177 ubyte^0x1D1 >037 \b%c 12313>>0x178 ubyte^0x1D2 >037 \b%c 12314>>0x179 ubyte^0x1D3 >037 \b%c 12315>>0x17A ubyte^0x1D4 >037 \b%c 12316>>0x17B ubyte^0x1D5 >037 \b%c 12317>>0x17C ubyte^0x1D6 >037 \b%c 12318>>0x17D ubyte^0x1D7 >037 \b%c 12319>>0x17E ubyte^0x1D8 >037 \b%c 12320>>0x17F ubyte^0x1D9 >037 \b%c 12321>>0x180 ubyte^0x1DA >037 \b%c 12322>>0x181 ubyte^0x1DB >037 \b%c 12323>>0x182 ubyte^0x1DC >037 \b%c 12324>>0x183 ubyte^0x1DD >037 \b%c 12325>>0x184 ubyte^0x1DE >037 \b%c 12326>>0x185 ubyte^0x1DF >037 \b%c 12327#>>0x165 string x (%.33s) 12328 12329 12330 12331#------------------------------------------------------------------------------ 12332# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $ 12333# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 12334# Based on info from 12335# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 123360 belong 9994 ESRI Shapefile 12337>4 belong =0 12338>8 belong =0 12339>12 belong =0 12340>16 belong =0 12341>20 belong =0 12342>28 lelong x version %d 12343>24 belong x length %d 12344>32 lelong =0 type Null Shape 12345>32 lelong =1 type Point 12346>32 lelong =3 type PolyLine 12347>32 lelong =5 type Polygon 12348>32 lelong =8 type MultiPoint 12349>32 lelong =11 type PointZ 12350>32 lelong =13 type PolyLineZ 12351>32 lelong =15 type PolygonZ 12352>32 lelong =18 type MultiPointZ 12353>32 lelong =21 type PointM 12354>32 lelong =23 type PolyLineM 12355>32 lelong =25 type PolygonM 12356>32 lelong =28 type MultiPointM 12357>32 lelong =31 type MultiPatch 12358 12359#------------------------------------------------------------------------------ 12360# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 12361# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 12362# From Roger Leigh <roger@whinlatter.uklinux.net> 123630 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 123640 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 123650 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 12366 12367#------------------------------------------------------------------------------ 12368# $File: filesystems,v 1.150 2022/07/04 16:40:33 christos Exp $ 12369# filesystems: file(1) magic for different filesystems 12370# 123710 name partid 12372>0 ubyte 0x00 Unused 12373>0 ubyte 0x01 12-bit FAT 12374>0 ubyte 0x02 XENIX / 12375>0 ubyte 0x03 XENIX /usr 12376>0 ubyte 0x04 16-bit FAT, less than 32M 12377>0 ubyte 0x05 extended partition 12378>0 ubyte 0x06 16-bit FAT, more than 32M 12379>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 12380>0 ubyte 0x08 AIX or os, or etc. 12381>0 ubyte 0x09 AIX boot partition or Coherent 12382>0 ubyte 0x0a O/2 boot manager or Coherent swap 12383>0 ubyte 0x0b 32-bit FAT 12384>0 ubyte 0x0c 32-bit FAT, LBA-mapped 12385>0 ubyte 0x0d 7XXX, LBA-mapped 12386>0 ubyte 0x0e 16-bit FAT, LBA-mapped 12387>0 ubyte 0x0f extended partition, LBA-mapped 12388>0 ubyte 0x10 OPUS 12389>0 ubyte 0x11 OS/2 DOS 12-bit FAT 12390>0 ubyte 0x12 Compaq diagnostics 12391>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 12392>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 12393>0 ubyte 0x17 OS/2 hidden IFS 12394>0 ubyte 0x18 AST Windows swapfile 12395>0 ubyte 0x19 Willowtech Photon coS 12396>0 ubyte 0x1b hidden win95 fat 32 12397>0 ubyte 0x1c hidden win95 fat 32 lba 12398>0 ubyte 0x1d hidden win95 fat 16 lba 12399>0 ubyte 0x20 Willowsoft OFS1 12400>0 ubyte 0x21 reserved 12401>0 ubyte 0x23 reserved 12402>0 ubyte 0x24 NEC DOS 12403>0 ubyte 0x26 reserved 12404>0 ubyte 0x31 reserved 12405>0 ubyte 0x32 Alien Internet Services NOS 12406>0 ubyte 0x33 reserved 12407>0 ubyte 0x34 reserved 12408>0 ubyte 0x35 JFS on OS2 12409>0 ubyte 0x36 reserved 12410>0 ubyte 0x38 Theos 12411>0 ubyte 0x39 Plan 9, or Theos spanned 12412>0 ubyte 0x3a Theos ver 4 4gb partition 12413>0 ubyte 0x3b Theos ve 4 extended partition 12414>0 ubyte 0x3c PartitionMagic recovery 12415>0 ubyte 0x3d Hidden Netware 12416>0 ubyte 0x40 VENIX 286 or LynxOS 12417>0 ubyte 0x41 PReP 12418>0 ubyte 0x42 linux swap sharing DRDOS disk 12419>0 ubyte 0x43 linux sharing DRDOS disk 12420>0 ubyte 0x44 GoBack change utility 12421>0 ubyte 0x45 Boot US Boot manager 12422>0 ubyte 0x46 EUMEL/Elan or Ergos 3 12423>0 ubyte 0x47 EUMEL/Elan or Ergos 3 12424>0 ubyte 0x48 EUMEL/Elan or Ergos 3 12425>0 ubyte 0x4a ALFX/THIN filesystem for DOS 12426>0 ubyte 0x4c Oberon partition 12427>0 ubyte 0x4d QNX4.x 12428>0 ubyte 0x4e QNX4.x 2nd part 12429>0 ubyte 0x4f QNX4.x 3rd part 12430>0 ubyte 0x50 DM (disk manager) 12431>0 ubyte 0x51 DM6 Aux1 (or Novell) 12432>0 ubyte 0x52 CP/M or Microport SysV/AT 12433>0 ubyte 0x53 DM6 Aux3 12434>0 ubyte 0x54 DM6 DDO 12435>0 ubyte 0x55 EZ-Drive (disk manager) 12436>0 ubyte 0x56 Golden Bow (disk manager) 12437>0 ubyte 0x57 Drive PRO 12438>0 ubyte 0x5c Priam Edisk (disk manager) 12439>0 ubyte 0x61 SpeedStor 12440>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 12441>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 12442>0 ubyte 0x65 Novell Netware 3.xx 12443>0 ubyte 0x66 Novell 386 Netware 12444>0 ubyte 0x67 Novell 12445>0 ubyte 0x68 Novell 12446>0 ubyte 0x69 Novell 12447>0 ubyte 0x70 DiskSecure Multi-Boot 12448>0 ubyte 0x71 reserved 12449>0 ubyte 0x73 reserved 12450>0 ubyte 0x74 reserved 12451>0 ubyte 0x75 PC/IX 12452>0 ubyte 0x76 reserved 12453>0 ubyte 0x77 M2FS/M2CS partition 12454>0 ubyte 0x78 XOSL boot loader filesystem 12455>0 ubyte 0x80 MINIX until 1.4a 12456>0 ubyte 0x81 MINIX since 1.4b 12457>0 ubyte 0x82 Linux swap or Solaris 12458>0 ubyte 0x83 Linux native 12459>0 ubyte 0x84 OS/2 hidden C: drive 12460>0 ubyte 0x85 Linux extended partition 12461>0 ubyte 0x86 NT FAT volume set 12462>0 ubyte 0x87 NTFS volume set or HPFS mirrored 12463>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 12464>0 ubyte 0x8b Legacy Fault tolerant FAT32 12465>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 12466>0 ubyte 0x8d Hidden free FDISK FAT12 12467>0 ubyte 0x8e Linux Logical Volume Manager 12468>0 ubyte 0x90 Hidden free FDISK FAT16 12469>0 ubyte 0x91 Hidden free FDISK DOS EXT 12470>0 ubyte 0x92 Hidden free FDISK FAT16 Big 12471>0 ubyte 0x93 Amoeba filesystem 12472>0 ubyte 0x94 Amoeba bad block table 12473>0 ubyte 0x95 MIT EXOPC native partitions 12474>0 ubyte 0x97 Hidden free FDISK FAT32 12475>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 12476>0 ubyte 0x99 Mylex EISA SCSI 12477>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 12478>0 ubyte 0x9b Hidden free FDISK EXT LBA 12479>0 ubyte 0x9f BSDI? 12480>0 ubyte 0xa0 IBM Thinkpad hibernation 12481>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 12482>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 12483>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 12484>0 ubyte 0xa5 386BSD partition type 12485>0 ubyte 0xa6 OpenBSD partition type 12486>0 ubyte 0xa7 NeXTSTEP 486 12487>0 ubyte 0xa8 Apple UFS 12488>0 ubyte 0xa9 NetBSD partition type 12489>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 12490>0 ubyte 0xab Apple Boot 12491>0 ubyte 0xae SHAG OS filesystem 12492>0 ubyte 0xaf Apple HFS 12493>0 ubyte 0xb0 BootStar Dummy 12494>0 ubyte 0xb1 reserved 12495>0 ubyte 0xb3 reserved 12496>0 ubyte 0xb4 reserved 12497>0 ubyte 0xb6 reserved 12498>0 ubyte 0xb7 BSDI BSD/386 filesystem 12499>0 ubyte 0xb8 BSDI BSD/386 swap 12500>0 ubyte 0xbb Boot Wizard Hidden 12501>0 ubyte 0xbe Solaris 8 partition type 12502>0 ubyte 0xbf Solaris partition type 12503>0 ubyte 0xc0 CTOS 12504>0 ubyte 0xc1 DRDOS/sec (FAT-12) 12505>0 ubyte 0xc2 Hidden Linux 12506>0 ubyte 0xc3 Hidden Linux swap 12507>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 12508>0 ubyte 0xc5 DRDOS/sec (EXT) 12509>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 12510>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 12511>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 12512>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 12513>0 ubyte 0xca Reserved for DR-DOS 8.0+ 12514>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 12515>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 12516>0 ubyte 0xcd CTOS Memdump 12517>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 12518>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 12519>0 ubyte 0xd0 REAL/32 secure big partition 12520>0 ubyte 0xd1 Old Multiuser DOS FAT12 12521>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 12522>0 ubyte 0xd5 Old Multiuser DOS Extended 12523>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 12524>0 ubyte 0xd8 CP/M 86 12525>0 ubyte 0xdb CP/M or Concurrent CP/M 12526>0 ubyte 0xdd Hidden CTOS Memdump 12527>0 ubyte 0xde Dell PowerEdge Server utilities 12528>0 ubyte 0xdf DG/UX virtual disk manager 12529>0 ubyte 0xe0 STMicroelectronics ST AVFS 12530>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 12531>0 ubyte 0xe3 DOS R/O or Storage Dimensions 12532>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 12533>0 ubyte 0xe5 reserved 12534>0 ubyte 0xe6 reserved 12535>0 ubyte 0xeb BeOS 12536>0 ubyte 0xee GPT Protective MBR 12537>0 ubyte 0xef EFI system partition 12538>0 ubyte 0xf0 Linux PA-RISC boot loader 12539>0 ubyte 0xf1 SpeedStor or Storage Dimensions 12540>0 ubyte 0xf2 DOS 3.3+ Secondary 12541>0 ubyte 0xf3 reserved 12542>0 ubyte 0xf4 SpeedStor large partition 12543>0 ubyte 0xf5 Prologue multi-volumen partition 12544>0 ubyte 0xf6 reserved 12545>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 12546>0 ubyte 0xfa Bochs x86 emulator 12547>0 ubyte 0xfb VMware File System 12548>0 ubyte 0xfc VMware Swap 12549>0 ubyte 0xfd Linux RAID partition persistent sb 12550>0 ubyte 0xfe LANstep or IBM PS/2 IML 12551>0 ubyte 0xff Xenix Bad Block Table 12552 125530 string \366\366\366\366 PC formatted floppy with no filesystem 12554# Sun disk labels 12555# From /usr/include/sun/dklabel.h: 125560774 beshort 0xdabe 12557# modified by Joerg Jenderek, because original test 12558# succeeds for Cabinet archive dao360.dl_ with negative blocks 12559>0770 long >0 Sun disk label 12560>>0 string x '%s 12561>>>31 string >\0 \b%s 12562>>>>63 string >\0 \b%s 12563>>>>>95 string >\0 \b%s 12564>>0 string x \b' 12565>>0734 short >0 %d rpm, 12566>>0736 short >0 %d phys cys, 12567>>0740 short >0 %d alts/cyl, 12568>>0746 short >0 %d interleave, 12569>>0750 short >0 %d data cyls, 12570>>0752 short >0 %d alt cyls, 12571>>0754 short >0 %d heads/partition, 12572>>0756 short >0 %d sectors/track, 12573>>0764 long >0 start cyl %d, 12574>>0770 long x %d blocks 12575# Is there a boot block written 1 sector in? 12576>512 belong&077777777 0600407 \b, boot block present 12577 12578# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 12579# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 125800 string SBMBAKUP_ Smart Boot Manager backup file 12581>9 string x \b, version %-5.5s 12582>>14 string =_ 12583>>>15 string x %-.1s 12584>>>>16 string =_ \b. 12585>>>>>17 string x \b%-.1s 12586>>>>>>18 string =_ \b. 12587>>>>>>>19 string x \b%-.1s 12588>>>22 ubyte 0 12589>>>>21 ubyte x \b, from drive %#x 12590>>>22 ubyte >0 12591>>>>21 string x \b, from drive %s 12592>>>535 search/17 \x55\xAA 12593>>>>&-512 indirect x \b; contains 12594 12595# updated by Joerg Jenderek at Nov 2012 12596# DOS Emulator image is 128 byte, null right padded header + harddisc image 125970 string DOSEMU\0 12598>0x27E leshort 0xAA55 12599#offset is 128 12600>>19 ubyte 128 12601>>>(19.b-1) ubyte 0x0 DOS Emulator image 12602>>>>7 ulelong >0 \b, %u heads 12603>>>>11 ulelong >0 \b, %d sectors/track 12604>>>>15 ulelong >0 \b, %d cylinders 12605>>>>128 indirect x \b; contains 12606 12607# added by Joerg Jenderek at Nov 2012 12608# http://www.thenakedpc.com/articles/v04/08/0408-05.html 12609# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 126100 string PNCIHISK\0 Norton Utilities disc image data 12611# real x86 boot sector with jump instruction 12612>509 search/1026 \x55\xAA\xeb 12613>>&-1 indirect x \b; contains 12614# http://file-extension.net/seeker/file_extension_dat 126150 string PNCIUNDO Norton Disk Doctor UnDo file 12616# 12617 12618# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 12619# for any allowed sector sizes 1262030 search/481 \x55\xAA 12621# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 12622# DOS BPB information (70) and after DOS floppy (120) like in previous file version 12623!:strength +65 12624# for sector sizes < 512 Bytes 12625>11 uleshort <512 12626>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 12627# for sector sizes with 512 or more Bytes 12628>0x1FE leshort 0xAA55 DOS/MBR boot sector 12629 12630# ExFAT 126313 string/w =EXFAT 12632>0x1FE leshort 0xAA55 12633>>0x6E ubyte 1 12634>>>0x6F ubyte 0x80 12635>>>0 ubyte 0xEB DOS/MBR boot sector, 12636>>>0x69 ubyte x ExFAT Filesystem version %d. 12637>>>0x68 ubyte x \b%d 12638>>>0x6d ubyte x \b, (1<<%d) sectors per cluster 12639>>>0x48 ulequad x \b, sectors %lld 12640>>>0x64 ulelong x \b, serial number %#x 12641 12642# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 12643# only for sector sizes with 512 or more Bytes 126440x1FE leshort 0xAA55 DOS/MBR boot sector 12645# 12646# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 12647!:strength +65 12648>2 string OSBS OS/BS MBR 12649# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ 12650# and https://en.wikipedia.org/wiki/Master_Boot_Record 12651# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 12652# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 12653>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 12654# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 12655# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 12656>>8 ubequad 0x8bf45007501ffbfc 12657# https://thestarman.pcministry.com/asm/mbr/200MBR.htm 12658>>>0x16 ubyte 0xF3 \b,DOS 2 12659>>>>219 regex Author\ -\ Author: 12660# found "David Litton" , "A Pehrsson " 12661>>>>>&0 string x "%s" 12662>>>0x16 ubyte 0xF2 12663# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 12664# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 12665>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 12666# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 12667>>>>0x22 default x \b,D0S version 3.3-7.0 12668# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 12669# where nn is string offset varying for different languages 12670# "Invalid partition table" nn=0x8b for english version 12671>>>>>(0x49.b) string Invalid\ partition\ table english 12672>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 12673>>>>>(0x49.b) string Table\ de\ partition\ invalide french 12674>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 12675>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 12676>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 12677>>>>>0x49 ubyte >0 at offset %#x 12678>>>>>>(0x49.b) string >\0 "%s" 12679# "Error loading operating system" nn=0xa3 for english version 12680# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 12681# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 12682# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 12683# "Error al cargar sistema operativo" nn=0xa8 for spanish version 12684# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 12685>>>>>0x74 ubyte >0 at offset %#x 12686>>>>>>(0x74.b) string >\0 "%s" 12687# "Missing operating system" nn=0xc2 for english version 12688# "Betriebssystem fehlt" nn=0xcd for german version 12689# "Syst\212me d'exploitation absent" nn=0xd2 for french version 12690# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 12691# "Falta sistema operativo" nn=0xca for spanish version 12692# "Sistema operativo mancante" nn=0xe2 for italian version 12693>>>>>0x79 ubyte >0 at offset %#x 12694>>>>>>(0x79.b) string >\0 "%s" 12695# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 12696# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 12697>>8 ubequad 0x5007501ffcbe1b7c 12698# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 12699>>>24 ubequad 0xf3a4cbbebe07b104 9M 12700# "Invalid partition table" nn=0x10F for english version 12701# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 12702# "Table de partition erron\202e" nn=0x10F for french version 12703# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 12704>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 12705>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 12706>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 12707>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 12708>>>>0x3C ubyte x at offset %#x+0xFF 12709>>>>(0x3C.b+0x0FF) string >\0 "%s" 12710# "Error loading operating system" nn=0x127 for english version 12711# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 12712# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 12713# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 12714>>>>0xBD ubyte x at offset 0x1%x 12715>>>>(0xBD.b+0x100) string >\0 "%s" 12716# "Missing operating system" nn=0x146 for english version 12717# "Betriebssystem fehlt" nn=0x151 for german version 12718# "Syst\212me d'exploitation manquant" nn=0x15e for french version 12719# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 12720>>>>0xA9 ubyte x at offset 0x1%x 12721>>>>(0xA9.b+0x100) string >\0 "%s" 12722# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 12723# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 12724>>>24 ubequad 0xf3a4cbbdbe07b104 XP 12725# where xxyyzz are lower bits from offsets of error messages varying for different languages 12726>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 12727>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 12728# "Invalid partition table" xx=0x12C for english version 12729# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 12730>>>>0x1b5 ubyte >0 at offset 0x1%x 12731>>>>(0x1b5.b+0x100) string >\0 "%s" 12732# "Error loading operating system" yy=0x144 for english version 12733# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 12734>>>>0x1b6 ubyte >0 at offset 0x1%x 12735>>>>(0x1b6.b+0x100) string >\0 "%s" 12736# "Missing operating system" zz=0x163 for english version 12737# "Betriebssystem nicht vorhanden" zz=0x16e for german version 12738>>>>0x1b7 ubyte >0 at offset 0x1%x 12739>>>>(0x1b7.b+0x100) string >\0 "%s" 12740# Microsoft Windows Vista or 7 12741# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 12742>>8 ubequad 0xc08ed8be007cbf00 12743# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 12744# assembler instructions: jnz 0729;cmp ebx,"TCPA" 12745>>>0xEC ubequad 0x753b6681fb544350 Vista 12746# where xxyyzz are lower bits from offsets of error messages varying for different languages 12747>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 12748#>>>>0x1B4 ubelong&0x00FFFFFF ? german 12749# "Invalid partition table" xx=0x162 for english version 12750# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 12751>>>>0x1b5 ubyte >0 at offset 0x1%x 12752>>>>(0x1b5.b+0x100) string >\0 "%s" 12753# "Error loading operating system" yy=0x17a for english version 12754# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 12755>>>>0x1b6 ubyte >0 at offset 0x1%x 12756>>>>(0x1b6.b+0x100) string >\0 "%s" 12757# "Missing operating system" zz=0x199 for english version 12758# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 12759>>>>0x1b7 ubyte >0 at offset 0x1%x 12760>>>>(0x1b7.b+0x100) string >\0 "%s" 12761# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 12762# assembler instructions: cmp ebx,"TCPA";cmp 12763>>>0xEC ubequad 0x6681fb5443504175 Windows 7 12764# where xxyyzz are lower bits from offsets of error messages varying for different languages 12765>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 12766#>>>>0x1B4 ubelong&0x00FFFFFF ? german 12767# "Invalid partition table" xx=0x163 for english version 12768# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 12769>>>>0x1b5 ubyte >0 at offset 0x1%x 12770>>>>(0x1b5.b+0x100) string >\0 "%s" 12771# "Error loading operating system" yy=0x17b for english version 12772# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 12773>>>>0x1b6 ubyte >0 at offset 0x1%x 12774>>>>(0x1b6.b+0x100) string >\0 "%s" 12775# "Missing operating system" zz=0x19a for english version 12776# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 12777>>>>0x1b7 ubyte >0 at offset 0x1%x 12778>>>>(0x1b7.b+0x100) string >\0 "%s" 12779# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 12780# https://en.wikipedia.org/wiki/MBR_disk_signature#ID 12781>>0x1b8 ulelong >0 \b, disk signature %#-.4x 12782# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm 12783>>0xDA uleshort 0 12784>>>0xDC ulelong >0 \b, created 12785# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 12786>>>>0xDC ubyte x with driveID %#x 12787# hours, minutes and seconds 12788>>>>0xDf ubyte x at %x 12789>>>>0xDe ubyte x \b:%x 12790>>>>0xDd ubyte x \b:%x 12791# special case for Microsoft MS-DOS 3.21 spanish 12792# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 12793>0 ubequad 0xfab830008ed0bc00 12794# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 12795>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 12796# Microsoft MBR IPL end 12797 12798# dr-dos with some upper-, lowercase variants 12799>0x9D string Invalid\ partition\ table$ 12800>>181 string No\ Operating\ System$ 12801>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 12802>0x9D string Invalid\ partition\ table$ 12803>>181 string No\ operating\ system$ 12804>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 12805>342 string Invalid\ partition\ table$ 12806>>366 string No\ operating\ system$ 12807>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 12808>295 string NEWLDR\0 12809>>302 string Bad\ PT\ $ 12810>>>310 string No\ OS\ $ 12811>>>>317 string OS\ load\ err$ 12812>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 12813>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 12814>>>>>>>387 string Copyright\ (c)\ 1984,1998 12815>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 12816# 12817# tests for different MS-DOS Master Boot Records (MBR) moved and merged 12818# 12819#>0x145 string Default:\ F \b, FREE-DOS MBR 12820#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 12821>0x145 search/7 Default:\ F \b, FREE-DOS MBR 12822#>>313 string F0\ .\ .\ . 12823#>>>322 string disk\ 1 12824#>>>>382 string FAT3 12825>64 string no\ active\ partition\ found 12826>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 12827# Ranish Partition Manager http://www.ranish.com/part/ 12828>387 search/4 \0\ Error!\r 12829>>378 search/7 Virus! 12830>>>397 search/4 Booting\040 12831>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 12832>>>>>416 string Writing\ changes... \b2.37 12833>>>>>>438 ubyte x \b,%#x dots 12834>>>>>>440 ubyte >0 \b,virus check 12835>>>>>>441 ubyte >0 \b,partition %c 12836#2.38,2.42,2.44 12837>>>>>416 string !Writing\ changes... \b 12838>>>>>>418 ubyte 1 \bvirus check, 12839>>>>>>419 ubyte x \b%#x seconds 12840>>>>>>420 ubyte&0x0F >0 \b,partition 12841>>>>>>>420 ubyte&0x0F <5 \b %x 12842>>>>>>>420 ubyte&0x0F 0Xf \b ask 12843>>>>>420 ubyte x \b) 12844# 12845# SYSLINUX MBR moved 12846# https://www.acronis.de/ 12847>362 string MBR\ Error\ \0\r 12848>>376 string ress\ any\ key\ to\040 12849>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 12850# added by Joerg Jenderek 12851# https://www.visopsys.org/ 12852# https://partitionlogic.org.uk/ 12853>309 string No\ bootable\ partition\ found\r 12854>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 12855>349 string No\ bootable\ partition\ found\r 12856>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 12857# bootloader, bootmanager 12858>0x40 string SBML 12859# label with 11 characters of FAT 12 bit filesystem 12860>>43 string SMART\ BTMGR 12861>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 12862# OEM-ID not always "SBM" 12863#>>>>3 strings SBM 12864>>>>6 string >\0 \b, version %s 12865>382 string XOSLLOADXCF \b, eXtended Operating System Loader 12866>6 string LILO \b, LInux i386 boot LOader 12867>>120 string LILO \b, version 22.3.4 SuSe 12868>>172 string LILO \b, version 22.5.8 Debian 12869# updated by Joerg Jenderek at Oct 2008 12870# variables according to grub-0.97/stage1/stage1.S or 12871# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 12872# usual values are marked with comments to get only information of strange GRUB loaders 12873>342 search/60 \0Geom\0 12874#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 12875>>0x41 ubyte <2 12876>>>0x3E ubyte >2 \b; GRand Unified Bootloader 12877# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 12878>>>>0x3E ubyte x \b, stage1 version %#x 12879#If it is 0xFF, use a drive passed by BIOS 12880>>>>0x40 ubyte <0xFF \b, boot drive %#x 12881# in most case 0,1,0x2e for GRUB 0.5.95 12882>>>>0x41 ubyte >0 \b, LBA flag %#x 12883>>>>0x42 uleshort <0x8000 \b, stage2 address %#x 12884#>>>>0x42 uleshort =0x8000 \b, stage2 address %#x (usual) 12885>>>>0x42 uleshort >0x8000 \b, stage2 address %#x 12886#>>>>0x44 ulelong =1 \b, 1st sector stage2 %#x (default) 12887>>>>0x44 ulelong >1 \b, 1st sector stage2 %#x 12888>>>>0x48 uleshort <0x800 \b, stage2 segment %#x 12889#>>>>0x48 uleshort =0x800 \b, stage2 segment %#x (usual) 12890>>>>0x48 uleshort >0x800 \b, stage2 segment %#x 12891>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 12892>>>>>394 string stage1 \b, GRUB version 0.5.95 12893>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 12894>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 12895>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 12896>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 12897>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 12898>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 12899>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 12900>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 12901# unknown version 12902>>>343 string Geom\0Read\0\ Error\0 12903>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 12904>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 12905>>>>374 string GRUB\ \0 \b, GRUB version n.m 12906# SYSLINUX bootloader moved 12907>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 12908# http://www.bcdwb.de/bcdw/index_e.htm 12909>3 string BCDL 12910>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 12911# mbr partition table entries updated by Joerg Jenderek at Sep 2013 12912# skip Norton Utilities disc image data 12913>3 string !IHISK 12914# skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax; 12915>>0 belong !0xb8c0078e 12916# not Linux kernel 12917>>>514 string !HdrS 12918# not BeOS 12919>>>>422 string !Be\ Boot\ Loader 12920# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 12921>>>>>0 ubelong&0xFD000000 =0xE9000000 12922# AdvanceMAME mbr 12923>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 12924>>>>>>>446 use partition-table 12925# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 12926>>>>>0 ubelong&0xFD000000 !0xE9000000 12927# skip FSInfosector 12928>>>>>>0 string !RRaA 12929# skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 12930# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 12931>>>>>>>0 ubequad !0xfa660fb64610668b 12932# skip 13rd sector of MS x86 bootloader 12933>>>>>>>>0 ubequad !0x660fb64610668b4e 12934# skip sector starting with DOS new line 12935>>>>>>>>>0 string !\r\n 12936# allowed active flag 0,80h-FFh 12937>>>>>>>>>>446 ubyte 0 12938>>>>>>>>>>>446 use partition-table 12939>>>>>>>>>>446 ubyte >0x7F 12940>>>>>>>>>>>446 use partition-table 12941# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 12942# mbr partition table entries end 12943# https://www.acronis.de/ 12944#FAT label=ACRONIS\ SZ 12945#OEM-ID=BOOTWIZ0 12946>442 string Non-system\ disk,\040 12947>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 12948# updated by Joerg Jenderek at Nov 2012, Sep 2013 12949# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 12950# display 1 space 12951>>>447 ubyte x \b 12952>>>477 use DOS-filename 12953# 12954>185 string FDBOOT\ Version\040 12955>>204 string \rNo\ Systemdisk.\040 12956>>>220 string Booting\ from\ harddisk.\n\r 12957>>>245 string Cannot\ load\ from\ harddisk.\n\r 12958>>>>273 string Insert\ Systemdisk\040 12959>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 12960>>>>>>200 string >\0 \b, version %-3s 12961>242 string Bootsector\ from\ C.H.\ Hochst\204 12962# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 12963# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 12964# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 12965>242 search/127 Bootsector\ from\ C.H.\ Hochst 12966>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 12967# followed by variants with point,CR-NL or NL-CR 12968>>>208 search/261 Cannot\ load\ from\ harddisk. 12969# followed by variants CR-NL or NL-CR 12970>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 12971# followed by variants with point,CR-NL or NL-CR 12972>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 12973# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 12974>>>>>>&0 string x \b, version %-4.4s 12975>(1.b+2) ubyte 0xe 12976>>(1.b+3) ubyte 0x1f 12977>>>(1.b+4) ubyte 0xbe 12978# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 12979>>>>(1.b+5) ubyte&0xd3 0x53 12980>>>>>(1.b+6) ubyte 0x7c 12981# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 12982>>>>>>(1.b+7) ubyte 0xac 12983>>>>>>>(1.b+8) ubyte 0x22 12984>>>>>>>>(1.b+9) ubyte 0xc0 12985>>>>>>>>>(1.b+10) ubyte 0x74 12986>>>>>>>>>>(1.b+11) ubyte 0x0b 12987>>>>>>>>>>>(1.b+12) ubyte 0x56 12988>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 12989# FAT1X version 12990>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 12991>>>>>>>>>>>>>>0x5b string >\0 "%-s" 12992# FAT32 version 12993>>>>>>>>>>>>>(1.b+5) ubyte 0x77 12994>>>>>>>>>>>>>>0x77 string >\0 "%-s" 12995>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 12996#>>244 string from\ dosemu-freedos-*-bin.tgz\r 12997#>>>170 string Sorry,\ could\ not\ load\ an\040 12998#>>>>195 string operating\ system.\r\n 12999# 13000>103 string This\ is\ not\ a\ bootable\ disk.\040 13001>>132 string Please\ insert\ a\ bootable\040 13002>>>157 string floppy\ and\r\n 13003>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 13004# 13005>66 string Solaris\ Boot\ Sector 13006>>99 string Incomplete\ MDBoot\ load. 13007>>>89 string Version \b, Sun Solaris Bootloader 13008>>>>97 byte x version %c 13009# 13010>408 string OS/2\ !!\ SYS01475\r\0 13011>>429 string OS/2\ !!\ SYS02025\r\0 13012>>>450 string OS/2\ !!\ SYS02027\r\0 13013>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 13014# 13015>409 string OS/2\ !!\ SYS01475\r\0 13016>>430 string OS/2\ !!\ SYS02025\r\0 13017>>>451 string OS/2\ !!\ SYS02027\r\0 13018>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 13019>112 string This\ disk\ is\ not\ bootable\r 13020>>142 string If\ you\ wish\ to\ make\ it\ bootable 13021>>>176 string run\ the\ DOS\ program\ SYS\040 13022>>>200 string after\ the\r 13023>>>>216 string system\ has\ been\ loaded\r\n 13024>>>>>242 string Please\ insert\ a\ DOS\ diskette\040 13025>>>>>271 string into\r\n\ the\ drive\ and\040 13026>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 13027# XP 13028>430 string NTLDR\ is\ missing\xFF\r\n 13029>>449 string Disk\ error\xFF\r\n 13030>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 13031# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 13032>>>>417 ubyte&0xDF >0 13033>>>>>417 string x %-.5s 13034>>>>>>422 ubyte&0xDF >0 13035>>>>>>>422 string x \b%-.3s 13036>>>>>425 ubyte&0xDF >0 13037>>>>>>425 string >\ \b.%-.3s 13038# 13039>>>>371 ubyte >0x20 13040>>>>>368 ubyte&0xDF >0 13041>>>>>>368 string x %-.5s 13042>>>>>>>373 ubyte&0xDF >0 13043>>>>>>>>373 string x \b%-.3s 13044>>>>>>376 ubyte&0xDF >0 13045>>>>>>>376 string x \b.%-.3s 13046# 13047>430 string NTLDR\ nicht\ gefunden\xFF\r\n 13048>>453 string Datentr\204gerfehler\xFF\r\n 13049>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 13050>>>>417 ubyte&0xDF >0 13051>>>>>417 string x %-.5s 13052>>>>>>422 ubyte&0xDF >0 13053>>>>>>>422 string x \b%-.3s 13054>>>>>425 ubyte&0xDF >0 13055>>>>>>425 string >\ \b.%-.3s 13056# offset variant 13057>>>>379 string \0 13058>>>>>368 ubyte&0xDF >0 13059>>>>>>368 string x %-.5s 13060>>>>>>>373 ubyte&0xDF >0 13061>>>>>>>>373 string x \b%-.3s 13062# 13063>430 string NTLDR\ fehlt\xFF\r\n 13064>>444 string Datentr\204gerfehler\xFF\r\n 13065>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 13066>>>>417 ubyte&0xDF >0 13067>>>>>417 string x %-.5s 13068>>>>>>422 ubyte&0xDF >0 13069>>>>>>>422 string x \b%-.3s 13070>>>>>425 ubyte&0xDF >0 13071>>>>>>425 string >\ \b.%-.3s 13072# variant 13073>>>>371 ubyte >0x20 13074>>>>>368 ubyte&0xDF >0 13075>>>>>>368 string x %-.5s 13076>>>>>>>373 ubyte&0xDF >0 13077>>>>>>>>373 string x \b%-.3s 13078>>>>>>376 ubyte&0xDF >0 13079>>>>>>>376 string x \b.%-.3s 13080# 13081>430 string NTLDR\ fehlt\xFF\r\n 13082>>444 string Medienfehler\xFF\r\n 13083>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 13084>>>>371 ubyte >0x20 13085>>>>>368 ubyte&0xDF >0 13086>>>>>>368 string x %-.5s 13087>>>>>>>373 ubyte&0xDF >0 13088>>>>>>>>373 string x \b%-.3s 13089>>>>>>376 ubyte&0xDF >0 13090>>>>>>>376 string x \b.%-.3s 13091# variant 13092>>>>417 ubyte&0xDF >0 13093>>>>>417 string x %-.5s 13094>>>>>>422 ubyte&0xDF >0 13095>>>>>>>422 string x \b%-.3s 13096>>>>>425 ubyte&0xDF >0 13097>>>>>>425 string >\ \b.%-.3s 13098# 13099>430 string Datentr\204ger\ entfernen\xFF\r\n 13100>>454 string Medienfehler\xFF\r\n 13101>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 13102>>>>379 string \0 13103>>>>>368 ubyte&0xDF >0 13104>>>>>>368 string x %-.5s 13105>>>>>>>373 ubyte&0xDF >0 13106>>>>>>>>373 string x \b%-.3s 13107>>>>>>376 ubyte&0xDF >0 13108>>>>>>>376 string x \b.%-.3s 13109# variant 13110>>>>417 ubyte&0xDF >0 13111>>>>>417 string x %-.5s 13112>>>>>>422 ubyte&0xDF >0 13113>>>>>>>422 string x \b%-.3s 13114>>>>>425 ubyte&0xDF >0 13115>>>>>>425 string >\ \b.%-.3s 13116# 13117 13118#>3 string NTFS\ \ \ \040 13119>389 string Fehler\ beim\ Lesen\040 13120>>407 string des\ Datentr\204gers 13121>>>426 string NTLDR\ fehlt 13122>>>>440 string NTLDR\ ist\ komprimiert 13123>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 13124#>3 string NTFS\ \ \ \040 13125>313 string A\ disk\ read\ error\ occurred.\r 13126>>345 string A\ kernel\ file\ is\ missing\040 13127>>>370 string from\ the\ disk.\r 13128>>>>484 string NTLDR\ is\ compressed 13129>>>>>429 string Insert\ a\ system\ diskette\040 13130>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 13131# DOS loader variants different languages,offsets 13132>472 ubyte&0xDF >0 13133>>389 string Invalid\ system\ disk\xFF\r\n 13134>>>411 string Disk\ I/O\ error 13135>>>>428 string Replace\ the\ disk,\ and\040 13136>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 13137#IO.SYS 13138>>>>>>472 ubyte&0xDF >0 13139>>>>>>>472 string x \b %-.2s 13140>>>>>>>>474 ubyte&0xDF >0 13141>>>>>>>>>474 string x \b%-.5s 13142>>>>>>>>>>479 ubyte&0xDF >0 13143>>>>>>>>>>>479 string x \b%-.1s 13144>>>>>>>480 ubyte&0xDF >0 13145>>>>>>>>480 string x \b.%-.3s 13146#MSDOS.SYS 13147>>>>>>>483 ubyte&0xDF >0 \b+ 13148>>>>>>>>483 string x \b%-.5s 13149>>>>>>>>>488 ubyte&0xDF >0 13150>>>>>>>>>>488 string x \b%-.3s 13151>>>>>>>>491 ubyte&0xDF >0 13152>>>>>>>>>491 string x \b.%-.3s 13153# 13154>>390 string Invalid\ system\ disk\xFF\r\n 13155>>>412 string Disk\ I/O\ error\xFF\r\n 13156>>>>429 string Replace\ the\ disk,\ and\040 13157>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 13158>>388 string Ungueltiges\ System\ \xFF\r\n 13159>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 13160>>>>427 string Datentraeger\ wechseln\ und\040 13161>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 13162#WINBOOT.SYS only not spaces (0xDF) 13163>>>>>>497 ubyte&0xDF >0 13164>>>>>>>497 string x %-.5s 13165>>>>>>>>502 ubyte&0xDF >0 13166>>>>>>>>>502 string x \b%-.1s 13167>>>>>>>>>>503 ubyte&0xDF >0 13168>>>>>>>>>>>503 string x \b%-.1s 13169>>>>>>>>>>>>504 ubyte&0xDF >0 13170>>>>>>>>>>>>>504 string x \b%-.1s 13171>>>>>>505 ubyte&0xDF >0 13172>>>>>>>505 string x \b.%-.3s 13173#IO.SYS 13174>>>>>>472 ubyte&0xDF >0 or 13175>>>>>>>472 string x \b %-.2s 13176>>>>>>>>474 ubyte&0xDF >0 13177>>>>>>>>>474 string x \b%-.5s 13178>>>>>>>>>>479 ubyte&0xDF >0 13179>>>>>>>>>>>479 string x \b%-.1s 13180>>>>>>>480 ubyte&0xDF >0 13181>>>>>>>>480 string x \b.%-.3s 13182#MSDOS.SYS 13183>>>>>>>483 ubyte&0xDF >0 \b+ 13184>>>>>>>>483 string x \b%-.5s 13185>>>>>>>>>488 ubyte&0xDF >0 13186>>>>>>>>>>488 string x \b%-.3s 13187>>>>>>>>491 ubyte&0xDF >0 13188>>>>>>>>>491 string x \b.%-.3s 13189# 13190>>390 string Ungueltiges\ System\ \xFF\r\n 13191>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 13192>>>>429 string Datentraeger\ wechseln\ und\040 13193>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 13194#WINBOOT.SYS only not spaces (0xDF) 13195>>>>>>497 ubyte&0xDF >0 13196>>>>>>>497 string x %-.7s 13197>>>>>>>>504 ubyte&0xDF >0 13198>>>>>>>>>504 string x \b%-.1s 13199>>>>>>505 ubyte&0xDF >0 13200>>>>>>>505 string x \b.%-.3s 13201#IO.SYS 13202>>>>>>472 ubyte&0xDF >0 or 13203>>>>>>>472 string x \b %-.2s 13204>>>>>>>>474 ubyte&0xDF >0 13205>>>>>>>>>474 string x \b%-.6s 13206>>>>>>>480 ubyte&0xDF >0 13207>>>>>>>>480 string x \b.%-.3s 13208#MSDOS.SYS 13209>>>>>>>483 ubyte&0xDF >0 \b+ 13210>>>>>>>>483 string x \b%-.5s 13211>>>>>>>>>488 ubyte&0xDF >0 13212>>>>>>>>>>488 string x \b%-.3s 13213>>>>>>>>491 ubyte&0xDF >0 13214>>>>>>>>>491 string x \b.%-.3s 13215# 13216>>389 string Ungueltiges\ System\ \xFF\r\n 13217>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 13218>>>>428 string Datentraeger\ wechseln\ und\040 13219>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 13220# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 13221>>>>>>472 string x %-.2s 13222>>>>>>>474 ubyte&0xDF >0 13223>>>>>>>>474 string x \b%-.5s 13224>>>>>>>>479 ubyte&0xDF >0 13225>>>>>>>>>479 string x \b%-.1s 13226>>>>>>480 ubyte&0xDF >0 13227>>>>>>>480 string x \b.%-.3s 13228>>>>>>483 ubyte&0xDF >0 \b+ 13229>>>>>>>483 string x \b%-.5s 13230>>>>>>>488 ubyte&0xDF >0 13231>>>>>>>>488 string x \b%-.2s 13232>>>>>>>>490 ubyte&0xDF >0 13233>>>>>>>>>490 string x \b%-.1s 13234>>>>>>>491 ubyte&0xDF >0 13235>>>>>>>>491 string x \b.%-.3s 13236>479 ubyte&0xDF >0 13237>>416 string Kein\ System\ oder\040 13238>>>433 string Laufwerksfehler 13239>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 13240#IO.SYS 13241>>>>>479 string x \b %-.2s 13242>>>>>>481 ubyte&0xDF >0 13243>>>>>>>481 string x \b%-.6s 13244>>>>>487 ubyte&0xDF >0 13245>>>>>>487 string x \b.%-.3s 13246#MSDOS.SYS 13247>>>>>>490 ubyte&0xDF >0 \b+ 13248>>>>>>>490 string x \b%-.5s 13249>>>>>>>>495 ubyte&0xDF >0 13250>>>>>>>>>495 string x \b%-.3s 13251>>>>>>>498 ubyte&0xDF >0 13252>>>>>>>>498 string x \b.%-.3s 13253# 13254>376 search/41 Non-System\ disk\ or\040 13255>>395 search/41 disk\ error\r 13256>>>407 search/41 Replace\ and\040 13257>>>>419 search/41 press\ \b, 13258>>>>419 search/41 strike\ \b, old 13259>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 13260#449 Disk\ Boot\ failure\r MS 3.21 13261#466 Boot\ Failure\r MS 3.30 13262>>>>>468 search/18 \0 13263#IO.SYS,IBMBIO.COM 13264>>>>>>&0 string x \b %-.2s 13265>>>>>>>&-20 ubyte&0xDF >0 13266>>>>>>>>&-1 string x \b%-.4s 13267>>>>>>>>>&-16 ubyte&0xDF >0 13268>>>>>>>>>>&-1 string x \b%-.2s 13269>>>>>>&8 ubyte&0xDF >0 \b. 13270>>>>>>>&-1 string x \b%-.3s 13271#MSDOS.SYS,IBMDOS.COM 13272>>>>>>&11 ubyte&0xDF >0 \b+ 13273>>>>>>>&-1 string x \b%-.5s 13274>>>>>>>>&-6 ubyte&0xDF >0 13275>>>>>>>>>&-1 string x \b%-.1s 13276>>>>>>>>>>&-5 ubyte&0xDF >0 13277>>>>>>>>>>>&-1 string x \b%-.2s 13278>>>>>>>&7 ubyte&0xDF >0 \b. 13279>>>>>>>>&-1 string x \b%-.3s 13280>441 string Cannot\ load\ from\ harddisk.\n\r 13281>>469 string Insert\ Systemdisk\040 13282>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 13283#>43 string \224R-LOADER\ \ SYS =label 13284>54 string SYS 13285>>324 string VASKK 13286>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 13287# 13288>98 string Press\ a\ key\ to\ retry\0\r 13289>>120 string Cannot\ find\ file\ \0\r 13290>>>139 string Disk\ read\ error\0\r 13291>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 13292#DRBIOS.SYS 13293>>>>>44 ubyte&0xDF >0 13294>>>>>>44 string x \b %-.6s 13295>>>>>>>50 ubyte&0xDF >0 13296>>>>>>>>50 string x \b%-.2s 13297>>>>>>52 ubyte&0xDF >0 13298>>>>>>>52 string x \b.%-.3s 13299# 13300>70 string IBMBIO\ \ COM 13301>>472 string Cannot\ load\ DOS!\040 13302>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 13303>>471 string Cannot\ load\ DOS\040 13304>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 13305#?? 13306>444 string KERNEL\ \ SYS 13307>>314 string BOOT\ error! \b, FREE-DOS Bootloader 13308>499 string KERNEL\ \ SYS 13309>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 13310>449 string KERNEL\ \ SYS 13311>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 13312# 13313>449 string Loading\ FreeDOS 13314>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 13315>>>497 ubyte&0xDF >0 13316>>>>497 string x \b %-.6s 13317>>>>>503 ubyte&0xDF >0 13318>>>>>>503 string x \b%-.1s 13319>>>>>>>504 ubyte&0xDF >0 13320>>>>>>>>504 string x \b%-.1s 13321>>>>505 ubyte&0xDF >0 13322>>>>>505 string x \b.%-.3s 13323# 13324>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 13325# 13326>125 string Loading\ FreeDOS...\r 13327>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 13328>>>441 ubyte&0xDF >0 13329>>>>441 string x \b %-.6s 13330>>>>>447 ubyte&0xDF >0 13331>>>>>>447 string x \b%-.1s 13332>>>>>>>448 ubyte&0xDF >0 13333>>>>>>>>448 string x \b%-.1s 13334>>>>449 ubyte&0xDF >0 13335>>>>>449 string x \b.%-.3s 13336>124 string FreeDOS\0 13337>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 13338# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 13339>>>497 ubyte&0xDF >0 13340>>>>497 string x \b %-.6s 13341>>>>>503 ubyte&0xDF >0 13342>>>>>>503 string x \b%-.1s 13343>>>>>>>504 ubyte&0xDF >0 13344>>>>>>>>504 string x \b%-.1s 13345>>>>505 ubyte&0xDF >0 13346>>>>>505 string x \b.%-.3s 13347>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 13348>>>497 ubyte&0xDF >0 13349>>>>497 string x \b %-.6s 13350>>>>>503 ubyte&0xDF >0 13351>>>>>>503 string x \b%-.1s 13352>>>>>>>504 ubyte&0xDF >0 13353>>>>>>>>504 string x \b%-.1s 13354>>>>505 ubyte&0xDF >0 13355>>>>>505 string x \b.%-.3s 13356>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 13357>>>497 ubyte&0xDF >0 13358>>>>497 string x \b %-.6s 13359>>>>>503 ubyte&0xDF >0 13360>>>>>>503 string x \b%-.1s 13361>>>>>>>504 ubyte&0xDF >0 13362>>>>>>>>504 string x \b%-.1s 13363>>>>505 ubyte&0xDF >0 13364>>>>>505 string x \b.%-.3s 13365>336 string Error!\040 13366>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 13367>>>497 ubyte&0xDF >0 13368>>>>497 string x \b %-.6s 13369>>>>>503 ubyte&0xDF >0 13370>>>>>>503 string x \b%-.1s 13371>>>>>>>504 ubyte&0xDF >0 13372>>>>>>>>504 string x \b%-.1s 13373>>>>505 ubyte&0xDF >0 13374>>>>>505 string x \b.%-.3s 13375# added by Joerg Jenderek 13376# https://www.visopsys.org/ 13377# https://partitionlogic.org.uk/ 13378# OEM-ID=Visopsys 13379>478 ulelong 0 13380>>(1.b+326) string I/O\ Error\ reading\040 13381>>>(1.b+344) string Visopsys\ loader\r 13382>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 13383# http://alexfru.chat.ru/epm.html#bootprog 13384>494 ubyte >0x4D 13385>>495 string >E 13386>>>495 string <S 13387#OEM-ID is not reliable 13388>>>>3 string BootProg 13389# It just looks for a program file name at the root directory 13390# and loads corresponding file with following execution. 13391# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 13392>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 13393>>>>>499 use DOS-filename 13394#If the boot sector fails to read any other sector, 13395#it prints a very short message ("RE") to the screen and hangs the computer. 13396#If the boot sector fails to find needed program in the root directory, 13397#it also hangs with another message ("NF"). 13398>>>>>492 string RENF \b, FAT (12 bit) 13399>>>>>495 string RENF \b, FAT (16 bit) 13400#If the boot sector fails to read any other sector, 13401#it prints a very short message ("RE") to the screen and hangs the computer. 13402# x86 bootloader end 13403 13404# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 13405# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 13406>0 string RRaA 13407>>0x1E4 string rrAa \b, FSInfosector 13408#>>0x1FC uleshort =0 SHOULD BE ZERO 13409>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 13410>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 13411 13412# updated by Joerg Jenderek at Sep 2007 13413>3 ubyte 0 13414#no active flag 13415>>446 ubyte 0 13416# partition 1 not empty 13417>>>450 ubyte >0 13418# partitions 3,4 empty 13419>>>>482 ubyte 0 13420>>>>>498 ubyte 0 13421# partition 2 ID=0,5,15 13422>>>>>>466 ubyte <0x10 13423>>>>>>>466 ubyte 0x05 \b, extended partition table 13424>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 13425>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 13426 13427# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 13428 13429>0x200 lelong 0x82564557 \b, BSD disklabel 13430 13431# by Joerg Jenderek at Apr 2013 13432# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 13433# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 134340 name DOS-filename 13435# space=0x20 (00100000b) means empty 13436>0 ubyte&0xDF >0 13437>>0 ubyte x \b%c 13438>>>1 ubyte&0xDF >0 13439>>>>1 ubyte x \b%c 13440>>>>>2 ubyte&0xDF >0 13441>>>>>>2 ubyte x \b%c 13442>>>>>>>3 ubyte&0xDF >0 13443>>>>>>>>3 ubyte x \b%c 13444>>>>>>>>>4 ubyte&0xDF >0 13445>>>>>>>>>>4 ubyte x \b%c 13446>>>>>>>>>>>5 ubyte&0xDF >0 13447>>>>>>>>>>>>5 ubyte x \b%c 13448>>>>>>>>>>>>>6 ubyte&0xDF >0 13449>>>>>>>>>>>>>>6 ubyte x \b%c 13450>>>>>>>>>>>>>>>7 ubyte&0xDF >0 13451>>>>>>>>>>>>>>>>7 ubyte x \b%c 13452# DOS filename extension 13453>>8 ubyte&0xDF >0 \b. 13454>>>8 ubyte x \b%c 13455>>>>9 ubyte&0xDF >0 13456>>>>>9 ubyte x \b%c 13457>>>>>>10 ubyte&0xDF >0 13458>>>>>>>10 ubyte x \b%c 13459# Print 2 following DOS filenames from directory entry form 13460# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 134610 name 2xDOS-filename 13462# display 1 space 13463>0 ubyte x \b 13464>0 use DOS-filename 13465>11 ubyte x \b+ 13466>11 use DOS-filename 13467 13468# https://en.wikipedia.org/wiki/Master_boot_record#PTE 13469# display standard partition table 134700 name partition-table 13471#>0 ubyte x PARTITION-TABLE 13472# test and display 1st til 4th partition table entry 13473>0 use partition-entry-test 13474>16 use partition-entry-test 13475>32 use partition-entry-test 13476>48 use partition-entry-test 13477# test for entry of partition table 134780 name partition-entry-test 13479# partition type ID > 0 13480>4 ubyte >0 13481# active flag 0 13482>>0 ubyte 0 13483>>>0 use partition-entry 13484# active flag 0x80, 0x81, ... 13485>>0 ubyte >0x7F 13486>>>0 use partition-entry 13487# Print entry of partition table 134880 name partition-entry 13489# partition type ID > 0 13490>4 ubyte >0 \b; partition 13491>>64 leshort 0xAA55 1 13492>>48 leshort 0xAA55 2 13493>>32 leshort 0xAA55 3 13494>>16 leshort 0xAA55 4 13495>>4 ubyte x : ID=%#x 13496>>0 ubyte&0x80 0x80 \b, active 13497>>0 ubyte >0x80 %#x 13498>>1 ubyte x \b, start-CHS ( 13499>>1 use partition-chs 13500>>5 ubyte x \b), end-CHS ( 13501>>5 use partition-chs 13502>>8 ulelong x \b), startsector %u 13503>>12 ulelong x \b, %u sectors 13504# Print cylinder,head,sector (CHS) of partition entry 135050 name partition-chs 13506# cylinder 13507>1 ubyte x \b0x 13508>1 ubyte&0xC0 0x40 \b1 13509>1 ubyte&0xC0 0x80 \b2 13510>1 ubyte&0xC0 0xC0 \b3 13511>2 ubyte x \b%x 13512# head 13513>0 ubyte x \b,%u 13514# sector 13515>1 ubyte&0x3F x \b,%u 13516 13517# FATX 135180 string FATX FATX filesystem data 13519 13520# romfs filesystems - Juan Cespedes <cespedes@debian.org> 135210 string -rom1fs- romfs filesystem, version 1 13522>8 belong x %d bytes, 13523>16 string x named %s. 13524 13525# netboot image - Juan Cespedes <cespedes@debian.org> 135260 lelong 0x1b031336L Netboot image, 13527>4 lelong&0xFFFFFF00 0 13528>>4 lelong&0x100 0x000 mode 2 13529>>4 lelong&0x100 0x100 mode 3 13530>4 lelong&0xFFFFFF00 !0 unknown mode 13531 135320x18b string OS/2 OS/2 Boot Manager 13533 13534# updated by Joerg Jenderek at Oct 2008 and Sep 2012 13535# https://syslinux.zytor.com/iso.php 13536# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 13537# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 135380 ulequad&0x909000007cc0eafa 0x909000007c40eafa 13539>631 search/689 ISOLINUX\ isolinux Loader 13540>>&0 string x (version %-4.4s) 13541# https://syslinux.zytor.com/pxe.php 13542# assembler instructions: jmp 7C05 135430 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 13544# assembler instructions: pushfd;pushad 135450 ulelong 0x60669c66 pxelinux loader 13546# assembler instructions: jmp 05 135470 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 13548# https://syslinux.zytor.com/wiki/index.php/SYSLINUX 135490 string LDLINUX\ SYS\ SYSLINUX loader 13550>12 string x (older version %-4.4s) 135510 string \r\nSYSLINUX\ SYSLINUX loader 13552>11 string x (version %-4.4s) 13553# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 13554# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 135550 ulelong&0x80909bEB 0x009018EB 13556# OEM-ID not always "SYSLINUX" 13557>434 search/47 Boot\ failed 13558# followed by \r\n\0 or :\ 13559>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 13560>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 13561>459 search/30 Boot\ error\r\n\0 13562>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 13563# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 13564# assembler instructions: mov di,0600h;mov cx,0100h 1356516 search/4 \xbf\x00\x06\xb9\x00\x01 13566# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 13567!:strength +36 13568>94 search/249 Missing\ operating\ system 13569# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 13570# skip Ranish MBR 13571>>408 search/4 HD1/\0 13572>>408 default x 13573>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 13574# followed by "ing " or space 13575>>>>292 search/98 error 13576>>>>>&0 string \r (version 3.35 or older) 13577>>>>>&0 string .\r (version 3.52 or newer) 13578>>>>>&0 default x (version 3.36-3.51 ) 13579>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 13580>>156 search/10 \0Boot\ partition\ not\ found\r\n 13581>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 13582>>174 search/10 \0Missing\ OS\r\n 13583>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 13584# SYSLINUX END 13585 13586# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 13587# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 135880 ubequad 0x31c08ed0bc007c8e 13589# mbr_bootsel magic before partition table not reliable with small ipl fragments 13590#>444 uleshort 0xb5e1 13591>0004 uleshort x 13592# ERRorTeXT 13593>>181 search/166 Error\ \0\r\n NetBSD mbr 13594# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 13595>>>0x1B8 ubelong >0 \b,Serial %#-.8x 13596# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 13597>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 13598# BOOT_EXTENDED definitions contains assembler instructions: 13599# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 13600>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 13601# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 13602>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 13603# not TERSE_ERROR 13604>>>196 search/106 No\ active\ partition\0 13605>>>>&0 string Disk\ read\ error\0 13606>>>>>&0 string No\ operating\ system\0 \b,verbose 13607# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 13608>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 13609# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 13610>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 13611# assembler instructions: movw nametab,bx 13612>>>0x26 search/21 \xBB\x94\x07 13613# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 13614>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 13615>>>>>181 search/166 Error\ \0 13616# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 13617>>>>>>&3 string x \b,"%s" 13618>>>446 use partition-table 13619# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 13620# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 13621# assembler instructions: jmp short 0x58;nop;ASCII 136220 ubequad&0xeb58908000000000 0xeb58900000000000 13623# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 13624>(1.b+2) ubequad 0xfa31c08ed88ec08e 13625# Error messages at end of code 13626>>376 string No\ operating\ system\r\n\0 13627>>>398 string Disk\ error\r\n\0FDD\0HDD\0 13628>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 13629 13630# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ 13631# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 13632# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 13633# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 136340 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 13635# pointer to the data starting with Neil Turton signature string 13636>(0x1BC.s) string NDTmbr 13637>>&-14 string 1234F\0 Turton mbr ( 13638# parameters also viewed by install-mbr --list 13639>>>(0x1BC.s+7) ubyte x \b%u<= 13640>>>(0x1BC.s+9) ubyte x \bVersion<=%u 13641#>>>(0x1BC.s+8) ubyte x asm_flag_%x 13642>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 13643# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode 13644>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 13645#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 13646#>>>(0x1BC.s+10) ubyte x \b,flags %#x 13647#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 13648#>>>(0x1BC.s+11) ubyte x \b,cfg_def %#x 13649# for older versions 13650>>>(0x1BC.s+9) ubyte <2 13651#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 13652>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 13653# floppy A: or B: 13654>>>>(0x1BC.s+13) ubyte <2 \b,floppy %#x 13655>>>>(0x1BC.s+13) ubyte >1 13656# 1st hard disc 13657#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive %#x 13658# not 1st hard disc 13659>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive %#x 13660# for version >= 2 maximal timeout can be 65534 13661>>>(0x1BC.s+9) ubyte >1 13662#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 13663>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 13664# floppy A: or B: 13665>>>>(0x1BC.s+14) ubyte <2 \b,floppy %#x 13666>>>>(0x1BC.s+14) ubyte >1 13667# 1st hard disc 13668#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive %#x 13669# not 1st hard disc 13670>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive %#x 13671>>>0 ubyte x \b) 13672 13673# added by Joerg Jenderek 13674# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 13675# grub-1.94/kern/i386/pc/startup.S 13676# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 13677# usual values are marked with comments to get only information of strange GRUB loaders 136780x200 uleshort 0x70EA 13679# found only version 3.{1,2} 13680>0x206 ubeshort >0x0300 13681# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 13682>>0x212 ubyte >0x29 13683>>>0x213 ubyte >0x29 13684# not iso9660_stage1_5 13685#>>>0 ulelong&0x00BE5652 0x00BE5652 13686>>>>0x213 ubyte >0x29 GRand Unified Bootloader 13687# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 13688>>>>0x217 ubyte 0xFF stage1_5 13689>>>>0x217 ubyte <0xFF stage2 13690>>>>0x206 ubyte x \b version %u 13691>>>>0x207 ubyte x \b.%u 13692# module_size for 1.94 13693>>>>0x208 ulelong <0xffffff \b, installed partition %u 13694#>>>>0x208 ulelong =0xffffff \b, %lu (default) 13695>>>>0x208 ulelong >0xffffff \b, installed partition %u 13696# GRUB 0.5.95 unofficial 13697>>>>0x20C ulelong&0x2E300000 0x2E300000 13698# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 13699>>>>>0x20C ubyte x \b, identifier %#x 13700#>>>>>0x20D ubyte =0 \b, LBA flag %#x (default) 13701>>>>>0x20D ubyte >0 \b, LBA flag %#x 13702# GRUB version as string 13703>>>>>0x20E string >\0 \b, GRUB version %-s 13704# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 13705>>>>>>0x215 ulong 0xffffffff 13706>>>>>>>0x219 string >\0 \b, configuration file %-s 13707>>>>>>0x215 ulong !0xffffffff 13708>>>>>>>0x215 string >\0 \b, configuration file %-s 13709# newer GRUB versions 13710>>>>0x20C ulelong&0x2E300000 !0x2E300000 13711##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 13712>>>>>0x20C ulelong >0 \b, saved entry %d 13713# for 1.94 contains kernel image size 13714# for 0.93,0.94,0.96,0.97 13715# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 13716>>>>>0x210 ubyte x \b, identifier %#x 13717# The flag for LBA forcing is in most cases 0 13718#>>>>>0x211 ubyte =0 \b, LBA flag %#x (default) 13719>>>>>0x211 ubyte >0 \b, LBA flag %#x 13720# GRUB version as string 13721>>>>>0x212 string >\0 \b, GRUB version %-s 13722# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 13723>>>>>0x217 ulong 0xffffffff 13724>>>>>>0x21b string >\0 \b, configuration file %-s 13725>>>>>0x217 ulong !0xffffffff 13726>>>>>>0x217 string >\0 \b, configuration file %-s 13727 13728# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 13729# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 13730# over BIOS parameter block (BPB) 13731# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 13732# older drives may use Near JuMP instruction E9 xx xx 13733# minimal short forward jump found 0x29 for bootloaders or 0x0 13734# maximal short forward jump is 0x7f 13735# OEM-ID is empty or contain readable bytes 137360 ulelong&0x804000E9 0x000000E9 13737!:strength +60 13738# mtools-3.9.8/msdos.h 13739# usual values are marked with comments to get only information of strange FAT systems 13740# valid sectorsize must be a power of 2 from 32 to 32768 13741>11 uleshort&0x001f 0 13742>>11 uleshort <32769 13743>>>11 uleshort >31 13744>>>>21 ubyte&0xf0 0xF0 13745>>>>>0 ubyte 0xEB DOS/MBR boot sector 13746>>>>>>1 ubyte x \b, code offset %#x+2 13747>>>>>0 ubyte 0xE9 13748>>>>>>1 uleshort x \b, code offset %#x+3 13749>>>>>3 string >\0 \b, OEM-ID "%-.8s" 13750#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 13751>>>>>>8 string IHC \b cached by Windows 9M 13752>>>>>11 uleshort >512 \b, Bytes/sector %u 13753#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 13754>>>>>11 uleshort <512 \b, Bytes/sector %u 13755>>>>>13 ubyte >1 \b, sectors/cluster %u 13756#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 13757# for lazy FAT32 implementation like Transcend digital photo frame PF830 13758>>>>>82 string/c fat32 13759>>>>>>14 uleshort !32 \b, reserved sectors %u 13760#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 13761>>>>>82 string/c !fat32 13762>>>>>>14 uleshort >1 \b, reserved sectors %u 13763#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 13764#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 13765>>>>>16 ubyte >2 \b, FATs %u 13766#>>>>>16 ubyte =2 \b, FATs %u (usual) 13767>>>>>16 ubyte =1 \b, FAT %u 13768>>>>>16 ubyte >0 13769>>>>>17 uleshort >0 \b, root entries %u 13770#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 13771>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 13772#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 13773>>>>>21 ubyte >0xF0 \b, Media descriptor %#x 13774#>>>>>21 ubyte =0xF0 \b, Media descriptor %#x (usual floppy) 13775>>>>>21 ubyte <0xF0 \b, Media descriptor %#x 13776>>>>>22 uleshort >0 \b, sectors/FAT %u 13777#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 13778>>>>>24 uleshort x \b, sectors/track %u 13779>>>>>26 ubyte >2 \b, heads %u 13780#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 13781>>>>>26 ubyte =1 \b, heads %u 13782# valid only for sector sizes with more then 32 Bytes 13783>>>>>11 uleshort >32 13784# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 13785# skip for values 2,2Ah,70h,73h,DFh 13786# and continue for extended boot signature values 0,28h,29h,80h 13787>>>>>>38 ubyte&0x56 =0 13788>>>>>>>28 ulelong >0 \b, hidden sectors %u 13789#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 13790>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 13791#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 13792# FAT<32 bit specific 13793>>>>>>>82 string/c !fat32 13794#>>>>>>>>36 ubyte 0x80 \b, physical drive %#x=0x80 (usual harddisk) 13795#>>>>>>>>36 ubyte 0 \b, physical drive %#x=0 (usual floppy) 13796>>>>>>>>36 ubyte !0x80 13797>>>>>>>>>36 ubyte !0 \b, physical drive %#x 13798# VGA-copy CRC or 13799# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 13800>>>>>>>>37 ubyte >0 \b, reserved %#x 13801#>>>>>>>>37 ubyte =0 \b, reserved %#x 13802# extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others 13803>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (%#x) 13804>>>>>>>>38 ubyte&0xFE =0x28 13805>>>>>>>>>39 ulelong x \b, serial number %#x 13806>>>>>>>>38 ubyte =0x29 13807>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 13808>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 13809>>>>>>>>>43 string =NO\ NAME \b, unlabeled 13810# there exist some old floppies without word FAT at offset 54 13811# a word like "FATnm " is only a hint for a FAT size on nm-bits 13812# Normally the number of clusters is calculated by the values of BPP. 13813# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 13814# otherwise FAT is 16 bit. 13815# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 13816>>>>>82 string/c !fat32 13817>>>>>>54 string FAT12 \b, FAT (12 bit) 13818>>>>>>54 string FAT16 \b, FAT (16 bit) 13819>>>>>>54 default x 13820# determinate FAT bit size by media descriptor 13821# small floppies implies FAT12 13822>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 13823# with media descriptor F0h floppy or maybe superfloppy with FAT16 13824>>>>>>>21 ubyte =0xF0 13825# superfloppy (many sectors) implies FAT16 13826>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 13827# no superfloppy with media descriptor F0h implies FAT12 13828>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 13829# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 13830>>>>>>>21 ubyte =0xF8 13831# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 13832>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 13833# hard disc with FAT12 or FAT16 13834>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 13835# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 13836>>>>>>>21 ubyte =0xFA 13837# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 13838>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 13839# RAM disc with FAT12 or FAT16 or Tandy hard disc 13840>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 13841# others are floppy 13842>>>>>>>21 default x \b, FAT (12 bit by descriptor) 13843# FAT32 bit specific 13844>>>>>82 string/c fat32 \b, FAT (32 bit) 13845>>>>>>36 ulelong x \b, sectors/FAT %u 13846# https://technet.microsoft.com/en-us/library/cc977221.aspx 13847>>>>>>40 uleshort >0 \b, extension flags %#x 13848#>>>>>>40 uleshort =0 \b, extension flags %hu 13849>>>>>>42 uleshort >0 \b, fsVersion %u 13850#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 13851>>>>>>44 ulelong >2 \b, rootdir cluster %u 13852#>>>>>>44 ulelong =2 \b, rootdir cluster %u 13853#>>>>>>44 ulelong =1 \b, rootdir cluster %u 13854>>>>>>48 uleshort >1 \b, infoSector %u 13855#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 13856>>>>>>48 uleshort <1 \b, infoSector %u 13857# 0 or 0xFFFF instead of usual 6 means no backup sector 13858>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 13859>>>>>>50 uleshort =0 \b, no Backup boot sector 13860#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 13861>>>>>>50 default x 13862>>>>>>>50 uleshort x \b, Backup boot sector %u 13863# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 13864>>>>>>52 ulelong >0 \b, reserved1 %#x 13865>>>>>>56 ulelong >0 \b, reserved2 %#x 13866>>>>>>60 ulelong >0 \b, reserved3 %#x 13867# same structure as FAT1X 13868#>>>>>>64 ubyte =0x80 \b, physical drive %#x=80 (usual harddisk) 13869#>>>>>>64 ubyte =0 \b, physical drive %#x=0 (usual floppy) 13870>>>>>>64 ubyte !0x80 13871>>>>>>>64 ubyte >0 \b, physical drive %#x 13872# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 13873>>>>>>65 ubyte >0 \b, reserved %#x 13874>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (%#x) 13875>>>>>>66 ubyte =0x29 13876>>>>>>>67 ulelong x \b, serial number %#x 13877>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 13878>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 13879>>>>>>>71 string =NO\ NAME \b, unlabeled 13880# additional tests for floppy image added by Joerg Jenderek 13881# no fixed disk 13882>>>>>21 ubyte !0xF8 13883# floppy media with 12 bit FAT 13884>>>>>>54 string !FAT16 13885# test for FAT after bootsector 13886>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 13887# floppy image 13888!:mime application/x-ima 13889# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 13890# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 13891# 0 FATs 13892>>>>>16 ubyte =0 13893# 0 root entries 13894>>>>>>17 uleshort =0 13895# 0 DOS sectors 13896>>>>>>>19 uleshort =0 13897# 0 sectors/FAT 13898# dos < 4.0 BootSector value found is 0x80 13899#38 ubyte =0x80 \b, dos < 4.0 BootSector (%#x) 13900>>>>>>>>22 uleshort =0 \b; NTFS 13901>>>>>>>>>24 uleshort >0 \b, sectors/track %u 13902>>>>>>>>>36 ulelong !0x800080 \b, physical drive %#x 13903>>>>>>>>>40 ulequad >0 \b, sectors %lld 13904>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 13905>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 13906# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 13907# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 13908>>>>>>>>>64 lelong <256 13909>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 13910>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 13911# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 13912# Values 128 to 255 represent index block sizes of 2^(256-N) byte 13913>>>>>>>>>68 ulelong <256 13914>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 13915#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 13916>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 13917>>>>>>>>>72 ulequad x \b, serial number 0%llx 13918>>>>>>>>>80 ulelong >0 \b, checksum %#x 13919#>>>>>>>>>80 ulelong =0 \b, checksum %#x=0 (usual) 13920# unicode loadername size jump 13921>>>>>>>>>(0x200.s*2) ubyte x 13922# in next sector loadername terminated by unicode CTRL-D and $ 13923>>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains 13924# if 2nd NTFS sectors is found then assume whole filesystem 13925#!:mime application/x-raw-disk-image 13926!:ext img/bin/ntfs 13927>>>>>>>>>>>0x200 use ntfs-sector2 13928 13929# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 13930# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 13931# unused assembler instructions short JMP y2;NOP;NOP 139320x056 ulelong&0xFFFF0FFF 0x909002EB NTFS 13933#!:mime application/octet-stream 13934!:ext bin 13935>0 use ntfs-sector2 13936# https://memory.dataram.com/products-and-services/software/ramdisk 13937# assembler instructions JMP C000;NOP 139380x056 ulelong 0x9000c0e9 NTFS 13939#!:mime application/octet-stream 13940!:ext bin 13941>0 use ntfs-sector2 13942# check for characteristics of second NTFS sector and then display loader name 139430 name ntfs-sector2 13944# number of utf16 characters of loadername 13945>0 uleshort <8 13946# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP 13947>>0x056 ulelong&0xFF0000FD 0x900000E9 13948# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 13949>>>0x002 lestring16 x bootstrap %-5.5s 13950# check for 7 character length of loader name like BOOTMGR 13951>>>0 uleshort 7 13952>>>>0x0c lestring16 x \b%-2.2s 13953### DOS,NTFS boot sectors end 13954 13955# ntfsclone-image is a special save format for NTFS volumes, 13956# created and restored by the ntfsclone program 139570 string \0ntfsclone-image ntfsclone image, 13958>0x10 byte x version %d. 13959>0x11 byte x \b%d, 13960>0x12 lelong x cluster size %d, 13961>0x16 lequad x device size %lld, 13962>0x1e lequad x %lld total clusters, 13963>0x26 lequad x %lld clusters in use 13964 139659564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 13966>8404 string x last mounted on %s, 13967#>9504 ledate x last checked at %s, 13968>8224 ledate x last written at %s, 13969>8401 byte x clean flag %d, 13970>8228 lelong x number of blocks %d, 13971>8232 lelong x number of data blocks %d, 13972>8236 lelong x number of cylinder groups %d, 13973>8240 lelong x block size %d, 13974>8244 lelong x fragment size %d, 13975>8252 lelong x minimum percentage of free blocks %d, 13976>8256 lelong x rotational delay %dms, 13977>8260 lelong x disk rotational speed %drps, 13978>8320 lelong 0 TIME optimization 13979>8320 lelong 1 SPACE optimization 13980 1398142332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 13982>&-1164 string x last mounted on %s, 13983>&-696 string >\0 volume name %s, 13984>&-304 leqldate x last written at %s, 13985>&-1167 byte x clean flag %d, 13986>&-1168 byte x readonly flag %d, 13987>&-296 lequad x number of blocks %lld, 13988>&-288 lequad x number of data blocks %lld, 13989>&-1332 lelong x number of cylinder groups %d, 13990>&-1328 lelong x block size %d, 13991>&-1324 lelong x fragment size %d, 13992>&-180 lelong x average file size %d, 13993>&-176 lelong x average number of files in dir %d, 13994>&-272 lequad x pending blocks to free %lld, 13995>&-264 lelong x pending inodes to free %d, 13996>&-664 lequad x system-wide uuid %0llx, 13997>&-1316 lelong x minimum percentage of free blocks %d, 13998>&-1248 lelong 0 TIME optimization 13999>&-1248 lelong 1 SPACE optimization 14000 1400166908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 14002>&-1164 string x last mounted on %s, 14003>&-696 string >\0 volume name %s, 14004>&-304 leqldate x last written at %s, 14005>&-1167 byte x clean flag %d, 14006>&-1168 byte x readonly flag %d, 14007>&-296 lequad x number of blocks %lld, 14008>&-288 lequad x number of data blocks %lld, 14009>&-1332 lelong x number of cylinder groups %d, 14010>&-1328 lelong x block size %d, 14011>&-1324 lelong x fragment size %d, 14012>&-180 lelong x average file size %d, 14013>&-176 lelong x average number of files in dir %d, 14014>&-272 lequad x pending blocks to free %lld, 14015>&-264 lelong x pending inodes to free %d, 14016>&-664 lequad x system-wide uuid %0llx, 14017>&-1316 lelong x minimum percentage of free blocks %d, 14018>&-1248 lelong 0 TIME optimization 14019>&-1248 lelong 1 SPACE optimization 14020 140219564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 14022>7168 belong 0x4c41424c Apple UFS Volume 14023>>7186 string x named %s, 14024>>7176 belong x volume label version %d, 14025>>7180 bedate x created on %s, 14026>8404 string x last mounted on %s, 14027#>9504 bedate x last checked at %s, 14028>8224 bedate x last written at %s, 14029>8401 byte x clean flag %d, 14030>8228 belong x number of blocks %d, 14031>8232 belong x number of data blocks %d, 14032>8236 belong x number of cylinder groups %d, 14033>8240 belong x block size %d, 14034>8244 belong x fragment size %d, 14035>8252 belong x minimum percentage of free blocks %d, 14036>8256 belong x rotational delay %dms, 14037>8260 belong x disk rotational speed %drps, 14038>8320 belong 0 TIME optimization 14039>8320 belong 1 SPACE optimization 14040 1404142332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 14042>&-1164 string x last mounted on %s, 14043>&-696 string >\0 volume name %s, 14044>&-304 beqldate x last written at %s, 14045>&-1167 byte x clean flag %d, 14046>&-1168 byte x readonly flag %d, 14047>&-296 bequad x number of blocks %lld, 14048>&-288 bequad x number of data blocks %lld, 14049>&-1332 belong x number of cylinder groups %d, 14050>&-1328 belong x block size %d, 14051>&-1324 belong x fragment size %d, 14052>&-180 belong x average file size %d, 14053>&-176 belong x average number of files in dir %d, 14054>&-272 bequad x pending blocks to free %lld, 14055>&-264 belong x pending inodes to free %d, 14056>&-664 bequad x system-wide uuid %0llx, 14057>&-1316 belong x minimum percentage of free blocks %d, 14058>&-1248 belong 0 TIME optimization 14059>&-1248 belong 1 SPACE optimization 14060 1406166908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 14062>&-1164 string x last mounted on %s, 14063>&-696 string >\0 volume name %s, 14064>&-304 beqldate x last written at %s, 14065>&-1167 byte x clean flag %d, 14066>&-1168 byte x readonly flag %d, 14067>&-296 bequad x number of blocks %lld, 14068>&-288 bequad x number of data blocks %lld, 14069>&-1332 belong x number of cylinder groups %d, 14070>&-1328 belong x block size %d, 14071>&-1324 belong x fragment size %d, 14072>&-180 belong x average file size %d, 14073>&-176 belong x average number of files in dir %d, 14074>&-272 bequad x pending blocks to free %lld, 14075>&-264 belong x pending inodes to free %d, 14076>&-664 bequad x system-wide uuid %0llx, 14077>&-1316 belong x minimum percentage of free blocks %d, 14078>&-1248 belong 0 TIME optimization 14079>&-1248 belong 1 SPACE optimization 14080 140810 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), 14082>0x90 lelong+1 x volume %d 14083>0x94 lelong x (of %d), 14084>0x50 string x name %s, 14085>0x98 ulelong x version %u, 14086>0xa0 ulelong x flags %#x 14087 140880 ulequad 0x48414d3205172011 HAMMER2 filesystem (little-endian), 14089>0x3b byte x volume %d, 14090>0x28 ulequad/1073741824 x size %lluGB, 14091>0x30 ulelong x version %u, 14092>0x34 ulelong x flags %#x 14093 14094# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 14095# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 14096# volume label and UUID Russell Coker 14097# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 140980x438 leshort 0xEF53 Linux 14099>0x44c lelong x rev %d 14100>0x43e leshort x \b.%d 14101# No journal? ext2 14102>0x45c lelong ^0x0000004 ext2 filesystem data 14103>>0x43a leshort ^0x0000001 (mounted or unclean) 14104# Has a journal? ext3 or ext4 14105>0x45c lelong &0x0000004 14106# and small INCOMPAT? 14107>>0x460 lelong <0x0000040 14108# and small RO_COMPAT? 14109>>>0x464 lelong <0x0000008 ext3 filesystem data 14110# else large RO_COMPAT? 14111>>>0x464 lelong >0x0000007 ext4 filesystem data 14112# else large INCOMPAT? 14113>>0x460 lelong >0x000003f ext4 filesystem data 14114>0x468 ubelong x \b, UUID=%08x 14115>0x46c ubeshort x \b-%04x 14116>0x46e ubeshort x \b-%04x 14117>0x470 ubeshort x \b-%04x 14118>0x472 ubelong x \b-%08x 14119>0x476 ubeshort x \b%04x 14120>0x478 string >0 \b, volume name "%s" 14121# General flags for any ext* fs 14122>0x460 lelong &0x0000004 (needs journal recovery) 14123>0x43a leshort &0x0000002 (errors) 14124# INCOMPAT flags 14125>0x460 lelong &0x0000001 (compressed) 14126#>0x460 lelong &0x0000002 (filetype) 14127#>0x460 lelong &0x0000010 (meta bg) 14128>0x460 lelong &0x0000040 (extents) 14129>0x460 lelong &0x0000080 (64bit) 14130#>0x460 lelong &0x0000100 (mmp) 14131#>0x460 lelong &0x0000200 (flex bg) 14132# RO_INCOMPAT flags 14133#>0x464 lelong &0x0000001 (sparse super) 14134>0x464 lelong &0x0000002 (large files) 14135>0x464 lelong &0x0000008 (huge files) 14136#>0x464 lelong &0x0000010 (gdt checksum) 14137#>0x464 lelong &0x0000020 (many subdirs) 14138#>0x463 lelong &0x0000040 (extra isize) 14139 14140# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> 141410x400 lelong 0xF2F52010 F2FS filesystem 14142>0x46c ubelong x \b, UUID=%08x 14143>0x470 ubeshort x \b-%04x 14144>0x472 ubeshort x \b-%04x 14145>0x474 ubeshort x \b-%04x 14146>0x476 ubelong x \b-%08x 14147>0x47a ubeshort x \b%04x 14148>0x147c lestring16 x \b, volume name "%s" 14149 14150# Minix filesystems - Juan Cespedes <cespedes@debian.org> 141510x410 leshort 0x137f 14152!:strength / 2 14153>0x402 beshort < 100 14154>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones 14155>0x1e string minix \b, bootable 141560x410 beshort 0x137f 14157!:strength / 2 14158>0x402 beshort < 100 14159>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 14160>0x1e string minix \b, bootable 141610x410 leshort 0x138f 14162!:strength / 2 14163>0x402 beshort < 100 14164>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 14165>0x1e string minix \b, bootable 141660x410 beshort 0x138f 14167!:strength / 2 14168>0x402 beshort < 100 14169>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 14170>0x1e string minix \b, bootable 14171# Weak Magic: this is $x 14172#0x410 leshort 0x2468 14173#>0x402 beshort < 100 14174#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names 14175#>0x1e string minix \b, bootable 14176#0x410 beshort 0x2468 14177#>0x402 beshort < 100 14178#>0x402 beshort > -1 Minix filesystem, V2 (big endian) 14179#>0x1e string minix \b, bootable 14180#0x410 leshort 0x2478 14181#>0x402 beshort < 100 14182#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 14183#>0x1e string minix \b, bootable 14184#0x410 leshort 0x2478 14185#>0x402 beshort < 100 14186#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 14187#>0x1e string minix \b, bootable 14188#0x410 beshort 0x2478 14189#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) 14190#>0x1e string minix \b, bootable 14191# Weak Magic! this is MD 14192#0x418 leshort 0x4d5a 14193#>0x402 beshort <100 14194#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names 14195 14196# SGI disk labels - Nathan Scott <nathans@debian.org> 141970 belong 0x0BE5A941 SGI disk label (volume header) 14198 14199# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 142000 belong 0x58465342 SGI XFS filesystem data 14201>0x4 belong x (blksz %d, 14202>0x68 beshort x inosz %d, 14203>0x64 beshort ^0x2004 v1 dirs) 14204>0x64 beshort &0x2004 v2 dirs) 14205 14206############################################################################ 14207# Minix-ST kernel floppy 142080x800 belong 0x46fc2700 Atari-ST Minix kernel image 14209# https://en.wikipedia.org/wiki/BIOS_parameter_block 14210# floppies with valid BPB and any instruction at beginning 14211>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 14212>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 14213 14214############################################################################ 14215# Hmmm, is this a better way of detecting _standard_ floppy images ? 1421619 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 14217>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1421819 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 14219>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1422019 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 14221>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 14222 1422319 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 14224>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1422519 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 14226>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 14227 1422819 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 1422919 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 14230# | | | | | 14231# | | | | heads 14232# | | | sectors/track 14233# | | sectors/FAT 14234# | media descriptor 14235# BPB: sectors 14236 14237# Valid media descriptor bytes for MS-DOS: 14238# 14239# Byte Capacity Media Size and Type 14240# ------------------------------------------------- 14241# 14242# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 14243# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 14244# F9 720K 3.5-inch, 2-sided, 9-sector 14245# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 14246# FD 360K 5.25-inch, 2-sided, 9-sector 14247# FF 320K 5.25-inch, 2-sided, 8-sector 14248# FC 180K 5.25-inch, 1-sided, 9-sector 14249# FE 160K 5.25-inch, 1-sided, 8-sector 14250# FE 250K 8-inch, 1-sided, single-density 14251# FD 500K 8-inch, 2-sided, single-density 14252# FE 1.2 MB 8-inch, 2-sided, double-density 14253# F8 ----- Fixed disk 14254# 14255# FC xxxK Apricot 70x1x9 boot disk. 14256# 14257# Originally a bitmap: 14258# xxxxxxx0 Not two sided 14259# xxxxxxx1 Double sided 14260# xxxxxx0x Not 8 SPT 14261# xxxxxx1x 8 SPT 14262# xxxxx0xx Not Removable drive 14263# xxxxx1xx Removable drive 14264# 11111xxx Must be one. 14265# 14266# But now it's rather random: 14267# 111111xx Low density disk 14268# 00 SS, Not 8 SPT 14269# 01 DS, Not 8 SPT 14270# 10 SS, 8 SPT 14271# 11 DS, 8 SPT 14272# 14273# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 14274# 11110000 High density 3 1/2 floppy disk 14275# 11111000 Hard disk any format 14276# 14277 14278# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 14279# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 14280# Too Weak. 14281#512 ubelong&0xE0ffff00 0xE0ffff00 14282# without valid Media descriptor in place of BPB, cases with are done at other places 14283#>21 ubyte <0xE5 floppy with old FAT filesystem 14284# but valid Media descriptor at begin of FAT 14285#>>512 ubyte =0xed 720k 14286#>>512 ubyte =0xf0 1440k 14287#>>512 ubyte =0xf8 720k 14288#>>512 ubyte =0xf9 1220k 14289#>>512 ubyte =0xfa 320k 14290#>>512 ubyte =0xfb 640k 14291#>>512 ubyte =0xfc 180k 14292# look like an old DOS directory entry 14293#>>>0xA0E ubequad 0 14294#>>>>0xA00 ubequad !0 14295#!:mime application/x-ima 14296#>>512 ubyte =0xfd 14297# look for 2nd FAT at different location to distinguish between 360k and 500k 14298#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 14299#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 14300#>>>0xA0E ubequad 0 14301#!:mime application/x-ima 14302#>>512 ubyte =0xfe 14303#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 14304#>>>>0x60E ubequad 0 14305#>>>>>0x600 ubequad !0 14306#!:mime application/x-ima 14307#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 14308#>>512 ubyte =0xff 320k 14309#>>>0x60E ubequad 0 14310#>>>>0x600 ubequad !0 14311#!:mime application/x-ima 14312#>>512 ubyte x \b, Media descriptor %#x 14313# without x86 jump instruction 14314#>>0 ulelong&0x804000E9 !0x000000E9 14315# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 14316#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 14317# IOSYS.COM+MSDOS.COM 14318#>>>>0xc4 use 2xDOS-filename 14319#>>0 ulelong&0x804000E9 =0x000000E9 14320# only x86 short jump instruction found 14321#>>>0 ubyte =0xEB 14322#>>>>1 ubyte x \b, code offset %#x+2 14323# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm 14324# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 14325#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 14326# ibmbio.com+ibmdos.com 14327#>>>>>0x176 use DOS-filename 14328#>>>>>0x181 ubyte x \b+ 14329#>>>>>0x182 use DOS-filename 14330# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm 14331# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 14332#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 14333# ibmbio.com+ibmdos.com 14334#>>>>>0x18b use DOS-filename 14335#>>>>>0x196 ubyte x \b+ 14336#>>>>>0x197 use DOS-filename 14337# https://en.wikipedia.org/wiki/Zenith_Data_Systems 14338# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 14339#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 14340# IO.SYS+MSDOS.SYS 14341#>>>>>0x20 use 2xDOS-filename 14342# https://en.wikipedia.org/wiki/Corona_Data_Systems 14343# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 14344#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 14345# IO.SYS+MSDOS.SYS 14346#>>>>>0x69 use 2xDOS-filename 14347# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 14348#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 14349# defect IO.SYS+MSDOS.SYS ? 14350#>>>>>0x162 use 2xDOS-filename 14351 143520 name cdrom 14353>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 14354!:mime application/x-iso9660-image 14355!:ext iso/iso9660 14356>38913 string NSR0 UDF filesystem data 14357!:mime application/x-iso9660-image 14358!:ext iso/udf 14359>>38917 string 1 (version 1.0) 14360>>38917 string 2 (version 1.5) 14361>>38917 string 3 (version 2.0) 14362>>38917 byte >0x33 (unknown version, ID %#X) 14363>>38917 byte <0x31 (unknown version, ID %#X) 14364# The next line is not necessary because the MBR staff is done looking for boot signature 14365>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 14366# "application id" which appears to be used as a volume label 14367>32808 string/T >\0 '%.32s' 14368>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 1436937633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 14370!:mime application/x-iso9660-image 1437132777 string CDROM High Sierra CD-ROM filesystem data 14372# "application id" which appears to be used as a volume label 14373>32816 string/T >\0 '%.32s' 14374 14375 14376# CDROM Filesystems 14377# https://en.wikipedia.org/wiki/ISO_9660 14378# Modified for UDF by gerardo.cacciari@gmail.com 1437932769 string CD001 14380# mime line at that position does not work 14381# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 14382#!:strength -11 14383# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 14384!:strength +35 14385>0 use cdrom 14386 14387# URL: https://en.wikipedia.org/wiki/NRG_(file_format) 14388# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ 14389# 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh 14390# From: Joerg Jenderek 14391# Note: Only for nero disc with once (DAO) type after 300 KB header 14392339969 string CD001 Nero CD image at 0x4B000 14393!:mime application/x-nrg 14394!:ext nrg 14395>307200 use cdrom 14396 14397# .cso files 14398# Reference: https://pismotec.com/ciso/ciso.h 14399# NOTE: There are two other formats with the same magic but 14400# completely incompatible specifications: 14401# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h 14402# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 144030 string CISO 14404# Other fields are used to determine what type of CISO this is: 14405# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 14406# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 14407# - 0x10 == 0x00004000: For >2GB files using maxcso... 14408# https://github.com/unknownbrackets/maxcso/issues/26 14409# - None of the above: Compact ISO. 14410>4 lelong !0 14411>>4 lelong !0x200000 14412>>>16 lelong !0x800 14413>>>>16 lelong !0x4000 Compressed ISO CD image 14414 14415# cramfs filesystem - russell@coker.com.au 144160 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 14417>4 lelong x size %u 14418>8 lelong &1 version #2 14419>8 lelong &2 sorted_dirs 14420>8 lelong &4 hole_support 14421>32 lelong x CRC %#x, 14422>36 lelong x edition %u, 14423>40 lelong x %u blocks, 14424>44 lelong x %u files 14425 144260 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 14427>4 belong x size %u 14428>8 belong &1 version #2 14429>8 belong &2 sorted_dirs 14430>8 belong &4 hole_support 14431>32 belong x CRC %#x, 14432>36 belong x edition %u, 14433>40 belong x %u blocks, 14434>44 belong x %u files 14435 14436# reiserfs - russell@coker.com.au 144370x10034 string ReIsErFs ReiserFS V3.5 144380x10034 string ReIsEr2Fs ReiserFS V3.6 144390x10034 string ReIsEr3Fs ReiserFS V3.6.19 14440>0x1002c leshort x block size %d 14441>0x10032 leshort &2 (mounted or unclean) 14442>0x10000 lelong x num blocks %d 14443>0x10040 lelong 1 tea hash 14444>0x10040 lelong 2 yura hash 14445>0x10040 lelong 3 r5 hash 14446 14447# EST flat binary format (which isn't, but anyway) 14448# From: Mark Brown <broonie@sirena.org.uk> 144490 string ESTFBINR EST flat binary 14450 14451# Aculab VoIP firmware 14452# From: Mark Brown <broonie@sirena.org.uk> 144530 string VoIP\ Startup\ and Aculab VoIP firmware 14454>35 string x format %s 14455 14456# From: Mark Brown <broonie@sirena.org.uk> [old] 14457# From: Behan Webster <behanw@websterwood.com> 144580 belong 0x27051956 u-boot legacy uImage, 14459>32 string x %s, 14460>28 byte 0 Invalid os/ 14461>28 byte 1 OpenBSD/ 14462>28 byte 2 NetBSD/ 14463>28 byte 3 FreeBSD/ 14464>28 byte 4 4.4BSD/ 14465>28 byte 5 Linux/ 14466>28 byte 6 SVR4/ 14467>28 byte 7 Esix/ 14468>28 byte 8 Solaris/ 14469>28 byte 9 Irix/ 14470>28 byte 10 SCO/ 14471>28 byte 11 Dell/ 14472>28 byte 12 NCR/ 14473>28 byte 13 LynxOS/ 14474>28 byte 14 VxWorks/ 14475>28 byte 15 pSOS/ 14476>28 byte 16 QNX/ 14477>28 byte 17 Firmware/ 14478>28 byte 18 RTEMS/ 14479>28 byte 19 ARTOS/ 14480>28 byte 20 Unity OS/ 14481>28 byte 21 INTEGRITY/ 14482>29 byte 0 \bInvalid CPU, 14483>29 byte 1 \bAlpha, 14484>29 byte 2 \bARM, 14485>29 byte 3 \bIntel x86, 14486>29 byte 4 \bIA64, 14487>29 byte 5 \bMIPS, 14488>29 byte 6 \bMIPS 64-bit, 14489>29 byte 7 \bPowerPC, 14490>29 byte 8 \bIBM S390, 14491>29 byte 9 \bSuperH, 14492>29 byte 10 \bSparc, 14493>29 byte 11 \bSparc 64-bit, 14494>29 byte 12 \bM68K, 14495>29 byte 13 \bNios-32, 14496>29 byte 14 \bMicroBlaze, 14497>29 byte 15 \bNios-II, 14498>29 byte 16 \bBlackfin, 14499>29 byte 17 \bAVR32, 14500>29 byte 18 \bSTMicroelectronics ST200, 14501>29 byte 19 \bSandbox architecture, 14502>29 byte 20 \bANDES Technology NDS32, 14503>29 byte 21 \bOpenRISC 1000, 14504>29 byte 22 \bARM 64-bit, 14505>29 byte 23 \bDesignWare ARC, 14506>29 byte 24 \bx86_64, 14507>29 byte 25 \bXtensa, 14508>29 byte 26 \bRISC-V, 14509>30 byte 0 Invalid Image 14510>30 byte 1 Standalone Program 14511>30 byte 2 OS Kernel Image 14512>30 byte 3 RAMDisk Image 14513>30 byte 4 Multi-File Image 14514>30 byte 5 Firmware Image 14515>30 byte 6 Script File 14516>30 byte 7 Filesystem Image (any type) 14517>30 byte 8 Binary Flat Device Tree BLOB 14518>31 byte 0 (Not compressed), 14519>31 byte 1 (gzip), 14520>31 byte 2 (bzip2), 14521>31 byte 3 (lzma), 14522>12 belong x %d bytes, 14523>8 bedate x %s, 14524>16 belong x Load Address: %#08X, 14525>20 belong x Entry Point: %#08X, 14526>4 belong x Header CRC: %#08X, 14527>24 belong x Data CRC: %#08X 14528 14529# JFFS2 file system 145300 leshort 0x1984 Linux old jffs2 filesystem data little endian 145310 beshort 0x1984 Linux old jffs2 filesystem data big endian 145320 leshort 0x1985 Linux jffs2 filesystem data little endian 145330 beshort 0x1985 Linux jffs2 filesystem data big endian 14534 14535# Squashfs 145360 name squashfs 14537>28 beshort x version %d. 14538>30 beshort x \b%d, 14539>20 beshort 0 uncompressed, 14540>20 beshort 1 zlib 14541>20 beshort 2 lzma 14542>20 beshort 3 lzo 14543>20 beshort 4 xz 14544>20 beshort 5 lz4 14545>20 beshort 6 zstd 14546>20 beshort >0 compressed, 14547>28 beshort <3 14548>>8 belong x %d bytes, 14549>28 beshort >2 14550>>28 beshort <4 14551>>>63 bequad x %lld bytes, 14552>>28 beshort >3 14553>>>40 bequad x %lld bytes, 14554#>>67 belong x %d bytes, 14555>4 belong x %d inodes, 14556>28 beshort <2 14557>>32 beshort x blocksize: %d bytes, 14558>28 beshort >1 14559>>28 beshort <4 14560>>>51 belong x blocksize: %d bytes, 14561>>28 beshort >3 14562>>>12 belong x blocksize: %d bytes, 14563>28 beshort <4 14564>>39 bedate x created: %s 14565>28 beshort >3 14566>>8 bedate x created: %s 14567 145680 string sqsh Squashfs filesystem, big endian, 14569>0 use squashfs 14570 145710 string hsqs Squashfs filesystem, little endian, 14572>0 use \^squashfs 14573 14574# AFS Dump Magic 14575# From: Ty Sarna <tsarna@sarna.org> 145760 string \x01\xb3\xa1\x13\x22 AFS Dump 14577>&0 belong x (v%d) 14578>>&0 byte 0x76 14579>>>&0 belong x Vol %d, 14580>>>>&0 byte 0x6e 14581>>>>>&0 string x %s 14582>>>>>>&1 byte 0x74 14583>>>>>>>&0 beshort 2 14584>>>>>>>>&4 bedate x on: %s 14585>>>>>>>>&0 bedate =0 full dump 14586>>>>>>>>&0 bedate !0 incremental since: %s 14587 14588#---------------------------------------------------------- 14589#delta ISO Daniel Novotny (dnovotny@redhat.com) 145900 string DISO Delta ISO data 14591!:strength +50 14592>4 belong x version %d 14593 14594# VMS backup savesets - gerardo.cacciari@gmail.com 14595# 145964 string \x01\x00\x01\x00\x01\x00 14597>(0.s+16) string \x01\x01 14598>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 14599>>>40 lelong x (block size %d, 14600>>>49 string >\0 original name '%s', 14601>>>2 short 1024 VAX generated) 14602>>>2 short 2048 AXP generated) 14603>>>2 short 4096 I64 generated) 14604 14605# Summary: Oracle Clustered Filesystem 14606# Created by: Aaron Botsis <redhat@digitalmafia.org> 146078 string OracleCFS Oracle Clustered Filesystem, 14608>4 long x rev %d 14609>0 long x \b.%d, 14610>560 string x label: %.64s, 14611>136 string x mountpoint: %.128s 14612 14613# Summary: Oracle ASM tagged volume 14614# Created by: Aaron Botsis <redhat@digitalmafia.org> 1461532 string ORCLDISK Oracle ASM Volume, 14616>40 string x Disk Name: %0.12s 1461732 string ORCLCLRD Oracle ASM Volume (cleared), 14618>40 string x Disk Name: %0.12s 14619 14620# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 146218 string OracleCFS Oracle Clustered Filesystem, 14622>4 long x rev %d 14623>0 long x \b.%d, 14624>560 string x label: %.64s, 14625>136 string x mountpoint: %.128s 14626 14627# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 1462832 string ORCLDISK Oracle ASM Volume, 14629>40 string x Disk Name: %0.12s 1463032 string ORCLCLRD Oracle ASM Volume (cleared), 14631>40 string x Disk Name: %0.12s 14632 14633# Compaq/HP RILOE floppy image 14634# From: Dirk Jagdmann <doj@cubic.org> 146350 string CPQRFBLO Compaq/HP RILOE floppy image 14636 14637#------------------------------------------------------------------------------ 14638# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 14639# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 14640# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 14641# 146421008 string DECFILE11 Files-11 On-Disk Structure 14643>525 byte x (ODS-%d); 14644>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 14645>1017 string B 14646>>525 byte 2 VAX/VMS or OpenVMS file system; 14647>>525 byte 5 OpenVMS Alpha or Itanium file system; 14648>984 string x volume label is '%-12.12s' 14649 14650# From: Thomas Klausner <wiz@NetBSD.org> 14651# https://filext.com/file-extension/DAA 14652# describes the daa file format. The magic would be: 146530 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 14654 14655# From Albert Cahalan <acahalan@gmail.com> 14656# really le32 operation,destination,payloadsize (but quite predictable) 14657# 01 00 00 00 00 00 00 c0 00 02 00 00 146580 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 14659 14660# From Eric Sandeen 14661# GFS2 146620x10000 belong 0x01161970 14663>0x10018 belong 0x0000051d GFS1 Filesystem 14664>>0x10024 belong x (blocksize %d, 14665>>0x10060 string >\0 lockproto %s) 14666>0x10018 belong 0x00000709 GFS2 Filesystem 14667>>0x10024 belong x (blocksize %d, 14668>>0x10060 string >\0 lockproto %s) 14669 14670# Russell Coker <russell@coker.com.au> 146710x10040 string _BHRfS_M BTRFS Filesystem 14672>0x1012b string >\0 label "%s", 14673>0x10090 lelong x sectorsize %d, 14674>0x10094 lelong x nodesize %d, 14675>0x10098 lelong x leafsize %d, 14676>0x10020 ubelong x UUID=%08x- 14677>0x10024 ubeshort x \b%04x- 14678>0x10026 ubeshort x \b%04x- 14679>0x10028 ubeshort x \b%04x- 14680>0x1002a ubeshort x \b%04x 14681>0x1002c ubelong x \b%08x, 14682>0x10078 lequad x %lld/ 14683>0x10070 lequad x \b%lld bytes used, 14684>0x10088 lequad x %lld devices 14685 146860 string btrfs-stream BTRFS stream file 14687 14688# dvdisaster's .ecc 14689# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 146900 string *dvdisaster* dvdisaster error correction file 14691 14692# xfs metadump image 14693# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 14694# but can we do the << ? For now it's always 512 (0x200) anyway. 146950 string XFSM 14696>0x200 string XFSB XFS filesystem metadump image 14697 14698# Type: CROM filesystem 14699# From: Werner Fink <werner@suse.de> 147000 string CROMFS CROMFS 14701>6 string >\0 \b version %2.2s, 14702>8 ulequad >0 \b block data at %lld, 14703>16 ulequad >0 \b fblock table at %lld, 14704>24 ulequad >0 \b inode table at %lld, 14705>32 ulequad >0 \b root at %lld, 14706>40 ulelong >0 \b fblock size = %d, 14707>44 ulelong >0 \b block size = %d, 14708>48 ulequad >0 \b bytes = %lld 14709 14710# Type: xfs metadump image 14711# From: Daniel Novotny <dnovotny@redhat.com> 14712# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 14713# but can we do the << ? For now it's always 512 (0x200) anyway. 147140 string XFSM 14715>0x200 string XFSB XFS filesystem metadump image 14716 14717# Type: delta ISO 14718# From: Daniel Novotny <dnovotny@redhat.com> 147190 string DISO Delta ISO data, 14720>4 belong x version %d 14721 14722# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 14723# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 14724# From: Adam Buchbinder <adam.buchbinder@gmail.com> 147250x8000 string JFS1 14726# Because it's text-only magic, check a binary value (version) to be sure. 14727# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 14728# mountable. 14729>&0 lelong <3 JFS2 filesystem image 14730# Label is followed by a UUID; we have to limit string length to avoid 14731# appending the UUID in the case of a 16-byte label. 14732>>&144 regex [\x20-\x7E]{1,16} (label "%s") 14733>>&0 lequad x \b, %lld blocks 14734>>&8 lelong x \b, blocksize %d 14735>>&32 lelong&0x00000006 >0 (dirty) 14736>>&36 lelong >0 (compressed) 14737 14738# LFS 147390 lelong 0x070162 LFS filesystem image 14740>4 lelong 1 version 1, 14741>>8 lelong x \b blocks %u, 14742>>12 lelong x \b blocks per segment %u, 14743>4 lelong 2 version 2, 14744>>8 lelong x \b fragments %u, 14745>>12 lelong x \b bytes per segment %u, 14746>16 lelong x \b disk blocks %u, 14747>20 lelong x \b block size %u, 14748>24 lelong x \b fragment size %u, 14749>28 lelong x \b fragments per block %u, 14750>32 lelong x \b start for free list %u, 14751>36 lelong x \b number of free blocks %d, 14752>40 lelong x \b number of files %u, 14753>44 lelong x \b blocks available for writing %d, 14754>48 lelong x \b inodes in cache %d, 14755>52 lelong x \b inode file disk address %#x, 14756>56 lelong x \b inode file inode number %u, 14757>60 lelong x \b address of last segment written %#x, 14758>64 lelong x \b address of next segment to write %#x, 14759>68 lelong x \b address of current segment written %#x 14760 147610 string td\000 floppy image data (TeleDisk, compressed) 147620 string TD\000 floppy image data (TeleDisk) 14763 147640 string CQ\024 floppy image data (CopyQM, 14765>16 leshort x %d sectors, 14766>18 leshort x %d heads.) 14767 147680 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 14769 14770# URL: http://fileformats.archiveteam.org/wiki/LoadDskF/SaveDskF 14771# Update: Joerg Jenderek 14772# Note: called "IBM SKF disk image" by TrID 14773# verfied by 7-Zip `7z l -tFAT -slt *.dsk` and 14774# `deark -l -m loaddskf 06200D19.DSK` 14775# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-old.trid.xml 147760 beshort 0xAA58 14777>0 use SaveDskF 14778# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf.trid.xml 147790 beshort 0xAA59 14780>0 use SaveDskF 14781# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dsk-skf-comp.trid.xml 147820 beshort 0xAA5A 14783# skip foo by additional check for unused upper byte of media type in SaveDskF header 14784#>3 ubyte =0 14785# skip bar by additional check for valid "low" number of heads in SaveDskF header 14786#>>26 uleshort <3 14787# skip foo by additional check for unused double word field in SaveDskF header 14788#>>>30 long =0 14789#>>>>0 use SaveDskF 14790>0 use SaveDskF 14791# display information about IBM SaveDskF floppy disk images 147920 name SaveDskF 14793# SaveDskF magic 14794>0 beshort x floppy image data (IBM SaveDskF 14795#!:mime application/octet-stream 14796!:mime application/x-ibm-dsk 14797!:ext dsk 14798# also suffix with digit (1dk .2dk ...); NO example FOUND! 14799#!:ext dsk/1dk/2dk 14800>1 ubyte =0x58 \b, old) 14801>1 ubyte =0x59 \b) 14802>1 ubyte =0x5A \b, compressed) 14803# media type; the first byte of the FAT like: 0xF0 (usual floppy) 0xF9 0xFE 14804# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system 14805>2 ubyte !0xF0 \b, Media descriptor %#x 14806# upper byte of media type is not used; so this seems to be nil 14807>3 ubyte !0 \b, upper byte of media type %#x 14808# sector size in bytes as in the BIOS parameter block like: 512 ; SAVEDSKF.EXE with other sizes produce garbage images 14809>4 uleshort !512 \b, Bytes/sector %u 14810# cluster mask; number of sectors per cluster, minus 1 14811>6 uleshort+1 >1 \b, sectors/cluster %u 14812#>6 uleshort+1 x \b, sectors/cluster %u 14813# cluster shift; log2(cluster size / sector size) like: 0~1=ClusterSize/SectorSize 14814>7 ubyte >0 \b, cluster shift %u 14815#>7 ubyte x \b, cluster shift %u 14816# reserved sectors; as in the BIOS parameter block like: 1 256 (2M256R-K.DSK) 14817>8 uleshort >1 \b, reserved sectors %u 14818#>8 uleshort x \b, reserved sectors %u 14819# FAT copies; as in the BIOS parameter block like: 2 (usual) 1 (2-NK.DSK) 14820>10 ubyte !2 \b, FAT 14821# plural s 14822>>10 ubyte >1 \bs 14823>>10 ubyte x %u 14824# root directory entries; as in the BIOS parameter block like: 224 (usual) 64 (H1-NK.DSK) 4096 (2-NK.DSK) 14825>11 uleshort !224 \b, root entries %u 14826# sector number of first cluster (count sectors used by boot sector, FATs and root directory) like: 7 10 29 33 288 14827>13 uleshort !33 \b, 1st cluster at sector %u 14828# number of clusters in image; empty clusters at the end are not saved and counted like: 2372 2848 14829>15 uleshort x \b, %u clusters 14830# sectors/FAT; as in the BIOS parameter block like: 1 (H1-NK.DSK) 7 9 14831>17 ubyte !9 \b, sectors/FAT %u 14832# sector number of root directory (ie, count of sectors used by boot sector and FATs) like: 3 (H1-NK.DSK) 9 10 15 19 274 (2M256R-K.DSK) 14833>18 uleshort !19 \b, root directory at sector %u 14834# checksum; sum of all bytes in the file 14835>20 ulelong x \b, checksum %#8.8x 14836# cylinders; number of cylinders like: 40 80 14837>24 uleshort !80 \b, %u cylinders 14838#>24 uleshort x \b, %u cylinders 14839# heads; number of heads as in the BIOS parameter block like: 1 (H1-NK.DSK) 2 14840>26 uleshort !2 \b, heads %u 14841#>26 uleshort x \b, heads %u 14842# sectors/track; number of sectors per track as in the BIOS parameter block like: 8 15 18 36 14843>28 uleshort !18 \b, sectors/track %u 14844#>28 uleshort x \b, sectors/track %u 14845# unused double word field seems to be always like: 0 14846>30 ulelong !0 \b, at 0x1E %#x 14847# number of sectors in images like: 1017 2786 2880 14848>34 uleshort x \b, sectors %u 14849# if string is "printable" it can be a real comment 14850>(36.s) ubyte !0x00 14851# if 1st sector is far enough away (> 0x29) then there is space for comment part 14852>>38 uleshort >41 14853# offset to comment string like: 28h=40 14854>>>36 uleshort x \b, at %#x 14855# comment string terminated with \r\n\0 14856>>>(36.s) string x "%s" 14857# offset to the first sector like: 0 (If this is 0, assume it is 0x200) 29h=41 (DISPLAY3.DSK) 31h 43h 45h 46h 48h 50h 200h=512 14858>38 uleshort !0 \b, 1st sector at %#x 14859# FOR DEBUGGING! 14860#>(38.s) ubelong x SECTOR CONTENT %x 14861# not compressed floppy image implies readable DOS boot sector inside image 14862>>1 ubyte !0x5A 14863# when not compressed it is readable as DOS boot sector via ./filesystems 14864#>>>(38.s) indirect x \b; contains 14865>38 uleshort =0 \b, 1st sector at 0x200 (0) 14866# maybe standard DOS boot sector; NO example FOUND HERE! 14867#>>0x200 indirect x \b; contains 14868 148690 string \074CPM_Disk\076 disk image data (YAZE) 14870 14871# From: Joerg Jenderek 14872# URL: https://en.wikipedia.org/wiki/Central_Point_Software#cite_note-6 14873# Reference: https://www.robcraig.com/download/transcopy-5-x-file-format 14874# https://www.robcraig.com/download/transcopy-file-format-by-gene-thompson 14875# http://mark0.net/download/triddefs_xml.7z/defs/t/tc-transcopy.trid.xml 14876# TransCopy signature 148770 beshort 0x5AA5 14878# skip Intel serial flash ROM with invalid 0 disk sides handled by ./intel 14879>0x103 ubyte !0 14880# skip Intel serial flash ROM with unlikely "high" start cylinder 100 handled by ./intel 14881#>>0x101 ubyte <100 VALID_START_CYLINDER 14882# skip Intel serial flash ROM with unlikely description handled by ./intel 14883#>>>2 beshort !0xF00f VALID_DESCRIPTION 14884# skip Intel serial flash ROM with invalid disk types 89h 88h handled by ./intel 14885#>>>>0x100 byte !0x89 VALID_DISK_TYPE 14886>>0 use tc-floppy 14887# display information of Central Point Software (CPS) Option Board TransCopy floppy image 148880 name tc-floppy 14889>0 beshort x TransCopy disk image 14890#!:mime application/octet-stream 14891!:mime application/x-floppy-image-tc 14892# like: disk04.tc VOCALC2.TC WIZ5_A.tc WIZ2_720.IMG 14893!:ext tc/img 14894# 1st description (optional 0-terminated maximal 32) like: 14895# "Project Workbench 2.20" "Visi On Calc" "Wizardry V Disk 1 of 3" 14896>2 string >\0 %.32s 14897# 2nd desc. (optional 0-terminated maximal 32) like: 14898# "(1988)." "Advanced - Utility" 'Program Disk 2" 14899>0x22 string >\0 "%.32s" 14900# Looks like ascii (like MESSAGES) formatted with attribute bytes (190)? 14901# not needed for disk copy 14902#>>0x42 string x '%.190s' 14903#>>0x88 lestring16 x "%.8s" 14904# disktype: 2~MFM High Density 3~MFM Double Density 4~Apple II GCR 5~FM Single Density 14905# 6~Commodore GCR 7~MFM Double Density 8~Commodore Amiga Ch~Atari FM FFh~Unknown 14906>0x100 ubyte !0xFF \b, disk type %u 14907# StartingCylinder like: 0 14908>0x101 ubyte x \b, cylinder 14909>0x101 ubyte !0 start=%u 14910# EndingCylinder like: 40 (often) 41 79 14911>0x102 ubyte x end=%u 14912# NumberOfSides like: 2 14913>0x103 ubyte !2 \b, %u sides 14914# TrackIncrement like: 1 14915>0x104 ubyte !1 \b, track increment %u 14916# TrackPosTbl Track skew 14917#>0x105 ubequad x \b, Track skew %#16.16llx 14918# TrackOffsTbl 14919#>0x305 ubequad x \b, TrackOffsTbl %#16.16llx 14920# TrackLngthTbl 14921#>0x505 ubequad x \b, TrackLngthTbl %#16.16llx 14922# TrackTypeTable 14923#>0x705 ubequad x \b, TrackTypeTable %#16.16llx 14924# Address mark timing 14925#>0x905 ubequad x \b, Address mark timing %#16.16llx 14926# Track fragment 14927#>0x2905 ubequad !0 \b, Track fragment %#16.16llx 14928# Track data 14929#>0x4000 ubequad !0 \b, Track data %#16.16llx 14930 14931# ReFS 14932# Richard W.M. Jones <rjones@redhat.com> 149330 string \0\0\0ReFS\0 ReFS filesystem image 14934 14935# EFW encase image file format: 14936# Gregoire Passault 14937# http://www.forensicswiki.org/wiki/Encase_image_file_format 149380 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 14939 14940# UBIfs 14941# Linux kernel sources: fs/ubifs/ubifs-media.h 149420 lelong 0x06101831 14943>0x16 leshort 0 UBIfs image 14944>0x08 lequad x \b, sequence number %llu 14945>0x10 leshort x \b, length %u 14946>0x04 lelong x \b, CRC %#08x 14947 149480 lelong 0x23494255 14949>0x04 leshort <2 14950>0x05 string \0\0\0 14951>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 14952>0x04 leshort x UBI image, version %u 14953 14954# NEC PC-88 2D disk image 14955# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 149560x20 ulelong&0xFFFFFEFF 0x2A0 14957>0x10 string \0\0\0\0\0\0\0\0\0\0 14958>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 14959>>>0x1A ubyte&0xEF 0 14960>>>>0x1B ubyte&0x8F 0 14961>>>>>0x1B ubyte&70 <0x40 14962>>>>>>0x1C ulelong >0x21 14963>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 14964>>>>>>>>0x1B ubyte 0 \b, media=2D 14965>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 14966>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 14967>>>>>>>>0x1B ubyte 0x30 \b, media=1D 14968>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 14969>>>>>>>>0x1A ubyte 0x10 \b, write-protected 14970 14971# HDD Raw Copy Tool disk image, file extension: .imgc 14972# From Benjamin Vanheuverzwijn <bvanheu@gmail.com> 149730 pstring HDD\ Raw\ Copy\ Tool %s 14974>0x100 pstring x %s 14975>0x200 pstring x - HD model: %s 14976#>0x300 pstring x unknown %s 14977>0x400 pstring x serial: %s 14978#>0x500 pstring x unknown: %s 14979!:ext imgc 14980 14981# http://martin.hinner.info/fs/bfs/bfs-structure.html 149820 lelong 0x1BADFACE SCO UnixWare BFS filesystem 14983 14984# https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/ 1498532 lelong 0x42465331 BE/OS BFS1 filesystem 14986>36 lelong x \b, byte order %d 14987>40 lelong x \b, block size %d 14988>44 lelong x \b, block shift %d 14989>48 lequad x \b, total blocks %lld 14990>56 lequad x \b, used blocks %lld 14991 14992 149930 name next 14994>0 lelong x \b, size %d 14995>4 string x \b, label %s 14996 14997# https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\ 14998# /IONeXTPartitionScheme.h 149990 string NeXT NeXT version 1 disklabel 15000>12 use next 150010 string dlV1 NeXT version 2 disklabel 15002>12 use next 150030 string dlV2 NeXT version 3 disklabel 15004>12 use next 15005 15006# bcachefs 15007# From: Thomas Wei�schuh <thomas@t-8ch.de> 15008 150090 name bcachefs-uuid 15010>0 ubelong x \b%08x 15011>4 ubeshort x \b-%04x 15012>6 ubeshort x \b-%04x 15013>8 ubeshort x \b-%04x 15014>10 ubelong x \b-%08x 15015>14 ubeshort x \b%04x 15016 150170x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 bcachefs 15018>0x1068 lequad 8 \b, UUID= 15019>>0x1038 use bcachefs-uuid 15020>>0x1048 string >0 \b, label "%.32s" 15021>>0x1010 uleshort x \b, version %u 15022>>0x1012 uleshort x \b, min version %u 15023>>0x107a byte x \b, device %d 15024# assumes the first field is the members field 15025>>0x12f4 ulelong 0x01 \b/UUID= 15026>>>0x12f0 default x 15027>>>&(0x107a.b*56) use bcachefs-uuid 15028>>0x107b byte x \b, %d devices 15029>>0x1090 byte ^0x02 \b (unclean) 15030 15031# EROFS 15032# https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils/\ 15033# +/refs/heads/experimental/include/erofs_fs.h#12 150341024 lelong 0xE0F5E1E2 EROFS filesystem 15035#>1028 lelong x \b, checksum=%#x 15036>1032 lelong >0 \b, compat: 15037>>1032 lelong &1 SB_CHKSUM 15038>>1032 lelong &2 MTIME 15039>1036 byte x \b, blocksize=%u 15040>1037 byte x \b, exslots=%u 15041#>1038 leshort x \b, root_nid=%d 15042#>1040 lequad x \b, inodes=%ld 15043#>1048 leldate x \b, build_time=%s 15044#>1056 lelong x \b.%d 15045#>1060 lelong x \b, blocks=%d 15046#>1064 lelong x \b, metadata@%#x 15047#>1068 lelong x \b, xattr@%#x 15048>1072 guid x \b, uuid=%s 15049>1088 string >0 \b, name=%s 15050>1104 lelong >0 \b, incompat: 15051>>1104 lelong &1 LZ4_0PADDING 15052>>1104 lelong &2 BIG_PCLUSTER 15053>>1104 lelong &4 CHUNKED_FILE 15054>>1104 lelong &8 DEVICE_TABLE 15055>>1104 lelong &16 ZTAILPACKING 15056 15057#------------------------------------------------------------------------------ 15058# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $ 15059# fingerprint: file(1) magic for fingerprint data 15060# XPM bitmaps) 15061# 15062 15063# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 15064 150650 string FP1 libfprint fingerprint data V1 15066>3 beshort x \b, driver_id %x 15067>5 belong x \b, devtype %x 15068 150690 string FP2 libfprint fingerprint data V2 15070>3 beshort x \b, driver_id %x 15071>5 belong x \b, devtype %x 15072 15073#------------------------------------------------------------------------------ 15074# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $ 15075# flash: file(1) magic for Macromedia Flash file format 15076# 15077# See 15078# 15079# https://www.macromedia.com/software/flash/open/ 15080# https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 15081# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 15082# 15083 150840 name swf-details 15085 15086>0 string F 15087>>8 byte&0xfd 0x08 Macromedia Flash data 15088!:mime application/x-shockwave-flash 15089>>>3 byte x \b, version %d 15090>>8 byte&0xfe 0x10 Macromedia Flash data 15091!:mime application/x-shockwave-flash 15092>>>3 byte x \b, version %d 15093>>8 byte 0x18 Macromedia Flash data 15094!:mime application/x-shockwave-flash 15095>>>3 byte x \b, version %d 15096>>8 beshort&0xff87 0x2000 Macromedia Flash data 15097!:mime application/x-shockwave-flash 15098>>>3 byte x \b, version %d 15099>>8 beshort&0xffe0 0x3000 Macromedia Flash data 15100!:mime application/x-shockwave-flash 15101>>>3 byte x \b, version %d 15102>>8 byte&0x7 0 15103>>>8 ubyte >0x2f 15104>>>>9 ubyte <0x20 Macromedia Flash data 15105!:mime application/x-shockwave-flash 15106>>>>>3 byte x \b, version %d 15107 15108>0 string C 15109>>8 byte 0x78 Macromedia Flash data (compressed) 15110!:mime application/x-shockwave-flash 15111>>>3 byte x \b, version %d 15112 15113>0 string Z 15114>>8 byte 0x5d Macromedia Flash data (lzma compressed) 15115!:mime application/x-shockwave-flash 15116>>>3 byte x \b, version %d 15117 15118 151191 string WS 15120>4 ulelong >14 15121>>3 ubyte !0 15122>>>0 use swf-details 15123 15124# From: Cal Peake <cp@absolutedigital.net> 151250 string FLV\x01 Macromedia Flash Video 15126!:mime video/x-flv 15127 15128# 15129# Yosu Gomez 151300 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 151310 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 15132# From Dave Wilson 151330 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 15134 15135#------------------------------------------------------------------------------ 15136# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $ 15137# flif: Magic data for file(1) command. 15138# FLIF (Free Lossless Image Format) 15139 151400 string FLIF FLIF 15141>4 string <H image data 15142>>6 beshort x \b, %u 15143>>8 beshort x \bx%u 15144>>5 string 1 \b, 8-bit/color, 15145>>5 string 2 \b, 16-bit/color, 15146>>4 string 1 \b, grayscale, non-interlaced 15147>>4 string 3 \b, RGB, non-interlaced 15148>>4 string 4 \b, RGBA, non-interlaced 15149>>4 string A \b, grayscale 15150>>4 string C \b, RGB, interlaced 15151>>4 string D \b, RGBA, interlaced 15152>4 string >H \b, animation data 15153>>5 ubyte <255 \b, %i frames 15154>>>7 beshort x \b, %u 15155>>>9 beshort x \bx%u 15156>>>6 string =1 \b, 8-bit/color 15157>>>6 string =2 \b, 16-bit/color 15158>>5 ubyte 0xFF 15159>>>6 beshort x \b, %i frames, 15160>>>9 beshort x \b, %u 15161>>>11 beshort x \bx%u 15162>>>8 string =1 \b, 8-bit/color 15163>>>8 string =2 \b, 16-bit/color 15164>>4 string =Q \b, grayscale, non-interlaced 15165>>4 string =S \b, RGB, non-interlaced 15166>>4 string =T \b, RGBA, non-interlaced 15167>>4 string =a \b, grayscale 15168>>4 string =c \b, RGB, interlaced 15169>>4 string =d \b, RGBA, interlaced 15170 15171#------------------------------------------------------------------------------ 15172# $File: fonts,v 1.51 2022/08/16 11:16:39 christos Exp $ 15173# fonts: file(1) magic for font data 15174# 151750 search/1 FONT ASCII vfont text 151760 short 0436 Berkeley vfont data 151770 short 017001 byte-swapped Berkeley vfont data 15178 15179# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 15180# Modified by: Joerg Jenderek 15181# URL: https://en.wikipedia.org/wiki/PostScript_fonts 15182# http://fileformats.archiveteam.org/wiki/Adobe_Type_1 15183# Reference: http://mark0.net/download/triddefs_xml.7z 15184# defs/p/pfb.trid.xml 15185# Note: PFB stands for Printer Font Binary 151860 string %!PS-AdobeFont-1. PostScript Type 1 font text 15187#!:mime font/x-postscript-pfb 15188#!:ext pfb 15189>20 string >\0 (%s) 15190# http://www.nationalarchives.gov.uk/pronom/fmt/525 151916 string %!PS-AdobeFont-1. 15192# skip DROID fmt-525-signature-id-816.pfb by checking for content after header 15193>24 ubyte x PostScript Type 1 font program data 15194#!:mime application/octet-stream 15195!:mime font/x-postscript-pfb 15196!:ext pfb 15197# often followed by colon (3Ah) and space (20h) and font name like: DarkGardenMK LetterGothic 15198>>24 ubyte =0x3A 15199>>>26 string >\0 (%s) 15200# some times instead of colon %%CreationDate: and "font name" later 15201>>24 ubyte !0x3A 15202# font name directive followed by def like: c0633bt_.pfb 15203>>>25 search/1247 /FontName\040/ 15204# show font name in parentheses like: Frankfurt Lithos CharterBT-BoldItalic Courier10PitchBT-Bold 15205>>>>&0 regex [A-Za-z0-9-]+ (%s) 15206# http://cd.textfiles.com/maxfonts/ATM/M/MIRROR__.PFB 152076 string %PS-AdobeFont-1. PostScript Type 1 font program data 15208!:mime font/x-postscript-pfb 15209!:ext pfb 15210# font name like: Times-Mirror 15211>25 string >\0 (%s) 152120 string %!FontType1 PostScript Type 1 font program data 15213#!:mime font/x-postscript-pfb 15214#!:ext pfb 152156 string %!FontType1 PostScript Type 1 font program data 15216#!:mime application/octet-stream 15217!:mime font/x-postscript-pfb 15218!:ext pfb 15219# font name like: CaslonOpenFace FetteFraktur Kaufmann Linotext MesozoicGothic Old-Town 15220>23 string >\0 (%s) 15221# http://cd.textfiles.com/maxfonts/ATM/P/PLAYBI.PFB 15222230 string %!FontType1 PostScript Type 1 font program data 15223!:mime font/x-postscript-pfb 15224!:ext pfb 15225# font name like: Playbill 15226>247 string >\0 (%s) 152270 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 15228#!:mime font/x-postscript-pfb 15229#!:ext pfb 15230 15231# Summary: PostScript Type 1 Printer Font Metrics 15232# URL: https://en.wikipedia.org/wiki/PostScript_fonts 15233# Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf 15234# Modified by: Joerg Jenderek 15235# Note: moved from ./msdos magic 15236# dfVersion 256=0100h 152370 uleshort 0x0100 15238# GRR: line above is too general as it catches also TrueType font, 15239# raw G3 data FAX, WhatsApp encrypted and Panorama database 15240# dfType 129=0081h 15241>66 uleshort 0x0081 15242# dfVertRes 300=012Ch not needed as additional test 15243#>>70 uleshort 0x012c 15244# dfHorizRes 300=012Ch 15245#>>>72 uleshort 0x012c 15246# dfDriverInfo points to postscript information section 15247>>(101.l) string/c Postscript Printer Font Metrics 15248# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID 15249!:mime application/x-font-pfm 15250# AppleShare Print Server 15251#!:apple ASPS???? 15252!:ext pfm 15253# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking 15254#>>>6 string >\060 - %-.60s 15255# dfDriverInfo 15256>>>139 ulelong >0 15257# often abbreviated and same as filename 15258>>>>(139.l) string x %s 15259# dfSize 15260>>>2 ulelong x \b, %d bytes 15261# dfFace 210=D2h 9Eh 15262>>>105 ulelong >0 15263# Windows font name 15264>>>>(105.l) string x \b, %s 15265# dfItalic 15266>>>80 ubyte 1 italic 15267# dfUnderline 15268>>>81 ubyte 1 underline 15269# dfStrikeOut 15270>>>82 ubyte 1 strikeout 15271# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc 15272>>>83 uleshort >699 bold 15273# dfPitchAndFamily 16 17 48 49 64 65 15274>>>90 ubyte 16 serif 15275>>>90 ubyte 17 serif proportional 15276#>>>90 ubyte 48 other 15277>>>90 ubyte 49 proportional 15278>>>90 ubyte 64 script 15279>>>90 ubyte 65 script proportional 15280 15281# X11 font files in SNF (Server Natural Format) format 15282# updated by Joerg Jenderek at Feb 2013 and Nov 2021 15283# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 15284# URL: http://fileformats.archiveteam.org/wiki/SNF 15285# Reference: https://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/bitmap/snfstr.h 152860 belong 00000004 15287# version2 same as version1 in struct _snfFontInfo 15288>104 belong 00000004 X11 SNF font data, MSB first 15289# GRR: line above is too general as it catches also DEGAS low-res bitmap like: 15290# http://cd.textfiles.com/geminiatari/FILES/GRAPHICS/ANIMAT/SPID_PAT/BIGSPID.PI1 15291!:mime application/x-font-sfn 15292!:ext snf 15293# GRR: line below is too general as it catches also Xbase index file t3-CHAR.NDX 152940 lelong 00000004 15295>104 lelong 00000004 X11 SNF font data, LSB first 15296!:mime application/x-font-sfn 15297# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/snf-x11-lsb.trid.xml 15298!:ext snf 15299 15300# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 153010 search/1 STARTFONT\ X11 BDF font text 15302 15303# From: Joerg Jenderek 15304# URL: https://grub.gibibit.com/New_font_format 15305# Reference: util/grub-mkfont.c 15306# include/grub/fontformat.h 15307# FONT_FORMAT_SECTION_NAMES_FILE 153080 string FILE 15309# FONT_FORMAT_PFF2_MAGIC 15310>8 string PFF2 15311# leng 4 only at the moment 15312>>4 ubelong 4 15313# FONT_FORMAT_SECTION_NAMES_FONT_NAME 15314>>>12 string NAME GRUB2 font 15315!:mime application/x-font-pf2 15316!:ext pf2 15317# length of font_name 15318>>>>16 ubelong >0 15319# font_name 15320>>>>>20 string >\0 "%-s" 15321 15322# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 15323# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 153240 string \001fcp X11 Portable Compiled Font data, 15325>12 lelong ^0x08 bit: LSB, 15326>12 lelong &0x08 bit: MSB, 15327>12 lelong ^0x04 byte: LSB first 15328>12 lelong &0x04 byte: MSB first 153290 string D1.0\015 X11 Speedo font data 15330 15331#------------------------------------------------------------------------------ 15332# FIGlet fonts and controlfiles 15333# From figmagic supplied with Figlet version 2.2 15334# "David E. O'Brien" <obrien@FreeBSD.ORG> 153350 string flf FIGlet font 15336>3 string >2a version %-2.2s 153370 string flc FIGlet controlfile 15338>3 string >2a version %-2.2s 15339 15340# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 15341# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 153420 belong 0x14025919 libGrx font data, 15343>8 leshort x %dx 15344>10 leshort x \b%d 15345>40 string x %s 15346# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 15347# Update: Joerg Jenderek 15348# URL: http://fileformats.archiveteam.org/wiki/CPI 15349# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html 153500 belong 0xff464f4e DOS code page font data collection 15351!:mime font/x-dos-cpi 15352!:ext cpi 153530 string \x7fDRFONT DR-DOS code page font data collection 15354!:mime font/x-drdos-cpi 15355!:ext cpi 153567 belong 0x00454741 DOS code page font data 153577 belong 0x00564944 DOS code page font data (from Linux?) 153584098 string DOSFONT DOSFONT2 encrypted font data 15359 15360# From: Joerg Jenderek 15361# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font 15362# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt 15363# 15364# usual case with lightening mask and skewing mask 5555h~UU 15365#62 ulelong 0x55555555 15366# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72 15367#>2 uleshort <73 15368#>>0 use gdos-font 15369# BOX18.GFT COWBOY30.GFT ROYALK30.GFT 15370#62 ulelong 0 15371# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size 15372#>2 uleshort >2 15373# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72 15374#>>2 uleshort <73 15375# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE 15376#>>>4 ulelong >0x001F1f1F 15377# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data 15378#>>>>76 ulelong >83 15379#>>>>>0 use gdos-font 153800 name gdos-font 15381>0 uleshort x GEM GDOS font 15382!:mime application/x-font-gdos 15383# also .eps found like AA070GEP.EPS AI360GEP.EPS 15384!:ext fnt/gtf 15385# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE 15386>4 string x %.32s 15387# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT 15388>2 uleshort x %u 15389# face ID (must be unique) 15390>0 uleshort x \b, ID %#4.4x 15391# lowest character index in face (4 but usually 32 for disk-loaded fonts) 15392#>36 uleshort !32 \b, unusual character index %u 15393# width of the widest character like 0 8 10 12 16 24 32 15394#>50 uleshort x \b, %u char width 15395# width of the widest character cell like 8 11 12 14 15 16 33 67 15396#>52 uleshort x \b, %u cell width 15397# thickening size in pixel like 0 1 2 3 4 5 6 7 8 15398#>58 uleshort x \b, %u thick 15399# lightening mask to eliminate pixels, usually 5555h 15400>62 uleshort !0x5555 \b, lightening mask %#x 15401# skewing mask to determine when to perform additional rotation when skewing, usually 5555h 15402>64 uleshort !0x5555 \b, skewing mask %#x 15403# offset to optional horizontal offset table 0 58h~88 5eh 252h 15404#>68 ulelong x \b, %#x horizontal table offset 15405# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h 15406#>72 ulelong x \b, %#x coffset 15407# offset to font data like 116h 118h 158 20Ah 20Eh 15408>76 ulelong x \b, %#x foffset 15409# form width in bytes like 58 67 156 190 227 317 345 15410#>80 uleshort x \b, %u fwidth 15411# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150 15412#>82 uleshort x \b, %u fheight 15413# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h 15414#>84 ulelong x \b, %#x noffset 15415 15416# downloadable fonts for browser (prints type) anthon@mnt.org 15417# https://tools.ietf.org/html/rfc3073 154180 string PFR1 Portable Font Resource font data (new) 15419>102 string >0 \b: %s 154200 string PFR0 Portable Font Resource font data (old) 15421>4 beshort >0 version %d 15422 15423# True Type fonts 15424# Modified by: Joerg Jenderek 15425# URL: https://en.wikipedia.org/wiki/TrueType 15426# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/ 15427# 15428# sfnt version "typ1" used by some Apple, but no example found 154290 string typ1 15430>0 use sfnt-font 15431>0 use sfnt-names 15432# sfnt version "true" used by some Apple 154330 string true 15434>0 use sfnt-font 15435>0 use sfnt-names 15436# GRR: below test is too general 15437# sfnt version often 0x00010000 154380 string \000\001\000\000 15439>0 use sfnt-font 15440>0 use sfnt-names 15441# validate and display sfnt font data like number of tables 154420 name sfnt-font 15443# file 5.30 version assumes 00FFh as maximal number of tables 15444#>4 ubeshort <0x0100 15445# maximal 27 tables found like in Skia.ttf 15446# 46 different table names mentioned on Apple specification 15447# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number 15448>4 ubeshort <47 15449# skip bad examples with garbage table names like in a5.show HYPERC MAC 15450# tag names consist of up to four characters padded with spaces at end like 15451# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ... 15452>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] 15453#>>>0 ubelong x \b, sfnt version %#x 15454>>>0 ubelong !0x4f54544f TrueType 15455!:mime font/sfnt 15456!:apple ????tfil 15457# .ttf for TrueType font 15458# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe 15459!:ext ttf/tte 15460# sfnt version 4F54544Fh~OTTO 15461>>>0 ubelong =0x4f54544f OpenType 15462!:mime font/otf 15463!:apple ????OTTO 15464!:ext otf 15465>>>0 ubelong x Font data 15466# DSIG=44454947h table name implies a digitally signed font 15467# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432 15468>>>12 search/432 DSIG \b, digitally signed 15469>>>4 ubeshort x \b, %d tables 15470# minimal 9 tables found like in NISC18030.ttf 15471#>>>4 ubeshort <10 TMIN 15472#>>>4 ubeshort >24 TBIG 15473# table directory entries 15474>>>12 string x \b, 1st "%4.4s" 15475 15476# search and display 1st name in sfnt font which is often copyright text 15477# does not work inside font collections 154780 name sfnt-names 15479# search for naming table 15480>12 search/432/s name 15481# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf 15482#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET 15483>>&8 ubelong >0x00100000 15484# offset of name table 15485>>>&-4 ubelong x \b, name offset %#x 15486# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h 15487>>&8 ubelong <0x00100000 15488>>>&-16 ubelong x 15489# name table 15490>>>>(&8.L) ubequad x 15491# invalid format selector 15492#>>>>>&-8 ubeshort !0 \b, invalid selector %x 15493# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf 15494# maximal 1227 name records found like in Apple Chancery.ttf 15495#>>>>>&-6 ubeshort <0x4 mincount 15496#>>>>>&-6 ubeshort >130 maxcount 15497>>>>>&-6 ubeshort x \b, %d names 15498# offset to start of string storage from start of table 15499#>>>>>&-4 ubeshort x \b, record offset %d 15500# 1st name record 15501# string offset from start of storage area 15502#>>>>>&8 ubeshort x \b, string offset %d 15503# string length 15504#>>>>>&6 ubeshort x \b, string length %d 15505# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf 15506# also found 0 like in SWZCONLN.TTF 15507#>>>>>&6 ubeshort <8 MIN STRING 15508# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf 15509#>>>>>&6 ubeshort >805 MAX STRING 15510# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft 15511#>>>>>&-2 ubeshort >3 BAD PLATFORM 15512>>>>>&-2 ubeshort 0 \b, Unicode 15513>>>>>&-2 ubeshort 1 \b, Macintosh 15514>>>>>&-2 ubeshort 3 \b, Microsoft 15515# languageID (0~english Macintosh, 0409h~english Microsoft, ...) 15516>>>>>&2 ubeshort >0 \b, language %#x 15517# name identifiers 15518# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ... 15519>>>>>&4 ubeshort >0 \b, type %d string 15520# platform specific encoding: 15521# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0 15522#>>>>>&0 ubeshort x \b, %d encoding 15523>>>>>&0 ubeshort 0 15524# handle only name string offset 0 because do not know how to add 2 relative offsets 15525>>>>>>&6 ubeshort 0 15526>>>>>>>&(&-14.S-18) ubyte !0 15527# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h 15528# often copyright string that starts like \251 2006 The Monotype Corporation 15529>>>>>>>>&-1 string x \b, %-11.96s 15530# test for unicode string 15531>>>>>>>&(&-14.S-18) ubyte 0 15532>>>>>>>>&0 lestring16 x \b, %-11.96s 15533# unicode encoding 15534>>>>>&0 ubeshort >0 15535>>>>>>&6 ubeshort 0 15536>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s 15537 155380 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 155390 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 15540 15541# TrueType/OpenType font collections (.ttc) 15542# URL: https://en.wikipedia.org/wiki/OpenType 15543# https://www.microsoft.com/typography/otspec/otff.htm 15544# Modified by: Joerg Jenderek 15545# Note: container for TrueType, OpenType font 155460 string ttcf 15547# skip ASCII text 15548>4 ubyte 0 15549# sfnt version often 0x00010000 of 1st table is TrueType 15550>>(12.L) ubelong !0x4f54544f TrueType 15551!:mime font/ttf 15552!:apple ????tfil 15553!:ext ttc 15554# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 15555>>(12.L) ubelong =0x4f54544f OpenType 15556!:mime font/otf 15557!:apple ????OTTO 15558# no example found for otc 15559!:ext ttc/otc 15560>>4 ubyte x font collection data 15561#!:mime font/collection 15562# TCC version 15563>>4 belong 0x00010000 \b, 1.0 15564>>4 belong 0x00020000 \b, 2.0 15565>>8 ubelong >0 \b, %d fonts 15566# array offset size = fonts * offsetsize = fonts * 4 15567>>(8.L*4) ubequad x 15568# 0x44454947 = 'DSIG' 15569>>>&4 belong 0x44534947 \b, digitally signed 15570# offset to 1st font 15571>>12 ubelong x \b, at %#x 15572# point to 1st font that starts with sfnt version 15573>>(12.L) use sfnt-font 15574 15575# Opentype font data from Avi Bercovich 155760 string OTTO OpenType font data 15577!:mime application/vnd.ms-opentype 15578 15579# From: Alex Myczko <alex@aiei.ch> 155800 string SplineFontDB: Spline Font Database 15581!:mime application/vnd.font-fontforge-sfd 15582>14 string x version %s 15583 15584# EOT 155850x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 15586>0x22 string LP Embedded OpenType (EOT) 15587# workaround until there's lepstring16 15588# >>0x52 lepstring16/h >\0 \b, %s family 15589>>0x52 short !0 15590>>>0x54 lestring16 x \b, %s family 15591!:mime application/vnd.ms-fontobject 15592 15593# Web Open Font Format (.woff) 155940 name woff 15595>4 belong 0x00010000 \b, TrueType 15596>4 belong 0x4F54544F \b, CFF 15597>4 belong 0x74727565 \b, TrueType 15598>4 default x 15599>>4 belong x \b, flavor %d 15600>8 belong x \b, length %d 15601#>12 beshort x \b, numTables %d 15602#>14 beshort x \b, reserved %d 15603#>16 belong x \b, totalSfntSize %d 15604 15605# https://www.w3.org/TR/WOFF/ 156060 string wOFF Web Open Font Format 15607!:mime font/woff 15608>0 use woff 15609>20 beshort x \b, version %d 15610>22 beshort x \b.%d 15611# https://www.w3.org/TR/WOFF2/ 156120 string wOF2 Web Open Font Format (Version 2) 15613!:mime font/woff2 15614!:ext woff2 15615>0 use woff 15616#>20 belong x \b, totalCompressedSize %d 15617>24 beshort x \b, version %d 15618>26 beshort x \b.%d 15619 15620#------------------------------------------------------------------------------ 15621# $File: forth,v 1.4 2021/04/26 15:56:00 christos Exp $ 15622# forth: file(1) magic for various Forth environments 15623# From: Lubomir Rintel <lkundrak@v3.sk> 15624# 15625 15626# Has a FORTH stack diagram and something that looks very much like a FORTH 15627# multi-line word definition. Probably a FORTH source. 156280 regex \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\) 15629>0 regex \^:\[[:space:]] 15630>>0 regex \^;$ FORTH program 15631!:mime text/x-forth 15632 15633# Inline word definition complete with a stack diagram 156340 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program 15635!:mime text/x-forth 15636 15637# Various dictionary images used by OpenFirware FORTH environment 15638 156390 lelong 0xe1a00000 15640>8 lelong 0xe1a00000 15641# skip raspberry pi kernel image kernel7.img by checking for positive text length 15642>>24 lelong >0 ARM OpenFirmware FORTH Dictionary, 15643>>>24 lelong x Text length: %d bytes, 15644>>>28 lelong x Data length: %d bytes, 15645>>>32 lelong x Text Relocation Table length: %d bytes, 15646>>>36 lelong x Data Relocation Table length: %d bytes, 15647>>>40 lelong x Entry Point: %#08X, 15648>>>44 lelong x BSS length: %d bytes 15649 156500 string MP 15651>28 lelong 1 x86 OpenFirmware FORTH Dictionary, 15652>>4 leshort x %d blocks 15653>>2 leshort x + %d bytes, 15654>>6 leshort x %d relocations, 15655>>8 leshort x Header length: %d paragraphs, 15656>>10 leshort x Data Size: %d 15657>>12 leshort x - %d 4K pages, 15658>>14 lelong x Initial Stack Pointer: %#08X, 15659>>20 lelong x Entry Point: %#08X, 15660>>24 lelong x First Relocation Item: %d, 15661>>26 lelong x Overlay Number: %d, 15662>>18 leshort x Checksum: %#08X 15663 156640 belong 0x48000020 PowerPC OpenFirmware FORTH Dictionary, 15665>4 belong x Text length: %d bytes, 15666>8 belong x Data length: %d bytes, 15667>12 belong x BSS length: %d bytes, 15668>16 belong x Symbol Table length: %d bytes, 15669>20 belong x Entry Point: %#08X, 15670>24 belong x Text Relocation Table length: %d bytes, 15671>28 belong x Data Relocation Table length: %d bytes 15672 156730 lelong 0x10000007 MIPS OpenFirmware FORTH Dictionary, 15674>4 lelong x Text length: %d bytes, 15675>8 lelong x Data length: %d bytes, 15676>12 lelong x BSS length: %d bytes, 15677>16 lelong x Symbol Table length: %d bytes, 15678>20 lelong x Entry Point: %#08X, 15679>24 lelong x Text Relocation Table length: %d bytes, 15680>28 lelong x Data Relocation Table length: %d bytes 15681 15682# Dictionary images used by minimal C FORTH environments, any platform, 15683# using native byte order. 15684 15685# Weak. 15686#0 short 0x5820 cForth 16-bit Dictionary, 15687#>2 short x Serial: %#08X, 15688#>4 short x Dictionary Start: %#08X, 15689#>6 short x Dictionary Size: %d bytes, 15690#>8 short x User Area Start: %#08X, 15691#>10 short x User Area Size: %d bytes, 15692#>12 short x Entry Point: %#08X 15693 156940 long 0x581120 cForth 32-bit Dictionary, 15695>4 long x Serial: %#08X, 15696>8 long x Dictionary Start: %#08X, 15697>12 long x Dictionary Size: %d bytes, 15698>16 long x User Area Start: %#08X, 15699>20 long x User Area Size: %d bytes, 15700>24 long x Entry Point: %#08X 15701 15702#------------------------------------------------------------------------------ 15703# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $ 15704# FORTRAN source 15705# Check that the first 100 lines start with C or whitespace first. 157060 regex/100l !\^[^Cc\ \t].*$ 15707>0 regex/100l \^[Cc][\ \t] FORTRAN program text 15708!:mime text/x-fortran 15709!:strength - 5 15710 15711#------------------------------------------------------------------------------ 15712# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $ 15713# frame: file(1) magic for FrameMaker files 15714# 15715# This stuff came on a FrameMaker demo tape, most of which is 15716# copyright, but this file is "published" as witness the following: 15717# 15718# Note that this is the Framemaker Maker Interchange Format, not the 15719# Normal format which would be application/vnd.framemaker. 15720# 157210 string \<MakerFile FrameMaker document 15722!:mime application/x-mif 15723>11 string 5.5 (5.5 15724>11 string 5.0 (5.0 15725>11 string 4.0 (4.0 15726>11 string 3.0 (3.0 15727>11 string 2.0 (2.0 15728>11 string 1.0 (1.0 15729>14 byte x %c) 15730# URL: http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format 15731# Reference: https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf 15732# Update: Joerg Jenderek 2019 Nov 157330 string \<MIFFile FrameMaker MIF (ASCII) file 15734# https://www.iana.org/assignments/media-types/application/vnd.mif 15735!:mime application/vnd.mif 15736# mif most but also find bookTOC.framemif 15737!:ext mif/framemif 15738# followed by space~20h 15739#>8 ubyte 0x20 \b, space before version 15740# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ... 15741>9 string x (%.3s 15742# if not greater sign then display 4th character of version 15743>12 ubyte =0x3e \b) 15744>12 ubyte !0x3e \b%c) 15745# comment starting with # shows the name+version number of generating program 15746>13 search/3 # 15747>>&0 string x "%s" 157480 search/1 \<MakerDictionary FrameMaker Dictionary text 15749!:mime application/x-mif 15750>17 string 3.0 (3.0) 15751>17 string 2.0 (2.0) 15752>17 string 1.0 (1.x) 157530 string \<MakerScreenFont FrameMaker Font file 15754!:mime application/x-mif 15755>17 string 1.01 (%s) 157560 string \<MML FrameMaker MML file 15757!:mime application/x-mif 157580 string \<BookFile FrameMaker Book file 15759!:mime application/x-mif 15760>10 string 3.0 (3.0 15761>10 string 2.0 (2.0 15762>10 string 1.0 (1.0 15763>13 byte x %c) 15764# XXX - this book entry should be verified, if you find one, uncomment this 15765#0 string \<Book\040 FrameMaker Book (ASCII) file 15766#!:mime application/x-mif 15767#>6 string 3.0 (3.0) 15768#>6 string 2.0 (2.0) 15769#>6 string 1.0 (1.0) 157700 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file 15771!:mime application/x-mif 15772 15773#------------------------------------------------------------------------------ 15774# $File: freebsd,v 1.9 2022/01/19 12:44:13 christos Exp $ 15775# freebsd: file(1) magic for FreeBSD objects 15776# 15777# All new-style FreeBSD magic numbers are in host byte order (i.e., 15778# little-endian on x86). 15779# 15780# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 15781# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 15782# schemes for distinguishing between executable images, shared libraries, 15783# and object files. 15784# 15785# FreeBSD says: 15786# 15787# Regardless of whether it's pure, demand-paged, or none of the 15788# above: 15789# 15790# if the entry point is < 4096, then it's a shared library if 15791# the "has run-time loader information" bit is set, and is 15792# position-independent if the "is position-independent" bit 15793# is set; 15794# 15795# if the entry point is >= 4096 (or >4095, same thing), then it's 15796# an executable, and is dynamically-linked if the "has run-time 15797# loader information" bit is set. 15798# 15799# On x86, NetBSD says: 15800# 15801# If it's neither pure nor demand-paged: 15802# 15803# if it has the "has run-time loader information" bit set, it's 15804# a dynamically-linked executable; 15805# 15806# if it doesn't have that bit set, then: 15807# 15808# if it has the "is position-independent" bit set, it's 15809# position-independent; 15810# 15811# if the entry point is non-zero, it's an executable, otherwise 15812# it's an object file. 15813# 15814# If it's pure: 15815# 15816# if it has the "has run-time loader information" bit set, it's 15817# a dynamically-linked executable, otherwise it's just an 15818# executable. 15819# 15820# If it's demand-paged: 15821# 15822# if it has the "has run-time loader information" bit set, 15823# then: 15824# 15825# if the entry point is < 4096, it's a shared library; 15826# 15827# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 15828# it's a dynamically-linked executable); 15829# 15830# if it doesn't have the "has run-time loader information" bit 15831# set, then it's just an executable. 15832# 15833# (On non-x86, NetBSD does much the same thing, except that it uses 15834# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 15835# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 15836# had 8K pages; dunno about MIPS.) 15837# 15838# I suspect the two will differ only in perverse and uninteresting cases 15839# ("shared" libraries that aren't demand-paged and whose pages probably 15840# won't actually be shared, executables with entry points <4096). 15841# 15842# I leave it to those more familiar with FreeBSD and NetBSD to figure out 15843# what the right answer is (although using ">4095", FreeBSD-style, is 15844# probably better than separately checking for "=4096" and ">4096", 15845# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 15846# executables using the NetBSD technique.) 15847# 158480 lelong&0377777777 041400407 FreeBSD/i386 15849>20 lelong <4096 15850>>3 byte&0xC0 &0x80 shared library 15851>>3 byte&0xC0 0x40 PIC object 15852>>3 byte&0xC0 0x00 object 15853>20 lelong >4095 15854>>3 byte&0x80 0x80 dynamically linked executable 15855>>3 byte&0x80 0x00 executable 15856>16 lelong >0 not stripped 15857 158580 lelong&0377777777 041400410 FreeBSD/i386 pure 15859>20 lelong <4096 15860>>3 byte&0xC0 &0x80 shared library 15861>>3 byte&0xC0 0x40 PIC object 15862>>3 byte&0xC0 0x00 object 15863>20 lelong >4095 15864>>3 byte&0x80 0x80 dynamically linked executable 15865>>3 byte&0x80 0x00 executable 15866>16 lelong >0 not stripped 15867 158680 lelong&0377777777 041400413 FreeBSD/i386 demand paged 15869>20 lelong <4096 15870>>3 byte&0xC0 &0x80 shared library 15871>>3 byte&0xC0 0x40 PIC object 15872>>3 byte&0xC0 0x00 object 15873>20 lelong >4095 15874>>3 byte&0x80 0x80 dynamically linked executable 15875>>3 byte&0x80 0x00 executable 15876>16 lelong >0 not stripped 15877 158780 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 15879>20 lelong <4096 15880>>3 byte&0xC0 &0x80 shared library 15881>>3 byte&0xC0 0x40 PIC object 15882>>3 byte&0xC0 0x00 object 15883>20 lelong >4095 15884>>3 byte&0x80 0x80 dynamically linked executable 15885>>3 byte&0x80 0x00 executable 15886>16 lelong >0 not stripped 15887 15888# XXX gross hack to identify core files 15889# cores start with a struct tss; we take advantage of the following: 15890# byte 7: highest byte of the kernel stack pointer, always 0xfe 15891# 8/9: kernel (ring 0) ss value, always 0x0010 15892# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 15893# 28: low order byte of the current PTD entry, always 0 since the 15894# PTD is page-aligned 15895# 158967 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 15897>1039 string >\0 from '%s' 15898 15899# /var/run/ld.so.hints 15900# What are you laughing about? 159010 lelong 011421044151 ld.so hints file (Little Endian 15902>4 lelong >0 \b, version %d) 15903>4 belong <1 \b) 159040 belong 011421044151 ld.so hints file (Big Endian 15905>4 belong >0 \b, version %d) 15906>4 belong <1 \b) 15907 15908# 15909# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 15910# 159110 string SCRSHOT_ scrshot(1) screenshot, 15912>8 byte x version %d, 15913>9 byte 2 %d bytes in header, 15914>>10 byte x %d chars wide by 15915>>11 byte x %d chars high 15916 15917# 15918# FreeBSD kernel minidumps 15919# 159200 string minidump\040FreeBSD/ FreeBSD kernel minidump 15921# powerpc uses 32-byte magic, followed by 32-byte mmu kind, then version 15922>17 string powerpc 15923>>17 string >\0 for %s, 15924>>>32 string >\0 %s, 15925>>>>64 byte 0 big endian, 15926>>>>>64 belong x version %d 15927>>>>64 default x little endian, 15928>>>>>64 lelong x version %d 15929# all other architectures use 24-byte magic, followed by version 15930>17 default x 15931>>17 string >\0 for %s, 15932>>>24 byte 0 big endian, 15933>>>>24 belong x version %d 15934>>>24 default x little endian, 15935>>>>24 lelong x version %d 15936 15937#------------------------------------------------------------------------------ 15938# $File: fsav,v 1.22 2021/04/26 15:56:00 christos Exp $ 15939# fsav: file(1) magic for datafellows fsav virus definition files 15940# Anthon van der Neut (anthon@mnt.org) 15941 15942# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 159430 beshort 0x1575 fsav macro virus signatures 15944>8 leshort >0 (%d- 15945>11 byte >0 \b%02d- 15946>10 byte >0 \b%02d) 15947# ftp://ftp.f-prot.com/pub/sign.zip 15948#10 ubyte <12 15949#>9 ubyte <32 15950#>>8 ubyte 0x0a 15951#>>>12 ubyte 0x07 15952#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 15953#>>>>10 byte 0 \b01- 15954#>>>>10 byte 1 \b02- 15955#>>>>10 byte 2 \b03- 15956#>>>>10 byte 3 \b04- 15957#>>>>10 byte 4 \b05- 15958#>>>>10 byte 5 \b06- 15959#>>>>10 byte 6 \b07- 15960#>>>>10 byte 7 \b08- 15961#>>>>10 byte 8 \b09- 15962#>>>>10 byte 9 \b10- 15963#>>>>10 byte 10 \b11- 15964#>>>>10 byte 11 \b12- 15965#>>>>9 ubyte >0 \b%02d) 15966# ftp://ftp.f-prot.com/pub/sign2.zip 15967#0 ubyte 0x62 15968#>1 ubyte 0xF5 15969#>>2 ubyte 0x1 15970#>>>3 ubyte 0x1 15971#>>>>4 ubyte 0x0e 15972#>>>>>13 ubyte >0 fsav virus signatures 15973#>>>>>>11 ubyte x size %#02x 15974#>>>>>>12 ubyte x \b%02x 15975#>>>>>>13 ubyte x \b%02x bytes 15976 15977# Joerg Jenderek: joerg dot jenderek at web dot de 15978# clamav-0.100.2\docs\html\node60.html 15979# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf 15980# ClamAV virus database files start with a 512 bytes colon separated header 15981# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 15982# + gzipped (optional) tarball files 15983# output can often be verified by `sigtool --info=FILE` 159840 string ClamAV-VDB: Clam AntiVirus 15985# padding spaces implies database 15986>511 ubyte =0x20 database 15987!:mime application/x-clamav-database 15988# empty build time 15989>>10 string =:: (unsigned) 15990# sigtool(1) man page 15991!:ext cud 15992# display some text to avoid error like: 15993# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type 15994# file: could not find any valid magic files! (No error) 15995>>10 default x (with buildtime) 15996#>>10 default x 15997# clamtmp is used for temporarily database like update process 15998# for pure tar database only cld extension found 15999!:ext cld/cvd/clamtmp/cud 16000>511 default x file 16001!:mime application/x-clamav 16002!:ext info 16003>11 string >\0 16004# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE` 16005>>11 regex \^[^:]{0,23} \b, %s 16006# version like 25170 16007>>>&1 regex \^[^:]{1,6} \b, version %s 16008# signaturesNumbers like 4566249 16009>>>>&1 regex \^[^:]{1,10} \b, %s signatures 16010# functionalityLevelRequired like 60 16011>>>>>&1 regex \^[^:]{1,4} \b, level %s 16012# X for nothing or MD5 16013#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s" 16014>>>>>>&1 regex \^[^:]{1,32} 16015# X for nothing or digital signature starting like AIzk/LYbX 16016#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s" 16017>>>>>>>&1 regex \^[^:]{1,255} 16018# builder like neo 16019>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s 16020# buildTime like 1506611558 16021#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s 16022>>>>>>>>>&1 regex \^[^:]{1,10} 16023# padding with spaces 16024#>>>>>>>>>>&1 ubequad x \b, padding %#16.16llx 16025>510 ubyte =0x20 16026# inspect real database content 16027#>>512 ubeshort x \b, database MAGIC %#x 16028# ./archive handle pure tar archives 16029>>1012 quad =0 \b, with 16030>>>512 use tar-file 16031# not pure tar 16032>>1012 quad !0 16033# one space at the end of text and then handles gzipped archives by ./compress 16034>>>512 string \037\213 \b, with 16035>>>>512 indirect x 16036 16037# Type: Grisoft AVG AntiVirus 16038# From: David Newgas <david@newgas.net> 160390 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 16040 160410 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 16042>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 16043 16044# From: Joerg Jenderek 16045# URL: https://www.avira.com/ 16046# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows) 16047# tested with version 15.0.43.23 at November 2019 160480 string AntiVir\ Qua Avira AntiVir quarantined 16049!:mime application/x-avira-qua 16050#!:mime application/octet-stream 16051!:ext qua 16052>156 string SUSPICIOUS_FILE 16053# file path of suspicious file 16054>>220 lestring16 x %s 16055>156 string !SUSPICIOUS_FILE 16056# file path of virus file 16057>>228 lestring16 x %s 16058# quarantined date 16059>60 ldate x at %s 16060# virus/danger name 16061>156 string !SUSPICIOUS_FILE 16062>>156 string x \b, category "%s" 16063 16064 16065#------------------------------------------------------------------------------ 16066# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 16067# fusecompress: file(1) magic for fusecompress 160680 string \037\135\211 FuseCompress(ed) data 16069>3 byte 0x00 (none format) 16070>3 byte 0x01 (bz2 format) 16071>3 byte 0x02 (gz format) 16072>3 byte 0x03 (lzo format) 16073>3 byte 0x04 (xor format) 16074>3 byte >0x04 (unknown format) 16075>4 long x uncompressed size: %d 16076 16077#------------------------------------------------------------------------------ 16078# $File: games,v 1.25 2022/05/31 18:40:20 christos Exp $ 16079# games: file(1) for games 16080 16081# Fabio Bonelli <fabiobonelli@libero.it> 16082# Quake II - III data files 160830 string IDP2 Quake II 3D Model file, 16084>20 long x %u skin(s), 16085>8 long x (%u x 16086>12 long x %u), 16087>40 long x %u frame(s), 16088>16 long x Frame size %u bytes, 16089>24 long x %u vertices/frame, 16090>28 long x %u texture coordinates, 16091>32 long x %u triangles/frame 16092 160930 string IBSP Quake 16094>4 long 0x26 II Map file (BSP) 16095>4 long 0x2E III Map file (BSP) 16096 160970 string IDS2 Quake II SP2 sprite file 16098 16099#--------------------------------------------------------------------------- 16100# Doom and Quake 16101# submitted by Nicolas Patrois 16102 161030 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 16104# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 16105 1610624 string LxD\ 203 Linuxdoom save 16107>0 string x , name=%s 16108>44 string x , world=%s 16109 16110# Quake 16111 16112# Update: Joerg Jenderek 16113# URL: http://fileformats.archiveteam.org/wiki/PAK 16114# reference: https://quakewiki.org/wiki/.pak 16115# GRR: line below is too general as it matches also Acorn PackDir compressed Archive 16116# and Git pack ./revision 161170 string PACK 16118# real Quake examples like pak0.pak have only some hundreds like 150 files 16119# So test for few files 16120>8 ulelong <0x01000000 16121# in file version 5.32 test for null terminator is only true for 16122# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 16123# look for null terminator of 1st entry name 16124>>(4.l+55) ubyte 0 Quake I or II world or extension 16125!:mime application/x-dzip 16126!:ext pak 16127#>>>8 ulelong x \b, table size %u 16128# dividing this by entry size (64) gives number of files 16129>>>8 ulelong/64 x \b, %u files 16130# offset to the beginning of the file table 16131>>>4 ulelong x \b, offset %#x 16132# 1st file entry 16133>>>(4.l) use pak-entry 16134# 2nd file entry 16135#>>>4 ulelong+64 x \b, offset %#x 16136#>>>(4.l+64) use pak-entry 16137# 16138# display file table entry of Quake PAK archive 161390 name pak-entry 16140# normally entry start after header which implies offset 12 or higher 16141>56 ulelong >11 16142# the offset from the beginning of pak to beginning of this entry file contents 16143>>56 ulelong x at %#x 16144# the size of file for this entry 16145>>60 ulelong x %u bytes 16146# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp 16147>>0 string x '%-.56s' 16148# inspect entry content by jumping to entry offset 16149>>(56) indirect x \b: 16150 16151#0 string -1\x0a Quake I demo 16152#>30 string x version %.4s 16153#>61 string x level %s 16154 16155#0 string 5\x0a Quake I save 16156 16157# The levels 16158 16159# Quake 1 16160 161610 string 5\x0aIntroduction Quake I save: start Introduction 161620 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 161630 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 161640 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 161650 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 161660 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 161670 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 161680 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 161690 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 161700 string 5\x0athe_Installation Quake I save: e2m1 The installation 161710 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 161720 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 161730 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 161740 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 161750 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 161760 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 161770 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 161780 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 161790 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 161800 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 161810 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 161820 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 161830 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 161840 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 161850 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 161860 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 161870 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 161880 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 161890 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 161900 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 161910 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 161920 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 16193 16194# Quake DeathMatch levels 16195 161960 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 161970 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 161980 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 161990 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 162000 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 162010 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 16202 16203# Scourge of Armagon 16204 162050 string 5\x0aCommand_HQ Quake I save: start Command HQ 162060 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 162070 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 162080 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 162090 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 162100 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 162110 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 162120 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 162130 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 162140 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 162150 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 162160 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 162170 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 162180 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 162190 string 5\x0aLimbo Quake I save: hip3m3 Limbo 162200 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 162210 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 162220 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 16223 16224# Malice 16225 162260 string 5\x0aThe_Academy Quake I save: start The academy 162270 string 5\x0aThe_Lab Quake I save: d1 The lab 162280 string 5\x0aArea_33 Quake I save: d1b Area 33 162290 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 162300 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 162310 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 162320 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 162330 string 5\x0aArea44 Quake I save: d1c Area 44 162340 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 162350 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 162360 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 162370 string 5\x0aThe_Flood Quake I save: d5 The flood 162380 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 162390 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 162400 string 5\x0aThe_Foundry Quake I save: d7b The foundry 162410 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 162420 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 162430 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 162440 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 162450 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 162460 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 16247 16248# Malice DeathMatch levels 16249 162500 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 162510 string 5\x0aSub_Station Quake I save: ddm2 Sub station 162520 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 162530 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 162540 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 162550 string 5\x0aDOMINO Quake I save: ddm6 Domino 162560 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 16257 16258 162590 string MComprHD MAME CHD compressed hard disk image, 16260>12 belong x version %u 16261 16262# doom - submitted by Jon Dowland 16263 162640 string =IWAD doom main IWAD data 16265>4 lelong x containing %d lumps 162660 string =PWAD doom patch PWAD data 16267>4 lelong x containing %d lumps 16268 16269# Build engine group files (Duke Nukem, Shadow Warrior, ...) 16270# Extension: .grp 16271# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 162720 string KenSilverman Build engine group file 16273>12 lelong x containing %d files 16274 16275# Summary: Warcraft 3 save 16276# Extension: .w3g 16277# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 162780 string Warcraft\ III\ recorded\ game %s 16279 16280 16281# Summary: Warcraft 3 map 16282# Extension: .w3m 16283# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 162840 string HM3W Warcraft III map file 16285 16286 16287# Summary: SGF Smart Game Format 16288# Extension: .sgf 16289# Reference: https://www.red-bean.com/sgf/ 16290# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 16291# Modified by (1): Abel Cheung (regex, more game format) 16292# FIXME: Some games don't have GM (game type) 162930 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 16294>2 search/0x200/b GM[ 16295>>&0 string 1] (Go) 16296>>&0 string 2] (Othello) 16297>>&0 string 3] (chess) 16298>>&0 string 4] (Gomoku+Renju) 16299>>&0 string 5] (Nine Men's Morris) 16300>>&0 string 6] (Backgammon) 16301>>&0 string 7] (Chinese chess) 16302>>&0 string 8] (Shogi) 16303>>&0 string 9] (Lines of Action) 16304>>&0 string 10] (Ataxx) 16305>>&0 string 11] (Hex) 16306>>&0 string 12] (Jungle) 16307>>&0 string 13] (Neutron) 16308>>&0 string 14] (Philosopher's Football) 16309>>&0 string 15] (Quadrature) 16310>>&0 string 16] (Trax) 16311>>&0 string 17] (Tantrix) 16312>>&0 string 18] (Amazons) 16313>>&0 string 19] (Octi) 16314>>&0 string 20] (Gess) 16315>>&0 string 21] (Twixt) 16316>>&0 string 22] (Zertz) 16317>>&0 string 23] (Plateau) 16318>>&0 string 24] (Yinsh) 16319>>&0 string 25] (Punct) 16320>>&0 string 26] (Gobblet) 16321>>&0 string 27] (hive) 16322>>&0 string 28] (Exxit) 16323>>&0 string 29] (Hnefatal) 16324>>&0 string 30] (Kuba) 16325>>&0 string 31] (Tripples) 16326>>&0 string 32] (Chase) 16327>>&0 string 33] (Tumbling Down) 16328>>&0 string 34] (Sahara) 16329>>&0 string 35] (Byte) 16330>>&0 string 36] (Focus) 16331>>&0 string 37] (Dvonn) 16332>>&0 string 38] (Tamsk) 16333>>&0 string 39] (Gipf) 16334>>&0 string 40] (Kropki) 16335 16336############################################## 16337# NetImmerse/Gamebryo game engine entries 16338 16339# Summary: Gamebryo game engine file 16340# Extension: .nif, .kf 16341# Created by: Abel Cheung <abelcheung@gmail.com> 163420 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 16343>&0 regex [0-9a-z.]+ \b, version %s 16344 16345# Summary: Gamebryo game engine file 16346# Extension: .kfm 16347# Created by: Abel Cheung <abelcheung@gmail.com> 163480 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 16349>&0 regex [0-9a-z.]+ \b, version %s 16350 16351# Summary: NetImmerse game engine file 16352# Extension .nif 16353# Created by: Abel Cheung <abelcheung@gmail.com> 163540 string NetImmerse\ File\ Format,\ Version 16355>&0 string n\ NetImmerse game engine file 16356>>&0 regex [0-9a-z.]+ \b, version %s 16357 16358# Type: SGF Smart Game Format 16359# URL: https://www.red-bean.com/sgf/ 16360# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 163612 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 16362>2 regex/c GM\\[1\\] - Go Game 16363>2 regex/c GM\\[6\\] - BackGammon Game 16364>2 regex/c GM\\[11\\] - Hex Game 16365>2 regex/c GM\\[18\\] - Amazons Game 16366>2 regex/c GM\\[19\\] - Octi Game 16367>2 regex/c GM\\[20\\] - Gess Game 16368>2 regex/c GM\\[21\\] - twix Game 16369 16370# Epic Games/Unreal Engine Package 16371# 163720 lelong 0x9E2A83C1 Unreal Engine Package, 16373>4 leshort x version: %i 16374>12 lelong !0 \b, names: %i 16375>28 lelong !0 \b, imports: %i 16376>20 lelong !0 \b, exports: %i 16377 163780 string ESVG 16379>4 lelong 0x00160000 16380>10 string TOC\020 Empire Deluxe for DOS saved game 16381 16382# Sid Meier's Civilization V/VI 16383# From: Benjamin Lowry <ben@ben.gmbh> 163840 string CIV5 16385>4 byte 0x08 Sid Meier's Civilization V saved game, 16386>>12 regex [0-9a-z.]+ saved by game version %s 16387>4 byte 0x01 Sid Meier's Civilization V replay data, 16388>>12 regex [0-9a-z.]+ saved by game version %s 16389 163900 string CIV6 Sid Meier's Civilization VI saved game 16391 16392# https://syzygy-tables.info/ 16393# From Michel Van den Bergh 163940 string \327f\f\245 Syzygy DTZ tablebase 16395!:mime application/syzygy 163960 string q\350#] Syzygy WDL tablebase 16397!:mime application/syzygy 16398 16399############################################################################## 16400# Grand Theft Auto (GTA) file formats. 16401# 16402# Summary: 16403# Includes GTA-specific formats used in all games from 1997 to present. Games 16404# and formats were created by Rockstar North, formerly DMA Design. Magic tests 16405# were written based on a combination of official and community documentation. 16406# 16407# Created by: Oliver Galvin <odg@riseup.net> 16408# 16409# References: 16410# * Classic GTA documentation and research: 16411# <https://gitlab.com/classic-gta/gta-data> 16412# * Official RenderWare documentation available from EA: 16413# <https://github.com/electronicarts/RenderWare3Docs> 16414# * Lots of community research in the GTAMods wiki: 16415# <https://gtamods.com/wiki> 16416 16417# GTA 2D-Era data - 'Classic' top down games (1/L/2) 16418 16419## GTA text 16420 164210 string \xbf\xf8\xbd\x49\x62\xbe GTA1 in-game text (FXT), 164220 string GBL GTA2 in-game text (GXT), 16423>3 string E English, 16424>>4 uleshort x version %d 16425>3 string F French, 16426>>4 uleshort x version %d 16427>3 string G German, 16428>>4 uleshort x version %d 16429>3 string I Italian, 16430>>4 uleshort x version %d 16431>3 string S Spanish, 16432>>4 uleshort x version %d 16433>3 string J Japanese, 16434>>4 uleshort x version %d 16435 16436## GTA maps 16437 164380 ulelong 331 GTA1 map layout (CMP), 16439>4 byte 1 Level 1 16440>4 byte 2 Level 2 16441>4 byte 3 Level 3 164420 string GBMP GTA2/GBH map layout (GMP), 16443>4 uleshort x version %d 164440 string/t [MapFiles] GTA2 multiplayer map metadata (MMP) 164450 string/t MainOrBonus\ =\ MAIN GTA2 single player map listing (test1.seq) 16446 16447## GTA 2D sprites and textures 16448 164490 ulelong 290 GTA1 style data (GRX), 8 bit editor graphics 164500 ulelong 325 GTA1 style data (GRY), 8 bit in-game graphics 164510 ulelong 336 GTA1 style data (G24), 24 bit in-game graphics 164520 string GBST GTA2/GBH style data (STY), in-game graphics, 16453>4 uleshort x version %d 16454 16455## GTA audio index 16456 164570 ulelong 0 16458>4 ulelong <0x40000 16459>>8 ulelong >4500 16460>>>8 ulelong <45000 GTA audio index data (SDT) 16461 16462## GTA scripts 16463 164640 ulelong 0x00080000 16465>4 uleshort 0x0024 GTA2 binary main script (SCR) 16466 164670 uleshort 0x063c GTA2 binary mission script (SCR), Residential area (ste) 164680 uleshort 0x055b GTA2 binary mission script (SCR), Downtown area (wil) 164690 uleshort 0x0469 GTA2 binary mission script (SCR), Industrial area (bil) 16470 164710 string v9.6\0\0 GTA2 replay file (REP), 16472>8 regex/30c [a-z0-9:\ ]+\0\0 created on %s 16473 16474# GTA 3D-Era (III/VC/SA/LCS/VCS) - used by the RenderWare engine by Criterion Games 16475 16476## GTA 3D models and textures - RenderWare binary streams 16477 164788 ulelong 0x00000310 RenderWare data, v3.1.0.0, used in GTA III on PS2, 16479>0 ulelong 0x00000016 texture archive (TXD) 16480>0 ulelong 0x00000010 3D models (DFF) 164818 ulelong 0x0401ffff RenderWare data, v3.1.0.1, used in GTA III on PC/PS2, 16482>0 ulelong 0x00000016 texture archive (TXD) 16483>0 ulelong 0x00000010 3D models (DFF) 164848 ulelong 0x0800ffff RenderWare data, v3.2.0.0, used in GTA III on PC, 16485>0 ulelong 0x00000016 texture archive (TXD) 16486>0 ulelong 0x00000010 3D models (DFF) 164878 ulelong 0x0c00ffff RenderWare data, v3.3.0.0, 16488>0 ulelong 0x00000016 texture archive (TXD) 16489>0 ulelong 0x00000010 3D models (DFF) 164908 ulelong 0x0c02ffff RenderWare data, v3.3.0.2, used in GTA III PC and GTA VC PS2, 16491>0 ulelong 0x00000016 texture archive (TXD) 16492>0 ulelong 0x00000010 3D models (DFF) 164938 ulelong 0x1000ffff RenderWare data, v3.4.0.0, 16494>0 ulelong 0x00000016 texture archive (TXD) 16495>0 ulelong 0x00000010 3D models (DFF) 164968 ulelong 0x1003ffff RenderWare data, v3.4.0.3, used in GTA VC PC, 16497>0 ulelong 0x00000016 texture archive (TXD) 16498>0 ulelong 0x00000010 3D models (DFF) 164998 ulelong 0x1005ffff RenderWare data, v3.4.0.5, used in GTA III/VC on Android, 16500>0 ulelong 0x00000016 texture archive (TXD) 16501>0 ulelong 0x00000010 3D models (DFF) 165028 ulelong 0x1400ffff RenderWare data, v3.5.0.0, used in GTA III/VC on Xbox, 16503>0 ulelong 0x00000016 texture archive (TXD) 16504>0 ulelong 0x00000010 3D models (DFF) 165058 ulelong 0x1803ffff RenderWare data, v3.6.0.3, used in GTA SA, 16506>0 ulelong 0x00000016 texture archive (TXD) 16507>0 ulelong 0x00000010 3D models (DFF) 16508 165090 string COL RenderWare collision data (COL), 16510>3 string L version 1, used in GTA III/VC/SA 16511>3 string 2 version 2, used in GTA SA 16512>3 string 3 version 3, used in GTA SA 16513>3 string 4 version 4, used in GTA SA 16514 16515## GTA items and animations 16516 165170 string/c #\ ipl\ generated\ from\ max\ file GTA Item Placement data (IPL), used in GTA III/VC 165180 string/b bnry GTA Item Placement data (IPL), used in GTA SA/IV, 16519>4 ulelong x %d items 16520 165210 string ANP GTA animation data (IFP), 16522>3 string K version 1, used in GTA III/VC 16523>3 string 3 version 2, used in GTA SA 16524 165250 string GtaSA29 GTA Replay data (REP), used in GTA SA 16526 16527## GTA text 16528 165290 string TKEY GTA in-game text (GXT), version 2, used in GTA III 165300 string TABL GTA in-game text (GXT), version 3, used in GTA VC/LS/VCS 16531 16532## GTA scripts 16533 165340 string \x02\x00\x01 GTA script (SCM), used in GTA III/VC/SA 16535 16536## GTA archives 16537 165380 string VER2 GTA archive (IMG), version 2, used in GTA SA, 16539>4 ulelong x %d items 16540 16541# GTA HD-Era (IV/V) - used by the Rockstar Advanced Game Engine (RAGE) 16542 16543## GTA models and textures - RAGE resources 16544# Note: GTA IV formats not yet documented - WAD, WBD, WBN, WHM, WPL 16545 165460 ulelong 0x00695254 GTA Drawable data (WDR), model and weapon data, used in GTA IV 165470 ulelong 0x00695238 GTA Windows Frag Type (WFT), vehicle models, used in GTA IV 165480 ulelong 0x006953A4 GTA Ped and LOD models (WDD), used in GTA IV 165490 ulelong 0x00695384 GTA Windows Texture Dictionary (WTD), used in GTA IV 16550 16551## GTA text 16552 165534 string TABL GTA in-game text (GXT), 16554>0 uleshort x version %d, used in GTA SA/IV 165550 string 2GXT GTA in-game text (GXT2), used in GTA V 16556 16557## GTA scripts 16558 165590 ulelong 0x0d524353 GTA script (SCO), unencrypted, used in GTA IV, 16560>4 ulelong x %d code bytes, 16561>>8 ulelong x %d static variables, 16562>>>12 ulelong x %d global variables 165630 ulelong 0x0e726373 GTA script (SCO), encrypted, used in GTA IV 16564>4 ulelong x %d code bytes, 16565>>8 ulelong x %d static variables, 16566>>>12 ulelong x %d global variables 16567 16568## GTA archives 16569 165700 ulelong 0xa94e2a52 GTA archive (IMG), 16571>4 ulelong x version %d, used in GTA IV, 16572>>8 ulelong x %d items 16573 16574# RPF[0-8] 165750 ulelong&0xfffffff0 =0x52504630 16576>0 ulelong&0xf <9 RAGE Package Format (RPF), version %d, used in 16577>>0 ulelong&0xf =0 Rockstar Table Tennis, 16578>>0 ulelong&0xf =1 *unknown* 16579>>0 ulelong&0xf =2 GTA IV, 16580>>0 ulelong&0xf =3 GTA IV Audio & Midnight Club: LA, 16581>>0 ulelong&0xf =4 Max Payne 3, 16582>>0 ulelong&0xf =5 *unknown* 16583>>0 ulelong&0xf =6 RDR, 16584>>0 ulelong&0xf =7 GTA V, 16585>>0 ulelong&0xf =8 RDR 2, 16586>>4 ulelong x %d bytes, 16587>>>8 ulelong x %d entries 16588 16589#------------------------------------------------------------------------------ 16590# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $ 16591# gcc: file(1) magic for GCC special files 16592# 165930 string gpch GCC precompiled header 16594 16595# The version field is annoying. It's 3 characters, not zero-terminated. 16596>5 byte x (version %c 16597>6 byte x \b%c 16598>7 byte x \b%c) 16599 16600# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 16601>4 byte 67 for C 16602>4 byte 111 for Objective-C 16603>4 byte 43 for C++ 16604>4 byte 79 for Objective-C++ 16605 16606#------------------------------------------------------------------------------ 16607# $File: gconv 16608# gconv: file(1) magic for iconv/gconv module configuration cache 16609# 16610# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC 16611# 16612# From: Marek Cermak <macermak@redhat.com> 16613# 166140 lelong 0x20010324 gconv module configuration cache data 16615#------------------------------------------------------------------------------ 16616# $File: gentoo,v 1.2 2022/09/12 13:13:28 christos Exp $ 16617# gentoo: file(1) magic for gentoo specific formats 16618# 16619# Summary: Gentoo ebuild Manifest files (GLEP 74) 16620# Reference: https://www.gentoo.org/glep/glep-0074.html 16621# Submitted by: Michal Gorny <mgorny@gentoo.org> 16622# Start by doing a fast check for the most common tags. 166230 string AUX 16624>0 use gentoo-manifest 166250 string DATA 16626>0 use gentoo-manifest 166270 string DIST 16628>0 use gentoo-manifest 166290 string EBUILD 16630>0 use gentoo-manifest 166310 string MANIFEST 16632>0 use gentoo-manifest 16633 16634# Manifest can be PGP-signed. 166350 string -----BEGIN\040PGP\040SIGNED\040MESSAGE----- 16636>34 search/32 \n\n 16637>>&0 string AUX 16638>>>&0 use gentoo-manifest 16639>>&0 string DATA 16640>>>&0 use gentoo-manifest 16641>>&0 string DIST 16642>>>&0 use gentoo-manifest 16643>>&0 string EBUILD 16644>>>&0 use gentoo-manifest 16645>>&0 string MANIFEST 16646>>>&0 use gentoo-manifest 16647 16648# Use a more detailed regex to verify that we were correct. 16649# <tag> <filename> <size> <hash-name> <hash-value>... 16650# (<tag>'s already been matched prior to calling) 166510 name gentoo-manifest 16652>&0 regex [[:space:]]+[[:print:]]+[[:space:]]+[[:digit:]]+[[:space:]]+[[:alnum:]]+[[:space:]]+[[:xdigit:]]{32} Gentoo Manifest (GLEP 74) 16653 16654# Summary: Gentoo ebuild and eclass files 16655# Reference: https://projects.gentoo.org/pms/8/pms.html 16656# Submitted by: Michal Gorny <mgorny@gentoo.org> 166570 search/512 EAPI= 16658>0 regex .*\n[\040\t]*EAPI=["']? Gentoo ebuild 16659>>&0 regex [[:alnum:]+_.-]+ \b, EAPI %s 16660 166610 search/512 @ECLASS:\040 Gentoo eclass 16662>&0 string x %s 16663 16664# Summary: Gentoo supplementary package and category metadata files 16665# Reference: https://www.gentoo.org/glep/glep-0068.html 16666# Submitted by: Michal Gorny <mgorny@gentoo.org> 166670 string \<?xml 16668>0 search/512 \<catmetadata Gentoo category metadata file 16669>0 search/512 \<pkgmetadata Gentoo package metadata file 16670 16671# Summary: Gentoo GLEP 78 binary package 16672# Reference: https://www.gentoo.org/glep/glep-0078.html 16673# Note: assumes the strict format 16674# Submitted by: Michal Gorny <mgorny@gentoo.org> 16675 16676# GPKG uses ustar (or ustar-compatible GNU format) that starts with 16677# a <directory>/gpkg-1 file 16678257 string ustar 16679>0 search/100 /gpkg-1\0 16680>>0 regex [^/]+ Gentoo GLEP 78 (GPKG) binary package for "%s" 16681!:mime application/x-tar 16682!:ext tar 16683# the logic below requires the gpkg-1 file to be empty 16684>>>124 string 00000000000\0 16685# determine the compression used by looking at the second member name 16686>>>>512 search/100 .tar. 16687>>>>>&0 string gz\0 using gzip compression 16688>>>>>&0 string bz2\0 using bzip2 compression 16689>>>>>&0 string lz\0 using lzip compression 16690>>>>>&0 string lz4\0 using lz4 compression 16691>>>>>&0 string lzo\0 using lzo compression 16692>>>>>&0 string xz\0 using xz compression 16693>>>>>&0 string zst\0 using zstd compression 16694>>>>(636.o+1024) search/611 .sig\0 \b, signed 16695 16696#------------------------------------------------------------------------------ 16697# $File: geo,v 1.8 2022/03/24 15:48:58 christos Exp $ 16698# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 16699 16700###################################################################### 16701# 16702# Acoustic Doppler Current Profilers (ADCP) 16703# 16704###################################################################### 16705 167060 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 16707 16708###################################################################### 16709# 16710# Metadata 16711# 16712###################################################################### 16713 167140 string Identification_Information FGDC ASCII metadata 16715 16716###################################################################### 16717# 16718# Seimsic / Subbottom 16719# 16720###################################################################### 16721 16722# Knudsen subbottom chirp profiler - Binary File Format: B9 16723# KEB D409-03167 V1.75 Huffman 167240 string KEB\ Knudsen seismic KEL binary (KEB) - 16725>4 regex [-A-Z0-9]+ Software: %s 16726>>&1 regex V[0-9]+\\.[0-9]+ version %s 16727 16728###################################################################### 16729# 16730# LIDAR - Laser altimetry or bathy 16731# 16732###################################################################### 16733 16734 16735# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 167360 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 16737>4 regex [0-9]+\\.[0-9]+ version %s 16738 167390 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 16740>3 byte x version %d . 16741>4 byte x %d 16742 16743 16744###################################################################### 16745# 16746# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 16747# 16748###################################################################### 16749 16750# GeoAcoustics - GeoSwath Plus 167514 beshort 0x2002 GeoSwath RDF 167520 string Start:- GeoSwatch auf text file 16753 16754# Seabeam 2100 16755# mbsystem code mb41 167560 string SB2100 SeaBeam 2100 multibeam sonar 167570 string SB2100DR SeaBeam 2100 DR multibeam sonar 167580 string SB2100PR SeaBeam 2100 PR multibeam sonar 16759 16760# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 16761# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 167620 string $HSF XSE multibeam 16763 16764# mb121 https://www.saic.com/maritime/gsf/ 167658 string GSF-v SAIC generic sensor format (GSF) sonar data, 16766>&0 regex [0-9]+\\.[0-9]+ version %s 16767 16768# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 16769# mb161 167709 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 16771 16772# MBSystem processing caches the mbinfo output 167731 string Swath\ Data\ File: mbsystem info cache 16774 16775# Caris John Hughes Clark format 167760 string HDCS Caris multibeam sonar related data 167771 string Start/Stop\ parameter\ header: Caris ASCII project summary 16778 16779###################################################################### 16780# 16781# Visualization and 3D modeling 16782# 16783###################################################################### 16784 16785# IVS - IVS3d.com Tagged Data Represetation 167860 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 16787 16788# http://www.ecma-international.org/publications/standards/Ecma-363.htm 16789# 3D in PDFs 167900 string U3D ECMA-363, Universal 3D 16791 16792###################################################################### 16793# 16794# Support files 16795# 16796###################################################################### 16797 16798# https://midas.psi.ch/elog/ 167990 string $@MID@$ elog journal entry 16800 16801# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm 168020 string DSBB Surfer 6 binary grid file 16803>4 leshort x \b, %d 16804>6 leshort x \bx%d 16805>8 ledouble x \b, minx=%g 16806>16 ledouble x \b, maxx=%g 16807>24 ledouble x \b, miny=%g 16808>32 ledouble x \b, maxy=%g 16809>40 ledouble x \b, minz=%g 16810>48 ledouble x \b, maxz=%g 16811 16812# magic for LAS format files 16813# alex myczko <alex@aiei.ch> 16814# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf 168150 string LASF LIDAR point data records 16816>24 byte >0 \b, version %u 16817>25 byte >0 \b.%u 16818>26 string >\0 \b, SYSID %s 16819>58 string >\0 \b, Generating Software %s 16820 16821# magic for PCD format files 16822# alex myczko <alex@aiei.ch> 16823# http://pointclouds.org/documentation/tutorials/pcd_file_format.php 168240 string #\ .PCD Point Cloud Data 16825 16826#------------------------------------------------------------------------------ 16827# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 16828# GEOS files (Vidar Madsen, vidar@gimp.org) 16829# semi-commonly used in embedded and handheld systems. 168300 belong 0xc745c153 GEOS 16831>40 byte 1 executable 16832>40 byte 2 VMFile 16833>40 byte 3 binary 16834>40 byte 4 directory label 16835>40 byte <1 unknown 16836>40 byte >4 unknown 16837>4 string >\0 \b, name "%s" 16838#>44 short x \b, version %d 16839#>46 short x \b.%d 16840#>48 short x \b, rev %d 16841#>50 short x \b.%d 16842#>52 short x \b, proto %d 16843#>54 short x \br%d 16844#>168 string >\0 \b, copyright "%s" 16845 16846#------------------------------------------------------------------------------ 16847# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $ 16848# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 16849# by Federico Mena <federico@nuclecu.unam.mx> 16850 168510 string/t GIMP\ Gradient GIMP gradient data 16852#!:mime text/plain 16853!:mime text/x-gimp-ggr 16854!:ext ggr 16855 16856# GIMP palette (.gpl) 16857# From: Markus Heidelberg <markus.heidelberg@web.de> 168580 string/t GIMP\ Palette GIMP palette data 16859# URL: https://docs.gimp.org/en/gimp-concepts-palettes.html 16860# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Palette 16861#!:mime text/plain 16862!:mime text/x-gimp-gpl 16863!:ext gpl 16864 16865#------------------------------------------------------------------------------ 16866# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 16867# by Spencer Kimball and Peter Mattis 16868# ('Bucky' LaDieu, nega@vt.edu) 16869 16870# URL: https://en.wikipedia.org/wiki/XCF_(file_format) 16871# Reference: https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt 168720 string gimp\ xcf GIMP XCF image data, 16873!:mime image/x-xcf 16874!:ext xcf 16875>9 string file version 0, 16876>9 string v version 16877>>10 string >\0 %s, 16878>14 belong x %u x 16879>18 belong x %u, 16880>22 belong 0 RGB Color 16881>22 belong 1 Greyscale 16882>22 belong 2 Indexed Color 16883>22 belong >2 Unknown Image Type. 16884 16885#------------------------------------------------------------------------------ 16886# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 16887# by Spencer Kimball and Peter Mattis 16888# ('Bucky' LaDieu, nega@vt.edu) 16889 16890# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Pattern 1689120 string GPAT GIMP pattern data, 16892>24 string x %s 16893!:mime image/x-gimp-pat 16894!:ext pat 16895 16896#------------------------------------------------------------------------------ 16897# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 16898# by Spencer Kimball and Peter Mattis 16899# ('Bucky' LaDieu, nega@vt.edu) 16900 1690120 string GIMP GIMP brush data 16902# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Brush 16903!:mime image/x-gimp-gbr 16904# some sources also list gpb 16905!:ext gbr 16906 16907# From: Joerg Jenderek 16908# URL: https://docs.gimp.org/en/gimp-using-animated-brushes.html 16909# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush 16910# share\gimp\2.0\brushes\Legacy\confetti.gih 169110 search/21/b \040ncells: GIMP animated brush data 16912!:mime image/x-gimp-gih 16913!:ext gih 16914 16915# GIMP Curves File 16916# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 169170 string #\040GIMP\040Curves\040File GIMP curve file 16918#!:mime text/plain 16919!:mime text/x-gimp-curve 16920!:ext /txt 16921 16922 16923#------------------------------------------------------------------------------ 16924# $File: git,v 1.2 2020/08/09 16:57:15 christos Exp $ 16925# git: file(1) magic for Git objects 16926 169270 string blob\040 16928>5 regex [0-9a-f]+ Git blob %s 16929 169300 string tree\040 16931>5 regex [0-9a-f]+ Git tree %s 16932 169330 string commit\040 16934>7 regex [0-9a-f]+ Git commit %s 16935 16936#------------------------------------------------------------------------------ 16937# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $ 16938# glibc locale files 16939# 16940# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32 16941 169420 belong 0x20070920 glibc locale file LC_CTYPE 169430 belong 0x14110320 glibc locale file LC_NUMERIC 169440 belong 0x17110320 glibc locale file LC_TIME 169450 belong 0x17100520 glibc locale file LC_COLLATE 169460 belong 0x11110320 glibc locale file LC_MONETARY 169470 belong 0x10110320 glibc locale file LC_MESSAGES 169480 belong 0x13110320 glibc locale file LC_ALL 169490 belong 0x12110320 glibc locale file LC_PAPER 169500 belong 0x1d110320 glibc locale file LC_NAME 169510 belong 0x1c110320 glibc locale file LC_ADDRESS 169520 belong 0x1f110320 glibc locale file LC_TELEPHONE 169530 belong 0x1e110320 glibc locale file LC_MEASUREMENT 169540 belong 0x19110320 glibc locale file LC_IDENTIFICATION 16955 16956 16957#------------------------------------------------------------------------------ 16958# $File: gnome,v 1.7 2020/06/23 16:17:08 christos Exp $ 16959# GNOME related files 16960 16961# Contributed by Josh Triplett 16962# FIXME: Could be simplified if pstring supported two-byte counts 169630 string GnomeKeyring\n\r\0\n GNOME keyring 16964>&0 ubyte 0 \b, major version 0 16965>>&0 ubyte 0 \b, minor version 0 16966>>>&0 ubyte 0 \b, crypto type 0 (AES) 16967>>>&0 ubyte >0 \b, crypto type %u (unknown) 16968>>>&1 ubyte 0 \b, hash type 0 (MD5) 16969>>>&1 ubyte >0 \b, hash type %u (unknown) 16970>>>&2 ubelong 0xFFFFFFFF \b, name NULL 16971>>>&2 ubelong !0xFFFFFFFF 16972>>>>&-4 ubelong >255 \b, name too long for file's pstring type 16973>>>>&-4 ubelong <256 16974>>>>>&-1 pstring x \b, name "%s" 16975>>>>>>&0 ubeqdate x \b, last modified %s 16976>>>>>>&8 ubeqdate x \b, created %s 16977>>>>>>&16 ubelong &1 16978>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 16979>>>>>>&16 ubelong ^1 \b, not locked if idle 16980>>>>>>&24 ubelong x \b, hash iterations %u 16981>>>>>>&28 ubequad x \b, salt %llu 16982>>>>>>&52 ubelong x \b, %u item(s) 16983 16984# From: Alex Beregszaszi <alex@fsn.hu> 169854 string gtktalog GNOME Catalogue (gtktalog) 16986>13 string >\0 version %s 16987 16988# Summary: GStreamer binary registry 16989# Extension: .bin 16990# Submitted by: Josh Triplett <josh@joshtriplett.org> 169910 belong 0xc0def00d GStreamer binary registry 16992>4 string x \b, version %s 16993 16994# GVariant Database file 16995# By Elan Ruusamae <glen@delfi.ee> 16996# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 16997# It's always "GVariant", it's byte swapped on incompatible archs 16998# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 16999# file_builder_serialise() 17000# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 170010 string GVariant GVariant Database file, 17002# version is never filled. probably future extension 17003>8 lelong x version %d 17004# not sure are these usable, so commented out 17005#>>16 lelong x start %d, 17006#>>>20 lelong x end %d 17007 17008# G-IR database made by gobject-introspect toolset, 17009# https://live.gnome.org/GObjectIntrospection 170100 string GOBJ\nMETADATA\r\n\032 G-IR binary database 17011>16 byte x \b, v%d 17012>17 byte x \b.%d 17013>20 short x \b, %d entries 17014>22 short x \b/%d local 17015 17016#------------------------------------------------------------------------------ 17017# $File: gnu,v 1.24 2021/04/26 15:56:00 christos Exp $ 17018# gnu: file(1) magic for various GNU tools 17019# 17020# GNU nlsutils message catalog file format 17021# 17022# GNU message catalog (.mo and .gmo files) 17023 17024# Update: Joerg Jenderek 17025# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 17026# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/ 17027# gettext-0.19.8.1/gettext-runtime/intl/gmo.h 17028# Note: maybe call it like "GNU translation gettext machine object" 170290 string \336\22\4\225 GNU message catalog (little endian), 17030#0 ulelong 0x950412DE GNU-format message catalog data 17031# TODO: write lines in such a way that code can also be called for big endian variant 17032#>0 use gettext-object 17033#0 name gettext-object 17034>4 ulelong x revision 17035!:mime application/x-gettext-translation 17036# mo extension is also used for Easeus Partition Master PE32 executable module 17037# like ConvertFatToNTFS.mo 17038!:ext gmo/mo 17039# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit 17040# major revision 17041>4 ulelong/0xFFff x %u. 17042# minor revision 17043>4 ulelong&0x0000FFff x \b%u 17044>>8 ulelong x \b, %u message 17045# plural s 17046>>8 ulelong >1 \bs 17047# size of hashing table 17048#>20 ulelong x \b, %u hash 17049#>20 ulelong >1 \bes 17050#>24 ulelong x at %#x 17051# for revision x.0 offset of table with originals is 1Ch if directly after header 17052>4 ulelong&0x0000FFff =0 17053>>12 ulelong !0x1C \b, at %#x string table 17054# but for x.1 table offset i found is 30h. That means directly after bigger header 17055>4 ulelong&0x0000FFff >0 17056>>12 ulelong !0x30 \b, at %#x string table 17057# The following variables are only used in .mo files with minor revision >= 1 17058# number of system dependent segments 17059#>>28 ulelong x \b, %u segment 17060#>>28 ulelong >1 \bs 17061# offset of table describing system dependent segments 17062#>>32 ulelong x at %#x 17063# number of system dependent strings pairs 17064>>36 ulelong x \b, %u sysdep message 17065>>36 ulelong >1 \bs 17066# offset of table with start offsets of original sysdep strings 17067#>>40 ulelong x \b, at %#x sysdep strings 17068# offset of table with start offsets of translated sysdep strings 17069#>>44 ulelong x \b, at %#x sysdep translations 17070# >>(44.l) ulelong x %#x chars 17071# >>>&0 ulelong x at %#x 17072# >>>>(&-4) string x "%s" 17073# string table after big header 17074#>>48 ubequad x \b, string table %#llx 17075# 17076# 0th string length seems to be always 0 17077#>(12.l) ulelong x \b, %u chars 17078#>>&0 ulelong x at %#x 17079# if 1st string length positive inspect offset and string 17080#>(12.l+8) ulelong >0 \b, %u chars 17081#>>&0 ulelong x at %#x 17082# if 2nd string length positive inspect offset and string 17083# >(12.l+16) ulelong >0 \b, %u chars 17084# >>&0 ulelong x at %#x 17085# skip newline byte 17086#>>>(&-4) ubyte =0x0A 17087#>>>>&0 string x "%s" 17088#>>>(&-4) ubyte !0x0A 17089#>>>>&-1 string x '%s' 17090# offset of table with translation strings 17091#>16 ulelong x \b, at %#x translation table 17092# check translation 0 length and offset 17093>(16.l) ulelong >0 17094>>&0 ulelong x 17095# translation 0 seems to be often Project-Id with name and version 17096>>>(&-4) string x \b, %s 17097# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL 17098>(16.l+8) ulelong >1 17099>>&0 ulelong x 17100>>>(&-4) ubyte !0x0A 17101>>>>&-1 string x '%s' 17102# 1 New Line like in tar-1.29\po\de.gmo 17103>>>(&-4) ubyte =0x0A 17104>>>>&0 ubyte !0x0A 17105>>>>>&-1 string x '%s' 17106# 2nd New Line like in parted-3.1\po\de.gmo 17107>>>>&0 ubyte =0x0A 17108>>>>>&0 string x '%s' 17109 171100 string \225\4\22\336 GNU message catalog (big endian), 17111#0 ubelong 0x950412DE GNU-format message catalog data 17112!:mime application/x-gettext-translation 17113!:ext gmo/mo 17114# TODO: for big endian use same code as for little endian 17115#>0 use \^gettext-object 17116# DEBUG code 17117#>16 ubelong x \b, at %#x translation table 17118#>(16.L) ubelong x %#x chars 17119#>>&0 ubelong x at %#x 17120# unexpected value HERE! 17121#>>>(&-4) ubequad x %#llx 17122# 17123>4 beshort x revision %d. 17124>6 beshort >0 \b%d, 17125>>8 belong x %d messages, 17126>>36 belong x %d sysdep messages 17127>6 beshort =0 \b%d, 17128>>8 belong x %d messages 17129 17130 17131# GnuPG 17132# The format is very similar to pgp 171330 string \001gpg GPG key trust database 17134>4 byte x version %d 17135# Note: magic.mime had 0x8501 for the next line instead of 0x8502 171360 beshort 0x8502 GPG encrypted data 17137!:mime text/PGP # encoding: data 17138 17139# Update: Joerg Jenderek 17140# Note: PGP and GPG use same data structure. 17141# So recognition is now done by ./pgp with start test for byte 0x99 17142# This magic is not particularly good, as the keyrings don't have true 17143# magic. Nevertheless, it covers many keyrings. 17144# 0 ubeshort-0x9901 <2 17145# >3 byte 4 17146# >>4 bedate x GPG key public ring, created %s 17147# !:mime application/x-gnupg-keyring 17148 17149# Symmetric encryption 171500 leshort 0x0d8c 17151>4 leshort 0x0203 17152>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 17153>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 17154>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 17155>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 17156>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 17157>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 17158>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 17159>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 17160>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 17161>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 17162 17163 17164# GnuPG Keybox file 17165# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 17166# From: Philipp Hahn <hahn@univention.de> 171670 belong 32 17168>4 byte 1 17169>>8 string KBXf GPG keybox database 17170>>>5 byte 1 version %d 17171>>>16 bedate x \b, created-at %s 17172>>>20 bedate x \b, last-maintained %s 17173 17174 17175# From: James Youngman <jay@gnu.org> 17176# gnu find magic 171770 string \0LOCATE GNU findutils locate database data 17178>7 string >\0 \b, format %s 17179>7 string 02 \b (frcode) 17180 17181# Files produced by GNU gettext 17182 17183# gettext message catalogue 171840 search/1024 \nmsgid 17185>&0 search/1024 \nmsgstr GNU gettext message catalogue text 17186!:strength +100 17187!:mime text/x-po 17188 17189#------------------------------------------------------------------------------ 17190# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 17191# gnumeric: file(1) magic for Gnumeric spreadsheet 17192# This entry is only semi-helpful, as Gnumeric compresses its files, so 17193# they will ordinarily reported as "compressed", but at least -z helps 1719439 string =<gmr:Workbook Gnumeric spreadsheet 17195!:mime application/x-gnumeric 17196 17197#------------------------------------------------------------------------------ 17198# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $ 17199# 17200# GPT Partition table patterns. 17201# Author: Rogier Goossens (goossens.rogier@gmail.com) 17202# Note that a GPT-formatted disk must contain an MBR as well. 17203# 17204 17205# The initial segment (up to >>>>>>>>422) was copied from the X86 17206# partition table code (aka MBR). 17207# This is kept separate, so that MBR partitions are not reported as well. 17208# (use -k if you do want them as well) 17209 17210# First, detect the MBR partition table 17211# If more than one GPT protective MBR partition exists, don't print anything 17212# (the other MBR detection code will then just print the MBR partition table) 172130x1FE leshort 0xAA55 17214>3 string !MS 17215>>3 string !SYSLINUX 17216>>>3 string !MTOOL 17217>>>>3 string !NEWLDR 17218>>>>>5 string !DOS 17219# not FAT (32 bit) 17220>>>>>>82 string !FAT32 17221#not Linux kernel 17222>>>>>>>514 string !HdrS 17223#not BeOS 17224>>>>>>>>422 string !Be\ Boot\ Loader 17225# GPT with protective MBR entry in partition 1 (only) 17226>>>>>>>>>450 ubyte 0xee 17227>>>>>>>>>>466 ubyte !0xee 17228>>>>>>>>>>>482 ubyte !0xee 17229>>>>>>>>>>>>498 ubyte !0xee 17230#>>>>>>>>>>>>>446 use gpt-mbr-partition 17231>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 17232>>>>>>>>>>>>>>0 use gpt-mbr-type 17233>>>>>>>>>>>>>>&-8 use gpt-table 17234>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 17235>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 17236>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 17237>>>>>>>>>>>>>>>0 use gpt-mbr-type 17238>>>>>>>>>>>>>>>&-8 use gpt-table 17239>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 17240>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 17241>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 17242>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17243>>>>>>>>>>>>>>>>&-8 use gpt-table 17244>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 17245>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 17246>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 17247>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17248>>>>>>>>>>>>>>>>>&-8 use gpt-table 17249>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 17250>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 17251>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 17252>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17253>>>>>>>>>>>>>>>>>>&-8 use gpt-table 17254>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 17255# GPT with protective MBR entry in partition 2 (only) 17256>>>>>>>>>450 ubyte !0xee 17257>>>>>>>>>>466 ubyte 0xee 17258>>>>>>>>>>>482 ubyte !0xee 17259>>>>>>>>>>>>498 ubyte !0xee 17260#>>>>>>>>>>>>>462 use gpt-mbr-partition 17261>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 17262>>>>>>>>>>>>>>0 use gpt-mbr-type 17263>>>>>>>>>>>>>>&-8 use gpt-table 17264>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 17265>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 17266>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 17267>>>>>>>>>>>>>>>0 use gpt-mbr-type 17268>>>>>>>>>>>>>>>&-8 use gpt-table 17269>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 17270>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 17271>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 17272>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17273>>>>>>>>>>>>>>>>&-8 use gpt-table 17274>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 17275>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 17276>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 17277>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17278>>>>>>>>>>>>>>>>>&-8 use gpt-table 17279>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 17280>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 17281>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 17282>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17283>>>>>>>>>>>>>>>>>>&-8 use gpt-table 17284>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 17285# GPT with protective MBR entry in partition 3 (only) 17286>>>>>>>>>450 ubyte !0xee 17287>>>>>>>>>>466 ubyte !0xee 17288>>>>>>>>>>>482 ubyte 0xee 17289>>>>>>>>>>>>498 ubyte !0xee 17290#>>>>>>>>>>>>>478 use gpt-mbr-partition 17291>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 17292>>>>>>>>>>>>>>0 use gpt-mbr-type 17293>>>>>>>>>>>>>>&-8 use gpt-table 17294>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 17295>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 17296>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 17297>>>>>>>>>>>>>>>0 use gpt-mbr-type 17298>>>>>>>>>>>>>>>&-8 use gpt-table 17299>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 17300>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 17301>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 17302>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17303>>>>>>>>>>>>>>>>&-8 use gpt-table 17304>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 17305>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 17306>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 17307>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17308>>>>>>>>>>>>>>>>>&-8 use gpt-table 17309>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 17310>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 17311>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 17312>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17313>>>>>>>>>>>>>>>>>>&-8 use gpt-table 17314>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 17315# GPT with protective MBR entry in partition 4 (only) 17316>>>>>>>>>450 ubyte !0xee 17317>>>>>>>>>>466 ubyte !0xee 17318>>>>>>>>>>>482 ubyte !0xee 17319>>>>>>>>>>>>498 ubyte 0xee 17320#>>>>>>>>>>>>>494 use gpt-mbr-partition 17321>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 17322>>>>>>>>>>>>>>0 use gpt-mbr-type 17323>>>>>>>>>>>>>>&-8 use gpt-table 17324>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 17325>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 17326>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 17327>>>>>>>>>>>>>>>0 use gpt-mbr-type 17328>>>>>>>>>>>>>>>&-8 use gpt-table 17329>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 17330>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 17331>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 17332>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17333>>>>>>>>>>>>>>>>&-8 use gpt-table 17334>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 17335>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 17336>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 17337>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17338>>>>>>>>>>>>>>>>>&-8 use gpt-table 17339>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 17340>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 17341>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 17342>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 17343>>>>>>>>>>>>>>>>>>&-8 use gpt-table 17344>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 17345 17346# The following code does GPT detection and processing, including 17347# sector size detection. 17348# It has to be duplicated above because the top-level pattern 17349# (i.e. not called using 'use') must print *something* for file 17350# to count it as a match. Text only printed in named patterns is 17351# not counted, and causes file to continue, and try and match 17352# other patterns. 17353# 17354# Unfortunately, when assuming sector sizes >=16k, if the sector size 17355# happens to be 512 instead, we may find confusing data after the GPT 17356# table... If the GPT table has less than 128 entries, this may even 17357# happen for assumed sector sizes as small as 4k 17358# This could be solved by checking for the presence of the backup GPT 17359# header as well, but that makes the logic extremely complex 17360##0 name gpt-mbr-partition 17361##>(8.l*8192) string EFI\ PART 17362##>>(8.l*8192) use gpt-mbr-type 17363##>>&-8 use gpt-table 17364##>>0 ubyte x of 8192 bytes 17365##>(8.l*8192) string !EFI\ PART 17366##>>(8.l*4096) string EFI\ PART GPT partition table 17367##>>>0 use gpt-mbr-type 17368##>>>&-8 use gpt-table 17369##>>>0 ubyte x of 4096 bytes 17370##>>(8.l*4096) string !EFI\ PART 17371##>>>(8.l*2048) string EFI\ PART GPT partition table 17372##>>>>0 use gpt-mbr-type 17373##>>>>&-8 use gpt-table 17374##>>>>0 ubyte x of 2048 bytes 17375##>>>(8.l*2048) string !EFI\ PART 17376##>>>>(8.l*1024) string EFI\ PART GPT partition table 17377##>>>>>0 use gpt-mbr-type 17378##>>>>>&-8 use gpt-table 17379##>>>>>0 ubyte x of 1024 bytes 17380##>>>>(8.l*1024) string !EFI\ PART 17381##>>>>>(8.l*512) string EFI\ PART GPT partition table 17382##>>>>>>0 use gpt-mbr-type 17383##>>>>>>&-8 use gpt-table 17384##>>>>>>0 ubyte x of 512 bytes 17385 17386# Print details of MBR type for a GPT-disk 17387# Calling code ensures that there is only one 0xee partition. 173880 name gpt-mbr-type 17389# GPT with protective MBR entry in partition 1 17390>450 ubyte 0xee 17391>>454 ulelong 1 17392>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 17393>>454 ulelong !1 \b (nonstandard: not at LBA 1) 17394# GPT with protective MBR entry in partition 2 17395>466 ubyte 0xee 17396>>470 ulelong 1 17397>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 17398>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 17399>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 17400>>470 ulelong !1 \b (nonstandard: not at LBA 1) 17401# GPT with protective MBR entry in partition 3 17402>482 ubyte 0xee 17403>>486 ulelong 1 17404>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 17405>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 17406>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 17407>>486 ulelong !1 \b (nonstandard: not at LBA 1) 17408# GPT with protective MBR entry in partition 4 17409>498 ubyte 0xee 17410>>502 ulelong 1 17411>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 17412>>502 ulelong !1 \b (nonstandard: not at LBA 1) 17413 17414# Print the information from a GPT partition table structure 174150 name gpt-table 17416>10 uleshort x \b, version %u 17417>8 uleshort x \b.%u 17418>56 ulelong x \b, GUID: %08x 17419>60 uleshort x \b-%04x 17420>62 uleshort x \b-%04x 17421>64 ubeshort x \b-%04x 17422>66 ubeshort x \b-%04x 17423>68 ubelong x \b%08x 17424#>80 uleshort x \b, %d partition entries 17425>32 ulequad+1 x \b, disk size: %lld sectors 17426 17427# In case a GPT data-structure is at LBA 0, report it as well 17428# This covers systems which are not GPT-aware, and which show 17429# and allow access to the protective partition. This code will 17430# detect the contents of such a partition. 174310 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 17432>0 use gpt-table 17433>0 ubyte x (sector size unknown) 17434 17435 17436 17437#------------------------------------------------------------------------------ 17438# $File: gpu,v 1.3 2021/04/26 15:56:00 christos Exp $ 17439# gpu: file(1) magic for GPU input files 17440 17441# Standard Portable Intermediate Representation (SPIR) 17442# Documentation: https://www.khronos.org/spir 17443# Typical file extension: .spv 17444 174450 belong 0x07230203 Khronos SPIR-V binary, big-endian 17446>4 belong x \b, version %#08x 17447>8 belong x \b, generator %#08x 17448 174490 lelong 0x07230203 Khronos SPIR-V binary, little-endian 17450>4 lelong x \b, version %#08x 17451>8 lelong x \b, generator %#08x 17452 17453# Vulkan Trace file 17454# Documentation: 17455# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\ 17456# vktrace_trace_packet_identifiers.h 17457# Typical file extension: .vktrace 17458 174598 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian 17460>0 leshort x \b, version %d 17461 174628 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian 17463>0 beshort x \b, version %d 17464 17465#------------------------------------------------------------------------------ 17466# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 17467# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 17468# 17469# ACE/gr binary 174700 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 17471>39 byte >0 - version %c 17472# ACE/gr ascii 174730 string #\ xvgr\ parameter\ file ACE/gr ascii file 174740 string #\ xmgr\ parameter\ file ACE/gr ascii file 174750 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 17476# Grace projects 174770 string #\ Grace\ project\ file Grace project file 17478>23 string @version\ (version 17479>>32 byte >0 %c 17480>>33 string >\0 \b.%.2s 17481>>35 string >\0 \b.%.2s) 17482# ACE/gr fit description files 174830 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 17484# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 17485 17486#------------------------------------------------------------------------------ 17487# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $ 17488# graphviz: file(1) magic for https://www.graphviz.org/ 17489 17490# FIXME: These patterns match too generally. For example, the first 17491# line matches a LaTeX file containing the word "graph" (with a { 17492# following later) and the second line matches this file. 17493#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 17494#!:mime text/vnd.graphviz 17495#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 17496#!:mime text/vnd.graphviz 17497 17498#------------------------------------------------------------------------------ 17499# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $ 17500# gringotts: file(1) magic for Gringotts 17501# http://devel.pluto.linux.it/projects/Gringotts/ 17502# author: Germano Rizzo <mano@pluto.linux.it> 17503#GRG3????Y 175040 string GRG Gringotts data file 17505#file format 1 17506>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 17507#file format 2 17508>3 string 2 v.2, MCRYPT S2K, 17509>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 17510>>8 byte&0x70 0x10 SERPENT crypt, 17511>>8 byte&0x70 0x20 TWOFISH crypt, 17512>>8 byte&0x70 0x30 CAST-256 crypt, 17513>>8 byte&0x70 0x40 SAFER+ crypt, 17514>>8 byte&0x70 0x50 LOKI97 crypt, 17515>>8 byte&0x70 0x60 3DES crypt, 17516>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 17517>>8 byte&0x08 0x00 SHA1 hash, 17518>>8 byte&0x08 0x08 RIPEMD-160 hash, 17519>>8 byte&0x04 0x00 ZLib 17520>>8 byte&0x04 0x04 BZip2 17521>>8 byte&0x03 0x00 lvl.0 17522>>8 byte&0x03 0x01 lvl.3 17523>>8 byte&0x03 0x02 lvl.6 17524>>8 byte&0x03 0x03 lvl.9 17525#file format 3 17526>3 string 3 v.3, OpenPGP S2K, 17527>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 17528>>8 byte&0x70 0x10 SERPENT crypt, 17529>>8 byte&0x70 0x20 TWOFISH crypt, 17530>>8 byte&0x70 0x30 CAST-256 crypt, 17531>>8 byte&0x70 0x40 SAFER+ crypt, 17532>>8 byte&0x70 0x50 LOKI97 crypt, 17533>>8 byte&0x70 0x60 3DES crypt, 17534>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 17535>>8 byte&0x08 0x00 SHA1 hash, 17536>>8 byte&0x08 0x08 RIPEMD-160 hash, 17537>>8 byte&0x04 0x00 ZLib 17538>>8 byte&0x04 0x04 BZip2 17539>>8 byte&0x03 0x00 lvl.0 17540>>8 byte&0x03 0x01 lvl.3 17541>>8 byte&0x03 0x02 lvl.6 17542>>8 byte&0x03 0x03 lvl.9 17543#file format >3 17544>3 string >3 v.%.1s (unknown details) 17545 17546#------------------------------------------------------------------------------ 17547# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $ 17548# hardware magic 17549 17550# EDID 17551# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data 175520 string \x00\xFF\xFF\xFF\xFF\xFF\xFF\x00 17553>19 byte x 17554>>18 byte x EDID data, version %u. 17555>>19 byte x \b%u 17556#>>17 ubyte+1990 <255 \b, manufactured %u 17557 17558#------------------------------------------------------------------------------ 17559# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $ 17560# hitach-sh: file(1) magic for Hitachi Super-H 17561# 17562# Super-H COFF 17563# 17564# updated by Joerg Jenderek at Oct 2015 17565# https://en.wikipedia.org/wiki/COFF 17566# https://de.wikipedia.org/wiki/Common_Object_File_Format 17567# http://www.delorie.com/djgpp/doc/coff/filhdr.html 17568# below test line conflicts with 2nd NTFS filesystem sector 17569# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 17570# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/) 175710 beshort 0x0500 17572# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 17573>18 ubeshort&0x8E80 0 17574# use big endian variant of subroutine to display name+variables+flags 17575# for common object formatted files 17576>>0 use \^display-coff 17577!:strength -10 17578 175790 leshort 0x0550 17580# test for unused flag bits in f_flags 17581>18 uleshort&0x8E80 0 17582# use little endian variant of subroutine to 17583# display name+variables+flags for common object formatted files 17584>>0 use display-coff 17585!:strength -10 17586 17587 17588#------------------------------------------------------------------------------ 17589# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $ 17590# hp: file(1) magic for Hewlett Packard machines (see also "printer") 17591# 17592# XXX - somebody should figure out whether any byte order needs to be 17593# applied to the "TML" stuff; I'm assuming the Apollo stuff is 17594# big-endian as it was mostly 68K-based. 17595# 17596# I think the 500 series was the old stack-based machines, running a 17597# UNIX environment atop the "SUN kernel"; dunno whether it was 17598# big-endian or little-endian. 17599# 17600# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 17601# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 17602# HP magic is useful for reference, but using "long" magic is a better 17603# practice in order to avoid collisions. 17604# 17605# Guy Harris (guy@netapp.com): some additions to this list came from 17606# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 17607# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 17608# "/etc/magic", though, except for the "archive file relocatable library" 17609# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 17610# used in executables, or have they just not yet updated "/etc/magic" 17611# completely? 17612# 17613# 0 beshort 200 hp200 (68010) BSD binary 17614# 0 beshort 300 hp300 (68020+68881) BSD binary 17615# 0 beshort 0x20c hp200/300 HP-UX binary 17616# 0 beshort 0x20d hp400 (68030) HP-UX binary 17617# 0 beshort 0x20e hp400 (68040?) HP-UX binary 17618# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 17619# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 17620# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 17621# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 17622 17623# 17624# The "misc" stuff needs a byte order; the archives look suspiciously 17625# like the old 177545 archives (0xff65 = 0177545). 17626# 17627#### Old Apollo stuff 176280 beshort 0627 Apollo m68k COFF executable 17629>18 beshort ^040000 not stripped 17630>22 beshort >0 - version %d 176310 beshort 0624 apollo a88k COFF executable 17632>18 beshort ^040000 not stripped 17633>22 beshort >0 - version %d 176340 long 01203604016 TML 0123 byte-order format 176350 long 01702407010 TML 1032 byte-order format 176360 long 01003405017 TML 2301 byte-order format 176370 long 01602007412 TML 3210 byte-order format 17638#### PA-RISC 1.1 176390 belong 0x02100106 PA-RISC1.1 relocatable object 176400 belong 0x02100107 PA-RISC1.1 executable 17641>168 belong &0x00000004 dynamically linked 17642>(144) belong 0x054ef630 dynamically linked 17643>96 belong >0 - not stripped 17644 176450 belong 0x02100108 PA-RISC1.1 shared executable 17646>168 belong&0x4 0x4 dynamically linked 17647>(144) belong 0x054ef630 dynamically linked 17648>96 belong >0 - not stripped 17649 176500 belong 0x0210010b PA-RISC1.1 demand-load executable 17651>168 belong&0x4 0x4 dynamically linked 17652>(144) belong 0x054ef630 dynamically linked 17653>96 belong >0 - not stripped 17654 176550 belong 0x0210010e PA-RISC1.1 shared library 17656>96 belong >0 - not stripped 17657 176580 belong 0x0210010d PA-RISC1.1 dynamic load library 17659>96 belong >0 - not stripped 17660 17661#### PA-RISC 2.0 176620 belong 0x02140106 PA-RISC2.0 relocatable object 17663 176640 belong 0x02140107 PA-RISC2.0 executable 17665>168 belong &0x00000004 dynamically linked 17666>(144) belong 0x054ef630 dynamically linked 17667>96 belong >0 - not stripped 17668 176690 belong 0x02140108 PA-RISC2.0 shared executable 17670>168 belong &0x00000004 dynamically linked 17671>(144) belong 0x054ef630 dynamically linked 17672>96 belong >0 - not stripped 17673 176740 belong 0x0214010b PA-RISC2.0 demand-load executable 17675>168 belong &0x00000004 dynamically linked 17676>(144) belong 0x054ef630 dynamically linked 17677>96 belong >0 - not stripped 17678 176790 belong 0x0214010e PA-RISC2.0 shared library 17680>96 belong >0 - not stripped 17681 176820 belong 0x0214010d PA-RISC2.0 dynamic load library 17683>96 belong >0 - not stripped 17684 17685#### 800 176860 belong 0x020b0106 PA-RISC1.0 relocatable object 17687 176880 belong 0x020b0107 PA-RISC1.0 executable 17689>168 belong&0x4 0x4 dynamically linked 17690>(144) belong 0x054ef630 dynamically linked 17691>96 belong >0 - not stripped 17692 176930 belong 0x020b0108 PA-RISC1.0 shared executable 17694>168 belong&0x4 0x4 dynamically linked 17695>(144) belong 0x054ef630 dynamically linked 17696>96 belong >0 - not stripped 17697 176980 belong 0x020b010b PA-RISC1.0 demand-load executable 17699>168 belong&0x4 0x4 dynamically linked 17700>(144) belong 0x054ef630 dynamically linked 17701>96 belong >0 - not stripped 17702 177030 belong 0x020b010e PA-RISC1.0 shared library 17704>96 belong >0 - not stripped 17705 177060 belong 0x020b010d PA-RISC1.0 dynamic load library 17707>96 belong >0 - not stripped 17708 17709#### 500 177100 long 0x02080106 HP s500 relocatable executable 17711>16 long >0 - version %d 17712 177130 long 0x02080107 HP s500 executable 17714>16 long >0 - version %d 17715 177160 long 0x02080108 HP s500 pure executable 17717>16 long >0 - version %d 17718 17719#### 200 177200 belong 0x020c0108 HP s200 pure executable 17721>4 beshort >0 - version %d 17722>8 belong &0x80000000 save fp regs 17723>8 belong &0x40000000 dynamically linked 17724>8 belong &0x20000000 debuggable 17725>36 belong >0 not stripped 17726 177270 belong 0x020c0107 HP s200 executable 17728>4 beshort >0 - version %d 17729>8 belong &0x80000000 save fp regs 17730>8 belong &0x40000000 dynamically linked 17731>8 belong &0x20000000 debuggable 17732>36 belong >0 not stripped 17733 177340 belong 0x020c010b HP s200 demand-load executable 17735>4 beshort >0 - version %d 17736>8 belong &0x80000000 save fp regs 17737>8 belong &0x40000000 dynamically linked 17738>8 belong &0x20000000 debuggable 17739>36 belong >0 not stripped 17740 177410 belong 0x020c0106 HP s200 relocatable executable 17742>4 beshort >0 - version %d 17743>6 beshort >0 - highwater %d 17744>8 belong &0x80000000 save fp regs 17745>8 belong &0x20000000 debuggable 17746>8 belong &0x10000000 PIC 17747 177480 belong 0x020a0108 HP s200 (2.x release) pure executable 17749>4 beshort >0 - version %d 17750>36 belong >0 not stripped 17751 177520 belong 0x020a0107 HP s200 (2.x release) executable 17753>4 beshort >0 - version %d 17754>36 belong >0 not stripped 17755 177560 belong 0x020c010e HP s200 shared library 17757>4 beshort >0 - version %d 17758>6 beshort >0 - highwater %d 17759>36 belong >0 not stripped 17760 177610 belong 0x020c010d HP s200 dynamic load library 17762>4 beshort >0 - version %d 17763>6 beshort >0 - highwater %d 17764>36 belong >0 not stripped 17765 17766#### MISC 177670 long 0x0000ff65 HP old archive 177680 long 0x020aff65 HP s200 old archive 177690 long 0x020cff65 HP s200 old archive 177700 long 0x0208ff65 HP s500 old archive 17771 177720 long 0x015821a6 HP core file 17773 177740 long 0x4da7eee8 HP-WINDOWS font 17775>8 byte >0 - version %d 177760 string Bitmapfile HP Bitmapfile 17777 177780 string IMGfile CIS compimg HP Bitmapfile 17779# XXX - see "lif" 17780#0 short 0x8000 lif file 177810 long 0x020c010c compiled Lisp 17782 177830 string msgcat01 HP NLS message catalog, 17784>8 long >0 %d messages 17785 17786# Summary: HP-48/49 calculator 17787# Created by: phk@data.fls.dk 17788# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 17789# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 177900 string HPHP HP 17791>4 string 48 48 binary 17792>4 string 49 49 binary 17793>7 byte >64 - Rev %c 17794>8 leshort 0x2911 (ADR) 17795>8 leshort 0x2933 (REAL) 17796>8 leshort 0x2955 (LREAL) 17797>8 leshort 0x2977 (COMPLX) 17798>8 leshort 0x299d (LCOMPLX) 17799>8 leshort 0x29bf (CHAR) 17800>8 leshort 0x29e8 (ARRAY) 17801>8 leshort 0x2a0a (LNKARRAY) 17802>8 leshort 0x2a2c (STRING) 17803>8 leshort 0x2a4e (HXS) 17804>8 leshort 0x2a74 (LIST) 17805>8 leshort 0x2a96 (DIR) 17806>8 leshort 0x2ab8 (ALG) 17807>8 leshort 0x2ada (UNIT) 17808>8 leshort 0x2afc (TAGGED) 17809>8 leshort 0x2b1e (GROB) 17810>8 leshort 0x2b40 (LIB) 17811>8 leshort 0x2b62 (BACKUP) 17812>8 leshort 0x2b88 (LIBDATA) 17813>8 leshort 0x2d9d (PROG) 17814>8 leshort 0x2dcc (CODE) 17815>8 leshort 0x2e48 (GNAME) 17816>8 leshort 0x2e6d (LNAME) 17817>8 leshort 0x2e92 (XLIB) 17818 178190 string %%HP: HP text 17820>6 string T(0) - T(0) 17821>6 string T(1) - T(1) 17822>6 string T(2) - T(2) 17823>6 string T(3) - T(3) 17824>10 string A(D) A(D) 17825>10 string A(R) A(R) 17826>10 string A(G) A(G) 17827>14 string F(.) F(.); 17828>14 string F(,) F(,); 17829 17830 17831# Summary: HP-38/39 calculator 17832# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 178330 string HP3 17834>3 string 8 HP 38 17835>3 string 9 HP 39 17836>4 string Bin binary 17837>4 string Asc ASCII 17838>7 string A (Directory List) 17839>7 string B (Zaplet) 17840>7 string C (Note) 17841>7 string D (Program) 17842>7 string E (Variable) 17843>7 string F (List) 17844>7 string G (Matrix) 17845>7 string H (Library) 17846>7 string I (Target List) 17847>7 string J (ASCII Vector specification) 17848>7 string K (wildcard) 17849 17850# Summary: HP-38/39 calculator 17851# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 178520 string HP3 17853>3 string 8 HP 38 17854>3 string 9 HP 39 17855>4 string Bin binary 17856>4 string Asc ASCII 17857>7 string A (Directory List) 17858>7 string B (Zaplet) 17859>7 string C (Note) 17860>7 string D (Program) 17861>7 string E (Variable) 17862>7 string F (List) 17863>7 string G (Matrix) 17864>7 string H (Library) 17865>7 string I (Target List) 17866>7 string J (ASCII Vector specification) 17867>7 string K (wildcard) 17868 17869# hpBSD magic numbers 178700 beshort 200 hp200 (68010) BSD 17871>2 beshort 0407 impure binary 17872>2 beshort 0410 read-only binary 17873>2 beshort 0413 demand paged binary 178740 beshort 300 hp300 (68020+68881) BSD 17875>2 beshort 0407 impure binary 17876>2 beshort 0410 read-only binary 17877>2 beshort 0413 demand paged binary 17878# 17879# From David Gero <dgero@nortelnetworks.com> 17880# HP-UX 10.20 core file format from /usr/include/sys/core.h 17881# Unfortunately, HP-UX uses corehead blocks without specifying the order 17882# There are four we care about: 17883# CORE_KERNEL, which starts with the string "HP-UX" 17884# CORE_EXEC, which contains the name of the command 17885# CORE_PROC, which contains the signal number that caused the core dump 17886# CORE_FORMAT, which contains the version of the core file format (== 1) 17887# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 17888# but we include all 6 variations of the order of the first 3, and 17889# assume that PROC will always be last 17890# Order 1: KERNEL, EXEC, FORMAT, PROC 178910x10 string HP-UX 17892>0 belong 2 17893>>0xC belong 0x3C 17894>>>0x4C belong 0x100 17895>>>>0x58 belong 0x44 17896>>>>>0xA0 belong 1 17897>>>>>>0xAC belong 4 17898>>>>>>>0xB0 belong 1 17899>>>>>>>>0xB4 belong 4 core file 17900>>>>>>>>>0x90 string >\0 from '%s' 17901>>>>>>>>>0xC4 belong 3 - received SIGQUIT 17902>>>>>>>>>0xC4 belong 4 - received SIGILL 17903>>>>>>>>>0xC4 belong 5 - received SIGTRAP 17904>>>>>>>>>0xC4 belong 6 - received SIGABRT 17905>>>>>>>>>0xC4 belong 7 - received SIGEMT 17906>>>>>>>>>0xC4 belong 8 - received SIGFPE 17907>>>>>>>>>0xC4 belong 10 - received SIGBUS 17908>>>>>>>>>0xC4 belong 11 - received SIGSEGV 17909>>>>>>>>>0xC4 belong 12 - received SIGSYS 17910>>>>>>>>>0xC4 belong 33 - received SIGXCPU 17911>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 17912# Order 2: KERNEL, FORMAT, EXEC, PROC 17913>>>0x4C belong 1 17914>>>>0x58 belong 4 17915>>>>>0x5C belong 1 17916>>>>>>0x60 belong 0x100 17917>>>>>>>0x6C belong 0x44 17918>>>>>>>>0xB4 belong 4 core file 17919>>>>>>>>>0xA4 string >\0 from '%s' 17920>>>>>>>>>0xC4 belong 3 - received SIGQUIT 17921>>>>>>>>>0xC4 belong 4 - received SIGILL 17922>>>>>>>>>0xC4 belong 5 - received SIGTRAP 17923>>>>>>>>>0xC4 belong 6 - received SIGABRT 17924>>>>>>>>>0xC4 belong 7 - received SIGEMT 17925>>>>>>>>>0xC4 belong 8 - received SIGFPE 17926>>>>>>>>>0xC4 belong 10 - received SIGBUS 17927>>>>>>>>>0xC4 belong 11 - received SIGSEGV 17928>>>>>>>>>0xC4 belong 12 - received SIGSYS 17929>>>>>>>>>0xC4 belong 33 - received SIGXCPU 17930>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 17931# Order 3: FORMAT, KERNEL, EXEC, PROC 179320x24 string HP-UX 17933>0 belong 1 17934>>0xC belong 4 17935>>>0x10 belong 1 17936>>>>0x14 belong 2 17937>>>>>0x20 belong 0x3C 17938>>>>>>0x60 belong 0x100 17939>>>>>>>0x6C belong 0x44 17940>>>>>>>>0xB4 belong 4 core file 17941>>>>>>>>>0xA4 string >\0 from '%s' 17942>>>>>>>>>0xC4 belong 3 - received SIGQUIT 17943>>>>>>>>>0xC4 belong 4 - received SIGILL 17944>>>>>>>>>0xC4 belong 5 - received SIGTRAP 17945>>>>>>>>>0xC4 belong 6 - received SIGABRT 17946>>>>>>>>>0xC4 belong 7 - received SIGEMT 17947>>>>>>>>>0xC4 belong 8 - received SIGFPE 17948>>>>>>>>>0xC4 belong 10 - received SIGBUS 17949>>>>>>>>>0xC4 belong 11 - received SIGSEGV 17950>>>>>>>>>0xC4 belong 12 - received SIGSYS 17951>>>>>>>>>0xC4 belong 33 - received SIGXCPU 17952>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 17953# Order 4: EXEC, KERNEL, FORMAT, PROC 179540x64 string HP-UX 17955>0 belong 0x100 17956>>0xC belong 0x44 17957>>>0x54 belong 2 17958>>>>0x60 belong 0x3C 17959>>>>>0xA0 belong 1 17960>>>>>>0xAC belong 4 17961>>>>>>>0xB0 belong 1 17962>>>>>>>>0xB4 belong 4 core file 17963>>>>>>>>>0x44 string >\0 from '%s' 17964>>>>>>>>>0xC4 belong 3 - received SIGQUIT 17965>>>>>>>>>0xC4 belong 4 - received SIGILL 17966>>>>>>>>>0xC4 belong 5 - received SIGTRAP 17967>>>>>>>>>0xC4 belong 6 - received SIGABRT 17968>>>>>>>>>0xC4 belong 7 - received SIGEMT 17969>>>>>>>>>0xC4 belong 8 - received SIGFPE 17970>>>>>>>>>0xC4 belong 10 - received SIGBUS 17971>>>>>>>>>0xC4 belong 11 - received SIGSEGV 17972>>>>>>>>>0xC4 belong 12 - received SIGSYS 17973>>>>>>>>>0xC4 belong 33 - received SIGXCPU 17974>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 17975# Order 5: FORMAT, EXEC, KERNEL, PROC 179760x78 string HP-UX 17977>0 belong 1 17978>>0xC belong 4 17979>>>0x10 belong 1 17980>>>>0x14 belong 0x100 17981>>>>>0x20 belong 0x44 17982>>>>>>0x68 belong 2 17983>>>>>>>0x74 belong 0x3C 17984>>>>>>>>0xB4 belong 4 core file 17985>>>>>>>>>0x58 string >\0 from '%s' 17986>>>>>>>>>0xC4 belong 3 - received SIGQUIT 17987>>>>>>>>>0xC4 belong 4 - received SIGILL 17988>>>>>>>>>0xC4 belong 5 - received SIGTRAP 17989>>>>>>>>>0xC4 belong 6 - received SIGABRT 17990>>>>>>>>>0xC4 belong 7 - received SIGEMT 17991>>>>>>>>>0xC4 belong 8 - received SIGFPE 17992>>>>>>>>>0xC4 belong 10 - received SIGBUS 17993>>>>>>>>>0xC4 belong 11 - received SIGSEGV 17994>>>>>>>>>0xC4 belong 12 - received SIGSYS 17995>>>>>>>>>0xC4 belong 33 - received SIGXCPU 17996>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 17997# Order 6: EXEC, FORMAT, KERNEL, PROC 17998>0 belong 0x100 17999>>0xC belong 0x44 18000>>>0x54 belong 1 18001>>>>0x60 belong 4 18002>>>>>0x64 belong 1 18003>>>>>>0x68 belong 2 18004>>>>>>>0x74 belong 0x2C 18005>>>>>>>>0xB4 belong 4 core file 18006>>>>>>>>>0x44 string >\0 from '%s' 18007>>>>>>>>>0xC4 belong 3 - received SIGQUIT 18008>>>>>>>>>0xC4 belong 4 - received SIGILL 18009>>>>>>>>>0xC4 belong 5 - received SIGTRAP 18010>>>>>>>>>0xC4 belong 6 - received SIGABRT 18011>>>>>>>>>0xC4 belong 7 - received SIGEMT 18012>>>>>>>>>0xC4 belong 8 - received SIGFPE 18013>>>>>>>>>0xC4 belong 10 - received SIGBUS 18014>>>>>>>>>0xC4 belong 11 - received SIGSEGV 18015>>>>>>>>>0xC4 belong 12 - received SIGSYS 18016>>>>>>>>>0xC4 belong 33 - received SIGXCPU 18017>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 18018 18019 18020 18021#------------------------------------------------------------------------------ 18022# $File: human68k,v 1.6 2021/04/26 15:56:00 christos Exp $ 18023# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 18024# Magic too short! 18025#0 string HU Human68k 18026#>68 string LZX LZX compressed 18027#>>72 string >\0 (version %s) 18028#>(8.L+74) string LZX LZX compressed 18029#>>(8.L+78) string >\0 (version %s) 18030#>60 belong >0 binded 18031#>(8.L+66) string #HUPAIR hupair 18032#>0 string HU X executable 18033#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 18034#>4 belong >0 - base address %#x 18035#>28 belong >0 not stripped 18036#>32 belong >0 with debug information 18037#0 beshort 0x601a Human68k Z executable 18038#0 beshort 0x6000 Human68k object file 18039#0 belong 0xd1000000 Human68k ar binary archive 18040#0 belong 0xd1010000 Human68k ar ascii archive 18041#0 beshort 0x0068 Human68k lib archive 18042#4 string LZX Human68k LZX compressed 18043#>8 string >\0 (version %s) 18044#>4 string LZX R executable 18045#2 string #HUPAIR Human68k hupair R executable 18046 18047#------------------------------------------------------------------------------ 18048# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $ 18049# ibm370: file(1) magic for IBM 370 and compatibles. 18050# 18051# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 18052# What the heck *is* "USS/370"? 18053# AIX 4.1's "/etc/magic" has 18054# 18055# 0 short 0535 370 sysV executable 18056# >12 long >0 not stripped 18057# >22 short >0 - version %d 18058# >30 long >0 - 5.2 format 18059# 0 short 0530 370 sysV pure executable 18060# >12 long >0 not stripped 18061# >22 short >0 - version %d 18062# >30 long >0 - 5.2 format 18063# 18064# instead of the "USS/370" versions of the same magic numbers. 18065# 180660 beshort 0537 370 XA sysV executable 18067>12 belong >0 not stripped 18068>22 beshort >0 - version %d 18069>30 belong >0 - 5.2 format 180700 beshort 0532 370 XA sysV pure executable 18071>12 belong >0 not stripped 18072>22 beshort >0 - version %d 18073>30 belong >0 - 5.2 format 180740 beshort 054001 370 sysV pure executable 18075>12 belong >0 not stripped 180760 beshort 055001 370 XA sysV pure executable 18077>12 belong >0 not stripped 180780 beshort 056401 370 sysV executable 18079>12 belong >0 not stripped 180800 beshort 057401 370 XA sysV executable 18081>12 belong >0 not stripped 180820 beshort 0531 SVR2 executable (Amdahl-UTS) 18083>12 belong >0 not stripped 18084>24 belong >0 - version %d 180850 beshort 0534 SVR2 pure executable (Amdahl-UTS) 18086>12 belong >0 not stripped 18087>24 belong >0 - version %d 180880 beshort 0530 SVR2 pure executable (USS/370) 18089>12 belong >0 not stripped 18090>24 belong >0 - version %d 180910 beshort 0535 SVR2 executable (USS/370) 18092>12 belong >0 not stripped 18093>24 belong >0 - version %d 18094 18095# NETDATA (https://en.wikipedia.org/wiki/NETDATA) 18096# -\INMR01 In EBCDIC 180970 string \x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1 IBM NETDATA file 18098 18099#------------------------------------------------------------------------------ 18100# $File: ibm6000,v 1.15 2021/07/03 14:01:46 christos Exp $ 18101# ibm6000: file(1) magic for RS/6000 and the RT PC. 18102# 181030 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 18104>12 belong >0 not stripped 18105# Breaks sun4 statically linked execs. 18106#0 beshort 0x0103 executable (RT Version 2) or obj module 18107#>2 byte 0x50 pure 18108#>28 belong >0 not stripped 18109#>6 beshort >0 - version %ld 18110# GRR: line below is too general as it matches also TTComp archive, ASCII, 1K handled by ./archive 181110 beshort 0x0104 shared library 18112# GRR: line below is too general as it matches also TTComp archive, ASCII, 2K handled by ./archive 181130 beshort 0x0105 ctab data 181140 beshort 0xfe04 structured file 181150 string 0xabcdef AIX message catalog 181160 belong 0x000001f9 AIX compiled message catalog 181170 string \<aiaff> archive 181180 string \<bigaf> archive (big format) 181190 belong 0x09006bea AIX backup/restore format file 181200 belong 0x09006fea AIX backup/restore format file 18121 181220 beshort 0x01f7 64-bit XCOFF executable or object module 18123>20 belong 0 not stripped 18124# GRR: this test is still too general as it catches also many FATs of DOS filesystems 181254 belong &0x0feeddb0 18126# real core dump could not be 32-bit and 64-bit together 18127>7 byte&0x03 !3 AIX core file 18128>>1 byte &0x01 fulldump 18129>>7 byte &0x01 32-bit 18130>>>0x6e0 string >\0 \b, %s 18131>>7 byte &0x02 64-bit 18132>>>0x524 string >\0 \b, %s 18133 18134#------------------------------------------------------------------------------ 18135# $File: icc,v 1.7 2021/04/26 15:56:00 christos Exp $ 18136# icc: file(1) magic for International Color Consortium file formats 18137 18138# 18139# Color profiles as per the ICC's "Image technology colour management - 18140# Architecture, profile format, and data structure" specification. 18141# See 18142# 18143# http://www.color.org/specification/ICC1v43_2010-12.pdf 18144# 18145# for Specification ICC.1:2010 (Profile version 4.3.0.0). 18146# URL: http://fileformats.archiveteam.org/wiki/ICC_profile 18147# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf 18148# Update: Joerg Jenderek 18149# 18150# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 18151# bytes 40 to 43 "may be used to identify the primary platform/operating 18152# system framework for which the profile was created". 18153# 18154# check and display ICC/ICM color profile 181550 name color-profile 18156>36 string acsp 18157# skip ASCII like Cognacspirit.txt by month <= 12 18158>>26 ubeshort <13 18159# platform/operating system. Only 5 mentioned 18160 18161# 18162# This appears to be what's used for Apple ColorSync profiles. 18163# Instead of adding that, Apple just changed the generic "acsp" entry 18164# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 18165# Management System, ICC Profile". 18166# Yes, it's "APPL", not "AAPL"; see the spec. 18167>>>40 string APPL ColorSync 18168 18169# Microsoft ICM color profile 18170>>>40 string MSFT Microsoft 18171 18172# Yes, that's a blank after "SGI". 18173>>>40 string SGI\ SGI 18174 18175# XXX - is this what's used for the Sun KCMS or not? The standard file 18176# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 18177# and there *is* an identified "primary platform" value of SUNW. 18178>>>40 string SUNW Sun KCMS 18179 18180# 5th platform 18181>>>40 string TGNT Taligent 18182 18183# remaining "l" "e" of "color profile" printed later to avoid error 18184>>>40 string x color profi 18185#>>>40 string x (%.4s) 18186!:mime application/vnd.iccprofile 18187# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found 18188>>>8 ubyte =2 18189# do not use empty message text to avoid error like 18190# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type 18191# file.exe: could not find any valid magic files! 18192>>>>9 ubyte !0 \ble 18193!:ext icc/icm 18194# minor version 18195>>>>9 ubyte =0 \bl 18196# Kodak colour management system 18197>>>>>4 string =KCMS \be 18198!:ext icc/icm/cc 18199>>>>>4 string !KCMS \be 18200!:ext icc/icm 18201>>>8 ubyte !2 \ble 18202!:ext icc 18203# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h) 18204>>>8 ubyte x %u 18205>>>9 ubyte/16 x \b.%u 18206# reserved and shall be null but 205.205 in umx1220u.icm 18207>>>10 ubyte >0 \b.%u 18208>>>>11 ubyte >0 \b.%u 18209# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF " 18210# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm 18211>>>4 string >\ \b, type %.2s 18212>>>>6 string >\ \b%.1s 18213>>>>>7 string >\ \b%.1s 18214# colour space "XYZ " "Lab " "RGB " CMYK GRAY ... 18215>>>16 string x \b, %.3s 18216>>>19 string >\ \b%.1s 18217# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes 18218# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc 18219>>>20 string >\0 \b/%.3s 18220>>>>23 string >\ \b%.1s 18221# eleven device classes 18222>>>12 string x \b-%.4s device 18223# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm 18224>>>52 string >\040 18225# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm" 18226>>>>52 ubelong !0x6e6f6e65 18227# device manufacturer field like "HP " "IBM " EPSO 18228>>>>>48 string x \b, %.2s 18229>>>>>50 string >\ \b%.1s 18230>>>>>51 string >\ \b%.1s 18231# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC 18232>>>>>52 string >\ \ \b/%.3s 18233>>>>>>55 string >\ \b%.1s 18234>>>>>52 string x model 18235# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm 18236>>>80 string >\0 by %.2s 18237>>>>82 string >\ \b%.1s 18238>>>>>83 string >\ \b%.1s 18239# profile size 18240>>>0 ubelong x \b, %u bytes 18241# skip invalid date 0 like in linearSRGB.icc 18242>>>24 ubequad !0 18243# datetime dd-mm-yyyy hh:mm:ss 18244>>>>28 ubeshort x \b, %u 18245# month <= 12 18246>>>>26 ubeshort x \b-%u 18247# year 18248>>>>24 ubeshort x \b-%u 18249# do not display midnight time like in CNHP8308.ICC 18250>>>>30 ubequad&0xFFffFFffFFff0000 !0 18251# hour <= 24 18252>>>>>30 ubeshort x %u 18253# minutes <= 59 18254>>>>>32 ubeshort x \b:%.2u 18255# seconds <= 59 18256>>>>>34 ubeshort x \b:%.2u 18257# vendor specific flags like 2 in HPCLJ5.ICM 18258>>>44 ubeshort >0 \b, %#x vendor flags 18259# profile flags bits 0-2 of least 16 used by ICC 18260#>>>44 ubelong >0 \b, %#x flags 18261# icEmbeddedProfileTrue 18262>>>44 ubelong &1 \b, embedded 18263# icEmbeddedProfileFalse 18264#>>>44 ubelong ^1 \b, not embedded 18265# icUseWithEmbeddedDataOnly 18266>>>44 ubelong &2 \b, dependently 18267# icUseAnywhere 18268#>>>44 ubelong ^2 \b, independently 18269>>>44 ubelong &4 \b, MCS 18270#>>>44 ubelong ^4 \b, no MCS 18271# vendor specific device attributes 1~srgb.icc 18272# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM 18273>>>56 ubelong >0 \b, %#x vendor attribute 18274# ICC device attributes bits 0-7 used 18275#>>>60 ubelong x \b, %#x attribute 18276# http://www.color.org/icc34.h 18277>>>60 ubelong &0x01 \b, transparent 18278#>>>60 ubelong ^0x01 \b, reflective 18279>>>60 ubelong &0x02 \b, matte 18280#>>>60 ubelong ^0x02 \b, glossy 18281>>>60 ubelong &0x04 \b, negative 18282#>>>60 ubelong ^0x04 \b, positive 18283>>>60 ubelong &0x08 \b, black&white 18284#>>>60 ubelong ^0x08 \b, colour 18285>>>60 ubelong &0x10 \b, non-paper 18286#>>>60 ubelong ^0x10 \b, paper 18287>>>60 ubelong &0x20 \b, non-textured 18288#>>>60 ubelong ^0x20 \b, textured 18289>>>60 ubelong &0x40 \b, non-isotropic 18290#>>>60 ubelong ^0x40 \b, isotropic 18291>>>60 ubelong &0x80 \b, self-luminous 18292#>>>60 ubelong ^0x80 \b, non-self-luminous 18293# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM 18294>>>64 ubelong >3 \b, %#x rendering intent 18295#>>>64 ubelong =0 \b, perceptual 18296>>>64 ubelong =1 \b, relative colorimetric 18297>>>64 ubelong =2 \b, saturation 18298>>>64 ubelong =3 \b, absolute colorimetric 18299# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d 18300>>>71 ubequad !0xd6000100000000d3 \b, PCS 18301# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found 18302# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm 18303>>>>68 ubelong !0x0000f6d5 X=%#x 18304# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm 18305>>>>72 ubelong !0x00010000 Y=%#x 18306# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found 18307# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm 18308>>>>76 ubelong !0x0000d32d Z=%#x 18309# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321. 18310>>>84 ubequad >0 \b, %#llx MD5 18311# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD 18312#>>100 ubequad x \b %#llx reserved 18313# tag table 18314# 6 <= tags count <= 43 18315#>>>128 ubelong >43 \b, %u tags 18316>>>128 ubelong x 18317# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt" 18318# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508 18319>>>>132 search/508 cprt 18320# but no copyright tag in linearSRGB.icc 18321# beneath /System/Library/Frameworks/WebKit.framework/ 18322# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources 18323>>>>132 default x \b, no copyright tag 18324# 1st tag 18325#>>>132 string x \b, 1st tag %.4s 18326#>>>136 ubelong x %#x offset 18327#>>>140 ubelong x %#x len 18328# 2nd tag,... 18329# look also for profileDescriptionTag "desc" 18330>>>132 search/508 desc 18331# look further for TextDescriptionType "desc" signature 18332>>>>(&0.L) string =desc 18333>>>>>&4 pstring/l x "%s" 18334# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc 18335>>>>(&0.L) string =mluc 18336>>>>>&(&8.L) ubequad x 18337>>>>>>&4 bestring16 x '%s' 18338 18339# Any other profile. 18340# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 18341# and use "acsp" for everything else and dump the "primary platform" 18342# string in those cases? 1834336 string acsp 18344>0 use color-profile 18345 18346 18347 18348#------------------------------------------------------------------------------ 18349# $File: iff,v 1.18 2022/03/21 19:57:18 christos Exp $ 18350# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 18351# 18352# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 18353# Arts for file interchange. It has also been used by Apple, SGI, and 18354# especially Commodore-Amiga. 18355# 18356# IFF files begin with an 8 byte FORM header, followed by a 4 character 18357# FORM type, which is followed by the first chunk in the FORM. 18358 183590 string FORM IFF data 18360#>4 belong x \b, FORM is %d bytes long 18361# audio formats 18362>8 string AIFF \b, AIFF audio 18363!:mime audio/x-aiff 18364>8 string AIFC \b, AIFF-C compressed audio 18365!:mime audio/x-aiff 18366>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 18367!:mime audio/x-aiff 18368>8 string 16SV \b, 16SV 16-bit sampled sound voice 18369>8 string SAMP \b, SAMP sampled audio 18370>8 string MAUD \b, MAUD MacroSystem audio 18371>8 string SMUS \b, SMUS simple music 18372>8 string CMUS \b, CMUS complex music 18373# image formats 18374>8 string ILBMBMHD \b, ILBM interleaved image 18375>>20 beshort x \b, %d x 18376>>22 beshort x %d 18377>8 string RGBN \b, RGBN 12-bit RGB image 18378>8 string RGB8 \b, RGB8 24-bit RGB image 18379>8 string DEEP \b, DEEP TVPaint/XiPaint image 18380>8 string DR2D \b, DR2D 2-D object 18381>8 string TDDD \b, TDDD 3-D rendering 18382>8 string LWOB \b, LWOB 3-D object 18383>8 string LWO2 \b, LWO2 3-D object, v2 18384>8 string LWLO \b, LWLO 3-D layered object 18385>8 string REAL \b, REAL Real3D rendering 18386>8 string MC4D \b, MC4D MaxonCinema4D rendering 18387>8 string ANIM \b, ANIM animation 18388>8 string YAFA \b, YAFA animation 18389>8 string SSA\ \b, SSA super smooth animation 18390>8 string FANT \b, Fantavision animation 18391>8 string ACBM \b, ACBM continuous image 18392>8 string FAXX \b, FAXX fax image 18393>8 string STFX \b, ST-Fax image 18394>8 string IMAGIHDR \b, CD-i image 18395# other formats 18396>8 string FTXT \b, FTXT formatted text 18397>8 string CTLG \b, CTLG message catalog 18398>8 string PREF \b, PREF preferences 18399>8 string DTYP \b, DTYP datatype description 18400>8 string PTCH \b, PTCH binary patch 18401>8 string AMFF \b, AMFF AmigaMetaFile format 18402>8 string WZRD \b, WZRD StormWIZARD resource 18403>8 string DOC\040 \b, DOC desktop publishing document 18404>8 string SWRT \b, SWRT Final Copy/Writer document 18405>8 string WORD \b, ProWrite document 18406>8 string WTXT \b, WTXT Wordworth document 18407>8 string WOWO \b, WOWO Wordworth document 18408>8 string WVQA \b, Westwood Studios VQA Multimedia, 18409>>24 leshort x %d video frames, 18410>>26 leshort x %d x 18411>>28 leshort x %d 18412>8 string MOVE \b, Wing Commander III Video 18413>>12 string _PC_ \b, PC version 18414>>12 string 3DO_ \b, 3DO version 18415 18416# These go at the end of the iff rules 18417# 18418# David Griffith <dave@661.org> 18419# I don't see why these might collide with anything else. 18420# 18421# Interactive Fiction related formats 18422# 18423>8 string IFRS \b, Blorb Interactive Fiction 18424>>24 string Exec with executable chunk 18425>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 18426!:mime application/x-blorb 18427 18428#------------------------------------------------------------------------------ 18429# $File: images,v 1.227 2022/09/11 20:58:52 christos Exp $ 18430# images: file(1) magic for image formats (see also "iff", and "c-lang" for 18431# XPM bitmaps) 18432# 18433# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 18434# additions by janl@ifi.uio.no as well as others. Jan also suggested 18435# merging several one- and two-line files into here. 18436# 18437# little magic: PCX (first byte is 0x0a) 18438 18439# Targa - matches `povray', `ppmtotga' and `xv' outputs 18440# by Philippe De Muyter <phdm@macqel.be> 18441# URL: http://justsolve.archiveteam.org/wiki/TGA 18442# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf 18443# Update: Joerg Jenderek 18444# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 18445# ,32 or 33 (both not observed) 18446# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 18447# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications 18448# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 18449# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 18450# `tgatoppm' recognizes a superset (Index may be anything) 18451# 18452# test of Color Map Type 0~no 1~color map 18453# and Image Type 1 2 3 9 10 11 32 33 18454# and Color Map Entry Size 0 15 16 24 32 184550 ubequad&0x00FeC400000000C0 0 18456# Conflict with MPEG sequences. 18457!:strength -40 18458# Prevent conflicts with CRI ADX. 18459#>(2.S-2) belong !0x28632943 18460# above line does not work for rgb32_top_left_rle.tga 18461# skip some MPEG sequence *.vob and some CRI ADX audio with improbable interleave bits 18462>17 ubyte&0xC0 !0xC0 18463# skip more garbage like *.iso by looking for positive image type 18464>>2 ubyte >0 18465# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33 18466>>>2 ubyte <34 18467# skip some MPEG sequence *.vob HV001T01.EVO winnicki.mpg with unacceptable alpha channel depth 11 18468>>>>17 ubyte&0x0F !11 18469# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32 18470>>>>>16 ubyte 1 18471>>>>>>0 use tga-image 18472>>>>>16 ubyte 8 18473>>>>>>0 use tga-image 18474>>>>>16 ubyte 15 18475>>>>>>0 use tga-image 18476>>>>>16 ubyte 16 18477>>>>>>0 use tga-image 18478>>>>>16 ubyte 24 18479>>>>>>0 use tga-image 18480>>>>>16 ubyte 32 18481>>>>>>0 use tga-image 18482# display tga bitmap image information 184830 name tga-image 18484>2 ubyte <34 Targa image data 18485!:mime image/x-tga 18486!:apple ????TPIC 18487# normal extension .tga but some Truevision products used others: 18488# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that) 18489!:ext tga/tpic/icb/vda/vst 18490# image type 1 2 3 9 10 11 32 33 18491>2 ubyte&0xF7 1 - Map 18492>2 ubyte&0xF7 2 - RGB 18493# alpha channel 18494>>17 ubyte&0x0F >0 \bA 18495>2 ubyte&0xF7 3 - Mono 18496# type not found, but by http://www.fileformat.info/format/tga/corion.htm 18497# Compressed color-mapped data, using Huffman, Delta, and runlength encoding 18498>2 ubyte 32 - Color 18499# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process 18500>2 ubyte 33 - Color 18501# Color Map Type 0~no 1~color map 18502>1 ubyte 1 ( 18503# first color map entry, 0 normal 18504>>3 uleshort >0 \b%d- 18505# color map length 0 2 1dh 3bh d9h 100h 18506>>5 uleshort x \b%d) 18507# 8~run length encoding bit 18508>2 ubyte&0x08 8 - RLE 18509# gimp can create big pictures! 18510>12 uleshort >0 %d x 18511>12 uleshort =0 65536 x 18512# image height. 0 interpreted as 65536 18513>14 uleshort >0 %d 18514>14 uleshort =0 65536 18515# Image Pixel depth 1 8 15 16 24 32 18516>16 ubyte x x %d 18517# X origin of image. 0 normal 18518>8 uleshort >0 +%d 18519# Y origin of image. 0 normal; positive for top 18520>10 uleshort >0 +%d 18521# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction 18522# alpha depth like: 1 8 18523>17 ubyte&0x0F >0 - %d-bit alpha 18524# bits 5-4 give direction. normal bottom left 18525>17 ubyte &0x20 - top 18526#>17 ubyte ^0x20 - bottom 18527>17 ubyte &0x10 - right 18528#>17 ubyte ^0x10 - left 18529# some info say other bits 6-7 should be zero 18530# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 18531# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved 18532#>17 ubyte&0xC0 0x00 - no interleave 18533>17 ubyte&0xC0 0x40 - interleave 18534>17 ubyte&0xC0 0x80 - four way interleave 18535>17 ubyte&0xC0 0xC0 - reserved 18536# positive length implies identification field 18537>0 ubyte >0 18538>>18 string x "%s" 18539# last 18 bytes of newer tga file footer signature 18540>18 search/4261301/s TRUEVISION-XFILE.\0 18541# extension area offset if not 0 18542>>&-8 ulelong >0 18543# length of the extension area. normal 495 for version 2.0 18544>>>(&-4.l) uleshort 0x01EF 18545# AuthorName[41] 18546>>>>&0 string >\0 - author "%-.40s" 18547# Comment[324]=4 * 80 null terminated 18548>>>>&41 string >\0 - comment "%-.80s" 18549# date 18550>>>>&365 ubequad&0xffffFFFFffff0000 !0 18551# Day 18552>>>>>&-6 uleshort x %d 18553# Month 18554>>>>>&-8 uleshort x \b-%d 18555# Year 18556>>>>>&-4 uleshort x \b-%d 18557# time 18558>>>>&371 ubequad&0xffffFFFFffff0000 !0 18559# hour 18560>>>>>&-8 uleshort x %d 18561# minutes 18562>>>>>&-6 uleshort x \b:%.2d 18563# second 18564>>>>>&-4 uleshort x \b:%.2d 18565# JobName[41] 18566>>>>&377 string >\0 - job "%-.40s" 18567# JobHour Jobminute Jobsecond 18568>>>>&418 ubequad&0xffffFFFFffff0000 !0 18569>>>>>&-8 uleshort x %d 18570>>>>>&-6 uleshort x \b:%.2d 18571>>>>>&-4 uleshort x \b:%.2d 18572# SoftwareId[41] 18573>>>>&424 string >\0 - %-.40s 18574# SoftwareVersionNumber 18575>>>>&424 ubyte >0 18576>>>>>&40 uleshort/100 x %d 18577>>>>>&40 uleshort%100 x \b.%d 18578# VersionLetter 18579>>>>>&42 ubyte >0x20 \b%c 18580# KeyColor 18581>>>>&468 ulelong >0 - keycolor %#8.8x 18582# Denominator of Pixel ratio. 0~no pixel aspect 18583>>>>&474 uleshort >0 18584# Numerator 18585>>>>>&-4 uleshort >0 - aspect %d 18586>>>>>&-2 uleshort x \b/%d 18587# Denominator of Gamma ratio. 0~no Gamma value 18588>>>>&478 uleshort >0 18589# Numerator 18590>>>>>&-4 uleshort >0 - gamma %d 18591>>>>>&-2 uleshort x \b/%d 18592# ColorOffset 18593#>>>>&480 ulelong x - col offset %#8.8x 18594# StampOffset 18595#>>>>&484 ulelong x - stamp offset %#8.8x 18596# ScanOffset 18597#>>>>&488 ulelong x - scan offset %#8.8x 18598# AttributesType 18599#>>>>&492 ubyte x - Attributes %#x 18600## EndOfTGA 18601 18602# PBMPLUS images 18603# URL: https://en.wikipedia.org/wiki/Netpbm 18604# The next byte following the magic is always whitespace. 18605# adding 65 to strength so that Netpbm images comes before "x86 boot sector" or 18606# "DOS/MBR boot sector" identified by ./filesystems 186070 name netpbm 18608>3 regex/s =[0-9]{1,50}[\040\t\f\r\n]+[0-9]{1,50} Netpbm image data 18609>>&0 regex =[0-9]{1,50} \b, size = %s x 18610>>>&0 regex =[0-9]{1,50} \b %s 18611 186120 search/1 P1 18613# test for whitespace after 2 byte magic 18614>2 regex/2 [\040\t\f\r\n] 18615# skip DROID x-fmt-164-signature-id-583.pbm with ten 0 digits 18616>>3 string !000000000 18617>>>0 use netpbm 18618>>>0 string x \b, bitmap 18619!:strength + 65 18620!:mime image/x-portable-bitmap 18621!:ext pbm 18622# check for character # starting a comment line 18623>>>3 ubyte =0x23 18624>>>>4 string x %s 18625 186260 search/1 P2 18627>0 regex/4 P2[\040\t\f\r\n] 18628>>0 use netpbm 18629>>0 string x \b, greymap 18630!:strength + 65 18631# american spelling gray 18632!:mime image/x-portable-graymap 18633!:ext pgm 18634 186350 search/1 P3 18636>0 regex/4 P3[\040\t\f\r\n] 18637>>0 use netpbm 18638>>0 string x \b, pixmap 18639!:strength + 65 18640!:mime image/x-portable-pixmap 18641!:ext ppm 18642 186430 string P4 18644>0 regex/4 P4[\040\t\f\r\n] 18645>>0 use netpbm 18646>>0 string x \b, rawbits, bitmap 18647!:strength + 65 18648!:mime image/x-portable-bitmap 18649!:ext pbm 18650 186510 string P5 18652>0 regex/4 P5[\040\t\f\r\n] 18653>>0 use netpbm 18654>>0 string x \b, rawbits, greymap 18655!:strength + 65 18656!:mime image/x-portable-greymap 18657!:ext pgm 18658 186590 string P6 18660>0 regex/4 P6[\040\t\f\r\n] 18661>>0 use netpbm 18662>>0 string x \b, rawbits, pixmap 18663!:strength + 65 18664!:mime image/x-portable-pixmap 18665!:ext ppm/pnm 18666 18667# URL: https://en.wikipedia.org/wiki/Netpbm#PAM_graphics_format 18668# Reference: http://fileformats.archiveteam.org/wiki/Portable_Arbitrary_Map 18669# Update: Joerg Jenderek 186700 string P7 18671# skip DROID fmt-405-signature-id-589.pam by looking for character like New Line 18672>2 ubyte !0xAB 18673#>2 ubyte =0x0A 18674>>3 search/256/b WIDTH Netpbm PAM image file, size = 18675!:mime image/x-portable-arbitrarymap 18676!:ext pam 18677!:strength + 65 18678>>>&1 string x %s 18679>>>3 search/256/b HEIGHT x 18680>>>>&1 string x %s 18681# at offset 2 a New Line character (0xA) should appear 18682>>>2 ubyte !0x0A \b, %#x at offset 2 instead new line 18683 18684# From: bryanh@giraffe-data.com (Bryan Henderson) 186850 string \117\072 Solitaire Image Recorder format 18686>4 string \013 MGI Type 11 18687>4 string \021 MGI Type 17 186880 string .MDA MicroDesign data 18689>21 ubyte 48 version 2 18690>21 ubyte 51 version 3 186910 string .MDP MicroDesign page data 18692>21 ubyte 48 version 2 18693>21 ubyte 51 version 3 18694 18695# NIFF (Navy Interchange File Format, a modification of TIFF) images 18696# [GRR: this *must* go before TIFF] 186970 string IIN1 NIFF image data 18698!:mime image/x-niff 18699 18700# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 18701# (CIFF) file. These are apparently all little-endian. 18702# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18703# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 187040 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 18705!:mime image/x-canon-crw 18706>16 uleshort x \b, version %d. 18707>14 uleshort x \b%d 18708 18709# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 18710# number. Put this above the TIFF test to make sure we detect them. 18711# These are apparently all little-endian. 18712# From: Adam Buchbinder <adam.buchbinder@gmail.com> 18713# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2 187140 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 18715!:mime image/x-canon-cr2 18716!:strength +80 18717>10 ubyte x \b, version %d. 18718>11 ubyte x \b%d 18719 18720# Fujifilm RAF RAW image files with embedded JPEG data and compressed 18721# or uncompressed CFA RAW data. Byte order: Big Endian. 18722# URL: https://libopenraw.freedesktop.org/formats/raf/ 18723# Useful info from http://fileformats.archiveteam.org/wiki/Fujifilm_RAF. 18724# File extension: RAF 18725# Works for both the FinePix S2 Pro and the X-T3. Anybody have some more Fuji 18726# raw samples available? 18727# -- David Dyer-Bennet <dd-b@dd-b.net> 9-Sep-2021 187280 string FUJIFILMCCD-RAW Fujifilm RAF raw image data 18729!:mime image/x-fuji-raf 18730!:ext raf 18731>0x10 string x \b, format version %4.4s 18732>0x1C string x \b, camera %s 18733 18734# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 18735# The second word of TIFF files is the TIFF version number, 42, which has 18736# never changed. The TIFF specification recommends testing for it. 187370 string MM\x00\x2a TIFF image data, big-endian 18738!:strength +70 18739!:mime image/tiff 18740!:ext tif,tiff 18741>(4.L) use \^tiff_ifd 187420 string II\x2a\x00 TIFF image data, little-endian 18743!:mime image/tiff 18744!:strength +70 18745!:ext tif,tiff 18746>(4.l) use tiff_ifd 18747 187480 name tiff_ifd 18749>0 uleshort x \b, direntries=%d 18750>2 use tiff_entry 18751 187520 name tiff_entry 18753# NewSubFileType 18754>0 uleshort 0xfe 18755>>12 use tiff_entry 18756>0 uleshort 0x100 18757>>4 ulelong 1 18758>>>12 use tiff_entry 18759>>>8 uleshort x \b, width=%d 18760>0 uleshort 0x101 18761>>4 ulelong 1 18762>>>8 uleshort x \b, height=%d 18763>>>12 use tiff_entry 18764>0 uleshort 0x102 18765>>8 uleshort x \b, bps=%d 18766>>12 use tiff_entry 18767>0 uleshort 0x103 18768>>4 ulelong 1 \b, compression= 18769>>>8 uleshort 1 \bnone 18770>>>8 uleshort 2 \bhuffman 18771>>>8 uleshort 3 \bbi-level group 3 18772>>>8 uleshort 4 \bbi-level group 4 18773>>>8 uleshort 5 \bLZW 18774>>>8 uleshort 6 \bJPEG (old) 18775>>>8 uleshort 7 \bJPEG 18776>>>8 uleshort 8 \bdeflate 18777>>>8 uleshort 9 \bJBIG, ITU-T T.85 18778>>>8 uleshort 0xa \bJBIG, ITU-T T.43 18779>>>8 uleshort 0x7ffe \bNeXT RLE 2-bit 18780>>>8 uleshort 0x8005 \bPackBits (Macintosh RLE) 18781>>>8 uleshort 0x8029 \bThunderscan RLE 18782>>>8 uleshort 0x807f \bRasterPadding (CT or MP) 18783>>>8 uleshort 0x8080 \bRLE (Line Work) 18784>>>8 uleshort 0x8081 \bRLE (High-Res Cont-Tone) 18785>>>8 uleshort 0x8082 \bRLE (Binary Line Work) 18786>>>8 uleshort 0x80b2 \bDeflate (PKZIP) 18787>>>8 uleshort 0x80b3 \bKodak DCS 18788>>>8 uleshort 0x8765 \bJBIG 18789>>>8 uleshort 0x8798 \bJPEG2000 18790>>>8 uleshort 0x8799 \bNikon NEF Compressed 18791>>>8 default x 18792>>>>8 uleshort x \b(unknown %#x) 18793>>>12 use tiff_entry 18794>0 uleshort 0x106 \b, PhotometricInterpretation= 18795>>8 clear x 18796>>8 uleshort 0 \bWhiteIsZero 18797>>8 uleshort 1 \bBlackIsZero 18798>>8 uleshort 2 \bRGB 18799>>8 uleshort 3 \bRGB Palette 18800>>8 uleshort 4 \bTransparency Mask 18801>>8 uleshort 5 \bCMYK 18802>>8 uleshort 6 \bYCbCr 18803>>8 uleshort 8 \bCIELab 18804>>8 default x 18805>>>8 uleshort x \b(unknown=%#x) 18806>>12 use tiff_entry 18807# FillOrder 18808>0 uleshort 0x10a 18809>>4 ulelong 1 18810>>>12 use tiff_entry 18811# DocumentName 18812>0 uleshort 0x10d 18813>>(8.l) string x \b, name=%s 18814>>>12 use tiff_entry 18815# ImageDescription 18816>0 uleshort 0x10e 18817>>(8.l) string x \b, description=%s 18818>>>12 use tiff_entry 18819# Make 18820>0 uleshort 0x10f 18821>>(8.l) string x \b, manufacturer=%s 18822>>>12 use tiff_entry 18823# Model 18824>0 uleshort 0x110 18825>>(8.l) string x \b, model=%s 18826>>>12 use tiff_entry 18827# StripOffsets 18828>0 uleshort 0x111 18829>>12 use tiff_entry 18830# Orientation 18831>0 uleshort 0x112 \b, orientation= 18832>>8 uleshort 1 \bupper-left 18833>>8 uleshort 3 \blower-right 18834>>8 uleshort 6 \bupper-right 18835>>8 uleshort 8 \blower-left 18836>>8 uleshort 9 \bundefined 18837>>8 default x 18838>>>8 uleshort x \b[*%d*] 18839>>12 use tiff_entry 18840# XResolution 18841>0 uleshort 0x11a 18842>>8 ulelong x \b, xresolution=%d 18843>>12 use tiff_entry 18844# YResolution 18845>0 uleshort 0x11b 18846>>8 ulelong x \b, yresolution=%d 18847>>12 use tiff_entry 18848# ResolutionUnit 18849>0 uleshort 0x128 18850>>8 uleshort x \b, resolutionunit=%d 18851>>12 use tiff_entry 18852# Software 18853>0 uleshort 0x131 18854>>(8.l) string x \b, software=%s 18855>>12 use tiff_entry 18856# Datetime 18857>0 uleshort 0x132 18858>>(8.l) string x \b, datetime=%s 18859>>12 use tiff_entry 18860# HostComputer 18861>0 uleshort 0x13c 18862>>(8.l) string x \b, hostcomputer=%s 18863>>12 use tiff_entry 18864# WhitePoint 18865>0 uleshort 0x13e 18866>>12 use tiff_entry 18867# PrimaryChromaticities 18868>0 uleshort 0x13f 18869>>12 use tiff_entry 18870# YCbCrCoefficients 18871>0 uleshort 0x211 18872>>12 use tiff_entry 18873# YCbCrPositioning 18874>0 uleshort 0x213 18875>>12 use tiff_entry 18876# ReferenceBlackWhite 18877>0 uleshort 0x214 18878>>12 use tiff_entry 18879# Copyright 18880>0 uleshort 0x8298 18881>>(8.l) string x \b, copyright=%s 18882>>12 use tiff_entry 18883# ExifOffset 18884>0 uleshort 0x8769 18885>>12 use tiff_entry 18886# GPS IFD 18887>0 uleshort 0x8825 \b, GPS-Data 18888>>12 use tiff_entry 18889 18890#>0 uleshort x \b, unknown=%#x 18891#>>12 use tiff_entry 18892 188930 string MM\x00\x2b Big TIFF image data, big-endian 18894!:mime image/tiff 188950 string II\x2b\x00 Big TIFF image data, little-endian 18896!:mime image/tiff 18897 18898# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 18899# (Greg Roelofs, newt@uchicago.edu) 18900# (Albert Cahalan, acahalan@cs.uml.edu) 18901# 18902# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ... 18903# 18904 18905# IHDR parser 189060 name png-ihdr 18907>0 ubelong x \b, %d x 18908>4 ubelong x %d, 18909>8 ubyte x %d-bit 18910>9 ubyte 0 grayscale, 18911>9 ubyte 2 \b/color RGB, 18912>9 ubyte 3 colormap, 18913>9 ubyte 4 gray+alpha, 18914>9 ubyte 6 \b/color RGBA, 18915#>10 ubyte 0 deflate/32K, 18916>12 ubyte 0 non-interlaced 18917>12 ubyte 1 interlaced 18918 18919# Standard PNG image. 189200 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data 18921!:mime image/png 18922!:ext png 18923!:strength +10 18924>16 use png-ihdr 18925 18926# Apple CgBI PNG image. 189270 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI 18928>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI) 18929!:mime image/png 18930!:ext png 18931!:strength +10 18932>>32 use png-ihdr 18933 18934# possible GIF replacements; none yet released! 18935# (Greg Roelofs, newt@uchicago.edu) 18936# 18937# GRR 950115: this was mine ("Zip GIF"): 189380 string GIF94z ZIF image (GIF+deflate alpha) 18939!:mime image/x-unknown 18940# 18941# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 18942# 189430 string FGF95a FGF image (GIF+deflate beta) 18944!:mime image/x-unknown 18945# 18946# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 18947# (best; not yet implemented): 18948# 189490 string PBF PBF image (deflate compression) 18950!:mime image/x-unknown 18951 18952# GIF 18953# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65) 189540 string GIF8 GIF image data 18955!:strength +80 18956!:mime image/gif 18957!:apple 8BIMGIFf 18958!:ext gif 18959>4 string 7a \b, version 8%s, 18960>4 string 9a \b, version 8%s, 18961>6 uleshort >0 %d x 18962>8 uleshort >0 %d 18963#>10 ubyte &0x80 color mapped, 18964#>10 ubyte&0x07 =0x00 2 colors 18965#>10 ubyte&0x07 =0x01 4 colors 18966#>10 ubyte&0x07 =0x02 8 colors 18967#>10 ubyte&0x07 =0x03 16 colors 18968#>10 ubyte&0x07 =0x04 32 colors 18969#>10 ubyte&0x07 =0x05 64 colors 18970#>10 ubyte&0x07 =0x06 128 colors 18971#>10 ubyte&0x07 =0x07 256 colors 18972 18973# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 18974# 1 plane, no encoding. 189750 string \361\0\100\273 CMU window manager raster image data 18976>4 ulelong >0 %d x 18977>8 ulelong >0 %d, 18978>12 ulelong >0 %d-bit 18979 18980# Magick Image File Format 18981# URL: https://imagemagick.org/script/miff.php 18982# Reference: http://fileformats.archiveteam.org/wiki/MIFF 18983# Update: Joerg Jenderek 18984# http://www.nationalarchives.gov.uk/pronom/fmt/930 189850 search/256/bc id=imagemagick 18986# skip bad ASCII text by following new line~0x0A or space~0x20 character 18987#>&0 ubyte x \b, next character %#x 18988# called by TriD ImageMagick Machine independent File Format bitmap 18989>&0 ubyte&0xD5 0 MIFF image data 18990# https://reposcope.com/mimetype/image/miff 18991#!:mime image/miff 18992!:mime image/x-miff 18993!:ext miff/mif 18994# examples with standard file(1) magic 18995#>>0 string =id=ImageMagick with standard magic 18996# examples with unusual file(1) magic like 18997>>0 string !id=ImageMagick starting with 18998# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF 18999>>>0 ubyte =0x7b comment 19000# skip second character which is often a newline and show comment 19001>>>>2 string x "%s" 19002# does not start with comment, probably letters with other case like Id=ImageMagick 19003# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff 19004>>>0 ubyte !0x7b 19005>>>>0 string >\0 '%-.14s' 19006# URL: https://imagemagick.org/ 19007# Reference: https://imagemagick.org/script/magick-vector-graphics.php 19008# From: Joerg Jenderek 19009# Note: all white-spaces between commands are ignored 190100 string push 19011# skip some white spaces 19012>5 search/3 graphic-context ImageMagick Vector Graphic 19013# TODO: look for dangerous commands like CVE-2016-3715 19014#!:mime text/plain 19015!:mime image/x-mvg 19016!:ext mvg 19017 19018# Artisan 190190 long 1123028772 Artisan image data 19020>4 long 1 \b, rectangular 24-bit 19021>4 long 2 \b, rectangular 8-bit with colormap 19022>4 long 3 \b, rectangular 32-bit (24-bit with matte) 19023 19024# FIG (Facility for Interactive Generation of figures), an object-based format 19025# URL: http://fileformats.archiveteam.org/wiki/Fig 19026# https://en.wikipedia.org/wiki/Xfig 19027# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fig.trid.xml 19028# https://web.archive.org/web/20070920204655/http://epb.lbl.gov/xfig/fig-format.html 19029# Update: Joerg Jenderek 19030# Note: called "FIG vector drawing" by TrID, 19031# 4 byte magic is assumed to be always at offset 0 and 19032# verified by `fig2mpdf -v bootloader.fig && file bootloader.pdf` 19033#0 search/1/tb #FIG FIG image text 19034# GRR: with --keep-going option the line above gives duplicate messages 190350 search/1/ts #FIG 19036>&0 use image-xfig 19037# binary data variant with non ASCII text characters like Control-A or �C in thermostat.fig 190380 search/1/bs #FIG 19039>&0 use image-xfig 19040# display XFIG image describing text, mime type, file name extension and version 190410 name image-xfig 19042>8 ubyte x FIG image text 19043#!:mime text/plain 19044# https://reposcope.com/mimetype/image/x-xfig 19045!:mime image/x-xfig 19046!:ext fig 19047# version string like: 1.4 2.1 3.1 3.2 19048>5 string x \b, version %.3s 19049# some times after version text like: "Produced by xfig version 3.2.5-alpha5" 19050>8 ubyte >0x0D 19051>>8 string x "%s" 19052# should be point character (2Eh) of version string according to TrID 19053#>6 ubyte !0x2E \b, at 6 %#x 19054# caret character (23h) at the beginning in most or probaly all exanples 19055#>0 ubyte !0x23 \b, starting with character %#x 19056# URL: http://fileformats.archiveteam.org/wiki/DeskMate_Draw 19057# http://en.wikipedia.org/wiki/Deskmate 19058# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dm-fig.trid.xml 19059# From: Joerg Jenderek 19060# Note: called "DeskMate Draw drawing" by TrID 190610 string \x14FIG DeskMate Drawing 19062#!:mime application/octet-stream 19063!:mime image/x-deskmate-fig 19064!:ext fig 19065# TODO: 19066# "Cabri 3D Figure" by TrID fig-cabri.trid.xml 19067# "Playmation Figure" by TrID fig-playmation.trid.xml 19068 19069# PHIGS 190700 string ARF_BEGARF PHIGS clear text archive 190710 string @(#)SunPHIGS SunPHIGS 19072# version number follows, in the form m.n 19073>40 string SunBin binary 19074>32 string archive archive 19075 19076# GKS (Graphics Kernel System) 190770 string GKSM GKS Metafile 19078>24 string SunGKS \b, SunGKS 19079 19080# CGM image files 190810 string BEGMF clear text Computer Graphics Metafile 19082 19083# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 190840 string yz MGR bitmap, modern format, 8-bit aligned 190850 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 190860 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 190870 string yx MGR bitmap, modern format, squeezed 19088 19089# Fuzzy Bitmap (FBM) images 190900 string %bitmap\0 FBM image data 19091>30 long 0x31 \b, mono 19092>30 long 0x33 \b, color 19093 19094# facsimile data 190951 string PC\ Research,\ Inc group 3 fax data 19096>29 ubyte 0 \b, normal resolution (204x98 DPI) 19097>29 ubyte 1 \b, fine resolution (204x196 DPI) 19098# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 190990 string Sfff structured fax file 19100 19101# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 19102# URL: http://fileformats.archiveteam.org/wiki/Award_BIOS_logo 19103# Note: verified by XnView command `nconvert -fullinfo *.EPA` 191040 string \x11\x06 Award BIOS Logo, 136 x 84 19105!:mime image/x-award-bioslogo 19106!:ext epa 191070 string \x11\x09 Award BIOS Logo, 136 x 126 19108!:mime image/x-award-bioslogo 19109!:ext epa 19110# https://telparia.com/fileFormatSamples/image/epa/IO.EPA 19111# Note: by bitmap-awbm-v1x1009.trid.xml called "Award BIOS logo bitmap (128x126) (v1)" 19112# verified by RECOIL `recoil2png -o tmp.png IO.EPA; file tmp.png` 191130 string \x10\x09 Award BIOS Logo, 128 x 126 19114!:mime image/x-award-bioslogo 19115!:ext epa 19116#0 string \x07\x1f BIOS Logo corrupted? 19117# http://www.blackfiveservices.co.uk/awbmtools.shtml 19118# http://biosgfx.narod.ru/v3/ 19119# http://biosgfx.narod.ru/abr-2/ 191200 string AWBM 19121# Note: by bitmap-awbm.trid.xml called "Award BIOS logo bitmap (v2)" 19122>4 uleshort <1981 Award BIOS Logo, version 2 19123#>4 uleshort <1981 Award BIOS bitmap 19124!:mime image/x-award-bioslogo2 19125#!:mime image/x-award-bmp 19126!:ext epa/bmp 19127# image width is a multiple of 4 19128>>4 uleshort&0x0003 0 19129>>>4 uleshort x \b, %d 19130>>>6 uleshort x x %d 19131>>4 uleshort&0x0003 >0 \b, 19132>>>4 uleshort&0x0003 =1 19133>>>>4 uleshort x %d+3 19134>>>4 uleshort&0x0003 =2 19135>>>>4 uleshort x %d+2 19136>>>4 uleshort&0x0003 =3 19137>>>>4 uleshort x %d+1 19138>>>6 uleshort x x %d 19139# at offset 8 starts imagedata followed by "RGB " marker 19140 19141# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 19142# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 19143# 28bitmap_information_header.29 19144# Note: variant starting direct with DIB header see 19145# http://fileformats.archiveteam.org/wiki/BMP 19146# verified by ImageMagick version 6.8.9-8 command `identify *.dib` 191470 uleshort 40 19148# skip bad samples like GAME by looking for valid number of color planes 19149>12 uleshort 1 Device independent bitmap graphic 19150!:mime image/x-ms-bmp 19151!:apple ????BMPp 19152!:ext dib 19153>>4 ulelong x \b, %d x 19154>>8 ulelong x %d x 19155>>14 uleshort x %d 19156# number of color planes (must be 1) 19157#>>12 uleshort >1 \b, %u color planes 19158# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D 19159#>>16 ulelong 3 \b, Huffman 1D compression 19160>>16 ulelong >0 \b, %u compression 19161# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 19162>>20 ulelong x \b, image size %u 19163# horizontal and vertical resolution of the image (pixel per metre, signed integer) 19164>>24 ulelong >0 \b, resolution %d x 19165>>>28 ulelong x %d px/m 19166# number of colors in palette, or 0 to default to 2**n 19167#>>32 ulelong >0 \b, %u colors 19168# number of important colors used, or 0 when every color is important 19169>>36 ulelong >0 \b, %u important colors 19170# From: Joerg Jenderek 19171# URL: http://fileformats.archiveteam.org/wiki/VBM_(VDC_BitMap) 19172# Reference: http://csbruce.com/cbm/postings/csc19950906-1.txt 19173# http://mark0.net/download/triddefs_xml.7z 19174# defs/b/bitmap-vbm.trid.xml 19175# defs/b/bitmap-vbm-v3.trid.xml 19176# Note: called "VDC BitMap" by TrID 19177# verified by RECOIL `recoil2png -o tmp.png coke_can.vbm; file tmp.png` 19178# begin with a signature of 'B' 'M' 0xCB, followed by a version byte 2 or 3 19179# Similar to the unrelated Windows BMP format 19180# check for VDC bitmap and then display image dimension and version 191810 name bitmap-vbm 19182>2 ubyte 0xCB VDC bitmap 19183!:mime image/x-commodore-vbm 19184# http://recoil.sourceforge.net/formats.html 19185!:ext bm/vbm 19186# the VBM format version number: 2 or 3 19187>>3 ubyte x \b, version %u 19188# width of the image in Hi/Lo format 19189>>4 ubeshort x \b, %u 19190# height of the image 19191>>6 ubeshort x x %u 19192# version 3 images have the following additional header information 19193>>3 ubyte =3 19194# data-encoding type: 0~uncompressed 1~RLE-compressed 19195>>>8 ubyte 0 \b, uncompressed 19196>>>8 ubyte 1 \b, RLE-compressed 19197# byte code for general RLE repetitions 19198#>>>9 ubyte x \b, RLE repetition code 0x%x 19199# reserved := 0 19200#>>>14 short >0 \b, reserved 0x%x 19201# length of comment text; 0~no comment text 19202#>>>16 ubeshort >0 \b, comment length %u 19203>>>16 pstring/H >0 \b, comment "%s" 19204# 192050 string BM 19206# check for magic and version 2 of VDC bitmap or BMP with cbSize=715=CB02 19207>2 ubeshort 0xCB02 19208>>6 short =0 19209>>>0 use bitmap-bmp 19210# VDC bitmap height or maybe a few OS/2 BMP with nonzero "hotspot coordinates" 19211>>6 short !0 19212>>>0 use bitmap-vbm 19213# check for magic and version 3 of VDC bitmap or BMP with cbSize=971=CB03 19214>2 ubeshort 0xCB03 19215# check for reserved value (=0) of VDC bitmap 19216>>14 short =0 19217>>>0 use bitmap-vbm 19218# BMP with cbSize=????03CBh and dib header size != 0 19219>>14 short !0 19220>>>0 use bitmap-bmp 19221# cbSize is size of header or file size of Windows BMP bitmap 19222>2 default x 19223>>0 use bitmap-bmp 192240 name bitmap-bmp 19225>14 ulelong 12 PC bitmap, OS/2 1.x format 19226!:mime image/bmp 19227!:ext bmp 19228>>18 uleshort x \b, %d x 19229>>20 uleshort x %d 19230# number of color planes (must be 1) 19231#>>22 uleshort !1 \b, %u color planes 19232# number of bits per pixel (color depth); found 4 8 19233>>24 uleshort x x %d 19234# x, y coordinates of the hotspot 19235>>6 uleshort >0 \b, hotspot %ux 19236>>>8 uleshort x \b%u 19237# cbSize; size of file or header like 1Ah 228C8h 19238>>2 ulelong x \b, cbSize %u 19239#>>2 ulelong x \b, cbSize 0x%8.8x 19240# offBits; offset to bitmap data like: 19241>>10 ulelong x \b, bits offset %u 19242# http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_BMP_2.0 no examples found 19243>14 ulelong 48 PC bitmap, OS/2 2.x format (DIB header size=48) 19244>14 ulelong 24 PC bitmap, OS/2 2.x format (DIB header size=24) 19245# http://entropymine.com/jason/bmpsuite/bmpsuite/q/pal8os2v2-16.bmp 19246# Note: by bitmap-bmp-v2o.trid.xml called "Windows Bitmap (v2o)" 19247>14 ulelong 16 PC bitmap, OS/2 2.x format (DIB header size=16) 19248!:mime image/bmp 19249!:apple ????BMPp 19250!:ext bmp 19251# image width and height fields are unsigned integers for OS/2 19252>>18 ulelong x \b, %u x 19253>>22 ulelong x %u 19254# number of bits per pixel (color depth); found 8 19255>>28 uleshort >1 x %u 19256# x, y coordinates of the hotspot 19257>>6 uleshort >0 \b, hotspot %ux 19258>>>8 uleshort x \b%u 19259# number of color planes (must be 1) 19260#>>26 uleshort >1 \b, %u color planes 19261# cbSize; size of file like: 241E 19262>>2 ulelong x \b, cbSize %u 19263#>>2 ulelong x \b, cbSize 0x%x 19264# offBits; offset to bitmap data like: 41E 19265>>10 ulelong x \b, bits offset %u 19266#>>10 ulelong x \b, bits offset 0x%x 19267>14 ulelong 64 PC bitmap, OS/2 2.x format 19268!:mime image/bmp 19269!:apple ????BMPp 19270!:ext bmp 19271# image width and height fields are unsigned integers for OS/2 19272>>18 ulelong x \b, %u x 19273>>22 ulelong x %u 19274# number of bits per pixel (color depth); found 1 4 8 19275>>28 uleshort >1 x %u 19276# x, y coordinates of the hotspot 19277>>6 uleshort >0 \b, hotspot %ux 19278>>>8 uleshort x \b%u 19279>>26 uleshort >1 \b, %u color planes 19280# cbSize; size of file or headers 19281>>2 ulelong x \b, cbSize %u 19282# BMP with cbSize 000002CBh=715 or 000003CBh=971 maybe misinterpreted as VDC bitmap 19283#>>2 ulelong x \b, cbSize %#x 19284# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh 19285>>10 ulelong x \b, bits offset %u 19286#>>10 ulelong x \b, bits offset %#x 19287#>>(10.l) ubequad !0 \b, bits %#16.16llx 19288# BITMAPV2INFOHEADER adds RGB bit masks 19289>14 ulelong 52 PC bitmap, Adobe Photoshop 19290!:mime image/bmp 19291!:apple ????BMPp 19292!:ext bmp 19293>>18 ulelong x \b, %d x 19294>>22 ulelong x %d x 19295# number of bits per pixel (color depth); found 16 32 19296>>28 uleshort x %d 19297# x, y coordinates of the hotspot; should be zero for Windows variant 19298>>6 uleshort >0 \b, hotspot %ux 19299>>>8 uleshort x \b%u 19300# cbSize; size of file like: 14A 7F42 19301>>2 ulelong x \b, cbSize %u 19302#>>2 ulelong x \b, cbSize 0x%x 19303# offBits; offset to bitmap data like: 42h 19304>>10 ulelong x \b, bits offset %u 19305#>>10 ulelong x \b, bits offset 0x%x 19306# BITMAPV3INFOHEADER adds alpha channel bit mask 19307>14 ulelong 56 PC bitmap, Adobe Photoshop with alpha channel mask 19308!:mime image/bmp 19309!:apple ????BMPp 19310!:ext bmp 19311>>18 ulelong x \b, %d x 19312>>22 ulelong x %d x 19313# number of bits per pixel (color depth); found 16 32 19314>>28 uleshort x %d 19315# x, y coordinates of the hotspot; should be zero for Windows variant 19316>>6 uleshort >0 \b, hotspot %ux 19317>>>8 uleshort x \b%u 19318# cbSize; size of file like: 4E 7F46 131DE 14046h 19319>>2 ulelong x \b, cbSize %u 19320#>>2 ulelong x \b, cbSize 0x%x 19321# offBits; offset to bitmap data like: 46h 19322>>10 ulelong x \b, bits offset %u 19323#>>10 ulelong x \b, bits offset 0x%x 19324>14 ulelong 40 19325# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib 19326# broken for large bitmaps 19327#>>(2.l-4) ulong x PC bitmap, Windows 3.x format 19328>>14 ulelong 40 PC bitmap, Windows 3.x format 19329!:mime image/bmp 19330!:apple ????BMPp 19331>>>18 ulelong x \b, %d x 19332>>>22 ulelong x %d 19333# 320 x 400 https://en.wikipedia.org/wiki/LOGO.SYS 19334>>>18 ulequad =0x0000019000000140 x 19335!:ext bmp/sys 19336>>>18 ulequad !0x0000019000000140 19337# compression method 2~RLE 4-bit/pixel implies also extension rle 19338>>>>30 ulelong 2 x 19339!:ext bmp/rle 19340# not RLE compressed and not 320x400 dimension 19341>>>>30 default x 19342# "small" dimensions like: 14x15 15x16 16x14 16x16 32x32 19343# https://en.wikipedia.org/wiki/Favicon 19344>>>>>18 ulequad&0xffFFffC0ffFFffC0 =0 x 19345# https://www.politi-kdigital.de/favicon.ico 19346# http://forum.rpc1.org/favicon.ico 19347!:ext bmp/ico 19348# "big" dimensions > 63 19349>>>>>18 default x x 19350!:ext bmp 19351# number of bits per pixel (color depth); found 1 2 4 8 16 24 32 19352>>>28 uleshort x %d 19353# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0 19354#>>>6 uleshort >0 \b, hotspot %ux 19355#>>>>8 uleshort x \b%u 19356# number of color planes (must be 1), except badplanes.bmp for testing 19357#>>>26 uleshort >1 \b, %u color planes 19358# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks 19359#>>>30 ulelong 3 \b, Huffman 1D compression 19360>>>30 ulelong >0 \b, %u compression 19361# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps 19362>>>34 ulelong >0 \b, image size %u 19363# horizontal and vertical resolution of the image (pixel per metre, signed integer) 19364>>>38 ulelong >0 \b, resolution %d x 19365>>>>42 ulelong x %d px/m 19366# number of colors in palette 16 256, or 0 to default to 2**n 19367#>>>46 ulelong >0 \b, %u colors 19368# number of important colors used, or 0 when every color is important 19369>>>50 ulelong >0 \b, %u important colors 19370# cbSize; often size of file 19371>>>2 ulelong x \b, cbSize %u 19372#>>>2 ulelong x \b, cbSize %#x 19373# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h 19374>>>10 ulelong x \b, bits offset %u 19375#>>>10 ulelong x \b, bits offset %#x 19376#>>>(10.l) ubequad !0 \b, bits %#16.16llxd 19377>14 ulelong 124 PC bitmap, Windows 98/2000 and newer format 19378!:mime image/bmp 19379!:ext bmp 19380>>18 ulelong x \b, %d x 19381>>22 ulelong x %d x 19382# color planes; must be 1 19383#>>>26 uleshort >1 \b, %u color planes 19384# number of bits per pixel (color depth); found 4 8 16 24 32 1 (fmt-119-signature-id-121.bmp) 0 (rgb24jpeg.bmp rgb24png.bmp) 19385>>28 uleshort x %d 19386# x, y coordinates of the hotspot; should be zero for Windows variant 19387>>6 uleshort >0 \b, hotspot %ux 19388>>>8 uleshort x \b%u 19389# cbSize; size of file like: 8E AA 48A 999 247A 4F02 7F8A 3F88E B216E 1D4C8A 100008A 19390>>2 ulelong x \b, cbSize %u 19391#>>2 ulelong x \b, cbSize 0x%x 19392# offBits; offset to bitmap data like: 8A 47A ABABABAB (fmt-119-signature-id-121.bmp) 19393>>10 ulelong x \b, bits offset %u 19394#>>10 ulelong x \b, bits offset 0x%x 19395>14 ulelong 108 PC bitmap, Windows 95/NT4 and newer format 19396!:mime image/bmp 19397!:ext bmp 19398>>18 ulelong x \b, %d x 19399>>22 ulelong x %d x 19400# number of bits per pixel (color depth); found 8 24 32 19401>>28 uleshort x %d 19402# x, y coordinates of the hotspot; should be zero for Windows variant 19403>>6 uleshort >0 \b, hotspot %ux 19404>>>8 uleshort x \b%u 19405# cbSize; size of file like: 82 8A 9A 9F86 1E07A 3007A 88B7A C007A 19406>>2 ulelong x \b, cbSize %u 19407#>>2 ulelong x \b, cbSize 0x%x 19408# offBits; offset to bitmap data like: 7A 7E 46A 19409>>10 ulelong x \b, bits offset %u 19410#>>10 ulelong x \b, bits offset 0x%x 19411# Update: Joerg Jenderek 19412# URL: http://fileformats.archiveteam.org/wiki/OS/2_Icon 19413# Reference: http://www.fileformat.info 19414# /format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm 19415# Note: verified by command like `deark -l -d3 OS2MEMU.ICO` 194160 string IC 19417# skip Lotus smart icon *.smi by looking for valid hotspot coordinates 19418>6 ulelong&0xFF00FF00 =0 OS/2 icon 19419# jump 4 bytes before end of header/file and test for accessibility 19420#>>(2.l-4) ubelong x End of header is OK! 19421!:mime image/x-os2-ico 19422!:ext ico 19423# cbSize; size of header or file in bytes like 1ah 120h 420h 19424>>2 ulelong x \b, cbSize %u 19425# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32 19426>>6 uleshort x \b, hotspot %ux 19427>>8 uleshort x \b%u 19428# offBits; offset in bytes to the beginning of the bit-map pel data like 20h 19429>>10 ulelong x \b, bits offset %u 19430#>>(10.l) ubequad x \b, bits %#16.16llx 19431#0 string PI PC pointer image data 19432#0 string CI PC color icon data 194330 string CI 19434# test also for valid dib header sizes 12 or 64 19435>14 ulelong <65 OS/2 19436# test also for valid hotspot coordinates 19437#>>6 ulelong&0xFE00FE00 =0 OS/2 19438!:mime image/x-os2-ico 19439!:ext ico 19440>>14 ulelong 12 1.x color icon 19441# image width and height fields are unsigned integers for OS/2 19442>>>18 uleshort x %u x 19443# stored height = 2 * real height 19444>>>20 uleshort/2 x %u 19445# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 19446>>>24 uleshort >1 x %u 19447# color planes; must be 1 19448#>>>22 uleshort >1 \b, %u color planes 19449>>14 ulelong 64 2.x color icon 19450# image width and height 19451>>>18 ulelong x %u x 19452# stored height = 2 * real height 19453>>>22 ulelong/2 x %u 19454# number of bits per pixel (color depth). only 1 found 19455>>>28 uleshort >1 x %u 19456#>>>26 uleshort >1 \b, %u color planes 19457# compression method: 0~no 3~Huffman 1D 19458>>>30 ulelong 3 \b, Huffman 1D compression 19459#>>>30 ulelong >0 \b, %u compression 19460# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64 19461>>6 uleshort x \b, hotspot %ux 19462>>8 uleshort x \b%u 19463# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh 19464>>2 ulelong x \b, cbSize %u 19465#>>2 ulelong x \b, cbSize %x 19466# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h 19467>>10 ulelong x \b, bits offset %u 19468#>>10 ulelong x \b, bits offset %#x 19469#>>(10.l) ubequad !0 \b, bits %#16.16llx 19470# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 19471#>>14 ulelong x \b, dib header size %u 19472#0 string CP PC color pointer image data 19473# URL: http://fileformats.archiveteam.org/wiki/OS/2_Pointer 19474# Reference: http://www.fileformat.info/format/os2bmp/egff.htm 194750 string CP 19476# skip many Corel Photo-Paint image "CPT9FILE" by checking for positive bits offset 19477>10 ulelong >0 19478# skip CPU-Z Report by checking for valid dib header sizes 12 or 64 19479>>14 ulelong =12 19480>>>0 use os2-ptr 19481>>14 ulelong =64 19482>>>0 use os2-ptr 19483# display information of OS/2 pointer bitmaps 194840 name os2-ptr 19485>14 ulelong x OS/2 19486# http://extension.nirsoft.net/PTR 19487!:mime image/x-ibm-pointer 19488!:ext ptr 19489>>14 ulelong 12 1.x color pointer 19490# image width and height fields are unsigned integers for OS/2 19491>>>18 uleshort x %u x 19492# stored height = 2 * real height 19493>>>20 uleshort/2 x %u 19494# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found 19495>>>24 uleshort >1 x %u 19496# color planes; must be 1 19497#>>>22 uleshort >1 \b, %u color planes 19498>>14 ulelong 64 2.x color pointer 19499# image width and height 19500>>>18 ulelong x %u x 19501# stored height = 2 * real height 19502>>>22 ulelong/2 x %u 19503# number of bits per pixel (color depth). only 1 found 19504>>>28 uleshort >1 x %u 19505#>>>26 uleshort >1 \b, %u color planes 19506# compression method: 0~no 3~Huffman 1D 19507>>>30 ulelong 3 \b, Huffman 1D compression 19508#>>>30 ulelong >0 \b, %u compression 19509# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31 19510>>6 uleshort x \b, hotspot %ux 19511>>8 uleshort x \b%u 19512# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 19513>>2 ulelong x \b, cbSize %u 19514#>>2 ulelong x \b, cbSize %x 19515# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h 19516>>10 ulelong x \b, bits offset %u 19517#>>10 ulelong x \b, bits offset %#x 19518#>>(10.l) ubequad !0 \b, bits %#16.16llx 19519# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x 19520#>>14 ulelong x \b, dib header size %u 19521# Conflicts with other entries [BABYL] 19522# URL: http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array 19523# Note: container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM" 19524#0 string BA PC bitmap array data 195250 string BA 19526# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size 19527>2 ulelong <0x004c5942 OS/2 graphic array 19528!:mime image/x-os2-graphics 19529#!:apple ????BMPf 19530# cbSize; size of header like 28h 5Ch 19531>>2 ulelong x \b, cbSize %u 19532#>>2 ulelong x \b, cbSize %#x 19533# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h 19534>>6 ulelong >0 \b, data offset %u 19535#>>6 ulelong >0 \b, data offset %#x 19536#>>(6.l) ubequad !0 \b, data %#16.16llx 19537# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768 19538>>10 uleshort >0 \b, display %u 19539>>>12 uleshort >0 x %u 19540# usType of first array element 19541#>>14 string x \b, usType %2.2s 19542# 1 space char after "1st" 19543# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342 19544>>14 string BM \b; 1st 19545!:ext bmp/bga 19546>>14 string CI \b; 1st 19547!:ext ico 19548>>14 string CP \b; 1st 19549!:ext ico 19550>>14 string IC \b; 1st 19551!:ext ico 19552# no white-black pointer found 19553#>>14 string PT \b; 1st 19554#!:ext 19555>>14 indirect x 19556 19557# XPM icons (Greg Roelofs, newt@uchicago.edu) 19558# Update: Joerg Jenderek 19559# URL: http://fileformats.archiveteam.org/wiki/XPM 19560# Reference: http://www.x.org/docs/XPM/xpm.pdf 19561# http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-xpm.trid.xml 19562# Note: called "X PixMap bitmap" by TrID and "X-Windows Pixmap Image" by DROID via PUID x-fmt/208 19563# starting with c comment like: logo.xpm 195640 string /*\040 19565# 9 byte c-comment "/* XPM */" not at the beginning like: mozicon16.xpm mozicon50.xpm (thunderbird) 19566>0 search/0xCE /*\ XPM\ */ 19567# skip DROID x-fmt-208-signature-id-620.xpm by looking for char aray without explict length 19568# and match mh-logo.xpm (emacs) 19569>>&0 search/1249 [] 19570>>>0 use xpm-image 19571# non standard because no 9 byte c-comment "/* XPM */" like: logo.xpm in qemu package 19572>0 default x 19573# words are separated by a white space which can be composed of space and tabulation characters 19574>>0 search/0x52 static\040char\040 19575# skip debug.c testmlc.c by looking for char aray without explict length 19576# https://www.clamav.net/downloads/production/clamav-0.104.2.tar.gz 19577# clamav-0.104.2\libclammspack\mspack\debug.c 19578>>>&0 search/64 [] 19579>>>>0 use xpm-image 19580# display X pixmap image information 195810 name xpm-image 19582>0 string x X pixmap image text 19583#!:mime text/plain 19584# https://reposcope.com/mimetype/image/x-xpixmap 19585# alias 19586#!:mime image/x-xpm 19587!:mime image/x-xpixmap 19588!:ext xpm 19589# NO pm example found! 19590#!:ext xpm/pm 19591# look for start of character array at beginning of a line like: psetupl.xpm (OpenOffice 4.1.7) 19592>0 search/0x406 \n" 19593# DEBUG VALUES string 19594#>>&0 string x '%s' 19595# width with optional white space before like: 16 24 32 48 1280 19596>>&0 regex/8 [0-9]{1,5} \b, %s 19597# height with white space like: 15 16 17 24 32 48 1024 19598>>>&0 regex/8 [0-9]{1,5} x %s 19599# number of colors with white space like: 1 2 3 4 5 8 11 14 162 255 but unrelistic 4294967295 by hardcopy tool 19600>>>>&0 regex/12 [0-9]{1,9} x %s 19601# chars_per_pixel with white space like: 1 2 19602>>>>>&0 regex/14 [0-9]{1,2} \b, %s chars/pixel 19603# non standard because not starting with 9 byte c-comment "/* XPM */" 19604>0 string !/*\ XPM\ */ 19605>>0 string x \b, 1st line "%s" 19606 19607# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 196080 uleshort 0xcc52 RLE image data, 19609>6 uleshort x %d x 19610>8 uleshort x %d 19611>2 uleshort >0 \b, lower left corner: %d 19612>4 uleshort >0 \b, lower right corner: %d 19613>10 ubyte&0x1 =0x1 \b, clear first 19614>10 ubyte&0x2 =0x2 \b, no background 19615>10 ubyte&0x4 =0x4 \b, alpha channel 19616>10 ubyte&0x8 =0x8 \b, comment 19617>11 ubyte >0 \b, %d color channels 19618>12 ubyte >0 \b, %d bits per pixel 19619>13 ubyte >0 \b, %d color map channels 19620 19621# image file format (Robert Potter, potter@cs.rochester.edu) 196220 string Imagefile\ version- iff image data 19623# this adds the whole header (inc. version number), informative but longish 19624>10 string >\0 %s 19625 19626# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 196270 ubelong 0x59a66a95 Sun raster image data 19628>4 ubelong >0 \b, %d x 19629>8 ubelong >0 %d, 19630>12 ubelong >0 %d-bit, 19631#>16 ubelong >0 %d bytes long, 19632>20 ubelong 0 old format, 19633#>20 ubelong 1 standard, 19634>20 ubelong 2 compressed, 19635>20 ubelong 3 RGB, 19636>20 ubelong 4 TIFF, 19637>20 ubelong 5 IFF, 19638>20 ubelong 0xffff reserved for testing, 19639>24 ubelong 0 no colormap 19640>24 ubelong 1 RGB colormap 19641>24 ubelong 2 raw colormap 19642#>28 ubelong >0 colormap is %d bytes long 19643 19644# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 19645# 19646# See 19647# http://reality.sgi.com/grafica/sgiimage.html 19648# 196490 ubeshort 474 SGI image data 19650#>2 ubyte 0 \b, verbatim 19651>2 ubyte 1 \b, RLE 19652#>3 ubyte 1 \b, normal precision 19653>3 ubyte 2 \b, high precision 19654>4 ubeshort x \b, %d-D 19655>6 ubeshort x \b, %d x 19656>8 ubeshort x %d 19657>10 ubeshort x \b, %d channel 19658>10 ubeshort !1 \bs 19659>80 string >0 \b, "%s" 19660 196610 string IT01 FIT image data 19662>4 ubelong x \b, %d x 19663>8 ubelong x %d x 19664>12 ubelong x %d 19665# 196660 string IT02 FIT image data 19667>4 ubelong x \b, %d x 19668>8 ubelong x %d x 19669>12 ubelong x %d 19670# 196712048 string PCD_IPI Kodak Photo CD image pack file 19672>0xe02 ubyte&0x03 0x00 , landscape mode 19673>0xe02 ubyte&0x03 0x01 , portrait mode 19674>0xe02 ubyte&0x03 0x02 , landscape mode 19675>0xe02 ubyte&0x03 0x03 , portrait mode 196760 string PCD_OPA Kodak Photo CD overview pack file 19677 19678# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 19679# FITS is the Flexible Image Transport System, the de facto standard for 19680# data and image transfer, storage, etc., for the astronomical community. 19681# (FITS floating point formats are big-endian.) 196820 string SIMPLE\ \ = FITS image data 19683!:mime image/fits 19684!:ext fits/fts 19685>109 string 8 \b, 8-bit, character or unsigned binary integer 19686>108 string 16 \b, 16-bit, two's complement binary integer 19687>107 string \ 32 \b, 32-bit, two's complement binary integer 19688>107 string -32 \b, 32-bit, floating point, single precision 19689>107 string -64 \b, 64-bit, floating point, double precision 19690 19691# other images 196920 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 19693 19694# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 19695# stuff. 19696# 196970 ubeshort 0x1010 PEX Binary Archive 19698 19699# DICOM medical imaging data 19700# URL: https://en.wikipedia.org/wiki/DICOM#Data_format 19701# Note: "dcm" is the official file name extension 19702# XnView mention also "dc3" and "acr" as file name extension 19703128 string DICM DICOM medical imaging data 19704!:mime application/dicom 19705!:ext dcm/dicom/dic 19706 19707# XWD - X Window Dump file. 19708# URL: http://fileformats.archiveteam.org/wiki/XWD 19709# Reference: https://wiki.multimedia.cx/index.php?title=XWD 19710# http://mark0.net/download/triddefs_xml.7z/defs/x/xdm-x11.trid.xml 19711# Note: called "X-Windows Screen Dump (X11)" by TrID and 19712# "X-Windows Screen Dump" version X11 by DROID via PUID fmt/483 19713# verfied by XnView `nconvert -in xwd -info *` 19714# and ImageMagick 6.9.11 `identify -verbose *` as XWD X Windows system window dump 19715# and `xwud -in fig41.wxd -dumpheader` 19716# As described in /usr/X11R6/include/X11/XWDFile.h 19717# used by the xwd program. 19718# Bradford Castalia, idaeim, 1/01 19719# updated by Adam Buchbinder, 2/09 and Joerg Jenderek, May 2022 19720# The following assumes version 7 of the format; the first long is the length 19721# of the header, which is at least 25 4-byte longs, and the one at offset 8 19722# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 19723# which is a maximum of 32. 19724# Size of the entire file header (bytes) like: 100 104 105 106 107 109 110 113 114 115 118 172 197250 ubelong >99 19726# pixmap_format; Pixmap format; 0~1-bit (XYBitmap) format 1~single-plane (XYPixmap) 2~bitmap with two or more planes (ZPixmap) 19727>8 ubelong <3 19728# pixmap_depth; Pixmap depth; value 1 - 32 19729>>12 ubelong <33 19730# file_version; XWD_FILE_VERSION=7 19731>>>4 ubelong 7 19732# skip DROID fmt-401-signature-id-618.xwd by test for existing border field 19733>>>>96 ubelong x X-Window screen dump image data, version X11 19734# ./images (version 1.205) labeled the above entry as "XWD X Window Dump image data" 19735# https://reposcope.com/mimetype/image/x-xwindowdump 19736!:mime image/x-xwindowdump 19737#!:ext xwd 19738!:ext xwd/dmp 19739# https://www.xnview.com/en/image_formats/ NO example with x11 suffix FOUND! 19740#!:ext xwd/dmp/x11 19741# https://www.nationalarchives.gov.uk/PRONOM/fmt/401 NO example with xdm suffix FOUND! 19742#!:ext xwd/dmp/x11/xmd 19743# file comment if header > 100; so not in MARBLES.XWD and hardcopy-x-window-v11.xwd 19744>>>>>0 ubelong >100 19745# comment or windows name 19746>>>>>>100 string >\0 \b, "%s" 19747# pixmap_width; pixmap width like: 576 800 1014 1280 1419 NOT -1414812757=abABabABh 19748>>>>>16 ubelong x \b, %dx 19749# pixmap_height; pixmap height like: 449 454 600 704 720 1001 1024 NOT -1414812757=abABabABh 19750>>>>>20 ubelong x \b%dx 19751# pixmap_depth; pixmap depth 19752>>>>>12 ubelong x \b%d 19753# XOffset; Bitmap X offset; pixel numbers to ignore at the beginning of each scan-line 19754#>>>>>24 ubelong x \b, %u ignore 19755# ByteOrder; byte order of image data: 0~least significant byte first 1~most significant byte first 19756>>>>>28 ubelong >0 \b, order %u 19757# BitmapUnit; bitmap base data size unit in each scan line like: 8 16 32 19758#>>>>>32 ubelong x \b, unit %u 19759# BitmapBitOrder; bit-order of image data; apparently same as ByteOrder 19760#>>>>>36 ubelong x \b, bit order %u 19761# BitmapPad; number of padding bits added to each scan line like: 8 16 32 19762#>>>>>40 ubelong x \b, pad %u 19763# BitsPerPixel; Bits per pixel: 1~StaticGray and GrayScale 2-15~StaticColor and PseudoColor 16,24,32~TrueColor and DirectColor 19764#>>>>>44 ubelong x \b, %u bits/pixel 19765# BytesPerLine; size of each scan line in bytes 19766#>>>>>48 ubelong x \b, %u bytes/line 19767# VisualClass; class of the image: 0~StaticGray 1~GrayScale 2~StaticColor 3~PseudoColor 4~TrueColor 5~DirectColor 19768#>>>>>52 ubelong x \b, %u Class 19769# RedMask; red RGB mask values used by ZPixmaps like: 0 0xff0000 19770#>>>>>56 ubelong !0 \b, %#x red 19771# GreenMask; green mask like: 0 19772#>>>>>60 ubelong !0 \b, %#x green 19773# BlueMask; blue mask like: 0 0xff 19774#>>>>>64 ubelong !0 \b, %#x blue 19775# BitsPerRgb; Size of each color mask in bits like: 0 1 8 24 19776#>>>>>68 ubelong x \b, %u bits/RGB 19777# NumberOfColors; number of colors in image like: 256 4 2 0 (WHAT DOES THIS MEAN?) 19778>>>>>72 ubelong x \b, %u colors 19779# ColorMapEntries; number of entries in color map like: 256 16 2 0~no color map 19780>>>>>76 ubelong x %u entries 19781# WindowWidth; window width 19782#>>>>>80 ubelong x \b, %u width 19783# WindowHeight; window height 19784#>>>>>84 ubelong x \b, %u height 19785# WindowX; Window upper left X coordinate like: 0 24 32 80 237 290 422 466 568 (lenna.dmp) 19786>>>>>88 ubelong !0 \b, x=%d 19787# WindowY; Window upper left Y coordinate like: 0 8 18 26 60 73 107 (fig41.xwd) 128 19788>>>>>92 ubelong !0 \b, y=%d 19789# WindowBorderWidth; Window border width; apparently pixmap_width=WindowWidth+2*WindowBorderWidth 19790# like: 1 (fig41.xwd) 2 (maze.dmp) 3 (lenna.dmp mandrill.dmp) 19791>>>>>96 ubelong >0 \b, %u border 19792# From: Joerg Jenderek 19793# Reference: http://mark0.net/download/triddefs_xml.7z/defs/x/xdm-x10.trid.xml 19794# Note: called "X-Windows Screen Dump (X10)" by TrID and 19795# "X-Windows Screen Dump" version X10 by DROID via PUID x-fmt/300 19796# verfied by XnView `nconvert -in xwd -info *` 19797# HeaderSize is the size of the header in bytes; always 40 for X10 variant 197980 ubelong =0x000000028 19799# FileVersion; always 6 for X10 variant 19800>4 ubelong =6 19801# skip DROID x-fmt-300-signature-id-619.xdm by test existing border field 19802>>36 ubeshort x X-Window screen dump image data, version X10 19803!:mime image/x-xwindowdump 19804!:ext xwd 19805# http://www.nationalarchives.gov.uk/pronom/fmt/401 NO example with xdm suffix FOUND! 19806#!:ext xwd/xdm 19807# PixmapWidth; pixmap width like: 127 1280 19808>>>20 ubelong x \b, %d 19809# PixmapHeight; pixmap height like: 64 1024 19810>>>24 ubelong x \bx%d 19811# DisplayPlanes; number of display planes like: 1 4 8 19812>>>12 ubelong x \bx%u 19813# DisplayType; display type like: 1 3 19814#>>>8 ubelong x \b, type %u 19815# PixmapFormat; pixmap format like: 1~bitmap with two or more planes (ZPixmap) 0~single-plane bitmap (XYBitmap) 19816#>>>16 ubelong x \b, %u format 19817# WindowWidth; window width; probably PixmapWidth=WindowWidth+2*WindowBorderWidth 19818#>>>28 ubeshort x \b, width %u 19819# WindowHeight; window height; probably PixmapWidth=PixmapHeight+2*WindowBorderWidth 19820#>>>30 ubeshort x \b, height %u 19821# WindowX; window upper left X coordinate like: 0 19822>>>32 ubeshort !0 \b, x=%d 19823# WindowY; window upper left Y coordinate like: 0 19824>>>34 ubeshort !0 \b, y=%d 19825# WindowBorderWidth; window border width like: 0 19826>>>36 ubeshort !0 \b, %u border 19827# WindowNumColors; Number of color entries in window like: 2 16 256 19828#>>>38 ubeshort x \b, %u colors 19829# if the image is a PseudoColor image, a color map immediately follows the header. X10COLORMAP[WindowNumColors]; 19830# EntryNumber; number of the color-map entry like: 0 19831#>>>40 ubeshort x \b, colors #%u 19832# Red; red-channel value 19833#>>>42 ubeshort !0 \b, red %#x 19834# Green; green-channel value 19835#>>>44 ubeshort !0 \b, green %#x 19836# Blue; blue-channel value 19837#>>>46 ubeshort !0 \b, blue %#x 19838# 2ND Entry like: 2 19839#>>>48 ubeshort x \b, colors #%u 19840 19841# PDS - Planetary Data System 19842# These files use Parameter Value Language in the header section. 19843# Unfortunately, there is no certain magic, but the following 19844# strings have been found to be most likely. 198450 string NJPL1I00 PDS (JPL) image data 198462 string NJPL1I PDS (JPL) image data 198470 string CCSD3ZF PDS (CCSD) image data 198482 string CCSD3Z PDS (CCSD) image data 198490 string PDS_ PDS image data 198500 string LBLSIZE= PDS (VICAR) image data 19851 19852# pM8x: ATARI STAD compressed bitmap format 19853# 19854# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 19855# p M 8 5/6 xx yy zz data... 19856# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 19857# bytes either run horizontally (pM85) or vertically (pM86). yy is the 19858# most frequent byte, xx and zz are runlength escape codes, where xx is 19859# used for runs of yy. 19860# 198610 string pM85 Atari ST STAD bitmap image data (hor) 19862>5 ubyte 0x00 (white background) 19863>5 ubyte 0xFF (black background) 198640 string pM86 Atari ST STAD bitmap image data (vert) 19865>5 ubyte 0x00 (white background) 19866>5 ubyte 0xFF (black background) 19867 19868# From: Alex Myczko <alex@aiei.ch> 19869# https://www.atarimax.com/jindroush.atari.org/afmtatr.html 198700 uleshort 0x0296 Atari ATR image 19871 19872# URL: http://fileformats.archiveteam.org/wiki/DEGAS_image 19873# Reference: https://wiki.multimedia.cx/index.php?title=Degas 19874# From: Joerg Jenderek 19875# http://mark0.net/download/triddefs_xml.7z/defs/b 19876# bitmap-pi2-degas.trid.xml bitmap-pi3-degas.trid.xml 19877# bitmap-pc1-degas.trid.xml bitmap-pc2-degas.trid.xml bitmap-pc3-degas.trid.xml 19878# Note: verified by NetPBM `pi3topbm sigirl1.pi3 | file` 19879# `deark -m degas -l -d2 ataribak.pi1` 19880# XnView `nconvert -fullinfo *.p??` 19881# DEGAS low-res uncompressed bitmap *.pi1 198820 beshort 0x0000 19883# skip some ISO 9660 CD-ROM filesystems like plpbt.iso by test for 4 non black colors in palette entries 19884>2 quad !0 19885# skip g3test.g3 by test for unused bits of 2nd color entry 19886>>4 ubeshort&0xF000 0 19887#>>>0 beshort x 1ST_VALUE=%x 19888>>>-0 offset x FILE_SIZE=%lld 19889# standard DEGAS low-res uncompressed bitmap *.pi1 with file size 32034 19890>>>-0 offset =32034 VARIANT_STANDARD 19891#>>>>0 beshort x 1st_VALUE=%x 19892# like: 8ball.pi1 teddy.pi1 sonic01.pi1 19893>>>>0 use degas-bitmap 19894# about 61 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32066 19895>>>-0 offset =32066 VARIANT_ELITE 19896# like: spider.pi1 pinkgirl.pi1 frog3.pi1 19897>>>>0 use degas-bitmap 19898# about 55 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32128 19899>>>-0 offset =32128 VARIANT_3 19900# like: mountain.pi1 bigspid.pi1 alf33.pi1 19901>>>>0 use degas-bitmap 19902# 1 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 44834 19903>>>-0 offset =44834 VARIANT_4 19904# like: kenshin.pi1 19905>>>>0 use degas-bitmap 19906# DEGAS mid-res uncompressed bitmap *.pi2 (strength=50) after GEM Images like: 19907# BEETHVEN.IMG CHURCH.IMG GAMEOVR4.IMG TURKEY.IMG clinton.img 199080 beshort 0x0001 19909#!:strength +0 19910# skip many control files like gnucash-4.8.setup.exe.aria2 by test for non black in 4 palette entries 19911>2 quad !0 19912# skip control file load-v0001.aria2 by test for unused bits of 5th color palette entry 19913>>10 ubeshort&0xF000 0 19914# skip many GEM Image data like DANCER.IMG GAMEOVR4.IMG SHIP.IMG by test for unused bits of 8th color palette entry 19915>>>16 ubeshort&0xF000 0 19916# skip many GEM Image data like BEETHVEN.IMG CABINETS.IMG MEMO.IMG by test for unused bits of 14th color palette entry 19917>>>>28 ubeshort&0xF000 0 19918# skip few GEM Image data like CHURCH.IMG by test for unused bits of 15th color palette entry 19919>>>>>30 ubeshort&0xF000 0 19920# skip many GEM Image data like TIGER.IMG TURKEY.IMG XMAS.IMG by test for unused bits of 16th color palette entry 19921>>>>>>32 ubeshort&0xF000 0 19922# skip GEM Image data like clinton.img by test for existing bytes at the end 19923>>>>>>>32026 quad x 19924>>>>>>>>0 use degas-bitmap 19925# DEGAS high-res uncompressed bitmap *.pi3 199260 beshort 0x0002 19927# skip Intel ia64 COFF msvcrt.lib by test for unused bits of 1st atari color palette entry 19928>2 ubeshort&0xF000 0 19929# skip few Adobe PhotoShop Brushes like Faux-Spitzen.abr by check 19930# for invalid Adobe PhotoShop Brush UTF16-LE string length 19931>>19 ubyte =0 19932# many like: 4th_ofj2.pi3 GEMINI03.PI3 PEOPLE18.PI3 POWERFIX.PI3 abydos.pi3 highres.pi3 sigirl1.pi3 vanna5.pi3 19933>>>0 use degas-bitmap 19934# Adobe PhotoShop Brush UTF16-LE string length 15 "Gitter - klein " 8 "Kreis 1 " 19935>>19 ubyte !0 19936#>>19 ubyte !0 \b, NOTE LENGTH %u 19937#>>>21 lestring16 x \b, BRUSH NOTE "%s" 19938>>>(19.b*2) ubequad x 19939# maybe last character of Adobe PhotoShop Brush UTF16-LE string and terminating nul char like 19940# 006e0000 for n in "Faux-Spitzen.abr" 00310000 for 1 in "Verschiedene Spitzen.abr" 19941# 00000000 "LEREDACT.PI3" 03730773 "TBX_DEMO.PI3" 19942#>>>>&8 ubelong x \b, LAST CHAR+NIL %8.8x 19943>>>>&8 ubelong&0xff00ffFF !0 19944# many DEGAS bitmap like: ARABDEMO.PI3 ELMRSESN.PI3 GEMVIEW.PI3 LEREDACT.PI3 PICCOLO.PI3 REPRO_JR.PI3 ST_TOOLS.PI3 TBX_DEMO.PI3 evgem7.pi3 19945>>>>>0 use degas-bitmap 19946# test for last character of Adobe PhotoShop Brush UTF16-LE string and terminating nul char 19947>>>>&8 ubelong&0xff00ffFF =0 19948# select last DEGAS bitmaps by invalid last char of brush note like BASICNES.PI3 DB_HELP.PI3 DB_WRITR.PI3 LEREDACT.PI3 19949>>>>>&-4 ubelong&0x00FF0000 <0x00200000 19950>>>>>>0 use degas-bitmap 19951# last character of Adobe PhotoShop Brush UTF16-LE note 19952#>>>>>&-4 ubelong&0x00FF0000 >0x001F0000 \b, THAT IS ABR 19953# DEGAS low-res compressed bitmap *.pc1 like: BATTLSHP.PC1 GNUCHESS.PC1 MEDUSABL.PC1 MOONLORD.PC1 WILDROSE.PC1 199540 beshort 0x8000 19955# skip lif files handled via ./lif by test for unused bits of 1st palette entry 19956>2 ubeshort&0xF000 0 19957>>0 use degas-bitmap 19958# DEGAS mid-res compressed bitmap *.pc2 like: abydos.pc2 ARTIS3.PC2 SMTHDRAW.PC2 STAR_2K.PC2 TX2_DEMO.PC2 199590 beshort 0x8001 19960>0 use degas-bitmap 19961# DEGAS high-res compressed bitmap *.pc3 like: abydos.pc3 COYOTE.PC3 ELEPHANT.PC3 TX2_DEMO.PC3 SMTHDRAW.PC3 199620 beshort 0x8002 19963>0 use degas-bitmap 19964# display information of Atari DEGAS and DEGAS Elite bitmap images 199650 name degas-bitmap 19966>0 ubyte x Atari DEGAS 19967#!:mime application/octet-stream 19968!:mime image/x-atari-degas 19969# compressed 19970>0 ubyte =0x80 Elite compressed 19971# uncompressed 19972#>0 ubyte =0x00 uncompressed 19973#>0 ubyte =0x00 un. 19974>0 ubyte =0x00 19975# check for existence of footer for DEGAS Elite images 19976>>32042 ubequad x Elite 19977>0 beshort 0x0000 bitmap 19978!:ext pi1 19979>0 beshort 0x0001 bitmap 19980!:ext pi2 19981>0 beshort 0x0002 bitmap 19982# no example with SUH extension found 19983#!:ext pi3/suh 19984!:ext pi3 19985>0 beshort 0x8000 bitmap 19986!:ext pc1 19987>0 beshort 0x8001 bitmap 19988!:ext pc2 19989>0 beshort 0x8002 bitmap 19990!:ext pc3 19991# low resolution; 320x200, 16 colors 19992>1 ubyte =0 320 x 200 x 16 19993# medium resolution; 640x200, 4 colors 19994>1 ubyte =1 640 x 200 x 4 19995# high resolution; 640x400, 2 colors 19996>1 ubyte =2 640 x 400 x 2 19997# http://fileformats.archiveteam.org/wiki/Atari_ST_color_palette 19998# hardware_palette[16]; 9 bit ?????RRR?GGG?BBB; 12 bit ????RRRRGGGGBBBB for Atari STE 19999# for Atari DEGAS apparently no Spectrum 512 Enhanced 15 bit palette RGB?RRRRGGGGBBBB 20000# Red Green Blue unused bit ? often 0 but not bilboule.pi1; color_value (examples or numbers) 20001# 1st color palette entry like: 0777 (61) 0fff (LEREDACT.PI3) 0fcf (devgem7.pi3) 0001 (9) 20002>2 ubeshort x \b, color palette %4.4x 20003# 2nd palette entry like: 0000 (32) 0700 (38) 0f00 (LEREDACT.PI3 devgem7.pi3) 20004>4 ubeshort x %4.4x 20005# 3rd palette entry 20006>6 ubeshort x %4.4x 20007# 4th palette entry like: 0000 (72) 20008>8 ubeshort x %4.4x 20009# 5th palette entry 20010>10 ubeshort x %4.4x 20011>2 ubeshort x ... 20012# 6th palette entry 20013#>12 ubeshort x %4.4x 20014# 7th palette entry like: 0000 (16) 0001 (ELMRSESN.PI3 elmrsesn.pi3) 0070 (51) 00f0 (BASICNES.PI3 LEREDACT.PI3) 00f8 (devgem7.pi3) 20015#>14 ubeshort x %4.4x 20016# 8th palette entry 20017#>16 ubeshort x %4.4x 20018# 9 palette entry 20019#>18 ubeshort x %4.4x 20020# 10 palette entry 20021#>20 ubeshort x %4.4x 20022# 11 palette entry 20023#>22 ubeshort x %4.4x 20024# 12 palette entry 20025#>24 ubeshort x %4.4x 20026# 13 palette entry 20027#>26 ubeshort x %4.4x 20028# 14th palette entry 20029#>28 ubeshort x %4.4x 20030# 15th palette entry 20031#>30 ubeshort x %4.4x 20032# 16th palette entry 20033#>32 ubeshort x %4.4x 20034# data[16000] for uncompressed images; pixel data 20035#>34 ubequad x \b, DATA %#16.16llx... 20036# footer for Elite variant images 20037# https://www.fileformat.info/format/atari/egff.htm 20038# https://pulkomandy.tk/projects/GrafX2/wiki/Develop/FileFormats/Atari 20039# left_color_animation[4]; like: 0000000000000000 0000000100020003 fffafff000000030 (bigspid.pi1) 20040#>32034 ubequad !0 \b, color animations %16.16llx (left) 20041# right_color_animation[4]; like: 0000000000000000 0000000100020003 20042#>>32042 ubequad !0 %16.16llx (right) 20043# channel_direction[4]; 0~left 1~none 2~right like: 0001000100010001 0002000000010001 (cycle2.pi1) 20044# sometimes unexpected like: feaafc0000000000 (bigspid.pi1) 20045#>32050 ubequad !0 \b, channel directions %16.16llx 20046# channel_delay[4]; 128 - channel delay, timebase 1/60 s 20047#>32058 ubequad !0 \b, channel delays %16.16llx 20048 20049# From: Joerg Jenderek 20050# URL: http://fileformats.archiveteam.org/wiki/ImageLab/PrintTechnic 20051# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-b_w.trid.xml 20052# Note: called "ImageLab bitmap" by TrID 20053# verfied by XnView `nconvert -fullinfo "MAEDCHEN.B&W"` 200540 string B&W256 ImageLab bitmap 20055!:mime image/x-ilab 20056# https://www.xnview.com/de/image_formats/ 20057# GRR: add char & inside parse_ext in ../../src/apprentice.c to avoid in file version 5.40 error like: 20058# Magdir\images, 1090: Warning: EXTENSION type ` b_w/b&w' has bad char '&' 20059!:ext b_w/b&w 20060# Width 20061>6 ubeshort x \b, %u 20062# Height 20063>8 ubeshort x x %u 20064 20065# XXX: 20066# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 20067# magic. 20068# SGI RICE image file <mpruett@sgi.com> 20069#0 ubeshort 0x5249 RICE image 20070#>2 ubeshort x v%d 20071#>4 ubeshort x (%d x 20072#>6 ubeshort x %d) 20073#>8 ubeshort 0 8 bit 20074#>8 ubeshort 1 10 bit 20075#>8 ubeshort 2 12 bit 20076#>8 ubeshort 3 13 bit 20077#>10 ubeshort 0 4:2:2 20078#>10 ubeshort 1 4:2:2:4 20079#>10 ubeshort 2 4:4:4 20080#>10 ubeshort 3 4:4:4:4 20081#>12 ubeshort 1 RGB 20082#>12 ubeshort 2 CCIR601 20083#>12 ubeshort 3 RP175 20084#>12 ubeshort 4 YUV 20085 20086# PCX image files 20087# From: Dan Fandrich <dan@coneharvesters.com> 20088# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX 20089# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 20090# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 20091# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 200920 ubelong&0xffF8fe00 0x0a000000 20093# for PCX bit depth > 0 20094>3 ubyte >0 20095# test for valid versions 20096>>1 ubyte <6 20097>>>1 ubyte !1 PCX 20098!:mime image/x-pcx 20099#!:mime image/pcx 20100>>>>1 ubyte 0 ver. 2.5 image data 20101>>>>1 ubyte 2 ver. 2.8 image data, with palette 20102>>>>1 ubyte 3 ver. 2.8 image data, without palette 20103>>>>1 ubyte 4 for Windows image data 20104>>>>1 ubyte 5 ver. 3.0 image data 20105>>>>4 uleshort x bounding box [%d, 20106>>>>6 uleshort x %d] - 20107>>>>8 uleshort x [%d, 20108>>>>10 uleshort x %d], 20109>>>>65 ubyte >1 %d planes each of 20110>>>>3 ubyte x %d-bit 20111>>>>68 ubyte 1 colour, 20112>>>>68 ubyte 2 grayscale, 20113# this should not happen 20114>>>>68 default x image, 20115>>>>12 uleshort >0 %d x 20116>>>>>14 uleshort x %d dpi, 20117>>>>2 ubyte 0 uncompressed 20118>>>>2 ubyte 1 RLE compressed 20119 20120# Adobe Photoshop 20121# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 20122# URL: http://fileformats.archiveteam.org/wiki/PSD 20123# Reference: https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/ 20124# Note: verfied by XnView `nconvert -fullinfo *.psd *.psb *.pdd` 20125# and ImageMagick `identify -verbose *.pdd` 201260 string 8BPS 20127# skip DROID x-fmt-92-signature-id-277.psd by checking valid width 20128>18 ubelong >0 Adobe Photoshop 20129!:mime image/vnd.adobe.photoshop 20130!:apple ????8BPS 20131# version: always equal to 1, but 2 for PSB 20132>>4 beshort 1 20133# URL: http://fileformats.archiveteam.org/wiki/PhotoDeluxe 20134# EXTRAS/PHOTOS/DEMOPIX/ORIGINAL.PDD 20135>>>34 search/0xC0d7 PHUT Image (PhotoDeluxe) 20136!:ext pdd 20137>>>34 default x Image 20138!:ext psd 20139# URL: http://fileformats.archiveteam.org/wiki/PSB 20140>>4 beshort 2 Image (PSB) 20141!:ext psb 20142# width in pixels: 1-30000 1-300000 for PSB 20143>>18 belong x \b, %d x 20144>>14 belong x %d, 20145# The color mode; 0~Bitmap 1~Grayscale 2~Indexed 3~RGB 4~CMYK 7~Multichannel 9~Duotone 9~Lab 20146>>24 beshort 0 bitmap 20147>>24 beshort 1 grayscale 20148# the number of channels; range is 1 to 56 20149>>>12 beshort 2 with alpha 20150>>24 beshort 2 indexed 20151>>24 beshort 3 RGB 20152>>>12 beshort 4 \bA 20153>>24 beshort 4 CMYK 20154>>>12 beshort 5 \bA 20155>>24 beshort 7 multichannel 20156>>24 beshort 8 duotone 20157>>24 beshort 9 lab 20158>>12 beshort > 1 20159>>>12 beshort x \b, %dx 20160>>12 beshort 1 \b, 20161>>22 beshort x %d-bit channel 20162>>12 beshort > 1 \bs 20163# 6 reserved bytes; must be zero, but spaces inside ImageMagick input.psd 20164# https://download.imagemagick.org/ImageMagick/download/ImageMagick-7.0.11-11.zip 20165# ImageMagick-7.0.11-11\PerlMagick\t\input.psd 20166>>6 bequad&0xFFffFFffFFff0000 !0 \b, at offset 6 20167>>>6 belong x 0x%8.8x 20168>>>6 beshort x \b%4.4x 20169 20170# XV thumbnail indicator (ThMO) 20171# URL: https://en.wikipedia.org/wiki/Xv_(software) 20172# Reference: http://fileformats.archiveteam.org/wiki/XV_thumbnail 20173# Update: Joerg Jenderek 201740 string P7\ 332 XV thumbnail image data 20175#0 string P7\ 332 XV "thumbnail file" (icon) data 20176!:mime image/x-xv-thumbnail 20177# thumbnail .xvpic/foo.bar for graphic foo.bar 20178!:ext p7/gif/tif/xpm/jpg 20179 20180# NITF is defined by United States MIL-STD-2500A 201810 string NITF National Imagery Transmission Format 20182>25 string >\0 dated %.14s 20183 20184# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 20185# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 20186# Update: Joerg Jenderek 20187# See http://fileformats.archiveteam.org/wiki/GEM_Raster 20188# For variations, also see: 20189# https://www.seasip.info/Gem/ff_img.html (Ventura) 20190# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 20191# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 20192# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 201930 beshort 0x0001 20194# header_size 20195>2 beshort 0x0008 20196>>0 use gem_info 20197>2 beshort 0x0009 20198>>0 use gem_info 20199# no example for NOSIG 20200>2 beshort 24 20201>>0 use gem_info 20202# no example for HYPERPAINT 20203>2 beshort 25 20204>>0 use gem_info 2020516 string XIMG\0 20206>0 use gem_info 20207# no example 2020816 string STTT\0\x10 20209>0 use gem_info 20210# no example or description 2021116 string TIMG\0 20212>0 use gem_info 20213 202140 name gem_info 20215# version is 2 for some XIMG and 1 for all others 20216>0 ubeshort <0x0003 GEM 20217# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt 20218!:mime image/x-gem 20219# header_size 24 25 27 59 779 words for colored bitmaps 20220>>2 ubeshort >9 20221>>>16 string STTT\0\x10 STTT 20222>>>16 string TIMG\0 TIMG 20223# HYPERPAINT or NOSIG variant 20224>>>16 string \0\x80 20225>>>>2 ubeshort =24 NOSIG 20226>>>>2 ubeshort !24 HYPERPAINT 20227# NOSIG or XIMG variant 20228>>>16 default x 20229>>>>16 string !XIMG\0 NOSIG 20230>>16 string =XIMG\0 XIMG Image data 20231!:ext img/ximg 20232# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type 20233>>16 string !XIMG\0 Image data 20234!:ext img 20235# header_size is 9 for Ventura files and 8 for other GEM Paint files 20236>>2 ubeshort 9 (Ventura) 20237#>>2 ubeshort 8 (Paint) 20238>>12 ubeshort x %d x 20239>>14 ubeshort x %d, 20240# 1 4 8 20241>>4 ubeshort x %d planes, 20242# in tenths of a millimetre 20243>>8 ubeshort x %d x 20244>>10 ubeshort x %d pixelsize 20245# pattern_size 1-8. 2 for GEM Paint 20246>>6 ubeshort !2 \b, pattern size %d 20247 20248# GEM Metafile (Wolfram Kleff) 202490 ulelong 0x0018FFFF GEM Metafile data 20250>4 uleshort x version %d 20251 20252# 20253# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 20254# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 20255# 202560 string \0\nSMJPEG SMJPEG 20257>8 ubelong x %d.x data 20258# According to the specification you could find any number of _TXT 20259# headers here, but I can't think of any way of handling that. None of 20260# the SMJPEG files I tried it on used this feature. Even if such a 20261# file is encountered the output should still be reasonable. 20262>16 string _SND \b, 20263>>24 ubeshort >0 %d Hz 20264>>26 ubyte 8 8-bit 20265>>26 ubyte 16 16-bit 20266>>28 string NONE uncompressed 20267# >>28 string APCM ADPCM compressed 20268>>27 ubyte 1 mono 20269>>28 ubyte 2 stereo 20270# Help! Isn't there any way to avoid writing this part twice? 20271# Yes, use a name/use 20272>>32 string _VID \b, 20273# >>>48 string JFIF JPEG 20274>>>40 ubelong >0 %d frames 20275>>>44 ubeshort >0 (%d x 20276>>>46 ubeshort >0 %d) 20277>16 string _VID \b, 20278# >>32 string JFIF JPEG 20279>>24 ubelong >0 %d frames 20280>>28 ubeshort >0 (%d x 20281>>30 ubeshort >0 %d) 20282 202830 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 20284 20285# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 202860 string KiSS KISS/GS 20287>4 ubyte 16 color 20288>>5 ubyte x %d bit 20289>>8 uleshort x %d colors 20290>>10 uleshort x %d groups 20291>4 ubyte 32 cell 20292>>5 ubyte x %d bit 20293>>8 uleshort x %d x 20294>>10 uleshort x %d 20295>>12 uleshort x +%d 20296>>14 uleshort x +%d 20297 20298# Webshots (www.webshots.com), by John Harrison 202990 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 20300 20301# Hercules DASD image files 20302# From Jan Jaeger <jj@septa.nl> and Jay Maynard <jaymaynard@gmail.com> 203030 string CKD_P370 Hercules CKD DASD image file 20304>8 lelong x \b, %d heads per cylinder 20305>12 lelong x \b, track size %d bytes 20306>16 byte x \b, device type 33%2.2X 20307 203080 string CKD_C370 Hercules compressed CKD DASD image file 20309>8 lelong x \b, %d heads per cylinder 20310>12 lelong x \b, track size %d bytes 20311>16 byte x \b, device type 33%2.2X 20312>552 lelong x \b, %d total cylinders 20313>>557 byte 0 \b, no compression 20314>>557 byte 1 \b, ZLIB compression 20315>>557 byte 2 \b, BZ2 compression 20316 203170 string CKD_S370 Hercules CKD DASD shadow file 20318>8 lelong x \b, %d heads per cylinder 20319>12 lelong x \b, track size %d bytes 20320>16 byte x \b, device type 33%2.2X 20321 203220 string CKD_P064 Hercules CKD64 DASD image file 20323>8 lelong x \b, %d heads per cylinder 20324>12 lelong x \b, track size %d bytes 20325>16 byte x \b, device type 33%2.2X 20326 203270 string CKD_C064 Hercules compressed CKD64 DASD image file 20328>8 lelong x \b, %d heads per cylinder 20329>12 lelong x \b, track size %d bytes 20330>16 byte x \b, device type 33%2.2X 20331>524 lelong x \b, %d total cylinders 20332>>585 byte 0 \b, no compression 20333>>585 byte 1 \b, ZLIB compression 20334>>585 byte 2 \b, BZ2 compression 20335 203360 string CKD_S064 Hercules CKD64 DASD shadow file 20337>8 lelong x \b, %d heads per cylinder 20338>12 lelong x \b, track size %d bytes 20339>16 byte x \b, device type 33%2.2X 20340 20341# Squeak images and programs - etoffi@softhome.net 203420 string \146\031\0\0 Squeak image data 203430 search/1 'From\040Squeak Squeak program text 20344 20345# partimage: file(1) magic for PartImage files (experimental, incomplete) 20346# Author: Hans-Joachim Baader <hjb@pro-linux.de> 203470 string PaRtImAgE-VoLuMe PartImage 20348>0x0020 string 0.6.1 file version %s 20349>>0x0060 ulelong >-1 volume %d 20350#>>0x0064 8 byte identifier 20351#>>0x007c reserved 20352>>0x0200 string >\0 type %s 20353>>0x1400 string >\0 device %s, 20354>>0x1600 string >\0 original filename %s, 20355# Some fields omitted 20356>>0x2744 ulelong 0 not compressed 20357>>0x2744 ulelong 1 gzip compressed 20358>>0x2744 ulelong 2 bzip2 compressed 20359>>0x2744 ulelong >2 compressed with unknown algorithm 20360>0x0020 string >0.6.1 file version %s 20361>0x0020 string <0.6.1 file version %s 20362 20363# DCX is multi-page PCX, using a simple header of up to 1024 20364# offsets for the respective PCX components. 20365# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 20366# Update: Joerg Jenderek 20367# URL: http://fileformats.archiveteam.org/wiki/DCX 203680 ulelong 987654321 DCX multi-page 20369# http://www.nationalarchives.gov.uk/pronom/x-fmt/348 20370!:mime image/x-dcx 20371!:ext dcx 20372# The first file offset usually starts at file offset 0x1004 20373# print 1 space after 0x100? offset and then handles PCX images by ./images 20374>4 ulelong x \b, at %#x 20375>(4.l) indirect x 20376# possible 2nd PCX image 20377#>8 ulelong !0 \b, at %#x 20378#>>(8.l) indirect x 20379# possible 3rd PCX image 20380#>12 ulelong !0 \b, at %#x 20381#>>(12.l) indirect x 20382 20383# Simon Walton <simonw@matteworld.com> 20384# Kodak Cineon format for scanned negatives 20385# http://www.kodak.com/US/en/motion/support/dlad/ 203860 ulelong 0xd75f2a80 Cineon image data 20387>200 ubelong >0 \b, %d x 20388>204 ubelong >0 %d 20389 20390 20391# Bio-Rad .PIC is an image format used by microscope control systems 20392# and related image processing software used by biologists. 20393# From: Vebjorn Ljosa <vebjorn@ljosa.com> 20394# BOOL values are two-byte integers; use them to rule out false positives. 20395# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 20396# Samples: https://www.loci.wisc.edu/software/sample-data 2039714 uleshort <2 20398>62 uleshort <2 20399>>54 uleshort 12345 Bio-Rad .PIC Image File 20400>>>0 uleshort >0 %d x 20401>>>2 uleshort >0 %d, 20402>>>4 uleshort =1 1 image in file 20403>>>4 uleshort >1 %d images in file 20404 20405# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 20406# The description of *.mrw format can be found at 20407# http://www.dalibor.cz/minolta/raw_file_format.htm 204080 string \000MRM Minolta Dimage camera raw image data 20409 20410# Summary: DjVu image / document 20411# Extension: .djvu 20412# Reference: http://djvu.org/docs/DjVu3Spec.djvu 20413# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 20414# Modified by (1): Abel Cheung <abelcheung@gmail.com> 204150 string AT&TFORM 20416>12 string DJVM DjVu multiple page document 20417!:mime image/vnd.djvu 20418>12 string DJVU DjVu image or single page document 20419!:mime image/vnd.djvu 20420>12 string DJVI DjVu shared document 20421!:mime image/vnd.djvu 20422>12 string THUM DjVu page thumbnails 20423!:mime image/vnd.djvu 20424 20425# Originally by Marc Espie 20426# Modified by Robert Minsk <robertminsk at yahoo.com> 20427# https://www.openexr.com/openexrfilelayout.pdf 204280 ulelong 20000630 OpenEXR image data, 20429!:mime image/x-exr 20430>4 ulelong&0x000000ff x version %d, 20431>4 ulelong ^0x00000200 storage: scanline 20432>4 ulelong &0x00000200 storage: tiled 20433>8 search/0x1000 compression\0 \b, compression: 20434>>&16 ubyte 0 none 20435>>&16 ubyte 1 rle 20436>>&16 ubyte 2 zips 20437>>&16 ubyte 3 zip 20438>>&16 ubyte 4 piz 20439>>&16 ubyte 5 pxr24 20440>>&16 ubyte 6 b44 20441>>&16 ubyte 7 b44a 20442>>&16 ubyte 8 dwaa 20443>>&16 ubyte 9 dwab 20444>>&16 ubyte >9 unknown 20445>8 search/0x1000 dataWindow\0 \b, dataWindow: 20446>>&10 ulelong x (%d 20447>>&14 ulelong x %d)- 20448>>&18 ulelong x \b(%d 20449>>&22 ulelong x %d) 20450>8 search/0x1000 displayWindow\0 \b, displayWindow: 20451>>&10 ulelong x (%d 20452>>&14 ulelong x %d)- 20453>>&18 ulelong x \b(%d 20454>>&22 ulelong x %d) 20455>8 search/0x1000 lineOrder\0 \b, lineOrder: 20456>>&14 ubyte 0 increasing y 20457>>&14 ubyte 1 decreasing y 20458>>&14 ubyte 2 random y 20459>>&14 ubyte >2 unknown 20460 20461# SMPTE Digital Picture Exchange Format, SMPTE DPX 20462# 20463# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 20464# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 20465# Robert Minsk <robertminsk at yahoo.com> 20466# Modified by Harry Mallon <hjmallon at gmail.com> 204670 string SDPX DPX image data, big-endian, 20468!:mime image/x-dpx 20469>0 use dpx_info 204700 string XPDS DPX image data, little-endian, 20471!:mime image/x-dpx 20472>0 use \^dpx_info 20473 204740 name dpx_info 20475>768 ubeshort <4 20476>>772 ubelong x %dx 20477>>776 ubelong x \b%d, 20478>768 ubeshort >3 20479>>776 ubelong x %dx 20480>>772 ubelong x \b%d, 20481>768 ubeshort 0 left to right/top to bottom 20482>768 ubeshort 1 right to left/top to bottom 20483>768 ubeshort 2 left to right/bottom to top 20484>768 ubeshort 3 right to left/bottom to top 20485>768 ubeshort 4 top to bottom/left to right 20486>768 ubeshort 5 top to bottom/right to left 20487>768 ubeshort 6 bottom to top/left to right 20488>768 ubeshort 7 bottom to top/right to left 20489 20490# From: Tom Hilinski <tom.hilinski@comcast.net> 20491# Update: Joerg Jenderek 20492# URL: https://en.wikipedia.org/wiki/NetCDF 20493# http://fileformats.archiveteam.org/wiki/NetCDF 20494# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/netcdf.trid.xml 20495# https://www.loc.gov/preservation/digital/formats/fdd/fdd000330.shtml 20496# Note: called "NetCDF Network Common Data Form" by TrID and 20497# "netCDF-3 Classic" by DROID via PUID fmt/282 20498# https://www.unidata.ucar.edu/packages/netcdf/ 204990 string CDF\001 20500# skip DROID fmt-282-signature-id-298.nc by test for more content bytes 20501>3 uleshort >0 NetCDF Data Format data 20502#!:mime application/netcdf 20503# https://reposcope.com/mimetype/application/x-netcdf 20504!:mime application/x-netcdf 20505!:ext nc 20506# https://fileinfo.com/extension/cdf 20507# https://www.file-extensions.org/cdf-file-extension-unidata-network-common-data-form 20508# in 1994 changed from CDF to NC file extension avoid a clash with other file formats 20509#!:ext nc/cdf 20510# 64-bit offset netcdf Classic https://www.unidata.ucar.edu/software/netcdf/docs/file_format_specifications 20511# Note: called "netCDF-3 64-bit" by DROID via PUID fmt/283 205120 string CDF\002 20513# skip DROID fmt-283-signature-id-299.nc by test for more content bytes 20514>3 uleshort >0 NetCDF Data Format data (64-bit offset) 20515#!:mime application/netcdf 20516!:mime application/x-netcdf 20517!:ext nc 20518 20519# From: Michael Liu 20520# https://en.wikipedia.org/wiki/Common_Data_Format 205210 ubelong 0xCDF30001 Common Data Format (Version 3 or later) data 20522!:mime application/x-cdf 20523 205240 ubelong 0xCDF26002 Common Data Format (Version 2.6 or 2.7) data 20525!:mime application/x-cdf 20526 205270 ubelong 0x0000FFFF Common Data Format (Version 2.5 or earlier) data 20528!:mime application/x-cdf 20529 20530# Hierarchical Data Format, used to facilitate scientific data exchange 20531# specifications at http://hdf.ncsa.uiuc.edu/ 20532# URL: http://fileformats.archiveteam.org/wiki/HDF 20533# https://en.wikipedia.org/wiki/Hierarchical_Data_Format 20534# Reference: https://portal.hdfgroup.org/download/attachments/52627880/HDF5_File_Format_Specification_Version-3.0.pdf 205350 ubelong 0x0e031301 Hierarchical Data Format (version 4) data 20536!:mime application/x-hdf 20537!:ext hdf/hdf4/h4 205380 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 20539#!:mime application/x-hdf 20540!:mime application/x-hdf5 20541!:ext h5/hdf5/hdf/he5 20542512 string \211HDF\r\n\032\n 20543# skip Matlab v5 mat-file testhdf5_7.4_GLNX86.mat handled by ./mathematica 20544>0 string !MATLAB Hierarchical Data Format (version 5) with 512 bytes user block 20545#!:mime application/x-hdf 20546!:mime application/x-hdf5 20547!:ext h5/hdf5/hdf/he5 205481024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 20549#!:mime application/x-hdf 20550!:mime application/x-hdf5 20551!:ext h5/hdf5/hdf/he5 205522048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 20553#!:mime application/x-hdf 20554!:mime application/x-hdf5 20555!:ext h5/hdf5/hdf/he5 205564096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 20557#!:mime application/x-hdf 20558!:mime application/x-hdf5 20559!:ext h5/hdf5/hdf/he5 20560 20561# From: Tobias Burnus <burnus@net-b.de> 20562# Xara (for a while: Corel Xara) is a graphic package, see 20563# http://www.xara.com/ for Windows and as GPL application for Linux 205640 string XARA\243\243 Xara graphics file 20565 20566# From: Joerg Jenderek 20567# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 20568# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bmf-corel.trid.xml 20569# Note: called "Corel Binary Material Format" by TrID and 20570# "Corel Flow" by XnView 205710 string @CorelBMF\n\rCorel\040Corporation Corel GALLERY Clipart 20572!:mime image/x-corel-bmf 20573!:ext bmf 20574 20575# https://www.cartesianinc.com/Tech/ 20576# Reference: http://fileformats.archiveteam.org/wiki/Cartesian_Perceptual_Compression 205770 string CPC\262 Cartesian Perceptual Compression image 20578!:mime image/x-cpi 20579!:ext cpi/cpc 20580 20581# From Albert Cahalan <acahalan@gmail.com> 20582# puredigital used it for the CVS disposable camcorder 20583#8 lelong 4 ZBM bitmap image data 20584#>4 uleshort x %u x 20585#>6 uleshort x %u 20586 20587# From Albert Cahalan <acahalan@gmail.com> 20588# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 205890 string C565 OLPC firmware icon image data 20590>4 uleshort x %u x 20591>6 uleshort x %u 20592 20593# Applied Images - Image files from Cytovision 20594# Gustavo Junior Alves <gjalves@gjalves.com.br> 205950 string \xce\xda\xde\xfa Cytovision Metaphases file 205960 string \xed\xad\xef\xac Cytovision Karyotype file 205970 string \x0b\x00\x03\x00 Cytovision FISH Probe file 205980 string \xed\xfe\xda\xbe Cytovision FLEX file 205990 string \xed\xab\xed\xfe Cytovision FLEX file 206000 string \xad\xfd\xea\xad Cytovision RATS file 20601 20602# Wavelet Scalar Quantization format used in gray-scale fingerprint images 20603# From Tano M Fotang <mfotang@quanteq.com> 206040 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 20605 20606# Type: PCO B16 image files 20607# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 20608# From: Florian Philipp <florian.philipp@binarywings.net> 20609# Extension: .b16 20610# Description: Pixel image format produced by PCO Camware, typically used 20611# together with PCO cameras. 20612# Note: Different versions exist for e.g. 8 bit and 16 bit images. 20613# Documentation is incomplete. 206140 string/b PCO- PCO B16 image data 20615>12 ulelong x \b, %dx 20616>16 ulelong x \b%d 20617>20 ulelong 0 \b, short header 20618>20 ulelong -1 \b, extended header 20619>>24 ulelong 0 \b, grayscale 20620>>>36 ulelong 0 linear LUT 20621>>>36 ulelong 1 logarithmic LUT 20622>>>28 ulelong x [%d 20623>>>32 ulelong x \b,%d] 20624>>24 ulelong 1 \b, color 20625>>>64 ulelong 0 linear LUT 20626>>>64 ulelong 1 logarithmic LUT 20627>>>40 ulelong x r[%d 20628>>>44 ulelong x \b,%d] 20629>>>48 ulelong x g[%d 20630>>>52 ulelong x \b,%d] 20631>>>56 ulelong x b[%d 20632>>>60 ulelong x \b,%d] 20633 20634# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 20635# From: Markus Heidelberg <markus.heidelberg at web.de> 206360 string/t [BitmapInfo2] Polar Monitor Bitmap text 20637!:mime image/x-polar-monitor-bitmap 20638 20639# From: Rick Richardson <rickrich@gmail.com> 20640# updated by: Joerg Jenderek 20641# URL: http://techmods.net/nuvi/ 206420 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 20643# extension is also used for 20644# Sony SRF raw image (image/x-sony-srf) 20645# SRF map 20646# Terragen Surface Map (https://www.planetside.co.uk/terragen) 20647# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro) 20648!:ext srf 20649#!:mime image/x-garmin-srf 20650# version 1.00,2.00,2.10,2.40,2.50 20651>0x2f string >0 \b, version %4.4s 20652# width (2880,2881,3240) 20653>0x55 uleshort >0 \b, %dx 20654# height (80,90) 20655>>0x53 uleshort x \b%d 20656 20657# From: Joerg Jenderek 20658# URL: http://fileformats.archiveteam.org/wiki/Imageiio/imaginfo_(Ulead) 20659# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe3.trid.xml 20660# Note: called "Ulead Imageiio/Imaginfo thumbnail" by TrID 206610 string IIO1$ Ulead Photo Explorer 3 20662#!:mime application/octet-stream 20663!:mime image/x-ulead-pe3 20664# IMAGEIIO.PE3 20665!:ext pe3 20666# look for DOS/Windows drive letter 20667>5 search/192/s :\\ 20668# directory or full name of corresponding imaginfo.pe3 like: "T:\SAMPLES\TEXTURES\SKY_SNOW\IIOE371.TMP "S:\PI3\PIMPACT3\PROGRAMS\PATTERNS\imaginfo.pe3" 20669>>&-1 string x "%s" 20670# look for DOS/Windows network path if no drive letter part 20671>5 default x 20672>>5 search/192/s \x5c\x5c 20673# full name of corresponding imaginfo.pe3 like: "\\Lionking\upi\SAMPLES\IMAGES\ANIMALS\imaginfo.pe3" 20674>>>&0 string x "%s" 20675# Type: Ulead Photo Explorer5 (.pe5) 20676# URL: http://fileformats.archiveteam.org/wiki/Imageiio/imaginfo_(Ulead) 20677# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe4.trid.xml 20678# From: Simon Horman <horms@debian.org> 20679# Update: Joerg Jenderek 20680# Note: some called "Ulead Imageiio/Imaginfo thumbnail" by TrID 20681# and used in various Ulead applications 206820 string IIO2H Ulead Photo Explorer 4 or 5 20683#!:mime application/octet-stream 20684!:mime image/x-ulead-pe4 20685# IMAGEIIO.PE4 20686!:ext pe4/pe5 20687# look in most samples for JPEG signature like: SAMPLES/IMAGES/SCENES/IMAGINFO.PE4 20688>0x4c2 search/0xE02/s JFIF with JPEG image data 20689>>&-6 use jpeg 20690# near the end list of image names like: Img0001.pcd 1116012L.JPG NCARD4.TPL 20691# 20692# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe3-imaginfo.trid.xml 2069311 string \001\0\0\0\0 20694# check for version 3 part 20695>19 string \0\001\0\003\0 20696>>0 use ulead-imaginfo 20697# From: Joerg Jenderek 20698# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe4-imaginfo.trid.xml 2069911 string \001\0\0\0\0 20700# check for version 4 part 20701>19 string \0\0\0\004\0 20702>>0 use ulead-imaginfo 20703# display information about Ulead Imaginfo thumbnail (version, directory, image extension) 207040 name ulead-imaginfo 20705>22 ubyte x Ulead Imaginfo thumbnail 20706#!:mime application/octet-stream 20707!:mime image/x-ulead-imaginfo 20708>22 ubyte =3 \b, version 3 20709# IMAGINFO.PE3 20710!:ext pe3 20711>22 ubyte =4 \b, version 4 20712# IMAGINFO.PE4 20713!:ext pe4 20714# MAYBE ALSO VERSION 5 ? 20715#>22 ubyte =5 \b, version 5 20716#!:ext pe5 20717>22 ubyte x 20718# look for DOS/Windows driver letter 20719>>4 search/192/s :\x5c 20720# skip f:\Programme\iPhoto Plus 4\Template\Business Cards\IMAGINFO.PE4 20721# by looking for driver letter in range A-Z 20722>>>&-1 ubyte >0x40 20723# directory path like: "E:\iPE\CDSample\Images\Scenes" "D:\XmasCard\Samples" "C:\TEMP\PLANTS" 20724>>>>&-5 pstring/l >0 \b, "%s" 20725# look for DOS/Windows network path if no valid drive letter part 20726>>>&-1 default x 20727>>>>4 search/192/s \x5c\x5c 20728# directory path like: "\\FSX\SYS\OPPS\IPE.ENG\TEMPLATE\BUSINESS" "\\Lionking\upi\SAMPLES\IMAGES\ANIMALS" 20729>>>>>&-4 pstring/l >0 \b, "%s" 20730# look for DOS/Windows network path if no drive letter part 20731>>4 default x 20732>>>4 search/192/s \x5c\x5c 20733# directory path like: "\\FSX\SYS\opps\ipe.eng\samples" "\\DANIEL\IPE_CD\IPE.ITA" 20734>>>>&-4 pstring/l >0 \b, "%s" 20735# look for point character inside image names 20736>56 search/38/s . 20737# image name extension like: bmp jpg pcd tpl 20738>>&1 string x with %-.3s images 20739# Summary: Ulead Pattern image (Corel Corporation) 20740# URL: https://en.wikipedia.org/wiki/Ulead_Systems 20741# https://www.file-extensions.org/pst-file-extension-ulead-pattern-image-format 20742# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pst-ulead.trid.xml 20743# From: Joerg Jenderek 20744# Note: used also by CorelDraw Essentials 3 version 13.0.0.800 20745# there seems to exist other versions 207460 ubelong 0xFFFF0100 20747>8 search/21 PresetInfo Ulead pattern image 20748#!:mime application/octet-stream 20749!:mime image/x-ulead-pst 20750!:ext pst 20751# string length like: 16 18 19 21 24 20752#>>4 uleshort x n=%u 20753# like: BlendPresetInfo DropShadowPresetInfo FileNewPresetInfo VectorExtrudePresetInfo EnvelopePresetInfo ContourPresetInfo DistortionPresetInfo 20754>>4 pstring/h x "%s" 20755 20756# Type: X11 cursor 20757# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 20758# From: Mathias Brodala <info@noctus.net> 207590 string Xcur X11 cursor 20760 20761# Type: Olympus ORF raw images. 20762# URL: https://libopenraw.freedesktop.org/wiki/Olympus_ORF 20763# From: Adam Buchbinder <adam.buchbinder@gmail.com> 207640 string MMOR Olympus ORF raw image data, big-endian 20765!:mime image/x-olympus-orf 207660 string IIRO Olympus ORF raw image data, little-endian 20767!:mime image/x-olympus-orf 207680 string IIRS Olympus ORF raw image data, little-endian 20769!:mime image/x-olympus-orf 20770 20771# Type: files used in modern AVCHD camcoders to store clip information 20772# Extension: .cpi 20773# From: Alexander Danilov <alexander.a.danilov@gmail.com> 207740 string HDMV0100 AVCHD Clip Information 20775 20776# From: Adam Buchbinder <adam.buchbinder@gmail.com> 20777# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 20778# Radiance HDR; usually has .pic or .hdr extension. 207790 string #?RADIANCE\n Radiance HDR image data 20780#!mime image/vnd.radiance 20781 20782# From: Adam Buchbinder <adam.buchbinder@gmail.com> 20783# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 20784# Used by the pfstools packages. The regex matches for the image size could 20785# probably use some work. The MIME type is made up; if there's one in 20786# actual common use, it should replace the one below. 207870 string PFS1\x0a PFS HDR image data 20788#!mime image/x-pfs 20789>1 regex [0-9]*\ \b, %s 20790>>1 regex \ [0-9]{4} \bx%s 20791 20792# Type: Foveon X3F 20793# URL: https://www.photofo.com/downloads/x3f-raw-format.pdf 20794# From: Adam Buchbinder <adam.buchbinder@gmail.com> 20795# Note that the MIME type isn't defined anywhere that I can find; if 20796# there's a canonical type for this format, it should replace this one. 207970 string FOVb Foveon X3F raw image data 20798!:mime image/x-x3f 20799>6 uleshort x \b, version %d. 20800>4 uleshort x \b%d 20801>28 ulelong x \b, %dx 20802>32 ulelong x \b%d 20803 20804# Paint.NET file 20805# From Adam Buchbinder <adam.buchbinder@gmail.com> 208060 string PDN3 Paint.NET image data 20807!:mime image/x-paintnet 20808 20809# Not really an image. 20810# From: "Tano M. Fotang" <mfotang@quanteq.com> 208110 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 20812 20813# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 20814# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 2081590 ubequad 0x574D50484F544F00 JPEG-XR Image 20816>98 ubyte&0x08 =0x08 \b, hard tiling 20817>99 ubyte&0x80 =0x80 \b, tiling present 20818>99 ubyte&0x40 =0x40 \b, codestream present 20819>99 ubyte&0x38 x \b, spatial xform= 20820>99 ubyte&0x38 0x00 \bTL 20821>99 ubyte&0x38 0x08 \bBL 20822>99 ubyte&0x38 0x10 \bTR 20823>99 ubyte&0x38 0x18 \bBR 20824>99 ubyte&0x38 0x20 \bBT 20825>99 ubyte&0x38 0x28 \bRB 20826>99 ubyte&0x38 0x30 \bLT 20827>99 ubyte&0x38 0x38 \bLB 20828>100 ubyte&0x80 =0x80 \b, short header 20829>>102 ubeshort+1 x \b, %d 20830>>104 ubeshort+1 x \bx%d 20831>100 ubyte&0x80 =0x00 \b, long header 20832>>102 ubelong+1 x \b, %x 20833>>106 ubelong+1 x \bx%x 20834>101 ubeshort&0xf x \b, bitdepth= 20835>>101 ubeshort&0xf 0x0 \b1-WHITE=1 20836>>101 ubeshort&0xf 0x1 \b8 20837>>101 ubeshort&0xf 0x2 \b16 20838>>101 ubeshort&0xf 0x3 \b16-SIGNED 20839>>101 ubeshort&0xf 0x4 \b16-FLOAT 20840>>101 ubeshort&0xf 0x5 \b(reserved 5) 20841>>101 ubeshort&0xf 0x6 \b32-SIGNED 20842>>101 ubeshort&0xf 0x7 \b32-FLOAT 20843>>101 ubeshort&0xf 0x8 \b5 20844>>101 ubeshort&0xf 0x9 \b10 20845>>101 ubeshort&0xf 0xa \b5-6-5 20846>>101 ubeshort&0xf 0xb \b(reserved %d) 20847>>101 ubeshort&0xf 0xc \b(reserved %d) 20848>>101 ubeshort&0xf 0xd \b(reserved %d) 20849>>101 ubeshort&0xf 0xe \b(reserved %d) 20850>>101 ubeshort&0xf 0xf \b1-BLACK=1 20851>101 ubeshort&0xf0 x \b, colorfmt= 20852>>101 ubeshort&0xf0 0x00 \bYONLY 20853>>101 ubeshort&0xf0 0x10 \bYUV240 20854>>101 ubeshort&0xf0 0x20 \bYWV422 20855>>101 ubeshort&0xf0 0x30 \bYWV444 20856>>101 ubeshort&0xf0 0x40 \bCMYK 20857>>101 ubeshort&0xf0 0x50 \bCMYKDIRECT 20858>>101 ubeshort&0xf0 0x60 \bNCOMPONENT 20859>>101 ubeshort&0xf0 0x70 \bRGB 20860>>101 ubeshort&0xf0 0x80 \bRGBE 20861>>101 ubeshort&0xf0 >0x80 \b(reserved %#x) 20862 20863# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 20864# 20865# BPG (Better Portable Graphics) format 20866# https://bellard.org/bpg/ 20867# http://fileformats.archiveteam.org/wiki/BPG 20868# 208690 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 20870!:mime image/bpg 20871 20872# From: Joerg Jenderek 20873# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format 208740 string icns Mac OS X icon 20875!:mime image/x-icns 20876!:apple ????icns 20877!:ext icns 20878>4 ubelong >0 20879# file size 20880>>4 ubelong x \b, %d bytes 20881# icon type 20882>>8 string x \b, "%4.4s" type 20883 20884# TIM images 20885# URL: http://fileformats.archiveteam.org/wiki/TIM_(PlayStation_graphics) 20886# Reference: https://mrclick.zophar.net/TilEd/download/timgfx.txt 20887# Update: Joerg Jenderek 20888# Note: called as "PSX TIM *bpp bitmap" by bitmap-tim-*.trid.xml 20889# verified as "TIM PSX" by XnView `nconvert -fullinfo *.tim` and 20890# by RECOIL `recoil2png -o TMP.PNG input.tim; file TMP.PNG` and often 20891# as "PSX TIM" by ImageMagick version 7.1.0-10 command `identify *.tim` 20892# here signed integers are used but according to Kaitai unsigned 208930 ulelong 0x00000010 20894# 32 Flag bits *cttt; c~CLUT flag t~type 000~4BPP 001~8BPP 010~16BPP 011~24BPP 100~Mixed 20895#>4 ulelong x FLAGS=%#x 20896# 12+Size of CLUT (2Ch for 4BPP; 20Ch 40Ch 60Ch 80Ch C0Ch for 8BPP) or 20897# +image data size (800Ch 2000Ch 2580C for 16BPP) (02000003h for dBase memo test.dbt) 20898#>8 ulelong x \b, 12+CLUT or data size=%#8.8x 20899# CLUT or data size remainder is 12 (Ch), but 03 for dBase memo test.dbt 20900#>8 ubyte&0x0F =0x0C \b, SIZE REMAINDER IS 12 20901# skip dBase III memo test.dbt with invalid flags 22D10189h 20902>4 ulelong&0xffFFffF0 =0 Sony PlayStation PSX image, 20903# file (version 5.40) labeled the above entry as "TIM image" 20904!:mime image/x-sony-tim 20905!:ext tim 20906#>>4 ulelong&0x00000007 x \b, BPP~%u 20907# 4BPP and 8BPP examples exist with CLUT or without CLUT 20908>>4 ulelong&0x07 0x0 4-Bit, 20909>>4 ulelong&0x07 0x1 8-Bit, 20910# 16BPP and 24BPP examples have no CLUT 20911>>4 ulelong 0x2 15-Bit, 20912>>4 ulelong 0x3 24-Bit, 20913# no example 20914>>4 ulelong&0x07 0x4 Mixed-Bit, 20915# CLUT flag set 20916>>4 ulelong &8 20917# 12 + size of CLUT like: 1000Ch 800Ch 400Ch 40Ch and 2FEh (KAGE.TIM) 20918#>>>(8.l+8) ulelong x \b, 12+CLUT SIZE=%#8.8x 20919>>>(8.l+12) uleshort x Pixel at (%d, 20920>>>(8.l+14) uleshort x \b%d) Size= 20921# image width (to get actual width multiply by 4 for 4BPP and by 2 for 8BPP) 20922>>>>4 ulelong 0x8 20923>>>>>(8.l+16) uleshort*4 x \b%d 20924>>>>4 ulelong 0x9 20925>>>>>(8.l+16) uleshort*2 x \b%d 20926# image height like: 32 64 128 144 160 208 256 20927>>>(8.l+18) uleshort x \bx%d, 20928>>>4 ulelong 0x8 16 CLUT Entries at 20929>>>4 ulelong 0x9 256 CLUT Entries at 20930>>>12 uleshort x (%d, 20931>>>14 uleshort x \b%d) 20932# no Color LookUp Table (CLUT) 20933>>4 ulelong ^8 20934# image origin X Y 20935>>>12 uleshort x Pixel at (%d, 20936>>>14 uleshort x \b%d) Size= 20937# real image width = multiply by 4 (4BPP) 2 (8BPP) 1 (16BPP) 2/3 (24BPP) 20938>>>>4 ulelong 0x0 20939>>>>>16 uleshort*4 x \b%d 20940>>>>4 ulelong 0x1 20941>>>>>16 uleshort*2 x \b%d 20942>>>>4 ulelong 0x2 20943>>>>>16 uleshort x \b%d 20944>>>>4 ulelong 0x3 20945# GRR: NOT working 20946#>>>>>16 uleshort*2/3 x \b%d 20947>>>>>16 uleshort x \b2/3*%d 20948# mixed format width not explained! 20949>>>>4 ulelong 0x4 20950>>>>>16 uleshort x \b%d 20951# image height like: 64 240 256 20952>>>18 uleshort x \bx%d 20953# TIM image data 20954 20955# MDEC streams 209560 ulelong 0x80010160 MDEC video stream, 20957>16 uleshort x %dx 20958>18 uleshort x \b%d 20959#>8 ulelong x %d frames 20960#>4 uleshort x secCount=%d; 20961#>6 uleshort x nSectors=%d; 20962#>12 ulelong x frameSize=%d; 20963 20964# BS encoded bitstreams 209652 uleshort 0x3800 BS image, 20966>6 uleshort x Version %d, 20967>4 uleshort x Quantization %d, 20968>0 uleshort x (Decompresses to %d words) 20969 20970# Type: farbfeld image. 20971# Url: http://tools.suckless.org/farbfeld/ 20972# From: Ian D. Scott <ian@iandouglasscott.com> 20973# 209740 string farbfeld farbfeld image data, 20975>8 ubelong x %dx 20976>12 ubelong x \b%d 20977 20978# Type: Microsoft DirectDraw Surface (DXGI formats) 20979# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 20980# From: Morten Hustveit <morten@debian.org> 20981# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 209820 name ms-directdraw-dx10 20983>0 ulelong x \b, DXGI format: 20984>0 ulelong 1 R32G32B32A32_TYPELESS 20985>0 ulelong 2 R32G32B32A32_FLOAT 20986>0 ulelong 3 R32G32B32A32_UINT 20987>0 ulelong 4 R32G32B32A32_SINT 20988>0 ulelong 5 R32G32B32_TYPELESS 20989>0 ulelong 6 R32G32B32_FLOAT 20990>0 ulelong 7 R32G32B32_UINT 20991>0 ulelong 8 R32G32B32_SINT 20992>0 ulelong 9 R16G16B16A16_TYPELESS 20993>0 ulelong 10 R16G16B16A16_FLOAT 20994>0 ulelong 11 R16G16B16A16_UNORM 20995>0 ulelong 12 R16G16B16A16_UINT 20996>0 ulelong 13 R16G16B16A16_SNORM 20997>0 ulelong 14 R16G16B16A16_SINT 20998>0 ulelong 15 R32G32_TYPELESS 20999>0 ulelong 16 R32G32_FLOAT 21000>0 ulelong 17 R32G32_UINT 21001>0 ulelong 18 R32G32_SINT 21002>0 ulelong 19 R32G8X24_TYPELESS 21003>0 ulelong 20 D32_FLOAT_S8X24_UINT 21004>0 ulelong 21 R32_FLOAT_X8X24_TYPELESS 21005>0 ulelong 22 X32_TYPELESS_G8X24_UINT 21006>0 ulelong 23 R10G10B10A2_TYPELESS 21007>0 ulelong 24 R10G10B10A2_UNORM 21008>0 ulelong 25 R10G10B10A2_UINT 21009>0 ulelong 26 R11G11B10_FLOAT 21010>0 ulelong 27 R8G8B8A8_TYPELESS 21011>0 ulelong 28 R8G8B8A8_UNORM 21012>0 ulelong 29 R8G8B8A8_UNORM_SRGB 21013>0 ulelong 30 R8G8B8A8_UINT 21014>0 ulelong 31 R8G8B8A8_SNORM 21015>0 ulelong 32 R8G8B8A8_SINT 21016>0 ulelong 33 R16G16_TYPELESS 21017>0 ulelong 34 R16G16_FLOAT 21018>0 ulelong 35 R16G16_UNORM 21019>0 ulelong 36 R16G16_UINT 21020>0 ulelong 37 R16G16_SNORM 21021>0 ulelong 38 R16G16_SINT 21022>0 ulelong 39 R32_TYPELESS 21023>0 ulelong 40 D32_FLOAT 21024>0 ulelong 41 R32_FLOAT 21025>0 ulelong 42 R32_UINT 21026>0 ulelong 43 R32_SINT 21027>0 ulelong 44 R24G8_TYPELESS 21028>0 ulelong 45 D24_UNORM_S8_UINT 21029>0 ulelong 46 R24_UNORM_X8_TYPELESS 21030>0 ulelong 47 X24_TYPELESS_G8_UINT 21031>0 ulelong 48 R8G8_TYPELESS 21032>0 ulelong 49 R8G8_UNORM 21033>0 ulelong 50 R8G8_UINT 21034>0 ulelong 51 R8G8_SNORM 21035>0 ulelong 52 R8G8_SINT 21036>0 ulelong 53 R16_TYPELESS 21037>0 ulelong 54 R16_FLOAT 21038>0 ulelong 55 D16_UNORM 21039>0 ulelong 56 R16_UNORM 21040>0 ulelong 57 R16_UINT 21041>0 ulelong 58 R16_SNORM 21042>0 ulelong 59 R16_SINT 21043>0 ulelong 60 R8_TYPELESS 21044>0 ulelong 61 R8_UNORM 21045>0 ulelong 62 R8_UINT 21046>0 ulelong 63 R8_SNORM 21047>0 ulelong 64 R8_SINT 21048>0 ulelong 65 A8_UNORM 21049>0 ulelong 66 R1_UNORM 21050>0 ulelong 67 R9G9B9E5_SHAREDEXP 21051>0 ulelong 68 R8G8_B8G8_UNORM 21052>0 ulelong 69 G8R8_G8B8_UNORM 21053>0 ulelong 70 BC1_TYPELESS 21054>0 ulelong 71 BC1_UNORM 21055>0 ulelong 72 BC1_UNORM_SRGB 21056>0 ulelong 73 BC2_TYPELESS 21057>0 ulelong 74 BC2_UNORM 21058>0 ulelong 75 BC2_UNORM_SRGB 21059>0 ulelong 76 BC3_TYPELESS 21060>0 ulelong 77 BC3_UNORM 21061>0 ulelong 78 BC3_UNORM_SRGB 21062>0 ulelong 79 BC4_TYPELESS 21063>0 ulelong 80 BC4_UNORM 21064>0 ulelong 81 BC4_SNORM 21065>0 ulelong 82 BC5_TYPELESS 21066>0 ulelong 83 BC5_UNORM 21067>0 ulelong 84 BC5_SNORM 21068>0 ulelong 85 B5G6R5_UNORM 21069>0 ulelong 86 B5G5R5A1_UNORM 21070>0 ulelong 87 B8G8R8A8_UNORM 21071>0 ulelong 88 B8G8R8X8_UNORM 21072>0 ulelong 89 R10G10B10_XR_BIAS_A2_UNORM 21073>0 ulelong 90 B8G8R8A8_TYPELESS 21074>0 ulelong 91 B8G8R8A8_UNORM_SRGB 21075>0 ulelong 92 B8G8R8X8_TYPELESS 21076>0 ulelong 93 B8G8R8X8_UNORM_SRGB 21077>0 ulelong 94 BC6H_TYPELESS 21078>0 ulelong 95 BC6H_UF16 21079>0 ulelong 96 BC6H_SF16 21080>0 ulelong 97 BC7_TYPELESS 21081>0 ulelong 98 BC7_UNORM 21082>0 ulelong 99 BC7_UNORM_SRGB 21083>0 ulelong 100 AYUV 21084>0 ulelong 101 Y410 21085>0 ulelong 102 Y416 21086>0 ulelong 103 NV12 21087>0 ulelong 104 P010 21088>0 ulelong 105 P016 21089>0 ulelong 106 420_OPAQUE 21090>0 ulelong 107 YUY2 21091>0 ulelong 108 Y210 21092>0 ulelong 109 Y216 21093>0 ulelong 110 NV11 21094>0 ulelong 111 AI44 21095>0 ulelong 112 IA44 21096>0 ulelong 113 P8 21097>0 ulelong 114 A8P8 21098>0 ulelong 115 B4G4R4A4_UNORM 21099 21100>0 ulelong 116 XBOX_R10G10B10_7E3_A2_FLOAT 21101>0 ulelong 117 XBOX_R10G10B10_6E4_A2_FLOAT 21102>0 ulelong 118 XBOX_D16_UNORM_S8_UINT 21103>0 ulelong 119 XBOX_R16_UNORM_X8_TYPELESS 21104>0 ulelong 120 XBOX_X16_TYPELESS_G8_UINT 21105 21106>0 ulelong 130 DXGI_FORMAT_P208 21107>0 ulelong 131 DXGI_FORMAT_V208 21108>0 ulelong 132 DXGI_FORMAT_V408 21109 21110>0 ulelong 133 ASTC_4X4_TYPELESS 21111>0 ulelong 134 ASTC_4X4_UNORM 21112>0 ulelong 135 ASTC_4X4_UNORM_SRGB 21113>0 ulelong 137 ASTC_5X4_TYPELESS 21114>0 ulelong 138 ASTC_5X4_UNORM 21115>0 ulelong 139 ASTC_5X4_UNORM_SRGB 21116>0 ulelong 141 ASTC_5X5_TYPELESS 21117>0 ulelong 142 ASTC_5X5_UNORM 21118>0 ulelong 143 ASTC_5X5_UNORM_SRGB 21119>0 ulelong 145 ASTC_6X5_TYPELESS 21120>0 ulelong 146 ASTC_6X5_UNORM 21121>0 ulelong 147 ASTC_6X5_UNORM_SRGB 21122>0 ulelong 149 ASTC_6X6_TYPELESS 21123>0 ulelong 150 ASTC_6X6_UNORM 21124>0 ulelong 151 ASTC_6X6_UNORM_SRGB 21125>0 ulelong 153 ASTC_8X5_TYPELESS 21126>0 ulelong 154 ASTC_8X5_UNORM 21127>0 ulelong 155 ASTC_8X5_UNORM_SRGB 21128>0 ulelong 157 ASTC_8X6_TYPELESS 21129>0 ulelong 158 ASTC_8X6_UNORM 21130>0 ulelong 159 ASTC_8X6_UNORM_SRGB 21131>0 ulelong 161 ASTC_8X8_TYPELESS 21132>0 ulelong 162 ASTC_8X8_UNORM 21133>0 ulelong 163 ASTC_8X8_UNORM_SRGB 21134>0 ulelong 165 ASTC_10X5_TYPELESS 21135>0 ulelong 166 ASTC_10X5_UNORM 21136>0 ulelong 167 ASTC_10X5_UNORM_SRGB 21137>0 ulelong 169 ASTC_10X6_TYPELESS 21138>0 ulelong 170 ASTC_10X6_UNORM 21139>0 ulelong 171 ASTC_10X6_UNORM_SRGB 21140>0 ulelong 173 ASTC_10X8_TYPELESS 21141>0 ulelong 174 ASTC_10X8_UNORM 21142>0 ulelong 175 ASTC_10X8_UNORM_SRGB 21143>0 ulelong 177 ASTC_10X10_TYPELESS 21144>0 ulelong 178 ASTC_10X10_UNORM 21145>0 ulelong 179 ASTC_10X10_UNORM_SRGB 21146>0 ulelong 181 ASTC_12X10_TYPELESS 21147>0 ulelong 182 ASTC_12X10_UNORM 21148>0 ulelong 183 ASTC_12X10_UNORM_SRGB 21149>0 ulelong 185 ASTC_12X12_TYPELESS 21150>0 ulelong 186 ASTC_12X12_UNORM 21151>0 ulelong 187 ASTC_12X12_UNORM_SRGB 21152 21153>0 ulelong 190 XBOX_R10G10B10_SNORM_A2_UNORM 21154>0 ulelong 189 XBOX_R4G4_UNORM 21155>0 ulelong 0xFFFFFFFF DXGI_FORMAT_FORCE_UINT 21156 21157# Type: Microsoft DirectDraw Surface (common data) 21158# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 21159# From: Morten Hustveit <morten@debian.org> 21160# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 211610 name ms-directdraw-surface 21162>0x10 ulelong x %u x 21163>0x0C ulelong x %u 21164# Color depth. 21165>0x58 ulelong >0 \b, %u-bit color 21166# Determine the pixel format. 21167>0x50 ulelong&0x4 4 21168# FIXME: Handle DX10 and XBOX formats. 21169>>0x54 string DX10 21170>>>0x80 use ms-directdraw-dx10 21171>>0x54 string !DX10 \b, compressed using %.4s 21172>0x50 ulelong&0x2 0x2 \b, alpha only 21173>0x50 ulelong&0x200 0x200 \b, YUV 21174>0x50 ulelong&0x20000 0x20000 \b, luminance 21175# RGB pixel format 21176>0x50 ulelong&0x40 0x40 21177 21178# Determine the RGB format using the color masks. 21179# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB 21180 21181>>0x58 ulelong 16 21182 21183# NOTE: 15-bit color formats usually have 16-bit listed as the color depth. 21184>>>0x5C ulequad 0x000003E000007C00 21185>>>>0x64 ulequad 0x000000000000001F \b, RGB555 21186>>>0x5C ulequad 0x000003E000001F00 21187>>>>0x64 ulequad 0x000000000000007C \b, BGR555 21188 21189>>>0x5C ulequad 0x000007E00000F800 21190>>>>0x64 ulequad 0x000000000000001F \b, RGB565 21191>>>0x5C ulequad 0x000007E000001F00 21192>>>>0x64 ulequad 0x00000000000000F8 \b, BGR565 21193 21194>>>0x5C ulequad 0x000000F000000F00 21195>>>>0x64 ulequad 0x0000F0000000000F \b, ARGB4444 21196>>>0x5C ulequad 0x000000F00000000F 21197>>>>0x64 ulequad 0x0000F00000000F00 \b, ABGR4444 21198 21199>>>0x5C ulequad 0x00000F000000F000 21200>>>>0x64 ulequad 0x0000000F000000F0 \b, RGBA4444 21201>>>0x5C ulequad 0x00000F00000000F0 21202>>>>0x64 ulequad 0x0000000F0000F000 \b, BGRA4444 21203 21204>>>0x5C ulequad 0x000000F000000F00 21205>>>>0x64 ulequad 0x000000000000000F \b, xRGB4444 21206>>>0x5C ulequad 0x000000F00000000F 21207>>>>0x64 ulequad 0x0000000000000F00 \b, xBGR4444 21208 21209>>>0x5C ulequad 0x00000F000000F000 21210>>>>0x64 ulequad 0x00000000000000F0 \b, RGBx4444 21211>>>0x5C ulequad 0x00000F00000000F0 21212>>>>0x64 ulequad 0x000000000000F000 \b, BGRx4444 21213 21214>>>0x5C ulequad 0x000003E000007C00 21215>>>>0x64 ulequad 0x000080000000001F \b, ARGB1555 21216>>>0x5C ulequad 0x000003E000001F00 21217>>>>0x64 ulequad 0x000080000000007C \b, ABGR1555 21218>>>0x5C ulequad 0x000007C00000F800 21219>>>>0x64 ulequad 0x000000010000003E \b, RGBA5551 21220>>>0x5C ulequad 0x000007C00000003E 21221>>>>0x64 ulequad 0x000000010000F800 \b, BGRA5551 21222 21223>>88 ulelong 24 21224>>>0x5C ulequad 0x0000FF0000FF0000 21225>>>>0x64 ulequad 0x00000000000000FF \b, RGB888 21226>>>0x5C ulequad 0x0000FF00000000FF 21227>>>>0x64 ulequad 0x0000000000FF0000 \b, BGR888 21228 21229>>88 ulelong 32 21230>>>0x5C ulequad 0x0000FF0000FF0000 21231>>>>0x64 ulequad 0xFF000000000000FF \b, ARGB8888 21232>>>0x5C ulequad 0x0000FF00000000FF 21233>>>>0x64 ulequad 0xFF00000000FF0000 \b, ABGR8888 21234 21235>>>0x5C ulequad 0x00FF0000FF000000 21236>>>>0x64 ulequad 0x000000FF0000FF00 \b, RGBA8888 21237>>>0x5C ulequad 0x00FF00000000FF00 21238>>>>0x64 ulequad 0x000000FFFF000000 \b, BGBA8888 21239 21240>>>0x5C ulequad 0x0000FF0000FF0000 21241>>>>0x64 ulequad 0x00000000000000FF \b, xRGB8888 21242>>>0x5C ulequad 0x0000FF00000000FF 21243>>>>0x64 ulequad 0x0000000000FF0000 \b, xBGR8888 21244 21245>>>0x5C ulequad 0x00FF0000FF000000 21246>>>>0x64 ulequad 0x000000000000FF00 \b, RGBx8888 21247>>>0x5C ulequad 0x00FF00000000FF00 21248>>>>0x64 ulequad 0x00000000FF000000 \b, BGBx8888 21249 21250# Less common 32-bit color formats. 21251>>>0x5C ulequad 0xFFFF00000000FFFF 21252>>>>0x64 ulequad 0x0000000000000000 \b, G16R16 21253>>>0x5C ulequad 0x0000FFFFFFFF0000 21254>>>>0x64 ulequad 0x0000000000000000 \b, R16G16 21255 21256>>>0x5C ulequad 0x000FFC003FF00000 21257>>>>0x64 ulequad 0xC0000000000003FF \b, A2R10G10B10 21258>>>0x5C ulequad 0x000FFC00000003FF 21259>>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10 21260 21261# Type: Microsoft DirectDraw Surface 21262# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 21263# From: Morten Hustveit <morten@debian.org> 21264# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 212650 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS): 21266>0 use ms-directdraw-surface 21267 21268# Type: Sega PVR image. 21269# From: David Korth <gerbilsoft@gerbilsoft.com> 21270# References: 21271# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt 21272# - https://github.com/yazgoo/pvrx2png 21273# - https://github.com/nickworonekin/puyotools 21274 21275# Sega PVR header. 212760 name sega-pvr-image-header 21277>0x0C uleshort x %u x 21278>0x0E uleshort x %u 21279# Image format. 21280>0x08 ubyte 0 \b, ARGB1555 21281>0x08 ubyte 1 \b, RGB565 21282>0x08 ubyte 2 \b, ARGB4444 21283>0x08 ubyte 3 \b, YUV442 21284>0x08 ubyte 4 \b, Bump 21285>0x08 ubyte 5 \b, 4bpp 21286>0x08 ubyte 6 \b, 8bpp 21287# Image data type. 21288>0x09 ubyte 0x01 \b, square twiddled 21289>0x09 ubyte 0x02 \b, square twiddled & mipmap 21290>0x09 ubyte 0x03 \b, VQ 21291>0x09 ubyte 0x04 \b, VQ & mipmap 21292>0x09 ubyte 0x05 \b, 8-bit CLUT twiddled 21293>0x09 ubyte 0x06 \b, 4-bit CLUT twiddled 21294>0x09 ubyte 0x07 \b, 8-bit direct twiddled 21295>0x09 ubyte 0x08 \b, 4-bit direct twiddled 21296>0x09 ubyte 0x09 \b, rectangle 21297>0x09 ubyte 0x0B \b, rectangular stride 21298>0x09 ubyte 0x0D \b, rectangular twiddled 21299>0x09 ubyte 0x10 \b, small VQ 21300>0x09 ubyte 0x11 \b, small VQ & mipmap 21301>0x09 ubyte 0x12 \b, square twiddled & mipmap 21302 21303# Sega PVR image. 213040 string PVRT 21305>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 21306>>0x20 use ms-directdraw-surface 21307>0x10 ubelong !0x44445320 Sega PVR image: 21308>>0 use sega-pvr-image-header 21309 21310# Sega PVR image with GBIX. 213110 string GBIX 21312>0x10 string PVRT 21313>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 21314>>>0x20 use ms-directdraw-surface 21315>>0x10 ubelong !0x44445320 Sega PVR image: 21316>>>0x10 use sega-pvr-image-header 21317>>0x08 ulelong x \b, global index = %u 21318 21319# Sega GVR header. 213200 name sega-gvr-image-header 21321>0x0C ubeshort x %u x 21322>0x0E ubeshort x %u 21323# Image data format. 21324>0x0B ubyte 0 \b, I4 21325>0x0B ubyte 1 \b, I8 21326>0x0B ubyte 2 \b, IA4 21327>0x0B ubyte 3 \b, IA8 21328>0x0B ubyte 4 \b, RGB565 21329>0x0B ubyte 5 \b, RGB5A3 21330>0x0B ubyte 6 \b, ARGB8888 21331>0x0B ubyte 8 \b, CI4 21332>0x0B ubyte 9 \b, CI8 21333>0x0B ubyte 14 \b, DXT1 21334 21335# Sega GVR image. 213360 string GVRT Sega GVR image: 21337>0x10 use sega-gvr-image-header 21338 21339# Sega GVR image with GBIX. 213400 string GBIX 21341>0x10 string GVRT Sega GVR image: 21342>>0x10 use sega-gvr-image-header 21343>>0x08 ubelong x \b, global index = %u 21344 21345# Sega GVR image with GCIX. (Wii) 213460 string GCIX 21347>0x10 string GVRT Sega GVR image: 21348>>0x10 use sega-gvr-image-header 21349>>0x08 ubelong x \b, global index = %u 21350 21351# Light Field Picture 21352# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx 21353# Typical file extensions: .lfp .lfr .lfx 21354 213550 ubelong 0x894C4650 21356>4 ubelong 0x0D0A1A0A 21357>12 ubelong 0x00000000 Lytro Light Field Picture 21358>8 ubelong x \b, version %d 21359 21360# Type: Vision Research Phantom CINE Format 21361# URL: https://www.phantomhighspeed.com/ 21362# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk 21363# From: Harry Mallon <hjmallon at gmail.com> 21364# 21365# This has a short "CI" code but the 44 is the size of the struct which is 21366# stable 213670 string CI 21368>2 uleshort 44 Vision Research CINE Video, 21369>>4 uleshort 0 Grayscale, 21370>>4 uleshort 1 JPEG Compressed, 21371>>4 uleshort 2 RAW, 21372>>6 uleshort x version %d, 21373>>20 ulelong x %d frames, 21374>>48 ulelong x %dx 21375>>52 ulelong x \b%d 21376 21377# Type: ARRI Raw Image 21378# Info: SMPTE RDD30:2014 21379# From: Harry Mallon <hjmallon at gmail.com> 213800 string ARRI ARRI ARI image data, 21381>4 ulelong 0x78563412 little-endian, 21382>4 ulelong 0x12345678 big-endian, 21383>12 ulelong x version %d, 21384>20 ulelong x %dx 21385>24 ulelong x \b%d 21386 21387# Type: Khronos KTX texture. 21388# From: David Korth <gerbilsoft@gerbilsoft.com> 21389# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/ 21390 21391# glEnum decoding. 21392# NOTE: Only the most common formats are listed here. 213930 name khronos-ktx-glEnum 21394>0 ulelong 0x1907 \b, RGB 21395>0 ulelong 0x1908 \b, RGBA 21396>0 ulelong 0x1909 \b, LUMINANCE 21397>0 ulelong 0x190A \b, LUMINANCE_ALPHA 21398>0 ulelong 0x80E1 \b, BGR 21399>0 ulelong 0x80E2 \b, BGRA 21400>0 ulelong 0x83A0 \b, RGB_S3TC 21401>0 ulelong 0x83A1 \b, RGB4_S3TC 21402>0 ulelong 0x83A2 \b, RGBA_S3TC 21403>0 ulelong 0x83A3 \b, RGBA4_S3TC 21404>0 ulelong 0x83A4 \b, RGBA_DXT5_S3TC 21405>0 ulelong 0x83A5 \b, RGBA4_DXT5_S3TC 21406>0 ulelong 0x83F0 \b, COMPRESSED_RGB_S3TC_DXT1_EXT 21407>0 ulelong 0x83F1 \b, COMPRESSED_RGBA_S3TC_DXT1_EXT 21408>0 ulelong 0x83F2 \b, COMPRESSED_RGBA_S3TC_DXT3_EXT 21409>0 ulelong 0x83F3 \b, COMPRESSED_RGBA_S3TC_DXT5_EXT 21410>0 ulelong 0x8D64 \b, ETC1_RGB8_OES 21411>0 ulelong 0x9270 \b, COMPRESSED_R11_EAC 21412>0 ulelong 0x9271 \b, COMPRESSED_SIGNED_R11_EAC 21413>0 ulelong 0x9272 \b, COMPRESSED_RG11_EAC 21414>0 ulelong 0x9273 \b, COMPRESSED_SIGNED_RG11_EAC 21415>0 ulelong 0x9274 \b, COMPRESSED_RGB8_ETC2 21416>0 ulelong 0x9275 \b, COMPRESSED_SRGB8_ETC2 21417>0 ulelong 0x9276 \b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2 21418>0 ulelong 0x9277 \b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2 21419>0 ulelong 0x9278 \b, COMPRESSED_RGBA2_ETC2_EAC 21420>0 ulelong 0x9279 \b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC 21421>0 ulelong 0x93B0 \b, COMPRESSED_RGBA_ASTC_4x4_KHR 21422>0 ulelong 0x93B1 \b, COMPRESSED_RGBA_ASTC_5x4_KHR 21423>0 ulelong 0x93B2 \b, COMPRESSED_RGBA_ASTC_5x5_KHR 21424>0 ulelong 0x93B3 \b, COMPRESSED_RGBA_ASTC_6x5_KHR 21425>0 ulelong 0x93B4 \b, COMPRESSED_RGBA_ASTC_6x6_KHR 21426>0 ulelong 0x93B5 \b, COMPRESSED_RGBA_ASTC_8x5_KHR 21427>0 ulelong 0x93B6 \b, COMPRESSED_RGBA_ASTC_8x6_KHR 21428>0 ulelong 0x93B7 \b, COMPRESSED_RGBA_ASTC_8x8_KHR 21429>0 ulelong 0x93B8 \b, COMPRESSED_RGBA_ASTC_10x5_KHR 21430>0 ulelong 0x93B9 \b, COMPRESSED_RGBA_ASTC_10x6_KHR 21431>0 ulelong 0x93BA \b, COMPRESSED_RGBA_ASTC_10x8_KHR 21432>0 ulelong 0x93BB \b, COMPRESSED_RGBA_ASTC_10x10_KHR 21433>0 ulelong 0x93BC \b, COMPRESSED_RGBA_ASTC_12x10_KHR 21434>0 ulelong 0x93BD \b, COMPRESSED_RGBA_ASTC_12x12_KHR 21435>0 ulelong 0x93D0 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR 21436>0 ulelong 0x93D1 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR 21437>0 ulelong 0x93D2 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR 21438>0 ulelong 0x93D3 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR 21439>0 ulelong 0x93D4 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR 21440>0 ulelong 0x93D5 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR 21441>0 ulelong 0x93D6 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR 21442>0 ulelong 0x93D7 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR 21443>0 ulelong 0x93D8 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR 21444>0 ulelong 0x93D9 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR 21445>0 ulelong 0x93DA \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR 21446>0 ulelong 0x93DB \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR 21447>0 ulelong 0x93DC \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR 21448>0 ulelong 0x93DD \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR 21449 21450# Endian-specific KTX header. 21451# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE) 214520 name khronos-ktx-endian-header 21453>20 ulelong x \b, %u 21454>24 ulelong >1 x %u 21455>28 ulelong >1 x %u 21456>8 ulelong >0 21457>>8 use khronos-ktx-glEnum 21458>8 ulelong 0 21459>>12 use khronos-ktx-glEnum 21460 21461# Main KTX header. 21462# Determine endianness, then check the rest of the header. 214630 string \xABKTX\ 11\xBB\r\n\x1A\n Khronos KTX texture 21464>12 ulelong 0x04030201 (little-endian) 21465>>16 use khronos-ktx-endian-header 21466>12 ubelong 0x04030201 (big-endian) 21467>>16 use \^khronos-ktx-endian-header 21468 21469# Type: Khronos KTX2 texture. 21470# From: David Korth <gerbilsoft@gerbilsoft.com> 21471# Based on draft19. 21472# Reference: http://github.khronos.org/KTX-Specification/ 21473 21474# Supercompression enum. 214750 name khronos-ktx2-supercompression 21476>0 ulelong 1 BasisLZ 21477>0 ulelong 2 Zstandard 21478>0 ulelong 3 ZLIB 21479 21480# Vulkan format identifier. 21481# NOTE: Formats prohibited from KTX2 are commented out. 214820 name khronos-ktx2-vkFormat 21483>0 ulelong 0 UNDEFINED 21484>0 ulelong 1 R4G4_UNORM_PACK8 21485>0 ulelong 2 R4G4B4A4_UNORM_PACK16 21486>0 ulelong 3 B4G4R4A4_UNORM_PACK16 21487>0 ulelong 4 R5G6B5_UNORM_PACK16 21488>0 ulelong 5 B5G6R5_UNORM_PACK16 21489>0 ulelong 6 R5G5B5A1_UNORM_PACK16 21490>0 ulelong 7 B5G5R5A1_UNORM_PACK16 21491>0 ulelong 8 A1R5G5B5_UNORM_PACK16 21492>0 ulelong 9 R8_UNORM 21493>0 ulelong 10 R8_SNORM 21494#>0 ulelong 11 R8_USCALED 21495#>0 ulelong 12 R8_SSCALED 21496>0 ulelong 13 R8_UINT 21497>0 ulelong 14 R8_SINT 21498>0 ulelong 15 R8_SRGB 21499>0 ulelong 16 R8G8_UNORM 21500>0 ulelong 17 R8G8_SNORM 21501#>0 ulelong 18 R8G8_USCALED 21502#>0 ulelong 19 R8G8_SSCALED 21503>0 ulelong 20 R8G8_UINT 21504>0 ulelong 21 R8G8_SINT 21505>0 ulelong 22 R8G8_SRGB 21506>0 ulelong 23 R8G8B8_UNORM 21507>0 ulelong 24 R8G8B8_SNORM 21508#>0 ulelong 25 R8G8B8_USCALED 21509#>0 ulelong 26 R8G8B8_SSCALED 21510>0 ulelong 27 R8G8B8_UINT 21511>0 ulelong 28 R8G8B8_SINT 21512>0 ulelong 29 R8G8B8_SRGB 21513>0 ulelong 30 B8G8R8_UNORM 21514>0 ulelong 31 B8G8R8_SNORM 21515#>0 ulelong 32 B8G8R8_USCALED 21516#>0 ulelong 33 B8G8R8_SSCALED 21517>0 ulelong 34 B8G8R8_UINT 21518>0 ulelong 35 B8G8R8_SINT 21519>0 ulelong 36 B8G8R8_SRGB 21520>0 ulelong 37 R8G8B8A8_UNORM 21521>0 ulelong 38 R8G8B8A8_SNORM 21522#>0 ulelong 39 R8G8B8A8_USCALED 21523#>0 ulelong 40 R8G8B8A8_SSCALED 21524>0 ulelong 41 R8G8B8A8_UINT 21525>0 ulelong 42 R8G8B8A8_SINT 21526>0 ulelong 43 R8G8B8A8_SRGB 21527>0 ulelong 44 B8G8R8A8_UNORM 21528>0 ulelong 45 B8G8R8A8_SNORM 21529#>0 ulelong 46 B8G8R8A8_USCALED 21530#>0 ulelong 47 B8G8R8A8_SSCALED 21531>0 ulelong 48 B8G8R8A8_UINT 21532>0 ulelong 49 B8G8R8A8_SINT 21533>0 ulelong 50 B8G8R8A8_SRGB 21534#>0 ulelong 51 A8B8G8R8_UNORM_PACK32 21535#>0 ulelong 52 A8B8G8R8_SNORM_PACK32 21536#>0 ulelong 53 A8B8G8R8_USCALED_PACK32 21537#>0 ulelong 54 A8B8G8R8_SSCALED_PACK32 21538#>0 ulelong 55 A8B8G8R8_UINT_PACK32 21539#>0 ulelong 56 A8B8G8R8_SINT_PACK32 21540#>0 ulelong 57 A8B8G8R8_SRGB_PACK32 21541>0 ulelong 58 A2R10G10B10_UNORM_PACK32 21542>0 ulelong 59 A2R10G10B10_SNORM_PACK32 21543#>0 ulelong 60 A2R10G10B10_USCALED_PACK32 21544#>0 ulelong 61 A2R10G10B10_SSCALED_PACK32 21545>0 ulelong 62 A2R10G10B10_UINT_PACK32 21546>0 ulelong 63 A2R10G10B10_SINT_PACK32 21547>0 ulelong 64 A2B10G10R10_UNORM_PACK32 21548>0 ulelong 65 A2B10G10R10_SNORM_PACK32 21549#>0 ulelong 66 A2B10G10R10_USCALED_PACK32 21550#>0 ulelong 67 A2B10G10R10_SSCALED_PACK32 21551>0 ulelong 68 A2B10G10R10_UINT_PACK32 21552>0 ulelong 69 A2B10G10R10_SINT_PACK32 21553>0 ulelong 70 R16_UNORM 21554>0 ulelong 71 R16_SNORM 21555#>0 ulelong 72 R16_USCALED 21556#>0 ulelong 73 R16_SSCALED 21557>0 ulelong 74 R16_UINT 21558>0 ulelong 75 R16_SINT 21559>0 ulelong 76 R16_SFLOAT 21560>0 ulelong 77 R16G16_UNORM 21561>0 ulelong 78 R16G16_SNORM 21562#>0 ulelong 79 R16G16_USCALED 21563#>0 ulelong 80 R16G16_SSCALED 21564>0 ulelong 81 R16G16_UINT 21565>0 ulelong 82 R16G16_SINT 21566>0 ulelong 83 R16G16_SFLOAT 21567>0 ulelong 84 R16G16B16_UNORM 21568>0 ulelong 85 R16G16B16_SNORM 21569#>0 ulelong 86 R16G16B16_USCALED 21570#>0 ulelong 87 R16G16B16_SSCALED 21571>0 ulelong 88 R16G16B16_UINT 21572>0 ulelong 89 R16G16B16_SINT 21573>0 ulelong 90 R16G16B16_SFLOAT 21574>0 ulelong 91 R16G16B16A16_UNORM 21575>0 ulelong 92 R16G16B16A16_SNORM 21576#>0 ulelong 93 R16G16B16A16_USCALED 21577#>0 ulelong 94 R16G16B16A16_SSCALED 21578>0 ulelong 95 R16G16B16A16_UINT 21579>0 ulelong 96 R16G16B16A16_SINT 21580>0 ulelong 97 R16G16B16A16_SFLOAT 21581>0 ulelong 98 R32_UINT 21582>0 ulelong 99 R32_SINT 21583>0 ulelong 100 R32_SFLOAT 21584>0 ulelong 101 R32G32_UINT 21585>0 ulelong 102 R32G32_SINT 21586>0 ulelong 103 R32G32_SFLOAT 21587>0 ulelong 104 R32G32B32_UINT 21588>0 ulelong 105 R32G32B32_SINT 21589>0 ulelong 106 R32G32B32_SFLOAT 21590>0 ulelong 107 R32G32B32A32_UINT 21591>0 ulelong 108 R32G32B32A32_SINT 21592>0 ulelong 109 R32G32B32A32_SFLOAT 21593>0 ulelong 110 R64_UINT 21594>0 ulelong 111 R64_SINT 21595>0 ulelong 112 R64_SFLOAT 21596>0 ulelong 113 R64G64_UINT 21597>0 ulelong 114 R64G64_SINT 21598>0 ulelong 115 R64G64_SFLOAT 21599>0 ulelong 116 R64G64B64_UINT 21600>0 ulelong 117 R64G64B64_SINT 21601>0 ulelong 118 R64G64B64_SFLOAT 21602>0 ulelong 119 R64G64B64A64_UINT 21603>0 ulelong 120 R64G64B64A64_SINT 21604>0 ulelong 121 R64G64B64A64_SFLOAT 21605>0 ulelong 122 B10G11R11_UFLOAT_PACK32 21606>0 ulelong 123 E5B9G9R9_UFLOAT_PACK32 21607>0 ulelong 124 D16_UNORM 21608>0 ulelong 125 X8_D24_UNORM_PACK32 21609>0 ulelong 126 D32_SFLOAT 21610>0 ulelong 127 S8_UINT 21611>0 ulelong 128 D16_UNORM_S8_UINT 21612>0 ulelong 129 D24_UNORM_S8_UINT 21613>0 ulelong 130 D32_SFLOAT_S8_UINT 21614 21615>0 ulelong 131 BC1_RGB_UNORM_BLOCK 21616>0 ulelong 132 BC1_RGB_SRGB_BLOCK 21617>0 ulelong 133 BC1_RGBA_UNORM_BLOCK 21618>0 ulelong 134 BC1_RGBA_SRGB_BLOCK 21619>0 ulelong 135 BC2_UNORM_BLOCK 21620>0 ulelong 136 BC2_SRGB_BLOCK 21621>0 ulelong 137 BC3_UNORM_BLOCK 21622>0 ulelong 138 BC3_SRGB_BLOCK 21623>0 ulelong 139 BC4_UNORM_BLOCK 21624>0 ulelong 140 BC4_SNORM_BLOCK 21625>0 ulelong 141 BC5_UNORM_BLOCK 21626>0 ulelong 142 BC5_SNORM_BLOCK 21627>0 ulelong 143 BC6H_UFLOAT_BLOCK 21628>0 ulelong 144 BC6H_SFLOAT_BLOCK 21629>0 ulelong 145 BC7_UNORM_BLOCK 21630>0 ulelong 146 BC7_SRGB_BLOCK 21631 21632>0 ulelong 147 ETC2_R8G8B8_UNORM_BLOCK 21633>0 ulelong 148 ETC2_R8G8B8_SRGB_BLOCK 21634>0 ulelong 149 ETC2_R8G8B8A1_UNORM_BLOCK 21635>0 ulelong 150 ETC2_R8G8B8A1_SRGB_BLOCK 21636>0 ulelong 151 ETC2_R8G8B8A8_UNORM_BLOCK 21637>0 ulelong 152 ETC2_R8G8B8A8_SRGB_BLOCK 21638 21639>0 ulelong 153 EAC_R11_UNORM_BLOCK 21640>0 ulelong 154 EAC_R11_SNORM_BLOCK 21641>0 ulelong 155 EAC_R11G11_UNORM_BLOCK 21642>0 ulelong 156 EAC_R11G11_SNORM_BLOCK 21643 21644>0 ulelong 157 ASTC_4x4_UNORM_BLOCK 21645>0 ulelong 158 ASTC_4x4_SRGB_BLOCK 21646>0 ulelong 159 ASTC_5x4_UNORM_BLOCK 21647>0 ulelong 160 ASTC_5x4_SRGB_BLOCK 21648>0 ulelong 161 ASTC_5x5_UNORM_BLOCK 21649>0 ulelong 162 ASTC_5x5_SRGB_BLOCK 21650>0 ulelong 163 ASTC_6x5_UNORM_BLOCK 21651>0 ulelong 164 ASTC_6x5_SRGB_BLOCK 21652>0 ulelong 165 ASTC_6x6_UNORM_BLOCK 21653>0 ulelong 166 ASTC_6x6_SRGB_BLOCK 21654>0 ulelong 167 ASTC_8x5_UNORM_BLOCK 21655>0 ulelong 168 ASTC_8x5_SRGB_BLOCK 21656>0 ulelong 169 ASTC_8x6_UNORM_BLOCK 21657>0 ulelong 170 ASTC_8x6_SRGB_BLOCK 21658>0 ulelong 171 ASTC_8x8_UNORM_BLOCK 21659>0 ulelong 172 ASTC_8x8_SRGB_BLOCK 21660>0 ulelong 173 ASTC_10x5_UNORM_BLOCK 21661>0 ulelong 174 ASTC_10x5_SRGB_BLOCK 21662>0 ulelong 175 ASTC_10x6_UNORM_BLOCK 21663>0 ulelong 176 ASTC_10x6_SRGB_BLOCK 21664>0 ulelong 177 ASTC_10x8_UNORM_BLOCK 21665>0 ulelong 178 ASTC_10x8_SRGB_BLOCK 21666>0 ulelong 179 ASTC_10x10_UNORM_BLOCK 21667>0 ulelong 180 ASTC_10x10_SRGB_BLOCK 21668>0 ulelong 181 ASTC_12x10_UNORM_BLOCK 21669>0 ulelong 182 ASTC_12x10_SRGB_BLOCK 21670>0 ulelong 183 ASTC_12x12_UNORM_BLOCK 21671>0 ulelong 184 ASTC_12x12_SRGB_BLOCK 21672 21673>0 ulelong 1000156000 G8B8G8R8_422_UNORM 21674>0 ulelong 1000156001 B8G8R8G8_422_UNORM 21675>0 ulelong 1000156002 G8_B8_R8_3PLANE_420_UNORM 21676>0 ulelong 1000156003 G8_B8R8_2PLANE_420_UNORM 21677>0 ulelong 1000156004 G8_B8_R8_3PLANE_422_UNORM 21678>0 ulelong 1000156005 G8_B8R8_2PLANE_422_UNORM 21679>0 ulelong 1000156006 G8_B8_R8_3PLANE_444_UNORM 21680>0 ulelong 1000156007 R10X6_UNORM_PACK16 21681>0 ulelong 1000156008 R10X6G10X6_UNORM_2PACK16 21682>0 ulelong 1000156009 R10X6G10X6B10X6A10X6_UNORM_4PACK16 21683>0 ulelong 1000156010 G10X6B10X6G10X6R10X6_422_UNORM_4PACK16 21684>0 ulelong 1000156011 B10X6G10X6R10X6G10X6_422_UNORM_4PACK16 21685>0 ulelong 1000156012 G10X6_B10X6_R10X6_3PLANE_420_UNORM_3PACK16 21686>0 ulelong 1000156013 G10X6_B10X6R10X6_2PLANE_420_UNORM_3PACK16 21687>0 ulelong 1000156014 G10X6_B10X6_R10X6_3PLANE_422_UNORM_3PACK16 21688>0 ulelong 1000156015 G10X6_B10X6R10X6_2PLANE_422_UNORM_3PACK16 21689>0 ulelong 1000156016 G10X6_B10X6_R10X6_3PLANE_444_UNORM_3PACK16 21690>0 ulelong 1000156017 R12X4_UNORM_PACK16 21691>0 ulelong 1000156018 R12X4G12X4_UNORM_2PACK16 21692>0 ulelong 1000156019 R12X4G12X4B12X4A12X4_UNORM_4PACK16 21693>0 ulelong 1000156020 G12X4B12X4G12X4R12X4_422_UNORM_4PACK16 21694>0 ulelong 1000156021 B12X4G12X4R12X4G12X4_422_UNORM_4PACK16 21695>0 ulelong 1000156022 G12X4_B12X4_R12X4_3PLANE_420_UNORM_3PACK16 21696>0 ulelong 1000156023 G12X4_B12X4R12X4_2PLANE_420_UNORM_3PACK16 21697>0 ulelong 1000156024 G12X4_B12X4_R12X4_3PLANE_422_UNORM_3PACK16 21698>0 ulelong 1000156025 G12X4_B12X4R12X4_2PLANE_422_UNORM_3PACK16 21699>0 ulelong 1000156026 G12X4_B12X4_R12X4_3PLANE_444_UNORM_3PACK16 21700>0 ulelong 1000156027 G16B16G16R16_422_UNORM 21701>0 ulelong 1000156028 B16G16R16G16_422_UNORM 21702>0 ulelong 1000156029 G16_B16_R16_3PLANE_420_UNORM 21703>0 ulelong 1000156030 G16_B16R16_2PLANE_420_UNORM 21704>0 ulelong 1000156031 G16_B16_R16_3PLANE_422_UNORM 21705>0 ulelong 1000156032 G16_B16R16_2PLANE_422_UNORM 21706>0 ulelong 1000156033 G16_B16_R16_3PLANE_444_UNORM 21707 21708>0 ulelong 1000054000 PVRTC1_2BPP_UNORM_BLOCK_IMG 21709>0 ulelong 1000054001 PVRTC1_4BPP_UNORM_BLOCK_IMG 21710>0 ulelong 1000054002 PVRTC2_2BPP_UNORM_BLOCK_IMG 21711>0 ulelong 1000054003 PVRTC2_4BPP_UNORM_BLOCK_IMG 21712>0 ulelong 1000054004 PVRTC1_2BPP_SRGB_BLOCK_IMG 21713>0 ulelong 1000054005 PVRTC1_4BPP_SRGB_BLOCK_IMG 21714>0 ulelong 1000054006 PVRTC2_2BPP_SRGB_BLOCK_IMG 21715>0 ulelong 1000054007 PVRTC2_4BPP_SRGB_BLOCK_IMG 21716 21717>0 ulelong 1000066000 ASTC_4x4_SFLOAT_BLOCK_EXT 21718>0 ulelong 1000066001 ASTC_5x4_SFLOAT_BLOCK_EXT 21719>0 ulelong 1000066002 ASTC_5x5_SFLOAT_BLOCK_EXT 21720>0 ulelong 1000066003 ASTC_6x5_SFLOAT_BLOCK_EXT 21721>0 ulelong 1000066004 ASTC_6x6_SFLOAT_BLOCK_EXT 21722>0 ulelong 1000066005 ASTC_8x5_SFLOAT_BLOCK_EXT 21723>0 ulelong 1000066006 ASTC_8x6_SFLOAT_BLOCK_EXT 21724>0 ulelong 1000066007 ASTC_8x8_SFLOAT_BLOCK_EXT 21725>0 ulelong 1000066008 ASTC_10x5_SFLOAT_BLOCK_EXT 21726>0 ulelong 1000066009 ASTC_10x6_SFLOAT_BLOCK_EXT 21727>0 ulelong 1000066010 ASTC_10x8_SFLOAT_BLOCK_EXT 21728>0 ulelong 1000066011 ASTC_10x10_SFLOAT_BLOCK_EXT 21729>0 ulelong 1000066012 ASTC_12x10_SFLOAT_BLOCK_EXT 21730>0 ulelong 1000066013 ASTC_12x12_SFLOAT_BLOCK_EXT 21731 21732# Main KTX2 header. 217330 string \xABKTX\ 20\xBB\r\n\x1A\n Khronos KTX2 texture 21734>20 ulelong x \b, %u 21735>24 ulelong >1 x %u 21736>28 ulelong >1 x %u 21737>32 ulelong >1 \b, %u layers 21738>36 ulelong >1 \b, %u faces 21739>40 ulelong >1 \b, %u mipmaps 21740>44 ulelong >0 \b, 21741>>44 use khronos-ktx2-supercompression 21742>12 ulelong >0 \b, 21743>>12 use khronos-ktx2-vkFormat 21744 21745# Type: Valve VTF texture. 21746# From: David Korth <gerbilsoft@gerbilsoft.com> 21747# References: 21748# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format 21749 21750# VTF image formats. 217510 name vtf-image-format 21752>0 ulelong 0 RGBA8888 21753>0 ulelong 1 ABGR8888 21754>0 ulelong 2 RGB888 21755>0 ulelong 3 BGR888 21756>0 ulelong 4 RGB565 21757>0 ulelong 5 I8 21758>0 ulelong 6 IA88 21759>0 ulelong 7 P8 21760>0 ulelong 8 A8 21761>0 ulelong 9 RGB888 (bluescreen) 21762>0 ulelong 10 BGR888 (bluescreen) 21763>0 ulelong 11 ARGB8888 21764>0 ulelong 12 BGRA8888 21765>0 ulelong 13 DXT1 21766>0 ulelong 14 DXT3 21767>0 ulelong 15 DXT5 21768>0 ulelong 16 BGRx8888 21769>0 ulelong 17 BGR565 21770>0 ulelong 18 BGRx5551 21771>0 ulelong 19 BGRA4444 21772>0 ulelong 20 DXT1+A1 21773>0 ulelong 21 BGRA5551 21774>0 ulelong 22 UV88 21775>0 ulelong 23 UVWQ8888 21776>0 ulelong 24 RGBA16161616F 21777>0 ulelong 25 RGBA16161616 21778>0 ulelong 26 UVLX8888 21779 21780# Main VTF header. 217810 string VTF\0 Valve Texture Format 21782>4 ulelong x v%u 21783>8 ulelong x \b.%u 21784>0x10 uleshort x \b, %u 21785>0x12 uleshort >1 x %u 21786>4 lequad 0x0000000700000002 21787>>0x3F uleshort >1 x %u 21788>0x18 uleshort >1 \b, %u frames 21789>0x38 ubyte x \b, mipmaps: %u 21790>0x34 ulelong >-1 \b, 21791>>0x34 use vtf-image-format 21792 21793# Type: Valve VTF3 (PS3) texture. 21794# From: David Korth <gerbilsoft@gerbilsoft.com> 217950 string VTF3 Valve Texture Format (PS3) 21796>0x14 ubeshort x \b, %u 21797>0x16 ubeshort x \b x %u 21798>0x10 ubelong&0x2000 0 \b, DXT1 21799>0x10 ubelong&0x2000 0x2000 \b, DXT5 21800 21801# Type: ASTC texture. 21802# From: David Korth <gerbilsoft@gerbilsoft.com> 21803# References: 21804# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header 21805# - https://stackoverflow.com/a/22682244 218060 ulelong 0x5ca1ab13 ASTC 21807>4 ubyte x %u 21808>5 ubyte x \bx%u 21809>6 ubyte >1 \bx%u 21810# X, Y, and Z dimensions are stored as 24-bit LE. 21811# Pretend it's 32-bit and mask off the high byte. 21812>7 ulelong&0x00FFFFFF x texture, %u 21813>10 ulelong&0x00FFFFFF x x %u 21814>13 ulelong&0x00FFFFFF >1 x %u 21815 21816# Zebra Metafile graphic 21817# http://www.fileformat.info/format/zbr/egff.htm 218180 ubeshort 0x9a02 Zebra Metafile graphic 21819>2 uleshort 1 (version 1.x) 21820>2 uleshort 2 (version 1.1x or 1.2x) 21821>2 uleshort 3 (version 1.49) 21822>2 uleshort 4 (version 1.50) 21823>4 string x (comment = %s) 21824 21825# Microsoft Paint graphic 21826# http://www.fileformat.info/format/mspaint/egff.htm 218270 string DanM icrosoft Paint image data (version 1.x) 21828>4 uleshort x (%d 21829>>6 uleshort x x %d) 218300 string LinS Microsoft Paint image data (version 2.0) 21831>4 uleshort x (%d 21832>>6 uleshort x x %d) 21833 21834# reMarkable tablet internal file format (https://www.remarkable.com/) 21835# https://github.com/ax3l/lines-are-beautiful 21836# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\ 21837# reMarkable-lines-file-format.html#what-to-do-next 21838# from Axel Huebl 218390 string reMarkable 21840>11 string lines 21841>>17 string with 21842>>>22 string selections 21843>>>>33 string and 21844>>>>>37 string layers 21845>>>>>>43 ulelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s) 21846 21847# newer per-page files for the reMarkable 218480 string reMarkable 21849>11 string .lines 21850>>18 string file, 21851>>>24 string version= 21852>>>>32 ubyte x reMarkable tablet page (v%c), 1404 x 1872, 21853>>>>>43 ulelong x %d layer(s) 21854 21855# Type: PVR3 texture. 21856# From: David Korth <gerbilsoft@gerbilsoft.com> 21857# References: 21858# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf 21859 21860# PVR3 pixel formats. 218610 name pvr3-pixel-format 21862>0 ulelong 0 PVRTC 2bpp RGB 21863>0 ulelong 1 PVRTC 2bpp RGBA 21864>0 ulelong 2 PVRTC 4bpp RGB 21865>0 ulelong 3 PVRTC 4bpp RGBA 21866>0 ulelong 4 PVRTC-II 2bpp 21867>0 ulelong 5 PVRTC-II 4bpp 21868>0 ulelong 6 ETC1 21869>0 ulelong 7 DXT1 21870>0 ulelong 8 DXT2 21871>0 ulelong 9 DXT3 21872>0 ulelong 10 DXT4 21873>0 ulelong 11 DXT5 21874>0 ulelong 12 BC4 21875>0 ulelong 13 BC5 21876>0 ulelong 14 BC6 21877>0 ulelong 15 BC7 21878>0 ulelong 16 UYVY 21879>0 ulelong 17 YUY2 21880>0 ulelong 18 BW1bpp 21881>0 ulelong 19 R9G9B9E5 Shared Exponent 21882>0 ulelong 20 RGBG8888 21883>0 ulelong 21 GRGB8888 21884>0 ulelong 22 ETC2 RGB 21885>0 ulelong 23 ETC2 RGBA 21886>0 ulelong 24 ETC2 RGB A1 21887>0 ulelong 25 EAC R11 21888>0 ulelong 26 EAC RG11 21889>0 ulelong 27 ASTC_4x4 21890>0 ulelong 28 ASTC_5x4 21891>0 ulelong 29 ASTC_5x5 21892>0 ulelong 30 ASTC_6x5 21893>0 ulelong 31 ASTC_6x6 21894>0 ulelong 32 ASTC_8x5 21895>0 ulelong 33 ASTC_8x6 21896>0 ulelong 34 ASTC_8x8 21897>0 ulelong 35 ASTC_10x5 21898>0 ulelong 36 ASTC_10x6 21899>0 ulelong 37 ASTC_10x8 21900>0 ulelong 38 ASTC_10x10 21901>0 ulelong 39 ASTC_12x10 21902>0 ulelong 40 ASTC_12x12 21903>0 ulelong 41 ASTC_3x3x3 21904>0 ulelong 42 ASTC_4x3x3 21905>0 ulelong 43 ASTC_4x4x3 21906>0 ulelong 44 ASTC_4x4x4 21907>0 ulelong 45 ASTC_5x4x4 21908>0 ulelong 46 ASTC_5x5x4 21909>0 ulelong 47 ASTC_5x5x5 21910>0 ulelong 48 ASTC_6x5x5 21911>0 ulelong 49 ASTC_6x6x5 21912>0 ulelong 50 ASTC_6x6x6 21913 219140 string PVR\x03 PowerVR 3.0 texture: 21915>0x18 ulelong x %u x 21916>0x1C ulelong x %u 21917>0x20 ulelong >1 x %u 21918>0x08 ubyte x \b, 21919>0x0C ulelong 0 21920>>0x08 use pvr3-pixel-format 21921>0x0C ulelong !0 21922>>0x08 ubyte !0 %c 21923>>>0x0C ubyte !0 \b%u 21924>>0x09 ubyte !0 \b%c 21925>>>0x0D ubyte !0 \b%u 21926>>0x0A ubyte !0 \b%c 21927>>>0x0E ubyte !0 \b%u 21928>>0x0B ubyte !0 \b%c 21929>>>0x0F ubyte !0 \b%u 21930>0x10 ulelong 1 \b, sRGB 21931>0x04 ulelong&0x02 0x02 \b, premultiplied alpha 21932 219330 string \x03RVP PowerVR 3.0 texture: BE, 21934>0x18 ubelong x %u x 21935>0x1C ubelong x %u 21936>0x20 ubelong >1 x %u 21937>0x08 ubyte x \b, 21938>0x0C ubelong 0 21939>>0x08 use pvr3-pixel-format 21940>0x0C ubelong !0 21941>>0x0B ubyte !0 %c 21942>>>0x0F ubyte !0 \b%u 21943>>0x0A ubyte !0 \b%c 21944>>>0x0E ubyte !0 \b%u 21945>>0x09 ubyte !0 \b%c 21946>>>0x0D ubyte !0 \b%u 21947>>0x08 ubyte !0 \b%c 21948>>>0x0C ubyte !0 \b%u 21949>0x10 ubelong 1 \b, sRGB 21950>0x04 ubelong&0x02 0x02 \b, premultiplied alpha 21951 21952# Type: Microsoft Xbox XPR0 texture. 21953# From: David Korth <gerbilsoft@gerbilsoft.com> 21954# References: 21955# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h 21956 21957# XPR pixel formats. 219580 name xbox-xpr-pixel-format 21959>0 ubyte 0x00 L8 21960>0 ubyte 0x01 AL8 21961>0 ubyte 0x02 ARGB1555 21962>0 ubyte 0x03 RGB555 21963>0 ubyte 0x04 ARGB4444 21964>0 ubyte 0x05 RGB565 21965>0 ubyte 0x06 ARGB8888 21966>0 ubyte 0x07 xRGB8888 21967>0 ubyte 0x0B P8 21968>0 ubyte 0x0C DXT1 21969>0 ubyte 0x0E DXT2 21970>0 ubyte 0x0F DXT4 21971>0 ubyte 0x10 Linear ARGB1555 21972>0 ubyte 0x11 Linear RGB565 21973>0 ubyte 0x12 Linear ARGB8888 21974>0 ubyte 0x13 Linear L8 21975>0 ubyte 0x16 Linear R8B8 21976>0 ubyte 0x17 Linear G8B8 21977>0 ubyte 0x19 A8 21978>0 ubyte 0x1A A8L8 21979>0 ubyte 0x1B Linear AL8 21980>0 ubyte 0x1C Linear RGB555 21981>0 ubyte 0x1D Linear ARGB4444 21982>0 ubyte 0x1E Linear xRGB8888 21983>0 ubyte 0x1F Linear A8 21984>0 ubyte 0x20 Linear A8L8 21985>0 ubyte 0x24 YUY2 21986>0 ubyte 0x25 UYVY 21987>0 ubyte 0x27 L6V5U5 21988>0 ubyte 0x28 V8U8 21989>0 ubyte 0x29 R8B8 21990>0 ubyte 0x2A D24S8 21991>0 ubyte 0x2B F24S8 21992>0 ubyte 0x2C D16 21993>0 ubyte 0x2D F16 21994>0 ubyte 0x2E Linear D24S8 21995>0 ubyte 0x2F Linear F24S8 21996>0 ubyte 0x30 Linear D16 21997>0 ubyte 0x31 Linear F16 21998>0 ubyte 0x32 L16 21999>0 ubyte 0x33 V16U16 22000>0 ubyte 0x35 Linear L16 22001>0 ubyte 0x36 Linear V16U16 22002>0 ubyte 0x37 Linear L6V5U5 22003>0 ubyte 0x38 RGBA5551 22004>0 ubyte 0x39 RGBA4444 22005>0 ubyte 0x3A QWVU8888 22006>0 ubyte 0x3B BGRA8888 22007>0 ubyte 0x3C RGBA8888 22008>0 ubyte 0x3D Linear RGBA5551 22009>0 ubyte 0x3E Linear RGBA4444 22010>0 ubyte 0x3F Linear ABGR8888 22011>0 ubyte 0x40 Linear BGRA8888 22012>0 ubyte 0x41 Linear RGBA8888 22013>0 ubyte 0x64 Vertex Data 22014 220150 string XPR0 Microsoft Xbox XPR0 texture 22016>0x19 ubyte x \b, format: 22017>>0x19 use xbox-xpr-pixel-format 22018 22019# ILDA Image Data Transfer Format 22020# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf 22021# 22022# Updated by Chuck Hein (laser@geekdude.com) 22023# 220240 string ILDA ILDA Image Data Transfer Format 22025>7 ubyte 0x00 3D Coordinates with Indexed Color 22026>7 ubyte 0x01 2D Coordinates with Indexed Color 22027>7 ubyte 0x02 Color Palette 22028>7 ubyte 0x04 3D Coordinates with True Color 22029>7 ubyte 0x05 2D Coordinates with True Color 22030>8 string >0 \b, palette %s 22031>16 string >0 \b, company %s 22032>24 ubeshort >0 \b, number of records %d 22033>>26 ubeshort x \b, palette number %d 22034>>28 ubeshort >0 \b, number of frames %d 22035>>30 ubyte >0 \b, projector number %d 22036 22037# Dropbox "lepton" compressed jpeg format 22038# https://github.com/dropbox/lepton 220390 ubelong&0xfffff0ff 0xcf84005a Lepton image file 22040>2 ubyte x (version %d) 22041 22042# Apple QuickTake camera raw images 22043# https://en.wikipedia.org/wiki/Apple_QuickTake 22044# dcraw can decode them 220450 name quicktake 22046>4 ubelong 8 22047>>544 ubeshort x \b, %dx 22048>>546 ubeshort x \b%d 22049>4 ubelong 4 22050>>546 ubeshort x \b, %dx 22051>>544 ubeshort x \b%d 22052 220530 string qktk Apple QuickTake 100 Raw Image 22054>0 use quicktake 22055 220560 string qktn 22057>4 ubyte 0 Apple QuickTake 150 Raw Image 22058>4 ubyte >0 Apple QuickTake 200 Raw Image 22059>0 use quicktake 22060 22061# From: Joerg Jenderek 22062# URL: http://fileformats.archiveteam.org/wiki/Corel_Photo-Paint_image 22063# Reference: http://blog.argasinski.eu/wp-content/uploads/2011/08/cpt-specification-0.01.pdf 220640 string CPT 22065>4 string FILE Corel Photo-Paint image, version 22066# version like 7, 9 or 8 22067>>3 ubyte x %c, 22068!:mime image/x-corel-cpt 22069!:ext cpt 22070# if blocks_array_offset available jump blockNumber*8 bytes 22071>>0x34 ulelong >0 22072>>>(0x28.l*8) ubyte x 22073# jump additional stored blocks_array_offset bytes forward to object block 22074>>>>&(0x34.l-1) ulelong x %u 22075# object height in pixels 22076>>>>>&0 ulelong x x %u 22077# if no blocks_array_offset available jump blockNumber*8 bytes 22078>>0x34 ulelong =0 22079>>>(0x28.l*8) ubyte x 22080# jump additional 0x13C bytes forward to object block 22081>>>>&0x13B ulelong x %u 22082>>>>>&0 ulelong x x %u 22083# image color model used 22084>>0x8 ulelong x 22085>>>0x8 ulelong 0x1 RGB 24 bits 22086>>>0x8 ulelong 0x3 CMYK 24 bits 22087>>>0x8 ulelong 0x5 greyscale 8 bits 22088>>>0x8 ulelong 0x6 black and white 1 bit 22089>>>0x8 ulelong 0xA RGB 8 bits 22090# palette_length number of colors * 3 in case of 8-bit RGB paletted image 22091# 0 otherwise. Allowed values: 0 or [1..256] * 3 22092#>>0xC ulelong >0 \b, palette length %u 22093>>>>0xC ulelong/3 <256 \b, %u colors 22094>>>0x8 ulelong 0xB LAB 22095>>>0x8 ulelong 0xC RGB 48 bits 22096>>>0x8 ulelong 0xE greyscale 16 bits 22097# this should not happen 22098>>>0x8 default x color model 22099>>>>0x8 ulelong x %#x 22100# bit 1 in CPT file flags: UCS-2 file comment present 22101>>0x31 ubyte &0x02 22102# look for comment marker 22103>>>0x100 search/0xc9d \4\2\0\0 22104# UCS-2 file comment 22105>>>>&0 lestring16 x "%s" 22106# if no UCS-2 is present show ANSI file comment[112] if available 22107>>0x31 ubyte&0x02 =0 22108>>>0x3C string >\0 "%-.112s" 22109# reserved seems to be always 0 22110#>>0x10 ulelong >0 \b, reserved1 %u 22111# horizontal real dpi = dpi_h * 25.4 / 10**6 22112>>0x18 ulelong x \b, %u micro dots/mm 22113# image vertical DPI in CPT DPI unit 22114#>>0x1C ulelong x \b, %u micro dots/mm 22115# reserved seems to be always 0 22116#>>0x20 ulelong >0 \b, reserved2 %u 22117#>>0x24 ulelong >0 \b, reserved3 %u 22118# blocks_count; number of CPT_Block blocks. Allowed values: > 0 22119>>0x28 ulelong x \b, %u block 22120# plural s 22121>>0x28 ulelong !1 \bs 22122# CPT file flags 22123# lower byte of CPT file flags: 0x94~CPT9FILE 0x01~often CPT7FILE 0x8C~CPT8FILE 22124#>>0x30 ubyte x \b, lower flags %#x 22125# upper byte of CPT file flags: 22126#>>0x31 ubyte >0 \b, upper flags %#x 22127# bit 2 in CPT file flags: unknown 22128#>>0x31 ubyte &0x04 \b, with UNKNOWN 22129# bits 3-7 in CPT file flags: unknown, seem to be often 0 22130# show unusual flag combinations 22131>>0x31 ubyte&0xFC >0 22132>>>0x30 uleshort x \b, flags %#4.4x 22133# reserved seems to be always 0 22134#>>0x32 uleshort >0 \b, reserved4 %#x 22135# blocks_array_offset is always 0 for CPT7 and CPT8 files created by PP7-PP8 22136# typical values like: 13Ch 154h 43Ch 4F0h DA8h 22137>>0x34 ulelong x \b, array offset %#x 22138# reserved seems to be often 0 22139>>0x38 ulelong >0 \b, reserved5 %#x 22140# possible next master block 22141#>>0x100 ubequad !0 \b, next block=%#llx... 22142# bit 0: ICC profile block present 22143>>0x31 ubyte &0x01 \b, with ICC profile 22144# check for characteristic string acsp of color profile for DEBUGGING 22145#>>>0x178 string x icc=%.4s 22146# display ICC/ICM color profile by ./icc 22147#>>>0x154 use color-profile 22148 22149# Type: Crunch compressed texture. 22150# From: David Korth <gerbilsoft@gerbilsoft.com> 22151# References: 22152# - https://github.com/BinomialLLC/crunch/blob/44c8402e24441c7524ca364941fd224ab3b971e9/inc/crn_decomp.h#L267 221530 ubelong 0x4878004A Crunch compressed texture: 22154>0x0C ubeshort x %u x 22155>0x0E ubeshort x %u 22156>0x12 ubyte 0 \b, DXT1 22157>0x12 ubyte 1 \b, DXT3 22158>0x12 ubyte 2 \b, DXT5 22159>0x12 ubyte 3 \b, DXT5 CCxY 22160>0x12 ubyte 4 \b, DXT5 xGxR 22161>0x12 ubyte 5 \b, DXT5 xGBR 22162>0x12 ubyte 6 \b, DXT5 AGBR 22163>0x12 ubyte 7 \b, DXn XY 22164>0x12 ubyte 8 \b, DXn YX 22165>0x12 ubyte 9 \b, DXT5 Alpha 22166>0x12 ubyte 10 \b, ETC1 22167>0x10 ubyte >1 \b, %u images 22168>0x11 ubyte >1 \b, %u faces 22169# TODO: Flags at 0x13? (ubeshort) 22170 22171# Type: BasisLZ compressed texture. 22172# From: David Korth <gerbilsoft@gerbilsoft.com> 22173# References: 22174# - https://github.com/BinomialLLC/basis_universal/blob/master/spec/basis_spec.txt 221750 uleshort 0x4273 22176>0x04 uleshort 0x4D BasisLZ 22177>>0x02 uleshort x v%x compressed texture: 22178>>0x14 ubyte 0 ETC1S 22179>>0x14 ubyte 1 UASTC 4x4 22180>>0x0E ulelong&0xFFFFFF >1 \b, %u slices 22181>>0x11 ulelong&0xFFFFFF >1 \b, %u images 22182>>0x15 uleshort&0x02 2 \b, Y-flipped 22183 22184# MIME registration: https://www.iana.org/assignments/media-types/model/e57 22185# Sample files: http://www.libe57.org/data.html 22186# Reference implementation: http://www.libe57.org/ 22187# https://www.ri.cmu.edu/pub_files/2011/1/2011-huber-e57-v3.pdf 221880 string ASTM-E57 ASTM E57 three-dimensional model 22189!:mime model/e57 22190!:ext e57 22191 22192# QOI [Quite OK Image Format] images 22193# (Horia Mihai David, mihaidavid@posteo.net) 22194# 22195# QOI format by Dominic Szablewski <http://phoboslab.org/> 22196# <https://qoiformat.org/> 22197# 22198# Based on spec v1.0 (2022.01.05) <https://qoiformat.org/qoi-specification.pdf> 22199 222000 string qoif QOI image data 22201!:ext qoi 22202!:mime image/x-qoi 22203# See <https://github.com/phoboslab/qoi/issues/167> 22204>4 ubelong x %ux 22205>8 ubelong x \b%u, 22206>>13 ubyte 0 s 22207>>>12 ubyte 3 \bRGB 22208>>>12 ubyte 4 \bRGBA 22209>>>12 default x 22210>>>>12 ubyte x \b*bad channels %u* 22211>>>13 ubyte 0 (linear alpha) 22212>>13 ubyte 1 22213>>>12 ubyte 3 RGB 22214>>>12 ubyte 4 RGBA 22215>>>13 ubyte 1 (all channels linear) 22216>>13 default x 22217>>>13 ubyte x *bad colorspace %u* 22218 22219 22220# Type: Godot 3, 4 texture (pixel format) 22221# From: David Korth <gerbilsoft@gerbilsoft.com> 222220 name godot-pixel-format 22223>0 ulelong&0xFFFFF 0 L8 22224>0 ulelong&0xFFFFF 1 LA8 22225>0 ulelong&0xFFFFF 2 R8 22226>0 ulelong&0xFFFFF 3 RG8 22227>0 ulelong&0xFFFFF 4 RGB8 22228>0 ulelong&0xFFFFF 5 RGBA8 22229>0 ulelong&0xFFFFF 6 RGBA4444 22230>0 ulelong&0xFFFFF 7 RGB565 22231>0 ulelong&0xFFFFF 8 RF 22232>0 ulelong&0xFFFFF 9 RGF 22233>0 ulelong&0xFFFFF 10 RGBF 22234>0 ulelong&0xFFFFF 11 RGBAF 22235>0 ulelong&0xFFFFF 12 RH 22236>0 ulelong&0xFFFFF 13 RGH 22237>0 ulelong&0xFFFFF 14 RGBH 22238>0 ulelong&0xFFFFF 15 RGBAH 22239>0 ulelong&0xFFFFF 16 RGBE9995 22240>0 ulelong&0xFFFFF 17 DXT1 22241>0 ulelong&0xFFFFF 18 DXT3 22242>0 ulelong&0xFFFFF 19 DXT5 22243>0 ulelong&0xFFFFF 20 RGTC_R 22244>0 ulelong&0xFFFFF 21 RGTC_RG 22245>0 ulelong&0xFFFFF 22 BPTC_RGBA 22246>0 ulelong&0xFFFFF 23 BPTC_RGBF 22247>0 ulelong&0xFFFFF 24 BPTC_RGBFU 22248>0 ulelong&0xFFFFF 25 PVRTC1_2 22249>0 ulelong&0xFFFFF 26 PVRTC1_2A 22250>0 ulelong&0xFFFFF 27 PVRTC1_4 22251>0 ulelong&0xFFFFF 28 PVRTC1_4A 22252>0 ulelong&0xFFFFF 29 ETC 22253>0 ulelong&0xFFFFF 30 ETC2_R11 22254>0 ulelong&0xFFFFF 31 ETC2_R11S 22255>0 ulelong&0xFFFFF 32 ETC2_RG11 22256>0 ulelong&0xFFFFF 33 ETC2_RG11S 22257>0 ulelong&0xFFFFF 34 ETC2_RGB8 22258>0 ulelong&0xFFFFF 35 ETC2_RGBA8 22259>0 ulelong&0xFFFFF 36 ETC2_RGB8A1 22260>0 ulelong&0xFFFFF 37 ASTC_8x8 22261 22262# Type: Godot 3, 4 texture (rescale display, width) 22263# From: David Korth <gerbilsoft@gerbilsoft.com> 22264# Shows rescale value if it's not a power of 2. 222650 name godot-rescale-display-w 22266>0 uleshort 0 22267>0 uleshort 1 22268>0 uleshort 2 22269>0 uleshort 4 22270>0 uleshort 8 22271>0 uleshort 16 22272>0 uleshort 32 22273>0 uleshort 64 22274>0 uleshort 128 22275>0 uleshort 256 22276>0 uleshort 512 22277>0 uleshort 1024 22278>0 uleshort 2048 22279>0 uleshort 4096 22280>0 uleshort 8192 22281>0 uleshort 16384 22282>0 uleshort 32768 22283>0 default x 22284>>0 uleshort x (rescale to %u x 22285 22286# Type: Godot 3, 4 texture (rescale display, height) 22287# From: David Korth <gerbilsoft@gerbilsoft.com> 22288# Shows rescale value if it's not a power of 2. 222890 name godot-rescale-display-h 22290>0 clear x 22291>0 uleshort 0 22292>0 uleshort 1 22293>0 uleshort 2 22294>0 uleshort 4 22295>0 uleshort 8 22296>0 uleshort 16 22297>0 uleshort 32 22298>0 uleshort 64 22299>0 uleshort 128 22300>0 uleshort 256 22301>0 uleshort 512 22302>0 uleshort 1024 22303>0 uleshort 2048 22304>0 uleshort 4096 22305>0 uleshort 8192 22306>0 uleshort 16384 22307>0 uleshort 32768 22308>0 default x 22309>>0 uleshort x %u) 22310 22311# Type: Godot 3 texture 22312# From: David Korth <gerbilsoft@gerbilsoft.com> 22313# References: 22314# - https://github.com/godotengine/godot/blob/3.3/core/image.h 22315# - https://github.com/godotengine/godot/blob/3.3/scene/resources/texture.cpp 22316# - https://github.com/godotengine/godot/blob/3.3/scene/resources/texture.h 22317# TODO: Don't show "rescale to" if it matches the image size. 223180 string GDST Godot 3 texture: 22319!:ext stex 22320!:mime image/x-godot-stex 22321>4 uleshort x %u x 22322>8 uleshort x %u 22323>6 uleshort 0 \b, 22324>6 uleshort !0 22325>>6 use godot-rescale-display-w 22326>>10 use godot-rescale-display-h 22327>>10 uleshort x \b, 22328>16 ulelong&0x800000 !0 has mipmaps, 22329>16 ulelong&0x100000 0x100000 lossless encoding 22330>16 ulelong&0x200000 0x200000 lossy encoding 22331>16 ulelong&0x300000 0 22332>>16 use godot-pixel-format 22333 22334# Type: Godot 4 texture 22335# From: David Korth <gerbilsoft@gerbilsoft.com> 22336# References: 22337# - https://github.com/godotengine/godot/blob/master/core/io/image.h 22338# - https://github.com/godotengine/godot/blob/master/scene/resources/texture.cpp 22339# - https://github.com/godotengine/godot/blob/master/scene/resources/texture.h 22340# TODO: Don't show "rescale to" if it matches the image size. 223410 string GST2 Godot 4 texture 22342!:ext stex 22343!:mime image/x-godot-stex 22344>4 ulelong x v%u: 22345>0x28 uleshort x %u x 22346>0x2A uleshort x %u 22347>8 use godot-rescale-display-w 22348>12 use godot-rescale-display-h 22349>12 uleshort x \b, 22350>0x2C ulelong >1 %u mipmaps, 22351>0x30 use godot-pixel-format 22352>0x24 ulelong 1 \b, embedded PNG image 22353>0x24 ulelong 2 \b, embedded WebP image 22354>0x24 ulelong 3 \b, Basis Universal 22355 22356# Summary: iCEDraw graphic *.IDF 22357# URL: http://fileformats.archiveteam.org/wiki/ICEDraw 22358# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/idf-icedraw.trid.xml 22359# From: Joerg Jenderek 22360# Note: called "iCEDraw graphic" by TrID, "iCEDraw text" by FFmpeg and "iCE Draw" by Ansilove 22361# verified by FFmpeg command `ffprobe ICE-9605.IDF` and `ansilove -s SQ-FORCE.IDF` 223620 string \0041.4\0\0\0\0O\0 iCEDraw graphic 22363#!:mime application/octet-stream 22364!:mime image/x-idf 22365!:ext idf 22366 22367#------------------------------------------------------------------------------ 22368# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 22369# inform: file(1) magic for Inform interactive fiction language 22370 22371# URL: http://www.inform-fiction.org/ 22372# From: Reuben Thomas <rrt@sc3d.org> 22373 223740 search/100/cW constant\ story Inform source text 22375 22376#------------------------------------------------------------------------------ 22377# $File: intel,v 1.22 2022/04/02 14:47:42 christos Exp $ 22378# intel: file(1) magic for x86 Unix 22379# 22380# Various flavors of x86 UNIX executable/object (other than Xenix, which 22381# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 22382# Windows as well. 22383# 22384# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 22385# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 22386# as well, if, as, and when IBM makes it portable. 22387# 22388# The `versions' should be un-commented if they work for you. 22389# (Was the problem just one of endianness?) 22390# 223910 leshort 0502 basic-16 executable 22392>12 lelong >0 not stripped 22393#>22 leshort >0 - version %d 223940 leshort 0503 basic-16 executable (TV) 22395>12 lelong >0 not stripped 22396#>22 leshort >0 - version %d 223970 leshort 0510 x86 executable 22398>12 lelong >0 not stripped 223990 leshort 0511 x86 executable (TV) 22400>12 lelong >0 not stripped 224010 leshort =0512 iAPX 286 executable small model (COFF) 22402>12 lelong >0 not stripped 22403#>22 leshort >0 - version %d 224040 leshort =0522 iAPX 286 executable large model (COFF) 22405>12 lelong >0 not stripped 22406#>22 leshort >0 - version %d 22407# updated by Joerg Jenderek at Oct 2015 22408# https://de.wikipedia.org/wiki/Common_Object_File_Format 22409# http://www.delorie.com/djgpp/doc/coff/filhdr.html 22410# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file" 22411# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" 22412# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 224130 leshort =0514 22414# use subroutine to display name+flags+variables for common object formatted files 22415>0 use display-coff 22416#>12 lelong >0 not stripped 22417# no hint found, that at offset 22 is version 22418#>22 leshort >0 - version %d 224190 leshort 0x0200 22420# no F_EXEC flag bit implies Intel ia64 COFF object file without optional header 22421>18 leshort ^0x0002 22422# skip some DEGAS high-res uncompressed bitmap *.pi3 handled by ./images like 22423# GEMINI03.PI3 MODEM2.PI3 POWERFIX.PI3 sigirl1.pi3 vanna5.pi3 22424# by test for valid starting character (often point 0x2E) of 1st section name 22425>>20 ubyte >0x1F 22426>>>0 use display-coff 22427# F_EXEC flag bit implies Intel ia64 COFF executable 22428>18 leshort &0x0002 22429>>0 use display-coff 224300 leshort 0x8664 22431>0 use display-coff 22432 22433# rom: file(1) magic for BIOS ROM Extensions found in intel machines 22434# mapped into memory between 0xC0000 and 0xFFFFF 22435# From: Alex Myczko <alex@aiei.ch> 22436# updated by Joerg Jenderek 22437# https://en.wikipedia.org/wiki/Option_ROM 22438# URL: http://fileformats.archiveteam.org/wiki/BIOS 22439# Reference: http://www.lejabeach.com/sisubb/BIOS_Disassembly_Ninjutsu_Uncovered.pdf 224400 beshort 0x55AA 22441# skip misidentified raspberry pi pieeprom-*.bin by check for 22442# unlikely high ROM size (0xF0*512=240*512) and not observed start instruction 0x0F 22443>2 ubeshort !0xF00F 22444# skip 2 byte sized eof.bin with start magic 22445>>0 use rom-x86 224460 name rom-x86 22447>0 beshort x BIOS (ia32) ROM Ext. 22448#!:mime application/octet-stream 22449!:mime application/x-ibm-rom 22450!:ext rom/bin 22451################################################################################ 22452# not Plug aNd Play ($PnP) like 00000000 (ide_xtp.bin kvmvapic.bin V7VGA.ROM) 000000fc (MCT-VGA.bin) 22453# 55aaf00f (pieeprom-*.bin) 55aa40e9 (Trm3x5.bin) 24506f4f (sgabios-bin.rom) 22454# 55aa4be9 (vgabios-stdvga.rom vgabios-cirrus-bin.rom vgabios-vmware-bin.rom) 22455>(26.s) ubelong !0x24506e50 22456#>(26.s) ubelong !0x24506e50 NOT PNP=%8.8x 22457# also not PCI (PCIR) implies "old" ISA cards or foo like: 8a168404 (MCT-VGA.bin) 22458# 55aaf00f (pieeprom*.bin) 22459>>(24.s) ubelong !0x50434952 22460#>>(24.s) ubelong !0x50434952 ISA CARD=%8.8x 22461# "old" identification strings used in file version 5.41 and earlier 22462# probably an USB controller 22463>>>5 string USB USB 22464# probably https://en.wikipedia.org/wiki/Preboot_Execution_Environment 22465>>>7 string LDR UNDI image 22466# probably another Adaptec SCSI controller 22467>>>26 string Adaptec Adaptec 22468# http://minuszerodegrees.net/rom/bin/adaptec_aha1542cp_bios_908501-00.bin 22469# already done by PNP variant 22470#>>>28 string Adaptec Adaptec 22471# probably Promise SCSI controller 22472>>>42 string PROMISE Promise 22473# old test for IBM compatible Video cards; INTERNAL FACTS WHY IS THIS WORKING? 22474>30 string IBM IBM comp. Video 22475# display exact text for IBM compatible Video cards with longer text 22476>>33 ubyte !0 22477>>>30 string x "%s" 22478# http://minuszerodegrees.net/rom/bin/unknown/MCT-VGA-16%20-%20TDVGA%203588%20BIOS%20Version%20V1.04A.zip 22479# "IBM COMPATIBLETDVGA 3588 BIOS Version V1.04A2+" "MCT-VGA-16 - TDVGA 3588 BIOS Version V1.04A.bin" 22480# "IBM VGA Compatible\001" NVidia44.bin 22481# "IBM EGA ROM Video Seven BIOS Code, Version 1.04" V7VGA.ROM 22482# "IBM" vgabios-stdvga.rom 22483# "IBM" vgabios-vmware-bin.rom: 22484# "IBM" vgabios-cirrus-bin.rom 22485# "IBM" vgabios-virtio-bin.rom 22486################################################################################ 22487# ROM size in 512B blocks must be interpreted as unsigned for ROM of network cards 22488# like: efi-eepro100.rom efi-rtl8139.rom pxe-e1000.rom 22489>2 ubyte x (%u*512) 22490# file name file size calculated size remark 22491# eof.bin 2 - with start magic nothing is shown here 22492# orchid.bin 188 0 =0*512 on window 95 CD in Drivers\audio\orchid3d 22493# multiboot.bin 1024 1024 =2*512 QEMU emulator 22494# loader1.bin 512 2048 =4*512 22495# ide_xtp.bin 8192 8192 =16*512 22496# kvmvapic.bin 9216 9216 =18*512 22497# V7VGA.ROM 18832 16384 =32*512 22498# adaptec1542.bin 32768 16384 =32*512 22499# MCT-VGA.bin 32768 24576 =48*512 22500# 2975BIOS.BIN 32768 32256 =63*512 22501# efi-e1000.rom 196608 64000 =125*512 22502# efi-rtl8139.rom 176640 66048 =129*512 22503# pieeprom*.bin 524288 122880 =240*512 22504################################################################################ 22505# initialization vector with executable code; often near JuMP instruction E9 yy zz 22506>3 ubyte =0xE9 jmp 22507# jmp offset like: 008fh 0093h 009fh 00afh 0143h 3ad7h 5417h 54ech 594dh 895fh 22508>>4 uleshort x %#4.4x 22509# for initialization vector samples without 3 byte jump instruction 22510>3 ubyte !0xE9 instruction 22511# eb4b3734h NVidia44.bin 22512# 00003234h V7VGA.ROM 22513# 060e0731h kvmvapic.bin 22514# cb000000h linuxboot-bin.rom 22515# e80d0fcbh PXE-Intel.rom 22516# b8004875h orchid.bin 22517>>3 ubelong x %#8.8x 22518# For misidetified raspberry pi pieeprom-*.bin like: 0xf00f 22519#>2 ubeshort x \b, AT 2 %#4.4x 22520################################################################################ 22521# new sections for BIOS (ia32) ROM Extension 22522# 4 bytes ASCII Signature "$PnP" for Plug aNd Play expansion header 22523>(26.s) string =$PnP \b; 22524#>(26.s) string =$PnP FOUND $PnP 22525# at 1Ah possible offset to expansion header structure; new for Plug aNd Play 22526>>26 uleshort x at %#x PNP 22527# Plug and Play vendor+device ID like: 0 0x000f1000 (2975BIOS.BIN) 0x31121095 (4243.bin) 0x04904215 (adaptec1542.bin) 22528#>>(26.s+0x0A) ulelong !0 NOT-nullID=%8.8x 22529>>(26.s+0x0A) uleshort !0 22530# show PnP Vendor identification in human readable text form instead of numeric 22531# For adaptec_ava1515_bios_585201-00.bin reverted endian! BUT IS THIS ALWAYS TRUE? 22532>>>(26.s+0x0C) use \^PCI-vendor 22533>>>(26.s+0x0A) ubeshort x device=%#4.4x 22534# 3 byte Device type code; probably the same meaning as in PCI section? 22535# OK for storage controller SCSI (2975BIOS.BIN adaptec1542.bin) 22536# and network controller ethernet (efi-e1000.rom efi-rtl8139.rom) 22537>>(26.s+0x12) use PCI-class 22538# structure revision like: 01h 22539>>(26.s+4) ubyte !1 \b, revision %u 22540# PnP Header structure length in multiple of 16 bytes like: 2 22541>>(26.s+5) uleshort !2 \b, length %u*16 22542# offset to next header; 0 if none 22543>>(26.s+7) uleshort !0 \b, at %#x next header 22544# reserved byte; seems to be zero 22545>>(26.s+8) ubyte !0 \b, reserved %#x 22546# 8-bit checksum for this header; calculated and patched by patch2pnprom 22547>>(26.s+9) ubyte !0 \b, CRC %#x 22548# pointer to optional manufacturer string; like: 0 (4243.bin) 59h 5ch 60h c7h 14eh 27ch 296h 324h 3662h 22549>>(26.s+0x0E) uleshort >0 \b, at %#x 22550>>>(26.s+0x0C) uleshort x 22551# manufacturer ASCII-Z string like "http://ipxe.org" "Plop - Elmar Hanlhofer www.plop.at" "QEMU" 22552>>>>(&0.s) string x "%s" 22553# pointer to optional product string; like: 0 (2975BIOS.BIN) 6ch 70h 7ch d9h 160h 281h 29bh 329h 22554>>(26.s+0x10) uleshort >0 \b, at %#x 22555>>>(26.s+0x0E) uleshort x 22556# often human readable product ASCII-Z string like "iPXE" "Plop Boot Manager" 22557# "multiboot loader" "Intel UNDI, PXE-2.0 (build 082)" 22558>>>>(&0.s) string x "%s" 22559# PnP Device indicators; contains bits that identify the device as being capable of bootable 22560#>>(26.s+0x15) ubyte x \b, INDICATORS %#x 22561# device is a display device 22562>>(26.s+0x15) ubyte &0x01 \b, display 22563# device is an input device 22564>>(26.s+0x15) ubyte &0x02 \b, input 22565# device is an IPL device 22566>>(26.s+0x15) ubyte &0x04 \b, IPL 22567#>>(26.s+0x15) ubyte &0x08 reserved 22568# ROM is only required if this device is selected as a boot device 22569>>(26.s+0x15) ubyte &0x10 \b, bootable 22570# indicates ROM is read cacheable 22571>>(26.s+0x15) ubyte &0x20 \b, cacheable 22572# ROM may be shadowed in RAM 22573>>(26.s+0x15) ubyte &0x40 \b, shadowable 22574# ROM supports the device driver initialization model 22575>>(26.s+0x15) ubyte &0x80 \b, InitialModel 22576# boot connection vector; an offset to a routine that hook into INT 9h, INT 10h, or INT 13h 22577# 0 means disabled 0x0429 (4650_sr5.bin) 0x0072 (adaptec1542.bin) 22578>>(26.s+0x16) uleshort !0 \b, boot vector offset %#x 22579# disconnect vector; offset to routine that do cleanup from an unsuccessful boot attempt 22580>>(26.s+0x18) uleshort !0 \b, disconnect offset %#x 22581# bootstrap entry point/vector (BEV); offset to a routine (like RPL) that hook into INT 19h 22582# 0 means disabled 0x3c (multiboot.bin) 0x358 (efi-rtl8139.rom) 0xae7 (PXE-Intel.rom) 22583>>(26.s+0x1A) uleshort !0 \b, bootstrap offset %#x 22584# 2nd reserved area; seems to be zero 22585>>(26.s+0x1C) uleshort !0 \b, 2nd reserved %#x 22586# static resource information vector; 0 means disabled 22587>>(26.s+0x1E) uleshort !0 \b, static offset %#4.4x 22588################################################################################ 22589# 4 bytes ASCII Signature "PCIR" for PCI Data Structure 22590#>(24.s) string =PCIR FOUND PCIR 22591>(24.s) string =PCIR \b; 22592# pointer to PCI data structure like: 1Ch 38h 104h 8E44h 22593>>24 uleshort x at %#x PCI 22594# Vendor identification (ID) https://pci-ids.ucw.cz/v2.2/pci.ids 22595#>>(24.s+4) uleshort x ID=%4.4x 22596# show Vendor identification in human readable text form instead of numeric 22597>>(24.s+4) use PCI-vendor 22598# device identification (ID) 22599>>(24.s+6) uleshort x device=%#4.4x 22600# Base+sub class code https://wiki.osdev.org/PCI 22601>>(24.s+0x0D) use PCI-class 22602# pointer to vital product data (VPD); 0 indicates no VPD; WHAT EXACTLY iS VPD? 22603>>(24.s+8) uleshort !0 \b, at %#x VPD 22604# PCI data structure length like: 24h 28h 22605>>(24.s+0xA) uleshort >0x28 \b, length %u 22606# PCI data structure revision like: 0 3 22607>>(24.s+0xC) ubyte >0 \b, revison %u 22608# image length (hexadecimal) in multiple of 512 bytes like: 54 56 68 6a 76 78 7c 7d 7e 7f 80 81 83 22609# Apparently this gives the same information as given by byte at offset 2 but as 16-bit 22610#>>(24.s+0x10) uleshort x \b, length %u*512 22611# revision level of code/data like: 0 1 201h 502h 22612>>(24.s+0xC) ubyte >1 \b, code revison %#x 22613# code type: 0~Intel x86/PC-AT compatible 1~Open firmware standard for PCI42 FF~Reserved 22614>>(24.s+0x14) ubyte >0 \b, code type %#x 22615# last image indicator; bit 7 indicates "last image"; bits 0-6 are reserved 22616>>(24.s+0x15) ubyte >0 22617>>>(24.s+0x15) ubyte =0x80 \b, last ROM 22618# THIS SHOULD NOT HAPPEN! 22619>>>(24.s+0x15) ubyte !0x80 \b, indicator %x 22620# 3rd reserved area; seems to be zero in most cases but not for 22621# efi-e1000.rom efi-rtl8139.rom 22622>>(24.s+0x16) ubeshort !0 \b, 3rd reserved %#x 22623 22624# Flash descriptors for Intel SPI flash roms. 22625# From Dr. Jesus <j@hug.gs> 226260 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 2262716 lelong 0x0ff0a55a Intel serial flash for PCH ROM 22628 22629# From: Joerg Jenderek 22630# URL: https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface 22631# Reference: https://uefi.org/sites/default/files/resources/ACPI_6_3_final_Jan30.pdf 22632# Note: generated for example by `cat /sys/firmware/acpi/tables/DSDT MyDSDT.aml` 226330 string DSDT 22634>0 use acpi-table 22635# not tested or other file format 226360 string APIC 22637>0 use acpi-table 22638#0 string ASF! 22639#>0 use acpi-table 226400 string FACP 22641>0 use acpi-table 22642#0 string FACS 22643#>0 use acpi-table 226440 string MCFG 22645>0 use acpi-table 226460 string SLIC 22647>0 use acpi-table 226480 string SSDT 22649>0 use acpi-table 226500 name acpi-table 22651# skip ASCII text starting with DSDT by looking for valid "low" revision 22652>8 ubyte <17 ACPI Machine Language file 22653# assume that ACPI tables size are lower than 16 MiB 22654#>4 ulelong <0x01000000 22655# DSDT for Differentiated System Description Table 22656>>0 string x '%.4s' 22657#!:mime application/octet-stream 22658!:mime application/x-intel-aml 22659!:ext aml 22660# the manufacture model ID like: VBOXBIOS BXDSDT 22661>>16 string >\0 %.8s 22662# OEM revision of DSDT for supplied OEM Table ID like: 0 1 2 20090511 22663>>>24 ulelong x %x 22664# OEM ID like: INTEL VBOX (VirtualBox) BXDSDT (qemu) MEDION or \030\001\0\0 for s3pt.aml 22665>>10 ubyte >040 by %c 22666>>>11 ubyte >040 \b%c 22667>>>>12 ubyte >040 \b%c 22668>>>>>13 ubyte >040 \b%c 22669>>>>>>14 ubyte >040 \b%c 22670>>>>>>>15 ubyte >040 \b%c 22671# This field also sets the global integer width for the AML interpreter. 22672# Values less than two will cause the interpreter to use 32-bit. 22673# Values of two and greater will cause the interpreter to use full 64-bit. 22674# 16 for asf!.aml, 67 fo rsdp.aml 22675>>8 ubyte x \b, revision %u 22676# length, in bytes, of the entire DSDT (including the header) 22677>>4 ulelong x \b, %u bytes 22678# entire table must sum to zero 22679#>>9 ubyte x \b, checksum %#x 22680# vendor ID for the ASL Compiler like: INTL MSFT ... 22681>>28 string >\0 \b, created by %.4s 22682# revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ... 22683>>>32 ulelong x %x 22684 22685 22686#------------------------------------------------------------------------------ 22687# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 22688# interleaf: file(1) magic for InterLeaf TPS: 22689# 226900 string =\210OPS Interleaf saved data 226910 string =<!OPS Interleaf document text 22692>5 string ,\ Version\ = \b, version 22693>>17 string >\0 %.3s 22694 22695#------------------------------------------------------------------------------ 22696# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 22697# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 22698# "/etc/magic": 22699# From: guy@netapp.com (Guy Harris) 22700# 227014 string pgscriptver IslandWrite document 2270213 string DrawFile IslandDraw document 22703 22704 22705#------------------------------------------------------------------------------ 22706# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 22707# ispell: file(1) magic for ispell 22708# 22709# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 22710# will match 0x9600 through 0x9603 in *both* little endian and big endian. 22711# (No other current magic entries collide.) 22712# 22713# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 22714# 227150 leshort&0xFFFC 0x9600 little endian ispell 22716>0 byte 0 hash file (?), 22717>0 byte 1 3.0 hash file, 22718>0 byte 2 3.1 hash file, 22719>0 byte 3 hash file (?), 22720>2 leshort 0x00 8-bit, no capitalization, 26 flags 22721>2 leshort 0x01 7-bit, no capitalization, 26 flags 22722>2 leshort 0x02 8-bit, capitalization, 26 flags 22723>2 leshort 0x03 7-bit, capitalization, 26 flags 22724>2 leshort 0x04 8-bit, no capitalization, 52 flags 22725>2 leshort 0x05 7-bit, no capitalization, 52 flags 22726>2 leshort 0x06 8-bit, capitalization, 52 flags 22727>2 leshort 0x07 7-bit, capitalization, 52 flags 22728>2 leshort 0x08 8-bit, no capitalization, 128 flags 22729>2 leshort 0x09 7-bit, no capitalization, 128 flags 22730>2 leshort 0x0A 8-bit, capitalization, 128 flags 22731>2 leshort 0x0B 7-bit, capitalization, 128 flags 22732>2 leshort 0x0C 8-bit, no capitalization, 256 flags 22733>2 leshort 0x0D 7-bit, no capitalization, 256 flags 22734>2 leshort 0x0E 8-bit, capitalization, 256 flags 22735>2 leshort 0x0F 7-bit, capitalization, 256 flags 22736>4 leshort >0 and %d string characters 227370 beshort&0xFFFC 0x9600 big endian ispell 22738>1 byte 0 hash file (?), 22739>1 byte 1 3.0 hash file, 22740>1 byte 2 3.1 hash file, 22741>1 byte 3 hash file (?), 22742>2 beshort 0x00 8-bit, no capitalization, 26 flags 22743>2 beshort 0x01 7-bit, no capitalization, 26 flags 22744>2 beshort 0x02 8-bit, capitalization, 26 flags 22745>2 beshort 0x03 7-bit, capitalization, 26 flags 22746>2 beshort 0x04 8-bit, no capitalization, 52 flags 22747>2 beshort 0x05 7-bit, no capitalization, 52 flags 22748>2 beshort 0x06 8-bit, capitalization, 52 flags 22749>2 beshort 0x07 7-bit, capitalization, 52 flags 22750>2 beshort 0x08 8-bit, no capitalization, 128 flags 22751>2 beshort 0x09 7-bit, no capitalization, 128 flags 22752>2 beshort 0x0A 8-bit, capitalization, 128 flags 22753>2 beshort 0x0B 7-bit, capitalization, 128 flags 22754>2 beshort 0x0C 8-bit, no capitalization, 256 flags 22755>2 beshort 0x0D 7-bit, no capitalization, 256 flags 22756>2 beshort 0x0E 8-bit, capitalization, 256 flags 22757>2 beshort 0x0F 7-bit, capitalization, 256 flags 22758>4 beshort >0 and %d string characters 22759# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 22760# Ispell 4.0 227610 string ISPL ispell 22762>4 long x hash file version %d, 22763>8 long x lexletters %d, 22764>12 long x lexsize %d, 22765>16 long x hashsize %d, 22766>20 long x stblsize %d 22767 22768#------------------------------------------------------------------------------ 22769# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $ 22770# ISO Zipped file format 22771# https://www.ezbsystems.com/isz/iszspec.txt 227720 string IsZ! ISO Zipped file 22773>4 byte x \b, header size %u 22774>5 byte x \b, version %u 22775>8 lelong x \b, serial %u 22776#12 leshort x \b, sector size %u 22777#>16 lelong x \b, total sectors %u 22778>17 byte >0 \b, password protected 22779#>24 lequad x \b, segment size %llu 22780#>32 lelong x \b, blocks %u 22781#>36 lelong x \b, block size %u 22782 22783#------------------------------------------------------------ 22784# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 22785# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 22786# same magic number, 0xcafebabe, so they are both handled 22787# in the entry called "cafebabe". 22788#------------------------------------------------------------ 22789# Java serialization 22790# From Martin Pool (m.pool@pharos.com.au) 227910 beshort 0xaced Java serialization data 22792>2 beshort >0x0004 \b, version %d 22793 227940 belong 0xfeedfeed Java KeyStore 22795!:mime application/x-java-keystore 227960 belong 0xcececece Java JCE KeyStore 22797!:mime application/x-java-jce-keystore 22798 22799# Java source 228000 regex \^import.*;$ Java source 22801!:mime text/x-java 22802 22803# Java HPROF dumps 22804# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 228050 string JAVA\x20PROFILE\x201.0. 22806>0x12 byte 0 22807>>0x11 ubyte-0x31 <2 Java HPROF dump, 22808>>>0x17 beqdate/1000 x created %s 22809 22810# Java jmod module 22811# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 22812# Grr. 2 byte magic "JM", really? In 2019? 228130 belong 0x4a4d0100 Java jmod module version 1.0 22814!:mime application/x-java-jmod 22815 22816# Java jlinked image 22817# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 228180 belong 0xcafedada Java module image (big endian) 22819>4 beshort >0x00 \b, version %d 22820>6 beshort x \b.%d 22821!:mime application/x-java-image 22822 228230 lelong 0xcafedada Java module image (little endian) 22824>6 leshort >0x00 \b, version %d 22825>4 leshort x \b.%d 22826!:mime application/x-java-image 22827 22828#------------------------------------------------------------------------------ 22829# $File: javascript,v 1.4 2022/09/02 08:08:17 christos Exp $ 22830# javascript: magic for javascript and node.js scripts. 22831# 228320 string/w #!/bin/node Node.js script text executable 22833!:mime application/javascript 228340 string/w #!/usr/bin/node Node.js script text executable 22835!:mime application/javascript 228360 string/w #!/bin/nodejs Node.js script text executable 22837!:mime application/javascript 228380 string/w #!/usr/bin/nodejs Node.js script text executable 22839!:mime application/javascript 228400 string #!/usr/bin/env\ node Node.js script text executable 22841!:mime application/javascript 228420 string #!/usr/bin/env\ nodejs Node.js script text executable 22843!:mime application/javascript 22844# Hermes by Facebook https://hermesengine.dev/ 22845# https://github.com/facebook/hermes/blob/master/include/hermes/\ 22846# BCGen/HBC/BytecodeFileFormat.h#L24 228470 lequad 0x1F1903C103BC1FC6 Hermes JavaScript bytecode 22848>8 lelong x \b, version %d 22849 22850# v8 JavaScript engine bytecode 22851# From: Alexandre Iooss <erdnaxe@crans.org> 22852# URL: https://v8.dev/docs/ignition 22853# Note: used in bytenode and NW.js protected source code 22854# V8 bytecode extraction was added in NodeJS v5.7.0 (V8 4.6.85.31). 22855# Version information is provided for some v8 versions found in NodeJS releases. 228562 uleshort =0xC0DE 22857>0 ulelong^0xC0DE0000 >0 22858# Reservation table starts at 40 22859>>40 ulelong&0xFFFFFF00 =0x80000000 22860# Stub keys present 22861>>>24 ulelong >0 22862>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes, 22863>>>>4 ulelong =0xEE4BF478 version 5.1.281.111, 22864>>>>4 ulelong =0xC4A0100C version 5.5.372.43, 22865>>>>8 ulelong x source size: %u bytes, 22866>>>>12 ulelong x cpu features: %#08X, 22867>>>>16 ulelong x flag hash: %#08X, 22868>>>>20 ulelong x %u reservations, 22869>>>>28 ulelong x payload size: %u bytes, 22870>>>>32 ulelong x checksum1: %#08X, 22871>>>>36 ulelong x checksum2: %#08X 22872# No stub keys 22873>>>24 ulelong =0 22874>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes, 22875>>>>4 ulelong =0x54F0AD81 version 6.2.414.46, 22876>>>>4 ulelong =0X7D1BF182 version 6.2.414.54, 22877>>>>4 ulelong =0x35BA122E version 6.2.414.77, 22878>>>>4 ulelong =0X9319F9C2 version 6.2.414.78, 22879>>>>4 ulelong =0xB1240060 version 6.6.346.32, 22880>>>>4 ulelong =0x2B757060 version 6.7.288.46, 22881>>>>4 ulelong =0x09D147AA version 6.7.288.49, 22882>>>>4 ulelong =0xF4D4F48A version 6.8.275.32, 22883>>>>4 ulelong =0xD3961326 version 7.0.276.38, 22884>>>>8 ulelong x source size: %u bytes, 22885>>>>12 ulelong x cpu features: %#08X, 22886>>>>16 ulelong x flag hash: %#08X, 22887>>>>20 ulelong x %u reservations, 22888>>>>28 ulelong x payload size: %u bytes, 22889>>>>32 ulelong x checksum1: %#08X, 22890>>>>36 ulelong x checksum2: %#08X 22891# Reservation table starts at 32 22892>>32 ulelong&0xFFFFFF00 =0x80000000 22893# Second checksum present 22894>>>28 ulelong >0 22895>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes, 22896>>>>4 ulelong =0x21DDF627 version 7.4.288.21, 22897>>>>4 ulelong =0x1FC9FE84 version 7.4.288.27, 22898>>>>4 ulelong =0x60A99E8B version 7.5.288.22, 22899>>>>4 ulelong =0x4F665E90 version 7.6.303.29, 22900>>>>4 ulelong =0xC7ACFCDE version 7.7.299.11, 22901>>>>4 ulelong =0x7F641D8F version 7.7.299.13, 22902>>>>4 ulelong =0xFD9A4F2E version 7.8.279.17, 22903>>>>4 ulelong =0x3A845324 version 7.8.279.23, 22904>>>>4 ulelong =0xFF52FEAF version 7.9.317.25, 22905>>>>8 ulelong x source size: %u bytes, 22906>>>>12 ulelong x flag hash: %#08X, 22907>>>>16 ulelong x %u reservations, 22908>>>>20 ulelong x payload size: %u bytes, 22909>>>>24 ulelong x checksum1: %#08X, 22910>>>>28 ulelong x checksum2: %#08X 22911# No second checksum 22912>>>28 ulelong =0 22913>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes, 22914>>>>4 ulelong =0x8725E0F8 version 8.1.307.30, 22915>>>>4 ulelong =0x09ED1289 version 8.1.307.31, 22916>>>>4 ulelong =0xA5728C87 version 8.3.110.9, 22917>>>>4 ulelong =0xB45C5D30 version 8.4.371.23, 22918>>>>4 ulelong =0xED9C278B version 8.4.371.19, 22919>>>>4 ulelong =0xD27BFF42 version 8.6.395.16, 22920>>>>8 ulelong x source size: %u bytes, 22921>>>>12 ulelong x flag hash: %#08X, 22922>>>>16 ulelong x %u reservations, 22923>>>>20 ulelong x payload size: %u bytes, 22924>>>>24 ulelong x payload checksum: %#08X 22925# No reservation table and code starts at 24 22926>>32 ulelong =0 22927>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes, 22928>>>4 ulelong =0x9A6F0B0F version 9.0.257.17, 22929>>>4 ulelong =0x271D5D1E version 9.0.257.24, 22930>>>4 ulelong =0x4EEA75DF version 9.0.257.25, 22931>>>4 ulelong =0x80809479 version 9.1.269.36, 22932>>>4 ulelong =0x55C46F65 version 9.1.269.38, 22933>>>4 ulelong =0x8A9C758A version 9.2.230.21, 22934>>>4 ulelong =0x9712F0E1 version 9.3.345.16, 22935>>>4 ulelong =0x29593715 version 9.4.146.19, 22936>>>4 ulelong =0xCD991825 version 9.4.146.24, 22937>>>4 ulelong =0xACDD64EE version 9.4.146.26, 22938>>>4 ulelong =0xC96B4CD5 version 9.5.172.21, 22939>>>4 ulelong =0xBCCE4578 version 9.5.172.25, 22940>>>4 ulelong =0xA2EEA077 version 9.6.180.15, 22941>>>4 ulelong =0xFD350011 version 10.1.124.8, 22942>>>4 ulelong =0xBEF4028F version 10.2.154.13, 22943>>>4 ulelong =0xAF632352 version 10.2.154.4, 22944>>>8 ulelong x source size: %u bytes, 22945>>>12 ulelong x flag hash: %#08X, 22946>>>16 ulelong x payload size: %u bytes, 22947>>>20 ulelong x payload checksum: %#08X 22948 22949#------------------------------------------------------------------------------ 22950# $File: jpeg,v 1.37 2022/06/17 18:03:35 christos Exp $ 22951# JPEG images 22952# SunOS 5.5.1 had 22953# 22954# 0 string \377\330\377\340 JPEG file 22955# 0 string \377\330\377\356 JPG file 22956# 22957# both of which turn into "JPEG image data" here. 22958# 229590 belong 0xffd8fff7 JPEG-LS image data 22960!:mime image/jls 22961!:ext jls 22962>0 use jpeg 22963 229640 belong&0xffffff00 0xffd8ff00 JPEG image data 22965!:mime image/jpeg 22966!:apple 8BIMJPEG 22967!:strength *3 22968!:ext jpeg/jpg/jpe/jfif 22969>0 use jpeg 22970 229710 name jpeg 22972>6 string JFIF \b, JFIF standard 22973# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 22974# in a vain attempt to add image size reporting for JFIF. Note that these 22975# tests are not fool-proof since some perfectly valid JPEGs are currently 22976# impossible to specify in magic(4) format. 22977# First, a little JFIF version info: 22978>>11 byte x \b %d. 22979>>12 byte x \b%02d 22980# Next, the resolution or aspect ratio of the image: 22981>>13 byte 0 \b, aspect ratio 22982>>13 byte 1 \b, resolution (DPI) 22983>>13 byte 2 \b, resolution (DPCM) 22984>>14 beshort x \b, density %dx 22985>>16 beshort x \b%d 22986>>4 beshort x \b, segment length %d 22987# Next, show thumbnail info, if it exists: 22988>>18 byte !0 \b, thumbnail %dx 22989>>>19 byte x \b%d 22990>6 string Exif \b, Exif standard: [ 22991>>12 indirect/r x 22992>>12 string x \b] 22993 22994# Jump to the first segment 22995>(4.S+4) use jpeg_segment 22996 22997# This uses recursion... 229980 name jpeg_segment 22999>0 beshort 0xFFFE 23000# Recursion handled by FFE0 23001#>>(2.S+2) use jpeg_segment 23002>>2 pstring/HJ x \b, comment: "%s" 23003 23004>0 beshort 0xFFC0 23005>>(2.S+2) use jpeg_segment 23006>>4 byte x \b, baseline, precision %d 23007>>7 beshort x \b, %dx 23008>>5 beshort x \b%d 23009>>9 byte x \b, components %d 23010 23011>0 beshort 0xFFC1 23012>>(2.S+2) use jpeg_segment 23013>>4 byte x \b, extended sequential, precision %d 23014>>7 beshort x \b, %dx 23015>>5 beshort x \b%d 23016>>9 byte x \b, components %d 23017 23018>0 beshort 0xFFC2 23019>>(2.S+2) use jpeg_segment 23020>>4 byte x \b, progressive, precision %d 23021>>7 beshort x \b, %dx 23022>>5 beshort x \b%d 23023>>9 byte x \b, components %d 23024 23025# Define Huffman Tables 23026>0 beshort 0xFFC4 23027>>(2.S+2) use jpeg_segment 23028 23029>0 beshort 0xFFE1 23030# Recursion handled by FFE0 23031#>>(2.S+2) use jpeg_segment 23032>>4 string Exif \b, Exif Standard: [ 23033>>>10 indirect/r x 23034>>>10 string x \b] 23035 23036# Application specific markers 23037>0 beshort&0xFFE0 =0xFFE0 23038>>(2.S+2) use jpeg_segment 23039 23040# DB: Define Quantization tables 23041# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 23042# D8: Start of image 23043# D9: End of image 23044# Dn: Restart 23045>0 beshort&0xFFD0 =0xFFD0 23046>>0 beshort&0xFFE0 !0xFFE0 23047>>>(2.S+2) use jpeg_segment 23048 23049#>0 beshort x unknown %#x 23050#>>(2.S+2) use jpeg_segment 23051 23052# HSI is Handmade Software's proprietary JPEG encoding scheme 23053# Update: Joerg Jenderek 23054# URL: http://fileformats.archiveteam.org/wiki/HSI_JPEG 23055# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-hsi1.trid.xml 23056# Note: called by TrID "HSI JPEG bitmap" 230570 string hsi1 JPEG image data, HSI proprietary 23058#!:mime application/octet-stream 23059!:mime image/x-hsi 23060!:ext hsi/jpg 23061 23062# From: David Santinoli <david@santinoli.com> 230630 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 23064# delete from ./animation (version 1.87) with jP (=6A50h) magic at offset 4 23065# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 23066# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 23067# https://github.com/bitsgalore/jp2kMagic 23068# 23069# Now read value of 'Brand' field, which yields a few possibilities: 23070# Update: Joerg Jenderek 23071# URL: http://fileformats.archiveteam.org/wiki/JP2 23072# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpeg2k.trid.xml 23073# Note: called by TrID "JPEG 2000 bitmap" 23074>20 string \x6a\x70\x32\x20 Part 1 (JP2) 23075# aliases image/jpeg2000, image/jpeg2000-image, image/x-jpeg2000-image 23076!:mime image/jp2 23077!:ext jp2 23078# URL: http://fileformats.archiveteam.org/wiki/JPX 23079# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpx.trid.xml 23080# Note: called by TrID "JPEG 2000 eXtended bitmap" 23081>20 string \x6a\x70\x78\x20 Part 2 (JPX) 23082!:mime image/jpx 23083!:ext jpf/jpx 23084# URL: http://fileformats.archiveteam.org/wiki/JPM 23085# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpm.trid.xml 23086# Note: called by TrID "JPEG 2000 eXtended bitmap" 23087>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 23088!:mime image/jpm 23089!:ext jpm 23090# URL: http://fileformats.archiveteam.org/wiki/MJ2 23091# Reference: http://mark0.net/download/triddefs_xml.7z/defs/v/video-mj2.trid.xml 23092# Note: called by TrID "Motion JPEG 2000 video" 23093>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 23094!:mime video/mj2 23095!:ext mj2/mjp2 23096 23097# Type: JPEG 2000 codesream 23098# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 23099# Update: Joerg Jenderek 23100# URL: http://fileformats.archiveteam.org/wiki/JPEG_2000_codestream 23101# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpc.trid.xml 23102# Note: called by TrID "JPEG-2000 Code Stream bitmap" 231030 belong 0xff4fff51 JPEG 2000 codestream 23104# value like: 0701h FF50h 23105#>45 ubeshort x \b, at 45 %#4.4x 23106#!:mime application/octet-stream 23107# https://reposcope.com/mimetype/image/x-jp2-codestream 23108!:mime image/x-jp2-codestream 23109!:ext jpc/j2c/j2k 23110# MAYBE also JHC like in byte_causal.jhc ? 23111# WHAT IS THAT? DEAD ENTRY? 23112#45 beshort 0xff52 23113 23114# JPEG extended range 23115# URL: http://fileformats.archiveteam.org/wiki/JPEG_XR 23116# Reference: https://www.itu.int/rec/T-REC-T.832 23117# http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-wmp.trid.xml 23118# Note: called by TrID "JPEG XR bitmap" 231190 string \x49\x49\xbc 23120# FILE_VERSION_ID; shall be equal to 1; other values are reserved for future use 23121>3 byte 1 23122# FIRST_IFD_OFFSET; shall be an integer multiple of 2; so skip DROID fmt-590-signature-id-931.wdp 23123>>4 lelong%2 0 JPEG-XR 23124#!:mime image/vnd.ms-photo 23125!:mime image/jxr 23126# NO example for HDP ! 23127!:ext jxr/wdp/hdp 23128# MAYBE also WMP ? 23129#!:ext jxr/wdp/hdp/wmp 23130# moved from ./images (version 1.205 ), merged and 23131# partly verified by XnView `nconvert -info abydos.jxr FLOWER.wdp` 23132# example: https://web.archive.org/web/20160403012904/ 23133# http://shikino.co.jp/solution/upfile/FLOWER.wdp.zip 23134>90 bequad 0x574D50484F544F00 23135>>98 byte&0x08 =0x08 \b, hard tiling 23136>>99 byte&0x80 =0x80 \b, tiling present 23137>>99 byte&0x40 =0x40 \b, codestream present 23138>>99 byte&0x38 x \b, spatial xform= 23139>>99 byte&0x38 0x00 \bTL 23140>>99 byte&0x38 0x08 \bBL 23141>>99 byte&0x38 0x10 \bTR 23142>>99 byte&0x38 0x18 \bBR 23143>>99 byte&0x38 0x20 \bBT 23144>>99 byte&0x38 0x28 \bRB 23145>>99 byte&0x38 0x30 \bLT 23146>>99 byte&0x38 0x38 \bLB 23147>>100 byte&0x80 =0x80 \b, short header 23148>>>102 beshort+1 x \b, %d 23149>>>104 beshort+1 x \bx%d 23150>>100 byte&0x80 =0x00 \b, long header 23151>>>102 belong+1 x \b, %x 23152>>>106 belong+1 x \bx%x 23153>>101 beshort&0xf x \b, bitdepth= 23154>>>101 beshort&0xf 0x0 \b1-WHITE=1 23155>>>101 beshort&0xf 0x1 \b8 23156>>>101 beshort&0xf 0x2 \b16 23157>>>101 beshort&0xf 0x3 \b16-SIGNED 23158>>>101 beshort&0xf 0x4 \b16-FLOAT 23159>>>101 beshort&0xf 0x5 \b(reserved 5) 23160>>>101 beshort&0xf 0x6 \b32-SIGNED 23161>>>101 beshort&0xf 0x7 \b32-FLOAT 23162>>>101 beshort&0xf 0x8 \b5 23163>>>101 beshort&0xf 0x9 \b10 23164>>>101 beshort&0xf 0xa \b5-6-5 23165>>>101 beshort&0xf 0xb \b(reserved %d) 23166>>>101 beshort&0xf 0xc \b(reserved %d) 23167>>>101 beshort&0xf 0xd \b(reserved %d) 23168>>>101 beshort&0xf 0xe \b(reserved %d) 23169>>>101 beshort&0xf 0xf \b1-BLACK=1 23170>>101 beshort&0xf0 x \b, colorfmt= 23171>>>101 beshort&0xf0 0x00 \bYONLY 23172>>>101 beshort&0xf0 0x10 \bYUV240 23173>>>101 beshort&0xf0 0x20 \bYWV422 23174>>>101 beshort&0xf0 0x30 \bYWV444 23175>>>101 beshort&0xf0 0x40 \bCMYK 23176>>>101 beshort&0xf0 0x50 \bCMYKDIRECT 23177>>>101 beshort&0xf0 0x60 \bNCOMPONENT 23178>>>101 beshort&0xf0 0x70 \bRGB 23179>>>101 beshort&0xf0 0x80 \bRGBE 23180>>>101 beshort&0xf0 >0x80 \b(reserved %#x) 23181 23182# JPEG XL 23183# From: Ian Tester 23184# Update: Joerg Jenderek 23185# URL: http://fileformats.archiveteam.org/wiki/JPEG_XL 23186# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl.trid.xml 23187# Note: called by TrID "JPEG XL bitmap" 231880 string \xff\x0a JPEG XL codestream 23189#!:mime image/jxl 23190!:mime image/x-jxl 23191!:ext jxl 23192 23193# JPEG XL (transcoded JPEG file) 23194# Update: Joerg Jenderek 23195# URL: http://fileformats.archiveteam.org/wiki/JPEG_XL 23196# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl-iso.trid.xml 23197# Note: called by TrID "JPEG XL bitmap (ISOBMFF)" 231980 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container 23199#!:mime image/jxl 23200!:mime image/x-jxl 23201!:ext jxl 23202 23203#------------------------------------------------------------------------------ 23204# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ 23205# karma: file(1) magic for Karma data files 23206# 23207# From <rgooch@atnf.csiro.au> 23208 232090 string KarmaRHD\040Version Karma Data Structure Version 23210>16 belong x %u 23211 23212#------------------------------------------------------------------------------ 23213# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 23214# kde: file(1) magic for KDE 23215 232160 string/t [KDE\ Desktop\ Entry] KDE desktop entry 23217!:mime application/x-kdelnk 232180 string/t #\ KDE\ Config\ File KDE config file 23219!:mime application/x-kdelnk 232200 string/t #\ xmcd xmcd database file for kscd 23221!:mime text/x-xmcd 23222 23223#------------------------------------------------------------------------------ 23224# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $ 23225# keepass: file(1) magic for KeePass file 23226# 23227# Keepass Password Safe: 23228# * original one: https://keepass.info/ 23229# * *nix port: https://www.keepassx.org/ 23230# * android port: https://code.google.com/p/keepassdroid/ 23231 232320 lelong 0x9AA2D903 Keepass password database 23233>4 lelong 0xB54BFB65 1.x KDB 23234>>48 lelong >0 \b, %d groups 23235>>52 lelong >0 \b, %d entries 23236>>8 lelong&0x0f 1 \b, SHA-256 23237>>8 lelong&0x0f 2 \b, AES 23238>>8 lelong&0x0f 4 \b, RC4 23239>>8 lelong&0x0f 8 \b, Twofish 23240>>120 lelong >0 \b, %d key transformation rounds 23241>4 lelong 0xB54BFB67 2.x KDBX 23242 23243#------------------------------------------------------------------------------ 23244# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $ 23245# kerberos: MIT kerberos file binary formats 23246# 23247 23248# This magic entry is for demonstration purposes and could be improved 23249# if the following features were implemented in file: 23250# 23251# Strings inside [[ .. ]] in the descriptions have special meanings and 23252# are not printed. 23253# 23254# - Provide some form of iteration in number of components 23255# [[${counter}=%d]] in the description 23256# then append 23257# [${counter}--] in the offset of the entries 23258# - Provide a way to round the next offset 23259# Add [R:4] after the offset? 23260# - Provide a way to have optional entries 23261# XXX: Syntax: 23262# - Provide a way to "save" entries to print them later. 23263# if the description is [[${name}=%s]], then nothing is 23264# printed and a subsequent entry in the same magic file 23265# can refer to ${name} 23266# - Provide a way to format strings as hex values 23267# 23268# https://www.gnu.org/software/shishi/manual/html_node/\ 23269# The-Keytab-Binary-File-Format.html 23270# 23271 232720 name keytab_entry 23273#>0 beshort x \b, size=%d 23274#>2 beshort x \b, components=%d 23275>4 pstring/H x \b, realm=%s 23276>>&0 pstring/H x \b, principal=%s/ 23277>>>&0 pstring/H x \b%s 23278>>>>&0 belong x \b, type=%d 23279>>>>>&0 bedate x \b, date=%s 23280>>>>>>&0 byte x \b, kvno=%u 23281#>>>>>>>&0 pstring/H x 23282#>>>>>>>>&0 belong x 23283#>>>>>>>>>>&0 use keytab_entry 23284 232850 belong 0x05020000 Kerberos Keytab file 23286>4 use keytab_entry 23287 23288#------------------------------------------------------------------------------ 23289# $File: kicad,v 1.2 2020/05/06 14:03:28 christos Exp $ 23290# kicad: file(1) magic for KiCad files 23291# 23292# See 23293# 23294# http://kicad-pcb.org 23295# 23296 23297# KiCad Schematic Document 232980 string (kicad_sch 23299>10 byte 0x20 KiCad Schematic Document 23300!:ext kicad_sch/kicad_sch-bak 23301>>11 string (version 23302>>>19 byte 0x20 23303>>>>20 regex [0-9.]+ (Version %s) 23304 23305# KiCad Schematic Document (Legacy) 233060 string EESchema 23307>8 byte 0x20 23308>>9 string Schematic 23309>>>18 byte 0x20 KiCad Schematic Document (Legacy) 23310!:ext sch/bak 23311>>>>24 string Version 23312>>>>>31 byte 0x20 23313>>>>>>32 string x (Version %s) 23314 23315# KiCad Symbol Library 233160 string (kicad_symbol_lib 23317>17 byte 0x20 KiCad Symbol Library 23318!:ext kicad_sym 23319>>18 string (version 23320>>>26 byte 0x20 23321>>>>27 regex [0-9.]+ (Version %s) 23322 23323# KiCad Symbol Library (Legacy) 233240 string EESchema-LIBRARY 23325>16 byte 0x20 KiCad Symbol Library (Legacy) 23326!:ext lib 23327>>17 string Version 23328>>>24 byte 0x20 23329>>>>25 string x (Version %s) 23330 23331# KiCad Symbol Library Documentation (Legacy) 233320 string EESchema-DOCLIB 23333>15 byte 0x20 KiCad Symbol Library Documentation (Legacy) 23334!:ext dcm 23335>>17 string Version 23336>>>24 byte 0x20 23337>>>>25 string x (Version %s) 23338 23339# KiCad Board Layout 233400 string (kicad_pcb 23341>10 byte 0x20 KiCad Board Layout 23342!:ext kicad_pcb/kicad_pcb-bak 23343>>11 string (version 23344>>>19 byte 0x20 23345>>>>20 regex [0-9.]+ (Version %s) 23346 23347# KiCad Footprint 233480 string (module 23349>7 byte 0x20 KiCad Footprint 23350!:ext kicad_mod 23351 23352# KiCad Footprint (Legacy) 233530 string PCBNEW-LibModule-V1 KiCad Footprint (Legacy) 23354!:ext mod 23355 23356# KiCad Netlist 233570 string (export 23358>7 byte 0x20 KiCad Netlist 23359!:ext net 23360 23361# KiCad Symbol Library Table 233620 string (sym_lib_table 23363>14 byte 0xA KiCad Symbol Library Table 23364>14 byte 0xD KiCad Symbol Library Table 23365>14 byte 0x20 KiCad Symbol Library Table 23366 23367# KiCad Footprint Library Table 233680 string (fp_lib_table 23369>13 byte 0xA KiCad Footprint Library Table 23370>13 byte 0xD KiCad Footprint Library Table 23371>13 byte 0x20 KiCad Footprint Library Table 23372 23373#------------------------------------------------------------------------------ 23374# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $ 23375# Type: Google KML, formerly Keyhole Markup Language 23376# Future development of this format has been handed 23377# over to the Open Geospatial Consortium. 23378# https://www.opengeospatial.org/standards/kml/ 23379# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 233800 string/t \<?xml 23381>20 search/400 \ xmlns= 23382>>&0 regex ['"]http://earth.google.com/kml Google KML document 23383!:mime application/vnd.google-earth.kml+xml 23384>>>&1 string 2.0' \b, version 2.0 23385>>>&1 string 2.1' \b, version 2.1 23386>>>&1 string 2.2' \b, version 2.2 23387 23388#------------------------------------------------------------------------------ 23389# Type: OpenGIS KML, formerly Keyhole Markup Language 23390# This standard is maintained by the 23391# Open Geospatial Consortium. 23392# https://www.opengeospatial.org/standards/kml/ 23393# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 23394>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 23395!:mime application/vnd.google-earth.kml+xml 23396>>>&1 string/t 2.2 \b, version 2.2 23397 23398#------------------------------------------------------------------------------ 23399# Type: Google KML Archive (ZIP based) 23400# https://code.google.com/apis/kml/documentation/kml_tut.html 23401# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 234020 string PK\003\004 23403>4 byte 0x14 23404>>30 string doc.kml Compressed Google KML Document, including resources. 23405!:mime application/vnd.google-earth.kmz 23406#------------------------------------------------------------------------------ 23407# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $ 23408# 23409 23410# Magic file patterns for use with file(1) for the 23411# LAMMPS molecular dynamics simulation software. 23412# https://lammps.sandia.gov 23413# 23414# Updated: 2021-03-14 by akohlmey@gmail.com 23415 23416# Binary restart file for the LAMMPS MD code 234170 string LammpS\ RestartT LAMMPS binary restart file 23418>0x14 long x (rev %d), 23419>>0x20 string x Version %s, 23420>>>0x10 lelong 0x0001 Little Endian 23421>>>0x10 lelong 0x1000 Big Endian 23422 23423# Atom style binary dump file for the LAMMPS MD code 23424# written on a little endian machine 234250 lequad -8 23426>0x08 string DUMPATOM LAMMPS atom style binary dump 23427>>0x14 long x (rev %d), 23428>>>0x10 lelong 0x0001 Little Endian, 23429>>>>0x18 lequad x First time step: %lld 23430 23431# written on a big endian machine 234320 bequad -8 23433>0x08 string DUMPATOM LAMMPS atom style binary dump 23434>>0x14 belong x (rev %d), 23435>>>0x10 lelong 0x1000 Big Endian, 23436>>>>0x18 bequad x First time step: %lld 23437 23438# Atom style binary dump file for the LAMMPS MD code 23439# written on a little endian machine 234400 lequad -10 23441>0x08 string DUMPCUSTOM LAMMPS custom style binary dump 23442>>0x16 lelong x (rev %d), 23443>>>0x12 lelong 0x0001 Little Endian, 23444>>>>0x1a lequad x First time step: %lld 23445 23446# written on a big endian machine 234470 bequad -10 23448>0x08 string DUMPCUSTOM LAMMPS custom style binary dump 23449>>0x16 belong x (rev %d), 23450>>>0x12 lelong 0x1000 Big Endian, 23451>>>>0x1a bequad x First time step: %lld 23452 23453# LAMMPS log file 234540 string LAMMPS\ ( LAMMPS log file 23455>8 regex/16 [0-9]+\ [A-Za-z]+\ [0-9]+ written by version %s 23456 23457# Data file written either by LAMMPS, msi2lmp or VMD/TopoTools 234580 string LAMMPS\ data\ file LAMMPS data file 23459>0x12 string CGCMM\ style written by TopoTools 23460>0x12 string msi2lmp written by msi2lmp 23461>0x11 string via\ write_data written by LAMMPS 23462 23463# LAMMPS data file written by OVITO 234640 string #\ LAMMPS\ data\ file LAMMPS data file 23465>0x13 string written\ by\ OVITO written by OVITO 23466 23467# LAMMPS text mode dump file 234680 string ITEM:\ TIMESTEP LAMMPS text mode dump, 23469>15 regex/16 [0-9]+ First time step: %s 23470 23471#------------------------------------------------------------------------------ 23472# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 23473# DEC SRC Virtual Paper: Lectern files 23474# Karl M. Hegbloom <karlheg@inetarena.com> 234750 string lect DEC SRC Virtual Paper Lectern file 23476 23477#------------------------------------------------------------------------------ 23478# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 23479# lex: file(1) magic for lex 23480# 23481# derived empirically, your offsets may vary! 234820 search/100 yyprevious C program text (from lex) 23483>3 search/1 >\0 for %s 23484# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 234850 search/100 generated\ by\ flex C program text (from flex) 23486# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 234870 search/1 %{ lex description text 23488 23489#------------------------------------------------------------------------------ 23490# $File: lif,v 1.10 2021/04/26 15:56:00 christos Exp $ 23491# lif: file(1) magic for lif 23492# 23493# (Daniel Quinlan <quinlan@yggdrasil.com>) 23494# 23495# Modified by: Joerg Jenderek 23496# URL: https://www.hp9845.net/9845/projects/hpdir/ 23497# https://github.com/bug400/lifutils 23498# Reference: https://www.hp9845.net/9845/downloads/manuals/LIF_excerpt_64941-90906_flpRef_Jan84.pdf 23499# Note: called by TrID "HP Logical Interchange Format disk image" 235000 beshort 0x8000 23501# GRR: line above is too general as it catches also compressed DEGAS low-res bitmap *.pc1 23502# skip many compressed DEGAS low-res bitmap *.pc1 by test for unused bytes 23503>14 beshort =0 23504# skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number 23505>>20 ubeshort <0x0100 23506# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name 23507#>>>2 ubelong >0x2020201F 23508>>>0 use lif-file 235090 name lif-file 23510# LIF ID 23511>0 beshort x lif file 23512!:mime application/x-lif-disk 23513# lif used by Tony Duell LIF utilities; enhanced version by Joachim Siebold use also dat; hpi used by hpdir 23514!:ext lif/hpi/dat 23515# volume label; A-Z 0-9 _ ; default are 6 spaces 23516>2 string x "%.6s" 23517# version number; 0 for systems without extensions or 1 for model 64000 23518>20 ubeshort x \b, version %u 23519# LIF identifier; 010000 for system 3000 23520>12 beshort !0x1000 \b, LIF identifier %#x 23521# directory start address in units like: 2 23522>8 ubelong x \b, directory 23523>8 ubelong !2 start address %u 23524# length of directory like: 2 4 7 10 12 14 (for model 64000) 16 18 20 24 30 50 57 77 80 23525>16 ubelong x length %u 23526# level 1 extensions 23527>20 beshort =0 23528>>24 ubequad !0 \b, for extensions %#llx... 23529>20 beshort >0 23530>>24 ubequad !0 \b, extensions %#llx... 23531# word 21-126 reserved for extensions and future use; set to nil 23532>42 ubequad !0 \b, RESERVED %#llx 23533# lif first file name for standard directory; 0xffff... means uninitialized 23534>8 ubelong 2 23535>>512 string <\xff\xff \b, 1st file %-.10s 23536 23537 23538#------------------------------------------------------------------------------ 23539# $File: linux,v 1.82 2022/09/07 11:23:44 christos Exp $ 23540# linux: file(1) magic for Linux files 23541# 23542# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 23543# The following basic Linux magic is useful for reference, but using 23544# "long" magic is a better practice in order to avoid collisions. 23545# 23546# 2 leshort 100 Linux/i386 23547# >0 leshort 0407 impure executable (OMAGIC) 23548# >0 leshort 0410 pure executable (NMAGIC) 23549# >0 leshort 0413 demand-paged executable (ZMAGIC) 23550# >0 leshort 0314 demand-paged executable (QMAGIC) 23551# 235520 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 23553>16 lelong 0 \b, stripped 235540 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 23555>16 lelong 0 \b, stripped 235560 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 23557>16 lelong 0 \b, stripped 235580 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 23559>16 lelong 0 \b, stripped 23560# 235610 string \007\001\000 Linux/i386 object file 23562>20 lelong >0x1020 \b, DLL library 23563# Linux-8086 stuff: 235640 string \01\03\020\04 Linux-8086 impure executable 23565>28 long !0 not stripped 235660 string \01\03\040\04 Linux-8086 executable 23567>28 long !0 not stripped 23568# 235690 string \243\206\001\0 Linux-8086 object file 23570# 235710 string \01\03\020\20 Minix-386 impure executable 23572>28 long !0 not stripped 235730 string \01\03\040\20 Minix-386 executable 23574>28 long !0 not stripped 235750 string \01\03\04\20 Minix-386 NSYM/GNU executable 23576>28 long !0 not stripped 23577# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 23578216 lelong 0421 Linux/i386 core file 23579!:strength / 2 23580>220 string >\0 of '%s' 23581>200 lelong >0 (signal %d) 23582# 23583# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 23584# this can be overridden by the DOS executable (COM) entry 235852 string LILO Linux/i386 LILO boot/chain loader 23586# 23587# Linux make config build file, from Ole Aamot <oka@oka.no> 23588# Updated by Ken Sharp 2358928 string make\ config Linux make config build file (old) 2359049 search/70 Kernel\ Configuration Linux make config build file 23591 23592# 23593# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 23594# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 23595# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 235960 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 23597>2 byte&0x01 0 256 characters, 23598>2 byte&0x01 !0 512 characters, 23599>2 byte&0x02 0 no directory, 23600>2 byte&0x02 !0 Unicode directory, 23601>3 byte >0 8x%d 236020 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 23603>16 lelong x %d characters, 23604>12 lelong&0x01 0 no directory, 23605>12 lelong&0x01 !0 Unicode directory, 23606>24 lelong x %d 23607>28 lelong x \bx%d 23608 23609# Linux swap and hibernate files 23610# Linux kernel: include/linux/swap.h 23611# util-linux: libblkid/src/superblocks/swap.c 23612 23613# format v0, unsupported since 2002 236140xff6 string SWAP-SPACE Linux old swap file, 4k page size 236150x1ff6 string SWAP-SPACE Linux old swap file, 8k page size 236160x3ff6 string SWAP-SPACE Linux old swap file, 16k page size 236170x7ff6 string SWAP-SPACE Linux old swap file, 32k page size 236180xfff6 string SWAP-SPACE Linux old swap file, 64k page size 23619 23620# format v1, supported since 1998 236210 name linux-swap 23622>0x400 lelong 1 little endian, version %u, 23623>>0x404 lelong x size %u pages, 23624>>0x408 lelong x %u bad pages, 23625>0x400 belong 1 big endian, version %u, 23626>>0x404 belong x size %u pages, 23627>>0x408 belong x %u bad pages, 23628>0x41c string \0 no label, 23629>0x41c string >\0 LABEL=%s, 23630>0x40c ubelong x UUID=%08x 23631>0x410 ubeshort x \b-%04x 23632>0x412 ubeshort x \b-%04x 23633>0x414 ubeshort x \b-%04x 23634>0x416 ubelong x \b-%08x 23635>0x41a ubeshort x \b%04x 23636 236370xff6 string SWAPSPACE2 Linux swap file, 4k page size, 23638>0 use linux-swap 236390x1ff6 string SWAPSPACE2 Linux swap file, 8k page size, 23640>0 use linux-swap 236410x3ff6 string SWAPSPACE2 Linux swap file, 16k page size, 23642>0 use linux-swap 236430x7ff6 string SWAPSPACE2 Linux swap file, 32k page size, 23644>0 use linux-swap 236450xfff6 string SWAPSPACE2 Linux swap file, 64k page size, 23646>0 use linux-swap 23647 236480 name linux-hibernate 23649>0 string S1SUSPEND \b, with SWSUSP1 image 23650>0 string S2SUSPEND \b, with SWSUSP2 image 23651>0 string ULSUSPEND \b, with uswsusp image 23652>0 string LINHIB0001 \b, with compressed hibernate image 23653>0 string \xed\xc3\x02\xe9\x98\x56\xe5\x0c \b, with tuxonice image 23654>0 default x \b, with unknown hibernate image 23655 236560xfec string SWAPSPACE2 Linux swap file, 4k page size, 23657>0 use linux-swap 23658>0xff6 use linux-hibernate 236590x1fec string SWAPSPACE2 Linux swap file, 8k page size, 23660>0 use linux-swap 23661>0x1ff6 use linux-hibernate 236620x3fec string SWAPSPACE2 Linux swap file, 16k page size, 23663>0 use linux-swap 23664>0x3ff6 use linux-hibernate 236650x7fec string SWAPSPACE2 Linux swap file, 32k page size, 23666>0 use linux-swap 23667>0x7ff6 use linux-hibernate 236680xffec string SWAPSPACE2 Linux swap file, 64k page size, 23669>0 use linux-swap 23670>0xfff6 use linux-hibernate 23671 23672# 23673# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 23674# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 23675# and Nicolas Lichtmaier <nick@debian.org> 23676# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 23677# Linux kernel boot images (i386 arch) (Wolfram Kleff) 23678# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt 23679514 string HdrS Linux kernel 23680!:strength + 55 23681# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes 23682# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin 23683# DamnSmallLinux 1.5 damnsmll.lnx 23684!:ext /dat/bin/lnx 23685>510 leshort 0xAA55 x86 boot executable 23686>>518 leshort >0x1ff 23687>>>529 byte 0 zImage, 23688>>>529 byte 1 bzImage, 23689>>>526 lelong >0 23690>>>>(526.s+0x200) string >\0 version %s, 23691>>498 leshort 1 RO-rootFS, 23692>>498 leshort 0 RW-rootFS, 23693>>508 leshort >0 root_dev %#X, 23694>>502 leshort >0 swap_dev %#X, 23695>>504 leshort >0 RAMdisksize %u KB, 23696>>506 leshort 0xFFFF Normal VGA 23697>>506 leshort 0xFFFE Extended VGA 23698>>506 leshort 0xFFFD Prompt for Videomode 23699>>506 leshort >0 Video mode %d 23700# This also matches new kernels, which were caught above by "HdrS". 237010 belong 0xb8c0078e Linux kernel 23702>0x1e3 string Loading version 1.3.79 or older 23703>0x1e9 string Loading from prehistoric times 23704 23705# System.map files - Nicolas Lichtmaier <nick@debian.org> 237068 search/1 \ A\ _text Linux kernel symbol map text 23707 23708# LSM entries - Nicolas Lichtmaier <nick@debian.org> 237090 search/1 Begin3 Linux Software Map entry text 237100 search/1 Begin4 Linux Software Map entry text (new format) 23711 23712# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 237130 belong 0x4f4f4f4d User-mode Linux COW file 23714>4 belong <3 \b, version %d 23715>>8 string >\0 \b, backing file %s 23716>4 belong >2 \b, version %d 23717>>32 string >\0 \b, backing file %s 23718 23719############################################################################ 23720# Linux kernel versions 23721 237220 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 23723>497 leshort 0 x86 boot sector 23724>>514 belong 0x8e of a kernel from the dawn of time! 23725>>514 belong 0x908ed8b4 version 0.99-1.1.42 23726>>514 belong 0x908ed8b8 for memtest86 23727 23728>497 leshort !0 x86 kernel 23729>>504 leshort >0 RAMdisksize=%u KB 23730>>502 leshort >0 swap=%#X 23731>>508 leshort >0 root=%#X 23732>>>498 leshort 1 \b-ro 23733>>>498 leshort 0 \b-rw 23734>>506 leshort 0xFFFF vga=normal 23735>>506 leshort 0xFFFE vga=extended 23736>>506 leshort 0xFFFD vga=ask 23737>>506 leshort >0 vga=%d 23738>>514 belong 0x908ed881 version 1.1.43-1.1.45 23739>>514 belong 0x15b281cd 23740>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 23741>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 23742>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 23743>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 23744>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 23745>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 23746>>514 string HdrS 23747>>>518 leshort >0x1FF 23748>>>>529 byte 0 \b, zImage 23749>>>>529 byte 1 \b, bzImage 23750>>>>(526.s+0x200) string >\0 \b, version %s 23751 23752# Linux boot sector thefts. 237530 belong 0xb8c0078e Linux 23754>0x1e6 belong 0x454c4b53 ELKS Kernel 23755>0x1e6 belong !0x454c4b53 style boot sector 23756 23757############################################################################ 23758# Linux S390 kernel image 23759# Created by: Jan Kaluza <jkaluza@redhat.com> 237608 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 23761>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 23762# 64bit 23763>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 23764>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 23765>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 23766>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 23767# 32bit 23768>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 23769>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 23770>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 23771>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 23772 23773############################################################################ 23774# Linux ARM compressed kernel image 23775# From: Kevin Cernekee <cernekee@gmail.com> 23776# Update: Joerg Jenderek 237770x24 lelong 0x016f2818 Linux kernel ARM boot executable zImage 23778# There are three possible situations: LE, BE with LE bootloader and pure BE. 23779# In order to aid telling these apart a new endian flag was added. In order 23780# to support kernels before the flag and BE with LE bootloader was added we'll 23781# do a negative check against the BE variant of the flag when we see a LE magic. 23782>0x30 belong !0x04030201 (little-endian) 23783# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin" 23784!:ext img/bin 23785>0x30 belong 0x04030201 (big-endian) 237860x24 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 23787 23788############################################################################ 23789# Linux AARCH64 kernel image 237900x38 lelong 0x644d5241 Linux kernel ARM64 boot executable Image 23791>0x18 lelong ^1 \b, little-endian 23792>0x18 lelong &1 \b, big-endian 23793>0x18 lelong &2 \b, 4K pages 23794>0x18 lelong &4 \b, 16K pages 23795>0x18 lelong &6 \b, 32K pages 23796 23797############################################################################ 23798# Linux 8086 executable 237990 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 23800>5 string . 23801>>4 string >\0 \b, libc version %s 23802 238030 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 23804>2 byte&0x01 !0 \b, unmapped zero page 23805>2 byte&0x20 0 \b, impure 23806>2 byte&0x20 !0 23807>>2 byte&0x10 !0 \b, A_EXEC 23808>2 byte&0x02 !0 \b, A_PAL 23809>2 byte&0x04 !0 \b, A_NSYM 23810>2 byte&0x08 !0 \b, A_STAND 23811>2 byte&0x40 !0 \b, A_PURE 23812>2 byte&0x80 !0 \b, A_TOVLY 23813>28 long !0 \b, not stripped 23814>37 string . 23815>>36 string >\0 \b, libc version %s 23816 23817# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 23818# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 23819# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 23820# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 23821 23822# SYSLINUX boot logo files (from 'ppmtolss16' sources) 23823# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 23824# file extension .lss .16 238250 lelong =0x1413f33d SYSLINUX' LSS16 image data 23826# syslinux-4.05/mime/image/x-lss16.xml 23827!:mime image/x-lss16 23828>4 leshort x \b, width %d 23829>6 leshort x \b, height %d 23830 238310 string OOOM User-Mode-Linux's Copy-On-Write disk image 23832>4 belong x version %d 23833 23834# SE Linux policy database 23835# From: Mike Frysinger <vapier@gentoo.org> 238360 lelong 0xf97cff8c SE Linux policy 23837>16 lelong x v%d 23838>20 lelong 1 MLS 23839>24 lelong x %d symbols 23840>28 lelong x %d ocons 23841 23842# Linux Logical Volume Manager (LVM) 23843# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 23844# 23845# System ID, UUID and volume group name are 128 bytes long 23846# but they should never be full and initialized with zeros... 23847# 23848# LVM1 23849# 238500x0 string/b HM\001 LVM1 (Linux Logical Volume Manager), version 1 23851>0x12c string/b >\0 , System ID: %s 23852 238530x0 string/b HM\002 LVM1 (Linux Logical Volume Manager), version 2 23854>0x12c string/b >\0 , System ID: %s 23855 23856# LVM2 23857# 23858# It seems that the label header can be in one the four first sector 23859# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 23860# 23861# 0x200 seems to be the common case 238620 name lvm2 23863# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 23864>0x0 string >\x2f \b, UUID: %.6s 23865>0x6 string >\x2f \b-%.4s 23866>0xa string >\x2f \b-%.4s 23867>0xe string >\x2f \b-%.4s 23868>0x12 string >\x2f \b-%.4s 23869>0x16 string >\x2f \b-%.4s 23870>0x1a string >\x2f \b-%.6s 23871>0x20 lequad x \b, size: %lld 23872 23873 23874# read the offset to add to the start of the header, and the header 23875# start in 0x200 238760x218 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 23877>&(&-12.l-0x20) use lvm2 23878 238790x018 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 23880>&(&-12.l-0x20) use lvm2 23881 238820x418 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 23883>&(&-12.l-0x20) use lvm2 23884 238850x618 string/b LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 23886>&(&-12.l-0x20) use lvm2 23887 23888# LVM snapshot 23889# from Jason Farrel 238900 string SnAp LVM Snapshot (CopyOnWrite store) 23891>4 lelong !0 - valid, 23892>4 lelong 0 - invalid, 23893>8 lelong x version %d, 23894>12 lelong x chunk_size %d 23895 23896# SE Linux policy database 238970 lelong 0xf97cff8c SE Linux policy 23898>16 lelong x v%d 23899>20 lelong 1 MLS 23900>24 lelong x %d symbols 23901>28 lelong x %d ocons 23902 23903# Summary: Xen saved domain file 23904# Created by: Radek Vokal <rvokal@redhat.com> 239050 string LinuxGuestRecord Xen saved domain 23906>20 search/256 (name 23907>>&1 string x (name %s) 23908 23909# Type: Xen, the virtual machine monitor 23910# From: Radek Vokal <rvokal@redhat.com> 239110 string LinuxGuestRecord Xen saved domain 23912#>2 regex \(name\ [^)]*\) %s 23913>20 search/256 (name (name 23914>>&1 string x %s...) 23915 23916# Systemd journald files 23917# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/. 23918# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 23919 23920# check magic 239210 string LPKSHHRH 23922# check that state is one of known values 23923>16 ubyte&252 0 23924# check that each half of three unique id128s is non-zero 23925>>24 ubequad >0 23926>>>32 ubequad >0 23927>>>>40 ubequad >0 23928>>>>>48 ubequad >0 23929>>>>>>56 ubequad >0 23930>>>>>>>64 ubequad >0 Journal file 23931!:mime application/octet-stream 23932# provide more info 23933>>>>>>>>184 leqdate 0 empty 23934>>>>>>>>16 ubyte 0 \b, offline 23935>>>>>>>>16 ubyte 1 \b, online 23936>>>>>>>>16 ubyte 2 \b, archived 23937>>>>>>>>8 ulelong&1 1 \b, sealed 23938>>>>>>>>12 ulelong&1 1 \b, compressed 23939 23940# BCache backing and cache devices 23941# From: Gabriel de Perthuis <g2p.code@gmail.com> 239420x1008 lequad 8 23943>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 23944>>0x1010 ulequad 0 cache device 23945>>0x1010 ulequad 1 backing device 23946>>0x1010 ulequad 3 cache device 23947>>0x1010 ulequad 4 backing device 23948>>0x1048 string >0 \b, label "%.32s" 23949>>0x1028 ubelong x \b, uuid %08x 23950>>0x102c ubeshort x \b-%04x 23951>>0x102e ubeshort x \b-%04x 23952>>0x1030 ubeshort x \b-%04x 23953>>0x1032 ubelong x \b-%08x 23954>>0x1036 ubeshort x \b%04x 23955>>0x1038 ubelong x \b, set uuid %08x 23956>>0x103c ubeshort x \b-%04x 23957>>0x103e ubeshort x \b-%04x 23958>>0x1040 ubeshort x \b-%04x 23959>>0x1042 ubelong x \b-%08x 23960>>0x1046 ubeshort x \b%04x 23961 23962# Linux device tree: 23963# File format description can be found in the Linux kernel sources at 23964# Documentation/devicetree/booting-without-of.txt 23965# From Christoph Biedl 239660 belong 0xd00dfeed 23967# structure must be within blob, strings are omitted to handle devicetrees > 1M 23968>&(8.L) byte x 23969>>20 belong >1 Device Tree Blob version %d 23970>>>4 belong x \b, size=%d 23971>>>20 belong >1 23972>>>>28 belong x \b, boot CPU=%d 23973>>>20 belong >2 23974>>>>32 belong x \b, string block size=%d 23975>>>20 belong >16 23976>>>>36 belong x \b, DT structure block size=%d 23977 23978# glibc locale archive as defined in glibc locale/locarchive.h 239790 lelong 0xde020109 locale archive 23980>24 lelong x %d strings 23981 23982# Linux Software RAID (mdadm) 23983# Russell Coker <russell@coker.com.au> 239840 name linuxraid 23985>16 belong x UUID=%8x: 23986>20 belong x \b%8x: 23987>24 belong x \b%8x: 23988>28 belong x \b%8x 23989>32 string x name=%s 23990>72 lelong x level=%d 23991>92 lelong x disks=%d 23992 239934096 lelong 0xa92b4efc Linux Software RAID 23994>4100 lelong x version 1.2 (%d) 23995>4096 use linuxraid 23996 239970 lelong 0xa92b4efc Linux Software RAID 23998>4 lelong x version 1.1 (%d) 23999>0 use linuxraid 24000 24001# Summary: Database file for mlocate 24002# Description: A database file as used by mlocate, a fast implementation 24003# of locate/updatedb. It uses merging to reuse the existing 24004# database and avoid rereading most of the filesystem. It's 24005# the default version of locate on Arch Linux (and others). 24006# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 24007# Site: https://fedorahosted.org/mlocate/ 24008# Format docs: https://linux.die.net/man/5/mlocate.db 24009# Type: mlocate database file 24010# URL: https://fedorahosted.org/mlocate/ 24011# From: Wander Nauta <info@wandernauta.nl> 240120 string \0mlocate mlocate database 24013>12 byte x \b, version %d 24014>13 byte 1 \b, require visibility 24015>16 string x \b, root %s 24016 24017# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL: 24018# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 24019# From: Pavel Emelyanov <xemul@parallels.com> 240200 lelong 0x45311224 iproute2 routes dump 240210 lelong 0x47361222 iproute2 addresses dump 24022 24023# Image and service files for CRIU tool. 24024# URL: https://criu.org 24025# From: Pavel Emelyanov <xemul@parallels.com> 240260 lelong 0x54564319 CRIU image file v1.1 240270 lelong 0x55105940 CRIU service file 240280 lelong 0x58313116 CRIU inventory 24029 24030# Kdump compressed dump files 24031# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 24032 240330 string KDUMP Kdump compressed dump 24034>8 long x v%d 24035>12 string >\0 \b, system %s 24036>77 string >\0 \b, node %s 24037>142 string >\0 \b, release %s 24038>207 string >\0 \b, version %s 24039>272 string >\0 \b, machine %s 24040>337 string >\0 \b, domain %s 24041 24042# Device Tree files 240430 search/1024 /dts-v1/ Device Tree File (v1) 24044# beat c code 24045!:strength +14 24046 24047 24048# e2fsck undo file 24049# David Gilman <davidgilman1@gmail.com> 240500 string E2UNDO02 e2fsck undo file, version 2 24051>44 lelong x \b, undo file is 24052>>44 lelong&1 0 not finished 24053>>44 lelong&1 1 finished 24054>48 lelong x \b, undo file features: 24055>>48 lelong&1 0 lacks filesystem offset 24056>>48 lelong&1 1 has filesystem offset 24057>>>64 lequad x at %#llx 24058 24059# ansible vault (does not really belong here) 240600 string $ANSIBLE_VAULT; Ansible Vault 24061>&0 regex [0-9]+\\.[0-9]+ \b, version %s 24062>>&0 string ; 24063>>>&0 regex [A-Z0-9]+ \b, encryption %s 24064 24065# From: Joerg Jenderek 24066# URL: https://www.gnu.org/software/grub 24067# Reference: https://ftp.gnu.org/gnu/grub/grub-2.06.tar.gz 24068# grub-2.06/include/grub/keyboard_layouts.h 24069# grub-2.06/grub-core/commands/keylayouts.c 24070# GRUB_KEYBOARD_LAYOUTS_FILEMAGIC 240710 string GRUBLAYO GRUB Keyboard 24072!:mime application/x-grub-keyboard 24073!:ext gkb 24074# GRUB_KEYBOARD_LAYOUTS_VERSION like: 10 24075>8 ulelong !10 \b, version %u 24076# 4 grub_uint32_t grub_keyboard_layout[160] 24077# for normal french keyboard this is letter a 24078>92 ubyte !0x71 24079>>92 ubyte >0x40 \b, english q is %c 24080#>732 ubyte x \b, english Q is %c 24081# for normal german keyboard this is letter z 24082>124 ubyte !0x79 24083>>124 ubyte >0x40 \b, english y is %c 24084#>764 ubyte x \b, english Y is %c 24085 24086#------------------------------------------------------------------------------ 24087# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $ 24088# lisp: file(1) magic for lisp programs 24089# 24090# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 24091 24092# updated by Joerg Jenderek 24093# GRR: This lot is too weak 24094#0 string ;; 24095# windows INF files often begin with semicolon and use CRLF as line end 24096# lisp files are mainly created on unix system with LF as line end 24097#>2 search/4096 !\r Lisp/Scheme program text 24098#>2 search/4096 \r Windows INF file 24099 241000 search/4096 (setq\ Lisp/Scheme program text 24101!:mime text/x-lisp 241020 search/4096 (defvar\ Lisp/Scheme program text 24103!:mime text/x-lisp 241040 search/4096 (defparam\ Lisp/Scheme program text 24105!:mime text/x-lisp 241060 search/4096 (defun\ Lisp/Scheme program text 24107!:mime text/x-lisp 241080 search/4096 (autoload\ Lisp/Scheme program text 24109!:mime text/x-lisp 241100 search/4096 (custom-set-variables\ Lisp/Scheme program text 24111!:mime text/x-lisp 24112 24113# URL: https://en.wikipedia.org/wiki/Emacs_Lisp 24114# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz 24115# Update: Joerg Jenderek 24116# Emacs 18 - this is always correct, but not very magical. 241170 string \012( 24118# look for emacs lisp keywords 24119# GRR: split regex because it is too long or get error like 24120# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|' 24121>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data 24122!:mime application/x-elc 24123# https://searchcode.com/codesearch/view/2173420/ 24124# not really pure text 24125!:apple EMAxTEXT 24126!:ext elc 24127# remaining regex 24128>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data 24129!:mime application/x-elc 24130!:apple EMAxTEXT 24131!:ext elc 24132# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;; 24133 24134# Emacs 19+ - ver. recognition added by Ian Springer 24135# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 24136# - Chris Chittleborough <cchittleborough@yahoo.com.au> 24137# Update: Joerg Jenderek 241380 string ;ELC 24139# version\0\0\0 24140>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data 24141# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015 24142#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 24143!:mime application/x-elc 24144!:apple EMAxTEXT 24145!:ext elc 24146 24147# Files produced by GNU/Emacs pdumper 241480 string DUMPEDGNUEMACS GNU/Emacs pdumper image 24149 24150# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 241510 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 241520 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 24153 241540 long 0x70768BD2 CLISP memory image data 241550 long 0xD28B7670 CLISP memory image data, other endian 24156 24157#.com and .bin for MIT scheme 241580 string \372\372\372\372 MIT scheme (library?) 24159 24160# From: David Allouche <david@allouche.net> 241610 search/1 \<TeXmacs| TeXmacs document text 24162!:mime text/texmacs 24163 24164#------------------------------------------------------------------------------ 24165# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $ 24166# llvm: file(1) magic for LLVM byte-codes 24167# URL: https://llvm.org/docs/BitCodeFormat.html 24168# From: Al Stone <ahs3@fc.hp.com> 24169 241700 string llvm LLVM byte-codes, uncompressed 241710 string llvc0 LLVM byte-codes, null compression 241720 string llvc1 LLVM byte-codes, gzip compression 241730 string llvc2 LLVM byte-codes, bzip2 compression 24174 241750 lelong 0x0b17c0de LLVM bitcode, wrapper 24176# Are these Mach-O ABI values? They appear to be. 24177>16 lelong 0x01000007 x86_64 24178>16 lelong 0x00000007 i386 24179>16 lelong 0x00000012 ppc 24180>16 lelong 0x01000012 ppc64 24181>16 lelong 0x0000000c arm 24182 241830 string BC\xc0\xde LLVM IR bitcode 24184 24185#------------------------------------------------------------------------------ 24186# $File: locoscript,v 1.1 2021/01/03 20:56:25 christos Exp $ 24187# locoscript: file(1) magic for LocoScript documents and related files 24188# 24189# See http://fileformats.archiveteam.org/wiki/LocoScript 241900 string JOY\x01\x01 LocoScript 1 document 241910 string JOY\x01\x02 LocoScript 2 document 241920 string JOY\x01\x04 LocoScript 3 document 241930 string JOY\x01\x06 LocoScript 4 document 241940 string DOC\x01\x01 LocoScript PC document 241950 string DOC\x01\x03 LocoScript Professional document 24196 24197#------------------------------------------------------------------------------ 24198# $File: lua,v 1.8 2020/10/08 23:23:56 christos Exp $ 24199# lua: file(1) magic for Lua scripting language 24200# URL: https://www.lua.org/ 24201# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 24202 24203# Lua scripts 242040 search/1/w #!\ /usr/bin/lua Lua script text executable 24205!:mime text/x-lua 242060 search/1/w #!\ /usr/local/bin/lua Lua script text executable 24207!:mime text/x-lua 242080 search/1 #!/usr/bin/env\ lua Lua script text executable 24209!:mime text/x-lua 242100 search/1 #!\ /usr/bin/env\ lua Lua script text executable 24211!:mime text/x-lua 24212 24213# Lua bytecode 242140 string \033Lua Lua bytecode, 24215# 2.4 uses 0x23 as its version byte because it shares the format 24216# with 2.3 (which was never released publicly). 24217>4 byte 0x23 version 2.4 24218>4 byte 0x25 version 2.5/3.0 24219>4 byte 0x31 version 3.1 24220>4 byte 0x32 version 3.2 24221>4 byte 0x40 version 4.0 24222>4 byte 0x50 version 5.0 24223>4 byte 0x51 version 5.1 24224>4 byte 0x52 version 5.2 24225>4 byte 0x53 version 5.3 24226>4 byte 0x54 version 5.4 24227 24228#------------------------------------------------------------------------------ 24229# $File: luks,v 1.5 2022/09/07 11:23:44 christos Exp $ 24230# luks: file(1) magic for Linux Unified Key Setup 24231# URL: https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup 24232# http://fileformats.archiveteam.org/wiki/LUKS 24233# From: Anthon van der Neut <anthon@mnt.org> 24234# Update: Joerg Jenderek 24235# Note: verfied by command like `cryptsetup luksDump /dev/sda3` 24236 242370 string LUKS\xba\xbe LUKS encrypted file, 24238# https://reposcope.com/mimetype/application/x-raw-disk-image 24239!:mime application/x-raw-disk-image 24240#!:mime application/x-luks-volume 24241# img is the generic extension; no suffix for partitions; luksVolumeHeaderBackUp via zuluCrypt 24242!:ext /luks/img/luksVolumeHeaderBackUp 24243# version like: 1 2 24244>6 beshort x ver %d 24245# test for version 1 variant 24246>6 beshort 1 24247>>0 use luks-v1 24248# test for version 2 variant 24249>6 beshort >1 24250>>0 use luks-v2 24251# Reference: https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf 24252# http://mark0.net/download/triddefs_xml.7z/defs/l/luks.trid.xml 24253# display information about LUKS version 1 242540 name luks-v1 24255# cipher-name like: aes twofish 24256>8 string x [%s, 24257# cipher-mode like: xts-plain64 cbc-essiv 24258>40 string x %s, 24259# hash specification like: sha256 sha1 ripemd160 24260>72 string x %s] 24261>168 string x UUID: %s 24262# NEW PART! 24263# payload-offset; start offset of the bulk data 24264>104 ubelong x \b, at %#x data 24265# key-bytes; number of key bytes; key-bytes*8=MK-bits 24266>108 ubelong x \b, %u key bytes 24267# mk-digest[20]; master key checksum from PBKDF2 24268>112 ubequad x \b, MK digest %#16.16llx 24269>>120 ubequad x \b%16.16llx 24270>>128 ubelong x \b%8.8x 24271# mk-digest-salt[32]; salt parameter for master key PBKDF2 24272>132 ubequad x \b, MK salt %#16.16llx 24273>>140 ubequad x \b%16.16llx 24274>>148 ubequad x \b%16.16llx 24275>>156 ubequad x \b%16.16llx 24276# mk-digest-iter; iterations parameter for master key PBKDF2 24277>164 ubelong x \b, %u MK iterations 24278# key slot 1 24279>208 ubelong =0x00AC71F3 \b; slot #0 24280>>208 use luks-slot 24281# key slot 2 24282>256 ubelong =0x00AC71F3 \b; slot #1 24283>>256 use luks-slot 24284# key slot 3 24285>304 ubelong =0x00AC71F3 \b; slot #2 24286>>304 use luks-slot 24287# key slot 4 24288>352 ubelong =0x00AC71F3 \b; slot #3 24289>>352 use luks-slot 24290# key slot 5 24291>400 ubelong =0x00AC71F3 \b; slot #4 24292>>400 use luks-slot 24293# key slot 6 24294>448 ubelong =0x00AC71F3 \b; slot #5 24295>>448 use luks-slot 24296# key slot 7 24297>496 ubelong =0x00AC71F3 \b; slot #6 24298>>496 use luks-slot 24299# key slot 8 24300>544 ubelong =0x00AC71F3 \b; slot #7 24301>>544 use luks-slot 24302# Reference: https://gitlab.com/cryptsetup/LUKS2-docs/-/raw/master/luks2_doc_wip.pdf 24303# http://mark0.net/download/triddefs_xml.7z/defs/l/luks2.trid.xml 24304# display information about LUKS version 2 243050 name luks-v2 24306# hdr_size; size including JSON area called Metadata area by cryptsetup with value like: 16384 24307>8 ubequad x \b, header size %llu 24308# possible check for MAGIC_2ND after header 24309#>(8.Q) string SKUL\xba\xbe \b, 2nd_HEADER_OK 24310# seqid; sequence ID, increased on update; called Epoch by cryptsetup with value like: 3 4 8 10 24311>16 ubequad x \b, ID %llu 24312# label[48]; optional ASCII label or empty; called Label by cryptsetup with value like: "LUKS2_EXT4_ROOT" 24313>24 string >\0 \b, label %s 24314# csum_alg[32]; checksum algorithm like: sha256 sha1 sha512 wirlpool ripemd160 24315>72 string x \b, algo %s 24316# salt[64]; salt , unique for every header 24317>104 ubequad x \b, salt %#llx... 24318# uuid[40]; UID of device as string like: 242256c6-396e-4a35-af5f-5b70cb7af9a7 24319>168 string x \b, UUID: %-.40s 24320# subsystem[48]; optional owner subsystem label or empty 24321>208 string >\0 \b, sub label %-.48s 24322# hdr_offset; offset from device start [ bytes ] like: 0 24323>256 ubequad !0 \b, offset %llx 24324# char _padding [184]; must be zeroed 24325#>264 ubequad x \b, padding %#16.16llx 24326#>440 ubequad x \b...%16.16llx 24327# csum[64]; header checksum 24328>448 ubequad x \b, crc %#llx... 24329# char _padding4096 [7*512]; Padding , must be zeroed 24330#>512 ubequad x \b, more padding %#16.16llx 24331#>4088 ubequad x \b...%16.16llx 24332# JSON text data terminated by the zero character; unused remainder empty and filled with zeroes like: 24333# {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offse" 24334>0x1000 string x \b, at 0x1000 %s 24335#>0x1000 indirect x 24336# display information (like active) about LUKS1 slot 243370 name luks-slot 24338# state of keyslot; 0x00AC71F3~active 0x0000DEAD~inactive 24339#>0 ubelong x \b, status %#8.8x 24340>0 ubelong =0x00AC71F3 active 24341>0 ubelong =0x0000DEAD inactive 24342# iteration parameter for PBKDF2 24343#>4 ubelong x \b, %u iterations 24344# salt parameter for PBKDF2 24345#>8 ubequad x \b, salt %#16.16llx 24346#>>16 ubequad x \b%16.16llx 24347#>>24 ubequad x \b%16.16llx 24348#>>32 ubequad x \b%16.16llx 24349# start sector of key material like: 8 0x200 0x3f8 0x5f0 0xdd0 24350>40 ubelong x \b, %#x material offset 24351# number of anti-forensic stripes like: 4000 24352>44 ubelong !4000 \b, %u stripes 24353#------------------------------------------------------------------------------ 24354# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $ 24355# make: file(1) magic for M4 scripts 24356# 243570 search/8192 dnl 24358>0 regex \^dnl\ M4 macro processor script text 24359!:mime text/x-m4 243600 search/8192 AC_DEFUN 24361>0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text 24362!:strength + 15 24363!:mime text/x-m4 24364 24365#------------------------------------------------------------ 24366# $File: mach,v 1.29 2021/04/26 15:56:00 christos Exp $ 24367# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 24368# Unfortunately the first, cafebabe, is shared with 24369# Java ByteCode, so they are both handled in the file "cafebabe". 24370# The "feedface" ones are handled herein. 24371#------------------------------------------------------------ 24372# if set, it's for the 64-bit version of the architecture 24373# yes, this is separate from the low-order magic number bit 24374# it's also separate from the "64-bit libraries" bit in the 24375# upper 8 bits of the CPU subtype 24376 24377# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/ 24378# include/mach-o/loader.h 24379# display CPU type as string like: i386 x86_64 ... armv7 armv7k ... 243800 name mach-o-cpu 24381>0 belong&0xff000000 0 24382# 24383# 32-bit ABIs. 24384# 24385# 1 vax 24386>>0 belong&0x00ffffff 1 24387>>>4 belong&0x00ffffff 0 vax 24388>>>4 belong&0x00ffffff 1 vax11/780 24389>>>4 belong&0x00ffffff 2 vax11/785 24390>>>4 belong&0x00ffffff 3 vax11/750 24391>>>4 belong&0x00ffffff 4 vax11/730 24392>>>4 belong&0x00ffffff 5 uvaxI 24393>>>4 belong&0x00ffffff 6 uvaxII 24394>>>4 belong&0x00ffffff 7 vax8200 24395>>>4 belong&0x00ffffff 8 vax8500 24396>>>4 belong&0x00ffffff 9 vax8600 24397>>>4 belong&0x00ffffff 10 vax8650 24398>>>4 belong&0x00ffffff 11 vax8800 24399>>>4 belong&0x00ffffff 12 uvaxIII 24400>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 24401>>0 belong&0x00ffffff 2 romp 24402>>0 belong&0x00ffffff 3 architecture=3 24403>>0 belong&0x00ffffff 4 ns32032 24404>>0 belong&0x00ffffff 5 ns32332 24405>>0 belong&0x00ffffff 6 m68k 24406# 7 x86 24407>>0 belong&0x00ffffff 7 24408>>>4 belong&0x0000000f 3 i386 24409>>>4 belong&0x0000000f 4 i486 24410>>>>4 belong&0x00fffff0 0 24411>>>>4 belong&0x00fffff0 0x80 \bsx 24412>>>4 belong&0x0000000f 5 i586 24413>>>4 belong&0x0000000f 6 24414>>>>4 belong&0x00fffff0 0 p6 24415>>>>4 belong&0x00fffff0 0x10 pentium_pro 24416>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 24417>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 24418>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 24419>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 24420>>>>4 belong&0x00fffff0 >0x50 pentium_2_m%#x 24421>>>4 belong&0x0000000f 7 celeron 24422>>>>4 belong&0x00fffff0 0x00 \b_m%#x 24423>>>>4 belong&0x00fffff0 0x10 \b_m%#x 24424>>>>4 belong&0x00fffff0 0x20 \b_m%#x 24425>>>>4 belong&0x00fffff0 0x30 \b_m%#x 24426>>>>4 belong&0x00fffff0 0x40 \b_m%#x 24427>>>>4 belong&0x00fffff0 0x50 \b_m%#x 24428>>>>4 belong&0x00fffff0 0x60 24429>>>>4 belong&0x00fffff0 0x70 \b_mobile 24430>>>>4 belong&0x00fffff0 >0x70 \b_m%#x 24431>>>4 belong&0x0000000f 8 pentium_3 24432>>>>4 belong&0x00fffff0 0x00 24433>>>>4 belong&0x00fffff0 0x10 \b_m 24434>>>>4 belong&0x00fffff0 0x20 \b_xeon 24435>>>>4 belong&0x00fffff0 >0x20 \b_m%#x 24436>>>4 belong&0x0000000f 9 pentiumM 24437>>>>4 belong&0x00fffff0 0x00 24438>>>>4 belong&0x00fffff0 >0x00 \b_m%#x 24439>>>4 belong&0x0000000f 10 pentium_4 24440>>>>4 belong&0x00fffff0 0x00 24441>>>>4 belong&0x00fffff0 0x10 \b_m 24442>>>>4 belong&0x00fffff0 >0x10 \b_m%#x 24443>>>4 belong&0x0000000f 11 itanium 24444>>>>4 belong&0x00fffff0 0x00 24445>>>>4 belong&0x00fffff0 0x10 \b_2 24446>>>>4 belong&0x00fffff0 >0x10 \b_m%#x 24447>>>4 belong&0x0000000f 12 xeon 24448>>>>4 belong&0x00fffff0 0x00 24449>>>>4 belong&0x00fffff0 0x10 \b_mp 24450>>>>4 belong&0x00fffff0 >0x10 \b_m%#x 24451>>>4 belong&0x0000000f >12 ia32 family=%d 24452>>>>4 belong&0x00fffff0 0x00 24453>>>>4 belong&0x00fffff0 >0x00 model=%x 24454>>0 belong&0x00ffffff 8 mips 24455>>>4 belong&0x00ffffff 1 R2300 24456>>>4 belong&0x00ffffff 2 R2600 24457>>>4 belong&0x00ffffff 3 R2800 24458>>>4 belong&0x00ffffff 4 R2000a 24459>>>4 belong&0x00ffffff 5 R2000 24460>>>4 belong&0x00ffffff 6 R3000a 24461>>>4 belong&0x00ffffff 7 R3000 24462>>>4 belong&0x00ffffff >7 subarchitecture=%d 24463>>0 belong&0x00ffffff 9 ns32532 24464>>0 belong&0x00ffffff 10 mc98000 24465>>0 belong&0x00ffffff 11 hppa 24466>>>4 belong&0x00ffffff 0 7100 24467>>>4 belong&0x00ffffff 1 7100LC 24468>>>4 belong&0x00ffffff >1 subarchitecture=%d 24469>>0 belong&0x00ffffff 12 arm 24470>>>4 belong&0x00ffffff 0 24471>>>4 belong&0x00ffffff 1 subarchitecture=%d 24472>>>4 belong&0x00ffffff 2 subarchitecture=%d 24473>>>4 belong&0x00ffffff 3 subarchitecture=%d 24474>>>4 belong&0x00ffffff 4 subarchitecture=%d 24475>>>4 belong&0x00ffffff 5 \bv4t 24476>>>4 belong&0x00ffffff 6 \bv6 24477>>>4 belong&0x00ffffff 7 \bv5tej 24478>>>4 belong&0x00ffffff 8 \bxscale 24479>>>4 belong&0x00ffffff 9 \bv7 24480>>>4 belong&0x00ffffff 10 \bv7f 24481>>>4 belong&0x00ffffff 11 \bv7s 24482>>>4 belong&0x00ffffff 12 \bv7k 24483>>>4 belong&0x00ffffff 13 \bv8 24484>>>4 belong&0x00ffffff 14 \bv6m 24485>>>4 belong&0x00ffffff 15 \bv7m 24486>>>4 belong&0x00ffffff 16 \bv7em 24487>>>4 belong&0x00ffffff >16 subarchitecture=%d 24488# 13 m88k 24489>>0 belong&0x00ffffff 13 24490>>>4 belong&0x00ffffff 0 mc88000 24491>>>4 belong&0x00ffffff 1 mc88100 24492>>>4 belong&0x00ffffff 2 mc88110 24493>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 24494>>0 belong&0x00ffffff 14 SPARC 24495>>0 belong&0x00ffffff 15 i860g 24496>>0 belong&0x00ffffff 16 alpha 24497>>0 belong&0x00ffffff 17 rs6000 24498>>0 belong&0x00ffffff 18 ppc 24499>>>4 belong&0x00ffffff 0 24500>>>4 belong&0x00ffffff 1 \b_601 24501>>>4 belong&0x00ffffff 2 \b_602 24502>>>4 belong&0x00ffffff 3 \b_603 24503>>>4 belong&0x00ffffff 4 \b_603e 24504>>>4 belong&0x00ffffff 5 \b_603ev 24505>>>4 belong&0x00ffffff 6 \b_604 24506>>>4 belong&0x00ffffff 7 \b_604e 24507>>>4 belong&0x00ffffff 8 \b_620 24508>>>4 belong&0x00ffffff 9 \b_750 24509>>>4 belong&0x00ffffff 10 \b_7400 24510>>>4 belong&0x00ffffff 11 \b_7450 24511>>>4 belong&0x00ffffff 100 \b_970 24512>>>4 belong&0x00ffffff >100 subarchitecture=%d 24513>>0 belong&0x00ffffff >18 architecture=%d 24514>0 belong&0xff000000 0x01000000 24515# 24516# 64-bit ABIs. 24517# 24518>>0 belong&0x00ffffff 0 64-bit architecture=%d 24519>>0 belong&0x00ffffff 1 64-bit architecture=%d 24520>>0 belong&0x00ffffff 2 64-bit architecture=%d 24521>>0 belong&0x00ffffff 3 64-bit architecture=%d 24522>>0 belong&0x00ffffff 4 64-bit architecture=%d 24523>>0 belong&0x00ffffff 5 64-bit architecture=%d 24524>>0 belong&0x00ffffff 6 64-bit architecture=%d 24525>>0 belong&0x00ffffff 7 x86_64 24526>>>4 belong&0x00ffffff 0 subarchitecture=%d 24527>>>4 belong&0x00ffffff 1 subarchitecture=%d 24528>>>4 belong&0x00ffffff 2 subarchitecture=%d 24529>>>4 belong&0x00ffffff 3 24530>>>4 belong&0x00ffffff 4 \b_arch1 24531>>>4 belong&0x00ffffff 8 \b_haswell 24532>>>4 belong&0x00ffffff >4 subarchitecture=%d 24533>>0 belong&0x00ffffff 8 64-bit architecture=%d 24534>>0 belong&0x00ffffff 9 64-bit architecture=%d 24535>>0 belong&0x00ffffff 10 64-bit architecture=%d 24536>>0 belong&0x00ffffff 11 64-bit architecture=%d 24537>>0 belong&0x00ffffff 12 arm64 24538>>>4 belong&0x00ffffff 0 24539>>>4 belong&0x00ffffff 1 \bv8 24540>>>4 belong&0x00ffffff 2 \be 24541>>>>7 ubyte&0xff >0 (caps: 24542>>>>7 ubyte&0xff <0x80 %#02x 24543>>>>7 ubyte&0xc0 0x80 PAC 24544>>>>>7 ubyte&0x3f x \b%02d 24545>>>>7 ubyte&0xc0 0xc0 PAK 24546>>>>>7 ubyte&0x3f x \b%02d 24547>>>>7 ubyte&0xff x \b) 24548>>>4 belong&0x00ffffff >2 subarchitecture=%d 24549>>0 belong&0x00ffffff 13 64-bit architecture=%d 24550>>0 belong&0x00ffffff 14 64-bit architecture=%d 24551>>0 belong&0x00ffffff 15 64-bit architecture=%d 24552>>0 belong&0x00ffffff 16 64-bit architecture=%d 24553>>0 belong&0x00ffffff 17 64-bit architecture=%d 24554>>0 belong&0x00ffffff 18 ppc64 24555>>>4 belong&0x00ffffff 0 24556>>>4 belong&0x00ffffff 1 \b_601 24557>>>4 belong&0x00ffffff 2 \b_602 24558>>>4 belong&0x00ffffff 3 \b_603 24559>>>4 belong&0x00ffffff 4 \b_603e 24560>>>4 belong&0x00ffffff 5 \b_603ev 24561>>>4 belong&0x00ffffff 6 \b_604 24562>>>4 belong&0x00ffffff 7 \b_604e 24563>>>4 belong&0x00ffffff 8 \b_620 24564>>>4 belong&0x00ffffff 9 \b_650 24565>>>4 belong&0x00ffffff 10 \b_7400 24566>>>4 belong&0x00ffffff 11 \b_7450 24567>>>4 belong&0x00ffffff 100 \b_970 24568>>>4 belong&0x00ffffff >100 subarchitecture=%d 24569>>0 belong&0x00ffffff >18 64-bit architecture=%d 24570>0 belong&0xff000000 0x02000000 24571# 24572# 64_32-bit ABIs. 24573# 24574>>0 belong&0x00ffffff 0 64_32-bit architecture=%d 24575>>0 belong&0x00ffffff 1 64_32-bit architecture=%d 24576>>0 belong&0x00ffffff 2 64_32-bit architecture=%d 24577>>0 belong&0x00ffffff 3 64_32-bit architecture=%d 24578>>0 belong&0x00ffffff 4 64_32-bit architecture=%d 24579>>0 belong&0x00ffffff 5 64_32-bit architecture=%d 24580>>0 belong&0x00ffffff 6 64_32-bit architecture=%d 24581>>0 belong&0x00ffffff 7 64_32-bit architecture=%d 24582>>0 belong&0x00ffffff 8 64_32-bit architecture=%d 24583>>0 belong&0x00ffffff 9 64_32-bit architecture=%d 24584>>0 belong&0x00ffffff 10 64_32-bit architecture=%d 24585>>0 belong&0x00ffffff 11 64_32-bit architecture=%d 24586>>0 belong&0x00ffffff 12 64_32-bit arm 24587>>>4 belong&0x00ffffff 0 24588>>>4 belong&0x00ffffff 1 \bv8 24589>>>4 belong&0x00ffffff >1 subarchitecture=%d 24590>>0 belong&0x00ffffff 13 64_32-bit architecture=%d 24591>>0 belong&0x00ffffff 14 64_32-bit architecture=%d 24592>>0 belong&0x00ffffff 15 64_32-bit architecture=%d 24593>>0 belong&0x00ffffff 16 64_32-bit architecture=%d 24594>>0 belong&0x00ffffff 17 64_32-bit architecture=%d 24595>>0 belong&0x00ffffff 18 64_32-bit architecture=%d 24596>>0 belong&0x00ffffff >18 64_32-bit architecture=%d 24597 245980 name mach-o-be 24599>0 byte 0xcf 64-bit 24600>4 use mach-o-cpu 24601>12 belong 1 object 24602# GRR: Does not work for Mach-O with 2 architectures; instead display oo 24603#!:ext o 24604!:ext o/ 24605>12 belong 2 executable 24606# the executables normally have no file extension like perl, 24607# but exceptions like perl5.18 perl5.16 24608!:ext 16/18/ 24609>12 belong 3 fixed virtual memory shared library 24610>12 belong 4 core 24611>12 belong 5 preload executable 24612>12 belong 6 dynamically linked shared library 24613# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib 24614#!:ext dylib 24615!:ext dylib/ 24616>12 belong 7 dynamic linker 24617>12 belong 8 bundle 24618# normally name extension bundle; but exceptions like: AMDil_r700.dylib 24619!:ext bundle/dylib/ 24620>12 belong 9 dynamically linked shared library stub 24621>12 belong 10 dSYM companion file 24622>12 belong 11 kext bundle 24623>12 belong >11 24624>>12 belong x filetype=%d 24625>24 belong >0 \b, flags:< 24626>>24 belong &0x00000001 \bNOUNDEFS 24627>>24 belong &0x00000002 \b|INCRLINK 24628>>24 belong &0x00000004 \b|DYLDLINK 24629>>24 belong &0x00000008 \b|BINDATLOAD 24630>>24 belong &0x00000010 \b|PREBOUND 24631>>24 belong &0x00000020 \b|SPLIT_SEGS 24632>>24 belong &0x00000040 \b|LAZY_INIT 24633>>24 belong &0x00000080 \b|TWOLEVEL 24634>>24 belong &0x00000100 \b|FORCE_FLAT 24635>>24 belong &0x00000200 \b|NOMULTIDEFS 24636>>24 belong &0x00000400 \b|NOFIXPREBINDING 24637>>24 belong &0x00000800 \b|PREBINDABLE 24638>>24 belong &0x00001000 \b|ALLMODSBOUND 24639>>24 belong &0x00002000 \b|SUBSECTIONS_VIA_SYMBOLS 24640>>24 belong &0x00004000 \b|CANONICAL 24641>>24 belong &0x00008000 \b|WEAK_DEFINES 24642>>24 belong &0x00010000 \b|BINDS_TO_WEAK 24643>>24 belong &0x00020000 \b|ALLOW_STACK_EXECUTION 24644>>24 belong &0x00040000 \b|ROOT_SAFE 24645>>24 belong &0x00080000 \b|SETUID_SAFE 24646>>24 belong &0x00100000 \b|NO_REEXPORTED_DYLIBS 24647>>24 belong &0x00200000 \b|PIE 24648>>24 belong &0x00400000 \b|DEAD_STRIPPABLE_DYLIB 24649>>24 belong &0x00800000 \b|HAS_TLV_DESCRIPTORS 24650>>24 belong &0x01000000 \b|NO_HEAP_EXECUTION 24651>>24 belong &0x02000000 \b|APP_EXTENSION_SAFE 24652>>24 belong &0x04000000 \b|NLIST_OUTOFSYNC_WITH_DYLDINFO 24653>>24 belong &0x08000000 \b|SIM_SUPPORT 24654>>24 belong &0x80000000 \b|DYLIB_IN_CACHE 24655>>24 belong x \b> 24656 24657# 246580 lelong&0xfffffffe 0xfeedface Mach-O 24659!:strength +1 24660!:mime application/x-mach-binary 24661>0 use \^mach-o-be 24662 246630 belong&0xfffffffe 0xfeedface Mach-O 24664!:strength +1 24665!:mime application/x-mach-binary 24666>0 use mach-o-be 24667 24668#------------------------------------------------------------------------------ 24669# $File: macintosh,v 1.32 2021/04/26 15:56:00 christos Exp $ 24670# macintosh description 24671# 24672# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 24673# Daniel Quinlan, quinlan@yggdrasil.com 24674# Update: Joerg Jenderek 24675# URL: https://en.wikipedia.org/wiki/BinHex 24676# Reference: http://fileformats.archiveteam.org/wiki/BinHex 24677# Note: only tested with version 4.0 and hqx extension 24678# Any text/binary before the characteristic comment sentence is to be ignored like in 24679# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx 246800 search/1602 (This\ file\ 24681>&0 use binhex 24682# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx 246830 search/2652/b (This\ file\ 24684>&0 use binhex 246850 name binhex 24686# keep split search string format similar like in version 5.37 24687>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version 24688# http://www.macdisk.com/binhexen.php3 24689!:apple BNHQTEXT 24690# http://www.faqs.org/faqs/macintosh/comm-faq/part1/ 24691>>&0 string 1.0 1.0 24692!:mime application/mac-binhex 24693!:ext hex 24694>>&0 string 2.0 2.0 24695!:mime application/mac-binhex 24696!:ext hcx 24697# BinHex 3.0 never existed 24698>>&0 string 4.0 4.0 24699!:mime application/mac-binhex40 24700!:ext hqx 24701# BinHex 5.0 also MacBinary I 24702>>&0 string 5.0 5.0 24703!:mime application/mac-binhex40 24704!:ext hqx 24705# this should never happen 24706>>&0 default x 24707>>>&0 string x %.3s 24708!:mime application/mac-binhex 24709!:ext hqx 24710 24711# Stuffit archives are the de facto standard of compression for Macintosh 24712# files obtained from most archives. (franklsm@tuns.ca) 247130 string SIT! StuffIt Archive (data) 24714!:mime application/x-stuffit 24715!:apple SIT!SIT! 24716>2 string x : %s 247170 string SITD StuffIt Deluxe (data) 24718>2 string x : %s 247190 string Seg StuffIt Deluxe Segment (data) 24720>2 string x : %s 24721 24722# Newer StuffIt archives (grant@netbsd.org) 247230 string StuffIt StuffIt Archive 24724!:mime application/x-stuffit 24725!:apple SIT!SIT! 24726#>162 string >0 : %s 24727 24728# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 24729# GRR: Too weak 24730#0 string APPL Macintosh Application (data) 24731#>2 string x \b: %s 24732 24733# Macintosh System files (franklsm@tuns.ca) 24734# GRR: Too weak 24735#0 string zsys Macintosh System File (data) 24736#0 string FNDR Macintosh Finder (data) 24737#0 string libr Macintosh Library (data) 24738#>2 string x : %s 24739#0 string shlb Macintosh Shared Library (data) 24740#>2 string x : %s 24741#0 string cdev Macintosh Control Panel (data) 24742#>2 string x : %s 24743#0 string INIT Macintosh Extension (data) 24744#>2 string x : %s 24745#0 string FFIL Macintosh Truetype Font (data) 24746#>2 string x : %s 24747#0 string LWFN Macintosh Postscript Font (data) 24748#>2 string x : %s 24749 24750# Additional Macintosh Files (franklsm@tuns.ca) 24751# GRR: Too weak 24752#0 string PACT Macintosh Compact Pro Archive (data) 24753#>2 string x : %s 24754#0 string ttro Macintosh TeachText File (data) 24755#>2 string x : %s 24756#0 string TEXT Macintosh TeachText File (data) 24757#>2 string x : %s 24758#0 string PDF Macintosh PDF File (data) 24759#>2 string x : %s 24760 24761# MacBinary format (Eric Fischer, enf@pobox.com) 24762# Update: Joerg Jenderek 24763# URL: https://en.wikipedia.org/wiki/MacBinary 24764# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt 24765# 24766# Unfortunately MacBinary doesn't really have a magic number prior 24767# to the MacBinary III format. 24768# 24769 24770# old version number, must be kept at zero for compatibility 247710 byte 0 24772# length of filename (must be in the range 1-63) 24773>1 ubyte >0 24774# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 24775>>1 ubyte <64 24776# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 24777# by looking for printable characters at beginning of file name 24778>>>2 ubelong >0x1F000000 24779# zero fill, must be zero for compatibility 24780>>>>74 byte 0 24781# zero fill, must be zero for compatibility 24782>>>>>82 byte 0 24783# MacBinary I test for valid version numbers 24784>>>>>>122 ubeshort 0 24785# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 24786#>>>>>>>91 ubelong >0x7c25b07F 24787# additional check for undefined header fields in MacBinary I 24788#>>>>>>>101 ulong 0 24789>>>>>>>0 use mac-bin 24790# MacBinary II the newer versions begins at 129 24791>>>>>>122 ubeshort 0x8181 24792>>>>>>>0 use mac-bin 24793# MacBinary III with MacBinary II to read 24794>>>>>122 ubeshort 0x8281 24795>>>>>>0 use mac-bin 24796 24797# display information of MacBinary file 247980 name mac-bin 24799>122 ubyte x MacBinary 24800# versions for MacBinary II/III 24801>122 ubyte 129 II 24802>122 ubyte 130 III 24803# only in MacBinary III 24804>>102 string !mBIN with surprising version 24805!:mime application/x-macbinary 24806!:apple PSPTBINA 24807!:ext bin/macbin 24808# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 24809#>1 ubyte >63 \b, name length %u too BIG! 24810#>122 ubeshort x \b, version %#x 24811# Finder flags if not 0 24812# >73 byte !0 \b, flags 0x 24813# >73 byte =0 24814# >>101 byte !0 \b, flags 0x 24815# # original Finder flags (Bits 8-15) 24816# >73 byte !0 \b%x 24817# # finder flags, bits 0-7 24818# >101 byte !0 \b%x 24819>73 byte &0x01 \b, inited 24820>73 byte &0x02 \b, changed 24821>73 byte &0x04 \b, busy 24822>73 byte &0x08 \b, bozo 24823>73 byte &0x10 \b, system 24824>73 byte &0x20 \b, bundle 24825>73 byte &0x40 \b, invisible 24826>73 byte &0x80 \b, locked 24827 24828# 75 beshort # vertical posn in window 24829#>75 beshort !0 \b, v.pos %u 24830# 77 beshort # horiz posn in window 24831#>77 beshort !0 \b, h.pos %u 24832# 79 beshort # window or folder ID 24833>79 ubeshort !0 \b, ID %#x 24834# protected flag 24835>81 byte !0 \b, protected %#x 24836# length of comment after resource 24837>99 ubeshort !0 \b, comment length %u 24838# char. code of file name 24839>106 ubyte !0 \b, char. code %#x 24840# still more Finder flags 24841>107 ubyte !0 \b, more flags %#x 24842# length of total files when unpacked only used when pack and unpack on the fly 24843>116 ubelong !0 \b, total length %u 24844# 120 beshort # length of add'l header 24845>120 ubeshort !0 \b, 2nd header length %u 24846# 124 beshort # checksum 24847#>124 ubeshort !0 \b, CRC %#x 24848# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 24849>91 beldate-0x7C25B080 x \b, %s 24850# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 24851>91 ubelong <0x7c25b080 INVALID date 24852#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 24853# last modified date 24854>95 beldate-0x7C25B080 x \b, modified %s 24855# Apple creator+typ if not null 24856# file creator (normally expressed as four characters) 24857>69 ulong !0 \b, creator 24858# instead 4 character code display full creator name 24859>>69 use apple-creator 24860# file type (normally expressed as four characters) 24861>65 ulong !0 \b, type 24862>>65 use apple-type 24863# length of data segment 24864>83 ubelong !0 \b, %u bytes 24865# filename (in the range 1-63) 24866>1 pstring x "%s" 24867# print 1 space and then at offset 128 inspect data fork content if it has one 24868>83 ubelong !0 \b 24869>>128 indirect x 24870# Afterwards resource fork if length of resource segment not zero 24871>87 ubelong !0 24872# calculate resource fork offset 24873>>83 ubelong+128 x \b, at %#x 24874# length of resource segment 24875>>87 ubelong !0 %u bytes 24876>>(83.S+128) ubequad x resource 24877# further resource fork content inspection 24878>>>&-8 indirect x 24879 24880# Apple Type/Creator Database 24881# URL: https://en.wikipedia.org/wiki/Type_code 24882# Reference: https://www.lacikam.co.il/tcdb/ 24883# https://www.macdisk.com/macsigen.php 24884# Note: classic Mac OS files have two 4 character codes for type and creator. 24885# Thereby the Finder attach documents types to applications. 24886 24887#>65 string x \b, type "%4.4s" 24888 24889# display information about apple type 248900 name apple-type 24891>0 string 8BIM PhotoShop 24892>0 string ALB3 PageMaker 3 24893>0 string ALB4 PageMaker 4 24894>0 string ALT3 PageMaker 3 24895>0 string APPL application 24896>0 string AWWP AppleWorks word processor 24897>0 string CIRC simulated circuit 24898>0 string DRWG MacDraw 24899>0 string EPSF Encapsulated PostScript 24900>0 string FFIL font suitcase 24901>0 string FKEY function key 24902>0 string FNDR Macintosh Finder 24903>0 string GIFf GIF image 24904>0 string Gzip GNU gzip 24905>0 string INIT system extension 24906>0 string LIB\ library 24907>0 string LWFN PostScript font 24908>0 string MSBC Microsoft BASIC 24909>0 string PACT Compact Pro archive 24910>0 string PDF\ Portable Document Format 24911>0 string PICT picture 24912>0 string PNTG MacPaint picture 24913>0 string PREF preferences 24914>0 string PROJ Think C project 24915>0 string QPRJ Think Pascal project 24916>0 string SCFL Defender scores 24917>0 string SCRN startup screen 24918>0 string SITD StuffIt Deluxe 24919>0 string SPn3 SuperPaint 24920>0 string STAK HyperCard stack 24921>0 string Seg\ StuffIt segment 24922>0 string TARF Unix tar archive 24923>0 string TEXT ASCII 24924>0 string TIFF TIFF image 24925>0 string TOVF Eudora table of contents 24926>0 string WDBN Microsoft Word word processor 24927>0 string WORD MacWrite word processor 24928>0 string XLS\ Microsoft Excel 24929>0 string ZIVM compress (.Z) 24930>0 string ZSYS Pre-System 7 system file 24931>0 string acf3 Aldus FreeHand 24932>0 string cdev control panel 24933>0 string dfil Desk Accessory suitcase 24934>0 string libr library 24935>0 string nX^d WriteNow word processor 24936>0 string nX^w WriteNow dictionary 24937>0 string rsrc resource 24938>0 string scbk Scrapbook 24939>0 string shlb shared library 24940>0 string ttro SimpleText read-only 24941>0 string zsys system file 24942 24943# additional types added in Dec 2017 24944>0 string BINA binary file 24945>0 string BMPp BMP image 24946>0 string JPEG JPEG image 24947#>0 string W4BN Microsoft Word x.y word processor? 24948# if type name is not known display 4 character identifier 24949>0 default x 24950>>0 string x '%4.4s' 24951 24952#>69 string x \b, creator "%4.4s" 24953 24954# Now Apple has no repository of registered Creator IDs any more. These are 24955# just the ones that I happened to have files from and was able to identify. 24956 24957# display information about apple creator 249580 name apple-creator 24959>0 string 8BIM Adobe Photoshop 24960>0 string ALD3 PageMaker 3 24961>0 string ALD4 PageMaker 4 24962>0 string ALFA Alpha editor 24963>0 string APLS Apple Scanner 24964>0 string APSC Apple Scanner 24965>0 string BRKL Brickles 24966>0 string BTFT BitFont 24967>0 string CCL2 Common Lisp 2 24968>0 string CCL\ Common Lisp 24969>0 string CDmo The Talking Moose 24970>0 string CPCT Compact Pro 24971>0 string CSOm Eudora 24972>0 string DMOV Font/DA Mover 24973>0 string DSIM DigSim 24974>0 string EDIT Macintosh Edit 24975>0 string ERIK Macintosh Finder 24976>0 string EXTR self-extracting archive 24977>0 string Gzip GNU gzip 24978>0 string KAHL Think C 24979>0 string LWFU LaserWriter Utility 24980>0 string LZIV compress 24981>0 string MACA MacWrite 24982>0 string MACS Macintosh operating system 24983>0 string MAcK MacKnowledge terminal emulator 24984>0 string MLND Defender 24985>0 string MPNT MacPaint 24986>0 string MSBB Microsoft BASIC (binary) 24987>0 string MSWD Microsoft Word 24988>0 string NCSA NCSA Telnet 24989>0 string PJMM Think Pascal 24990>0 string PSAL Hunt the Wumpus 24991#>0 string PSI2 Apple File Exchange 24992>0 string R*ch BBEdit 24993>0 string RMKR Resource Maker 24994>0 string RSED Resource Editor 24995>0 string Rich BBEdit 24996>0 string SIT! StuffIt 24997>0 string SPNT SuperPaint 24998>0 string Unix NeXT Mac filesystem 24999>0 string VIM! Vim editor 25000>0 string WILD HyperCard 25001>0 string XCEL Microsoft Excel 25002>0 string aCa2 Fontographer 25003>0 string aca3 Aldus FreeHand 25004>0 string dosa Macintosh MS-DOS file system 25005>0 string movr Font/DA Mover 25006>0 string nX^n WriteNow 25007>0 string pdos Apple ProDOS file system 25008>0 string scbk Scrapbook 25009>0 string ttxt SimpleText 25010>0 string ufox Foreign File Access 25011# additional creators added in Dec 2017 25012# Claris/Apple Works 25013>0 string BOBO Apple Works 25014# CU-SeeMe_0.87b3_(68K).bin 25015#>0 string CUce bar 25016>0 string PSPT Apple File Exchange 25017# Disk_Copy_4.2.sea.bin 25018#>0 string NCse foo 25019# probably StuffIt/Aladdin by Smith Micro Software, Inc. 25020>0 string STi0 stuffit 25021# MacGzip-1.1.3.sea.bin 25022#>0 string aust bar 25023# D-Disk_Copy_6.3.3.smi.bin 25024>0 string oneb Disk Copy Self Mounting 25025# if creator name is not known display 4 character identifier 25026>0 default x 25027>>0 string x '%4.4s' 25028 25029# sas magic from Bruce Foster (bef@nwu.edu) 25030# 25031#0 string SAS SAS 25032#>8 string x %s 250330 string SAS SAS 25034>24 string DATA data file 25035>24 string CATALOG catalog 25036>24 string INDEX data file index 25037>24 string VIEW data view 25038# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 25039# 250400x54 string SAS SAS 7+ 25041>0x9C string DATA data file 25042>0x9C string CATALOG catalog 25043>0x9C string INDEX data file index 25044>0x9C string VIEW data view 25045 25046# spss magic for SPSS system and portable files, 25047# from Bruce Foster (bef@nwu.edu). 25048 250490 long 0xc1e2c3c9 SPSS Portable File 25050>40 string x %s 25051 250520 string $FL2 SPSS System File 25053>24 string x %s 25054 250550 string $FL3 SPSS System File 25056>24 string x %s 25057 25058# Macintosh filesystem data 25059# From "Tom N Harris" <telliamed@mac.com> 25060# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 25061# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 25062# entries depend on the data arithmetic added after v.35 25063# There's also some Pascal strings in here, ditto... 25064 25065# The boot block signature, according to IM:Files, is 25066# "for HFS volumes, this field always contains the value 0x4C4B." 25067# But if this is true for MFS or HFS+ volumes, I don't know. 25068# Alternatively, the boot block is supposed to be zeroed if it's 25069# unused, so a simply >0 should suffice. 25070 250710x400 beshort 0xD2D7 Macintosh MFS data 25072>0 beshort 0x4C4B (bootable) 25073>0x40a beshort &0x8000 (locked) 25074>0x402 beldate-0x7C25B080 x created: %s, 25075>0x406 beldate-0x7C25B080 >0 last backup: %s, 25076>0x414 belong x block size: %d, 25077>0x412 beshort x number of blocks: %d, 25078>0x424 pstring x volume name: %s 25079 25080# *.hfs updated by Joerg Jenderek 25081# https://en.wikipedia.org/wiki/Hierarchical_File_System 25082# "BD" gives many false positives 250830x400 beshort 0x4244 25084# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 25085# first block of volume bit map (always 3) 25086>0x40e ubeshort 0x0003 25087# maximal length of volume name is 27 25088>>0x424 ubyte <28 Macintosh HFS data 25089!:mime application/x-apple-diskimage 25090#!:apple hfsdINIT 25091#!:apple MACSdisk 25092# https://www.macdisk.com/macsigen.php 25093#!:apple ddskdevi 25094!:apple ????devi 25095# https://en.wikipedia.org/wiki/Apple_Disk_Image 25096!:ext hfs/dmg 25097>>>0 beshort 0x4C4B (bootable) 25098#>>>0 beshort 0x0000 (not bootable) 25099>>>0x40a beshort &0x8000 (locked) 25100>>>0x40a beshort ^0x0100 (mounted) 25101>>>0x40a beshort &0x0200 (spared blocks) 25102>>>0x40a beshort &0x0800 (unclean) 25103>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 25104# https://www.epochconverter.com/ 25105# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 25106# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 25107# construct not working 25108#>>>0x402 beldate-0x7C25B080 x created: %s, 25109#>>>0x406 beldate-0x7C25B080 x last modified: %s, 25110#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 25111# found block sizes 200h,1200h,2800h 25112>>>0x414 belong x block size: %d, 25113>>>0x412 beshort x number of blocks: %d, 25114>>>0x424 pstring x volume name: %s 25115 251160x400 beshort 0x482B Macintosh HFS Extended 25117>&0 beshort x version %d data 25118>0 beshort 0x4C4B (bootable) 25119>0x404 belong ^0x00000100 (mounted) 25120>&2 belong &0x00000200 (spared blocks) 25121>&2 belong &0x00000800 (unclean) 25122>&2 belong &0x00008000 (locked) 25123>&6 string x last mounted by: '%.4s', 25124# really, that should be treated as a belong and we print a string 25125# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 25126>&14 beldate-0x7C25B080 x created: %s, 25127# only the creation date is local time, all other timestamps in HFS+ are UTC. 25128>&18 bedate-0x7C25B080 x last modified: %s, 25129>&22 bedate-0x7C25B080 >0 last backup: %s, 25130>&26 bedate-0x7C25B080 >0 last checked: %s, 25131>&38 belong x block size: %d, 25132>&42 belong x number of blocks: %d, 25133>&46 belong x free blocks: %d 25134 25135## AFAIK, only the signature is different 25136# same as Apple Partition Map 25137# GRR: This magic is too weak, it is just "TS" 25138#0x200 beshort 0x5453 Apple Old Partition data 25139#>0x2 beshort x block size: %d, 25140#>0x230 string x first type: %s, 25141#>0x210 string x name: %s, 25142#>0x254 belong x number of blocks: %d, 25143#>0x400 beshort 0x504D 25144#>>0x430 string x second type: %s, 25145#>>0x410 string x name: %s, 25146#>>0x454 belong x number of blocks: %d, 25147#>>0x800 beshort 0x504D 25148#>>>0x830 string x third type: %s, 25149#>>>0x810 string x name: %s, 25150#>>>0x854 belong x number of blocks: %d, 25151#>>>0xa00 beshort 0x504D 25152#>>>>0xa30 string x fourth type: %s, 25153#>>>>0xa10 string x name: %s, 25154#>>>>0xa54 belong x number of blocks: %d 25155 25156# From: Remi Mommsen <mommsen@slac.stanford.edu> 251570 string BOMStore Mac OS X bill of materials (BOM) file 25158 25159# From: Adam Buchbinder <adam.buchbinder@gmail.com> 25160# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 25161# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 25162# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 25163# don't know what they mean. 251640 belong 0x100 25165>(0x4.L+24) beshort x 25166>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 25167>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 25168>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 25169>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 25170 25171#------------------------------------------------------------------------------ 25172# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 25173# MacOS files 25174# 25175 251760 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 25177 25178#------------------------------------------------------------------------------ 25179# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 25180# magic: file(1) magic for magic files 25181# 251820 string/t #\ Magic magic text file for file(1) cmd 251830 lelong 0xF11E041C magic binary file for file(1) cmd 25184>4 lelong x (version %d) (little endian) 251850 belong 0xF11E041C magic binary file for file(1) cmd 25186>4 belong x (version %d) (big endian) 25187#------------------------------------------------------------------------------ 25188# $File: mail.news,v 1.29 2022/06/17 18:02:19 christos Exp $ 25189# mail.news: file(1) magic for mail and news 25190# 25191# Unfortunately, saved netnews also has From line added in some news software. 25192#0 string From mail text 251930 string/t Relay-Version: old news text 25194!:mime message/rfc822 251950 string/t #!\ rnews batched news text 25196!:mime message/rfc822 251970 string/t N#!\ rnews mailed, batched news text 25198!:mime message/rfc822 251990 string/t Forward\ to mail forwarding text 25200!:mime message/rfc822 252010 string/t Pipe\ to mail piping text 25202!:mime message/rfc822 252030 string/tc delivered-to: SMTP mail text 25204!:mime message/rfc822 252050 string/tc return-path: SMTP mail text 25206!:mime message/rfc822 252070 string/t Path: news text 25208!:mime message/news 252090 string/t Xref: news text 25210!:mime message/news 252110 string/t From: news or mail text 25212!:mime message/rfc822 252130 string/t Date: news or mail text 25214!:mime message/rfc822 252150 string/t Article saved news text 25216!:mime message/news 25217# Reference: http://quimby.gnus.org/notes/BABYL 25218# Update: Joerg Jenderek 25219# Note: used by Rmail in Emacs version 22 and before 25220# is not text because of characters like Control-L Control-_ 252210 string/b BABYL\ OPTIONS: Emacs RMAIL 25222#0 string/t BABYL Emacs RMAIL text 25223# https://reposcope.com/mimetype/message/x-gnu-rmail 25224!:mime message/x-gnu-rmail 25225# ~/RMAIL 25226!:ext / 252270 string/t Received: RFC 822 mail text 25228!:mime message/rfc822 252290 string/t MIME-Version: MIME entity text 25230#0 string/t Content- MIME entity text 25231 25232# TNEF files... 25233# URL: http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format 25234# https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format 25235# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tnef.trid.xml 25236# https://interoperability.blob.core.windows.net/files/MS-OXTNEF/%5bMS-OXTNEF%5d-210817.pdf 25237# Update: Joerg Jenderek 25238# Note: moved and merged from ./msdos (version 1.154) there just called "TNEF" 25239# partly verified by `tnef --list -v -f voice.tnef` and `ytnef -v triples.tnef` 25240# TNEF magic From "Joomy" <joomy@se-ed.net> 25241# TNEF_SIGNATURE 252420 lelong 0x223E9F78 Transport Neutral Encapsulation Format (TNEF) 25243!:mime application/vnd.ms-tnef 25244# winmail.dat or win.dat by Microsoft Outlook 25245!:ext tnef/dat 25246# https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef/7fdb64ee-7f63-4d95-9af1-c672e7475c3a 25247# LegacyKey 25248#>4 uleshort x \b, key %#4.4x 25249# attrLevelMessage; Level where attribute applies like: 1~attrLevelMessage 2~attrLevelAttachment 25250>6 ubyte !1 \b, 1st level %#2.2x 25251# other ID (like 02900000h) or TnefVersion ID (idTnefVersion=06900800h) 25252>7 ubelong !0x06900800 \b, 1st id %#8.8x 25253>7 ubelong =0x06900800 25254# TnefVersion lenght like: 4 25255>>11 ulelong !4 \b, TnefVersion length %x 25256# TNEFVersionData; TnefVersion data like: 00010000h 25257>>15 ulelong !0x00010000h \b, version %#8.8x 25258# Checksum like: 1 25259>>19 uleshort !1 \b, checksum %#4.4x 25260# attrLevelMessage; level of attOemCodepage like: 1 25261>>21 ubyte !1 \b, level %#2.2x 25262# idOEMCodePage; OEMCodePage ID like: 07900600h 25263>>22 ubelong =0x07900600 \b, OEM codepage 25264# OEMCodePage length like: 8 25265>>>26 ulelong =8 25266# OEMCodePageData; PrimaryCodePage like: 1251 1252 25267>>>>30 ulelong x %u 25268# OEMCodePageData; SecondaryCodePage; unused and SHOULD contain zero 25269>>>>34 ulelong !0 and %u 25270# OEMCodePageData Checksum like: E7h E8h 25271>>>>38 uleshort x (checksum %#x) 25272# attrLevelMessage of attMessageClass like: 1 25273>>40 ubyte !1 \b, level %u 25274# idMessageClass; ID of attMessageClass like: 08800700h 25275>>41 ubelong =0x08800700 \b, MessageAttribute 25276# attMessageClass length like: 16 24 25 25277#>>>45 ulelong x (length %u) 25278# attMessageClass data like: "IPM.Microsoft Mail.Note" "IPM.Note.Portada Newseum" 25279# "IPM.Appointment" "IPM.Note.Microsoft.Voicemail.UM.CA" 25280>>>45 pstring/l x "%s" 25281 25282# From: Kevin Sullivan <ksulliva@psc.edu> 252830 string *mbx* MBX mail folder 25284 25285# From: Simon Matter <simon.matter@invoca.ch> 252860 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 252870 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 25288 25289# JAM(mbp) Fidonet message area databases 25290# JHR file 252910 string JAM\0 JAM message area header file 25292>12 leshort >0 (%d messages) 25293 25294# Squish Fidonet message area databases 25295# SQD file (requires at least one message in the area) 25296# XXX: Weak magic 25297#256 leshort 0xAFAE4453 Squish message area data file 25298#>4 leshort >0 (%d messages) 25299 25300#0 string \<!--\ MHonArc text/html; x-type=mhonarc 25301 25302# Cyrus: file(1) magic for compiled Cyrus sieve scripts 25303# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 25304# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 25305# From: Philipp Hahn <hahn@univention.de> 25306 25307# Compiled Cyrus sieve script 253080 string CyrSBytecode Cyrus sieve bytecode data, 25309>12 belong =1 version 1, big-endian 25310>12 lelong =1 version 1, little-endian 25311>12 belong x version %d, network-endian 25312 25313# Dovecot mail server, version 2.2 and later. 25314# Dovecot mailing list: dovecot@dovecot.org 25315# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format 25316# From: Stephen Gildea 253170 string CRYPTED\003\007 Dovecot encrypted message 25318>9 byte x \b, dcrypt version %d 25319#------------------------------------------------------------------------------ 25320# $File: make,v 1.5 2022/03/12 15:09:47 christos Exp $ 25321# make: file(1) magic for makefiles 25322# 25323# URL: https://en.wikipedia.org/wiki/Make_(software) 253240 regex/100l \^(CFLAGS|VPATH|LDFLAGS|all:|\\.PRECIOUS) makefile script text 25325!:mime text/x-makefile 25326!:strength -15 25327# Update: Joerg Jenderek 25328# Reference: https://www.freebsd.org/cgi/man.cgi?make(1) 25329# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST" 25330# by additional escaping point character 25331# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT" 25332# and NSIS script with "!include" by additional escaping point character 253330 regex/100l \^\\.(BEGIN|endif|include) BSD makefile script text 25334!:mime text/x-makefile 25335!:ext /mk 25336!:strength -10 253370 regex/100l \^SUBDIRS[[:space:]]+= automake makefile script text 25338!:mime text/x-makefile 25339!:strength -15 25340 25341 25342#------------------------------------------------------------------------------ 25343# $File: map,v 1.9 2021/04/26 15:56:00 christos Exp $ 25344# map: file(1) magic for Map data 25345# 25346 25347# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 253488 string .FIT FIT Map data 25349>15 byte 0 25350>>35 belong x \b, unit id %d 25351>>39 lelong x \b, serial %u 25352# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 25353# 20 years after unix epoch 25354# TZ=GMT date -d '1989-12-31 0:00' +%s 25355>>43 leldate+631065600 x \b, %s 25356 25357>>47 leshort x \b, manufacturer %d 25358>>47 leshort 1 \b (garmin) 25359>>49 leshort x \b, product %d 25360>>53 byte x \b, type %d 25361>>53 byte 1 \b (Device) 25362>>53 byte 2 \b (Settings) 25363>>53 byte 3 \b (Sports/Cycling) 25364>>53 byte 4 \b (Activity) 25365>>53 byte 8 \b (Elevations) 25366>>53 byte 10 \b (Totals) 25367 25368# Summary: Garmin map 25369# From: Joerg Jenderek 25370# URL: https://en.wikipedia.org/wiki/Garmin_.img 25371# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 25372# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf 25373# GRR: similar to MBR boot sector handled by ./filesystems 253740x1FE leshort =0xAA55 25375# look for valid map signature 25376>0x13 string =IMG\0 25377>>0 use garmin-map 253780 name garmin-map 25379>0 ubyte x Garmin 25380!:mime application/x-garmin-map 25381# If non-zero, every byte of the entire .img file is to be XORed with this value 25382>0 ubyte !0 \b, %#x XORed 25383# goto block before FAT 25384>(0x40.b*512) ubyte x 25385# 1st fat name "DLLINFO TXT" only found for vpm 25386>>&512 string =DLLINFO\ TXT map (Voice Processing) 25387# there exist 2 other Garmin VPM formats; see ./audio 25388!:ext vpm 25389# Deutsch__Yannick_D4481-00_0210.vpm 25390#>>>512 search/0x0116da60/s RIFF \b; with 25391# determine type voice type by ./riff 25392#>>>>&0 indirect x \b 25393>>&512 string !DLLINFO\ TXT map 25394!:ext img 25395# 9 zeros 25396>1 ubelong !0 \b, zeroes %#x 25397# Map's version major 25398>8 ubyte x v%u 25399# Map's version minor 25400>9 ubyte x \b.%.2u 25401# Map description[20], 0x20 padded 25402>0x49 string x %.20s 25403# Map name, continued (0x20 padded, \0 terminated) 25404>0x65 string >\ \b%.31s 25405# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62) 25406>0xB ubyte x \b, updated 25407>>0xB ubyte >0x62 25408>>>0xB ubyte-100 x 20%.2u 25409>>0xB ubyte <0x63 25410>>>0xB ubyte x 20%.2u 25411# Update month (0-11) 25412>0xA ubyte x \b-%.2u 25413# All zeroes 25414>0xc uleshort !0 \b, zeroes %#x 25415# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport 25416#>0xE ubyte !0 \b, Mapsource flag %#x 25417>0xE ubyte 1 \b, Mapsource 25418# Checksum, sum of all bytes modulo 256 should be 0 25419#>0xF ubyte x \b, Checksum %#x 25420# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map 25421>0x10 string !DSKIMG \b, signature "%.7s" 25422>0x39 use garmin-date 25423# Map file identifier like GARMIN\0 25424>0x41 string !GARMIN \b, id "%.7s" 25425# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes 25426>0x61 ubyte !0x09 \b, E1=%u 25427# Block size exponent, E2 ; file blocksize=2**(E1+E2) 25428>>0x62 ubyte x \b, E2=%u 25429>0x61 ubyte =0x09 \b, blocksize 25430>>0x62 ubyte 0 512 25431>>0x62 ubyte 1 1024 25432>>0x62 ubyte 2 2048 25433>>0x62 ubyte 3 4096 25434>>0x62 ubyte 4 8192 25435>>0x62 ubyte 5 16384 25436>>0x62 default x 25437>>>0x62 ubyte x E2=%u 25438# MBR signature 25439>0x1FE leshort !0xAA55 \b, invalid MBR 25440# 512 zeros 25441>0x200 uquad !0 \b, zeroes %#llx 25442# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file! 25443>0x40C ulelong >0 \b, at %#x 25444# sub-file Header length 25445#>>(0x40C.l) uleshort x \b, header len %#x 25446>>(0x40C.l) uleshort x %u bytes 25447# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc. 25448>>(0x40C.l+2) ubyte >0x1F 25449>>>(0x40C.l+2) ubyte <0xFF 25450>>>>(0x40C.l+2) string x "%.10s" 25451# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.) 25452>>>>(0x40C.l+13) ubyte >0 \b, locked %#x 25453# Block sequence numbers like 0000 0100 0200 ... FFFF 25454# >0x420 ubequad >0 \b, seq. %#16.16llx 25455# >>0x428 ubequad >0 \b%16.16llx 25456# >>>0x430 ubequad >0 \b%16.16llx 25457# >>>>0x438 ubequad >0 \b%16.16llx 25458# >>>>>0x440 ubequad >0 \b%16.16llx 25459# >>>>>>0x448 ubequad >0 \b%16.16llx 25460# >>>>>>>0x450 ubequad >0 \b%16.16llx 25461# >>>>>>>>0x458 ubequad >0 \b%16.16llx 25462# >>>>>>>>>0x460 ubequad >0 \b%16.16llx 25463# >>>>>>>>>>0x468 ubequad >0 \b%16.16llx 25464# >>>>>>>>>>>0x470 ubequad >0 \b%16.16llx 25465# >>>>>>>>>>>>0x478 ubequad >0 \b%16.16llx 25466# >>>>>>>>>>>>>0x480 ubequad >0 \b%16.16llx 25467# >>>>>>>>>>>>>>0x488 ubequad >0 \b%16.16llx 25468# >>>>>>>>>>>>>>>0x490 ubequad >0 \b%16.16llx 25469# >>>>>>>>>>>>>>>>0x498 ubequad >0 \b%16.16llx 25470# >>>>>>>>>>>>>>>>>0x4A0 ubequad >0 \b%16.16llx 25471# >>>>>>>>>>>>>>>>>>0x4A8 ubequad >0 \b%16.16llx 25472# look for end of FAT 25473#>>0x420 search/512/s \xff\xff FAT END 25474# Physical block number of FAT header 25475#>0x40 ubyte x \b, FAT at phy. block %u 25476>0x40 ubyte x 25477>>(0x40.b*512) ubyte x 25478# 1st FAT block 25479>>>&511 use garmin-fat 25480# 2nd FAT block 25481>>>&1023 use garmin-fat 25482# 3th FAT block 25483>>>&1535 use garmin-fat 25484# 4th FAT block 25485>>>&2047 use garmin-fat 25486# ... xth FAT block 25487# 25488# 314 zeros but not in vpm and also gmaptz.img 25489>0x84 uquad !0 \b, at 0x84 %#llx 25490# display FileAllocationTable block entry in garmin map 254910 name garmin-fat 25492>0 ubyte x \b; 25493# sub file part; 0x0003 seems to be garbage 25494>0x10 uleshort !0 next %#4.4x 25495>0x10 uleshort =0 25496# fat flag 0~dummy block 1~true sub file 25497>>0 ubyte !1 flag %u 25498>>0 ubyte =1 25499# sub-file name like MAKEGMAP 12345678 25500>>>0x1 string x %.8s 25501# sub-file typ like RGN TRE MDR LBL 25502>>>0x9 string x \b.%.3s 25503# size of sub file 25504>>>0xC ulelong x \b, %u bytes 25505# 32-bit block sequence numbers 25506#>>>0x20 ubequad x \b, seq. %#16.16llx 25507 25508# display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss 255090 name garmin-date 25510# year like 2018 25511>0 uleshort x \b, created %u 25512# month (0-11) 25513>2 ubyte x \b-%.2u 25514# day (1-31) 25515>3 ubyte x \b-%.2u 25516# hour (0-23) 25517>4 ubyte x %u 25518# minute (0-59) 25519>5 ubyte x \b:%.2u 25520# second (0-59) 25521>6 ubyte x \b:%.2u 25522 25523# Summary: Garmin Map subfiles 25524# From: Joerg Jenderek 25525# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 25526# Garmin Common Header 255272 string GARMIN\ 25528# skip ASCII text by checking for low header length 25529>0 uleshort <0x1000 Garmin map, 25530# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format 25531>>9 string GMP subtile 25532!:mime application/x-garmin-gpm 25533!:ext gmp 25534# copyright message 25535>>>(0.s) string x %s 25536>>>0x0E use garmin-date 25537# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format 25538# This contains the searchable address table used for finding routing destinations 25539>>9 string MDR address table 25540!:mime application/x-garmin-mdr 25541!:ext mdr 25542# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format 25543# http://svn.parabola.me.uk/display/trunk/doc/nod.txt 25544# This contains the routing information 25545>>9 string NOD routing 25546!:mime application/x-garmin-nod 25547!:ext nod 25548>>>0x0E use garmin-date 25549#>>>0x15 ulelong x \b, at %#x 25550#>>>0x19 ulelong x %#x bytes NOD1 25551#>>>0x25 ulelong x \b, at %#x 25552#>>>0x29 ulelong x %#x bytes NOD2 25553#>>>0x31 ulelong x \b, at %#x 25554#>>>0x35 ulelong x %#x bytes NOD3 25555# URL: http://www.pinns.co.uk/osm/net.html 25556# routable highways (length, direction, allowed speed,house address information) 25557>>9 string NET highways 25558!:mime application/x-garmin-net 25559!:ext net 25560#>>>0x15 ulelong x \b, at %#x 25561#>>>0x19 ulelong x %#x bytes NET1 25562#>>>0x22 ulelong >0 25563#>>>>0x1E ulelong x \b, at %#x 25564#>>>>0x22 ulelong x %#x bytes NET2 25565#>>>0x2B ulelong >0 25566#>>>>0x27 ulelong x \b, at %#x 25567#>>>>0x2B ulelong x %#x bytes NET3 25568# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format 25569>>9 string LBL labels 25570!:mime application/x-garmin-lbl 25571!:ext lbl 25572>>>(0.s) string x %s 25573# Label coding type 6h 9h and ah 25574>>>0x1E ubyte x \b, coding type %#x 25575#>>>0x15 ulelong x \b, at %#x 25576#>>>0x19 ulelong x %#x bytes LBL1 25577#>>>0x1F ulelong x \b, at %#x 25578#>>>0x23 ulelong x %#x bytes LBL2 25579#>>>0x2D ulelong x \b, at %#x 25580#>>>0x31 ulelong x %#x bytes LBL3 25581# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format 25582# A lookup table of the chars in the map's codepage, and their collating sequence 25583>>9 string SRT sort table 25584!:mime application/x-garmin-srt 25585!:ext srt 25586>>>0x0E use garmin-date 25587# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format 25588>>9 string TRE tree 25589!:mime application/x-garmin-tre 25590!:ext tre 25591# title like City Nav Europe NTU 2019.2 Basemap 25592# or OSM Street map 25593>>>(0.s) string x %s 25594# 2nd title like Copyright 1995-2018 by GARMIN Corporation. 25595# or http://www.openstreetmap.org/ 25596>>>>&1 string x %s 25597>>>0x0E use garmin-date 25598#>>>0x21 ulelong x \b, at %#x 25599#>>>0x25 ulelong x %#x bytes TRE1 25600#>>>0x29 ulelong x \b, at %#x 25601#>>>0x2D ulelong x %#x bytes TRE2 25602#>>>0x31 ulelong x \b, at %#x 25603#>>>0x35 ulelong x %#x bytes TRE3 25604# Copyright record size 25605#>>>0x39 uleshort x \b, copyright record size %u 25606# Map ID 25607>>>0x74 ulelong x \b, ID %#x 25608# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html 25609# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps 25610>>9 string TRF traffic, 25611!:mime application/x-garmin-trf 25612!:ext trf 25613# city/region like Preitenegg 25614>>>(0.s+1) string x 1st %s 25615# highway part like L606/L148 25616>>>>&1 string x %s 25617# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format 25618# Reference: http://www.pinns.co.uk/osm/typformat.html 25619# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps 25620>>9 string TYP types 25621!:mime application/x-garmin-typ 25622!:ext typ 25623>>>0x0E use garmin-date 25624# character set 1252 65001~UTF8 25625>>>0x15 uleshort x \b, code page %u 25626# POIs 25627#>>>0x17 ulelong x \b, at %#x 25628#>>>0x1B ulelong x %#x bytes TYP1 25629# extra pois 25630#>>>0x5B ulelong x \b, at %#x 25631#>>>0x5F ulelong x %#x bytes TYP8 25632# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format 25633# http://www.pinns.co.uk/osm/RGN.html 25634# region data used by the Garmin software 25635>>9 string RGN region 25636!:mime application/x-garmin-rgn 25637!:ext rgn 25638# POIs,Indexed POIs,Polylines or Polygons or first map level 25639#>>>0x15 ulelong x \b, at %#x 25640#>>>0x19 ulelong x %#x bytes RGN1 25641# polygons with extended types 25642#>>>0x21 ulelong >0 25643#>>>>0x1D ulelong x \b, at %#x 25644#>>>>0x21 ulelong x %#x bytes RGN2 25645# polylines with extended types 25646#>>>0x3D ulelong >0 25647#>>>>0x39 ulelong x \b, at %#x 25648#>>>>0x3D ulelong x %#x bytes RGN3 25649# extended POIs 25650#>>>0x59 ulelong >0 25651#>>>>0x55 ulelong x \b, at %#x 25652#>>>>0x59 ulelong x %#x bytes RGN3 25653#>>9 default x unknown map type 25654# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h, 25655# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh 25656>>0 uleshort x \b, header length %#x 25657 25658# URL: https://www.memotech.franken.de/FileFormats/ 25659# Reference: https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf 25660# From: Joerg Jenderek 256610 string KpGr Garmin update 25662# format version like: 0064h~1.0 25663>0x4 uleshort !0x0064 25664>>4 uleshort/100 x \b, version %u 25665>>4 uleshort%100 x \b.%u 25666# 1st Garmin entry 25667>6 use garmin-entry 25668# 2nd Garmin entry 25669>(0x6.l+10) ubyte x 25670>>&0 use garmin-entry 25671# 3rd entry 25672>(0x6.l+10) ubyte x 25673>>&(&0.l+4) ubyte x 25674>>>&0 use garmin-entry 25675# look again at version to use default clause 25676>0x4 uleshort x 25677# test for region content by looking for 25678# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales" 25679# 1 space after equal sign 25680>>0x3a search/5/s GARMIN\ BITMAP \b= 25681!:mime image/x-garmin-exe 25682!:ext exe 25683>>>&0 indirect x 25684# if not bitmap *.srf then region; 1 space after equal sign 25685>>0x3a default x \b= 25686!:mime application/x-garmin-rgn 25687!:ext rgn 25688# recursiv embedded 25689>>>0x3a search/5/s KpGrd 25690>>>>&0 indirect x 25691# look for ZIP or JAR archive by ./archive and ./zip 25692>>>0x3a search/5/s PK\003\004 25693>>>>&0 indirect x 25694# TODO: other garmin RGN record content like foo 25695#>>0x3a search/5/s bar BAR 25696# display information of Garmin RGN record 256970 name garmin-entry 25698# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region 25699#>0 ulelong x \b, length %#x 25700# data record (ID='D') with version content like 0064h~1.0 25701>4 ubyte =0x44 25702>>5 uleshort !0x0064 \b; Data 25703>>>5 uleshort/100 x \b, version %u 25704>>>5 uleshort%100 x \b.%u 25705# Application Record (ID='A') 25706>4 ubyte =0x41 \b; App 25707# version content like 00c8h~2.0 25708>>5 uleshort !0x00C8 25709>>>5 uleshort/100 x \b, version %u 25710>>>5 uleshort%100 x \b.%u 25711# builder name like: SQA sqa build hales 25712>>7 string x \b, build by %s 25713# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009 25714>>>&1 string x %s 25715# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01 25716>>>>&1 string x %s 25717# region record (ID='R') 25718>4 ubyte =0x52 \b; Region 25719# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP 25720>>5 uleshort x ID=%u 25721# delay in ms: like 0, 500 25722>>7 ulelong !0 \b, %u ms 25723# region size (is record length - 10) 25724#>>11 ulelong x \b, length %#x 25725# region content like: 25726# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive 25727#>>15 string x \b, content "%s" 25728>>15 ubequad x \b, content %#llx... 25729# This does NOT WORK! 25730#>>15 indirect x \b; contains 25731>4 default x \b; other 25732# garmin Record ID Identifies the record content like: D A R 25733>>4 ubyte x ID '%c' 25734 25735# TOM TOM GPS watches ttbin files: 25736# https://github.com/ryanbinns/ttwatch/tree/master/ttbin 25737# From: Daniel Lenski 257380 byte 0x20 25739>1 leshort 0x0007 25740>>0x76 byte 0x20 25741>>>0x77 leshort 0x0075 TomTom activity file, v7 25742>>>>8 leldate x (%s, 25743>>>>3 byte x device firmware %d. 25744>>>>4 byte x \b%d. 25745>>>>5 byte x \b%d, 25746>>>>6 leshort x product ID %04d) 25747 25748 25749#------------------------------------------------------------------------------ 25750# $File: maple,v 1.10 2021/08/30 13:31:25 christos Exp $ 25751# maple: file(1) magic for maple files 25752# "H. Nanosecond" <aldomel@ix.netcom.com> 25753# Maple V release 4, a multi-purpose math program 25754# 25755 25756# maple library .lib 25757# URL: https://en.wikipedia.org/wiki/Maple_(software) 25758# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lib-maple-v-r4.trid.xml 25759# Update: Joerg Jenderek 257600 string \000MVR4\nI Maple Vr4 library 25761#!:mime application/octet-stream 25762!:mime application/x-maple-lib 25763!:ext lib 25764 25765# URL: https://en.wikipedia.org/wiki/Maple_(software) 25766# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lib-maple-v-r5.trid.xml 25767# From: Joerg Jenderek 257680 string \000MVR5\n Maple Vr5 library 25769#!:mime application/octet-stream 25770!:mime application/x-maple-lib 25771!:ext lib 25772 25773# From: Joerg Jenderek 257740x400 string M7R0\nI Maple Vr7 library 25775#!:mime application/octet-stream 25776!:mime application/x-maple-lib 25777!:ext lib 25778# null terminated library name like: C:\Maple12/Cliffordlib\maple.lib ../Maplets/Tutors.lib 25779>5 string x %s 25780# probably library name padding with nil or points (0x2E) 25781#>0xF8 uquad x \b, PADDING 0x%16.16llx 25782# null terminated strings like: Exterior Clifford FunctionArithmetics 25783# like: 1 20 40 25784>0x115 ulelong x \b, %u string 25785# plural s 25786>0x115 ulelong >1 \bs 25787>0x119 string x 1st '%s' 25788# probably second name section padding with nil or points (0x2E) 25789#>0x3F0 uquad x \b, 2nd PADDING 0x%16.16llx 25790# line feed separated ASCII string with maximal 79 length 25791#>0x407 string x \b, section "%s" 25792>0x454 ubyte !0x0a \b, at 0x454 0x%x 25793 25794# .ind 25795# no magic for these :-( 25796# they are compiled indexes for maple files 25797 25798# .hdb 25799# Update: Joerg Jenderek 25800# URL: https://www.maplesoft.com/support/help/maple/view.aspx?path=Formats/HDB 25801# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hdb-maple.trid.xml 25802# Note: This format was replaced in Maple 18 by the Maple Help format (*.help) 258030 string \000\004\000\000 25804# skip xBASE Compound Index file *.CDX by looking for version 25805>1028 string version Maple help database 25806# length of string version 25807#>>1024 ulelong !7 \b, at 0x400 unexpected %u 25808#!:mime application/octet-stream 25809!:mime application/x-maple-hdb 25810!:ext hdb 25811>1028 default x 25812# skip more xBASE Compound Index file *.CDX by looking for keyword Maple 25813# like hsum.hdb 25814>>4 search/0xCC41 Maple Maple help database 25815!:mime application/x-maple-hdb 25816!:ext hdb 25817 25818# .mhp 25819# this has the form <PACKAGE=name> 258200 string \<PACKAGE= Maple help file 258210 string \<HELP\ NAME= Maple help file 258220 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 25823#0 string #\ Newton Maple help file, old style 258240 string #\ daub Maple help file, old style 25825#0 string #=========== Maple help file, old style 25826 25827# .mws 258280 string \000\000\001\044\000\221 Maple worksheet 25829#this is anomalous 258300 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 25831# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 25832# that is {VERSION major_version miunor_version computer_type version_string} 258330 string {VERSION\ Maple worksheet 25834>9 string >\0 version %.1s. 25835>>11 string >\0 %.1s 25836 25837# .mps 258380 string \0\0\001$ Maple something 25839# from byte 4 it is either 'nul E' or 'soh R' 25840# I think 'nul E' means a file that was saved as a different name 25841# a sort of revision marking 25842# 'soh R' means new 25843>4 string \000\105 An old revision 25844>4 string \001\122 The latest save 25845 25846# .mpl 25847# some of these are the same as .mps above 25848#0000000 000 000 001 044 000 105 same as .mps 25849#0000000 000 000 001 044 001 122 same as .mps 25850 258510 string #\n##\ <SHAREFILE= Maple something 258520 string \n#\n##\ <SHAREFILE= Maple something 258530 string ##\ <SHAREFILE= Maple something 258540 string #\r##\ <SHAREFILE= Maple something 258550 string \r#\r##\ <SHAREFILE= Maple something 258560 string #\ \r##\ <DESCRIBE> Maple something anomalous. 25857#-------------------------------------------- 25858# marc21: file(1) magic for MARC 21 Format 25859# 25860# Kevin Ford (kefo@loc.gov) 25861# 25862# MARC21 formats are for the representation and communication 25863# of bibliographic and related information in machine-readable 25864# form. For more info, see https://www.loc.gov/marc/ 25865 25866 25867# leader position 20-21 must be 45 25868# and 22-23 also 00 so far, but we check that later. 2586920 string 45 25870>0 search/2048 \x1e 25871 25872# leader starts with 5 digits, followed by codes specific to MARC format 25873>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 25874!:mime application/marc 25875>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 25876!:mime application/marc 25877>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 25878!:mime application/marc 25879>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 25880!:mime application/marc 25881>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 25882!:mime application/marc 25883 25884# leader position 22-23, should be "00" but is it? 25885>>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 25886!:mime application/marc 25887 25888#------------------------------------------------------------------------------ 25889# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 25890# mathcad: file(1) magic for Mathcad documents 25891# URL: http://www.mathsoft.com/ 25892# From: Josh Triplett <josh@freedesktop.org> 25893 258940 string .MCAD\t Mathcad document 25895 25896#------------------------------------------------------------------------------ 25897# $File: mathematica,v 1.14 2021/11/07 16:27:36 christos Exp $ 25898# mathematica: file(1) magic for mathematica files 25899# "H. Nanosecond" <aldomel@ix.netcom.com> 25900# Mathematica a multi-purpose math program 25901# versions 2.2 and 3.0 25902 25903#mathematica .mb 259040 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 25905!:ext mb 259060 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 25907!:ext mb 25908 25909# .ma 25910# multiple possibilities: 25911 259120 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 25913#>41 string >\0 %s 25914!:ext mb 25915 25916#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 25917 25918#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 25919#>675 string >\0 %s #doesn't work well 25920 25921# there may be 'cr' instead of 'nl' in some does this matter? 25922 25923# generic: 259240 string (*^\r\r::[\011 Mathematica notebook version 2.x 25925!:ext mb 259260 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 25927!:ext mb 259280 string (*^\015 Mathematica notebook version 2.x 25929!:ext mb 259300 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 25931!:ext mb 259320 string (*^\r::[\011 Mathematica notebook version 2.x 25933!:ext mb 259340 string (*^\r\n::[\011 Mathematica notebook version 2.x 25935!:ext mb 259360 string (*^\n\n::[\011 Mathematica notebook version 2.x 25937!:ext mb 259380 string (*^\n::[\011 Mathematica notebook version 2.x 25939!:ext mb 25940 25941 25942# Mathematica .mx files 25943 25944#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 259450 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 25946#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 25947# >71... is optional 25948>88 string >\0 from %s 25949 25950 25951# Mathematica files PBF: 25952# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 259530 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 25954 25955# .ml files These are menu resources I think 25956# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 25957# how to put that into a magic rule? 259584 string \ A~ MAthematica .ml file 25959 25960# .nb files 25961#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 259620 string (*********************** Mathematica 3.0 notebook 25963 25964# other (* matches it is a comment start in these langs 25965# GRR: Too weak; also matches other languages e.g. ML 25966#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 25967 25968######################### 25969# MatLab v5 25970# URL: http://fileformats.archiveteam.org/wiki/MAT 25971# Reference: https://www.mathworks.com/help/pdf_doc/matlab/matfile_format.pdf 25972# first 116 bytes of header contain text in human-readable form 259730 string MATLAB Matlab v 25974#>11 string/T x \b, at 11 "%.105s" 25975#!:mime application/octet-stream 25976!:mime application/x-matlab-data 25977!:ext mat 25978# https://de.mathworks.com/help/matlab/import_export/mat-file-versions.html 25979# level of the MAT-file like: 5.0 7.0 or maybe 7.3 25980#>7 string x LEVEL "%.3s" 25981>7 ubyte =0x35 \b5 mat-file 25982>7 ubyte !0x35 25983>>7 string x \b%.3s mat-file 25984>126 short 0x494d (big endian) 25985>>124 beshort x version %#04x 25986>126 short 0x4d49 (little endian) 25987# 0x0100 for level 5.0 and 0x0200 for level 7.0 25988>>124 leshort x version %#04x 25989# test again so that default clause works 25990>126 short x 25991# created by MATLAB include Platform sometimes without leading comma (0x2C) or missing 25992# like: GLNX86 PCWIN PCWIN64 SOL2 Windows\0407 nt posix 25993>>20 search/2 Platform:\040 \b, platform 25994>>>&0 string x %-0.2s 25995>>>&2 ubyte !0x2C \b%c 25996>>>>&0 ubyte !0x2C \b%c 25997>>>>>&0 ubyte !0x2C \b%c 25998>>>>>>&0 ubyte !0x2C \b%c 25999>>>>>>>&0 ubyte !0x2C \b%c 26000>>>>>>>>&0 ubyte !0x2C \b%c 26001>>>>>>>>>&0 ubyte !0x2C \b%c 26002# examples without Platform tag like one_by_zero_char.mat 26003>>20 default x 26004>>>11 string x "%s" 26005# created by MATLAB include time like: Fri Feb 20 15:26:59 2009 26006>34 search/9/c created\040on:\040 \b, created 26007>>&0 string x %-.24s 26008# MatLab v4 26009# From: Joerg Jenderek 26010# check for valid imaginary flag of Matlab matrix version 4 2601113 ushort 0 26012# check for valid ASCII matrix name 26013>20 ubyte >0x1F 26014# skip PreviousEntries.dat with "invalid high" name \304P\344@\001 26015>>20 ubyte <0304 26016# skip some Netwfw*.dat and $I3KREPH.dat by checking for non zero number of rows 26017>>>4 ulong !0 26018# skip some CD-ROM filesystem like test-hfs.iso by looking for valid big endian type flag 26019>>>>0 ubelong&0xFFffFF00 0x00000300 26020>>>>>0 use matlab4 26021# no example for 8-bit and 16-bit integers matrix 26022>>>>0 ubelong&0xFFffFF00 0x00000400 26023>>>>>0 use matlab4 26024# branch for Little-Endian variant of Matlab MATrix version 4 26025# skip big endian variant by looking for valid low lttle endian type flag 26026>>>>0 ulelong <53 26027# skip tokens.dat and some Netwfw*.dat by check for valid imaginary flag value of MAT version 4 26028>>>>>12 ulelong <2 26029# no misidentfied little endian MATrix example with "short" matrix name 26030>>>>>>16 ulelong <3 26031>>>>>>>0 use \^matlab4 26032# little endian MATrix with "long" matrix name or some misidentified samples 26033>>>>>>16 ulelong >2 26034# skip TileCacheLogo-*.dat with invalid 2nd character \001 of matrix name with length 96 26035>>>>>>>21 ubyte >0x1F 26036>>>>>>>>0 use \^matlab4 26037# display information of Matlab v4 mat-file 260380 name matlab4 Matlab v4 mat-file 26039#!:mime application/octet-stream 26040!:mime application/x-matlab-data 26041!:ext mat 26042# 20-byte header with 5 long integers that contains information describing certain attributes of the Matrix 26043# type flag decimal MOPT; maximal 4052=FD4h; maximal 52=34h for little endian 26044#>0 ubelong x \b, type flag %u 26045#>0 ubelong x (%#x) 26046# M: 0~little endian 1~Big Endian 2~VAX D-float 3~VAX G-float 4~Cray 26047#>0 ubelong/1000 x \b, M=%u 26048>0 ubelong/1000 0 (little endian) 26049>0 ubelong/1000 1 (big endian) 26050>0 ubelong/1000 2 (VAX D-float) 26051>0 ubelong/1000 3 (VAX G-float) 26052>0 ubelong/1000 4 (Cray) 26053# namlen; the length of the matrix name 26054#>16 ubelong x \b, name length %u 26055#>(16.L+19) ubyte x \b, TERMINATING NAME CHARACTER=%#x 26056# nul terminated matrix name like: fit_params testmatrix testsparsecomplex teststringarray 26057#>20 string x \b, MATRIX NAME="%s" 26058#>21 ubyte x \b, MAYBE 2ND CHAR=%c 26059>16 pstring/L x %s 26060# T indicates the matrix type: 0~numeric 1~text 2~sparse 26061#>0 ubelong%10 x \b, T=%u 26062>0 ubelong%10 0 \b, numeric 26063>0 ubelong%10 1 \b, text 26064>0 ubelong%10 2 \b, sparse 26065# mrows; number of rows in the matrix like: 1 3 8 26066>4 ubelong x \b, rows %u 26067# ncols; number of columns in the matrix like: 1 3 4 5 9 43 26068>8 ubelong x \b, columns %u 26069# imagf; imaginary flag; 1~matrix has an imaginary part 0~only real data 26070>12 ubelong !0 \b, imaginary (%u) 26071# real; Real part of the matrix consists of mrows * ncols numbers 26072 26073#------------------------------------------------------------------------------ 26074# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $ 26075# matroska: file(1) magic for Matroska files 26076# 26077# See https://www.matroska.org/ 26078# 26079 26080# EBML id: 260810 belong 0x1a45dfa3 26082# DocType id: 26083>4 search/4096 \x42\x82 26084# DocType contents: 26085>>&1 string webm WebM 26086!:mime video/webm 26087>>&1 string matroska Matroska data 26088!:mime video/x-matroska 26089 26090#------------------------------------------------------------------------------ 26091# $File: mcrypt,v 1.6 2022/02/08 18:51:45 christos Exp $ 26092# Mavroyanopoulos Nikos <nmav@hellug.gr> 26093# mcrypt: file(1) magic for mcrypt 2.2.x; 26094# URL: https://en.wikipedia.org/wiki/Mcrypt 26095# http://fileformats.archiveteam.org/wiki/MCrypt 26096# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nc-mcrypt.trid.xml 26097# Update: Joerg Jenderek 26098# Note: called by TrID "mcrypt encrypted (v2.5)" 260990 string \0m\3 mcrypt 2.5 encrypted data, 26100#!:mime application/octet-stream 26101!:mime application/x-crypt-nc 26102!:ext nc 26103>4 string >\0 algorithm: %s, 26104>>&1 leshort >0 keysize: %d bytes, 26105>>>&0 string >\0 mode: %s, 26106 26107# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nc-mcrypt-22.trid.xml 26108# Note: called by TrID "mcrypt encrypted (v2.2)" 261090 string \0m\2 mcrypt 2.2 encrypted data, 26110#!:mime application/octet-stream 26111!:mime application/x-crypt-nc 26112# no example 26113!:ext nc 26114>3 byte 0 algorithm: blowfish-448, 26115>3 byte 1 algorithm: DES, 26116>3 byte 2 algorithm: 3DES, 26117>3 byte 3 algorithm: 3-WAY, 26118>3 byte 4 algorithm: GOST, 26119>3 byte 6 algorithm: SAFER-SK64, 26120>3 byte 7 algorithm: SAFER-SK128, 26121>3 byte 8 algorithm: CAST-128, 26122>3 byte 9 algorithm: xTEA, 26123>3 byte 10 algorithm: TWOFISH-128, 26124>3 byte 11 algorithm: RC2, 26125>3 byte 12 algorithm: TWOFISH-192, 26126>3 byte 13 algorithm: TWOFISH-256, 26127>3 byte 14 algorithm: blowfish-128, 26128>3 byte 15 algorithm: blowfish-192, 26129>3 byte 16 algorithm: blowfish-256, 26130>3 byte 100 algorithm: RC6, 26131>3 byte 101 algorithm: IDEA, 26132>4 byte 0 mode: CBC, 26133>4 byte 1 mode: ECB, 26134>4 byte 2 mode: CFB, 26135>4 byte 3 mode: OFB, 26136>4 byte 4 mode: nOFB, 26137>5 byte 0 keymode: 8bit 26138>5 byte 1 keymode: 4bit 26139>5 byte 2 keymode: SHA-1 hash 26140>5 byte 3 keymode: MD5 hash 26141 26142#------------------------------------------------------------------------------ 26143# $File: measure,v 1.3 2021/03/25 17:30:10 christos Exp $ 26144# measure: file(1) magic for measurement data 26145 26146# DIY-Thermocam raw data 261470 name diy-thermocam-parser 26148>0 beshort x scale %d- 26149>2 beshort x \b%d, 26150>4 lefloat x spot sensor temperature %f, 26151>9 ubyte 0 unit celsius, 26152>9 ubyte 1 unit fahrenheit, 26153>8 ubyte x color scheme %d 26154>10 ubyte 1 \b, show spot sensor 26155>11 ubyte 1 \b, show scale bar 26156>12 ubyte &1 \b, minimum point enabled 26157>12 ubyte &2 \b, maximum point enabled 26158>13 lefloat x \b, calibration: offset %f, 26159>17 lefloat x slope %f 26160 261610 name diy-thermocam-checker 26162>9 ubyte <2 26163>>10 ubyte <2 26164>>>11 ubyte <2 26165>>>>12 ubyte <4 26166>>>>>17 lefloat >0.0001 DIY-Thermocam raw data 26167 26168# V2 and Leption 3.x: 2616938408 ubyte <19 26170>38400 use diy-thermocam-checker 26171>>38400 default x (Lepton 3.x), 26172>>>38400 use diy-thermocam-parser 26173 26174# V1 or Lepton 2.x 261759608 ubyte <19 26176>9600 use diy-thermocam-checker 26177>>9600 default x (Lepton 2.x), 26178>>>9600 use diy-thermocam-parser 26179 26180# Becker & Hickl Photon Counting (PMS) data file 26181# format documentation: https://www.becker-hickl.com/wp-content/uploads/2018/11/opm-pms400-v01.pdf (page 57) 26182(0x02.l) string *IDENTIFICATION Becker & Hickl PMS Data File 26183>0x12 short x (%d data blocks) 26184!:ext sdt 26185 26186#------------------------------------------------------------------------------ 26187# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $ 26188# mercurial: file(1) magic for Mercurial changeset bundles 26189# https://www.selenic.com/mercurial/wiki/ 26190# 26191# Jesse Glick (jesse.glick@sun.com) 26192# 26193 261940 string HG10 Mercurial changeset bundle 26195>4 string UN (uncompressed) 26196>4 string GZ (gzip compressed) 26197>4 string BZ (bzip2 compressed) 26198 26199#------------------------------------------------------------------------------ 26200# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $ 26201# metastore: file(1) magic for metastore files 26202# From: Thomas Wissen 26203# see https://david.hardeman.nu/software.php#metastore 262040 string MeTaSt00r3 Metastore data file, 26205>10 bequad x version %0llx 26206 26207#------------------------------------------------------------------------------ 26208# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $ 26209# rinex: file(1) magic for RINEX files 26210# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 26211# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 26212# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 2621360 string RINEX 26214>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 26215>>&32 string x \b, date %15.15s 26216>>5 string x \b, version %6.6s 26217!:mime rinex/broadcast 26218>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 26219>>&32 string x \b, date %15.15s 26220>>5 string x \b, version %6.6s 26221!:mime rinex/observation 26222>80 search/256 XXRINEXC RINEX Data, Clock 26223>>&32 string x \b, date %15.15s 26224>>5 string x \b, version %6.6s 26225!:mime rinex/clock 26226>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 26227>>&32 string x \b, date %15.15s 26228>>5 string x \b, version %6.6s 26229!:mime rinex/navigation 26230>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 26231>>&32 string x \b, date %15.15s 26232>>5 string x \b, version %6.6s 26233!:mime rinex/navigation 26234>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 26235>>&32 string x \b, date %15.15s 26236>>5 string x \b, version %6.6s 26237!:mime rinex/navigation 26238>80 search/256 XXRINEXM RINEX Data, Meteorological 26239>>&32 string x \b, date %15.15s 26240>>5 string x \b, version %6.6s 26241!:mime rinex/meteorological 26242>80 search/256 XXRINEXN RINEX Data, Navigation 26243>>&32 string x \b, date %15.15s 26244>>5 string x \b, version %6.6s 26245!:mime rinex/navigation 26246>80 search/256 XXRINEXO RINEX Data, Observation 26247>>&32 string x \b, date %15.15s 26248>>5 string x \b, version %6.6s 26249!:mime rinex/observation 26250 26251# https://en.wikipedia.org/wiki/GRIB 262520 string GRIB 26253>7 byte =1 Gridded binary (GRIB) version 1 26254>7 byte =2 Gridded binary (GRIB) version 2 26255 26256#------------------------------------------------------------------------------ 26257# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $ 26258# Micro Focus COBOL data files. 26259 26260# https://documentation.microfocus.com/help/index.jsp?topic=\ 26261# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html 26262# http://www.cobolproducts.com/datafile/data-viewer.html 26263# https://github.com/miracle2k/mfcobol-export 26264 262650 string \x30\x00\x00\x7C 26266>36 string \x00\x3E Micro Focus File with Header (DAT) 26267!:mime application/octet-stream 26268 262690 string \x30\x7E\x00\x00 26270>36 string \x00\x3E Micro Focus File with Header (DAT) 26271!:mime application/octet-stream 26272 2627339 string \x02 26274>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX) 26275!:mime application/octet-stream 26276 26277#------------------------------------------------------------------------------ 26278# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $ 26279# mime: file(1) magic for MIME encoded files 26280# 262810 string/t Content-Type:\040 26282>14 string >\0 %s 262830 string/t Content-Type: 26284>13 string >\0 %s 26285 26286#------------------------------------------------------------------------------ 26287# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $ 26288# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 26289# and DEC Ultrix 26290# 262910 beshort 0x0160 MIPSEB ECOFF executable 26292>20 beshort 0407 (impure) 26293>20 beshort 0410 (swapped) 26294>20 beshort 0413 (paged) 26295>8 belong >0 not stripped 26296>8 belong 0 stripped 26297>22 byte x - version %d 26298>23 byte x \b.%d 26299# 263000 beshort 0x0162 MIPSEL-BE ECOFF executable 26301>20 beshort 0407 (impure) 26302>20 beshort 0410 (swapped) 26303>20 beshort 0413 (paged) 26304>8 belong >0 not stripped 26305>8 belong 0 stripped 26306>23 byte x - version %d 26307>22 byte x \b.%d 26308# 263090 beshort 0x6001 MIPSEB-LE ECOFF executable 26310>20 beshort 03401 (impure) 26311>20 beshort 04001 (swapped) 26312>20 beshort 05401 (paged) 26313>8 belong >0 not stripped 26314>8 belong 0 stripped 26315>23 byte x - version %d 26316>22 byte x \b.%d 26317# 263180 beshort 0x6201 MIPSEL ECOFF executable 26319>20 beshort 03401 (impure) 26320>20 beshort 04001 (swapped) 26321>20 beshort 05401 (paged) 26322>8 belong >0 not stripped 26323>8 belong 0 stripped 26324>23 byte x - version %d 26325>22 byte x \b.%d 26326# 26327# MIPS 2 additions 26328# 263290 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 26330>20 beshort 0407 (impure) 26331>20 beshort 0410 (swapped) 26332>20 beshort 0413 (paged) 26333>8 belong >0 not stripped 26334>8 belong 0 stripped 26335>22 byte x - version %d 26336>23 byte x \b.%d 26337# 263380 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 26339>20 beshort 0407 (impure) 26340>20 beshort 0410 (swapped) 26341>20 beshort 0413 (paged) 26342>8 belong >0 not stripped 26343>8 belong 0 stripped 26344>22 byte x - version %d 26345>23 byte x \b.%d 26346# 263470 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 26348>20 beshort 03401 (impure) 26349>20 beshort 04001 (swapped) 26350>20 beshort 05401 (paged) 26351>8 belong >0 not stripped 26352>8 belong 0 stripped 26353>23 byte x - version %d 26354>22 byte x \b.%d 26355# 263560 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 26357>20 beshort 03401 (impure) 26358>20 beshort 04001 (swapped) 26359>20 beshort 05401 (paged) 26360>8 belong >0 not stripped 26361>8 belong 0 stripped 26362>23 byte x - version %d 26363>22 byte x \b.%d 26364# 26365# MIPS 3 additions 26366# 263670 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 26368>20 beshort 0407 (impure) 26369>20 beshort 0410 (swapped) 26370>20 beshort 0413 (paged) 26371>8 belong >0 not stripped 26372>8 belong 0 stripped 26373>22 byte x - version %d 26374>23 byte x \b.%d 26375# 263760 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 26377>20 beshort 0407 (impure) 26378>20 beshort 0410 (swapped) 26379>20 beshort 0413 (paged) 26380>8 belong >0 not stripped 26381>8 belong 0 stripped 26382>22 byte x - version %d 26383>23 byte x \b.%d 26384# 263850 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 26386>20 beshort 03401 (impure) 26387>20 beshort 04001 (swapped) 26388>20 beshort 05401 (paged) 26389>8 belong >0 not stripped 26390>8 belong 0 stripped 26391>23 byte x - version %d 26392>22 byte x \b.%d 26393# 263940 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 26395>20 beshort 03401 (impure) 26396>20 beshort 04001 (swapped) 26397>20 beshort 05401 (paged) 26398>8 belong >0 not stripped 26399>8 belong 0 stripped 26400>23 byte x - version %d 26401>22 byte x \b.%d 26402# 264030 beshort 0x180 MIPSEB Ucode 264040 beshort 0x182 MIPSEL-BE Ucode 26405 26406#------------------------------------------------------------------------------ 26407# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 26408# mirage: file(1) magic for Mirage executables 26409# 26410# XXX - byte order? 26411# 264120 long 31415 Mirage Assembler m.out executable 26413 26414#----------------------------------------------------------------------------- 26415# $File: misctools,v 1.20 2021/05/25 15:13:55 christos Exp $ 26416# misctools: file(1) magic for miscellaneous UNIX tools. 26417# 264180 search/1 %%!! X-Post-It-Note text 264190 string/c BEGIN:VCALENDAR vCalendar calendar file 26420!:mime text/calendar 26421# updated by Joerg Jenderek at Apr 2015, May 2021 26422# https://en.wikipedia.org/wiki/VCard 26423# URL: http://fileformats.archiveteam.org/wiki/VCard 26424# https://datatracker.ietf.org/doc/html/rfc6350 26425# the value is case-insensitive 264260 string/c begin:vcard 26427# skip DROID fmt-395-signature-id-634.vcf 26428>13 string !VERSION:END vCard visiting card 26429# deprecated 26430#!:mime text/x-vcard 26431!:mime text/vcard 26432!:apple ????vCrd 26433!:ext vcf/vcard 26434# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere 26435# Joerg_Jenderek_67.vcf 26436>>12 search/0x113b4/c version: 26437# VERSION 2.1 , 3.0 or 4.0 26438>>>&0 string x \b, version %-.3s 26439>>>&0 string !2.1 26440>>>>13 string !VERSION: \b, 2nd line does not start with VERSION: 26441# downcase violates RFC 6350, but some "bad" software produce such vcards 26442>>0 string !BEGIN \b, not up case 26443# http://ftp.mozilla.org/pub/thunderbird/candidates/ 26444# 78.10.1-candidates/build1/source/thunderbird-78.10.1.source.tar.xz 26445# thunderbird-78.10.1/comm/mailnews/import/test/unit/resources/basic_vcard_addressbook.vcf 26446>>11 beshort !0x0D0A \b, lines not separated by CRLF 26447 26448# Summary: Libtool library file 26449# Extension: .la 26450# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 264510 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 26452 26453# Summary: Libtool object file 26454# Extension: .lo 26455# Submitted by: Abel Cheung <abelcheung@gmail.com> 264560 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 26457 26458# From: Daniel Novotny <dnovotny@redhat.com> 26459# Update: Joerg Jenderek 26460# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps 26461# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx 26462# 26463# "Windows Minidump" by TrID 26464# ./misctools (version 5.25) labeled the entry as "MDMP crash report data" 264650 string MDMP Mini DuMP crash report 26466# https://filext.com/file-extension/DMP 26467!:mime application/x-dmp 26468!:ext dmp/mdmp 26469# The high-order word is an internal value that is implementation specific. 26470# The low-order word is MINIDUMP_VERSION 0xA793 26471>4 ulelong&0x0000FFFF !0xA793 \b, version %#4.4x 26472# NumberOfStreams 8,9,10,13 26473>8 ulelong x \b, %d streams 26474# StreamDirectoryRva 0x20 26475>12 ulelong !0x20 \b, %#8.8x RVA 26476# CheckSum 0 26477>16 ulelong !0 \b, CheckSum %#8.8x 26478# Reserved or TimeDateStamp 26479>20 ledate x \b, %s 26480# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx 26481# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800 26482>24 ulelong x \b, %#x type 26483# >24 ulelong >0 \b; include 26484# >>24 ulelong &0x00000001 \b data sections, 26485# >>24 ulelong &0x00000020 \b list of unloaded modules, 26486# >>24 ulelong &0x00000100 \b process and thread information, 26487# >>24 ulelong &0x00000800 \b memory information, 26488 26489# Summary: abook addressbook file 26490# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 264910 string #\x20abook\x20addressbook\x20file abook address book 26492!:mime application/x-abook-addressbook 26493 26494#------------------------------------------------------------------------------ 26495# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 26496# mkid: file(1) magic for mkid(1) databases 26497# 26498# ID is the binary tags database produced by mkid(1). 26499# 26500# XXX - byte order? 26501# 265020 string \311\304 ID tags data 26503>2 short >0 version %d 26504 26505#------------------------------------------------------------------------------ 26506# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 26507# mlssa: file(1) magic for MLSSA datafiles 26508# 265090 lelong 0xffffabcd MLSSA datafile, 26510>4 leshort x algorithm %d, 26511>10 lelong x %d samples 26512 26513#------------------------------------------------------------------------------ 26514# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 26515# mmdf: file(1) magic for MMDF mail files 26516# 265170 string \001\001\001\001 MMDF mailbox 26518 26519#------------------------------------------------------------------------------ 26520# $File: modem,v 1.10 2021/04/26 15:56:00 christos Exp $ 26521# modem: file(1) magic for modem programs 26522# 26523# From: Florian La Roche <florian@knorke.saar.de> 265241 string PC\ Research,\ Inc Digifax-G3-File 26525>29 byte 1 \b, fine resolution 26526>29 byte 0 \b, normal resolution 26527 26528# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header). 26529# Modified by: Joerg Jenderek 26530# URL: https://de.wikipedia.org/wiki/Fax 26531# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm 26532# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others 265330 short 0x0100 26534# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER 26535>2 search/9 \0\0 26536# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 26537>2 default x 26538# skip IRCAM file (VAX big-endian) ./audio 26539>>0 belong !0x0001a364 26540# skip GEM Image data ./images 26541>>>2 beshort !0x0008 26542# look for first keyword of Panorama database *.pan 26543>>>>11 search/262 \x06DESIGN 26544# skip Panorama database 26545>>>>11 default x 26546# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files 26547>>>>>27118 search/1864 DreamWorld 26548>>>>>27118 default x 26549# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom 26550>>>>>>8 ubequad !0x2e01010454010203 26551# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom 26552>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded 26553# version 5.25 labeled the entry above "raw G3 data, byte-padded" 26554!:mime image/g3fax 26555#!:apple ????TIFF 26556!:ext g3 26557# unusual image starting with black pixel 26558#0 short 0x1300 raw G3 (Group 3) FAX 265590 short 0x1400 26560# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom 26561>2 search/9 \0\0 26562# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 26563>2 default x raw G3 (Group 3) FAX 26564# version 5.25 labeled the above entry as "raw G3 data" 26565!:mime image/g3fax 26566!:ext g3 26567# unusual image with black pixel near beginning 26568#0 short 0x1900 raw G3 (Group 3) FAX 26569 26570# 26571# Magic data for vgetty voice formats 26572# (Martin Seine & Marc Eberhard) 26573 26574# 26575# raw modem data version 1 26576# 265770 string RMD1 raw modem data 26578>4 string >\0 (%s / 26579>20 short >0 compression type %#04x) 26580 26581# 26582# portable voice format 1 26583# 265840 string PVF1\n portable voice format 26585>5 string >\0 (binary %s) 26586 26587# 26588# portable voice format 2 26589# 265900 string PVF2\n portable voice format 26591>5 string >\0 (ascii %s) 26592 26593# From: Bernd Nuernberger <bernd.nuernberger@web.de> 26594# Brooktrout G3 fax data incl. 128 byte header 26595# Common suffixes: 3??, BRK, BRT, BTR 265960 leshort 0x01bb 26597>2 leshort 0x0100 Brooktrout 301 fax image, 26598>>9 leshort x %d x 26599>>0x2d leshort x %d 26600>>6 leshort 200 \b, fine resolution 26601>>6 leshort 100 \b, normal resolution 26602>>11 byte 1 \b, G3 compression 26603>>11 byte 2 \b, G32D compression 26604 26605#------------------------------------------------------------------------------ 26606# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $ 26607# modulefile: file(1) magic for user's environment modulefile 26608# URL: http://modules.sourceforge.net/ 26609# Reference: https://modules.readthedocs.io/en/stable/modulefile.html 26610# From: Xavier Delaruelle <xavier.delaruelle@cea.fr> 266110 string #%Module modulefile 26612!:mime text/x-modulefile 26613 26614#------------------------------------------------------------------------------ 26615# $File: motorola,v 1.12 2021/04/26 15:56:00 christos Exp $ 26616# motorola: file(1) magic for Motorola 68K and 88K binaries 26617# 26618# 68K 26619# 266200 beshort 0520 mc68k COFF 26621>18 beshort ^00000020 object 26622>18 beshort &00000020 executable 26623>12 belong >0 not stripped 26624>168 string .lowmem Apple toolbox 26625>20 beshort 0407 (impure) 26626>20 beshort 0410 (pure) 26627>20 beshort 0413 (demand paged) 26628>20 beshort 0421 (standalone) 266290 beshort 0521 mc68k executable (shared) 26630>12 belong >0 not stripped 266310 beshort 0522 mc68k executable (shared demand paged) 26632>12 belong >0 not stripped 26633# 26634# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 26635# 266360 beshort 0554 68K BCS executable 26637# 26638# 88K 26639# 26640# Motorola/88Open BCS 26641# 266420 beshort 0555 88K BCS executable 26643# 26644# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 266450 string S0 Motorola S-Record; binary data in text format 26646 26647# ATARI ST relocatable PRG 26648# 26649# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 26650# (according to Roland Waldi, Oct 21, 1987) 26651# besides the magic 0x601a, the text segment size is checked to be 26652# not larger than 1 MB (which is a lot on ST). 26653# The additional 0x601b distinction I took from Doug Lee's magic. 266540 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 26655>2 belong x (txt=%d, 26656>6 belong x dat=%d, 26657>10 belong x bss=%d, 26658>14 belong x sym=%d) 266590 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 26660>2 belong x (txt=%d, 26661>6 belong x dat=%d, 26662>10 belong x bss=%d, 26663>14 belong x sym=%d) 26664 26665# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 266660 beshort 0x601A Atari 68xxx executable, 26667>2 belong x text len %u, 26668>6 belong x data len %u, 26669>10 belong x BSS len %u, 26670>14 belong x symboltab len %u, 26671>18 belong 0 26672>22 belong &0x01 fastload flag, 26673>22 belong &0x02 may be loaded to alternate RAM, 26674>22 belong &0x04 malloc may be from alternate RAM, 26675>22 belong x flags: %#X, 26676>26 beshort 0 no relocation tab 26677>26 beshort !0 + relocation tab 26678>30 string SFX [Self-Extracting LZH SFX archive] 26679>38 string SFX [Self-Extracting LZH SFX archive] 26680>44 string ZIP! [Self-Extracting ZIP SFX archive] 26681 266820 beshort 0x0064 Atari 68xxx CPX file 26683>8 beshort x (version %04x) 26684 26685#------------------------------------------------------------------------------ 26686# $File: mozilla,v 1.12 2021/04/26 15:56:00 christos Exp $ 26687# mozilla: file(1) magic for Mozilla XUL fastload files 26688# (XUL.mfasl and XPC.mfasl) 26689# URL: https://www.mozilla.org/ 26690# From: Josh Triplett <josh@freedesktop.org> 26691 266920 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 26693# Probably the next magic line contains misspelled "mozLz40\0" 266940 string mozLz4a Mozilla lz4 compressed bookmark data 26695# From: Joerg Jenderek 26696# URL: https://lz4.github.io/lz4/ 26697# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/ 26698# dejsonlz4-master\src\dejsonlz4.c 26699# Note: mostly JSON compressed with a non-standard LZ4 header 26700# can be unpacked by dejsonlz4 but not lz4 program. 267010 string mozLz40\0 Mozilla lz4 compressed data 26702!:mime application/x-lz4+json 26703# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks 26704!:ext jsonlz4/mozlz4 26705# decomp_size 26706>8 ulelong x \b, originally %u bytes 26707# lz4 data 26708#>12 ubequad x \b, lz4 data %#16.16llx 26709 26710# From: Joerg Jenderek 26711# URL: https://en.wikipedia.org/wiki/Firefox_4 26712# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT 26713# Note: Most ZIP utilities are able to extract such archives 26714# maybe only partly or after some warnings. Example: 26715# zip -FF omni.ja --out omni.zip 267164 string PK\001\002 Mozilla archive omni.ja 26717!:mime application/x-zip 26718!:ext ja 26719# TODO: 26720#>4 use zip-dir-entry 26721 26722#------------------------------------------------------------------------------ 26723# $File: msdos,v 1.158 2022/09/07 11:17:31 christos Exp $ 26724# msdos: file(1) magic for MS-DOS files 26725# 26726 26727# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 26728# updated by Joerg Jenderek at Oct 2008,Apr 2011 267290 string/t @ 26730>1 string/cW \ echo\ off DOS batch file text 26731!:mime text/x-msdos-batch 26732!:ext bat 26733>1 string/cW echo\ off DOS batch file text 26734!:mime text/x-msdos-batch 26735!:ext bat 26736>1 string/cW rem DOS batch file text 26737!:mime text/x-msdos-batch 26738!:ext bat 26739>1 string/cW set\ DOS batch file text 26740!:mime text/x-msdos-batch 26741!:ext bat 26742 26743 26744# OS/2 batch files are REXX. the second regex is a bit generic, oh well 26745# the matched commands seem to be common in REXX and uncommon elsewhere 26746100 search/0xffff rxfuncadd 26747>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 26748100 search/0xffff say 26749>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 26750 26751# updated by Joerg Jenderek at Oct 2015 26752# https://de.wikipedia.org/wiki/Common_Object_File_Format 26753# http://www.delorie.com/djgpp/doc/coff/filhdr.html 26754# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 26755#0 leshort 0x14c MS Windows COFF Intel 80386 object file 26756#>4 ledate x stamp %s 267570 leshort 0x166 MS Windows COFF MIPS R4000 object file 26758#>4 ledate x stamp %s 267590 leshort 0x184 MS Windows COFF Alpha object file 26760#>4 ledate x stamp %s 267610 leshort 0x268 MS Windows COFF Motorola 68000 object file 26762#>4 ledate x stamp %s 267630 leshort 0x1f0 MS Windows COFF PowerPC object file 26764#>4 ledate x stamp %s 267650 leshort 0x290 MS Windows COFF PA-RISC object file 26766#>4 ledate x stamp %s 26767 26768# Tests for various EXE types. 26769# 26770# Many of the compressed formats were extracted from IDARC 1.23 source code. 26771# 267720 string/b MZ 26773# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 26774>0x18 leshort <0x40 MS-DOS executable 26775!:mime application/x-dosexec 26776# Windows and later versions of DOS will allow .EXEs to be named with a .COM 26777# extension, mostly for compatibility's sake. 26778# URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM 26779# Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml 26780!:ext exe/com/vlm 26781# These traditional tests usually work but not always. When test quality support is 26782# implemented these can be turned on. 26783#>>0x18 leshort 0x1c (Borland compiler) 26784#>>0x18 leshort 0x1e (MS compiler) 26785 26786# Maybe it's a PE? 26787>(0x3c.l) string PE\0\0 PE 26788!:mime application/x-dosexec 26789>>(0x3c.l+24) leshort 0x010b \b32 executable 26790>>(0x3c.l+24) leshort 0x020b \b32+ executable 26791>>(0x3c.l+24) leshort 0x0107 ROM image 26792>>(0x3c.l+24) default x Unknown PE signature 26793>>>&0 leshort x %#x 26794>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 26795>>(0x3c.l+92) leshort 1 26796# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 26797# drivers in Windows/System32/drivers/*.sys. 26798>>>(0x3c.l+22) leshort&0x2000 >0 (native) 26799!:ext dll/sys 26800>>>(0x3c.l+22) leshort&0x2000 0 (native) 26801!:ext exe/sys 26802>>(0x3c.l+92) leshort 2 26803>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 26804# These could probably be at least partially distinguished from one another by 26805# looking for specific exported functions. 26806# CPL: Control Panel item 26807# TLB: Type library 26808# OCX: OLE/ActiveX control 26809# ACM: Audio compression manager codec 26810# AX: DirectShow source filter 26811# IME: Input method editor 26812!:ext dll/cpl/tlb/ocx/acm/ax/ime 26813>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 26814# Screen savers typically include code from the scrnsave.lib static library, but 26815# that's not guaranteed. 26816!:ext exe/scr 26817>>(0x3c.l+92) leshort 3 26818>>>(0x3c.l+22) leshort&0x2000 >0 (console) 26819!:ext dll/cpl/tlb/ocx/acm/ax/ime 26820>>>(0x3c.l+22) leshort&0x2000 0 (console) 26821!:ext exe/com 26822# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format 26823>>(0x3c.l+92) leshort 7 (POSIX) 26824>>(0x3c.l+92) leshort 9 (Windows CE) 26825>>(0x3c.l+92) leshort 10 (EFI application) 26826>>(0x3c.l+92) leshort 11 (EFI boot service driver) 26827>>(0x3c.l+92) leshort 12 (EFI runtime driver) 26828>>(0x3c.l+92) leshort 13 (EFI ROM) 26829>>(0x3c.l+92) leshort 14 (XBOX) 26830>>(0x3c.l+92) leshort 15 (Windows boot application) 26831>>(0x3c.l+92) default x (Unknown subsystem 26832>>>&0 leshort x %#x) 26833>>(0x3c.l+4) leshort 0x14c Intel 80386 26834>>(0x3c.l+4) leshort 0x166 MIPS R4000 26835>>(0x3c.l+4) leshort 0x168 MIPS R10000 26836>>(0x3c.l+4) leshort 0x184 Alpha 26837>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 26838>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP 26839>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5 26840>>(0x3c.l+4) leshort 0x169 MIPS WCE v2 26841>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 26842>>(0x3c.l+4) leshort 0x1c0 ARM 26843>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 26844>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 26845>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33 26846>>(0x3c.l+4) leshort 0x1f0 PowerPC 26847>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU 26848>>(0x3c.l+4) leshort 0x1f2 PowerPC (big-endian) 26849>>(0x3c.l+4) leshort 0x200 Intel Itanium 26850>>(0x3c.l+4) leshort 0x266 MIPS16 26851>>(0x3c.l+4) leshort 0x268 Motorola 68000 26852>>(0x3c.l+4) leshort 0x290 PA-RISC 26853>>(0x3c.l+4) leshort 0x366 MIPSIV 26854>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 26855>>(0x3c.l+4) leshort 0xebc EFI byte code 26856>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit 26857>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit 26858>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit 26859>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R 26860>>(0x3c.l+4) leshort 0x8664 x86-64 26861>>(0x3c.l+4) leshort 0xaa64 Aarch64 26862>>(0x3c.l+4) leshort 0xc0ee MSIL 26863>>(0x3c.l+4) default x Unknown processor type 26864>>>&0 leshort x %#x 26865>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 26866>>(0x3c.l+22) leshort&0x1000 >0 system file 26867>>(0x3c.l+24) leshort 0x010b 26868>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 26869>>(0x3c.l+24) leshort 0x020b 26870>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 26871 26872# hooray, there's a DOS extender using the PE format, with a valid PE 26873# executable inside (which just prints a message and exits if run in win) 26874>>(8.s*16) string 32STUB \b, 32rtm DOS extender 26875>>(8.s*16) string !32STUB \b, for MS Windows 26876>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 26877>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 26878>>(0x3c.l+0xf8) search/0x140 UPX2 26879>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 26880>>(0x3c.l+0xf8) search/0x140 .idata 26881>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 26882>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 26883>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 26884>>(0x3c.l+0xf8) search/0x140 .rsrc 26885>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 26886>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 26887>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 26888>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 26889>>(0x3c.l+0xf8) search/0x140 .data 26890>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 26891>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 26892>>>(0x3c.l+0xf7) byte x 26893>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 26894>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 26895>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 26896>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 26897>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 26898>>0x30 string Inno \b, InnoSetup self-extracting archive 26899 26900# If the relocation table is 0x40 or more bytes into the file, it's definitely 26901# not a DOS EXE. 26902>0x18 leshort >0x3f 26903 26904# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 26905# must be one of the unusual subformats. 26906>>(0x3c.l) string !PE\0\0 MS-DOS executable 26907!:mime application/x-dosexec 26908 26909>>(0x3c.l) string NE \b, NE 26910!:mime application/x-dosexec 26911>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 26912>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 26913>>>(0x3c.l+0x36) byte 3 for MS-DOS 26914>>>(0x3c.l+0x36) byte 4 for Windows 386 26915>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 26916>>>(0x3c.l+0x36) default x 26917>>>>(0x3c.l+0x36) byte x (unknown OS %x) 26918>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 26919>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 26920# DRV: Driver 26921# 3GR: Grabber device driver 26922# CPL: Control Panel Item 26923# VBX: Visual Basic Extension 26924# FON: Bitmap font 26925# FOT: Font resource file 26926!:ext dll/drv/3gr/cpl/vbx/fon/fot 26927>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 26928!:ext exe/scr 26929>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 26930>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 26931 26932>>(0x3c.l) string LX\0\0 \b, LX 26933!:mime application/x-dosexec 26934>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 26935>>>(0x3c.l+0x0a) leshort 1 for OS/2 26936>>>(0x3c.l+0x0a) leshort 2 for MS Windows 26937>>>(0x3c.l+0x0a) leshort 3 for DOS 26938>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 26939>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 26940>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 26941>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 26942>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 26943>>>(0x3c.l+0x08) leshort 1 i80286 26944>>>(0x3c.l+0x08) leshort 2 i80386 26945>>>(0x3c.l+0x08) leshort 3 i80486 26946>>>(8.s*16) string emx \b, emx 26947>>>>&1 string x %s 26948>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 26949 26950# MS Windows system file, supposedly a collection of LE executables 26951>>(0x3c.l) string W3 \b, W3 for MS Windows 26952!:mime application/x-dosexec 26953 26954>>(0x3c.l) string LE\0\0 \b, LE executable 26955!:mime application/x-dosexec 26956>>>(0x3c.l+0x0a) leshort 1 26957# some DOS extenders use LE files with OS/2 header 26958>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 26959>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 26960>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 26961>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 26962>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 26963>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 26964>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 26965# this is a wild guess; hopefully it is a specific signature 26966>>>>&0x24 lelong <0x50 26967>>>>>(&0x4c.l) string \xfc\xb8WATCOM 26968>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 26969# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 26970#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 26971# fails with DOS-Extenders. 26972>>>(0x3c.l+0x0a) leshort 2 for MS Windows 26973>>>(0x3c.l+0x0a) leshort 3 for DOS 26974>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 26975# VXD: VxD for Windows 95/98/Me 26976# 386: VxD for Windows 2.10, 3.0, 3.1x 26977# PDR: Port driver 26978# MPD: Miniport driver (?) 26979!:ext vxd/386/pdr/mpd 26980>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 26981>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 26982 26983# looks like ASCII, probably some embedded copyright message. 26984# and definitely not NE/LE/LX/PE 26985>>0x3c lelong >0x20000000 26986>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 26987!:mime application/x-dosexec 26988!:ext exe/com 26989# header data too small for extended executable 26990>2 long !0 26991>>0x18 leshort <0x40 26992>>>(4.s*512) leshort !0x014c 26993 26994>>>>&(2.s-514) string !LE 26995>>>>>&-2 string !BW \b, MZ for MS-DOS 26996!:mime application/x-dosexec 26997>>>>&(2.s-514) string LE \b, LE 26998>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 26999# educated guess since indirection is still not capable enough for complex offset 27000# calculations (next embedded executable would be at &(&2*512+&0-2) 27001# I suspect there are only LE executables in these multi-exe files 27002>>>>&(2.s-514) string BW 27003>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 27004>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 27005 27006# This sequence skips to the first COFF segment, usually .text 27007>(4.s*512) leshort 0x014c \b, COFF 27008!:mime application/x-dosexec 27009>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 27010>>(8.s*16) string emx 27011>>>&1 string x for DOS, Win or OS/2, emx %s 27012>>&(&0x42.l-3) byte x 27013>>>&0x26 string UPX \b, UPX compressed 27014# and yet another guess: small .text, and after large .data is unusual, could be 32lite 27015>>&0x2c search/0xa0 .text 27016>>>&0x0b lelong <0x2000 27017>>>>&0 lelong >0x6000 \b, 32lite compressed 27018 27019>(8.s*16) string $WdX \b, WDos/X DOS extender 27020 27021# By now an executable type should have been printed out. The executable 27022# may be a self-uncompressing archive, so look for evidence of that and 27023# print it out. 27024# 27025# Some signatures below from Greg Roelofs, newt@uchicago.edu. 27026# 27027>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 27028>0xe7 string LH/2\ Self-Extract \b, %s 27029>0x1c string UC2X \b, UCEXE compressed 27030>0x1c string WWP\ \b, WWPACK compressed 27031>0x1c string RJSX \b, ARJ self-extracting archive 27032>0x1c string diet \b, diet compressed 27033>0x1c string LZ09 \b, LZEXE v0.90 compressed 27034>0x1c string LZ91 \b, LZEXE v0.91 compressed 27035>0x1c string tz \b, TinyProg compressed 27036>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 27037!:mime application/zip 27038# Yes, this really is "Copr", not "Corp." 27039>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 27040!:mime application/zip 27041# winarj stores a message in the stub instead of the sig in the MZ header 27042>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 27043>0x20 string AIN 27044>>0x23 string 2 \b, AIN 2.x compressed 27045>>0x23 string <2 \b, AIN 1.x compressed 27046>>0x23 string >2 \b, AIN 1.x compressed 27047>0x24 string LHa's\ SFX \b, LHa self-extracting archive 27048!:mime application/x-lha 27049>0x24 string LHA's\ SFX \b, LHa self-extracting archive 27050!:mime application/x-lha 27051>0x24 string \ $ARX \b, ARX self-extracting archive 27052>0x24 string \ $LHarc \b, LHarc self-extracting archive 27053>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 27054>0x40 string aPKG \b, aPackage self-extracting archive 27055>0x64 string W\ Collis\0\0 \b, Compack compressed 27056>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 27057>>&0xf4 search/0x140 \x0\x40\x1\x0 27058>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 27059>1638 string -lh5- \b, LHa self-extracting archive v2.13S 27060>0x17888 string Rar! \b, RAR self-extracting archive 27061 27062# Skip to the end of the EXE. This will usually work fine in the PE case 27063# because the MZ image is hardcoded into the toolchain and almost certainly 27064# won't match any of these signatures. 27065>(4.s*512) long x 27066>>&(2.s-517) byte x 27067>>>&0 string PK\3\4 \b, ZIP self-extracting archive 27068>>>&0 string Rar! \b, RAR self-extracting archive 27069>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 27070>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 27071>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 27072>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 27073>>>&7 search/400 **ACE** \b, ACE self-extracting archive 27074>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 27075 27076# a few unknown ZIP sfxes, no idea if they are needed or if they are 27077# already captured by the generic patterns above 27078>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 27079# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 27080# 27081 27082# TELVOX Teleinformatica CODEC self-extractor for OS/2: 27083>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 27084>>49824 leshort =1 \b, 1 file 27085>>49824 leshort >1 \b, %u files 27086 27087# Summary: OS/2 LX Library and device driver (no DOS stub) 27088# From: Joerg Jenderek 27089# URL: http://en.wikipedia.org/wiki/EXE 27090# Reference: http://www.textfiles.com/programming/FORMATS/lxexe.txt 27091# https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h 27092# Note: by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)" 27093# TODO: unify with DOS stub variant (MZ magic) 270940 string/b LX 27095>2 ushort =0 27096>>0 use lx-executable 27097# no examples found for big endian variant 27098>2 ushort =0x0101 27099>>0 use \^lx-executable 271000 name lx-executable 27101# similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX" 27102#>0x00 uleshort x executable, 27103# signature OSF_FLAT_LX_SIGNATURE~0x584C~LX OSF_FLAT_SIGNATURE~0x454C~LE 27104>0x00 uleshort =0x584c LX 27105>0x00 uleshort =0x454C LE 27106>0x00 uleshort x executable 27107#!:mime application/x-msdownload 27108!:mime application/x-lx-executable 27109# byte order: 00h~little-endian non-zero=1~big-endian 27110#>0x02 ubyte =0 (little-endian) 27111>0x02 ubyte !0 (big-endian) 27112# FOR DEBUGGING! 27113# word order: 00h~little-endian non-zero=1~big-endian 27114#>0x03 ubyte =0 \b, little-endian word order 27115#>0x03 ubyte !0 \b, big-endian word order 27116# cpu_type; CPU type like: 1~286 2~386 3~486 4 20h~i860 21h~Intel N11 40h~MIPS R2000,R3000 41h~MIPS R6000 42h~MIPS R4000 27117#>0x08 uleshort x \b, CPU %u 27118# os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 3~DOS 4.x 4~Windows 386 27119#>0x0A leshort x \b, OS %u 27120# flags; module type flags 27121#>0x10 ulelong x \b, FLAGS %#8.8x 27122# 00000002h ~Reserved for system use 27123#>0x10 ulelong &0x00000002 \b, 2h reserved 27124# OSF_INIT_INSTANCE=00000004h ~Per-Process Library Initialization; setting this bit for EXE file is invalid 27125#>0x10 ulelong &0x00000004 \b, per-process library Initialization 27126# OSF_INTERNAL_FIXUPS_DONE=00000010h ~Internal fixups for the module have been applied 27127#>0x10 ulelong &0x00000010 \b, int. fixup 27128# OSF_EXTERNAL_FIXUPS_DONE=00000020h ~External fixups for the module have been applied 27129#>0x10 ulelong &0x00000020 \b, ext. fixup 27130# OSF_NOT_PM_COMPATIBLE=00000100h ~Incompatible with PM windowing 27131#>0x10 ulelong&0x00000100 =0x00000100 \b, incompatible with PM windowing 27132# OSF_PM_COMPATIBLE=00000200h ~Compatible with PM windowing 27133#>0x10 ulelong&0x00000200 =0x00000200 \b, compatible with PM windowing 27134# bit 17; device driver 27135#>0x10 ulelong&0x00020000 >0 \b, device driver 27136# Per-process Library Termination; setting this bit for EXE file is invalid 27137#>0x10 ulelong&0x40000000 =0x40000000 \b, per-process library termination 27138>0x0a leshort 1 for OS/2 27139# no example found 27140>0x0a leshort 3 for DOS 27141# http://www.ctyme.com/intr/rb-2939.htm#Table1610 27142# library by module type mask 00038000h (bits 15-17); 27143# 0h ~exectable Program module 27144>0x10 ulelong&0x00038000 =0x00000000 (program) 27145#!:ext exe 27146# OSF_IS_DLL=8000h ~Library module (DLL) 27147>0x10 ulelong&0x00038000 >0x00000000 27148# OSF_PHYS_DEVICE=00020000h ~device driver 27149>>0x10 ulelong&0x00020000 >0 (device driver) 27150!:ext sys 27151# if not device driver it is library (DLL) 27152>>0x10 ulelong&0x00020000 =0 (library) 27153!:ext dll 27154# bits 8-10; OSF_PM_APP=300h in flags ~Uses PM windowing API; either it is GUI or console 27155>0x10 ulelong&0x00000300 =0x00000300 (GUI) 27156>0x10 ulelong&0x00000300 !0x00000300 (console) 27157# CPU type 27158>0x08 uleshort 1 i80286 27159# all inspected examples 27160>0x08 uleshort 2 i80386 27161>0x08 uleshort 3 i80486 27162>0x08 uleshort 4 i80586 27163# 21h Intel "N11" or compatible 27164# 40h MIPS Mark I ( R2000, R3000) or compatible 27165# 41h MIPS Mark II ( R6000 ) or compatible 27166# 42h MIPS Mark III ( R4000 ) or compatible 27167 27168# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 27169# and https://www.freedos.org/software/?prog=kpdos 27170# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 271710 string/b KCF FreeDOS KEYBoard Layout collection 27172# only version=0x100 found 27173>3 uleshort x \b, version %#x 27174# length of string containing author,info and special characters 27175>6 ubyte >0 27176#>>6 pstring x \b, name=%s 27177>>7 string >\0 \b, author=%-.14s 27178>>7 search/254 \xff \b, info= 27179#>>>&0 string x \b%-s 27180>>>&0 string x \b%-.15s 27181# for FreeDOS *.KL files 271820 string/b KLF FreeDOS KEYBoard Layout file 27183# only version=0x100 or 0x101 found 27184>3 uleshort x \b, version %#x 27185# stringlength 27186>5 ubyte >0 27187>>8 string x \b, name=%-.2s 271880 string \xffKEYB\ \ \ \0\0\0\0 27189>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 27190 27191# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020 27192# URL: http://fileformats.archiveteam.org/wiki/DOS_device_driver 27193# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html 27194# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 271950 ulequad&0x07a0ffffffff 0xffffffff 27196# skip OS/2 INI ./os2 27197>4 ubelong !0x14000000 27198>>0 use msdos-driver 271990 name msdos-driver DOS executable ( 27200#!:mime application/octet-stream 27201!:mime application/x-dosdriver 27202# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 27203# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used? 27204# PROTMAN.DOS ELNKPL.DOS 27205!:ext sys/dev/bin/dos 27206# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device" 27207>40 search/7 UPX! \bUPX compressed 27208# DOS device driver attributes 27209>4 uleshort&0x8000 0x0000 \bblock device driver 27210# character device 27211>4 uleshort&0x8000 0x8000 \b 27212# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$" 27213>>4 uleshort&0x0008 0x0008 \bclock 27214# fast video output by int 29h 27215# 1 space char after "fast" to get phrase like "fast standard input/output character device driver" 27216>>4 uleshort&0x0010 0x0010 \bfast 27217# standard input/output device 27218# 1 space char after "standard" to get phrase like "standard input/output character device driver" 27219>>4 uleshort&0x0003 >0 \bstandard 27220>>>4 uleshort&0x0001 0x0001 \binput 27221>>>4 uleshort&0x0003 0x0003 \b/ 27222# 1 space char after "output" to get phrase like "input/output character device driver" 27223>>>4 uleshort&0x0002 0x0002 \boutput 27224>>4 uleshort&0x8000 0x8000 \bcharacter device driver 27225>0 ubyte x 27226# upx compressed device driver has garbage instead of real in name field of header 27227>>40 search/7 UPX! 27228>>40 default x 27229# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 27230# 1 space char before device driver name to get phrase like "device driver PROTMAN$" 27231>>>12 ubyte >0x2E \b 27232>>>>10 ubyte >0x20 27233>>>>>10 ubyte !0x2E 27234>>>>>>10 ubyte !0x2A \b%c 27235>>>>11 ubyte >0x20 27236>>>>>11 ubyte !0x2E \b%c 27237>>>>12 ubyte >0x20 27238>>>>>12 ubyte !0x39 27239>>>>>>12 ubyte !0x2E \b%c 27240>>>13 ubyte >0x20 27241>>>>13 ubyte !0x2E \b%c 27242>>>>14 ubyte >0x20 27243>>>>>14 ubyte !0x2E \b%c 27244>>>>15 ubyte >0x20 27245>>>>>15 ubyte !0x2E \b%c 27246>>>>16 ubyte >0x20 27247>>>>>16 ubyte !0x2E 27248>>>>>>16 ubyte <0xCB \b%c 27249>>>>17 ubyte >0x20 27250>>>>>17 ubyte !0x2E 27251>>>>>>17 ubyte <0x90 \b%c 27252# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 27253>>>12 ubyte <0x2F 27254# they have their real name at offset 22 27255# also block device drivers like DUMBDRV.SYS 27256>>>>22 string >\056 %-.6s 27257>4 uleshort&0x8000 0x0000 27258# 32 bit sector addressing ( > 32 MB) for block devices 27259>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 27260# support by driver functions 13h, 17h, 18h 27261>4 uleshort&0x0040 0x0040 \b,IOCTL- 27262# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 27263>4 uleshort&0x0800 0x0800 \b,close media- 27264# output until busy support by int 10h for character device driver 27265>4 uleshort&0x8000 0x8000 27266>>4 uleshort&0x2000 0x2000 \b,until busy- 27267# direct read/write support by driver functions 03h,0Ch 27268>4 uleshort&0x4000 0x4000 \b,control strings- 27269>4 uleshort&0x8000 0x8000 27270>>4 uleshort&0x6840 >0 \bsupport 27271>4 uleshort&0x8000 0x0000 27272>>4 uleshort&0x4842 >0 \bsupport 27273>0 ubyte x \b) 27274>0 ulelong !0xffffffff with pointer %#x 27275# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 272760 ulequad 0x0513c00000000012 27277>0 use msdos-driver 27278# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 272790 ulequad 0x32f28000ffff0016 27280>0 use msdos-driver 272810 ulequad 0x007f00000000ffff 27282>0 use msdos-driver 27283# https://www.uwe-sieber.de/files/cfg_echo.zip 272840 ulequad 0x001600000000ffff 27285>0 use msdos-driver 27286# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 272870 ulequad 0x0bf708c2ffffffff 27288>0 use msdos-driver 272890 ulequad 0x07bd08c2ffffffff 27290>0 use msdos-driver 27291# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS 272920 ulequad 0x027ac0c0ffffffff 27293>0 use msdos-driver 27294# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS 272950 ulequad 0x00228880ffffffff 27296>0 use msdos-driver 27297 27298# updated by Joerg Jenderek 27299# GRR: line below too general as it catches also 27300# rt.lib DYADISKS.PIC and many more 27301# start with assembler instruction MOV 273020 ubyte 0x8c 27303# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 27304>4 string !O==== 27305# skip some unknown basic binaries like RocketRnger.SHR 27306>>5 string !MAIN 27307# skip "GPG symmetrically encrypted data" ./gnu 27308# skip "PGP symmetric key encrypted data" ./pgp 27309# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 27310>>>4 ubyte >13 27311>>>>0 use msdos-com 27312# the remaining files should be DOS *.COM executables 27313# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 27314# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 27315# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 27316# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 27317# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 27318# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 27319# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 27320# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 27321 273220 name msdos-com 27323# URL: http://fileformats.archiveteam.org/wiki/DOS_executable_(.com) 27324>0 byte x DOS executable ( 27325# DOS execuable with JuMP 16-bit instruction 27326>0 byte =0xE9 27327# check for probably nil padding til offset 64 of Lotus driver name 27328>>56 quad =0 27329# check for "long" alpabetical Lotus driver name like: 27330# Diablo "COMPAQ Text Display" "IBM Monochrome Display" "Plantronics ColorPlus" 27331>>>24 regex =^[A-Z][A-Za-z\040]{5,21} \bLotus driver) %s 27332!:mime application/x-dosexec 27333# like: CPQ0TD.DRV IBM0MONO.DRV (Lotus 123 10a) SDIAB4.DRV SPL0CPLS.DRV (Lotus Symphony 2) 27334!:ext drv 27335# COM with nils like MODE.COM IBMDOS.COM (pcdos 3.31 ru Compaq) RSSTUB.COM (PC-DOS 2000 de) ACCESS.COM (Lotus Symphony 1) 27336>>>24 default x \bCOM) 27337!:mime application/x-dosexec 27338!:ext com 27339# DOS excutable with JuMP 16-bit and without nil padding 27340>>56 quad !0 27341# https://wiki.syslinux.org/wiki/index.php?title=Doc/comboot 27342# TODO: HOWTO distinguish COMboot from pure DOS executables? 27343# look for unreliable Syslinux specific api call INTerrupt 22h for 16-bit COMBOOT program 27344>>>1 search/0xc088 \xcd\x22 \bCOM or COMBOOT 16-bit) 27345!:mime application/x-dosexec 27346# like: sbm.cbt command.com (Windows XP) UNI2ASCI.COM (FreeDOS 1.2) 27347!:ext com/cbt 27348>>>1 default x \bCOM) 27349!:mime application/x-dosexec 27350!:ext com 27351# DOS executable without JuMP 16-bit instruction 27352>0 byte !0xE9 27353# SCREATE.SYS https://en.wikipedia.org/wiki/Stac_Electronics 27354>>10 string =?STACVOL \bSCREATE.SYS) 27355!:mime application/x-dosexec 27356!:ext sys 27357# COM executable without JuMP 16-bit instruction and not SCREATE.SYS 27358>>10 string !?STACVOL \bCOM) 27359!:mime application/x-dosexec 27360!:ext com 27361>6 string SFX\ of\ LHarc \b, %s 27362>0x1FE leshort 0xAA55 \b, boot code 27363>85 string UPX \b, UPX compressed 27364>4 string \ $ARX \b, ARX self-extracting archive 27365>4 string \ $LHarc \b, LHarc self-extracting archive 27366>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 27367# like: E30ODI.COM MADGEODI.COM UNI2ASCI.COM RECOVER.COM (DOS 2) COMMAND.COM (DOS 2) 27368>1 search/0xc088 \xcd\x22 \b, maybe with interrupt 22h 27369>0 ubelong x \b, start instruction %#8.8x 27370# show more instructions but not in samples like: rem.com (DJGPP) 27371>4 ubelong x %8.8x 27372 27373# JMP 8bit 273740 byte 0xeb 27375# byte 0xeb conflicts with magic leshort 0xn2eb of "SYMMETRY i386" handled by ./sequent 27376# allow forward jumps only 27377>1 byte >-1 27378# that offset must be accessible 27379# with hexadecimal values like: 0e 2e 50 8c 8d ba bc bd be e8 fb fc 27380>>(1.b+2) byte x 27381# if look like COM executable with x86 boot signature then this 27382# implies FAT volume with x86 real mode code already handled by ./filesystems 27383# 27384# No x86 boot signature implies often DOS executable 27385# check for unrealistic high number of FATs. Then it is an unusual disk image or often a DOS executable 27386# like: FIXBIOS.COM (50 bytes) 27387>>>16 ubyte >3 27388# https://www.drivedroid.io/ 27389# skip MBR disk image drivedroid.img version 12 July 2013 by start message 27390>>>>2 string !DriveDroid 27391# ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/ 27392# skip unusual floppy image disk1.img of MS-DOS 1.25 (Corona Data Systems OEM) 27393# by check for characteristic message text near the beginning 27394>>>>>15 string !Non\040System\040disk 27395# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 4.0.rar" 27396# skip BeOS 4 bootfloppy.img done as "Linux kernel x86 boot executable" by ./linux 27397# by check for characteristic message text near the beginning 27398>>>>>>6 string !read\040error\015 27399# https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip 27400# skip ventoy 1.0.78 boot_hybrid.img 27401>>>>>>>24 string !\220\220\353I$\022\017 27402# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/PC-DOS 1.0 (5.25).rar" 27403# skip unusual floppy image PCDOS100.IMG of DOS 1.0 27404# by check for characteristic message text near the beginning 27405>>>>>>>>9 string !7-May-81 27406# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 5.0 Personal (BA).rar" 27407# skip BeOS 5 floppy_1.44.00.ima done as "DOS/MBR boot sector" by ./filesystems 27408# by check for characteristic message near the beginning 27409>>>>>>>>>3 string !\370sdfS\270 27410# like: FIXBIOS.COM (50 bytes) 27411>>>>>>>>>>0 use msdos-com 27412# check for unrealistic low number of FATs. Then it is an unusual FAT disk image or often a DOS executable 27413# like: DEVICE.COM INSTALL.COM (GAG 4.10) WORD.COM (Word 1.15) 27414>>>16 ubyte =0 27415# if low FATs with x86 boot signature it can be unusual disk image like: boot.img (Ventoy 1.0.27) geodspms.img (Syslinux) 27416>>>>0x1FE leshort =0xAA55 27417>>>>0x1FE default x 27418# https://thestarman.pcministry.com/tool/hxd/dimtut.htm 27419# skip unusual floppy image TK-DOS11.img IBMDOS11.img of IBM DOS 1.10 27420# by check for characteristic bootloader names near end of boot sector 27421>>>>>395 string !ibmbio\040\040com 27422>>>>>>0 use msdos-com 27423# 8-bit jump with valid number of FAT implies FAT volume already handled by ./filesystems 27424# like: balder.img 27425>>>16 default x 27426# skip disk images with boot signature at end of 1st sector 27427# like: TDSK-64b.img 27428>>>>(11.s-2) uleshort !0xAA55 27429# skip unusual floppy image without boot signature like 360k-256.img (mtools 4.0.18) 27430# by check for characteristic file system type text for FAT (12 bit or 16 bit) 27431>>>>>54 string !FAT 27432# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/Microsoft MS-DOS 3.31 (Compaq OEM) (3.5).rar" 27433# skip unusual floppy image Disk4.img without boot signature and file system type text 27434# by check for characteristic OEM-ID text 27435>>>>>>3 string !COMPAQ\040\040 27436# no such DOS COM executables found 27437>>>>>>>0 use msdos-com 27438# JMP 16bit 274390 byte 0xe9 27440# 16-bit offset; for DEBUGGING!; can be negative like: USBDRIVE.COM 27441#>1 leshort x \b, OFFSET %d 27442# forward jumps 27443>1 leshort >-1 27444# that offset must be accessible 27445# with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc 27446>>(1.s+3) byte x 27447# check for unrealistic high number of FATs. Then it is not a disk image and it is a DOS executable 27448# like: CALLVER.COM CPUCACHE.COM K437_EUR.COM SHSUCDX.COM UMBFILL.COM (183 bytes) 27449>>>16 ubyte >3 27450>>>>0 use msdos-com 27451# check for unrealistic low number of FATs. Then it is not a disk image and it is a DOS executable 27452# like: GAG.COM DRMOUSE.COM NDN.COM CPQ0TD.DRV 27453>>>16 ubyte =0 27454>>>>0 use msdos-com 27455# maybe disc image with valid number of FATs or DOS executable 27456# like: IPXODI.COM PERUSE.COM TASKID.COM 27457>>>16 default x 27458# invalid low media descriptor. Then it is not a disk image and it is a DOS executable 27459>>>>21 ubyte <0xE5 27460>>>>>0 use msdos-com 27461# valid media descriptor. Then it is maybe disk image or DOS executable 27462>>>>21 ubyte >0xE4 27463# invalid sectorsize not a power of 2 from 32-32768. Then it is not a disk image and it must be DOS executable 27464# like: LEARN.COM (Word 1.15) 27465>>>>>11 uleshort&0x001f !0 27466>>>>>>0 use msdos-com 27467# negative offset, must not lead into PSP 27468# like: BASICA.COM (PC dos 3.20) FORMAT.COM SMC8100.COM WORD.COM (word4) 27469# HIDSUPT1.COM USBDRIVE.COM USBSUPT1.COM USBUHCI.COM (FreeDOS USBDOS) 27470>1 leshort <-259 27471# that offset must be accessible 27472# add 10000h to jump at end of 64 KiB segment, add 1 for jump instruction and 2 for 16-bit offset 27473>>(1,s+65539) byte x 27474# after jump next instruction for DEBUGGING! 27475#>>>&-1 ubelong x \b, NEXT instruction %#8.8x 27476>>>0 use msdos-com 27477 27478# updated by Joerg Jenderek at Oct 2008,2015,2022 27479# following line is too general 274800 ubyte 0xb8 27481# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 27482>0 string !\xb8\xc0\x07\x8e 27483# modified by Joerg Jenderek 27484# syslinux COM32 or COM32R executable 27485>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 27486# https://www.syslinux.org/wiki/index.php/Comboot_API 27487# Since version 5.00 c32 modules switched from the COM32 object format to ELF 27488!:mime application/x-c32-comboot-syslinux-exec 27489!:ext c32 27490# https://syslinux.zytor.com/comboot.php 27491# older syslinux version ( <4 ) 27492# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 27493# start with assembler instructions mov eax,21cd4cffh 27494>>>1 lelong 0x21CD4CFf \b) 27495# syslinux:doc/comboot.txt 27496# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 27497# eax,21cd4cfeh) as a magic number. 27498# syslinux version (4.x) 27499# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 27500>>>1 lelong 0x21CD4CFe \b, relocatable) 27501>>1 default x 27502# look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x) 27503>>>3 search/118 \xCD 27504# FOR DEBUGGING; possible hexadecimal interupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux) 27505# 1A~BERNDPCI.COM 20~SETENHKB.COM 21~mostly 22~gfxboot.com (Syslinux) 2F~SHUTDOWN.COM (GEMSYS) 27506#>>>>&0 ubyte x \b, INTERUPT %#x 27507# few examples with interrupt 0x13 instruction 27508>>>>&0 ubyte =0x13 27509# FOR DEBUGGING! 27510#>>>>>3 ubequad x \b, 2nd INSTRUCTION %#16.16llx 27511# skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems 27512# by check for assembler instructions: mov es,ax ; mov ax,07c0h ; mov ds,ax 27513>>>>>3 ubequad !0x8ec0b8c0078ed88d 27514# few COM exectables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com 27515# http://bootcd.narod.ru/bcdw150z_en.zip 27516>>>>>>0 use msdos-com 27517# few examples with interrupt 0x16 instruction like flashimg.img 27518>>>>&0 ubyte =0x16 27519# skip Syslinux 3.71 flashimg.img done as "DOS/MBR boot sector" by ./filesystems 27520# by check for assembler instructions: cmp ax 0xE4E4 (magic); jnz 27521>>>>>8 ubelong !0x3DE4E475 27522# no DOS executable with interrupt 0x16 found 27523>>>>>>0 use msdos-com 27524# most examples with interrupt instruction unequal 0x13 and 0x16 27525>>>>&0 default x 27526#>>>>>&-1 ubyte x \b, INTERUPT %#x 27527# like: LOADER.COM SETENHKB.COM banner.com copybs.com gif2raw.com poweroff.com rem.com 27528>>>>>0 use msdos-com 27529# few COM executables without interupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM 27530# or some EUC-KR text files or one Ulead Imaginfo thumbnail 27531>>>3 default x 27532# FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM) 27533# or random like: 0x0 (IMAGINFO.PE3 sky_snow) 0xb1 (euckr_.txt) 27534#>>>>3 ubyte x \b, 2nd INSTRUCTION %#x 27535# skip 1 Ulead Imaginfo thumbnail (IMAGINFO.PE3 sky_snow) 27536# inside SAMPLES/TEXTURES/SKY_SNOW 27537# from https://archive.org/download/PI3CANON/PI3CANON.iso 27538>>>>3 ubyte !0x0 27539# skip some EUC-KR text files like: euckr_falsepositive.txt 27540# https://bugs.astron.com/view.php?id=186 27541>>>>>3 ubyte !0xb1 27542# like: RESTART.COM (DOS 7.10) REBOOT.COM 27543>>>>>>0 use msdos-com 27544 27545# URL: https://en.wikipedia.org/wiki/UPX 27546# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/ 27547# src/stub/src/i086-dos16.com.S 27548# Update: Joerg Jenderek 27549# assembler instructions: cmp sp, offset sp_limit 275500 string/b \x81\xfc 27551#>2 uleshort x \b, sp_limit=%#x 27552# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy 27553>4 string \x77\x02\xcd\x20\xb9 27554#>9 uleshort x \b, [bytes_to_copy]=%#x 27555# at different offsets assembler instructions: push di; jump decomp_start_n2b 27556>0x1e search/3 \x57\xe9 27557#>>&0 uleshort x \b, decomp_start_n2b=%#x 27558# src/stub/src/include/header.S; UPX_MAGIC_LE32 27559>>&2 string UPX! FREE-DOS executable (COM), UPX 27560!:mime application/x-dosexec 27561# UPX compressed *.CPI; See ./fonts 27562>>>&21 string =FONT compressed DOS code page font 27563!:ext cpx 27564>>>&21 string !FONT compressed 27565!:ext com 27566# compressed size? 27567#>>>&14 uleshort+152 x \b, %u bytes 27568# uncompressed len 27569>>>&12 uleshort x \b, uncompressed %u bytes 27570252 string Must\ have\ DOS\ version DR-DOS executable (COM) 27571!:mime application/x-dosexec 27572!:ext com 27573# GRR search is not working 27574#2 search/28 \xcd\x21 COM executable for MS-DOS 27575#WHICHFAT.cOM 275762 string \xcd\x21 COM executable for DOS 27577!:mime application/x-dosexec 27578!:ext com 27579#DELTREE.cOM DELTREE2.cOM 275804 string \xcd\x21 COM executable for DOS 27581!:mime application/x-dosexec 27582!:ext com 27583#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 275845 string \xcd\x21 COM executable for DOS 27585!:mime application/x-dosexec 27586!:ext com 27587#DELTMP.COm HASFAT32.cOM 275887 string \xcd\x21 27589>0 byte !0xb8 COM executable for DOS 27590!:mime application/x-dosexec 27591!:ext com 27592#COMP.cOM MORE.COm 2759310 string \xcd\x21 27594>5 string !\xcd\x21 COM executable for DOS 27595!:mime application/x-dosexec 27596!:ext com 27597#comecho.com 2759813 string \xcd\x21 COM executable for DOS 27599!:mime application/x-dosexec 27600!:ext com 27601#HELP.COm EDIT.coM 2760218 string \xcd\x21 27603# not printable before it? 27604>17 byte >32 27605>>17 byte <126 27606>>17 default x COM executable for MS-DOS 27607!:mime application/x-dosexec 27608!:ext com 27609#NWRPLTRM.COm 2761023 string \xcd\x21 COM executable for MS-DOS 27611!:mime application/x-dosexec 27612!:ext com 27613#LOADFIX.cOm LOADFIX.cOm 2761430 string \xcd\x21 COM executable for MS-DOS 27615!:mime application/x-dosexec 27616!:ext com 27617#syslinux.com 3.11 2761870 string \xcd\x21 COM executable for DOS 27619!:mime application/x-dosexec 27620!:ext com 27621# many compressed/converted COMs start with a copy loop instead of a jump 276220x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 27623!:mime application/x-dosexec 27624!:ext com 276250x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 27626!:mime application/x-dosexec 27627!:ext com 27628>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 276290x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 27630!:mime application/x-dosexec 27631!:ext com 27632# FIXME: missing diet .com compression 27633 27634# miscellaneous formats 276350 string/b LZ MS-DOS executable (built-in) 27636#0 byte 0xf0 MS-DOS program library data 27637# 27638 27639# AAF files: 27640# <stuartc@rd.bbc.co.uk> Stuart Cunningham 276410 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 27642>30 byte 9 (512B sectors) 27643>30 byte 12 (4kB sectors) 276440 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 27645>30 byte 9 (512B sectors) 27646>30 byte 12 (4kB sectors) 27647 27648# Popular applications 27649# 27650# Update: Joerg Jenderek 27651# URL: http://fileformats.archiveteam.org/wiki/DOC 27652# Reference: https://web.archive.org/web/20170206041048/ 27653# http://www.msxnet.org/word2rtf/formats/ffh-dosword5 27654# wIdent+dty 276550 belong 0x31be0000 27656# skip droid skeleton like x-fmt-274-signature-id-488.doc 27657>128 ubyte >0 Microsoft 27658>>96 uleshort =0 Word 27659!:mime application/msword 27660!:apple MSWDWDBN 27661# DCX is used in the Unix version. 27662!:ext doc/dcx 27663>>>0x6E ulequad =0 1.0-4.0 27664>>>0x6E ulequad !0 5.0-6.0 27665>>>0x6E ulequad x (DOS) Document 27666# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt 27667>>96 uleshort !0 Write 3.0 (Windows) Document 27668!:mime application/x-mswrite 27669!:apple MSWDWDBN 27670# sometimes also doc like in splitter.doc srchtest.doc 27671!:ext wri/doc 27672# wTool must be 0125400 octal 27673#>>4 uleshort !0xAB00 \b, wTool %o 27674# reserved; must be zero 27675#>>6 ulelong !0 \b, reserved %u 27676# block pointer to the block containing optional file manager information 27677#>>0x1C uleshort x \b, at %#x info block 27678# jump to File manager information block 27679>>(0x1C.s*128) uleshort x 27680# test for valid information start; maybe also 0012h 27681>>>&-2 uleshort =0x0014 27682# Document ASCIIZ name 27683>>>>&0x12 string x %s 27684# author name 27685>>>>>&1 string x \b, author %s 27686# reviser name 27687>>>>>>&1 string x \b, reviser %s 27688# keywords 27689>>>>>>>&1 string x \b, keywords %s 27690# comment 27691>>>>>>>>&1 string x \b, comment %s 27692# version number 27693>>>>>>>>>&1 string x \b, version %s 27694# date of last change MM/DD/YY 27695>>>>>>>>>>&1 string x \b, %-.8s 27696# creation date MM/DD/YY 27697>>>>>>>>>>&9 string x created %-.8s 27698# file name of print format like NORMAL.STY 27699>>0x1E string >0 \b, formatted by %-.66s 27700# count of pages in whole file for write variant; maybe some times wrong 27701>>96 uleshort >0 \b, %u pages 27702# name of the printer driver like HPLASMS 27703>>0x62 string >0 \b, %-.8s printer 27704# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0 27705>>0x6A uleshort >0 \b, %u blocks 27706# bit field for corrected text areas 27707#>>0x6C uleshort x \b, %#x bit field 27708# text of document; some times start with 4 non printable characters like CR LF 27709>>128 ubyte x \b, 27710>>>128 ubyte >0x1F 27711>>>>128 string x %s 27712>>>128 ubyte <0x20 27713>>>>129 ubyte >0x1F 27714>>>>>129 string x %s 27715>>>>129 ubyte <0x20 27716>>>>>130 ubyte >0x1F 27717>>>>>>130 string x %s 27718>>>>>130 ubyte <0x20 27719>>>>>>131 ubyte >0x1F 27720>>>>>>>131 string x %s 27721>>>>>>131 ubyte <0x20 27722>>>>>>>132 ubyte >0x1F 27723>>>>>>>>132 string x %s 27724>>>>>>>132 ubyte <0x20 27725>>>>>>>>133 ubyte >0x1F 27726>>>>>>>>>133 string x %s 27727# 277280 string/b PO^Q` Microsoft Word 6.0 Document 27729!:mime application/msword 27730# 277314 long 0 27732>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 27733!:mime application/msword 27734!:ext mcw 27735>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 27736!:mime application/msword 27737!:ext mcw 27738>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 27739!:mime application/msword 27740!:ext mcw 27741>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 27742!:mime application/msword 27743!:ext mcw 27744 277450 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 27746!:mime application/msword 27747!:ext doc 27748# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 27749#512 string/b \354\245\301 Microsoft Word Document 27750#!:mime application/msword 27751 27752# 277530 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 27754!:mime application/msword 27755# 277560 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 27757!:mime application/msword 27758 27759# 277600 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 27761!:mime application/vnd.ms-excel 27762# https://www.macdisk.com/macsigen.php 27763!:apple XCELXLS4 27764!:ext xls 27765# 27766# Update: Joerg Jenderek 27767# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 27768# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 27769# Note: newer Lotus versions >2 use longer BOF record 27770# record type (BeginningOfFile=0000h) + length (001Ah) 277710 belong 0x00001a00 27772# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 27773#>18 uleshort&0x73E0 0 27774# Lotus Multi Byte Character Set (LMBCS=1-31) 27775>20 ubyte >0 27776>>20 ubyte <32 Lotus 1-2-3 27777#!:mime application/x-123 27778!:mime application/vnd.lotus-1-2-3 27779!:apple ????L123 27780# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 27781>>>4 uleshort 0x1000 WorKsheet, version 3 27782!:ext wk3 27783# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 27784>>>4 uleshort 0x1002 WorKsheet, version 4 27785# also worksheet template 4 (.wt4) 27786!:ext wk4/wt4 27787# no example or documentation for wk5 27788#>>4 uleshort 0x???? WorKsheet, version 4 27789#!:ext wk5 27790# only MacrotoScript.123 example 27791>>>4 uleshort 0x1003 WorKsheet, version 97 27792# also worksheet template Smartmaster (.12M)? 27793!:ext 123 27794# only Set_Y2K.123 example 27795>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 27796!:ext 123 27797# no example for this version 27798>>>4 uleshort 0x8001 FoRMatting data 27799!:ext frm 27800# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 27801# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 27802>>>4 uleshort 0x8007 ForMatting data, version 3 27803!:ext fm3 27804>>>4 default x unknown 27805# file revision sub code 0004h for worksheets 27806>>>>6 uleshort =0x0004 worksheet 27807!:ext wXX 27808>>>>6 uleshort !0x0004 formatting data 27809!:ext fXX 27810# main revision number 27811>>>>4 uleshort x \b, revision %#x 27812>>>6 uleshort =0x0004 \b, cell range 27813# active cellcoord range (start row, page,column ; end row, page, column) 27814# start values normally 0~1st sheet A1 27815>>>>8 ulelong !0 27816>>>>>10 ubyte >0 \b%d* 27817>>>>>8 uleshort x \b%d, 27818>>>>>11 ubyte x \b%d- 27819# end page mostly 0 27820>>>>14 ubyte >0 \b%d* 27821# end raw, column normally not 0 27822>>>>12 uleshort x \b%d, 27823>>>>15 ubyte x \b%d 27824# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 27825>>>>20 ubyte >1 \b, character set %#x 27826# flags 27827>>>>21 ubyte x \b, flags %#x 27828>>>6 uleshort !0x0004 27829# record type (FONTNAME=00AEh) 27830>>>>30 search/29 \0\xAE 27831# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 27832>>>>>&4 string >\0 \b, 1st font "%s" 27833# 27834# Update: Joerg Jenderek 27835# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 27836# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 27837# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 27838# record type (BeginningOfFile=0000h) + length (0002h) 278390 belong 0x00000200 27840# GRR: line above is too general as it catches also MS Windows CURsor 27841# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 27842!:strength -1 27843# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 27844>7 ubyte 0 27845# skip Windows cursors with image width 256 and keep Lotus with positive opcode 27846>>6 ubyte >0 Lotus 27847# !:mime application/x-123 27848!:mime application/vnd.lotus-1-2-3 27849!:apple ????L123 27850# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 27851# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 27852>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 27853!:ext cnf 27854>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 27855!:ext cnf 27856>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 27857!:ext cnf 27858>>>4 uleshort 0x0802 Symphony CoNFiguration 27859!:ext cnf 27860>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 27861!:ext cnf 27862>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 27863!:ext cnf 27864>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 27865!:ext cnf 27866>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 27867!:ext cnf 27868# (version 5.26) labeled the entry as "Lotus 123" 27869# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 27870>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 27871# extension "wks" also for Microsoft Works document 27872!:ext wks 27873# (version 5.26) labeled the entry as "Lotus 123" 27874# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 27875>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 27876!:ext wrk/wr1 27877# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 27878# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 27879>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 27880# Symphony (.wr1) 27881!:ext wk1/wr1 27882# no example for this japan version 27883>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 27884!:ext wj1 27885# no example or documentation for wk2 27886#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 27887#!:ext wk2 27888# undocumented japan version 27889>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 27890!:ext wj3 27891# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 27892>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 27893# japan version 2.4J (fj3) 27894!:ext fmt/fj3 27895# no example for this version 27896>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 27897!:ext frm 27898# (version 5.26) labeled the entry as "Lotus 1-2-3" 27899>>>4 default x unknown worksheet or configuration 27900!:ext cnf 27901>>>>4 uleshort x \b, revision %#x 27902# 2nd record for most worksheets describes cells range 27903>>>6 use lotus-cells 27904# 3rd record for most japan worksheets describes cells range 27905>>>(8.s+10) use lotus-cells 27906# check and then display Lotus worksheet cells range 279070 name lotus-cells 27908# look for type (RANGE=0006h) + length (0008h) at record begin 27909>0 ubelong 0x06000800 \b, cell range 27910# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 27911>>4 ulong !0 27912>>>4 uleshort x \b%d, 27913>>>6 uleshort x \b%d- 27914# end of cell range 27915>>8 uleshort x \b%d, 27916>>10 uleshort x \b%d 27917# EndOfLotus123 279180 string/b WordPro\0 Lotus WordPro 27919!:mime application/vnd.lotus-wordpro 279200 string/b WordPro\r\373 Lotus WordPro 27921!:mime application/vnd.lotus-wordpro 27922 27923 27924# Summary: Script used by InstallScield to uninstall applications 27925# Extension: .isu 27926# Submitted by: unknown 27927# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 279280 string \x71\xa8\x00\x00\x01\x02 27929>12 string Stirling\ Technologies, InstallShield Uninstall Script 27930 27931# Winamp .avs 27932#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 279330 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 27934 27935# Windows Metafile .WMF 279360 string/b \327\315\306\232 Windows metafile 27937!:mime image/wmf 27938!:ext wmf 279390 string/b \002\000\011\000 Windows metafile 27940!:mime image/wmf 27941!:ext wmf 279420 string/b \001\000\011\000 Windows metafile 27943!:mime image/wmf 27944!:ext wmf 27945 27946#tz3 files whatever that is (MS Works files) 279470 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 279480 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 279490 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 27950 27951# PGP sig files .sig 27952#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 279530 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 279540 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 279550 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 279560 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 279570 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 279580 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 27959 27960# windows zips files .dmf 279610 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 27962 27963# Windows icons 27964# Update: Joerg Jenderek 27965# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 27966# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 279670 belong 0x00000100 27968>9 byte 0 27969>>0 byte x 27970>>0 use cur-ico-dir 27971>9 ubyte 0xff 27972>>0 byte x 27973>>0 use cur-ico-dir 27974# displays number of icons and information for icon or cursor 279750 name cur-ico-dir 27976# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 27977# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 27978>18 ulelong &0x00000006 27979# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 27980>>(18.l) ulelong x MS Windows 27981>>>0 ubelong 0x00000100 icon resource 27982# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 27983!:mime image/vnd.microsoft.icon 27984#!:mime image/x-icon 27985!:ext ico 27986>>>>4 uleshort x - %d icon 27987# plural s 27988>>>>4 uleshort >1 \bs 27989# 1st icon 27990>>>>0x06 use ico-entry 27991# 2nd icon 27992>>>>4 uleshort >1 27993>>>>>0x16 use ico-entry 27994>>>0 ubelong 0x00000200 cursor resource 27995#!:mime image/x-cur 27996!:mime image/x-win-bitmap 27997!:ext cur 27998>>>>4 uleshort x - %d icon 27999>>>>4 uleshort >1 \bs 28000# 1st cursor 28001>>>>0x06 use cur-entry 28002#>>>>0x16 use cur-entry 28003# display information of one cursor entry 280040 name cur-entry 28005>0 use cur-ico-entry 28006>4 uleshort x \b, hotspot @%dx 28007>6 uleshort x \b%d 28008# display information of one icon entry 280090 name ico-entry 28010>0 use cur-ico-entry 28011# normally 0 1 but also found 14 28012>4 uleshort >1 \b, %d planes 28013# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 28014>6 uleshort >1 \b, %d bits/pixel 28015# display shared information of cursor or icon entry 280160 name cur-ico-entry 28017>0 byte =0 \b, 256x 28018>0 byte !0 \b, %dx 28019>1 byte =0 \b256 28020>1 byte !0 \b%d 28021# number of colors in palette 28022>2 ubyte !0 \b, %d colors 28023# reserved 0 FFh 28024#>3 ubyte x \b, reserved %x 28025#>8 ulelong x \b, image size %d 28026# offset of PNG or DIB image 28027#>12 ulelong x \b, offset %#x 28028# PNG header (\x89PNG) 28029>(12.l) ubelong =0x89504e47 28030# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 28031>>&-4 indirect x \b with 28032# DIB image 28033>(12.l) ubelong !0x89504e47 28034#>>&-4 use dib-image 28035 28036# Windows non-animated cursors 28037# Update: Joerg Jenderek 28038# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 28039# Note: similar to Windows ICOn. container for BMP ( only DIB part) 28040# GRR: line below is too general as it catches also Lotus 1-2-3 files 280410 belong 0x00000200 28042>9 byte 0 28043>>0 use cur-ico-dir 28044>9 ubyte 0xff 28045>>0 use cur-ico-dir 28046 28047# .chr files 280480 string/b PK\010\010BGI Borland font 28049>4 string >\0 %s 28050# then there is a copyright notice 28051 28052 28053# .bgi files 280540 string/b pk\010\010BGI Borland device 28055>4 string >\0 %s 28056# then there is a copyright notice 28057 28058 28059# Windows Recycle Bin record file (named INFO2) 28060# By Abel Cheung (abelcheung AT gmail dot com) 28061# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 28062# Since Vista uses another structure, INFO2 structure probably won't change 28063# anymore. Detailed analysis in: 28064# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 280650 lelong 0x00000004 28066>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 28067 280680 lelong 0x00000005 28069>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 28070 28071# From Doug Lee via a FreeBSD pr 280729 string GERBILDOC First Choice document 280739 string GERBILDB First Choice database 280749 string GERBILCLIP First Choice database 280750 string GERBIL First Choice device file 280769 string RABBITGRAPH RabbitGraph file 280770 string DCU1 Borland Delphi .DCU file 280780 string =!<spell> MKS Spell hash list (old format) 280790 string =!<spell2> MKS Spell hash list 28080# Too simple - MPi 28081#0 string AH Halo(TM) bitmapped font file 280820 lelong 0x08086b70 TurboC BGI file 280830 lelong 0x08084b50 TurboC Font file 28084 28085# Debian#712046: The magic below identifies "Delphi compiled form data". 28086# An additional source of information is available at: 28087# http://www.woodmann.com/fravia/dafix_t1.htm 280880 string TPF0 28089>4 pstring >\0 Delphi compiled form '%s' 28090 28091# tests for DBase files moved, updated and merged to database 28092 280930 string PMCC Windows 3.x .GRP file 280941 string RDC-meg MegaDots 28095>8 byte >0x2F version %c 28096>9 byte >0x2F \b.%c file 280970 lelong 0x4C 28098>4 lelong 0x00021401 Windows shortcut file 28099 28100# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 28101# only for windows versions equal or greater 3.0 281020x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 28103!:mime application/x-dosexec 28104!:ext pif 28105#>2 string >\0 \b, Title:%.30s 28106>0x24 string >\0 \b for %.63s 28107>0x65 string >\0 \b, directory=%.64s 28108>0xA5 string >\0 \b, parameters=%.64s 28109#>0x181 leshort x \b, offset %x 28110#>0x183 leshort x \b, offsetdata %x 28111#>0x185 leshort x \b, section length %x 28112>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 28113>>&0x5e ubyte >0 28114>>>&-1 string <PIFMGR.DLL \b, icon=%s 28115#>>>&-1 string PIFMGR.DLL \b, icon=%s 28116>>>&-1 string >PIFMGR.DLL \b, icon=%s 28117>>&0xF0 ubyte >0 28118>>>&-1 string <Terminal \b, font=%.32s 28119#>>>&-1 string =Terminal \b, font=%.32s 28120>>>&-1 string >Terminal \b, font=%.32s 28121>>&0x110 ubyte >0 28122>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 28123#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 28124>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 28125#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 28126#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 28127>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 28128#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 28129>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 28130#>>&06 string x \b:%s 28131>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 28132#>>&06 string x \b:%s 28133 28134# DOS EPS Binary File Header 28135# From: Ed Sznyter <ews@Black.Market.NET> 281360 belong 0xC5D0D3C6 DOS EPS Binary File 28137!:mime image/x-eps 28138>4 long >0 Postscript starts at byte %d 28139>>8 long >0 length %d 28140>>>12 long >0 Metafile starts at byte %d 28141>>>>16 long >0 length %d 28142>>>20 long >0 TIFF starts at byte %d 28143>>>>24 long >0 length %d 28144 28145# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 28146# of http://www.davep.org/norton-guides/ng2h-105.tgz 28147# https://en.wikipedia.org/wiki/Norton_Guides 281480 string NG\0\001 28149# only value 0x100 found at offset 2 28150>2 ulelong 0x00000100 Norton Guide 28151!:mime application/x-norton-guide 28152# often like NORTON.NG but some times like NC.HLP 28153!:ext ng/hlp 28154# Title[40] 28155>>8 string >\0 "%-.40s" 28156#>>6 uleshort x \b, MenuCount=%u 28157# szCredits[5][66] 28158>>48 string >\0 \b, %-.66s 28159>>114 string >\0 %-.66s 28160 28161# URL: https://en.wikipedia.org/wiki/Norton_Commander 28162# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml 28163# From: Joerg Jenderek 28164# Note: Message file is used by executable with same main name. 28165# Only tested with version 5.50 (english) and 2.01 (Windows) 281660 string Abort 28167# \0 or i 28168#>5 ubyte x %x 28169# skip ASCII Abort text by looking for error message like in NCVIEW.MSG 28170>6 search/7089 Non-DOS\ disk Norton Commander module message 28171!:mime application/x-norton-msg 28172!:ext msg 28173 28174# URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm 28175# Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml 28176# From: Joerg Jenderek 281770 string DOS\ Client\ Message\ File: Novell DOS client message 28178#!:mime application/octet-stream 28179#!:mime application/x-novell-msg 28180!:ext msg 28181# look for second letter instead space character 28182>26 ubyte >0x20 28183# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr 28184>>25 ubyte !0x20 %c 28185>>>26 ubyte !0x20 \b%c 28186>>>>27 ubyte !0x20 \b%c 28187>>>>>28 ubyte !0x20 \b%c 28188>>>>>>29 ubyte !0x20 \b%c 28189>>>>>>>30 ubyte !0x20 \b%c 28190>>>>>>>>31 ubyte !0x20 \b%c 28191>>>>>>>>>32 ubyte !0x20 \b%c 28192>>>>>>>>>>33 ubyte !0x20 \b%c 28193>>>>>>>>>>>34 ubyte !0x20 \b%c 28194>>>>>>>>>>>>35 ubyte !0x20 \b%c 28195>>>>>>>>>>>>>36 ubyte !0x20 \b%c 28196# followed by string like: 0 v.10 V1.20 28197# 28198# followed by ,\040Tran 28199>28 search/14 ,\040Tran 28200# probably translated version string like: 0 v1.00 28201>>&0 string x \b, tran version %s 28202# followed by Ctrl-J Ctrl-Z 28203>>>&0 ubyte !0xa \b, terminated by %#2.2x 28204>>>>&0 ubyte x \b%2.2x 28205# Ctrl-Z 28206>0x65 ubyte !0x1A \b, at 0x65 %#x 28207# one 28208>0x66 ubyte !0x01 \b, at 0x66 %#x 28209# URL: https://en.wikipedia.org/wiki/NetWare 28210# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml 28211# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html 28212# From: Joerg Jenderek 282130 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data 28214#>35 string Version\ 1.00 28215#>49 string COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc. 28216#>83 string \ \ All\ Rights\ Reserved 28217#!:mime application/octet-stream 28218#!:mime application/x-novell-msg 28219!:ext msg 28220#!:ext msg/dat 28221# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 28222# of https://www.4dos.info/ 28223# pointer,HelpID[8]=4DHnnnmm 282240 ulelong 0x48443408 4DOS help file 28225>4 string x \b, version %-4.4s 28226 28227# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 282280 ulequad 0x3a000000024e4c MS Advisor help file 28229 28230# HtmlHelp files (.chm) 282310 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 28232!:mime application/vnd.ms-htmlhelp 28233!:ext chm 28234 28235# GFA-BASIC (Wolfram Kleff) 282362 string/b GFA-BASIC3 GFA-BASIC 3 data 28237 28238#------------------------------------------------------------------------------ 28239# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 28240# Update: Joerg Jenderek 28241# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 28242# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 28243# Note: verified by `7z l *.cab` 28244# Microsoft Cabinet files 282450 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 28246# 28247# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 28248# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 28249# because some archive does not have *.diag* as 1st or 2nd archive member like 28250# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 28251# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 28252>0x2c search/980/c .diag \b, Diagnostic 28253!:mime application/vnd.ms-cab-compressed 28254!:ext diagcab 28255# http://fileformats.archiveteam.org/wiki/PUZ 28256# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 28257# bundles a Publisher document *PNG.pub with all links into a CAB 28258>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 28259!:mime application/vnd.ms-cab-compressed 28260!:ext puz 28261# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 28262>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 28263!:mime application/vnd.ms-powerpoint 28264#!:mime application/mspowerpoint 28265!:ext ppz 28266# URL: https://en.wikipedia.org/wiki/Windows_Desktop_Gadgets 28267# Reference: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/sidebar/ 28268# http://win10gadgets.com/download/273/ All_CPU_Meter1.zip/All_CPU_Meter_V4.7.3.gadget 28269>0x2c search/968/c gadget.xml \b, Windows Desktop Gadget 28270#!:mime application/vnd.ms-cab-compressed 28271# http://extension.nirsoft.net/gadget 28272!:mime application/x-windows-gadget 28273!:ext gadget 28274# http://www.incredimail.com/ 28275# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 28276>0x2c search/3369/c content.ini\0 \b, IncrediMail 28277!:mime application/x-incredimail 28278# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 28279>>0x2c search/83/c Flavor.htm\0 ecard 28280!:ext imf 28281# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 28282>>0x2c search/211/c .swf\0 skin 28283!:ext ims 28284# member anim.im3 implies IncrediMail animation like in letter_fold.ima 28285>>0x2c search/92/c anim.im3\0 animation 28286!:ext ima 28287# other IncrediMail cab archive 28288>>0x2c default x 28289>>>0x2c search/116/c thumb ecard, image, notifier or skin 28290!:ext imf/imi/imn/ims 28291# http://file-extension.net/seeker/file_extension_ime 28292>>>0x2c default x emoticons or sound 28293!:ext ime/imw 28294# no Diagnostic, Packed and Go, Windows Desktop Gadget, IncrediMail 28295>0x2c default x 28296# look for 1st member name 28297>>(16.l+16) ubyte x 28298# https://en.wikipedia.org/wiki/SNP_file_format 28299>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 28300!:mime application/msaccess 28301!:ext snp 28302# https://en.wikipedia.org/wiki/Microsoft_InfoPath 28303>>>&-1 string manifest.xsf \b, InfoPath Form Template 28304!:mime application/vnd.ms-cab-compressed 28305#!:mime application/vnd.ms-infopath 28306!:ext xsn 28307# https://www.cabextract.org.uk/wince_cab_format/ 28308# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 28309>>>&7 string =.000 \b, WinCE install 28310!:mime application/vnd.ms-cab-compressed 28311!:ext cab 28312 28313# https://support.microsoft.com/kb/934307/en-US 28314# All inspected MSU contain a file with name WSUSSCAN.cab 28315# that is called "Windows Update meta data" by Microsoft 28316>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 28317!:mime application/vnd.ms-cab-compressed 28318!:ext msu 28319>>>&-1 default x 28320# look at point character of 1st archive member name for file name extension 28321>>>>&-1 search/255 . 28322# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 28323# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 28324# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 28325>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 28326!:mime application/vnd.ms-powerpoint 28327#!:mime application/mspowerpoint 28328!:ext ppz 28329# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 28330# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 28331# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 28332>>>>>&0 string/c theme \b, Windows 28333!:mime application/x-windows-themepack 28334# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 28335# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 28336# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 28337>>>>>>(16.l+16) string =Panoram 8 28338!:ext deskthemepack 28339>>>>>>(16.l+16) string !Panoram 7 or 8 28340!:ext themepack/deskthemepack 28341>>>>>>(16.l+16) ubyte x Theme Pack 28342# URL: https://en.wikipedia.org/wiki/Microsoft_OneNote#File_format 28343# http://fileformats.archiveteam.org/wiki/OneNote 28344# Reference: https://mark0.net/download/triddefs_xml.7z/defs/o/onepkg.trid.xml 28345# 1st member name like: "Class Notes.one" "test-onenote.one" "Open Notebook.onetoc2" "Editor �ffnen.onetoc2" 28346>>>>>&0 string/c one \b, OneNote Package 28347!:mime application/msonenote 28348!:ext onepkg 28349>>>>>&0 default x 28350# look for null terminator of 1st member name 28351>>>>>>&0 search/255 \0 28352# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 28353>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 28354!:mime application/vnd.ms-cab-compressed 28355!:ext msu 28356>>>>>>>&16 default x 28357# archive with more then one file need some output in version 5.32 to avoid error message like 28358# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 28359# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 28360# file: could not find any valid magic files! 28361>>>>>>>>28 uleshort >1 \b, many 28362!:mime application/vnd.ms-cab-compressed 28363!:ext cab 28364# remaining archives with just one file 28365>>>>>>>>28 uleshort =1 28366# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 28367>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 28368# cut of last char of source extension and add underscore to generate extension 28369# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 28370!:mime application/vnd.ms-cab-compressed 28371!:ext _/?_/??_ 28372# archive need some output like "single" in version 5.32 to avoid error messages 28373>>>>>>>>>30 uleshort !0x0000 \b, single 28374!:mime application/vnd.ms-cab-compressed 28375!:ext cab 28376# TODO: additional extensions like 28377# .xtp InfoPath Template Part 28378# .lvf Logitech Video Effects Face Accessory 28379>8 ulelong x \b, %u bytes 28380>28 uleshort 1 \b, 1 file 28381>28 uleshort >1 \b, %u files 28382# Reserved fields, set to zero 28383#>4 belong !0 \b, reserved1 %x 28384#>12 belong !0 \b, reserved2 %x 28385# offset of the first CFFILE entry coffFiles: minimal 2Ch 28386>16 ulelong x \b, at %#x 28387>(16.l) use cab-file 28388# at least also 2nd member 28389>28 uleshort >1 28390>>(16.l+16) ubyte x 28391>>>&0 search/255 \0 28392# second member info 28393>>>>&0 use cab-file 28394#>20 belong !0 \b, reserved %x 28395# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 28396>24 ubeshort !0x0301 \b version %#x 28397# number of CFFOLDER entries 28398>26 uleshort >1 \b, %u cffolders 28399# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 28400# only found for flags 0 1 2 3 4 not 7 28401>30 uleshort >0 \b, flags %#x 28402# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 28403# default is zero, however, the -i option of cabarc can be used to set this field 28404>32 uleshort >0 \b, ID %u 28405# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 28406#>34 uleshort x \b, iCabinet %u 28407# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 28408>34 uleshort+1 x \b, number %u 28409>30 uleshort &0x0004 \b, extra bytes 28410# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 28411>>36 uleshort >0 %u in head 28412# cbCFFolder is optional size of per-folder reserved area 28413>>38 ubyte >0 %u in folder 28414# cbCFData is optional size of per-datablock reserved area 28415>>39 ubyte >0 %u in data block 28416# optional per-cabinet reserved area abReserve[cbCFHeader] 28417>>36 uleshort >0 28418# 1st CFFOLDER after reserved area in header 28419>>>(36.s+40) use cab-folder 28420# no reserved area in header 28421>30 uleshort ^0x0004 28422# no previous and next cab archive 28423>>30 uleshort =0x0000 28424>>>36 use cab-folder 28425# only previous cab archive 28426>>30 uleshort =0x0001 \b, previous 28427>>>36 use cab-anchor 28428# only next cab archive 28429>>30 uleshort =0x0002 \b, next 28430>>>36 use cab-anchor 28431# previous+next cab archive 28432# can not use sub routine cab-anchor to display previous and next cabinet together 28433#>>>36 use cab-anchor 28434#>>>>&0 use cab-anchor 28435>>30 uleshort =0x0003 \b, previous 28436>>>36 string x %s 28437# optional name of previous disk szDisk* 28438>>>>&1 string x disk %s 28439>>>>>&1 string x \b, next %s 28440# optional name of previous disk szDisk* 28441>>>>>>&1 string x disk %s 28442>>>>>>>&1 use cab-folder 28443# display filename and disk name of previous or next cabinet 284440 name cab-anchor 28445# optional name of previous/next cabinet file szCabinet*[255] 28446>&0 string x %s 28447# optional name of previous/next disk szDisk*[255] 28448>>&1 string x disk %s 28449# display folder structure CFFOLDER information like compression of cabinet 284500 name cab-folder 28451# offset of the CFDATA block in this folder 28452#>0 ulelong x \b, coffCabStart %#x 28453# number of CFDATA blocks in folder 28454>4 uleshort x \b, %u datablock 28455# plural s 28456>4 uleshort >1 \bs 28457# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 28458>6 uleshort x \b, %#x compression 28459# optional per-folder reserved area 28460#>8 ubequad x \b, abReserve %#llx 28461# display member structure CFFILE information like member name of cabinet 284620 name cab-file 28463# cbFile is uncompressed size of file in bytes 28464#>0 ulelong x \b, cbFile %u 28465# uoffFolderStart is uncompressed offset of file in folder 28466#>4 ulelong >0 \b, uoffFolderStart %#x 28467# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 28468# define ifoldCONTINUED_FROM_PREV (0xFFFD) 28469# define ifoldCONTINUED_TO_NEXT (0xFFFE) 28470# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 28471>8 uleshort >0 \b, iFolder %#x 28472# date stamp for file 28473#>10 uleshort x \b, date %#x 28474# time stamp for file 28475#>12 uleshort x \b, time %#x 28476# attribs is attribute flags for file 28477# define _A_RDONLY (0x01) file is read-only 28478# define _A_HIDDEN (0x02) file is hidden 28479# define _A_SYSTEM (0x04) file is a system file 28480# define _A_ARCH (0x20) file modified since last backup 28481# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 28482# define _A_EXEC (0x40) run after extraction 28483# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 28484# define UNKNOWN (0x0100) undocumented or accident 28485#>14 uleshort x \b, attribs %#x 28486>14 uleshort >0 + 28487>>14 uleshort &0x0001 \bR 28488>>14 uleshort &0x0002 \bH 28489>>14 uleshort &0x0004 \bS 28490>>14 uleshort &0x0020 \bA 28491>>14 uleshort &0x0040 \bX 28492>>14 uleshort &0x0080 \bUtf 28493# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 28494>>14 uleshort &0x0100 \b? 28495# szName is name of archive member 28496>16 string x "%s" 28497# next archive member name if more files 28498#>>&17 string >\0 \b, NEXT NAME %-.50s 28499 28500# InstallShield Cabinet files 285010 string/b ISc( InstallShield Cabinet archive data 28502>5 byte&0xf0 =0x60 version 6, 28503>5 byte&0xf0 !0x60 version 4/5, 28504>(12.l+40) lelong x %u files 28505 28506# Windows CE package files 285070 string/b MSCE\0\0\0\0 Microsoft WinCE install header 28508>20 lelong 0 \b, architecture-independent 28509>20 lelong 103 \b, Hitachi SH3 28510>20 lelong 104 \b, Hitachi SH4 28511>20 lelong 0xA11 \b, StrongARM 28512>20 lelong 4000 \b, MIPS R4000 28513>20 lelong 10003 \b, Hitachi SH3 28514>20 lelong 10004 \b, Hitachi SH3E 28515>20 lelong 10005 \b, Hitachi SH4 28516>20 lelong 70001 \b, ARM 7TDMI 28517>52 leshort 1 \b, 1 file 28518>52 leshort >1 \b, %u files 28519>56 leshort 1 \b, 1 registry entry 28520>56 leshort >1 \b, %u registry entries 28521 28522 28523# Windows Enhanced Metafile (EMF) 28524# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 28525# for further information. 285260 ulelong 1 28527>40 string \ EMF Windows Enhanced Metafile (EMF) image data 28528>>44 ulelong x version %#x 28529 28530 285310 string/b \224\246\056 Microsoft Word Document 28532!:mime application/msword 28533 28534# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 28535# Magic type for Dell's BIOS .hdr files 28536# Dell's .hdr 285370 string/b $RBU 28538>23 string Dell %s system BIOS 28539>5 byte 2 28540>>48 byte x version %d. 28541>>49 byte x \b%d. 28542>>50 byte x \b%d 28543>5 byte <2 28544>>48 string x version %.3s 28545 28546# Type: Microsoft Document Imaging Format (.mdi) 28547# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 28548# From: Daniele Sempione <scrows@oziosi.org> 28549# Too weak (EP) 28550#0 short 0x5045 Microsoft Document Imaging Format 28551 28552# MS eBook format (.lit) 285530 string/b ITOLITLS Microsoft Reader eBook Data 28554>8 lelong x \b, version %u 28555!:mime application/x-ms-reader 28556 28557# Windows CE Binary Image Data Format 28558# From: Dr. Jesus <j@hug.gs> 285590 string/b B000FF\n Windows Embedded CE binary image 28560 28561# The second byte of these signatures is a file version; I don't know what, 28562# if anything, produced files with version numbers 0-2. 28563# From: John Elliott <johne@seasip.demon.co.uk> 285640 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 285650 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 285660 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 285670 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 28568 285690 string MIOPEN Mallard BASIC Jetsam data 285700 string Jetsam0 Mallard BASIC Jetsam index data 28571 28572# DOS backup 2.0 to 3.2 28573# URL: http://fileformats.archiveteam.org/wiki/BACKUP_(MS-DOS) 28574# Reference: http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/restore/brtecdoc.htm 28575# backupid.@@@ 28576 28577# plausibility check for date 285780x3 ushort >1979 28579>0x5 ubyte-1 <31 28580>>0x6 ubyte-1 <12 28581# actually 121 nul bytes 28582>>>0x7 string \0\0\0\0\0\0\0\0 28583>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 28584#!:mime application/octet-stream 28585!:ext @@@ 28586>>>>0x0 ubyte 0xff \b, last disk 28587 28588# backed up file 28589 28590# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 28591# by looking for trailing nul of maximal file name string 285920x52 ubyte 0 28593# test for flag byte: FFh~complete file, 00h~split file 28594# FFh -127 = -1 -127 = -128 28595# 00h -127 = 0 -127 = -127 28596>0 byte-127 <-126 28597# plausibility check for file name length 28598>>0x53 ubyte-1 <78 28599# looking for terminating nul of file name string 28600>>>(0x53.b+4) ubyte 0 28601# looking if last char of string is valid DOS file name 28602>>>>(0x53.b+3) ubyte >0x1F 28603# actually 44 nul bytes 28604# but sometimes garbage according to Ralf Quint. So can not be used as test 28605#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 28606# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 28607# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 28608>>>>>5 ubyte&0x8C 0x0C 28609# ./msdos (version 5.30) labeled the entry as 28610# "DOS 2.0 backed up file %s, split file, sequence %d" or 28611# "DOS 2.0 backed up file %s, complete file" 28612>>>>>>0 ubyte x DOS 2.0-3.2 backed up 28613#>>>>>>0 ubyte 0xff complete 28614>>>>>>0 ubyte 0 28615>>>>>>>1 uleshort x sequence %d of 28616# full file name with path but without drive letter and colon stored from 0x05 til 0x52 28617>>>>>>0x5 string x file %s 28618#!:mime application/octet-stream 28619# backup name is original filename 28620#!:ext doc/exe/rar/zip 28621#!:ext * 28622# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 28623# file: line 1169: Bad magic entry ' *' 28624# after header original file content 28625>>>>>>128 indirect x \b; 28626 28627 28628# DOS backup 3.3 to 5.x 28629 28630# CONTROL.nnn files 286310 string \x8bBACKUP\x20 28632# actually 128 nul bytes 28633>0xa string \0\0\0\0\0\0\0\0 28634>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 28635>>0x8a ubyte 0xff \b, last disk 28636 28637# NB: The BACKUP.nnn files consist of the files backed up, 28638# concatenated. 28639 28640# From: Joerg Jenderek 28641# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_date/time 28642# Reference: https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-dosdatetimetofiletime 28643# Note: DOS date+time format is different from formats such as Unix epoch 28644# bit encoded; uses year values relative to 1980 and 2 second precision 286450 name dos-date 28646# HHHHHMMMMMMSSSSS bit encoded Hour (0-23) Minute (0-59) SecondPart (*2) 28647#>0 uleshort x RAW TIME [%#4.4x] 28648# hour part 28649#>0 uleshort/2048 x hour [%u] 28650# YYYYYMMMMDDDDD bit encoded YearPart (+1980) Month (1-12) Day (1-31) 28651#>2 uleshort x RAW DATE [%#4.4x] 28652# day part 28653>2 uleshort&0x001F x %u 28654#>2 uleshort/16 x MONTH PART [%#x] 28655# GRR: not working 28656#>2 uleshort/16 &0x000F MONTH [%u] 28657#>2 uleshort&0x01E0 x MONTH PART [%#4.4x] 28658>2 uleshort&0x01E0 =0x0020 jan 28659>2 uleshort&0x01E0 =0x0040 feb 28660>2 uleshort&0x01E0 =0x0060 mar 28661>2 uleshort&0x01E0 =0x0080 apr 28662>2 uleshort&0x01E0 =0x00A0 may 28663>2 uleshort&0x01E0 =0x00C0 jun 28664>2 uleshort&0x01E0 =0x00E0 jul 28665>2 uleshort&0x01E0 =0x0100 aug 28666>2 uleshort&0x01E0 =0x0120 sep 28667>2 uleshort&0x01E0 =0x0140 oct 28668>2 uleshort&0x01E0 =0x0160 nov 28669>2 uleshort&0x01E0 =0x0180 dec 28670# year part 28671>2 uleshort/512 x 1980+%u 28672# 28673 28674#------------------------------------------------------------------------------ 28675# $File: msooxml,v 1.18 2022/08/16 11:16:39 christos Exp $ 28676# msooxml: file(1) magic for Microsoft Office XML 28677# From: Ralf Brown <ralf.brown@gmail.com> 28678 28679# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 28680# archive. The first member file is normally "[Content_Types].xml". 28681# but some libreoffice generated files put this later. Perhaps skip 28682# the "[Content_Types].xml" test? 28683# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 28684# file of ePub or OpenDocument, we'll have to scan for a filename 28685# which can distinguish between the three types 28686 286870 name msooxml 28688>0 string word/ Microsoft Word 2007+ 28689!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 28690!:ext docx 28691>0 string ppt/ Microsoft PowerPoint 2007+ 28692!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 28693!:ext pptx 28694>0 string xl/ Microsoft Excel 2007+ 28695!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 28696!:ext xlsx 28697>0 string visio/ Microsoft Visio 2013+ 28698!:mime application/vnd.ms-visio.drawing.main+xml 28699>0 string AppManifest.xaml Microsoft Silverlight Application 28700!:mime application/x-silverlight-app 28701 28702# start by checking for ZIP local file header signature 287030 string PK\003\004 28704!:strength +10 28705# make sure the first file is correct 28706>0x1E use msooxml 28707>0x1E default x 28708>>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps|customXml 28709# skip to the second local file header 28710# since some documents include a 520-byte extra field following the file 28711# header, we need to scan for the next header 28712>>>(18.l+49) search/6000 PK\003\004 28713# now skip to the *third* local file header; again, we need to scan due to a 28714# 520-byte extra field following the file header 28715>>>>&26 search/6000 PK\003\004 28716# and check the subdirectory name to determine which type of OOXML 28717# file we have. Correct the mimetype with the registered ones: 28718# https://technet.microsoft.com/en-us/library/cc179224.aspx 28719>>>>>&26 use msooxml 28720>>>>>&26 default x 28721# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file 28722>>>>>>&26 search/6000 PK\003\004 28723>>>>>>>&26 use msooxml 28724# Some OOXML generators add an extra customXml directory. Check another file. 28725>>>>>>>&26 default x 28726>>>>>>>>&26 search/6000 PK\003\004 28727>>>>>>>>>&26 use msooxml 28728>>>>>>>>>&26 default x Microsoft OOXML 28729>>>>>>>&26 default x Microsoft OOXML 28730>>>>>&26 default x Microsoft OOXML 28731 28732#------------------------------------------------------------------------------ 28733# $File: msvc,v 1.11 2022/01/17 17:17:30 christos Exp $ 28734# msvc: file(1) magic for msvc 28735# "H. Nanosecond" <aldomel@ix.netcom.com> 28736# Microsoft visual C 28737# 28738# I have version 1.0 28739 28740# .aps 287410 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 28742 28743# .ide 28744#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 287450 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 28746 28747# .res 287480 string \000\000\000\000\040\000\000\000\377 MSVC .res 287490 string \377\003\000\377\001\000\020\020\350 MSVC .res 287500 string \377\003\000\377\001\000\060\020\350 MSVC .res 28751 28752#.lib 28753# URL: https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B 28754# http://fileformats.archiveteam.org/wiki/Microsoft_Library 28755# http://fileformats.archiveteam.org/wiki/OMF 28756# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lib-msvc.trid.xml 28757# https://pierrelib.pagesperso-orange.fr/exec_formats/OMF_v1.1.pdf 28758# Update: Joerg Jenderek 28759#0 string \360\015\000\000 Microsoft Visual C library 28760#0 string \360\075\000\000 Microsoft Visual C library 28761#0 string \360\175\000\000 Microsoft Visual C library 28762# test for RecordType~LibraryHeaderRecord=0xF0 + RecordLength=???Dh + dictionary offset is multiple of 0x200 287630 ubelong&0xFF0f80ff =0xF00d0000 28764# Microsoft Visual C library (strength=70) before MIDI SysEx messages (strength=50) handled by ./sysex 28765#!:strength +0 28766# test for valid 2nd RecordType~Translator Header Record=THEADR=80h or LHEADR=82h 28767>(1.s+3) ubyte&0xFD =0x80 28768>>0 use omf-lib 28769# display information about Microsoft Visual C/OMF library 287700 name omf-lib 28771# RecordType~LibraryHeaderRecord=0xF0 28772#>0 byte 0xF0 Microsoft Visual C library 28773# the above description was used in file version 5.41 28774>0 byte 0xF0 Microsoft Visual C/OMF library 28775#>0 byte 0xF0 relocatable Object Module Format (OMF) libray 28776#!:mime application/octet-stream 28777!:mime application/x-omf-lib 28778!:ext lib 28779# 1st record data length like 13=0Dh 29=1Dh 61=3Dh 125=7Dh 509=01FDh ... 32765=7FFDh 28780#>1 uleshort x \b, 1st record data length %u 28781#>1 uleshort x \b, 1st record data length %#x 28782# 2**4=16 <= RecordLength+3 = PageSize = 2**n {16 32 512 no examples 64 128 256 1024 2048 ...32768} <= 2**15=32768 28783>1 uleshort+3 x \b, page size %u 28784# dictionary offset like: 400h 600h a00h c00h 1200h 1800h 2400h 5600h 12800h 19200h 28a00h 28785>3 ulelong x \b, at %#x dictionary 28786# dictionary block a 512 bytes; the first 37 bytes correspond to the 37 buckets 28787#>(3.l) ubequad x (%#16.16llx...) 28788# dictionary size; length in 512-byte blocks; a prime number? like: 28789# 1 2 3 4 5 6 7 9 11 13 15 16 18 21 22 23 24 25 31 50 53 89 101 117 277 28790>7 uleshort x with %u block 28791# plurals s 28792>7 uleshort >1 \bs 28793# If dictionary byte 38 (FFLAG) has the value 255, there is no space left 28794>(3.l+37) ubyte <0xFF (FFLAG=%#x) 28795>(3.l+37) ubyte =0xFF (FFLAG=full) 28796# dictionary entry; length byte of following symbol, the following text bytes of symbol, two bytes specifies the page number 28797# like: dbfntx1! DBFNTX.LIB zlibCompileFlags_ ZLIB.LIB atoi! mwlibc.lib 28798>(3.l+38) pstring x 1st entry %s 28799# like: 1 33 41 47 458 8783 28800>>&0 uleshort x in page %u 28801# library flags; 0 or 1, but WHAT IS 0x4d in MOUSE.LIB ? 28802>9 ubyte >1 \b, flags %#x 28803>9 ubyte =1 case sensitive 28804# In the library after header comes first object module with a Library Module Header Record (LHEADR=82h) 28805# but in examples Translator Header Record (THEADR=80h) which is handled identically 28806>(1.s+3) ubyte x \b, 2nd record 28807>(1.s+3) ubyte !0x80 (type %#x) 28808#>(1.s+4) uleshort x \b, 2nd record data length %u 28809# Module name often source name like "dos\crt0.asm" in mlibce.lib or "QB4UTIL.ASM" in QB4UTIL.LIB 28810# or "C:\Documents and Settings\Allan Campbell\My Documents\FDOSBoot\zlib\zutil.c" in ZLIB.LIB 28811# or title like "87INIT" in FP87.LIB or "ACOSASIN" in MATHC.LIB or "Copyright" in calc-bcc.lib 28812>(1.s+6) pstring x "%s" 28813# 2nd record checksum 28814#>>&0 ubyte x checksum %#x 28815# 3rd RecordType: 96h~LNAMES 88h~COMENT 28816>>&1 ubyte x \b, 3rd record 28817>>&1 ubyte !0x88 28818>>>&-1 ubyte !0x96 28819# 3rd unusual record type 28820>>>>&-1 ubyte x (type %#x) 28821# 3rd record is a List of Names Record (LNAMES=96h) 28822>>&1 ubyte =0x96 LNAMES 28823# LNAMES record length like: 2 15 19 28824#>>>&0 uleshort x \b, LNAMES record length %u 28825>>>&0 uleshort >2 28826# 1st LNAME string length; null is valid; maximal 255 28827#>>>>&0 ubyte x 1st LNAME length %u 28828>>>>&0 ubyte =0 28829# 2nd LNAME length like: 4 7 8 17 31 28830#>>>>>&0 ubyte x 2nd LNAME length %u 28831# name used for segment, class, group, overlay, etc like: 28832# CODE (mwlibc.lib) _TEXT32 (JMPPM32.LIB) _OVLCODE (WOVL.LIB) 28833>>>>>&0 pstring x %s 28834# 3rd LNAME length like: 4 5 28835#>>>>>>&0 ubyte x 3rd LNAME length %u 28836# like: DATA (mwlibc.lib) CODE (JMPPM32.LIB) _TEXT (EMU87.LIB) 28837>>>>>>&0 pstring x %s 28838# maybe 4th LNAME length like: 4 6 28839>>>>>>>&0 ubyte <44 28840# like: DATA (DEBUG.LIB) DGROUP (mwlibc.lib MOUSE.LIB) 28841>>>>>>>>&-1 pstring x %s 28842# 3rd record is a COMMENT (Including all comment class extensions) 28843>>&1 ubyte =0x88 COMMENT 28844# comment record length like: 3 FLIB7M.LIB 1Bh 1Eh 23h 27h 2Bh 30h freetype-bcc.lib 28845#>>>&0 uleshort x \b, record length %#x 28846# real comment length = record length - 1 (comment type) - 1 (comment Class) - 1 (checksum) -1 (char count) 28847# like: 2 LIBFL.LIB 4 "UUID" 5 "dscap" 6 "int386" 7 "qb4util" 8 "AMSGEXIT" 16 REXX.LIB 20 27 35 44 freetype-bcc.lib 28848#>>>>&-2 uleshort-4 >0 \b, comment length %u 28849# check that record contain at least comment type (1 byte), comment class (1 byte), checksum (1 byte) 28850# probably always true 28851>>>&0 uleshort >2 28852# comment type: 80h~NP~no purge bit 40h~NL~no list bit 28853#>>>>&0 ubyte !0 Type %#x 28854>>>>&0 ubyte &0x80 Preserved 28855# no example 28856>>>>&0 ubyte &0x40 NoList 28857# comment class like: 0~Translator A0~OMF extensions A3~LIBMOD A1~New OMF extensions AA~UNKNOWN 28858>>>>&1 ubyte x class=%#x 28859# check that comment record contains at least real content 28860>>>>&-2 uleshort >3 28861# Translator comment record (0); it may name the source language or translator 28862>>>>>&1 ubyte =0 Translator 28863#>>>>>>&0 ubyte x Translator length %u 28864# like: "TC86 Borland Turbo C 2.01 " (GEMS.LIB) "TC86 Borland Turbo C++ 3.00" (CATDB.LIB) 28865>>>>>>&0 pstring x "%s" 28866# OMF extensions comment record (A0); first byte of commentary string identifies subtype 28867>>>>>&1 ubyte =0xA0 OMF extensions 28868# A0 subtype like: 1~IMPDEF 28869>>>>>>&0 ubyte !1 subtype %#x 28870# Import Definition Record (Comment Class A0, Subtype 01~IMPDEF) 28871>>>>>>&0 ubyte 1 IMPDEF 28872# ordinal flag; determines form of Entry Ident field. If nonzero (seems to be 1) Entry is ordinal 28873>>>>>>>&0 ubyte !0 ordinal 28874# like: IMPORT.LIB DOSCALLS.LIB mlibw.lib mwinlibc.lib REXX.LIB 28875>>>>>>>>&-1 ubyte >1 %u 28876# Internal Name in count, char string format; module name for the imported symbol 28877# like: 7 "REXXSAA" 9 11 13 14 15 16 20 21 26 "_Z10_clip_linePdS_S_S_dddd" 28878#>>>>>>>&1 ubyte x internal name length %u 28879# internal module name like: _DllGetVersion DllGetVersion BezierTerminationTest Copyright 28880>>>>>>>&1 pstring x %s 28881# module name in count, char string format; DLL name that supplies a matching export symbol 28882# like: jpeg62.dll (jpeg-bcc.lib) unrar3.dll (unrar-bcc.lib) REXX (REXX.LIB) 28883>>>>>>>>&0 pstring x exported by %s 28884# Entry Ident; 16-bit if ordinal flag != 0 or imported name in count, char string format if ordinal flag = 0 28885# like: \0 (calc-bcc.lib) DllGetVersion (libtiff-bcc.lib) UTF8ToHtml (libxml2-bcc.lib) xslAddCall (libxslt-bcc.lib) 28886#>>>>>>>>>&0 pstring >\0 entry ident %s 28887# "New OMF" extensions comment (A1); indicate version of symbolic debug information 28888# like: LIBFL.LIB 28889>>>>>&1 ubyte =0xA1 New OMF extensions 28890# symbolic debug information version n 28891>>>>>>&0 ubyte x n=%u 28892# symbolic debug information style like: HL~IBM PM Debugger style (LIBFL.LIB) DX~AIX style CV~Microsoft symbol and type style 28893>>>>>>>&0 string HL IBM style 28894>>>>>>>&0 string DX AIX style 28895>>>>>>>&0 string CV Microsoft style 28896# LIBMOD comment record (A3) used only by the librarian 28897# Microsoft extension added for LIB version 3.07 in macro assembler (MASM 5.0) 28898>>>>>&1 ubyte =0xA3 LIBMOD 28899# The A3 LIBMOD record contains only the ASCII string of the module name in count char format 28900#>>>>>>&0 ubyte x LIBMOD length %u 28901# LIBMOD comment record module name without path and extension like: 28902# qb4util (QB4UTIL.LIB) affaldiv (libh.lib) crt0 (slibc.lib) clipper (DDDRAWS.LIB) dinpdev (DINPUTS.LIB) UUID (UUID.LIB) 28903>>>>>>&0 pstring x %s 28904# GRR: WHAT iS THAT? AA foo comment record 28905#>>>>>&1 ubyte =0xAA AA-comment 28906# like: OS220 28907#>>>>>>&0 string x what=%-5.5s 28908# 28909 28910#.pch 289110 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 28912 28913# Summary: Symbol Table / Debug info used by Microsoft compilers 28914# URL: https://en.wikipedia.org/wiki/Program_database 28915# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 28916# Update: Joerg Jenderek 28917# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 28918# info does only applies partly for older files like msvbvm50.pdb about year 2001 289190 string Microsoft\ C/C++\040 28920# "Microsoft Program DataBase" by TrID 28921>24 search/14 \r\n\x1A MSVC program database 28922!:mime application/x-ms-pdb 28923!:ext pdb 28924# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 28925>>16 regex \([0-9.]+\) ver %s 28926#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 28927# "MSF 7.00" variant 28928>>0x1e leshort 0 28929# PageSize 400h 1000h 28930>>>0x20 lelong x \b, %d 28931# Page Count 28932>>>0x28 lelong x \b*%d bytes 28933# "program database 2.00" variant 28934>>0x1e leshort !0 28935# PageSize 400h 28936>>>0x2c lelong x \b, %d 28937# Page Count for msoo-dll.pdb 4379h 28938>>>0x32 leshort x \b*%d bytes 28939 28940# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d 289410 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Roslyn C# debugging symbols version 1.0 28942 28943#.sbr 289440 string \000\002\000\007\000 MSVC .sbr 28945>5 string >\0 %s 28946 28947#.bsc 289480 string \002\000\002\001 MSVC .bsc 28949 28950#.wsp 289510 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 28952# these seem to start with the version and contain menus 28953 28954#------------------------------------------------------------------------------ 28955# msx: file(1) magic for the MSX Home Computer 28956# v1.3 28957# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 28958 28959############## MSX Music file formats ############## 28960 28961# Gigamix MGSDRV music file 289620 string/b MGS MSX Gigamix MGSDRV3 music file, 28963>6 ubeshort 0x0D0A 28964>>3 byte x \bv%c 28965>>4 byte x \b.%c 28966>>5 byte x \b%c 28967>>8 string >\0 \b, title: %s 28968 289691 string/b mgs2\ MSX Gigamix MGSDRV2 music file 28970>6 uleshort 0x80 28971>>0x2E uleshort 0 28972>>>0x30 string >\0 \b, title: %s 28973 28974# KSS music file 289750 string/b KSCC KSS music file v1.03 28976>0xE byte 0 28977>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 28978>>0xF byte&0x02 2 \b, soundchip(s): SN76489 28979>>>0xF byte&0x04 4 stereo 28980>>0xF byte&0x01 1 \b, YM2413 28981>>0xF byte&0x08 8 \b, Y8950 28982 289830 string/b KSSX KSS music file v1.20 28984>0xE byte&0xEF 0 28985>>0xF byte&0x40 0x00 \b, 60Hz 28986>>0xF byte&0x40 0x40 \b, 50Hz 28987>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 28988>>0xF byte&0x02 0x02 \b, soundchips: SN76489 28989>>>0xF byte&0x04 0x04 stereo 28990>>0xF byte&0x01 0x01 \b, 28991>>>0xF byte&0x18 0x00 \bYM2413 28992>>>0xF byte&0x18 0x08 \bYM2413, Y8950 28993>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 28994>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 28995 28996# Moonblaster for Moonsound 289970 string/b MBMS 28998>4 byte 0x10 MSX Moonblaster for MoonSound music 28999 29000# Music Player K-kaz 290010 string/b MPK MSX Music Player K-kaz song 29002>6 ubeshort 0x0D0A 29003>>3 byte x v%c 29004>>4 byte x \b.%c 29005>>5 byte x \b%c 29006 29007# I don't know why these don't work 29008#0 search/0xFFFF \r\n.FM9 29009#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 29010#0 search/0xFFFF \r\nFM1\ \= 29011#>0 search/0xFFFF \r\nPSG1\= 29012#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 29013 29014# OPX Music file 290150x35 beshort 0x0d0a 29016>0x7B beshort 0x0d0a 29017>>0x7D byte 0x1a 29018>>>0x87 uleshort 0 MSX OPX Music file 29019>>>>0x86 byte 0 v1.5 29020>>>>>0 string >\32 \b, title: %s 29021>>>>0x86 byte 1 v2.4 29022>>>>>0 string >\32 \b, title: %s 29023 29024# SCMD music file 290250x8B string/b SCMD 29026>0xCE uleshort 0 MSX SCMD Music file 29027#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 29028>>0x8F string >\0 \b, title: %s 29029 290300 search/0xFFFF \r\n@title 29031>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 29032 29033 29034############## MSX image file formats ############## 29035 29036# MSX raw VRAM dump 290370 ubyte 0xFE 29038>1 uleshort 0 29039>>5 uleshort 0 29040>>>3 uleshort 0x37FF MSX SC2/GRP raw image 29041>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 29042>>>3 uleshort >0x769E 29043>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 29044>>>>>3 uleshort 0x7FFF \b, with sprite patterns 29045>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 29046>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 29047 29048# Graph Saurus compressed images 290490 ubyte 0xFD 29050>1 uleshort 0 29051>>5 uleshort 0 29052>>>3 uleshort >0x013D MSX Graph Saurus compressed image 29053 29054# MSX G9B image file 290550 string/b G9B 29056>1 uleshort 11 29057>>3 uleshort >10 29058>>>5 ubyte >0 MSX G9B image, depth=%d 29059>>>>8 uleshort x \b, %dx 29060>>>>10 uleshort x \b%d 29061>>>>5 ubyte <9 29062>>>>>6 ubyte 0 29063>>>>>>7 ubyte x \b, codec=%d RGB color palettes 29064>>>>>6 ubyte 64 \b, codec=RGB fixed color 29065>>>>>6 ubyte 128 \b, codec=YJK 29066>>>>>6 ubyte 192 \b, codec=YUV 29067>>>>5 ubyte >8 codec=RGB fixed color 29068>>>>12 ubyte 0 \b, raw 29069>>>>12 ubyte 1 \b, bitbuster compression 29070 29071############## Other MSX file formats ############## 29072 29073# MSX internal ROMs 290740 ubeshort 0xF3C3 29075>2 uleshort <0x4000 29076>>8 ubyte 0xC3 29077>>>9 uleshort <0x4000 29078>>>>0x0B ubeshort 0x00C3 29079>>>>>0x0D uleshort <0x4000 29080>>>>>>0x0F ubeshort 0x00C3 29081>>>>>>>0x11 uleshort <0x4000 29082>>>>>>>>0x13 ubeshort 0x00C3 29083>>>>>>>>>0x15 uleshort <0x4000 29084>>>>>>>>>>0x50 ubyte 0xC3 29085>>>>>>>>>>>0x51 uleshort <0x4000 29086>>>>>>>>>>>>(9.s) ubyte 0xC3 29087>>>>>>>>>>>>>&0 uleshort >0x4000 29088>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC 29089>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d 29090>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+ 29091>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R 29092>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version 29093>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=%#2x 29094>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=%#2x 29095>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese 29096>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International 29097>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean 29098>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d 29099>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D 29100>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y 29101>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y 29102>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz 29103>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz 29104>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese 29105>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International 29106>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French 29107>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK 29108>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German 29109>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d 29110>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish 29111>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d 29112>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese 29113>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International 29114>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d 29115>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI 29116 29117 291180 string/b CD 29119>2 uleshort >0x10 29120>>2 uleshort <0x4000 29121>>>4 uleshort <0x4000 29122>>>>6 uleshort <0x4000 29123>>>>>8 ubyte 0xC3 29124>>>>>>9 uleshort <0x4000 29125>>>>>>>0x10 ubyte 0xC3 29126>>>>>>>>0x11 uleshort <0x4000 29127>>>>>>>>>0x14 ubyte 0xC3 29128>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM 29129 291300 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 29131>0x5F0 ubequad 0x8282828244380000 29132>>0x150 ubyte 0x38 29133>>>0x170 string \20\20\20 29134>>>>0x1E32 string ()) 29135>>>>>0x2130 ubequad 0xA5A5594924231807 29136>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font 29137 29138 29139 29140# MSX extension ROMs 291410 string/b AB 29142>2 uleshort 0x0010 MSX ROM 29143>>2 uleshort x \b, init=%#4x 29144>>4 uleshort >0 \b, stahdl=%#4x 29145>>6 uleshort >0 \b, devhdl=%#4x 29146>>8 uleshort >0 \b, bas=%#4x 29147>2 uleshort 0x4010 MSX ROM 29148>>2 uleshort x \b, init=%#04x 29149>>4 uleshort >0 \b, stahdl=%#04x 29150>>6 uleshort >0 \b, devhdl=%#04x 29151>>8 uleshort >0 \b, bas=%#04x 29152>2 uleshort 0x8010 MSX ROM 29153>>2 uleshort x \b, init=%#04x 29154>>4 uleshort >0 \b, stahdl=%#04x 29155>>6 uleshort >0 \b, devhdl=%#04x 29156>>8 uleshort >0 \b, bas=%#04x 291570 string/b AB\0\0 29158>6 uleshort 0 29159>>4 uleshort >0x400F MSX-BASIC extension ROM 29160>>>4 uleshort >0 \b, stahdl=%#04x 29161>>>6 uleshort >0 \b, devhdl=%#04x 29162>>>0x1C string OPLL \b, MSX-Music 29163>>>>0x18 string PAC2 \b (external) 29164>>>>0x18 string APRL \b (internal) 29165 291660 string/b AB\0\0\0\0 29167>6 uleshort >0x400F MSX device BIOS 29168>>6 uleshort >0 \b, devhdl=%#04x 29169 29170 291710 string/b AB 29172#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 29173#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 29174#>3 string @3\x80IA862 Golvellius MSX1 ROM 29175>2 uleshort >15 29176>>2 uleshort <0xC000 29177>>>8 string \0\0\0\0\0\0\0\0 29178>>>>(2.s&0x3FFF) uleshort >0 MSX ROM 29179>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 29180>>>>>0x10 string CD \b, Konami RC- 29181>>>>>>0x12 ubyte x \b%d 29182>>>>>>0x13 ubyte/16 x \b%d 29183>>>>>>0x13 ubyte&0xF x \b%d 29184>>>>>0x10 string EF \b, Konami RC- 29185>>>>>>0x12 ubyte x \b%d 29186>>>>>>0x13 ubyte/16 x \b%d 29187>>>>>>0x13 ubyte&0xF x \b%d 29188>>>>>2 uleshort x \b, init=%#04x 29189>>>>>4 uleshort >0 \b, stahdl=%#04x 29190>>>>>6 uleshort >0 \b, devhdl=%#04x 29191>>>>>8 uleshort >0 \b, bas=%#04x 29192>>>2 uleshort 0 29193>>>>4 uleshort 0 29194>>>>>6 uleshort 0 29195>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=%#04x 29196 291970x4000 string/b AB 29198>0x4002 uleshort >0x400F 29199>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 29200>>>0x4002 uleshort x \b, init=%#04x 29201>>>0x4004 uleshort >0 \b, stahdl=%#04x 29202>>>0x4006 uleshort >0 \b, devhdl=%#04x 29203>>>0x4008 uleshort >0 \b, bas=%#04x 29204 292050x8000 string/b AB 29206>0x8002 uleshort >0x400F 29207>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 29208>>>0x8002 uleshort x \b, init=%#04x 29209>>>0x8004 uleshort >0 \b, stahdl=%#04x 29210>>>0x8006 uleshort >0 \b, devhdl=%#04x 29211>>>0x8008 uleshort >0 \b, bas=%#04x 29212 29213 292140x3C000 string/b AB 29215>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 29216>>0x3C002 uleshort x \b, init=%#04x 29217>>0x3C004 uleshort >0 \b, stahdl=%#04x 29218>>0x3C006 uleshort >0 \b, devhdl=%#04x 29219>>0x3C008 uleshort >0 \b, bas=%#04x 29220 29221# MSX BIN file 29222#0 byte 0xFE 29223#>1 uleshort >0x8000 29224#>>3 uleshort >0x8004 29225#>>>5 uleshort >0x8000 MSX BIN file 29226 29227# MSX-BASIC file 292280 byte 0xFF 29229>3 uleshort 0x000A 29230>>1 uleshort >0x8000 MSX-BASIC program 29231 29232# MSX .CAS file 292330 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 29234 29235# Mega-Assembler file 292360 byte 0xFE 29237>1 uleshort 0x0001 29238>>5 uleshort 0xffff 29239>>>6 byte 0x0A MSX Mega-Assembler source 29240 29241# Execrom Patchfile 292420 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 29243>0x12 ubyte/16 x v%d 29244>0x12 ubyte&0xF x \b.%d 29245>0x13 ubyte x \b, contains %d patches 29246 29247# Konami's King's Valley-2 custom stage (ELG file) 292484 uleshort 0x0900 29249>0xF byte 1 29250>>0x14 byte 0 29251>>>0x1E string \040\040\040 29252>>>>0x23 byte 1 29253>>>>>0x25 byte 0 29254>>>>>>0x15 string >\x30 29255>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 29256>>>>>>>>0x1D byte <32 \b, theme: %d 29257 29258# Metal Gear 1 savegame 29259#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 29260#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 29261#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 29262 29263# ------------------------------------------------------------------------ 29264# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $ 29265# mup: file(1) magic for Mup (Music Publisher) input file. 29266# 29267# From: Abel Cheung <abel (@) oaka.org> 29268# 29269# NOTE: This header is mainly proposed in the Arkkra mailing list, 29270# and is not a mandatory header because of old mup input file 29271# compatibility. Noteedit also use mup format, but is not forcing 29272# user to use any header as well. 29273# 292740 search/1 //!Mup Mup music publication program input text 29275>6 string -Arkkra (Arkkra) 29276>>13 string - 29277>>>16 string . 29278>>>>14 string x \b, need V%.4s 29279>>>15 string . 29280>>>>14 string x \b, need V%.3s 29281>6 string - 29282>>9 string . 29283>>>7 string x \b, need V%.4s 29284>>8 string . 29285>>>7 string x \b, need V%.3s 29286#------------------------------------------------------------------------------ 29287# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 29288# music: file (1) magic for music formats 29289 29290# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 29291# and Bagpipe Writer by Doug Wickstrom 29292# 292930 string Bagpipe Bagpipe 29294>8 string Reader Reader 29295>>15 string >\0 (version %.3s) 29296>8 string Music\ Writer Music Writer 29297>>20 string : 29298>>>21 string >\0 (version %.3s) 29299>>21 string Gold Gold 29300>>>25 string : 29301>>>>26 string >\0 (version %.3s) 29302 29303 29304#------------------------------------------------------------------------------ 29305# nasa: file(1) magic 29306 29307# From: Barry Carter <carter.barry@gmail.com> 293080 string DAF/SPK NASA SPICE file (binary format) 293090 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format) 29310 29311#----------------------------------------------------------------------------- 29312# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $ 29313# natinst: file(1) magic for National Instruments Code Files 29314 29315# 29316# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 29317# version 1 29318# Many formats still missing, we use, for the moment LabVIEW 29319# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 29320# 293210 string RSRC National Instruments, 29322# Check if it's a LabVIEW File 29323>8 string LV LabVIEW File, 29324# Check which kind of file it is 29325>>10 string SB Code Resource File, data 29326>>10 string IN Virtual Instrument Program, data 29327>>10 string AR VI Library, data 29328# This is for Menu Libraries 29329>8 string LMNULBVW Portable File Names, data 29330# This is for General Resources 29331>8 string rsc Resources File, data 29332# This is for VXI Package 293330 string VMAP National Instruments, VXI File, data 29334 29335#------------------------------------------------------------------------------ 29336# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $ 29337# ncr: file(1) magic for NCR Tower objects 29338# 29339# contributed by 29340# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 29341# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 29342# 293430 beshort 000610 Tower/XP rel 2 object 29344>12 belong >0 not stripped 29345>20 beshort 0407 executable 29346>20 beshort 0410 pure executable 29347>22 beshort >0 - version %d 293480 beshort 000615 Tower/XP rel 2 object 29349>12 belong >0 not stripped 29350>20 beshort 0407 executable 29351>20 beshort 0410 pure executable 29352>22 beshort >0 - version %d 293530 beshort 000620 Tower/XP rel 3 object 29354>12 belong >0 not stripped 29355>20 beshort 0407 executable 29356>20 beshort 0410 pure executable 29357>22 beshort >0 - version %d 293580 beshort 000625 Tower/XP rel 3 object 29359>12 belong >0 not stripped 29360>20 beshort 0407 executable 29361>20 beshort 0410 pure executable 29362>22 beshort >0 - version %d 293630 beshort 000630 Tower32/600/400 68020 object 29364>12 belong >0 not stripped 29365>20 beshort 0407 executable 29366>20 beshort 0410 pure executable 29367>22 beshort >0 - version %d 293680 beshort 000640 Tower32/800 68020 29369>18 beshort &020000 w/68881 object 29370>18 beshort &040000 compatible object 29371>18 beshort &060000 object 29372>20 beshort 0407 executable 29373>20 beshort 0413 pure executable 29374>12 belong >0 not stripped 29375>22 beshort >0 - version %d 293760 beshort 000645 Tower32/800 68010 29377>18 beshort &040000 compatible object 29378>18 beshort &060000 object 29379>20 beshort 0407 executable 29380>20 beshort 0413 pure executable 29381>12 belong >0 not stripped 29382>22 beshort >0 - version %d 29383 29384#------------------------------------------------------------------------------ 29385# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $ 29386# netbsd: file(1) magic for NetBSD objects 29387# 29388# All new-style magic numbers are in network byte order. 29389# The old-style magic numbers are indistinguishable from the same magic 29390# numbers used in other systems, and are handled, for all those systems, 29391# in aout. 29392# 29393 293940 name netbsd-detail 29395>20 lelong x @%#x 29396>4 lelong >0 \b+T=%d 29397>8 lelong >0 \b+D=%d 29398>12 lelong >0 \b+B=%d 29399>16 lelong >0 \b+S=%d 29400>24 lelong >0 \b+TR=%d 29401>28 lelong >0 \b+TD=%d 29402 294030 name netbsd-4096 29404>0 byte &0x80 29405>>20 lelong <4096 shared library 29406>>20 lelong =4096 dynamically linked executable 29407>>20 lelong >4096 dynamically linked executable 29408>0 byte ^0x80 executable 29409>16 lelong >0 not stripped 29410 294110 name netbsd-8192 29412>0 byte &0x80 29413>>20 lelong <8192 shared library 29414>>20 lelong =8192 dynamically linked executable 29415>>20 lelong >8192 dynamically linked executable 29416>0 byte ^0x80 executable 29417>16 lelong >0 not stripped 29418>0 use netbsd-detail 29419 294200 name netbsd-normal 29421>0 byte &0x80 dynamically linked executable 29422>0 byte ^0x80 29423>>0 byte &0x40 position independent 29424>>20 lelong !0 executable 29425>>20 lelong =0 object file 29426>16 lelong >0 not stripped 29427>0 use netbsd-detail 29428 294290 name netbsd-pure 29430>0 byte &0x80 dynamically linked executable 29431>0 byte ^0x80 executable 29432>16 lelong >0 not stripped 29433>0 use netbsd-detail 29434 294350 name netbsd-core 29436>12 string >\0 from '%s' 29437>32 lelong !0 (signal %d) 29438 294390 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 29440>0 use netbsd-4096 29441 294420 belong&0377777777 041400410 a.out NetBSD/i386 pure 29443>0 use netbsd-pure 29444 294450 belong&0377777777 041400407 a.out NetBSD/i386 29446>0 use netbsd-normal 29447 294480 belong&0377777777 041400507 a.out NetBSD/i386 core 29449>0 use netbsd-core 29450 294510 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 29452>0 use \^netbsd-8192 29453 294540 belong&0377777777 041600410 a.out NetBSD/m68k pure 29455>0 use \^netbsd-pure 29456 294570 belong&0377777777 041600407 a.out NetBSD/m68k 29458>0 use \^netbsd-normal 29459 294600 belong&0377777777 041600507 a.out NetBSD/m68k core 29461>0 use \^netbsd-core 29462 294630 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 29464>0 use \^netbsd-4096 29465 294660 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 29467>0 use \^netbsd-pure 29468 294690 belong&0377777777 042000407 a.out NetBSD/m68k4k 29470>0 use \^netbsd-normal 29471 294720 belong&0377777777 042000507 a.out NetBSD/m68k4k core 29473>0 use \^netbsd-core 29474 294750 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 29476>0 use netbsd-4096 29477 294780 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 29479>0 use netbsd-pure 29480 294810 belong&0377777777 042200407 a.out NetBSD/ns32532 29482>0 use netbsd-normal 29483 294840 belong&0377777777 042200507 a.out NetBSD/ns32532 core 29485>0 use netbsd-core 29486 294870 belong&0377777777 045200507 a.out NetBSD/powerpc core 29488>0 use netbsd-core 29489 294900 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 29491>0 use \^netbsd-8192 29492 294930 belong&0377777777 042400410 a.out NetBSD/SPARC pure 29494>0 use \^netbsd-pure 29495 294960 belong&0377777777 042400407 a.out NetBSD/SPARC 29497>0 use \^netbsd-normal 29498 294990 belong&0377777777 042400507 a.out NetBSD/SPARC core 29500>0 use \^netbsd-core 29501 295020 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 29503>0 use netbsd-4096 29504 295050 belong&0377777777 042600410 a.out NetBSD/pmax pure 29506>0 use \^netbsd-pure 29507 295080 belong&0377777777 042600407 a.out NetBSD/pmax 29509>0 use netbsd-normal 29510 295110 belong&0377777777 042600507 a.out NetBSD/pmax core 29512>0 use netbsd-core 29513 295140 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 29515>0 use netbsd-4096 29516 295170 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 29518>0 use netbsd-pure 29519 295200 belong&0377777777 043000407 a.out NetBSD/vax 1k 29521>0 use netbsd-normal 29522 295230 belong&0377777777 043000507 a.out NetBSD/vax 1k core 29524>0 use netbsd-core 29525 295260 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 29527>0 use netbsd-4096 29528 295290 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 29530>0 use netbsd-pure 29531 295320 belong&0377777777 045400407 a.out NetBSD/vax 4k 29533>0 use netbsd-normal 29534 295350 belong&0377777777 045400507 a.out NetBSD/vax 4k core 29536>0 use netbsd-core 29537 29538# NetBSD/alpha does not support (and has never supported) a.out objects, 29539# so no rules are provided for them. NetBSD/alpha ELF objects are 29540# dealt with in "elf". 295410 lelong 0x00070185 ECOFF NetBSD/alpha binary 29542>10 leshort 0x0001 not stripped 29543>10 leshort 0x0000 stripped 295440 belong&0377777777 043200507 a.out NetBSD/alpha core 29545>12 string >\0 from '%s' 29546>32 lelong !0 (signal %d) 29547 295480 belong&0377777777 043400413 a.out NetBSD/mips demand paged 29549>0 use \^netbsd-8192 29550 29551>16 belong >0 not stripped 295520 belong&0377777777 043400410 a.out NetBSD/mips pure 29553>0 use netbsd-pure 29554 295550 belong&0377777777 043400407 a.out NetBSD/mips 29556>0 use netbsd-normal 29557 295580 belong&0377777777 043400507 a.out NetBSD/mips core 29559>0 use netbsd-core 29560 295610 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 29562>0 use netbsd-4096 29563 295640 belong&0377777777 043600410 a.out NetBSD/arm32 pure 29565>0 use netbsd-pure 29566 295670 belong&0377777777 043600407 a.out NetBSD/arm32 29568>0 use netbsd-normal 29569 29570# NetBSD/arm26 has always used ELF objects, but it shares a core file 29571# format with NetBSD/arm32. 295720 belong&0377777777 043600507 a.out NetBSD/arm core 29573>0 use netbsd-core 29574 29575# Kernel core dump format 295760 belong&0x0000ffff 0x00008fca NetBSD kernel core file 29577>0 belong&0x03ff0000 0x00000000 \b, Unknown 29578>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 29579>0 belong&0x03ff0000 0x00020000 \b, sun 68020 29580>0 belong&0x03ff0000 0x00640000 \b, 386 PC 29581>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 29582>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 29583>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 29584>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 29585>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 29586>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 29587>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 29588>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 29589>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 29590>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 29591>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 29592>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 29593>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 29594>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 29595>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 29596>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 29597>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 29598>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 29599>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 29600>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 29601>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 29602>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 29603>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 29604>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 29605>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 29606>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 29607>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 29608>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 29609>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 29610>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 29611>0 belong&0xfc000000 0x04000000 \b, CPU 29612>0 belong&0xfc000000 0x08000000 \b, DATA 29613>0 belong&0xfc000000 0x10000000 \b, STACK 29614>4 leshort x \b, (headersize = %d 29615>6 leshort x \b, segmentsize = %d 29616>8 lelong x \b, segments = %d) 29617 29618# little endian only for now. 296190 name ktrace 29620>4 leshort 7 29621>>6 leshort <3 NetBSD ktrace file version %d 29622>>>12 string x from %s 29623>>>56 string x \b, emulation %s 29624>>>8 lelong <65536 \b, pid=%d 29625 2962656 string netbsd 29627>0 use ktrace 2962856 string linux 29629>0 use ktrace 2963056 string sunos 29631>0 use ktrace 2963256 string hpux 29633>0 use ktrace 29634 29635#------------------------------------------------------------------------------ 29636# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $ 29637# netscape: file(1) magic for Netscape files 29638# "H. Nanosecond" <aldomel@ix.netcom.com> 29639# version 3 and 4 I think 29640# 29641 29642# Netscape Address book .nab 296430 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 29644 29645# Netscape Communicator address book 296460 string \000\017\102\111 Netscape Communicator address book 29647 29648# .snm Caches 296490 string #\ Netscape\ folder\ cache Netscape folder cache 296500 string \000\036\204\220\000 Netscape folder cache 29651# .n2p 29652# Net 2 Phone 29653#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 296540 string SX961999 Net2phone 29655 29656# 29657#This is files ending in .art, FIXME add more rules 296580 string JG\004\016\0\0\0\0 AOL ART image 296590 string JG\003\016\0\0\0\0 AOL ART image 29660 29661#------------------------------------------------------------------------------ 29662# $File: netware,v 1.5 2020/09/04 16:30:51 christos Exp $ 29663# netware: file(1) magic for NetWare Loadable Modules (NLMs) 29664# From: Mads Martin Joergensen <mmj@suse.de> 29665# URL: https://en.wikipedia.org/wiki/NetWare_Loadable_Module 29666 296670 string NetWare\ Loadable\ Module NetWare Loadable Module 29668#!:mime application/octet-stream 29669!:ext nlm 29670 29671 29672#------------------------------------------------------------------------------ 29673# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 29674# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 29675# 296760 string StartFontMetrics ASCII font metrics 296770 string StartFont ASCII font bits 296780 belong 0x137A2944 NeWS bitmap font 296790 belong 0x137A2947 NeWS font family 296800 belong 0x137A2950 scalable OpenFont binary 296810 belong 0x137A2951 encrypted scalable OpenFont binary 296828 belong 0x137A2B45 X11/NeWS bitmap font 296838 belong 0x137A2B48 X11/NeWS font family 29684 29685#------------------------------------------------------------------------------ 29686# $File: nifty,v 1.1 2022/02/14 16:51:15 christos Exp $ 29687# file(1) magic for the NIfTI file format 29688 29689# Type: NIfTI, Neuroimaging file format 29690# URL: https://nifti.nimh.nih.gov/ 29691# From: Yann Leprince <yann.leprince@cea.fr>, 2022 29692 29693344 string n+1\0 NIfTI-1 neuroimaging data, 29694!:mime image/x.nifti 29695!:ext nii 29696>0 use nifti1 29697344 string ni1\0 NIfTI-1 neuroimaging data header, 29698!:mime image/x.nifti 29699!:ext hdr 29700>0 use nifti1 29701 297024 string n+2\0\r\n\032\n NIfTI-2 neuroimaging data, 29703!:mime image/x.nifti 29704!:ext nii 29705>0 use nifti2 297064 string ni2\0\r\n\032\n NIfTI-2 neuroimaging data header, 29707!:mime image/x.nifti 29708!:ext hdr 29709>0 use nifti2 29710 29711# Main subroutine for NIfTI-1 297120 name nifti1 29713>0 clear x 29714>0 lelong =348 little endian 29715>>70 use nifti-datatype-le 29716>>112 lefloat !0 with scaling 29717>>0 use nifti1-dim-le 29718>>252 leshort >0 \b, with qform 29719>>>252 use xform-code-nifti1-le 29720>>254 leshort >0 \b, with sform 29721>>>254 use xform-code-nifti1-le 29722>>136 string >\0 \b, description: %s 29723>0 belong =348 big endian 29724>>70 use \^nifti-datatype-le 29725>>112 befloat !0 with scaling 29726>>0 use \^nifti1-dim-le 29727>>252 beshort >0 \b, with qform 29728>>>252 use \^xform-code-nifti1-le 29729>>254 beshort >0 \b, with sform 29730>>>254 use \^xform-code-nifti1-le 29731>>136 string >\0 \b, description: %s 29732>0 default x 29733>>0 long x invalid sizeof_hdr=%d 29734 29735# Main subroutine for NIfTI-2 297360 name nifti2 29737>0 clear x 29738>0 lelong =540 little endian 29739>>12 use nifti-datatype-le 29740>>176 lefloat !0 with scaling 29741>>0 use nifti2-dim-le 29742>>344 lelong >0 \b, with qform 29743>>>344 use xform-code-nifti2-le 29744>>348 lelong >0 \b, with sform 29745>>>348 use xform-code-nifti2-le 29746>>240 string >\0 \b, description: %s 29747>0 belong =540 big endian 29748>>12 use \^nifti-datatype-le 29749>>176 befloat !0 with scaling 29750>>0 use \^nifti2-dim-le 29751>>344 lelong >0 \b, with qform 29752>>>344 use \^xform-code-nifti2-le 29753>>348 lelong >0 \b, with sform 29754>>>348 use \^xform-code-nifti2-le 29755>>240 string >\0 \b, description: %s 29756>0 default x 29757>>0 long x invalid sizeof_hdr=%d 29758 29759 29760# Other subroutines for details of NIfTI files 29761 297620 name nifti-datatype-le 29763>0 clear x 29764>0 leshort =1 \b, binary datatype 29765>0 leshort =2 \b, uint8 datatype 29766>0 leshort =4 \b, int16 datatype 29767>0 leshort =8 \b, int32 datatype 29768>0 leshort =16 \b, float32 datatype 29769>0 leshort =32 \b, complex64 datatype 29770>0 leshort =64 \b, float64 datatype 29771>0 leshort =128 \b, RGB24 datatype 29772>0 leshort =256 \b, int8 datatype 29773>0 leshort =512 \b, uint16 datatype 29774>0 leshort =768 \b, uint32 datatype 29775>0 leshort =1024 \b, int64 datatype 29776>0 leshort =1280 \b, uint64 datatype 29777>0 leshort =1536 \b, float128 datatype 29778>0 leshort =1792 \b, complex128 datatype 29779>0 leshort =2048 \b, complex256 datatype 29780>0 leshort =2304 \b, RGBA32 datatype 29781>0 default x 29782>>0 leshort x \b, unknown datatype 0x%x 29783>>2 leshort x (%d bits/pixel) 29784 297850 name nifti1-dim-le 29786>0 clear x 29787>40 leshort <0 \b, INVALID dim[0]=%d 29788>40 leshort >7 \b, INVALID dim[0]=%d 29789>0 default x 29790>>40 leshort x \b, %d-dimensional (size 29791>>42 leshort x %d 29792>>40 leshort >1 29793>>>44 leshort x \bx%d 29794>>40 leshort >2 29795>>>46 leshort x \bx%d 29796>>40 leshort >3 29797>>>48 leshort x \bx%d 29798>>40 leshort >4 29799>>>50 leshort x \bx%d 29800>>40 leshort >5 29801>>>52 leshort x \bx%d 29802>>40 leshort >6 29803>>>54 leshort x \bx%d 29804>>80 lefloat x \b, voxel size %f 29805>>40 leshort >1 29806>>>84 lefloat x x %f 29807>>40 leshort >2 29808>>>88 lefloat x x %f 29809>>123 use nifti1-xyz-unit 29810>>40 leshort >3 29811>>>92 lefloat x x %f 29812>>>123 use nifti1-t-unit 29813>>40 leshort x \b) 29814 298150 name nifti2-dim-le 29816>0 clear x 29817>16 lequad <0 \b, INVALID dim[0]=%lld 29818>16 lequad >7 \b, INVALID dim[0]=%lld 29819>0 default x 29820>>16 lequad x \b, %lld-dimensional (size 29821>>24 lequad x %lld 29822>>16 lequad >1 29823>>>32 lequad x \bx%lld 29824>>16 lequad >2 29825>>>40 lequad x \bx%lld 29826>>16 lequad >3 29827>>>48 lequad x \bx%lld 29828>>16 lequad >4 29829>>>56 lequad x \bx%lld 29830>>16 lequad >5 29831>>>64 lequad x \bx%lld 29832>>16 lequad >6 29833>>>72 lequad x \bx%lld, 29834>>112 ledouble x \b, voxel size %f 29835>>16 lequad >1 29836>>>120 ledouble x x %f 29837>>16 lequad >2 29838>>>128 ledouble x x %f 29839>>500 use nifti2-xyz-unit 29840>>16 lequad >3 29841>>>136 ledouble x x %f 29842>>>500 use nifti2-t-unit 29843>>16 lequad x \b) 29844 298450 name xform-code-nifti1-le 29846>0 leshort =1 to scanner-based coordinates 29847>0 leshort =2 to aligned coordinates 29848>0 leshort =3 to Talairach coordinates 29849>0 leshort =4 to MNI152 coordinates 29850>0 leshort =5 to template coordinates 29851 298520 name xform-code-nifti2-le 29853>0 lelong =1 to scanner-based coordinates 29854>0 lelong =2 to aligned coordinates 29855>0 lelong =3 to Talairach coordinates 29856>0 lelong =4 to MNI152 coordinates 29857>0 lelong =5 to template coordinates 29858 298590 name nifti1-xyz-unit 29860>0 byte &0x01 29861>>0 byte ^0x02 m 29862>>0 byte &0x02 micron 29863>0 byte ^0x01 29864>>0 byte &0x02 mm 29865 298660 name nifti1-t-unit 29867>0 byte &0x08 29868>>0 byte ^0x10 s 29869>>0 byte &0x10 ms 29870>0 byte ^0x08 29871>>0 byte &0x10 microsecond 29872 298730 name nifti2-xyz-unit 29874>0 lelong &0x01 29875>>0 lelong ^0x02 m 29876>>0 lelong &0x02 micron 29877>0 lelong ^0x01 29878>>0 lelong &0x02 mm 29879 298800 name nifti2-t-unit 29881>0 lelong &0x08 29882>>0 lelong ^0x10 s 29883>>0 lelong &0x10 ms 29884>0 lelong ^0x08 29885>>0 lelong &0x10 microsecond 29886 29887#------------------------------------------------------------------------------ 29888# $File: nim-lang,v 1.3 2021/07/06 12:34:06 christos Exp $ 29889# nim-lang: file(1) magic for nim 29890# URL: https://nim-lang.org/ 29891 298920 search/8192 import 29893>&0 search/64 os 29894>>&0 use nim1 29895>&0 default x 29896>>&0 search/64 osproc 29897>>>&0 use nim1 29898>>&0 default x 29899>>>&0 search/64 strutils 29900>>>>&0 use nim1 29901 299020 name nim1 29903>&0 search/8192 proc 29904>>&0 use nim2 29905>&0 default x 29906>>&0 search/8192 template 29907>>>&0 use nim2 29908>>&0 default x 29909>>>&0 search/8192 let 29910>>>>&0 use nim2 29911 299120 name nim2 29913>&0 search/8192 when Nim source code 29914!:ext nim 29915 29916#------------------------------------------------------------------------------ 29917# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $ 29918# nitpicker: file(1) magic for Flowfiles. 29919# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de 299200 string NPFF NItpicker Flow File 29921>4 byte x V%d. 29922>5 byte x %d 29923>6 bedate x started: %s 29924>10 bedate x stopped: %s 29925>14 belong x Bytes: %u 29926>18 belong x Bytes1: %u 29927>22 belong x Flows: %u 29928>26 belong x Pkts: %u 29929 29930#------------------------------------------------------------------------------ 29931# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $ 29932# numpy: file(1) magic for NumPy array binary serialization format 29933# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html 299340 string \x93NUMPY NumPy array, 29935>6 ubyte x version %d 29936>7 ubyte x \b.%d, 29937>8 uleshort x header length %d 29938 29939#------------------------------------------------------------------------------ 29940# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $ 29941# OASIS 29942# Summary: OASIS stream file 29943# Long description: Open Artwork System Interchange Standard 29944# File extension: .oas 29945# Full name: Ben Cowley (bcowley@broadcom.com) 29946# Philip Dixon (pdixon@broadcom.com) 29947# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 29948# (see page 3) 299490 string %SEMI-OASIS\r\n OASIS Stream file 29950 29951#------------------------------------------------------------------------------ 29952# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 29953# ocaml: file(1) magic for Objective Caml files. 299540 string Caml1999 OCaml 29955>8 string X exec file 29956>8 string I interface file (.cmi) 29957>8 string O object file (.cmo) 29958>8 string A library file (.cma) 29959>8 string Y native object file (.cmx) 29960>8 string Z native library file (.cmxa) 29961>8 string M abstract syntax tree implementation file 29962>8 string N abstract syntax tree interface file 29963>9 string >\0 (Version %3.3s) 29964 29965#------------------------------------------------------------------------------ 29966# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 29967# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 299680 string Octave-1-L Octave binary data (little endian) 299690 string Octave-1-B Octave binary data (big endian) 29970 29971#------------------------------------------------------------------------------ 29972# $File: ole2compounddocs,v 1.19 2022/09/11 20:52:40 christos Exp $ 29973# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 29974# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 29975# Additional tests for OLE 2 Compound Documents should be under this recipe. 29976# reference: https://www.openoffice.org/sc/compdocfileformat.pdf 29977 299780 string \320\317\021\340\241\261\032\341 29979# https://digital-preservation.github.io/droid/ 29980# skip droid skeleton like fmt-39-signature-id-128.doc by valid version 29981>0x1A ushort !0xABAB OLE 2 Compound Document 29982#>0x1C uleshort x \b, endnian %#4.4x 29983# big endian not tested 29984>>0x1C ubeshort =0xfffe \b, big-endian 29985>>>546 string jbjb : Microsoft Word Document 29986!:mime application/msword 29987!:apple MSWDWDBN 29988!:ext doc 29989# Byte Order 0xFFFE means little-endian found in real world applications 29990#>>0x1C uleshort =0xfffe \b, little-endian 29991>>0x1C uleshort =0xfffe 29992# From: Joerg Jenderek 29993# Major Version 3 or 4 29994>>>0x1A uleshort x \b, v%u 29995# Minor Version 32h=50 3Bh=59 3Eh=62 29996>>>0x18 uleshort x \b.%u 29997# SecID of first sector of the directory stream is often 1 but high like 3144h 29998>>>48 ulelong x \b, SecID %#x 29999# Sector Shift Exponent in short-stream container stream: 6~64 bytes 30000>>>32 uleshort !6 \b, exponent of short stream %u 30001# total number of sectors used for the FAT 30002>>>44 ulelong >1 \b, %u FAT sectors 30003# SecID of first sector of the short-sector allocation table (Mini FAT) 30004# or -2 (End Of ChainSecID) if not extant 30005>>>60 ulelong !0xffFFffFE \b, Mini FAT start sector %#x 30006# total number of sectors used for the short-sector allocation table 30007>>>64 ulelong !1 \b, %u Mini FAT sector 30008# plural s 30009>>>>64 ulelong >1 \bs 30010# SecID of first sector of the master sector allocation table (DIFAT) 30011# or -2 (End Of Chain SecID) if no additional sectors used 30012>>>68 ulelong !0xffFFffFE \b, DIFAT start sector %#x 30013# total number of sectors used for the master sector allocation table (DIFAT) 30014>>>72 ulelong >0 \b, %u DIFAT sectors 30015# First part of the master sector allocation table (DIFAT) containing 109 SecIDs 30016#>>>76 ubequad x \b, DIFAT=%#16.16llx 30017#>>>84 ubequad x \b%16.16llx... 30018# pointer to root entry only works with standard configuration for SecID ~< 800h 30019# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls 30020# "ORLEN Factbook 2017.xls" XnView_metadata.doc 30021# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized 30022>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB 30023# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4 30024>>>0x1E uleshort 0xc \b, blocksize 4096 30025# jump to one block (4096 bytes per block) before root storage block 30026>>>>(48.l*4096) ubyte x 30027>>>>>&4095 use ole2-directory 30028#>>>0x1E uleshort 9 \b, blocksize 512 30029>>>0x1E uleshort 9 30030# jump to one block (512 bytes per block) before root storage block 30031# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h 30032>>>>(48.l*512) ubyte x 30033>>>>>&511 use ole2-directory 30034# check directory entry structure and display types by GUID 300350 name ole2-directory 30036# directory entry name like "Root Entry" 30037#>0 lestring16 x \b, 1st %.10s 30038# type of the entry; 5~Root storage 30039#>66 ubyte x \b, type %x 30040# node colour of the entry: 00H ~ Red 01H ~ Black 30041#>67 ubyte x \b, color %x 30042# the DirIDs of the child nodes. Should both be -1 in the root storage entry 30043#>68 bequad !0xffffffffffffffff \b, DirIDs %llx 30044# second directory entry name like VisioDocument Control000 30045#>128 lestring16 x \b, 2nd %.20s 30046# third directory entry like WordDocument 30047#>256 lestring16 x \b, 3rd %.20s 30048# forth 30049#>384 lestring16 x \b, 4th %.10s 30050# 5th 30051#>512 lestring16 x \b, 5th %.10s 30052# 6th 30053#>640 lestring16 x \b, 6th %.10s 30054# 7th 30055#>768 lestring16 x \b, 7th %.10s 30056# https://wikileaks.org/ciav7p1/cms/page_13762814.html 30057# https://m.blog.naver.com/superman4u/40047693679 30058# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt 30059# https://toolslick.com/conversion/data/guid 30060#>80 ubequad !0 \b, clsid %#16.16llx 30061#>>88 ubequad x \b%16.16llx 30062# test for "Root Entry" inside directory by type 5 value 30063>66 ubyte 5 30064# look for CLSID GUID 0 30065>>88 ubequad 0x0 30066>>>80 ubequad 0x0 30067# - Microstation V8 DGN files (www.bentley.com) 30068# URL: https://en.wikipedia.org/wiki/MicroStation 30069# Last update on 10/23/2006 by Lester Hightower 30070# 07/24/2019 by Joerg Jenderek 30071# Second directory entry name like Dgn~H Dgn~S 30072>>>>128 lestring16 Dgn~ : Microstation V8 CAD 30073#!:mime application/x-ole-storage 30074!:mime application/x-bentley-dgn 30075# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn 30076!:ext dgn 30077# 30078# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 30079# Second directory entry name PerfectOffice_ 30080>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic 30081!:mime application/vnd.wordperfect 30082# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 30083!:apple ????WPC7 30084!:ext mst/wpd/wpg 30085# 30086# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 30087# Second directory entry name MatOST_ 30088>>>>128 lestring16 MatOST : Microsoft Works 3.0 document 30089!:mime application/vnd.ms-works 30090!:apple ????AWWP 30091!:ext wps 30092# 30093# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet 30094# 3rd directory entry name WksSSWorkBook 30095>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet 30096!:mime application/vnd.ms-works 30097!:apple ????AWSS 30098!:ext xlr 30099# 30100# URL: http://fileformats.archiveteam.org/wiki/XLS 30101# what is the difference to {00020820-0000-0000-c000-000000000046} ? 30102# Second directory entry name Workbook 30103>>>>128 lestring16 Workbook 30104>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid 30105!:mime application/vnd.ms-excel 30106# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 30107!:apple ????XLS9 30108!:ext xls 30109# 30110# URL: http://fileformats.archiveteam.org/wiki/PPT 30111# Second directory entry name Object1 Object12 Object35 30112>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation 30113!:mime application/vnd.ms-powerpoint 30114# https://www.macdisk.com/macsigen.php 30115!:apple ????PPT3 30116!:ext ppt 30117# 30118# URL: https://www.msoutlook.info/question/164 30119# Second directory entry name __CollDataStm 30120>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings 30121#!:mime application/vnd.ms-outlook 30122!:mime application/x-ms-srs 30123# %APPDATA%\Microsoft\Outlook\Outlook.srs 30124!:ext srs 30125# 30126# URL: https://www.file-extensions.org/cag-file-extension 30127# Second directory entry name Category 30128>>>>128 lestring16 Category : Microsoft Clip Art Gallery 30129#!:mime application/x-ole-storage 30130!:mime application/x-ms-cag 30131!:apple MScgCGdb 30132!:ext cag/ 30133# 30134# URL: https://www.filesuffix.com/de/extension/rra 30135# 3rd directory entry name StrIndex_StringTable 30136>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer 30137#!:mime application/x-ole-storage 30138!:mime application/x-ms-rra 30139!:ext rra 30140# 30141# URL: https://www.forensicswiki.org/wiki/Jump_Lists 30142# 3rd directory entry name DestList 30143>>>>256 lestring16 DestList : Windows jump list 30144#!:mime application/x-ole-storage 30145!:mime application/x-ms-jumplist 30146# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms 30147!:ext automaticDestinations-ms 30148# 30149# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache 30150# Second directory entry name 256_ 30151>>>>128 lestring16 256_ : Windows thumbnail database 256 30152#!:mime application/x-ole-storage 30153!:mime application/x-ms-thumbnail 30154# Thumbs.db 30155!:ext db 30156>>>>128 lestring16 96_ : Windows thumbnail database 96 30157!:mime application/x-ms-thumbnail 30158!:ext db 30159# 3rd directory entry name Catalog_ 30160>>>>256 lestring16 Catalog : Windows thumbnail database 30161!:mime application/x-ms-thumbnail 30162!:ext db 30163# 30164# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches 30165# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based 30166# Second directory entry name Control000 30167>>>>128 lestring16 Control000 : Microsoft old Systeminfo 30168#!:mime application/x-ole-storage 30169!:mime application/x-ms-info 30170!:ext nfo 30171# 30172# From: Joerg Jenderek 30173# URL: https://en.wikipedia.org/wiki/Microsoft_Access 30174# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml 30175# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 30176# Note: only version foo tested and called "Microsoft Access Wizard template" by TrID 30177# Fourth directory entry name TemplateID 30178>>>>384 lestring16 TemplateID : Microsoft Access wizard template 30179# Second directory entry name like \005SummaryInformation and 3rd name like \005DocumentSummaryInformation 30180#!:mime application/x-ole-storage 30181#!:mime application/vnd.ms-office 30182#!:mime application/vnd.ms-access 30183#!:mime application/msaccess 30184!:mime application/x-ms-mdz 30185# http://extension.nirsoft.net/mdz 30186!:ext mdz 30187# 30188# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House 30189# Second directory entry name Thumbnail 30190>>>>128 lestring16 Thumbnail : Corel PrintHouse image 30191#!:mime application/x-ole-storage 30192!:mime application/x-corel-cph 30193!:ext cph 30194# 3rd directory entry name Thumbnail 30195>>>>256 lestring16 Thumbnail : Corel PrintHouse image 30196!:mime application/x-corel-cph 30197!:ext cph 30198# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery 30199# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album 30200# third directory entry name _INFO_ 30201>>>>256 lestring16 _INFO_ : Corel Gallery 30202# second directory entry name _ITEM_ or _DATA_ 30203# later directory entry names: _ALBUM_ _THUMBNAIL_ 30204#!:mime application/x-ole-storage 30205!:mime application/x-corel-gal 30206!:ext gal 30207# 30208# From: Joerg Jenderek 30209# URL: https://archive.org/details/iPhoto-Plus-4 30210# https://filext.com/file-extension/TPL 30211# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml 30212# Note: found in Template sub directory in program directory of software iPhoto Plus version 4 30213# second, third and fourth directory entry name like TplHeader TplMainImage TplPreview 30214>>>>128 lestring16 TplHeader : Ulead iPhoto Template 30215#!:mime application/x-ole-storage 30216!:mime image/x-ulead-tpl 30217# https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template 30218!:ext tpl 30219# 30220# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor) 30221# Note: "HWP Document File" signature found in FileHeader 30222# Second directory entry name FileHeader hint for Thinkfree Office document 30223>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File 30224#!:mime application/haansofthwp 30225!:mime application/x-hwp 30226# https://example-files.online-convert.com/document/hwp/example.hwp 30227!:ext hwp 30228# 30229# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/ 30230# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083 30231>>>>128 lestring16 dd2 : StarOffice Gallery view 30232#!:mime application/x-ole-storage 30233!:mime application/x-star-sdv 30234!:ext sdv 30235# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 30236# second directory entry name Current User 30237>>>>128 lestring16 Current\ User : SoftMaker 30238# third directory entry name SMNativeObjData 30239>>>>>256 lestring16 SMNativeObjData 30240# 5th directory entry name PowerPoint 30241>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template 30242!:mime application/vnd.ms-powerpoint 30243!:ext ppt/pps/pot 30244# 4th directory entry name PowerPoint 30245>>>>>384 lestring16 PowerPoint Presentations or template 30246# http://extension.nirsoft.net/prv 30247!:mime application/vnd.softmaker.presentations 30248!:ext prd/prv 30249# third directory entry name like Current User 30250>>>>256 lestring16 Current\ User : SoftMaker 30251# 5th directory entry name PowerPoint 30252>>>>>512 lestring16 PowerPoint Presentations or template 30253# http://extension.nirsoft.net/prd 30254!:mime application/vnd.softmaker.presentations 30255!:ext prd/prv 30256# 2nd directory entry name Pictures 30257>>>>>>128 lestring16 Pictures with pictures 30258# 30259# URL: http://fileformats.archiveteam.org/wiki/PageMaker 30260# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p 30261# pagemaker-generic.trid.xml 30262# pagemaker-pm6.trid.xml 30263# pagemaker-pm65.trid.xml 30264# pmd-pm7.trid.xml 30265# From: Joerg Jenderek 30266# Note: since version 6 embedd as stream with PageMaker name the "old" format handled by ./wordprocessors 30267# verified by Michal Mutl Structured Storage Viewer `SSView.exe brochus.pt6` 30268# Second directory entry name PageMaker 30269>>>>128 lestring16 PageMaker : 30270# look for magic of "old" PageMaker like in 02TEMPLT.T65 30271>>>>>0 search/0xa900/s \0\0\0\0\0\0\xff\x99 30272# GRR: jump to PageMaker stream and inspect it by sub routine PageMaker of ./wordprocessors failed with wrong version! 30273#>>>>>>&0 use PageMaker 30274# THIS WORKS PARTLY! 30275>>>>>>&0 indirect x 30276# remaining null clsid 30277>>>>128 default x : UNKNOWN 30278# second directory entry name like VisioDocument Control000 30279>>>>>128 lestring16 x with names %.20s 30280# third directory entry like WordDocument 30281>>>>>256 lestring16 x %.20s 30282# forth 30283>>>>>384 lestring16 x %.20s 30284!:mime application/x-ole-storage 30285# according to file version 5.41 with -e soft option 30286#!:mime application/CDFV2 30287#!:ext ??? 30288# look for known clsid GUID 30289# - Visio documents 30290# URL: http://fileformats.archiveteam.org/wiki/Visio 30291# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek 30292>>88 ubequad 0xc000000000000046 : Microsoft 30293>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template 30294!:mime application/vnd.visio 30295# VSD~Drawing VSS~Stencil VST~Template 30296!:ext vsd/vss/vst 30297>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template 30298!:mime application/vnd.visio 30299!:ext vsd/vss/vst 30300# 30301# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer 30302>>>80 ubequad 0x84100c0000000000 Windows Installer Package 30303!:mime application/x-msi 30304#!:mime application/x-ms-win-installer 30305!:ext msi 30306>>>80 ubequad 0x86100c0000000000 Windows Installer Patch 30307# ?? 30308!:mime application/x-wine-extension-msp 30309#!:mime application/x-ms-msp 30310!:ext msp 30311# 30312# URL: http://fileformats.archiveteam.org/wiki/DOC 30313>>>80 ubequad 0x0009020000000000 Word 6-95 document or template 30314!:mime application/msword 30315# for template MSWDW8TN 30316!:apple MSWDWDBN 30317!:ext doc/dot 30318>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template 30319!:mime application/msword 30320!:apple MSWDWDBN 30321# dot for template; no extension on Macintosh 30322!:ext doc/dot/ 30323# 30324# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 30325>>>80 ubequad 0x0213020000000000 Works 3-4 document or template 30326!:mime application/vnd.ms-works 30327!:apple ????AWWP 30328# ps for template https://filext.com/file-extension/PS bps for backup 30329!:ext wps/ps/bps 30330# 30331# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 30332>>>80 ubequad 0x0313020000000000 Works 3-4 database or template 30333!:mime application/vnd.ms-works-db 30334# https://www.macdisk.com/macsigen.php 30335!:apple ????AWDB 30336# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup 30337!:ext wdb/db/bdb 30338# 30339# URL: https://en.wikipedia.org/wiki/Microsoft_Excel 30340>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template 30341!:mime application/vnd.ms-excel 30342# https://www.macdisk.com/macsigen.php 30343!:apple ????XLS5 30344# worksheet/addin/template/no extension on Macintosh 30345!:ext xls/xla/xlt/ 30346# 30347>>>80 ubequad 0x2008020000000000 Excel 97-2003 30348!:mime application/vnd.ms-excel 30349# https://www.macdisk.com/macsigen.php XLS5 for Excel 5 30350!:apple ????XLS9 30351# 3rd directory entry name 30352>>>>256 lestring16 _VBA_PROJECT_CUR addin 30353!:ext xla/ 30354# 4th directory entry name 30355>>>>384 lestring16 _VBA_PROJECT_CUR addin 30356!:ext xla 30357#!:ext xla/ 30358>>>>256 default x worksheet or template 30359!:ext xls/xlt 30360#!:ext xls/xlt/ 30361# 30362# URL: http://fileformats.archiveteam.org/wiki/OLE2 30363>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item 30364#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message 30365#!:mime application/vnd.ms-outlook 30366!:mime application/x-ms-msg 30367!:ext msg 30368# URL: https://wiki.fileformat.com/email/oft/ 30369>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template 30370#!:mime application/vnd.ms-outlook 30371!:mime application/x-ms-oft 30372!:ext oft 30373# 30374# URL: http://fileformats.archiveteam.org/wiki/PPT 30375>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation 30376!:mime application/vnd.ms-powerpoint 30377# https://www.macdisk.com/macsigen.php 30378!:apple ????PPT3 30379!:ext ppt 30380#?? 30381# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/ 30382>>88 ubequad 0xa29a00aa004a1a72 : Microsoft 30383# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 30384>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document 30385!:mime application/vnd.ms-works 30386!:apple ????AWWP 30387!:ext wps 30388# 30389# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database 30390>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database 30391!:mime application/vnd.ms-works-db 30392!:apple ????AWDB 30393!:ext wdb/bdb 30394#?? 30395>>88 ubequad 0xa40700c04fb932ba : Microsoft 30396# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 30397>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document 30398!:mime application/vnd.ms-works 30399!:apple ????AWWP 30400!:ext wps 30401# From: Joerg Jenderek 30402# URL: https://en.wikipedia.org/wiki/Microsoft_Works 30403# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 30404# Note: probably version 6 and 7 30405# organize pictures like JPFG images in streams __cf1 with names like 30406# 001.JPG, 002.JPG ... in streams __fname 30407>>88 ubequad 0xa1c800c04f612452 : Microsoft 30408>>>80 ubequad 0xc0c7266eb98cd311 Works portfolio 30409# 2nd directory entry name PfOrder, 3rd __LastID and 4th __SizeUsed 30410#!:mime application/x-ole-storage 30411# https://www.iana.org/assignments/media-types/application/vnd.ms-works 30412!:mime application/vnd.ms-works 30413# https://extension.nirsoft.net/wsb 30414# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb 30415!:ext wsb 30416#?? 30417# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher 30418>>88 ubequad 0x00c0000000000046 : Microsoft 30419>>>80 ubequad 0x0112020000000000 Publisher 30420!:mime application/vnd.ms-publisher 30421!:ext pub 30422# 30423# URL: http://fileformats.archiveteam.org/wiki/PPT 30424#?? 30425>>88 ubequad 0xa90300aa00510ea3 : Microsoft 30426>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation 30427!:mime application/vnd.ms-powerpoint 30428# https://www.macdisk.com/macsigen.php 30429!:apple ????PPT3 30430!:ext ppt/pot 30431#?? 30432>>88 ubequad 0x86ea00aa00b929e8 : Microsoft 30433>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template 30434!:mime application/vnd.ms-powerpoint 30435!:apple ????PPT3 30436# /autostart/template 30437!:ext ppt/pps/pot 30438# From: Joerg Jenderek 30439# URL: https://www.file-extensions.org/ppa-file-extension 30440# https://en.wikipedia.org/wiki/Microsoft_PowerPoint#cite_note-231 30441# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 30442>>88 ubequad 0x871800aa0060263b : Microsoft 30443# only version 8 (97) tested; PowerPoint 4.0 to 11.0 (2004) (Wikipedia); 97 to 2003 (file-extensions.org) 30444>>>80 ubequad 0xf04672810a72cf11 PowerPoint Addin or Wizard 30445# second, third and fourth directory entry name like VBA PROJECT PROJECTwm 30446# http://extension.nirsoft.net/pwz 30447!:mime application/vnd.ms-powerpoint 30448# like: BSHPPT97.PPA "AutoContent Wizard.pwz" 30449!:ext ppa/pwz 30450# 30451# From: Joerg Jenderek 30452# URL: http://fileformats.archiveteam.org/wiki/AWD_(At_Work_Document) 30453# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/awd-fax.trid.xml 30454# Note: called "Microsoft At Work Fax document" by TrID 30455>>88 ubequad 0xb29400dd010f2bf9 : Microsoft 30456>>>80 ubequad 0x801cb0023de01a10 At Work fax Document 30457#!:mime application/x-ole-storage 30458!:mime image/x-ms-awd 30459!:ext awd 30460# 30461# URL: https://en.wikipedia.org/wiki/Microsoft_Project 30462#?? 30463>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft 30464>>>80 ubequad 0x3a8fb774c8c8d111 Project 30465!:mime application/vnd.ms-project 30466!:ext mpp 30467# From: Joerg Jenderek 30468# URL: https://en.wikipedia.org/wiki/Microsoft_Office_shared_tools#Binder 30469# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/obd.trid.xml 30470# http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 30471# Note: only version 8 tested and called "Office Binder Document" by TrID and 30472# "Microsoft Office Binder File for Windows" version 97-2000 by DROID fmt/240 30473>>88 ubequad 0xb21c00aa004ba90b : Microsoft 30474>>>80 ubequad 0x0004855964661b10 Office Binder Document, Template or wizard 30475# second directory entry name like Binder 30476# https://www.file-extensions.org/obd-file-extension 30477#!:mime application/vnd.ms-binder 30478!:mime application/x-msbinder 30479# obt for template; obz for Microsoft Office Binder wizard 30480!:ext obd/obt/obz 30481# 30482# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 30483# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 30484# https://github.com/OneWingedShark/WordPerfect/ 30485# blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm 30486# From: Joerg Jenderek 30487# Note: internal version x.2 or 2.2 like in embedded ole6-PerfectOffice_MAIN.wpd 30488# 3rd directory entry name PerfectOffice_OBJECT and 2nd PerfectOffice_MAIN, 30489# which contains WordPerfect document \xffWPC signature handled by ./wordprocessors 30490>>88 ubequad 0x19370000929679cd : WordPerfect 7 30491>>>80 ubequad 0xff739851ad2d2002 Document 30492!:mime application/vnd.wordperfect 30493#!:apple ????WPC? 30494# https://fossies.org/linux/wp2latex/test/ole6.wpd 30495!:ext wpd 30496#>>>>0 search/0xc01/s \xffWPC \b, WPC SIGNATURE 30497# inspect embedded WordPerfect document by ./wordprocessors with 1 space at end 30498#>>>>>&0 indirect x \b; contains 30499# GRR: the above expression does not work correctly 30500# 30501# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel) 30502#??? 30503>>88 ubequad 0x99ae04021c007002 : WordPerfect 30504>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation 30505!:mime application/x-corelpresentations 30506#!:mime application/x-shw-viewer 30507#!:mime image/x-presentations 30508!:ext shw 30509# 30510# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/ 30511>>>80 ubequad 0x60fe2e4099191b10 9 Graphic 30512#!:mime application/x-wpg 30513#!:mime image/x-wordperfect-graphics 30514!:mime image/x-wpg 30515# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd 30516!:apple ????WPC9 30517!:ext wpg 30518# 30519# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats 30520>>88 ubequad 0x996104021c007002 : StarOffice 30521>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template 30522# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html 30523!:mime application/x-starwriter 30524!:ext sdw/vor 30525# 30526>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template 30527!:mime application/x-starcalc 30528!:ext sdc/vor 30529# 30530>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template 30531!:mime application/x-starimpress 30532#!:mime application/x-stardraw 30533# sda ?? 30534!:ext sdd/sda/vor 30535#?? 30536>>88 ubequad 0x89cb008029e4b0b1 : StarOffice 30537>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template 30538!:mime application/x-starcalc 30539!:ext sdc/vor 30540# 30541>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template 30542!:mime application/vnd.stardivision.cal 30543!:ext sdc/vor 30544# 30545>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template 30546!:mime application/x-starimpress 30547!:ext sdd/vor 30548#?? 30549>>88 ubequad 0xb12a04021c007002 : StarOffice 30550>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0 30551!:mime application/x-starmath 30552!:ext smf 30553#?? 30554>>88 ubequad 0x8e2c00001b4cc711 : StarOffice 30555>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0 30556!:mime application/x-starchart 30557!:ext sds 30558#?? 30559>>88 ubequad 0xa45e00a0249d57b1 : StarOffice 30560>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template 30561!:mime application/x-starwriter 30562!:ext sdw/vor 30563#?? 30564>>88 ubequad 0x89ca008029e4b0b1 : StarOffice 30565>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0 30566!:mime application/x-starmath 30567!:ext smf 30568# 30569>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0 30570!:mime application/x-starchart 30571!:ext sds 30572#?? 30573>>88 ubequad 0xa53f00a0249d57b1 : StarOffice 30574>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document 30575!:mime application/x-starwriter-global 30576!:ext sgl 30577#?? 30578>>88 ubequad 0x89d0008029e4b0b1 : StarOffice 30579>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0 30580!:mime application/vnd.stardivision.math 30581!:ext smf 30582# 30583>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template 30584!:mime application/vnd.stardivision.draw 30585!:ext sda/vor 30586# 30587>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template 30588!:mime application/vnd.stardivision.impress 30589# sda is used for what? 30590!:ext sdd/vor/sda 30591# 30592>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0 30593!:mime application/vnd.stardivision.chart 30594!:ext sds 30595# ?? 30596>>88 ubequad 0xaab4006097da561a : StarOffice 30597>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template 30598!:mime application/vnd.stardivision.writer 30599!:ext sdw/vor 30600# 30601>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document 30602!:mime application/vnd.stardivision.writer-global 30603!:ext sgl 30604#?? 30605# URL: http://fileformats.archiveteam.org/wiki/FlashPix 30606>>88 ubequad 0x855300aa00a1f95b : Kodak 30607>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image 30608!:mime image/vnd.fpx 30609!:apple ????FPix 30610!:ext fpx 30611# URL: https://en.wikipedia.org/wiki/SoftMaker_Office 30612>>88 ubequad 0x95f600a0cc3cca14 : PlanMaker 30613>>>80 ubequad 0x9174088a6452d411 document or template 30614!:mime application/vnd.softmaker.planmaker 30615# pmv for template https://www.file-extensions.org/pmv-file-extension 30616!:ext pmd/pmv 30617# URL: http://fileformats.archiveteam.org/wiki/MAX_(3ds_Max) 30618# https://en.wikipedia.org/wiki/Autodesk_3ds_Max 30619# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File 30620# Note: called "3D Studio Max Scene" by TrID and "3DS Max" by DROID and 30621# "3DSMax thumbnail" by XnView and verfied by `nconvert -info A380.max` 30622# applies only to "newer" versions (about 2008-2020) 30623>>88 ubequad 0x9fed04143144cc1e : Autodesk 30624>>>80 ubequad 0x7b8cdd1cc081a045 3ds Max 30625#!:mime application/x-ole-storage 30626!:mime model/x-autodesk-max 30627# like: https://static.free3d.com/models/dropbox/dropbox/sq/A380.7z/A380.max 30628!:ext max 30629# also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978 30630#!:ext max/chr 30631# remaining non null clsid 30632>>88 default x 30633# GRR: check again for non null clsid because wrong when called by indirect directive 30634>>>88 ubequad !0 : UNKNOWN 30635# https://reposcope.com/mimetype/application/x-ole-storage 30636!:mime application/x-ole-storage 30637# according to file version 5.41 with -e soft option 30638#!:mime application/CDFV2 30639#!:ext ??? 30640>>>>80 ubequad !0 \b, clsid %#16.16llx 30641>>>>88 ubequad x \b%16.16llx 30642 30643 30644#------------------------------------------------------------------------------ 30645# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 30646# olf: file(1) magic for OLF executables 30647# 30648# We have to check the byte order flag to see what byte order all the 30649# other stuff in the header is in. 30650# 30651# MIPS R3000 may also be for MIPS R2000. 30652# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 30653# 30654# Created by Erik Theisen <etheisen@openbsd.org> 30655# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 306560 string \177OLF OLF 30657>4 byte 0 invalid class 30658>4 byte 1 32-bit 30659>4 byte 2 64-bit 30660>7 byte 0 invalid os 30661>7 byte 1 OpenBSD 30662>7 byte 2 NetBSD 30663>7 byte 3 FreeBSD 30664>7 byte 4 4.4BSD 30665>7 byte 5 Linux 30666>7 byte 6 SVR4 30667>7 byte 7 esix 30668>7 byte 8 Solaris 30669>7 byte 9 Irix 30670>7 byte 10 SCO 30671>7 byte 11 Dell 30672>7 byte 12 NCR 30673>5 byte 0 invalid byte order 30674>5 byte 1 LSB 30675>>16 leshort 0 no file type, 30676>>16 leshort 1 relocatable, 30677>>16 leshort 2 executable, 30678>>16 leshort 3 shared object, 30679# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 30680# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 30681>>16 leshort 4 core file 30682>>>(0x38+0xcc) string >\0 of '%s' 30683>>>(0x38+0x10) lelong >0 (signal %d), 30684>>16 leshort &0xff00 processor-specific, 30685>>18 leshort 0 no machine, 30686>>18 leshort 1 AT&T WE32100 - invalid byte order, 30687>>18 leshort 2 SPARC - invalid byte order, 30688>>18 leshort 3 Intel 80386, 30689>>18 leshort 4 Motorola 68000 - invalid byte order, 30690>>18 leshort 5 Motorola 88000 - invalid byte order, 30691>>18 leshort 6 Intel 80486, 30692>>18 leshort 7 Intel 80860, 30693>>18 leshort 8 MIPS R3000_BE - invalid byte order, 30694>>18 leshort 9 Amdahl - invalid byte order, 30695>>18 leshort 10 MIPS R3000_LE, 30696>>18 leshort 11 RS6000 - invalid byte order, 30697>>18 leshort 15 PA-RISC - invalid byte order, 30698>>18 leshort 16 nCUBE, 30699>>18 leshort 17 VPP500, 30700>>18 leshort 18 SPARC32PLUS, 30701>>18 leshort 20 PowerPC, 30702>>18 leshort 0x9026 Alpha, 30703>>20 lelong 0 invalid version 30704>>20 lelong 1 version 1 30705>>36 lelong 1 MathCoPro/FPU/MAU Required 30706>8 string >\0 (%s) 30707>5 byte 2 MSB 30708>>16 beshort 0 no file type, 30709>>16 beshort 1 relocatable, 30710>>16 beshort 2 executable, 30711>>16 beshort 3 shared object, 30712>>16 beshort 4 core file, 30713>>>(0x38+0xcc) string >\0 of '%s' 30714>>>(0x38+0x10) belong >0 (signal %d), 30715>>16 beshort &0xff00 processor-specific, 30716>>18 beshort 0 no machine, 30717>>18 beshort 1 AT&T WE32100, 30718>>18 beshort 2 SPARC, 30719>>18 beshort 3 Intel 80386 - invalid byte order, 30720>>18 beshort 4 Motorola 68000, 30721>>18 beshort 5 Motorola 88000, 30722>>18 beshort 6 Intel 80486 - invalid byte order, 30723>>18 beshort 7 Intel 80860, 30724>>18 beshort 8 MIPS R3000_BE, 30725>>18 beshort 9 Amdahl, 30726>>18 beshort 10 MIPS R3000_LE - invalid byte order, 30727>>18 beshort 11 RS6000, 30728>>18 beshort 15 PA-RISC, 30729>>18 beshort 16 nCUBE, 30730>>18 beshort 17 VPP500, 30731>>18 beshort 18 SPARC32PLUS, 30732>>18 beshort 20 PowerPC or cisco 4500, 30733>>18 beshort 21 cisco 7500, 30734>>18 beshort 24 cisco SVIP, 30735>>18 beshort 25 cisco 7200, 30736>>18 beshort 36 cisco 12000, 30737>>18 beshort 0x9026 Alpha, 30738>>20 belong 0 invalid version 30739>>20 belong 1 version 1 30740>>36 belong 1 MathCoPro/FPU/MAU Required 30741 30742#------------------------------------------------------------------------------ 30743# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $ 30744# openfs: file(1) magic for OpenFST (Weighted finite-state tranducer library) 30745 307460 long 0x7eb2fdd6 OpenFst binary FST data 30747>&0 pstring/l x \b, fst type: %s 30748>>&0 pstring/l x \b, arc type: %s 30749>>>&0 long x \b, version: %d 30750>>>>&20 quad x \b, num states: %lld 30751>>>>>&0 quad >0 \b, num arcs: %lld 30752 307530 long 0x56515c OpenFst binary FAR data, far type: stlist 30754>4 long x \b, version: %d 30755 307560 long 0x7eb2f35c OpenFst binary FAR data, far type: sttable 30757>4 long x \b, version: %d 30758 30759#------------------------------------------------------------ 30760# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $ 30761# OpenTimestamps related magic entries 30762# https://opentimestamps.org/ 30763# https://en.wikipedia.org/wiki/OpenTimestamps 30764# "Emanuele Cisbani" <emanuele.cisbani@gmail.com> 30765#------------------------------------------------------------ 30766 30767# OpenTimestamps Proof .ots format. 30768# Magic is defined here: 30769# https://github.com/opentimestamps/python-opentimestamps/\ 30770# blob/master/opentimestamps/core/timestamp.py#L273 30771 307720 string \x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps 30773>16 string \x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof 30774 30775#------------------------------------------------------------------------------ 30776# $File: oric,v 1.2 2022/04/25 17:28:20 christos Exp $ 30777# Oric tape files 30778# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org> 30779# References: 30780# http://fileformats.archiveteam.org/wiki/TAP_(Oric) 30781# http://fileformats.archiveteam.org/wiki/DSK_(Oric) 307820 string \x16\x16\x16\x24 Oric tape, 30783>6 byte =0x00 BASIC, 30784>6 byte =0x80 memory block, 30785>7 byte >0x00 autorun, 30786>13 string x "%.15s" 30787 307880 string ORICDISK Oric Image 307890 string MFM_DISK Oric Image 30790 30791#------------------------------------------------------------------------------ 30792# $File: os2,v 1.14 2022/03/21 21:25:50 christos Exp $ 30793# os2: file(1) magic for OS/2 files 30794# 30795 30796# Provided 1998/08/22 by 30797# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 307981 search/100 InternetShortcut MS Windows 95 Internet shortcut text 30799!:mime application/x-mswinurl 30800!:ext url 30801>17 search/100 URL= (URL=< 30802>>&0 string x \b%s>) 30803 30804# OS/2 URL objects 30805# Provided 1998/08/22 by 30806# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 30807#0 string http: OS/2 URL object text 30808#>5 string >\ (WWW) <http:%s> 30809#0 string mailto: OS/2 URL object text 30810#>7 string >\ (email) <%s> 30811#0 string news: OS/2 URL object text 30812#>5 string >\ (Usenet) <%s> 30813#0 string ftp: OS/2 URL object text 30814#>4 string >\ (FTP) <ftp:%s> 30815#0 string file: OS/2 URL object text 30816#>5 string >\ (Local file) <%s> 30817 30818# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 30819# URL: http://fileformats.archiveteam.org/wiki/INF/HLP_(OS/2) 30820# Reference: http://www.edm2.com/0308/inf.html 30821# Carl Hauser (chauser.parc@xerox.com) and 30822# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 30823# list the following header format in inf02a.doc: 30824# 30825# int16 ID; // ID magic word (5348h = "HS") 30826# int8 unknown1; // unknown purpose, could be third letter of ID 30827# int8 flags; // probably a flag word... 30828# // bit 0: set if INF style file 30829# // bit 4: set if HLP style file 30830# // patching this byte allows reading HLP files 30831# // using the VIEW command, while help files 30832# // seem to work with INF settings here as well. 30833# int16 hdrsize; // total size of header 30834# int16 unknown2; // unknown purpose 30835# 308360 string HSP\x01\x9b\x00 OS/2 INF 30837!:mime application/x-os2-inf 30838!:ext inf 30839>107 string >0 (%s) 308400 string HSP\x10\x9b\x00 OS/2 HLP 30841!:mime application/x-os2-hlp 30842!:ext hlp 30843>107 string >0 (%s) 30844 30845# From: Joerg Jenderek 30846# URL: http://fileformats.archiveteam.org/wiki/MSG_(OS/2) 30847# Reference: https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/blob/master/mkmsgf.h 30848# Note: created by MKMSGF.EXE. Text source can be recreated by E_MSGF 30849# example like OS001H.MSG 308500 string \xffMKMSGF\0 OS/2 help message 30851!:mime application/x-os2-msg 30852!:ext msg 30853# identifier[3] like: DOS NET REX SYS ... 30854>8 string x '%.3s' 30855# msgnumber: number of messages 30856>11 uleshort x \b, %u messages 30857# firstmsgnumber; number of the first message like: some times 0 often 1 169 1000 3502 30858>13 uleshort >1 \b, 1st number %u 30859# offset16bit; 1~Index table has 16-bit offsets (files<64k) 0~Index table has 32-bit offsets 30860>15 ubyte =0 \b, 32-bit 30861#>15 ubyte =1 \b, 16-bit 30862# version; file version: 2~new 0~old 30863>16 uleshort !2 \b, version %u 30864# indextaboffset; offset of index table: 1F~after header 0~no index table for version 0? 30865>18 uleshort >0 30866>>18 uleshort !0x1f \b, at %#x index 30867# 32-bit offset 30868>>15 ubyte =0 30869# offset with message table 30870>>>(18.s) ulelong x \b, at %#x 30871# 1st message 30872# http://www.os2museum.com/files/docs/os210ptk/os2-1.0-ptk-tools-1988.pdf 30873# message type: E~Error H~Help I~Information P~Prompt W~Warning ? 30874>>>>(&-4.l) ubyte x %c-type 30875>>>>>&0 string x %s 30876# 16-bit offset 30877>>15 ubyte =1 30878# msgnum; message number 30879>>>(18.s) uleshort x \b, number %u 30880# msgindex; offset of message from begin of file 30881>>>(18.s+2) uleshort x at %#x 30882# message type E H I P W ? 30883>>>>(&-2.s) ubyte x %c-type 30884# skip newline carriage return 30885>>>>>&0 ubeshort =0x0D0a 30886>>>>>>&0 string x %s 30887>>>>>&0 ubeshort !0x0D0a 30888>>>>>>&-2 string x %s 30889# for version 0 index table apparently at offset 1F 30890>16 uleshort 0 30891>>15 ubyte 1 30892# 1st message 16-bit 30893>>>0x1F uleshort x \b, at %#x 30894# message type: E~Error H~Help I~Information P~Prompt W~Warning ? 30895>>>>(0x1F.s) ubyte x %c-type 30896>>>>>&0 string x %s 30897# 2nd message 16-bit 30898>>>0x21 uleshort x \b, at %#x 30899>>>>(0x21.s) ubyte x %c-type 30900>>>>>&0 string x %s 30901# 3rd message 16-bit 30902>>>0x23 uleshort x \b, at %#x 30903>>>>(0x23.s) ubyte x %c-type 30904>>>>>&0 string x %s 30905# version 0 32-bit 30906>>15 ubyte 0 30907# 1st message 32-bit 30908>>>0x1f ulelong x \b, at %#x 30909>>>>(0x1F.l) ubyte x %c-type 30910>>>>>&0 string x %s 30911# 2nd message 32-bit 30912>>>0x23 ulelong x \b, at %#x 30913>>>>(0x23.l) ubyte x %c-type 30914>>>>>&0 string x %s 30915# 3rd message 32-bit 30916>>>0x27 ulelong x \b, AT %#x 30917>>>>(0x27.l) ubyte x %c-type 30918>>>>>&0 string x %s 30919# countryinfo; offset of country info block: 0 for version 0 30920>20 uleshort !0 \b, at %#x countryinfo 30921# nextcoutryinfo 30922>>22 uleshort >0 \b, at %#x next 30923# reserved[5]; Must be 0 30924>>25 ulelong !0 \b, RESERVED %#x 30925>>(20.s) use os2-msg-info 30926# display country info block of MKMSGF message file 309270 name os2-msg-info 30928# bytesperchar; bytes per char: 1~SBCS 2~DBCS 30929>0 ubyte >1 \b, %u bytes/char 30930# reserved; Not known 30931>1 uleshort !0 \b, reserved %#x 30932# langfamilyID; language family ID like: 0~? 1~Arabic ... 7~German ... 9~English ... 34~Slovene 30933>3 uleshort >0 \b, language %u 30934# langversionID; like: 7_1~German 7_2~Swiss German 12_1~French 12_3~Canadian French 30935>>5 uleshort x \b_%u 30936# langfamilyID too high. This should not happen 30937>3 uleshort >34 (invalid language) 30938# codepagesnumber; number of codepages like: 1 2 ... 16 30939>7 uleshort x \b, %u code page 30940# plural s 30941>7 uleshort >1 \bs 30942# too many number of codepages. This should not happen 30943>7 uleshort >16 (Too many) 30944# codepages[16]; codepages list like 437 850 ... 30945>7 uleshort <17 30946# 1st code page 30947>>9 uleshort >0 %u 30948# possible 2nd code page number 30949>>>7 uleshort >1 30950>>>>11 uleshort x %u 30951# filename[260]; name of file like: dbaseos2.msg dde4c01e.msg os2ldr.mgr xdfh.msg ... 30952>41 string x \b, %s 30953 30954# OS/2 INI (this is a guess) 309550 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 30956!:mime application/x-os2-ini 30957!:ext ini 30958 30959# From: Joerg Jenderek 30960# URL: http://warpin.netlabs.org/ 30961# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/ark-wpi.trid.xml 30962# Note: called by TrID "WarpIN Installer" 30963# probably magic at the beginning 309640 ubelong =0x770402BE WarpIN Installer 30965#>4 ubelong =0x03000000 30966#!:mime application/octet-stream 30967!:mime application/x-os2-wpi 30968!:ext wpi 30969# creator program name like: "reserved" or "WIC x.y.z" 30970>0x106 string x \b, created by %s 30971# name like: "reserved" or "OS/2 Netlabs" 30972>0x146 string x \b, '%s' 30973# name like: "N/A" "http://warpin.netlabs.org" 30974>0x186 string x \b, URL %s 30975 30976 30977#------------------------------------------------------------------------------ 30978# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 30979# os400: file(1) magic for IBM OS/400 files 30980# 30981# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 30982# In spite of its quite variable format (due to internal memory page 30983# length differences between CISC and RISC versions of the OS) the 30984# SAVF structure hasn't suitable offsets to identify the catalog 30985# header in the first descriptor where there are some useful infos, 30986# so we must search in a somewhat large area for a particular string 30987# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 30988# descriptor space) preceded by a two byte constant. 30989# 309901090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 30991>&212 byte 0x01 \b, created with SAVOBJ 30992>&212 byte 0x02 \b, created with SAVLIB 30993>&212 byte 0x07 \b, created with SAVCFG 30994>&212 byte 0x08 \b, created with SAVSECDTA 30995>&212 byte 0x0A \b, created with SAVSECDTA 30996>&212 byte 0x0B \b, created with SAVDLO 30997>&212 byte 0x0D \b, created with SAVLICPGM 30998>&212 byte 0x11 \b, created with SAVCHGOBJ 30999>&213 byte 0x44 \b, at least V5R4 to open 31000>&213 byte 0x43 \b, at least V5R3 to open 31001>&213 byte 0x42 \b, at least V5R2 to open 31002>&213 byte 0x41 \b, at least V5R1 to open 31003>&213 byte 0x40 \b, at least V4R5 to open 31004>&213 byte 0x3F \b, at least V4R4 to open 31005>&213 byte 0x3E \b, at least V4R3 to open 31006>&213 byte 0x3C \b, at least V4R2 to open 31007>&213 byte 0x3D \b, at least V4R1M4 to open 31008>&213 byte 0x3B \b, at least V4R1 to open 31009>&213 byte 0x3A \b, at least V3R7 to open 31010>&213 byte 0x35 \b, at least V3R6 to open 31011>&213 byte 0x36 \b, at least V3R2 to open 31012>&213 byte 0x34 \b, at least V3R1 to open 31013>&213 byte 0x31 \b, at least V3R0M5 to open 31014>&213 byte 0x30 \b, at least V2R3 to open 31015 31016#------------------------------------------------------------------------------ 31017# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $ 31018# 31019# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 31020# 31021# Redistribution and use in source and binary forms, with or without 31022# modification, are permitted provided that the following conditions 31023# are met: 31024# 1. Redistributions of source code must retain the above copyright 31025# notice, this list of conditions and the following disclaimer. 31026# 2. Redistributions in binary form must reproduce the above copyright 31027# notice, this list of conditions and the following disclaimer in the 31028# documentation and/or other materials provided with the distribution. 31029# 31030# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 31031# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 31032# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 31033# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 31034# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 31035# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 31036# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 31037# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 31038# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 31039# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31040# 31041# 31042# 31043# OS9/6809 module descriptions: 31044# 310450 beshort 0x87CD OS9/6809 module: 31046# 31047>6 byte&0x0f 0x00 non-executable 31048>6 byte&0x0f 0x01 machine language 31049>6 byte&0x0f 0x02 BASIC I-code 31050>6 byte&0x0f 0x03 Pascal P-code 31051>6 byte&0x0f 0x04 C I-code 31052>6 byte&0x0f 0x05 COBOL I-code 31053>6 byte&0x0f 0x06 Fortran I-code 31054# 31055>6 byte&0xf0 0x10 program executable 31056>6 byte&0xf0 0x20 subroutine 31057>6 byte&0xf0 0x30 multi-module 31058>6 byte&0xf0 0x40 data module 31059# 31060>6 byte&0xf0 0xC0 system module 31061>6 byte&0xf0 0xD0 file manager 31062>6 byte&0xf0 0xE0 device driver 31063>6 byte&0xf0 0xF0 device descriptor 31064# 31065# OS9/m68k stuff (to be continued) 31066# 310670 beshort 0x4AFC OS9/68K module: 31068# 31069# attr 31070>0x14 byte&0x80 0x80 re-entrant 31071>0x14 byte&0x40 0x40 ghost 31072>0x14 byte&0x20 0x20 system-state 31073# 31074# lang: 31075# 31076>0x13 byte 1 machine language 31077>0x13 byte 2 BASIC I-code 31078>0x13 byte 3 Pascal P-code 31079>0x13 byte 4 C I-code 31080>0x13 byte 5 COBOL I-code 31081>0x13 byte 6 Fortran I-code 31082# 31083# 31084# type: 31085# 31086>0x12 byte 1 program executable 31087>0x12 byte 2 subroutine 31088>0x12 byte 3 multi-module 31089>0x12 byte 4 data module 31090>0x12 byte 11 trap library 31091>0x12 byte 12 system module 31092>0x12 byte 13 file manager 31093>0x12 byte 14 device driver 31094>0x12 byte 15 device descriptor 31095 31096#------------------------------------------------------------------------------ 31097# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 31098# 31099# Mach magic number info 31100# 311010 long 0xefbe OSF/Rose object 31102# I386 magic number info 31103# 311040 short 0565 i386 COFF object 31105 31106#------------------------------------------------------------------------------ 31107# $File: palm,v 1.15 2021/12/16 21:50:06 christos Exp $ 31108# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 31109# 31110# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 31111 31112# These are weak, byte 59 is not guaranteed to be 0 and there are 31113# 8 character identifiers at byte 60, one I found for appl is BIGb. 31114# What are the possibilities and where is this documented? 31115 31116# The common header format for PalmOS .pdb/.prc files is 31117# { 31118# char name[ 32 ]; 31119# Word attributes; 31120# Word version; 31121# DWord creationDate; 31122# DWord modificationDate; 31123# DWord lastBackupDate; 31124# DWord modificationNumber; 31125# DWord appInfoID; 31126# DWord sortInfoID; 31127# char type[4]; 31128# char creator[4]; 31129# DWord uniqueIDSeed; 31130# RecordListType recordList; 31131# }; 31132# 31133# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 31134# or Unix/POSIX time + 2082844800. 31135 311360 name aportisdoc 31137# date is supposed to be big-endian seconds since 1 Jan 1904, but many 31138# files contain the timestamp in little-endian or a completely 31139# nonsensical value... 31140#>36 bedate-2082844800 >0 \b, created %s 31141# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 31142>(78.L) beshort =1 \b, uncompressed 31143# compressed 31144>(78.L) beshort >1 31145>>(78.L+4) belong x \b, %d bytes uncompressed 31146 31147# appl 31148#60 string appl PalmOS application 31149#>0 string >\0 "%s" 31150 31151# HACK 31152#60 string HACK HackMaster hack 31153#>0 string >\0 "%s" 31154 31155# iSiloX e-book 3115660 string SDocSilX iSiloX E-book 31157>0 string >\0 "%s" 31158 31159# Mobipocket (www.mobipocket.com), donated by Carl Witty 31160# expanded by Ralf Brown 3116160 string BOOKMOBI Mobipocket E-book 31162!:mime application/x-mobipocket-ebook 31163# MobiPocket stores a full title, pointed at by the belong at offset 31164# 0x54 in its header at (78.L), with length given by the belong at 31165# offset 0x58. 31166# there's no guarantee that the title string is null-terminated, but 31167# we currently can't specify a variable-length string where the length 31168# field is not at the start of the string; in practice, the data 31169# following the string always seems to start with a zero byte 31170>(78.L) belong x 31171>>&(&0x50.L-4) string >\0 "%s" 31172>0 use aportisdoc 31173>>(78.L+0x68) belong >0 \b, version %d 31174>>(78.L+0x1C) belong !0 \b, codepage %d 31175>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 31176 31177# AportisDoc/PalmDOC 3117860 string TEXtREAd AportisDoc/PalmDOC E-book 31179>0 string >\0 "%s" 31180>0 use aportisdoc 31181 31182# Variety of PalmOS document types 31183# Michael-John Turner <mj@debian.org> 31184# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 3118560 string BVokBDIC BDicty PalmOS document 31186>0 string >\0 "%s" 3118760 string DB99DBOS DB PalmOS document 31188>0 string >\0 "%s" 3118960 string vIMGView FireViewer/ImageViewer PalmOS document 31190>0 string >\0 "%s" 3119160 string PmDBPmDB HanDBase PalmOS document 31192>0 string >\0 "%s" 3119360 string InfoINDB InfoView PalmOS document 31194>0 string >\0 "%s" 3119560 string ToGoToGo iSilo PalmOS document 31196>0 string >\0 "%s" 3119760 string JfDbJBas JFile PalmOS document 31198>0 string >\0 "%s" 3119960 string JfDbJFil JFile Pro PalmOS document 31200>0 string >\0 "%s" 3120160 string DATALSdb List PalmOS document 31202>0 string >\0 "%s" 3120360 string Mdb1Mdb1 MobileDB PalmOS document 31204>0 string >\0 "%s" 3120560 string PNRdPPrs PeanutPress PalmOS document 31206>0 string >\0 "%s" 3120760 string DataPlkr Plucker PalmOS document 31208>0 string >\0 "%s" 3120960 string DataSprd QuickSheet PalmOS document 31210>0 string >\0 "%s" 3121160 string SM01SMem SuperMemo PalmOS document 31212>0 string >\0 "%s" 3121360 string TEXtTlDc TealDoc PalmOS document 31214>0 string >\0 "%s" 3121560 string InfoTlIf TealInfo PalmOS document 31216>0 string >\0 "%s" 3121760 string DataTlMl TealMeal PalmOS document 31218>0 string >\0 "%s" 3121960 string DataTlPt TealPaint PalmOS document 31220>0 string >\0 "%s" 3122160 string dataTDBP ThinkDB PalmOS document 31222>0 string >\0 "%s" 3122360 string TdatTide Tides PalmOS document 31224>0 string >\0 "%s" 3122560 string ToRaTRPW TomeRaider PalmOS document 31226>0 string >\0 "%s" 31227 31228# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 31229# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 31230# annotations. 31231# For other versions, just outputs version. 31232# 3123360 string zTXT A GutenPalm zTXT e-book 31234>0 string >\0 "%s" 31235>(0x4E.L) byte 0 31236>>(0x4E.L+1) byte x (v0.%02d) 31237>(0x4E.L) byte 1 31238>>(0x4E.L+1) byte x (v1.%02d) 31239>>>(0x4E.L+10) beshort >0 31240>>>>(0x4E.L+10) beshort <2 - 1 bookmark 31241>>>>(0x4E.L+10) beshort >1 - %d bookmarks 31242>>>(0x4E.L+14) beshort >0 31243>>>>(0x4E.L+14) beshort <2 - 1 annotation 31244>>>>(0x4E.L+14) beshort >1 - %d annotations 31245>(0x4E.L) byte >1 (v%d. 31246>>(0x4E.L+1) byte x %02d) 31247 31248# Palm OS .prc file types 3124960 string libr 31250# flags, only bit 0 or bit 6 31251# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 31252# https://web.mit.edu/tytso/www/pilot/prc-format.html 31253>0x20 beshort&0xffbe 0 31254>>0 string >\0 Palm OS dynamic library data "%s" 3125560 string ptch Palm OS operating system patch data 31256>0 string >\0 "%s" 31257 31258# Mobipocket (www.mobipocket.com), donated by Carl Witty 3125960 string BOOKMOBI Mobipocket E-book 31260>0 string >\0 "%s" 31261 31262#------------------------------------------------------------------------------ 31263# $File: parix,v 1.5 2020/03/08 22:18:32 christos Exp $ 31264# 31265# Parix COFF executables 31266# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 31267# 312680 beshort&0xefff 0x8ACE PARIX 31269>0 byte&0xf0 0x80 T800 31270>0 byte&0xf0 0x90 T9000 31271>19 byte&0x02 0x02 executable 31272>19 byte&0x02 0x00 object 31273>19 byte&0x0c 0x00 not stripped 31274#------------------------------------------------------------------------------ 31275# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $ 31276# parrot: file(1) magic for Parrot Virtual Machine 31277# URL: https://www.lua.org/ 31278# From: Lubomir Rintel <lkundrak@v3.sk> 31279 31280# Compiled Parrot byte code 312810 string \376PBC\r\n\032\n Parrot bytecode 31282>64 byte x %d. 31283>72 byte x \b%d, 31284>8 byte >0 %d byte words, 31285>16 byte 0 little-endian, 31286>16 byte 1 big-endian, 31287>32 byte 0 IEEE-754 8 byte double floats, 31288>32 byte 1 x86 12 byte long double floats, 31289>32 byte 2 IEEE-754 16 byte long double floats, 31290>32 byte 3 MIPS 16 byte long double floats, 31291>32 byte 4 AIX 16 byte long double floats, 31292>32 byte 5 4-byte floats, 31293>40 byte x Parrot %d. 31294>48 byte x \b%d. 31295>56 byte x \b%d 31296#------------------------------------------------------------------------------ 31297# $File: pascal,v 1.4 2022/07/30 16:53:06 christos Exp $ 31298# pascal: file(1) magic for Pascal source 31299# 313000 search/8192 (input, Pascal source text 31301!:mime text/x-pascal 31302#0 regex \^program Pascal source text 31303#!:mime text/x-pascal 31304#0 regex \^record Pascal source text 31305#!:mime text/x-pascal 31306 31307# Free Pascal 313080 string PPU Pascal unit 31309>3 string x \b, version %s 31310 31311# From: Joerg Jenderek 31312# URL: https://en.wikipedia.org/wiki/Dan_Bricklin 313130 string/b Type 31314# URL: https://dl.winworldpc.com/Dan%20Bricklins%20Demo%20II%20Version%202%20Manual.7z 31315# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbd-v2.trid.xml 31316>4 string D2 Dan Bricklin's Demo 2 demo 31317#!:mime application/octet-stream 31318!:ext dbd 31319# URL: https://muhaz.org/turbo-pascal-download-details.html 31320# From: Joerg Jenderek 31321# Note: used by Turbo Pascal 5.5 TOUR.EXE 31322>4 string T2 Turbo Pascal TOUR data 31323#!:mime application/octet-stream 31324!:mime application/x-borland-cbt 31325!:ext cbt 31326# WHAT iS THAT? 31327#>4 string \040P Dan Bricklin's Demo 2 foo 31328#!:mime application/octet-stream 31329# _PPRINT.SG2 _PASCII.SG2 31330#!:ext sg2 31331# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbd-gen.trid.xml 31332>4 default x Dan Bricklin's Demo demo (generic) 31333#!:mime application/octet-stream 31334!:ext dbd 31335 31336#------------------------------------------------------------------------------ 31337# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $ 31338# file(1) magic(5) data for OpenStreetMap 31339 31340# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 31341# https://wiki.openstreetmap.org/wiki/PBF_Format 31342# From: Markus Heidelberg <markus.heidelberg@web.de> 313430 belong&0xfffffff0 0 31344>4 beshort 0x0A09 31345>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 31346 31347#------------------------------------------------------------------------------ 31348# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 31349# pbm: file(1) magic for Portable Bitmap files 31350# 31351# XXX - byte order? 31352# 313530 short 0x2a17 "compact bitmap" format (Poskanzer) 31354#------------------------------------------------------------------------------ 31355# pc88: file(1) magic for the NEC Home Computer 31356# v1.0 31357# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 31358 31359# PC88 2D disk image 313600x20 ulelong&0xFFFFFEFF 0x2A0 31361>0x10 string \0\0\0\0\0\0\0\0\0\0 31362>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 31363>>>0x1A ubyte&0xEF 0 31364>>>>0x1B ubyte&0x8F 0 31365>>>>>0x1B ubyte&70 <0x40 31366>>>>>>0x1C ulelong >0x21 31367>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 31368>>>>>>>>0x1B ubyte 0 \b, media=2D 31369>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 31370>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 31371>>>>>>>>0x1B ubyte 0x30 \b, media=1D 31372>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 31373>>>>>>>>0x1A ubyte 0x10 \b, write-protected 31374 31375 31376 31377 31378#------------------------------------------------------------------------------ 31379# pc98: file(1) magic for the MSX Home Computer 31380# v1.0 31381# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 31382 31383# Maki-chan v1 Graphic format 31384# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so 31385# http://www.jisyo.com/viewer/faq/maki_tech.htm 313860 string/b MAKI01 Maki-chan v1. 31387>6 ubyte|0x20 x \b%c image 31388>8 ubelong >0x40404040 \b, system ID: 31389>>8 byte x %c 31390>>9 byte x \b%c 31391>>10 byte x \b%c 31392>>11 byte x \b%c 31393>44 ubeshort x \b, %dx 31394>46 ubeshort x \b%d 31395>38 ubeshort&2 0 \b, 16 paletted RGB colors 31396>38 ubeshort&2 2 \b, 8 fixed RGB colors 31397>38 ubeshort&1 1 \b, 2:1 dot aspect ratio 31398 31399# Maki-chan v2 Graphic format 31400# http://www.jisyo.com/viewer/faq/mag_tech.htm 31401# https://mooncore.eu/bunny/txt/makichan.htm 31402# http://metanest.jp/mag/mag.xhtml 314030 string/b MAKI02\ \ Maki-chan v2 image, 31404>8 byte x system ID: %c 31405>9 byte x \b%c 31406>10 byte x \b%c 31407>11 byte x \b%c, 31408>13 search/0x200 \x1A 31409#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing: 31410#1) When offset1(ubeshort) !=0x0344: 31411# 1.1) And offset3(ubyte).b7=0: 31412# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1) 31413# - b1=number of colors: 0=16 colors, 1=8 colors 31414# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data 31415# 1.2) And offset3(ubyte).B7=1: 31416# - b0=256 paletted colors 31417# - b1=256 fixed colors using the MSX SCR8 palette 31418#2) When offset1(ubeshort) =0x0344: 31419# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored 31420>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors 31421>>&1 ubeshort !0x0344 31422>>>&5 uleshort+1 x %dx 31423>>>&7 uleshort+1 x \b%d, 31424>>>&0 ubyte&0x86 0x00 16 paletted RGB colors 31425>>>&0 ubyte&0x86 0x02 8 paletted RGB colors 31426>>>&0 ubyte&0x86 0x04 16 fixed RGB colors 31427>>>&0 ubyte&0x86 0x06 8 fixed RGB colors 31428>>>&0 ubyte&0x81 0x80 256 paletted RGB colors 31429>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors 31430>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio 31431 31432# XLD4 (Q4) picture 3143311 string/b MAJYO XLD4(Q4) picture 31434 31435# Yanagisawa Pi picture 31436#0 string Pi\x1A\0 Yanagisawa Pi picture 31437#>3 search/0x200 \x04 314380 string Pi 31439>2 search/0x200 \x1A 31440>>&0 ubyte 0 31441>>>&3 ubyte 4 Yanagisawa Pi 16 color picture, 31442>>>&4 byte x system ID: %c 31443>>>&5 byte x \b%c 31444>>>&6 byte x \b%c 31445>>>&7 byte x \b%c, 31446>>>&10 ubeshort x %dx 31447>>>&12 ubeshort x \b%d 31448>>>&3 ubyte 8 Yanagisawa Pi 256 color picture 31449>>>&4 byte x system ID: %c 31450>>>&5 byte x \b%c 31451>>>&6 byte x \b%c 31452>>>&7 byte x \b%c, 31453>>>&10 ubeshort x %dx 31454>>>&12 ubeshort x \b%d 31455 31456#------------------------------------------------------------------------------ 31457# $File: pci_ids,v 1.1 2022/04/02 14:47:42 christos Exp $ 31458# pci.ids: file(1) magic for PCI specific informations 31459# 31460 31461# Vendor identification (ID) https://pci-ids.ucw.cz/v2.2/pci.ids 31462# show hexadecimal PCI vendor identification in human readable text form 314630 name PCI-vendor 31464# ID vendor name 31465#>0 uleshort =0x0f00 fOO 31466>0 uleshort =0x1000 Broadcom 31467>0 uleshort =0x1002 AMD/ATI 31468>0 uleshort =0x1013 Cirrus Logic 31469>0 uleshort =0x1014 IBM 31470>0 uleshort =0x1022 AMD 31471>0 uleshort =0x1050 Winbond 31472>0 uleshort =0x105a Promise 31473>0 uleshort =0x1095 Silicon 31474>0 uleshort =0x10EC Realtek 31475>0 uleshort =0x10de NVIDIA 31476>0 uleshort =0x1106 VIA 31477# Woodward McCoach, Inc. 31478>0 uleshort =0x1231 Woodward 31479# 31480>0 uleshort =0x1234 Bochs 31481>0 uleshort =0x15ad VMware 31482>0 uleshort =0x1af4 Virtio 31483>0 uleshort =0x1b36 QEMU 31484>0 uleshort =0x1de1 Tekram 31485# maybe also Promise? 31486#>0 uleshort =0x4289 Promise 31487#>0 uleshort =0x66a1 FOO 31488>0 uleshort =0x8086 Intel 31489>0 uleshort =0x9004 Adaptec 31490# also Adaptec; but no example 31491>0 uleshort =0x9005 Adaptec 31492# for unknown/missing manufactors 31493>0 default x UNKNOWN 31494>>0 uleshort x (%#4.4x) 31495 31496# https://blog.ladsai.com/pci-configuration-space-class-code.html 31497# Base class code https://wiki.osdev.org/PCI 31498# show hexadecimal PCI class+sub+ProgIF identification in human readable text form 314990 name PCI-class 31500#>0 ubyte x CLASS=%x 31501>0 ubyte x 31502# Device was built prior definition of the class code field 31503>>0 ubyte 0x00 PRIOR 31504# Any device except for VGA-Compatible devices like: 2975BIOS.BIN Trm3x5.bin 31505# BUT also NVidia44.bin vgabios-stdvga-bin.rom 31506#>>>0 ubyte 0x00 NOT VGA 31507# VGA-Compatible Device; NO EXAMPLE found here!! 31508#>>>0 ubyte 0x01 VGA 31509# like 4243.bin 31510#>>>0 ubyte 0x04 SUB_CLASS_4 31511>>0 ubyte 0x01 storage controller 31512# device sub-type and its definition is dependent upon the base-type code 31513>>>1 ubyte 0x00 SCSI 31514>>>1 ubyte 0x01 IDE 31515>>>1 ubyte 0x02 Floppy 31516>>>1 ubyte 0x03 IPI 31517>>>0 ubyte 0x04 RAID 31518>>>1 ubyte 0x05 ATA 31519>>>1 ubyte 0x06 SATA 31520>>>1 ubyte 0x07 SAS 31521>>>1 ubyte 0x08 NVM 31522# 4650_sr5.bin "PROMISE" "FT TX4650 Ary X" 31523>>>1 ubyte 0x80 OTHER 31524>>0 ubyte 0x02 network controller 31525>>>1 ubyte 0x00 ethernet 31526>>>1 ubyte 0x01 token ring 31527>>>1 ubyte 0x02 FDDI 31528>>>1 ubyte 0x03 ATM 31529>>>1 ubyte 0x04 ISDN 31530>>>1 ubyte 0x05 WorldFip 31531# PICMG 2.14 Multi Computing 31532>>>1 ubyte 0x06 PICMG 31533>>>1 ubyte 0x80 OTHER 31534>>0 ubyte 0x03 display controller 31535>>0 ubyte 0x04 multimedia controller 31536>>0 ubyte 0x05 memory controller 31537>>0 ubyte 0x06 bridge device 31538# Simple Communication Controllers 31539>>0 ubyte 0x07 communication controller 31540# Base System Peripherals 31541>>0 ubyte 0x08 base peripheral 31542# Input Devices 31543>>0 ubyte 0x09 input device 31544# Docking Stations 31545>>0 ubyte 0x0A docking station 31546>>0 ubyte 0x0B processor 31547>>0 ubyte 0x0C serial bus controller 31548>>0 ubyte 0x0D wireless controller 31549# Intelligent I/O Controllers 31550>>0 ubyte 0x0E I/O controller 31551# Satellite Communication Controllers 31552>>0 ubyte 0x0F satellite controller 31553# Encryption/Decryption Controllers 31554>>0 ubyte 0x10 encryption controller 31555# Data Acquisition and Signal Processing Controllers 31556>>0 ubyte 0x11 signal controller 31557# Processing Accelerator 31558>>0 ubyte 0x12 processing accelerator 31559# Non-Essential Instrumentation 31560>>0 ubyte 0x13 non-essential 31561# reserved or unassigned 31562>>0 default x 31563# device does not fit any defined class; Unassigned Class (Vendor specific) 31564>>>0 ubyte 0xFF UNASSIGNED 31565# THIS SHOULD NOT HAPPEN! BUT CLASS=8f for Promise 4650_sr5.bin 8660_sr5.bin 31566>>>0 default x RESERVED 31567>>>>0 ubyte x (%#x) 31568# Prog IF of PCI class code? 31569# defines the specific device programming interface 31570>2 ubyte >0 \b, ProgIF=%u 31571 31572#------------------------------------------------------------------------------ 31573# $File: pcjr,v 1.1 2021/01/09 15:09:58 christos Exp $ 31574# pcjr: file(1) magic for PCjr Cartridge image file format 31575# From: Francis Laniel <laniel_francis@privacyrequired.com> 315760 string PCjr 31577>0x80 beshort 0x55aa PCjr Cartridge image 31578>0x200 beshort 0x55aa PCjr Cartridge image 31579 31580#------------------------------------------------------------------------------ 31581# $File: pdf,v 1.16 2021/07/30 11:47:07 christos Exp $ 31582# pdf: file(1) magic for Portable Document Format 31583# 31584 315850 name pdf 31586>8 search /Count 31587>>&0 regex [0-9]+ \b, %s pages 31588>8 search/512 /Filter/FlateDecode/ (zip deflate encoded) 31589 315900 string %PDF- PDF document 31591!:mime application/pdf 31592!:strength +60 31593!:ext pdf 31594>5 byte x \b, version %c 31595>7 byte x \b.%c 31596>0 use pdf 31597 315980 string \012%PDF- PDF document 31599!:mime application/pdf 31600!:strength +60 31601!:ext pdf 31602>6 byte x \b, version %c 31603>8 byte x \b.%c 31604>0 use pdf 31605 316060 string \xef\xbb\xbf%PDF- PDF document (UTF-8) 31607!:mime application/pdf 31608!:strength +60 31609!:ext pdf 31610>6 byte x \b, version %c 31611>8 byte x \b.%c 31612>0 use pdf 31613 31614# From: Nick Schmalenberger <nick@schmalenberger.us> 31615# Forms Data Format 316160 string %FDF- FDF document 31617!:mime application/vnd.fdf 31618!:strength +60 31619!:ext pdf 31620>5 byte x \b, version %c 31621>7 byte x \b.%c 31622 316230 search/256 %PDF- PDF document 31624!:mime application/pdf 31625!:strength +60 31626!:ext pdf 31627>&0 byte x \b, version %c 31628>&2 byte x \b.%c 31629>0 use pdf 31630 31631#------------------------------------------------------------------------------ 31632# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $ 31633# pdp: file(1) magic for PDP-11 executable/object and APL workspace 31634# 316350 lelong 0101555 PDP-11 single precision APL workspace 316360 lelong 0101554 PDP-11 double precision APL workspace 31637# 31638# PDP-11 a.out 31639# 316400 leshort 0407 PDP-11 executable 31641>8 leshort >0 not stripped 31642>15 byte >0 - version %d 31643 31644# updated by Joerg Jenderek at Mar 2013 31645# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 316460 leshort 0401 31647# skip *.PNF with WinDirPathOffset 58h 31648>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 31649# skip *.PNF with high byte of InfVersionDatumCount zero 31650#>>15 byte !0 PDP-11 UNIX/RT ldp 316510 leshort 0405 PDP-11 old overlay 31652 316530 leshort 0410 PDP-11 pure executable 31654>8 leshort >0 not stripped 31655>15 byte >0 - version %d 31656 316570 leshort 0411 PDP-11 separate I&D executable 31658>8 leshort >0 not stripped 31659>15 byte >0 - version %d 31660 316610 leshort 0437 PDP-11 kernel overlay 31662 31663# These last three are derived from 2.11BSD file(1) 316640 leshort 0413 PDP-11 demand-paged pure executable 31665>8 leshort >0 not stripped 31666 316670 leshort 0430 PDP-11 overlaid pure executable 31668>8 leshort >0 not stripped 31669 316700 leshort 0431 PDP-11 overlaid separate executable 31671>8 leshort >0 not stripped 31672#------------------------------------------------------------------------------ 31673# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $ 31674# perl: file(1) magic for Larry Wall's perl language. 31675# 31676# The `eval' lines recognizes an outrageously clever hack. 31677# Keith Waclena <keith@cerberus.uchicago.edu> 31678# Send additions to <perl5-porters@perl.org> 316790 search/1024 eval\ "exec\ perl Perl script text 31680!:mime text/x-perl 316810 search/1024 eval\ "exec\ /bin/perl Perl script text 31682!:mime text/x-perl 316830 search/1024 eval\ "exec\ /usr/bin/perl Perl script text 31684!:mime text/x-perl 316850 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text 31686!:mime text/x-perl 316870 search/1024 eval\ 'exec\ perl Perl script text 31688!:mime text/x-perl 316890 search/1024 eval\ 'exec\ /bin/perl Perl script text 31690!:mime text/x-perl 316910 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text 31692!:mime text/x-perl 316930 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text 31694!:mime text/x-perl 316950 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 31696!:mime text/x-perl 316970 string #!/usr/bin/env\ perl Perl script text executable 31698!:mime text/x-perl 316990 string #!\ /usr/bin/env\ perl Perl script text executable 31700!:mime text/x-perl 317010 string #! 31702>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 31703!:mime text/x-perl 31704 31705# by Dmitry V. Levin and Alexey Tourbin 31706# check the first line 317070 search/8192 package 31708>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 31709!:strength + 40 31710# not 'p', check other lines 317110 search/8192 !p 31712>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 31713>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 31714!:strength + 75 31715 31716# Perl POD documents 31717# From: Tom Hukins <tom@eborcom.com> 317180 search/1024/W \=pod\n Perl POD document text 317190 search/1024/W \n\=pod\n Perl POD document text 317200 search/1024/W \=head1\ Perl POD document text 317210 search/1024/W \n\=head1\ Perl POD document text 317220 search/1024/W \=head2\ Perl POD document text 317230 search/1024/W \n\=head2\ Perl POD document text 317240 search/1024/W \=encoding\ Perl POD document text 317250 search/1024/W \n\=encoding\ Perl POD document text 31726 31727 31728# Perl Storable data files. 317290 string perl-store perl Storable (v0.6) data 31730>4 byte >0 (net-order %d) 31731>>4 byte &01 (network-ordered) 31732>>4 byte =3 (major 1) 31733>>4 byte =2 (major 1) 31734 317350 string pst0 perl Storable (v0.7) data 31736>4 byte >0 31737>>4 byte &01 (network-ordered) 31738>>4 byte =5 (major 2) 31739>>4 byte =4 (major 2) 31740>>5 byte >0 (minor %d) 31741 31742# This is Debian #742949 by Zefram <zefram@fysh.org>: 31743# ----------------------------------------------------------- 31744# The Perl module Hash::SharedMem 31745# <https://metacpan.org/release/Hash-SharedMem> defines a file format 31746# for a key/value store. Details of the file format are in the "DESIGN" 31747# file in the module distribution. Magic: 317480 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 31749>8 bequad <0x1000000 31750>>15 byte >2 \b, line size 2^%d byte 31751>>14 byte >2 \b, page size 2^%d byte 31752>>13 byte &1 31753>>>13 byte >1 \b, max fanout %d 317540 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 31755>8 lequad <0x1000000 31756>>8 byte >2 \b, line size 2^%d byte 31757>>9 byte >2 \b, page size 2^%d byte 31758>>10 byte &1 31759>>>10 byte >1 \b, max fanout %d 317600 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 31761>8 bequad <0x1000000 31762>>15 byte >2 \b, line size 2^%d byte 31763>>14 byte >2 \b, page size 2^%d byte 31764>>13 byte &1 31765>>>13 byte >1 \b, max fanout %d 317660 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 31767>8 lequad <0x1000000 31768>>8 byte >2 \b, line size 2^%d byte 31769>>9 byte >2 \b, page size 2^%d byte 31770>>10 byte &1 31771>>>10 byte >1 \b, max fanout %d 31772 31773#------------------------------------------------------------------------------ 31774# $File: pgf,v 1.3 2021/02/23 00:51:10 christos Exp $ 31775# pgf: file(1) magic for Progressive Graphics File (PGF) 31776# 31777# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 31778# 2013 by Philipp Hahn <pmhahn debian org> 317790 string PGF Progressive Graphics image data, 31780!:mime image/x-pgf 31781>3 string 2 version %s, 31782>3 string 4 version %s, 31783>3 string 5 version %s, 31784>3 string 6 version %s, 31785# PGFPreHeader 31786#>>4 lelong x header size %d, 31787# PGFHeader 31788>>8 lelong x %d x 31789>>12 lelong x %d, 31790>>16 byte x %d levels, 31791>>17 byte x compression level %d, 31792>>18 byte x %d bpp, 31793>>19 byte x %d channels, 31794>>20 clear x 31795>>20 byte 0 bitmap, 31796>>20 byte 1 gray scale, 31797>>20 byte 2 indexed color, 31798>>20 byte 3 RGB color, 31799>>20 byte 4 CMYK color, 31800>>20 byte 5 HSL color, 31801>>20 byte 6 HSB color, 31802>>20 byte 7 multi-channel, 31803>>20 byte 8 duo tone, 31804>>20 byte 9 LAB color, 31805>>20 byte 10 gray scale 16, 31806>>20 byte 11 RGB color 48, 31807>>20 byte 12 LAB color 48, 31808>>20 byte 13 CMYK color 64, 31809>>20 byte 14 deep multi-channel, 31810>>20 byte 15 duo tone 16, 31811>>20 byte 17 RGBA color, 31812>>20 byte 18 gray scale 32, 31813>>20 byte 19 RGB color 12, 31814>>20 byte 20 RGB color 16, 31815>>20 byte 255 unknown format, 31816>>20 default x format 31817>>>20 byte x \b %d, 31818>>21 byte x %d bpc 31819# PGFPostHeader 31820# Level-Sizes 31821#>>(4.l+4) lelong x level 0 size: %d 31822#>>(4.l+8) lelong x level 1 size: %d 31823#>>(4.l+12) lelong x level 2 size: %d 31824 31825#------------------------------------------------------------------------------ 31826# $File: pgp,v 1.25 2021/04/26 15:56:00 christos Exp $ 31827# pgp: file(1) magic for Pretty Good Privacy 31828 31829# Handling of binary PGP keys is in pgp-binary-keys. 31830# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 31831# 318320 beshort 0xa600 PGP encrypted data 31833#!:mime application/pgp-encrypted 31834#0 string -----BEGIN\040PGP text/PGP armored data 31835!:mime text/PGP # encoding: armored data 31836#>15 string PUBLIC\040KEY\040BLOCK- public key block 31837#>15 string MESSAGE- message 31838#>15 string SIGNED\040MESSAGE- signed message 31839#>15 string PGP\040SIGNATURE- signature 31840 31841# Update: Joerg Jenderek 31842# URL: http://en.wikipedia.org/wiki/Pretty_Good_Privacy 31843# Reference: https://reposcope.com/mimetype/application/pgp-keys 318442 string ---BEGIN\040PGP\040PRIVATE\040KEY\040BLOCK- PGP private key block 31845#!:mime text/PGP 31846!:mime application/pgp-keys 31847!:ext asc 318482 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 31849!:mime application/pgp-keys 31850!:ext asc 31851>10 search/100 \n\n 31852>>&0 use pgp 318530 string -----BEGIN\040PGP\040MESSAGE- PGP message 31854# https://reposcope.com/mimetype/application/pgp-encrypted 31855#!:mime application/pgp 31856!:mime application/pgp-encrypted 31857!:ext asc 31858#!:ext asc/pgp/gpg 31859>10 search/100 \n\n 31860>>&0 use pgp 31861# Reference: https://www.gnupg.org/gph/en/manual/x135.html 318620 string -----BEGIN\040PGP\040SIGNED\040MESSAGE- PGP signed message 31863#!:mime text/plain 31864!:mime text/PGP 31865#!:mime application/pgp 31866!:ext asc 318670 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 31868# https://reposcope.com/mimetype/application/pgp-signature 31869!:mime application/pgp-signature 31870!:ext asc 31871>10 search/100 \n\n 31872>>&0 use pgp 31873 31874# Decode the type of the packet based on it's base64 encoding. 31875# Idea from Mark Martinec 31876# The specification is in RFC 4880, section 4.2 and 4.3: 31877# https://tools.ietf.org/html/rfc4880#section-4.2 31878 318790 name pgp 31880>0 byte 0x67 Reserved (old) 31881>0 byte 0x68 Public-Key Encrypted Session Key (old) 31882>0 byte 0x69 Signature (old) 31883>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 31884>0 byte 0x6b One-Pass Signature (old) 31885>0 byte 0x6c Secret-Key (old) 31886>0 byte 0x6d Public-Key (old) 31887>0 byte 0x6e Secret-Subkey (old) 31888>0 byte 0x6f Compressed Data (old) 31889>0 byte 0x70 Symmetrically Encrypted Data (old) 31890>0 byte 0x71 Marker (old) 31891>0 byte 0x72 Literal Data (old) 31892>0 byte 0x73 Trust (old) 31893>0 byte 0x74 User ID (old) 31894>0 byte 0x75 Public-Subkey (old) 31895>0 byte 0x76 Unused (old) 31896>0 byte 0x77 31897>>1 byte&0xc0 0x00 Reserved 31898>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 31899>>1 byte&0xc0 0x80 Signature 31900>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 31901>0 byte 0x78 31902>>1 byte&0xc0 0x00 One-Pass Signature 31903>>1 byte&0xc0 0x40 Secret-Key 31904>>1 byte&0xc0 0x80 Public-Key 31905>>1 byte&0xc0 0xc0 Secret-Subkey 31906>0 byte 0x79 31907>>1 byte&0xc0 0x00 Compressed Data 31908>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 31909>>1 byte&0xc0 0x80 Marker 31910>>1 byte&0xc0 0xc0 Literal Data 31911>0 byte 0x7a 31912>>1 byte&0xc0 0x00 Trust 31913>>1 byte&0xc0 0x40 User ID 31914>>1 byte&0xc0 0x80 Public-Subkey 31915>>1 byte&0xc0 0xc0 Unused [z%x] 31916>0 byte 0x30 31917>>1 byte&0xc0 0x00 Unused [0%x] 31918>>1 byte&0xc0 0x40 User Attribute 31919>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 31920>>1 byte&0xc0 0xc0 Modification Detection Code 31921 31922# magic signatures to detect PGP crypto material (from stef) 31923# detects and extracts metadata from: 31924# - symmetric encrypted packet header 31925# - RSA (e=65537) secret (sub-)keys 31926 31927# 1024b RSA encrypted data 31928 319290 string \x84\x8c\x03 PGP RSA encrypted session key - 31930>3 belong x keyid: %08X 31931>7 belong x %08X 31932>11 byte 0x01 RSA (Encrypt or Sign) 1024b 31933>11 byte 0x02 RSA Encrypt-Only 1024b 31934>12 string \x04\x00 31935>12 string \x03\xff 31936>12 string \x03\xfe 31937>12 string \x03\xfd 31938>12 string \x03\xfc 31939>12 string \x03\xfb 31940>12 string \x03\xfa 31941>12 string \x03\xf9 31942>142 byte 0xd2 . 31943 31944# 2048b RSA encrypted data 31945 319460 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 31947>4 belong x keyid: %08X 31948>8 belong x %08X 31949>12 byte 0x01 RSA (Encrypt or Sign) 2048b 31950>12 byte 0x02 RSA Encrypt-Only 2048b 31951>13 string \x08\x00 31952>13 string \x07\xff 31953>13 string \x07\xfe 31954>13 string \x07\xfd 31955>13 string \x07\xfc 31956>13 string \x07\xfb 31957>13 string \x07\xfa 31958>13 string \x07\xf9 31959>271 byte 0xd2 . 31960 31961# 3072b RSA encrypted data 31962 319630 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 31964>4 belong x keyid: %08X 31965>8 belong x %08X 31966>12 byte 0x01 RSA (Encrypt or Sign) 3072b 31967>12 byte 0x02 RSA Encrypt-Only 3072b 31968>13 string \x0c\x00 31969>13 string \x0b\xff 31970>13 string \x0b\xfe 31971>13 string \x0b\xfd 31972>13 string \x0b\xfc 31973>13 string \x0b\xfb 31974>13 string \x0b\xfa 31975>13 string \x0b\xf9 31976>399 byte 0xd2 . 31977 31978# 4096b RSA encrypted data 31979 319800 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 31981>4 belong x keyid: %08X 31982>8 belong x %08X 31983>12 byte 0x01 RSA (Encrypt or Sign) 4096b 31984>12 byte 0x02 RSA Encrypt-Only 4096b 31985>13 string \x10\x00 31986>13 string \x0f\xff 31987>13 string \x0f\xfe 31988>13 string \x0f\xfd 31989>13 string \x0f\xfc 31990>13 string \x0f\xfb 31991>13 string \x0f\xfa 31992>13 string \x0f\xf9 31993>527 byte 0xd2 . 31994 31995# 8192b RSA encrypted data 31996 319970 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 31998>4 belong x keyid: %08X 31999>8 belong x %08X 32000>12 byte 0x01 RSA (Encrypt or Sign) 8192b 32001>12 byte 0x02 RSA Encrypt-Only 8192b 32002>13 string \x20\x00 32003>13 string \x1f\xff 32004>13 string \x1f\xfe 32005>13 string \x1f\xfd 32006>13 string \x1f\xfc 32007>13 string \x1f\xfb 32008>13 string \x1f\xfa 32009>13 string \x1f\xf9 32010>1039 byte 0xd2 . 32011 32012# 1024b Elgamal encrypted data 32013 320140 string \x85\x01\x0e\x03 PGP Elgamal encrypted session key - 32015>4 belong x keyid: %08X 32016>8 belong x %08X 32017>12 byte 0x10 Elgamal Encrypt-Only 1024b. 32018>13 string \x04\x00 32019>13 string \x03\xff 32020>13 string \x03\xfe 32021>13 string \x03\xfd 32022>13 string \x03\xfc 32023>13 string \x03\xfb 32024>13 string \x03\xfa 32025>13 string \x03\xf9 32026 32027# 2048b Elgamal encrypted data 32028 320290 string \x85\x02\x0e\x03 PGP Elgamal encrypted session key - 32030>4 belong x keyid: %08X 32031>8 belong x %08X 32032>12 byte 0x10 Elgamal Encrypt-Only 2048b. 32033>13 string \x08\x00 32034>13 string \x07\xff 32035>13 string \x07\xfe 32036>13 string \x07\xfd 32037>13 string \x07\xfc 32038>13 string \x07\xfb 32039>13 string \x07\xfa 32040>13 string \x07\xf9 32041 32042# 3072b Elgamal encrypted data 32043 320440 string \x85\x03\x0e\x03 PGP Elgamal encrypted session key - 32045>4 belong x keyid: %08X 32046>8 belong x %08X 32047>12 byte 0x10 Elgamal Encrypt-Only 3072b. 32048>13 string \x0c\x00 32049>13 string \x0b\xff 32050>13 string \x0b\xfe 32051>13 string \x0b\xfd 32052>13 string \x0b\xfc 32053>13 string \x0b\xfb 32054>13 string \x0b\xfa 32055>13 string \x0b\xf9 32056 32057# crypto algo mapper 32058 320590 name crypto 32060>0 byte 0x00 Plaintext or unencrypted data 32061>0 byte 0x01 IDEA 32062>0 byte 0x02 TripleDES 32063>0 byte 0x03 CAST5 (128 bit key) 32064>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 32065>0 byte 0x07 AES with 128-bit key 32066>0 byte 0x08 AES with 192-bit key 32067>0 byte 0x09 AES with 256-bit key 32068>0 byte 0x0a Twofish with 256-bit key 32069 32070# hash algo mapper 32071 320720 name hash 32073>0 byte 0x01 MD5 32074>0 byte 0x02 SHA-1 32075>0 byte 0x03 RIPE-MD/160 32076>0 byte 0x08 SHA256 32077>0 byte 0x09 SHA384 32078>0 byte 0x0a SHA512 32079>0 byte 0x0b SHA224 32080 32081# display public key algorithms as human readable text 320820 name key_algo 32083>0 byte 0x01 RSA (Encrypt or Sign) 32084# keep old look of version 5.28 without parentheses 32085>0 byte 0x02 RSA Encrypt-Only 32086>0 byte 0x03 RSA (Sign-Only) 32087>0 byte 16 ElGamal (Encrypt-Only) 32088>0 byte 17 DSA 32089>0 byte 18 Elliptic Curve 32090>0 byte 19 ECDSA 32091>0 byte 20 ElGamal (Encrypt or Sign) 32092>0 byte 21 Diffie-Hellman 32093>0 default x 32094>>0 ubyte <22 unknown (pub %d) 32095# this should never happen 32096>>0 ubyte >21 invalid (%d) 32097 32098# pgp symmetric encrypted data 32099 321000 byte 0x8c PGP symmetric key encrypted data - 32101>1 byte 0x0d 32102>1 byte 0x0c 32103>2 byte 0x04 32104>3 use crypto 32105>4 byte 0x01 salted - 32106>>5 use hash 32107>>14 byte 0xd2 . 32108>>14 byte 0xc9 . 32109>4 byte 0x03 salted & iterated - 32110>>5 use hash 32111>>15 byte 0xd2 . 32112>>15 byte 0xc9 . 32113 32114# encrypted keymaterial needs s2k & can be checksummed/hashed 32115 321160 name chkcrypto 32117>0 use crypto 32118>1 byte 0x00 Simple S2K 32119>1 byte 0x01 Salted S2K 32120>1 byte 0x03 Salted&Iterated S2K 32121>2 use hash 32122 32123# all PGP keys start with this prolog 32124# containing version, creation date, and purpose 32125 321260 name keyprolog 32127>0 byte 0x04 32128>1 beldate x created on %s - 32129>5 byte 0x01 RSA (Encrypt or Sign) 32130>5 byte 0x02 RSA Encrypt-Only 32131 32132# end of secret keys known signature 32133# contains e=65537 and the prolog to 32134# the encrypted parameters 32135 321360 name keyend 32137>0 string \x00\x11\x01\x00\x01 e=65537 32138>5 use crypto 32139>5 byte 0xff checksummed 32140>>6 use chkcrypto 32141>5 byte 0xfe hashed 32142>>6 use chkcrypto 32143 32144# PGP secret keys contain also the public parts 32145# these vary by bitsize of the key 32146 321470 name x1024 32148>0 use keyprolog 32149>6 string \x03\xfe 32150>6 string \x03\xff 32151>6 string \x04\x00 32152>136 use keyend 32153 321540 name x2048 32155>0 use keyprolog 32156>6 string \x80\x00 32157>6 string \x07\xfe 32158>6 string \x07\xff 32159>264 use keyend 32160 321610 name x3072 32162>0 use keyprolog 32163>6 string \x0b\xfe 32164>6 string \x0b\xff 32165>6 string \x0c\x00 32166>392 use keyend 32167 321680 name x4096 32169>0 use keyprolog 32170>6 string \x10\x00 32171>6 string \x0f\xfe 32172>6 string \x0f\xff 32173>520 use keyend 32174 32175# \x00|\x1f[\xfe\xff]).{1024})' 321760 name x8192 32177>0 use keyprolog 32178>6 string \x20\x00 32179>6 string \x1f\xfe 32180>6 string \x1f\xff 32181>1032 use keyend 32182 32183# depending on the size of the pkt 32184# we branch into the proper key size 32185# signatures defined as x{keysize} 32186 321870 name pgpkey 32188>0 string \x01\xd8 1024b 32189>>2 use x1024 32190>0 string \x01\xeb 1024b 32191>>2 use x1024 32192>0 string \x01\xfb 1024b 32193>>2 use x1024 32194>0 string \x01\xfd 1024b 32195>>2 use x1024 32196>0 string \x01\xf3 1024b 32197>>2 use x1024 32198>0 string \x01\xee 1024b 32199>>2 use x1024 32200>0 string \x01\xfe 1024b 32201>>2 use x1024 32202>0 string \x01\xf4 1024b 32203>>2 use x1024 32204>0 string \x02\x0d 1024b 32205>>2 use x1024 32206>0 string \x02\x03 1024b 32207>>2 use x1024 32208>0 string \x02\x05 1024b 32209>>2 use x1024 32210>0 string \x02\x15 1024b 32211>>2 use x1024 32212>0 string \x02\x00 1024b 32213>>2 use x1024 32214>0 string \x02\x10 1024b 32215>>2 use x1024 32216>0 string \x02\x04 1024b 32217>>2 use x1024 32218>0 string \x02\x06 1024b 32219>>2 use x1024 32220>0 string \x02\x16 1024b 32221>>2 use x1024 32222>0 string \x03\x98 2048b 32223>>2 use x2048 32224>0 string \x03\xab 2048b 32225>>2 use x2048 32226>0 string \x03\xbb 2048b 32227>>2 use x2048 32228>0 string \x03\xbd 2048b 32229>>2 use x2048 32230>0 string \x03\xcd 2048b 32231>>2 use x2048 32232>0 string \x03\xb3 2048b 32233>>2 use x2048 32234>0 string \x03\xc3 2048b 32235>>2 use x2048 32236>0 string \x03\xc5 2048b 32237>>2 use x2048 32238>0 string \x03\xd5 2048b 32239>>2 use x2048 32240>0 string \x03\xae 2048b 32241>>2 use x2048 32242>0 string \x03\xbe 2048b 32243>>2 use x2048 32244>0 string \x03\xc0 2048b 32245>>2 use x2048 32246>0 string \x03\xd0 2048b 32247>>2 use x2048 32248>0 string \x03\xb4 2048b 32249>>2 use x2048 32250>0 string \x03\xc4 2048b 32251>>2 use x2048 32252>0 string \x03\xc6 2048b 32253>>2 use x2048 32254>0 string \x03\xd6 2048b 32255>>2 use x2048 32256>0 string \x05X 3072b 32257>>2 use x3072 32258>0 string \x05k 3072b 32259>>2 use x3072 32260>0 string \x05{ 3072b 32261>>2 use x3072 32262>0 string \x05} 3072b 32263>>2 use x3072 32264>0 string \x05\x8d 3072b 32265>>2 use x3072 32266>0 string \x05s 3072b 32267>>2 use x3072 32268>0 string \x05\x83 3072b 32269>>2 use x3072 32270>0 string \x05\x85 3072b 32271>>2 use x3072 32272>0 string \x05\x95 3072b 32273>>2 use x3072 32274>0 string \x05n 3072b 32275>>2 use x3072 32276>0 string \x05\x7e 3072b 32277>>2 use x3072 32278>0 string \x05\x80 3072b 32279>>2 use x3072 32280>0 string \x05\x90 3072b 32281>>2 use x3072 32282>0 string \x05t 3072b 32283>>2 use x3072 32284>0 string \x05\x84 3072b 32285>>2 use x3072 32286>0 string \x05\x86 3072b 32287>>2 use x3072 32288>0 string \x05\x96 3072b 32289>>2 use x3072 32290>0 string \x07[ 4096b 32291>>2 use x4096 32292>0 string \x07\x18 4096b 32293>>2 use x4096 32294>0 string \x07+ 4096b 32295>>2 use x4096 32296>0 string \x07; 4096b 32297>>2 use x4096 32298>0 string \x07= 4096b 32299>>2 use x4096 32300>0 string \x07M 4096b 32301>>2 use x4096 32302>0 string \x073 4096b 32303>>2 use x4096 32304>0 string \x07C 4096b 32305>>2 use x4096 32306>0 string \x07E 4096b 32307>>2 use x4096 32308>0 string \x07U 4096b 32309>>2 use x4096 32310>0 string \x07. 4096b 32311>>2 use x4096 32312>0 string \x07> 4096b 32313>>2 use x4096 32314>0 string \x07@ 4096b 32315>>2 use x4096 32316>0 string \x07P 4096b 32317>>2 use x4096 32318>0 string \x074 4096b 32319>>2 use x4096 32320>0 string \x07D 4096b 32321>>2 use x4096 32322>0 string \x07F 4096b 32323>>2 use x4096 32324>0 string \x07V 4096b 32325>>2 use x4096 32326>0 string \x0e[ 8192b 32327>>2 use x8192 32328>0 string \x0e\x18 8192b 32329>>2 use x8192 32330>0 string \x0e+ 8192b 32331>>2 use x8192 32332>0 string \x0e; 8192b 32333>>2 use x8192 32334>0 string \x0e= 8192b 32335>>2 use x8192 32336>0 string \x0eM 8192b 32337>>2 use x8192 32338>0 string \x0e3 8192b 32339>>2 use x8192 32340>0 string \x0eC 8192b 32341>>2 use x8192 32342>0 string \x0eE 8192b 32343>>2 use x8192 32344>0 string \x0eU 8192b 32345>>2 use x8192 32346>0 string \x0e. 8192b 32347>>2 use x8192 32348>0 string \x0e> 8192b 32349>>2 use x8192 32350>0 string \x0e@ 8192b 32351>>2 use x8192 32352>0 string \x0eP 8192b 32353>>2 use x8192 32354>0 string \x0e4 8192b 32355>>2 use x8192 32356>0 string \x0eD 8192b 32357>>2 use x8192 32358>0 string \x0eF 8192b 32359>>2 use x8192 32360>0 string \x0eV 8192b 32361>>2 use x8192 32362 32363# PGP RSA (e=65537) secret (sub-)key header 32364 323650 byte 0x97 PGP Secret Sub-key - 32366>1 use pgpkey 323670 byte 0x9d 32368# Update: Joerg Jenderek 32369# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 32370# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 32371>1 ubeshort >0 32372#>1 ubeshort x \b, body length %#x 32373# next packet type often 88h,89h~(tag 2)~Signature Packet 32374#>>(1.S+3) ubyte x \b, next packet type %#x 32375# skip Dragon.SHR DEMO.INIT by looking for positive version 32376>>3 ubyte >0 32377# skip BUISSON.13 GUITAR1 by looking for low version number 32378>>>3 ubyte <5 PGP Secret Sub-key 32379# sub-key are normally part of secret key. So it does not occur as standalone file 32380#!:ext bin 32381# version 2,3~old 4~new . Comment following line for version 5.28 look 32382>>>>3 ubyte x (v%d) 32383>>>>3 ubyte x - 32384# old versions 2 or 3 but no real example found 32385>>>>3 ubyte <4 32386# 2 byte for key bits in version 5.28 look 32387>>>>>11 ubeshort x %db 32388>>>>>4 beldate x created on %s - 32389# old versions use 2 additional bytes after time stamp 32390#>>>>>8 ubeshort x %#x 32391# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 32392>>>>>10 use key_algo 32393>>>>>(11.S/8) ubequad x 32394# look after first key 32395>>>>>>&5 use keyend 32396# new version 32397>>>>3 ubyte >3 32398>>>>>9 ubeshort x %db 32399>>>>>4 beldate x created on %s - 32400# display key algorithm 32401>>>>>8 use key_algo 32402>>>>>(9.S/8) ubequad x 32403# look after first key for something like s2k 32404>>>>>>&3 use keyend 32405 32406#------------------------------------------------------------------------------ 32407# $File: pgp-binary-keys,v 1.2 2021/04/26 15:56:00 christos Exp $ 32408# pgp-binary-keys: This file handles pgp binary keys. 32409# 32410# An PGP certificate or message doesn't have a fixed header. Instead, 32411# they are sequences of packets: 32412# 32413# https://tools.ietf.org/html/rfc4880#section-4.3 32414# 32415# whose order conforms to a grammar: 32416# 32417# https://tools.ietf.org/html/rfc4880#section-11 32418# 32419# Happily most packets have a few fields that are constrained, which 32420# allow us to fingerprint them with relatively high certainty. 32421# 32422# A PGP packet is described by a single byte: the so-called CTB. The 32423# high-bit is always set. If bit 6 is set, then it is a so-called 32424# new-style CTB; if bit 6 is clear, then it is a so-called old-style 32425# CTB. Old-style CTBs have only four bits of type information; bits 32426# 1-0 are used to describe the length. New-style CTBs have 6 bits of 32427# type information. 32428# 32429# Following the CTB is the packet's length in bytes. If we blindly 32430# advance the file cursor by this amount past the end of the length 32431# information we come to the next packet. 32432# 32433# Data Structures 32434# =============== 32435# 32436# New Style CTB 32437# ------------- 32438# 32439# https://tools.ietf.org/html/rfc4880#section-4.2.2 32440# 32441# 76543210 32442# ||\----/ 32443# || tag 32444# |always 1 32445# always 1 32446# 32447# Tag bits 7 and 6 set 32448# 0 0xC0 -- Reserved - a packet tag MUST NOT have this value 32449# 1 0xC1 -- Public-Key Encrypted Session Key Packet 32450# 2 0xC2 -- Signature Packet 32451# 3 0xC3 -- Symmetric-Key Encrypted Session Key Packet 32452# 4 0xC4 -- One-Pass Signature Packet 32453# 5 0xC5 -- Secret-Key Packet 32454# 6 0xC6 -- Public-Key Packet 32455# 7 0xC7 -- Secret-Subkey Packet 32456# 8 0xC8 -- Compressed Data Packet 32457# 9 0xC9 -- Symmetrically Encrypted Data Packet 32458# 10 0xCA -- Marker Packet 32459# 11 0xCB -- Literal Data Packet 32460# 12 0xCC -- Trust Packet 32461# 13 0xCD -- User ID Packet 32462# 14 0xCE -- Public-Subkey Packet 32463# 17 0xD1 -- User Attribute Packet 32464# 18 0xD2 -- Sym. Encrypted and Integrity Protected Data Packet 32465# 19 0xD3 -- Modification Detection Code Packet 32466# 60 to 63 -- Private or Experimental Values 32467# 32468# The CTB is followed by the length header, which is densely encoded: 32469# 32470# if length[0] is: 32471# 0..191: one byte length (length[0]) 32472# 192..223: two byte length ((length[0] - 192) * 256 + length[2] + 192 32473# 224..254: four byte length (big endian interpretation of length[1..5]) 32474# 255: partial body encoding 32475# 32476# The partial body encoding is similar to HTTP's chunk encoding. It 32477# is only allowed for container packets (SEIP, Compressed Data and 32478# Literal). 32479# 32480# Old Style CTB 32481# ------------- 32482# 32483# https://tools.ietf.org/html/rfc4880#section-4.2.1 32484# 32485# CTB: 32486# 32487# 76543210 32488# ||\--/\/ 32489# || | length encoding 32490# || tag 32491# |always 0 32492# always 1 32493# 32494# Tag: 32495# 32496# Tag bit 7 set, bits 6, 1, 0 clear 32497# 0 0x80 -- Reserved - a packet tag MUST NOT have this value 32498# 1 0x84 -- Public-Key Encrypted Session Key Packet 32499# 2 0x88 -- Signature Packet 32500# 3 0x8C -- Symmetric-Key Encrypted Session Key Packet 32501# 4 0x90 -- One-Pass Signature Packet 32502# 5 0x94 -- Secret-Key Packet 32503# 6 0x98 -- Public-Key Packet 32504# 7 0x9C -- Secret-Subkey Packet 32505# 8 0xA0 -- Compressed Data Packet 32506# 9 0xA4 -- Symmetrically Encrypted Data Packet 32507# 10 0xA8 -- Marker Packet 32508# 11 0xAC -- Literal Data Packet 32509# 12 0xB0 -- Trust Packet 32510# 13 0xB4 -- User ID Packet 32511# 14 0xB8 -- Public-Subkey Packet 32512# 32513# Length encoding: 32514# 32515# Value 32516# 0 1 byte length (following byte is the length) 32517# 1 2 byte length (following two bytes are the length) 32518# 2 4 byte length (following four bytes are the length) 32519# 3 indeterminate length: natural end of packet, e.g., EOF 32520# 32521# An indeterminate length is only allowed for container packets 32522# (SEIP, Compressed Data and Literal). 32523# 32524# Certificates 32525# ------------ 32526# 32527# We check the first three packets to determine if a sequence of 32528# OpenPGP packets is likely to be a certificate. The grammar allows 32529# the following prefixes: 32530# 32531# [Primary Key] [SIG] (EOF or another certificate) 32532# [Primary Key] [SIG] [User ID] [SIG]... 32533# [Primary Key] [SIG] [User Attribute] [SIG]... 32534# [Primary Key] [SIG] [Subkey] [SIG]... 32535# [Primary Key] [User ID] [SIG]... 32536# [Primary Key] [User Attribute] [SIG]... 32537# [Primary Key] [Subkey] [SIG]... 32538# 32539# Any number of marker packets are also allowed between each packet, 32540# but they are not normally used and we don't currently check for 32541# them. 32542# 32543# The keys and subkeys may be public or private. 32544# 32545 32546# Key packets and signature packets are versioned. There are two 32547# packet versions that we need to worry about in practice: v3 and v4. 32548# v4 packets were introduced in RFC 2440, which was published in 1998. 32549# It also deprecated v3 packets. There are no actively used v3 32550# certificates (GnuPG removed the code to support them in November 32551# 2014). But there are v3 keys lying around and it is useful to 32552# identify them. The next version of OpenPGP will introduce v5 keys. 32553# The document has not yet been standardized so changes are still 32554# possible. But, for our purposes, it appears that v5 data structures 32555# will be identical to v4 data structures modulo the version number. 32556# 32557# https://tools.ietf.org/html/rfc2440 32558# https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html 32559# https://www.ietf.org/id/draft-ietf-openpgp-rfc4880bis-09.html#name-key-material-packet 32560 32561 32562 32563 32564# The first packet has to be a public key or a secret key. 32565# 32566# New-Style Public Key 325670 ubyte =0xC6 OpenPGP Public Key 32568>&0 use primary_key_length_new 32569# New-Style Secret Key 325700 ubyte =0xC5 OpenPGP Secret Key 32571>&0 use primary_key_length_new 32572# Old-Style Public Key 325730 ubyte&0xFC =0x98 OpenPGP Public Key 32574>&-1 use primary_key_length_old 32575# Old-Style Secret Key 325760 ubyte&0xFC =0x94 OpenPGP Secret Key 32577>&-1 use primary_key_length_old 32578 32579# Parse the length, check the packet's body and finally advance to the 32580# next packet. 32581 32582# There are 4 different new-style length encodings, but the partial 32583# body encoding is only acceptable for the SEIP, Compressed Data, and 32584# Literal packets, which isn't valid for any packets in a certificate 32585# so we ignore it. 325860 name primary_key_length_new 32587>&0 ubyte <192 32588#>>&0 ubyte x (1 byte length encoding, %d bytes) 32589>>&0 use pgp_binary_key_pk_check 32590>>>&(&-1.B) use sig_or_component_1 32591>&0 ubyte >191 32592>>&-1 ubyte <225 32593# offset = ((offset[0] - 192) << 8) + offset[1] + 192 (for the length header) 32594# raw - (192 * 256 - 192) 32595# = 48960 32596#>>>&0 ubeshort x (2 byte length encoding, %d bytes) 32597>>>&1 use pgp_binary_key_pk_check 32598>>>>&(&-2.S-48960) use sig_or_component_1 32599>&0 ubyte =255 32600#>>&0 belong x (5 byte length encoding, %d bytes) 32601>>&4 use pgp_binary_key_pk_check 32602>>>&(&-4.L) use sig_or_component_1 32603# Partial body encoding (only valid for container packets). 32604# >&0 ubyte >224 32605# >>&0 ubyte <255 partial body encoding 32606 32607# There are 4 different old-style length encodings, but the 32608# indeterminate length encoding is only acceptable for the SEIP, 32609# Compressed Data, and Literal packets, which isn't valid for any 32610# packets in a certificate. 326110 name primary_key_length_old 32612#>&0 ubyte x (ctb: %x) 32613>&0 ubyte&0x3 =0 32614#>>&0 ubyte x (1 byte length encoding, %d bytes) 32615>>&1 use pgp_binary_key_pk_check 32616>>>&(&-1.B) use sig_or_component_1 32617>&0 ubyte&0x3 =1 32618#>>&0 ubeshort x (2 byte length encoding, %d bytes) 32619>>&2 use pgp_binary_key_pk_check 32620>>>&(&-2.S) use sig_or_component_1 32621>&0 ubyte&0x3 =2 32622#>>&0 ubelong x (4 byte length encoding, %d bytes) 32623>>&4 use pgp_binary_key_pk_check 32624>>>&(&-4.L) use sig_or_component_1 32625 32626# Check the Key. 32627# 32628# https://tools.ietf.org/html/rfc4880#section-5.5.2 326290 name pgp_binary_key_pk_check 32630# Valid versions are: 2, 3, 4. 5 is proposed in RFC 4880bis. 32631# Anticipate a v6 / v7 format that like v5 is compatible with v4. 32632# key format in a decade or so :D. 32633>&0 ubyte >1 32634>>&-1 ubyte <8 32635>>>&-1 byte x Version %d 32636# Check that keys were created after 1990. 32637# (1990 - 1970) * 365.2524 * 24 * 60 * 60 = 631156147 32638>>>&0 bedate >631156147 \b, Created %s 32639>>>>&-5 ubyte >3 32640>>>>>&4 use pgp_binary_key_algo 32641>>>>&-5 ubyte <4 32642>>>>>&6 use pgp_binary_key_algo 32643 32644# Print out the key's algorithm and the number of bits, if this is 32645# relevant (ECC keys are a fixed size). 326460 name pgp_binary_key_algo 32647>0 clear x 32648>&0 ubyte =1 \b, RSA (Encrypt or Sign, 32649>>&0 ubeshort x \b %d bits) 32650>&0 ubyte =2 \b, RSA (Encrypt, 32651>>&0 ubeshort x \b %d bits) 32652>&0 ubyte =3 \b, RSA (Sign, 32653>>&0 ubeshort x \b %d bits) 32654>&0 ubyte =16 \b, El Gamal (Encrypt, 32655>>&0 ubeshort x \b %d bits) 32656>&0 ubyte =17 \b, DSA 32657>>&0 ubeshort x \b (%d bits) 32658>&0 ubyte =18 \b, ECDH 32659>&0 ubyte =19 \b, ECDSA 32660>&0 ubyte =20 \b, El Gamal (Encrypt or Sign, 32661>>&0 ubeshort x \b %d bits) 32662>&0 ubyte =22 \b, EdDSA 32663>&0 default x 32664>>&0 ubyte x \b, Unknown Algorithm (%#x) 32665 32666# Match all possible second packets. 326670 name sig_or_component_1 32668#>0 ubyte x (ctb: %x) 32669>&0 ubyte =0xC2 32670>>0 ubyte x \b; Signature 32671>>&0 use sig_or_component_1_length_new 32672>&0 ubyte =0xCD 32673>>0 ubyte x \b; User ID 32674>>&0 use sig_or_component_1_length_new 32675>&0 ubyte =0xCE 32676>>0 ubyte x \b; Public Subkey 32677>>&0 use sig_or_component_1_length_new 32678>&0 ubyte =0xC7 32679>>0 ubyte x \b; Secret Subkey 32680>>&0 use sig_or_component_1_length_new 32681>&0 ubyte =0xD1 32682>>0 ubyte x \b; User Attribute 32683>>&0 use sig_or_component_1_length_new 32684>&0 ubyte&0xFC =0x88 32685>>0 ubyte x \b; Signature 32686>>&-1 use sig_or_component_1_length_old 32687>&0 ubyte&0xFC =0xB4 32688>>0 ubyte x \b; User ID 32689>>&-1 use sig_or_component_1_length_old 32690>&0 ubyte&0xFC =0xB8 32691>>0 ubyte x \b; Public Subkey 32692>>&-1 use sig_or_component_1_length_old 32693>&0 ubyte&0xFC =0x9C 32694>>0 ubyte x \b; Secret Subkey 32695>>&-1 use sig_or_component_1_length_old 32696 32697# Copy of 'primary_key_length_new', but calls cert_packet_3. 326980 name sig_or_component_1_length_new 32699>&0 ubyte <192 32700#>>&0 ubyte x (1 byte new length encoding, %d bytes) 32701>>&(&-1.B) use cert_packet_3 32702>&0 ubyte >191 32703>>&-1 ubyte <225 32704# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header) 32705# raw - (192 * 256 - 192 - 1) 32706# = 48959 32707#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes) 32708>>>&(&-1.S-48959) use cert_packet_3 32709>&0 ubyte =255 32710#>>&0 belong x (5 byte new length encoding, %d bytes) 32711>>&(&-4.L) use cert_packet_3 32712# Partial body encoding (only valid for container packets). 32713# >&0 ubyte >224 32714# >>&0 ubyte <255 partial body encoding 32715 327160 name sig_or_component_1_length_old 32717#>&0 ubyte x (ctb: %x) 32718>&0 ubyte&0x3 =0 32719#>>&0 ubyte x (1 byte old length encoding, %d bytes) 32720>>&(&0.B+1) use cert_packet_3 32721>&0 ubyte&0x3 =1 32722#>>&0 ubeshort x (2 byte old length encoding, %d bytes) 32723>>&(&0.S+2) use cert_packet_3 32724>&0 ubyte&0x3 =2 32725#>>&0 ubelong x (4 byte old length encoding, %d bytes) 32726>>&(&0.L+4) use cert_packet_3 32727 32728# Copy of above. 327290 name cert_packet_3 32730#>0 ubyte x (ctb: %x) 32731>&0 ubyte =0xC2 32732>>0 ubyte x \b; Signature 32733>>&0 use cert_packet_3_length_new 32734>&0 ubyte =0xCD 32735>>0 ubyte x \b; User ID 32736>>&0 use cert_packet_3_length_new 32737>&0 ubyte =0xCE 32738>>0 ubyte x \b; Public Subkey 32739>>&0 use cert_packet_3_length_new 32740>&0 ubyte =0xC7 32741>>0 ubyte x \b; Secret Subkey 32742>>&0 use cert_packet_3_length_new 32743>&0 ubyte =0xD1 32744>>0 ubyte x \b; User Attribute 32745>>&0 use cert_packet_3_length_new 32746>&0 ubyte&0xFC =0x88 32747>>0 ubyte x \b; Signature 32748>>&-1 use cert_packet_3_length_old 32749>&0 ubyte&0xFC =0xB4 32750>>0 ubyte x \b; User ID 32751>>&-1 use cert_packet_3_length_old 32752>&0 ubyte&0xFC =0xB8 32753>>0 ubyte x \b; Public Subkey 32754>>&-1 use cert_packet_3_length_old 32755>&0 ubyte&0xFC =0x9C 32756>>0 ubyte x \b; Secret Subkey 32757>>&-1 use cert_packet_3_length_old 32758 32759# Copy of above. 327600 name cert_packet_3_length_new 32761>&0 ubyte <192 32762#>>&0 ubyte x (1 byte new length encoding, %d bytes) 32763>>&(&-1.B) use pgp_binary_keys_end 32764>&0 ubyte >191 32765>>&-1 ubyte <225 32766# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header) 32767# raw - (192 * 256 - 192 - 1) 32768# = 48959 32769#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes) 32770>>>&(&-1.S-48959) use pgp_binary_keys_end 32771>&0 ubyte =255 32772#>>&0 belong x (5 byte new length encoding, %d bytes) 32773>>&(&-4.L) use pgp_binary_keys_end 32774 327750 name cert_packet_3_length_old 32776#>&0 ubyte x (ctb: %x) 32777>&0 ubyte&0x3 =0 32778#>>&0 ubyte x (1 byte old length encoding, %d bytes) 32779>>&(&0.B+1) use pgp_binary_keys_end 32780>&0 ubyte&0x3 =1 32781#>>&0 ubeshort x (2 byte old length encoding, %d bytes) 32782>>&(&0.S+2) use pgp_binary_keys_end 32783>&0 ubyte&0x3 =2 32784#>>&0 ubelong x (4 byte old length encoding, %d bytes) 32785>>&(&0.L+4) use pgp_binary_keys_end 32786 32787# We managed to parse the first three packets of the certificate. Declare 32788# victory. 327890 name pgp_binary_keys_end 32790>0 byte x \b; OpenPGP Certificate 32791!:mime application/pgp-keys 32792!:ext pgp/gpg/pkr/asd 32793 32794#------------------------------------------------------------------------------ 32795# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 32796# pkgadd: file(1) magic for SysV R4 PKG Datastreams 32797# 327980 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 32799!:mime application/x-svr4-package 32800 32801#------------------------------------------------------------------------------ 32802# $File: plan9,v 1.6 2021/07/30 12:25:13 christos Exp $ 32803# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables and object files 32804# From: "Stefan A. Haubenthal" <polluks@web.de> 32805# 328060 belong 0x00000107 Plan 9 executable, Motorola 68k 328070 belong 0x00000197 Plan 9 executable, AT&T Hobbit 328080 belong 0x000001EB Plan 9 executable, Intel 386 328090 belong 0x00000247 Plan 9 executable, Intel 960 328100 belong 0x000002AB Plan 9 executable, SPARC 328110 belong 0x00000407 Plan 9 executable, MIPS R3000 328120 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 328130 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 328140 belong 0x000005AB Plan 9 executable, AMD 29000 328150 belong 0x00000647 Plan 9 executable, ARM 7-something 328160 belong 0x000006EB Plan 9 executable, PowerPC 328170 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 328180 belong 0x0000084B Plan 9 executable, DEC Alpha 32819 328200 belong 0x3A11013C Plan 9 object file, MIPS R3000 328210 belong 0x430D013C Plan 9 object file, AT&T Hobbit 328220 belong 0x4D013201 Plan 9 object file, Motorola 68k 328230 belong 0x7410013C Plan 9 object file, SPARC 328240 belong 0x7E004501 Plan 9 object file, Intel 386 32825 32826#------------------------------------------------------------------------------ 32827# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 32828# plus5: file(1) magic for Plus Five's UNIX MUMPS 32829# 32830# XXX - byte order? Paging Hokey.... 32831# 328320 short 0x259 mumps avl global 32833>2 byte >0 (V%d) 32834>6 byte >0 with %d byte name 32835>7 byte >0 and %d byte data cells 328360 short 0x25a mumps blt global 32837>2 byte >0 (V%d) 32838>8 short >0 - %d byte blocks 32839>15 byte 0x00 - P/D format 32840>15 byte 0x01 - P/K/D format 32841>15 byte 0x02 - K/D format 32842>15 byte >0x02 - Bad Flags 32843 32844#------------------------------------------------------------------------------ 32845# $File: pmem,v 1.4 2021/04/26 15:56:00 christos Exp $ 32846# pmem: file(1) magic for Persistent Memory Development Kit pool files 32847# 328480 string PMEM 32849>4 string POOLSET Persistent Memory Poolset file 32850>>11 search REPLICA with replica 32851>4 regex LOG|BLK|OBJ Persistent Memory Pool file, type: %s, 32852>>8 lelong >0 version: %#x, 32853>>12 lelong x compat: %#x, 32854>>16 lelong x incompat: %#x, 32855>>20 lelong x ro_compat: %#x, 32856 32857 32858>>120 leqldate x crtime: %s, 32859>>128 lequad x alignment_desc: %#016llx, 32860 32861>>136 clear x 32862>>136 byte 2 machine_class: 64-bit, 32863>>136 default x machine_class: unknown 32864>>>136 byte x (%#d), 32865 32866>>137 clear x 32867>>137 byte 1 data: little-endian, 32868>>137 byte 2 data: big-endian, 32869>>137 default x data: unknown 32870>>>137 byte x (%#d), 32871 32872>>138 byte !0 reserved[0]: %d, 32873>>139 byte !0 reserved[1]: %d, 32874>>140 byte !0 reserved[2]: %d, 32875>>141 byte !0 reserved[3]: %d, 32876 32877>>142 clear x 32878>>142 leshort 62 machine: x86_64 32879>>142 leshort 183 machine: aarch64 32880>>142 default x machine: unknown 32881>>>142 leshort x (%#d) 32882 32883>4 string BLK 32884>>4096 lelong x \b, blk.bsize: %d 32885 32886>4 string OBJ 32887>>4096 string >0 \b, obj.layout: '%s' 32888>>4096 string <0 \b, obj.layout: NULL 32889 32890#------------------------------------------------------------------------------ 32891# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $ 32892# polyml: file(1) magic for PolyML 32893# 32894# PolyML 32895# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 32896# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 32897 32898# [0]: https://www.polyml.org/ 32899# [1]: https://github.com/polyml/polyml/blob/master/\ 32900# libpolyml/savestate.cpp#L146-L147 32901# [2]: https://github.com/polyml/polyml/blob/master/\ 32902# libpolyml/savestate.cpp#L1262-L1263 32903 32904# Type: Poly/ML saved data 32905# From: Matthew Fernandez <matthew.fernandez@gmail.com> 32906 329070 string POLYSAVE Poly/ML saved state 32908>8 long x version %u 32909 329100 string POLYMODU Poly/ML saved module 32911>8 long x version %u 32912 32913#------------------------------------------------------------------------------ 32914# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $ 32915# printer: file(1) magic for printer-formatted files 32916# 32917 32918# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 329190 string %! PostScript document text 32920!:mime application/postscript 32921!:apple ASPSTEXT 32922>2 string PS-Adobe- conforming 32923>>11 string >\0 DSC level %.3s 32924>>>15 string EPS \b, type %s 32925>>>15 string Query \b, type %s 32926>>>15 string ExitServer \b, type %s 32927>>>15 search/1000 %%LanguageLevel:\040 32928>>>>&0 string >\0 \b, Level %s 32929# Some PCs have the annoying habit of adding a ^D as a document separator 329300 string \004%! PostScript document text 32931!:mime application/postscript 32932!:apple ASPSTEXT 32933>3 string PS-Adobe- conforming 32934>>12 string >\0 DSC level %.3s 32935>>>16 string EPS \b, type %s 32936>>>16 string Query \b, type %s 32937>>>16 string ExitServer \b, type %s 32938>>>16 search/1000 %%LanguageLevel:\040 32939>>>>&0 string >\0 \b, Level %s 329400 string \033%-12345X%!PS PostScript document 32941 32942# DOS EPS Binary File Header 32943# From: Ed Sznyter <ews@Black.Market.NET> 329440 belong 0xC5D0D3C6 DOS EPS Binary File 32945>4 long >0 Postscript starts at byte %d 32946>>8 long >0 length %d 32947>>>12 long >0 Metafile starts at byte %d 32948>>>>16 long >0 length %d 32949>>>20 long >0 TIFF starts at byte %d 32950>>>>24 long >0 length %d 32951 32952# Summary: Adobe's PostScript Printer Description File 32953# Extension: .ppd 32954# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 32955# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 32956# 329570 string *PPD-Adobe:\x20 PPD file 32958>&0 string x \b, version %s 32959 32960# HP Printer Job Language 329610 string \033%-12345X@PJL HP Printer Job Language data 32962# HP Printer Job Language 32963# The header found on Win95 HP plot files is the "Silliest Thing possible" 32964# (TM) 32965# Every driver puts the language at some random position, with random case 32966# (LANGUAGE and Language) 32967# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 32968# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 32969# 329700 string \033%-12345X@PJL HP Printer Job Language data 32971>&0 string >\0 %s 32972>>&0 string >\0 %s 32973>>>&0 string >\0 %s 32974>>>>&0 string >\0 %s 32975#>15 string \ ENTER\ LANGUAGE\ = 32976#>31 string PostScript PostScript 32977 32978# From: Stefan Thurner <thurners@nicsys.de> 329790 string \033%-12345X@PJL 32980>&0 search/10000 %! PJL encapsulated PostScript document text 32981 32982# Rick Richardson <rickrich@gmail.com> 32983 32984# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 32985# For Oki Data Printers - HIPERC 32986# For Konica Minolta Printers - LAVAFLOW 32987# For Samsung Printers - QPDL 32988# For HP Printers - ZJS stands for Zenographics ZJStream 329890 string \033%-12345X@PJL HP Printer Job Language data 32990>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 32991>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 32992>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 32993>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 32994>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 32995>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 32996 32997 32998# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 329990 string \033E\033 HP PCL printer data 33000>3 string \&l0A - default page size 33001>3 string \&l1A - US executive page size 33002>3 string \&l2A - US letter page size 33003>3 string \&l3A - US legal page size 33004>3 string \&l26A - A4 page size 33005>3 string \&l80A - Monarch envelope size 33006>3 string \&l81A - No. 10 envelope size 33007>3 string \&l90A - Intl. DL envelope size 33008>3 string \&l91A - Intl. C5 envelope size 33009>3 string \&l100A - Intl. B5 envelope size 33010>3 string \&l-81A - No. 10 envelope size (landscape) 33011>3 string \&l-90A - Intl. DL envelope size (landscape) 33012 33013# IMAGEN printer-ready files: 330140 string @document( Imagen printer 33015# this only works if "language xxx" is first item in Imagen header. 33016>10 string language\ impress (imPRESS data) 33017>10 string language\ daisy (daisywheel text) 33018>10 string language\ diablo (daisywheel text) 33019>10 string language\ printer (line printer emulation) 33020>10 string language\ tektronix (Tektronix 4014 emulation) 33021# Add any other languages that your Imagen uses - remember 33022# to keep the word `text' if the file is human-readable. 33023# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 33024# 33025# Now magic for IMAGEN font files... 330260 string Rast RST-format raster font data 33027>45 string >0 face %s 33028# From Jukka Ukkonen 330290 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 33030 33031# From <mike@flyn.org> 33032# These are the /etc/magic entries to decode data sent to an Epson printer. 330330 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 33034 33035 33036#------------------------------------------------------------------------------ 33037# zenographics: file(1) magic for Zenographics ZjStream printer data 33038# Rick Richardson <rickrich@gmail.com> 330390 string JZJZ 33040>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 330410 string ZJZJ 33042>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 33043 33044 33045#------------------------------------------------------------------------------ 33046# Oak Technologies printer stream 33047# Rick Richardson <rickrich@gmail.com> 330480 string OAK 33049>0x07 byte 0 33050>0x0b byte 0 Oak Technologies printer stream 33051 33052# This would otherwise be recognized as PostScript - nick@debian.org 330530 string %!VMF SunClock's Vector Map Format data 33054 33055#------------------------------------------------------------------------------ 33056# HP LaserJet 1000 series downloadable firmware file 330570 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 33058 33059# From: Paolo <oopla@users.sf.net> 33060# Epson ESC/Page, ESC/PageColor 330610 string \x1b\x01@EJL Epson ESC/Page language printer data 33062 33063#------------------------------------------------------------------------------ 33064# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $ 33065# project: file(1) magic for Project management 33066# 33067# Magic strings for ftnchek project files. Alexander Mai 330680 string FTNCHEK_\ P project file for ftnchek 33069>10 string 1 version 2.7 33070>10 string 2 version 2.8 to 2.10 33071>10 string 3 version 2.11 or later 33072 33073#------------------------------------------------------------------------------ 33074# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $ 33075# psdbms: file(1) magic for psdatabase 33076# 33077# Update: Joerg Jenderek 33078# GRR: line below too general as it catches also some Panorama database *.pan , 33079# AppleWorks word processor 330800 belong&0xff00ffff 0x56000000 33081# assume version starts with digit 33082>1 regex/s =^[0-9] ps database 33083>>1 string >\0 version %s 33084# kernel name 33085>>4 string >\0 from kernel %s 33086 33087#------------------------------------------------------------------------------ 33088# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $ 33089# psl: file(1) magic for Public Suffix List representations 33090# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> 33091# URL: https://publicsuffix.org 33092# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166 33093 330940 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data 33095 330960 string .DAFSA@PSL_ 33097>15 string \n Public Suffix List data (optimized) 33098>>11 byte >0x2f 33099>>>11 byte <0x3a (Version %c) 33100 33101#------------------------------------------------------------------------------ 33102# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 33103# pulsar: file(1) magic for Pulsar POP3 daemon binary files 33104# 33105# http://pulsar.sourceforge.net 33106# mailto:rok.papez@lugos.si 33107# 33108 331090 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 33110>4 ubelong x Version: %d. 33111>8 ubelong x \b%d 33112 33113 33114#------------------------------------------------------------------------------ 33115# $File: puzzle,v 1.2 2021/10/07 15:40:40 christos Exp $ 33116# wsdl: Magic for various puzzles 33117 33118# PUZ crossword puzzles from Alan De Smet 33119# Test files can be found at 33120# https://theworld.com/~wij/puzzles/wij-themed.html or using the 33121# "Universal" or "WS Journal" links on the right side of 33122# https://www.cruciverb.com/ . 33123 331242 string ACROSS&DOWN PUZ crossword puzzle 33125>0x2c byte x %d x 33126>0x2d byte x %d, 33127>0x2e leshort x %d clues, 33128>0x1e leshort 0x0000 plain text solution 33129>0x1e leshort !0x0000 scrambled solution 33130 33131#------------------------------------------------------------------------------ 33132# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $ 33133# pwsafe: file(1) magic for passwordsafe file 33134# 33135# Password Safe 33136# http://passwordsafe.sourceforge.net/ 33137# file format specs 33138# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 33139# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 33140# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 33141# V2 and V1 have no easy identifier that I can find 33142# .psafe3 331430 string PWS3 Password Safe V3 database 33144 33145#------------------------------------------------------------------------------ 33146# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 33147# pyramid: file(1) magic for Pyramids 33148# 33149# XXX - byte order? 33150# 331510 long 0x50900107 Pyramid 90x family executable 331520 long 0x50900108 Pyramid 90x family pure executable 33153>16 long >0 not stripped 331540 long 0x5090010b Pyramid 90x family demand paged pure executable 33155>16 long >0 not stripped 33156 33157#------------------------------------------------------------------------------ 33158# $File: python,v 1.45 2022/07/24 23:59:37 christos Exp $ 33159# python: file(1) magic for python 33160# 33161# Outlook puts """ too for urgent messages 33162# From: David Necas <yeti@physics.muni.cz> 33163# often the module starts with a multiline string 331640 string/t """ Python script text executable 33165# MAGIC as specified in Python/import.c (1.0 to 3.7) 33166# and in Lib/importlib/_bootstrap_external.py (3.5+) 33167# two bytes of magic followed by "\r\n" in little endian order 331680 belong 0x02099900 python 1.0 byte-compiled 33169!:mime application/x-bytecode.python 331700 belong 0x03099900 python 1.1/1.2 byte-compiled 33171!:mime application/x-bytecode.python 331720 belong 0x892e0d0a python 1.3 byte-compiled 33173!:mime application/x-bytecode.python 331740 belong 0x04170d0a python 1.4 byte-compiled 33175!:mime application/x-bytecode.python 331760 belong 0x994e0d0a python 1.5 byte-compiled 33177!:mime application/x-bytecode.python 331780 belong 0xfcc40d0a python 1.6 byte-compiled 33179!:mime application/x-bytecode.python 331800 belong 0xfdc40d0a python 1.6 byte-compiled 33181!:mime application/x-bytecode.python 331820 belong 0x87c60d0a python 2.0 byte-compiled 33183!:mime application/x-bytecode.python 331840 belong 0x88c60d0a python 2.0 byte-compiled 33185!:mime application/x-bytecode.python 331860 belong 0x2aeb0d0a python 2.1 byte-compiled 33187!:mime application/x-bytecode.python 331880 belong 0x2beb0d0a python 2.1 byte-compiled 33189!:mime application/x-bytecode.python 331900 belong 0x2ded0d0a python 2.2 byte-compiled 33191!:mime application/x-bytecode.python 331920 belong 0x2eed0d0a python 2.2 byte-compiled 33193!:mime application/x-bytecode.python 331940 belong 0x3bf20d0a python 2.3 byte-compiled 33195!:mime application/x-bytecode.python 331960 belong 0x3cf20d0a python 2.3 byte-compiled 33197!:mime application/x-bytecode.python 331980 belong 0x45f20d0a python 2.3 byte-compiled 33199!:mime application/x-bytecode.python 332000 belong 0x59f20d0a python 2.4 byte-compiled 33201!:mime application/x-bytecode.python 332020 belong 0x63f20d0a python 2.4 byte-compiled 33203!:mime application/x-bytecode.python 332040 belong 0x6df20d0a python 2.4 byte-compiled 33205!:mime application/x-bytecode.python 332060 belong 0x6ef20d0a python 2.4 byte-compiled 33207!:mime application/x-bytecode.python 332080 belong 0x77f20d0a python 2.5 byte-compiled 33209!:mime application/x-bytecode.python 332100 belong 0x81f20d0a python 2.5 byte-compiled 33211!:mime application/x-bytecode.python 332120 belong 0x8bf20d0a python 2.5 byte-compiled 33213!:mime application/x-bytecode.python 332140 belong 0x8cf20d0a python 2.5 byte-compiled 33215!:mime application/x-bytecode.python 332160 belong 0x95f20d0a python 2.5 byte-compiled 33217!:mime application/x-bytecode.python 332180 belong 0x9ff20d0a python 2.5 byte-compiled 33219!:mime application/x-bytecode.python 332200 belong 0xa9f20d0a python 2.5 byte-compiled 33221!:mime application/x-bytecode.python 332220 belong 0xb3f20d0a python 2.5 byte-compiled 33223!:mime application/x-bytecode.python 332240 belong 0xb4f20d0a python 2.5 byte-compiled 33225!:mime application/x-bytecode.python 332260 belong 0xc7f20d0a python 2.6 byte-compiled 33227!:mime application/x-bytecode.python 332280 belong 0xd1f20d0a python 2.6 byte-compiled 33229!:mime application/x-bytecode.python 332300 belong 0xd2f20d0a python 2.6 byte-compiled 33231!:mime application/x-bytecode.python 332320 belong 0xdbf20d0a python 2.7 byte-compiled 33233!:mime application/x-bytecode.python 332340 belong 0xe5f20d0a python 2.7 byte-compiled 33235!:mime application/x-bytecode.python 332360 belong 0xeff20d0a python 2.7 byte-compiled 33237!:mime application/x-bytecode.python 332380 belong 0xf9f20d0a python 2.7 byte-compiled 33239!:mime application/x-bytecode.python 332400 belong 0x03f30d0a python 2.7 byte-compiled 33241!:mime application/x-bytecode.python 332420 belong 0x04f30d0a python 2.7 byte-compiled 33243!:mime application/x-bytecode.python 332440 belong 0x0af30d0a PyPy2.7 byte-compiled 33245!:mime application/x-bytecode.python 332460 belong 0xb80b0d0a python 3.0 byte-compiled 33247!:mime application/x-bytecode.python 332480 belong 0xc20b0d0a python 3.0 byte-compiled 33249!:mime application/x-bytecode.python 332500 belong 0xcc0b0d0a python 3.0 byte-compiled 33251!:mime application/x-bytecode.python 332520 belong 0xd60b0d0a python 3.0 byte-compiled 33253!:mime application/x-bytecode.python 332540 belong 0xe00b0d0a python 3.0 byte-compiled 33255!:mime application/x-bytecode.python 332560 belong 0xea0b0d0a python 3.0 byte-compiled 33257!:mime application/x-bytecode.python 332580 belong 0xf40b0d0a python 3.0 byte-compiled 33259!:mime application/x-bytecode.python 332600 belong 0xf50b0d0a python 3.0 byte-compiled 33261!:mime application/x-bytecode.python 332620 belong 0xff0b0d0a python 3.0 byte-compiled 33263!:mime application/x-bytecode.python 332640 belong 0x090c0d0a python 3.0 byte-compiled 33265!:mime application/x-bytecode.python 332660 belong 0x130c0d0a python 3.0 byte-compiled 33267!:mime application/x-bytecode.python 332680 belong 0x1d0c0d0a python 3.0 byte-compiled 33269!:mime application/x-bytecode.python 332700 belong 0x1f0c0d0a python 3.0 byte-compiled 33271!:mime application/x-bytecode.python 332720 belong 0x270c0d0a python 3.0 byte-compiled 33273!:mime application/x-bytecode.python 332740 belong 0x3b0c0d0a python 3.0 byte-compiled 33275!:mime application/x-bytecode.python 332760 belong 0x450c0d0a python 3.1 byte-compiled 33277!:mime application/x-bytecode.python 332780 belong 0x4f0c0d0a python 3.1 byte-compiled 33279!:mime application/x-bytecode.python 332800 belong 0x580c0d0a python 3.2 byte-compiled 33281!:mime application/x-bytecode.python 332820 belong 0x620c0d0a python 3.2 byte-compiled 33283!:mime application/x-bytecode.python 332840 belong 0x6c0c0d0a python 3.2 byte-compiled 33285!:mime application/x-bytecode.python 332860 belong 0x760c0d0a python 3.3 byte-compiled 33287!:mime application/x-bytecode.python 332880 belong 0x800c0d0a python 3.3 byte-compiled 33289!:mime application/x-bytecode.python 332900 belong 0x8a0c0d0a python 3.3 byte-compiled 33291!:mime application/x-bytecode.python 332920 belong 0x940c0d0a python 3.3 byte-compiled 33293!:mime application/x-bytecode.python 332940 belong 0x9e0c0d0a python 3.3 byte-compiled 33295!:mime application/x-bytecode.python 332960 belong 0xb20c0d0a python 3.4 byte-compiled 33297!:mime application/x-bytecode.python 332980 belong 0xbc0c0d0a python 3.4 byte-compiled 33299!:mime application/x-bytecode.python 333000 belong 0xc60c0d0a python 3.4 byte-compiled 33301!:mime application/x-bytecode.python 333020 belong 0xd00c0d0a python 3.4 byte-compiled 33303!:mime application/x-bytecode.python 333040 belong 0xda0c0d0a python 3.4 byte-compiled 33305!:mime application/x-bytecode.python 333060 belong 0xe40c0d0a python 3.4 byte-compiled 33307!:mime application/x-bytecode.python 333080 belong 0xee0c0d0a python 3.4 byte-compiled 33309!:mime application/x-bytecode.python 333100 belong 0xf80c0d0a python 3.5.1- byte-compiled 33311!:mime application/x-bytecode.python 333120 belong 0x020d0d0a python 3.5.1- byte-compiled 33313!:mime application/x-bytecode.python 333140 belong 0x0c0d0d0a python 3.5.1- byte-compiled 33315!:mime application/x-bytecode.python 333160 belong 0x160d0d0a python 3.5.1- byte-compiled 33317!:mime application/x-bytecode.python 333180 belong 0x170d0d0a python 3.5.2+ byte-compiled 33319!:mime application/x-bytecode.python 333200 belong 0x200d0d0a python 3.6 byte-compiled 33321!:mime application/x-bytecode.python 333220 belong 0x210d0d0a python 3.6 byte-compiled 33323!:mime application/x-bytecode.python 333240 belong 0x2a0d0d0a python 3.6 byte-compiled 33325!:mime application/x-bytecode.python 333260 belong 0x2b0d0d0a python 3.6 byte-compiled 33327!:mime application/x-bytecode.python 333280 belong 0x2c0d0d0a python 3.6 byte-compiled 33329!:mime application/x-bytecode.python 333300 belong 0x2d0d0d0a python 3.6 byte-compiled 33331!:mime application/x-bytecode.python 333320 belong 0x2f0d0d0a python 3.6 byte-compiled 33333!:mime application/x-bytecode.python 333340 belong 0x300d0d0a python 3.6 byte-compiled 33335!:mime application/x-bytecode.python 333360 belong 0x310d0d0a python 3.6 byte-compiled 33337!:mime application/x-bytecode.python 333380 belong 0x320d0d0a python 3.6 byte-compiled 33339!:mime application/x-bytecode.python 333400 belong 0x330d0d0a python 3.6 byte-compiled 33341!:mime application/x-bytecode.python 333420 belong 0x3e0d0d0a python 3.7 byte-compiled 33343!:mime application/x-bytecode.python 333440 belong 0x3f0d0d0a python 3.7 byte-compiled 33345!:mime application/x-bytecode.python 33346 33347# magic 3392+ implements PEP 552: Deterministic pycs 333480 name pyc-pep552 33349# the flag field determines how .pyc validity is checked 33350>4 ulelong&1 0 timestamp-based, 33351>>8 uledate x .py timestamp: %s UTC, 33352>>12 ulelong x .py size: %d bytes 33353>4 ulelong&1 !0 hash-based, check-source flag 33354>>4 ulelong&2 0 unset, 33355>>4 ulelong&2 !0 set, 33356>>8 ulequad x hash: 0x%llx 33357 33358# uleshort magic followed by \x0d\0xa 333592 string \x0d\x0a 33360# extra check: only two bits of flag field are currently used 33361>4 ulelong <0x4 33362# \x0d as part of magic should suffice till Python 3.14 (magic 3600) 33363>>1 ubyte 0x0d Byte-compiled Python module for 33364!:mime application/x-bytecode.python 33365# now look at the magic number to determine the version 33366>>>0 uleshort <3400 CPython 3.7, 33367>>>0 default x 33368>>>>0 uleshort <3420 CPython 3.8, 33369>>>>0 default x 33370>>>>>0 uleshort <3430 CPython 3.9, 33371>>>>>0 default x 33372>>>>>>0 uleshort <3450 CPython 3.10, 33373>>>>>>0 default x 33374>>>>>>>0 uleshort <3500 CPython 3.11, 33375>>>>>>>0 default x CPython 3.12 or newer, 33376>>>0 use pyc-pep552 33377>>0 uleshort 240 Byte-compiled Python module for PyPy3.7, 33378!:mime application/x-bytecode.python 33379>>>0 use pyc-pep552 33380>>0 uleshort 256 Byte-compiled Python module for PyPy3.8, 33381!:mime application/x-bytecode.python 33382>>>0 use pyc-pep552 33383>>0 uleshort 336 Byte-compiled Python module for PyPy3.9, 33384!:mime application/x-bytecode.python 33385>>>0 use pyc-pep552 33386 333870 search/1/w #!\040/usr/bin/python Python script text executable 33388!:strength + 15 33389!:mime text/x-script.python 333900 search/1/w #!\040/usr/local/bin/python Python script text executable 33391!:strength + 15 33392!:mime text/x-script.python 333930 search/10/w #!\040/usr/bin/env\040python Python script text executable 33394!:strength + 15 33395!:mime text/x-script.python 33396 33397 33398# from module.submodule import func1, func2 333990 search/8192 import 33400>0 regex \^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$ Python script text executable 33401!:strength + 15 33402!:mime text/x-script.python 33403 33404# def __init__ (self, ...): 334050 search/4096 def\ __init__ 33406>&0 search/64 self Python script text executable 33407!:strength + 15 33408!:mime text/x-script.python 33409 33410# if __name__ == "__main__": 334110 search/4096 if\ __name__ 33412>&0 search/64 '__main__' Python script text executable 33413>&0 search/64 "__main__" Python script text executable 33414!:strength + 15 33415!:mime text/x-script.python 33416 33417# import module [as abrev] 334180 search/8192 import 33419>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable 33420!:mime text/x-script.python 33421 33422# comments 33423#0 search/4096 ''' 33424#>&0 regex .*'''$ Python script text executable 33425#!:mime text/x-script.python 33426 33427#0 search/4096 """ 33428#>&0 regex .*"""$ Python script text executable 33429#!:mime text/x-script.python 33430 33431# try: 33432# except: or finally: 33433# block 334340 search/4096 try: 33435>&0 regex \^[[:space:]]*except.*:$ Python script text executable 33436!:strength + 15 33437!:mime text/x-script.python 33438>&0 search/4096 finally: Python script text executable 33439!:mime text/x-script.python 33440 33441# class name[(base classes,)]: [pass] 334420 search/8192 class 33443>0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable 33444!:strength + 15 33445!:mime text/x-script.python 33446 33447# def name(*args, **kwargs): 334480 search/8192 def\ 33449>0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100} 33450>>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable 33451!:strength + 15 33452!:mime text/x-script.python 33453 33454# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html 334550 string \223NUMPY NumPy data file 33456!:mime application/x-numpy-data 33457>6 byte x \b, version %d 33458>7 byte x \b.%d 33459#>8 leshort x \b, header length=%d 33460>10 string x \b, description %s 33461 33462#------------------------------------------------------------------------------ 33463# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $ 33464# qt: file(1) magic for Qt 33465 33466# https://doc.qt.io/qt-5/resources.html 334670 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 33468 33469# https://qt.gitorious.org/qt/qtbase/source/\ 33470# 5367fa356233da4c0f28172a8f817791525f5457:\ 33471# src/tools/rcc/rcc.cpp#L840 334720 string qres\0\0 Qt Binary Resource file 334730 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 33474 33475# https://qt.gitorious.org/qt/qtbase/source/\ 33476# 5367fa356233da4c0f28172a8f817791525f5457:\ 33477# src/corelib/kernel/qtranslator.cpp#L62 334780 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 33479>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 33480 33481#------------------------------------------------------------------------------ 33482# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $ 33483# file(1) magic for revision control files 33484# From Hendrik Scholz <hendrik@scholz.net> 334850 string/t /1\ :pserver: cvs password text file 33486 33487# Conary changesets 33488# From: Jonathan Smith <smithj@rpath.com> 334890 belong 0xea3f81bb Conary changeset data 33490 33491# Type: Git bundles (git-bundle) 33492# From: Josh Triplett <josh@freedesktop.org> 334930 string #\ v2\ git\ bundle\n Git bundle 33494 33495# Type: Git pack 33496# From: Adam Buchbinder <adam.buchbinder@gmail.com> 33497# Update: Joerg Jenderek 33498# URL: http://fileformats.archiveteam.org/wiki/Git 33499# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt 33500# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 33501# those have a little-endian offset immediately following the magic 'PACK', 33502# the first byte of which is never 0, while the first byte of the Git pack 33503# version, since it's a tiny number stored in big-endian format, is always 0. 335040 string PACK 33505# GRR: line above is too general as it matches also PackDir archive ./acorn 33506# test for major version. Git 2017 accepts version number 2 or 3 33507>4 ubelong <9 33508# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc 33509# or SystemDevice::foobar 33510>>9 search/13 :: 33511# but in git binary 33512>>9 default x Git pack 33513!:mime application/x-git 33514!:ext pack 33515# 4 GB limit implies unsigned integer 33516>>>4 ubelong x \b, version %u 33517>>>8 ubelong x \b, %u objects 33518 33519# Type: Git pack index 33520# From: Adam Buchbinder <adam.buchbinder@gmail.com> 335210 string \377tOc Git pack index 33522>4 belong =2 \b, version 2 33523 33524# Type: Git index file 33525# From: Frederic Briare <fbriere@fbriere.net> 335260 string DIRC Git index 33527>4 belong >0 \b, version %d 33528>>8 belong >0 \b, %d entries 33529 33530# Type: Mercurial bundles 33531# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 335320 string HG10 Mercurial bundle, 33533>4 string UN uncompressed 33534>4 string BZ bzip2 compressed 33535 33536# Type: Subversion (SVN) dumps 33537# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 335380 string SVN-fs-dump-format-version: Subversion dumpfile 33539>28 string >\0 (version: %s) 33540 33541# Type: Bazaar revision bundles and merge requests 33542# URL: https://www.bazaar-vcs.org/ 33543# From: Jelmer Vernooij <jelmer@samba.org> 335440 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 335450 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 33546 33547#------------------------------------------------------------------------------ 33548# $File: riff,v 1.45 2022/07/24 23:47:49 christos Exp $ 33549# riff: file(1) magic for RIFF format 33550# See 33551# 33552# https://www.seanet.com/users/matts/riffmci/riffmci.htm 33553# http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf 33554# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 33555# 33556 33557# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 335580 name riff-wave 33559>0 leshort 0x01 \b, Microsoft PCM 33560>>14 leshort >0 33561>>>14 leshort <1024 \b, %d bit 33562>0 leshort 0x02 \b, Microsoft ADPCM 33563>0 leshort 0x03 \b, IEEE Float 33564>0 leshort 0x04 \b, Compaq VSELP 33565>0 leshort 0x05 \b, IBM CVSD 33566>0 leshort 0x06 \b, ITU G.711 A-law 33567>0 leshort 0x07 \b, ITU G.711 mu-law 33568>0 leshort 0x08 \b, Microsoft DTS 33569>0 leshort 0x10 \b, OKI ADPCM 33570>0 leshort 0x11 \b, IMA ADPCM 33571>0 leshort 0x12 \b, MediaSpace ADPCM 33572>0 leshort 0x13 \b, Sierra ADPCM 33573>0 leshort 0x14 \b, ITU G.723 ADPCM (Yamaha) 33574>0 leshort 0x15 \b, DSP Solutions DIGISTD 33575>0 leshort 0x16 \b, DSP Solutions DIGIFIX 33576>0 leshort 0x17 \b, Dialogic OKI ADPCM 33577>0 leshort 0x18 \b, MediaVision ADPCM 33578>0 leshort 0x19 \b, HP CU 33579>0 leshort 0x20 \b, Yamaha ADPCM 33580>0 leshort 0x21 \b, Speech Compression SONARC 33581>0 leshort 0x22 \b, DSP Group True Speech 33582>0 leshort 0x23 \b, Echo Speech EchoSC1 33583>0 leshort 0x24 \b, AudioFile AF36 33584>0 leshort 0x25 \b, APTX 33585>0 leshort 0x26 \b, AudioFile AF10 33586>0 leshort 0x27 \b, Prosody 1612 33587>0 leshort 0x28 \b, LRC 33588>0 leshort 0x30 \b, Dolby AC2 33589>0 leshort 0x31 \b, GSM 6.10 33590>0 leshort 0x32 \b, MSN Audio 33591>0 leshort 0x33 \b, Antex ADPCME 33592>0 leshort 0x34 \b, Control Res VQLPC 33593>0 leshort 0x35 \b, Digireal 33594>0 leshort 0x36 \b, DigiADPCM 33595>0 leshort 0x37 \b, Control Res CR10 33596>0 leshort 0x38 \b, NMS VBXADPCM 33597>0 leshort 0x39 \b, Roland RDAC 33598>0 leshort 0x3A \b, Echo Speech EchoSC3 33599>0 leshort 0x3B \b, Rockwell ADPCM 33600>0 leshort 0x3C \b, Rockwell Digitalk 33601>0 leshort 0x3D \b, Xebec 33602>0 leshort 0x40 \b, ITU G.721 ADPCM 33603>0 leshort 0x41 \b, ITU G.728 CELP 33604>0 leshort 0x42 \b, MSG723 33605>0 leshort 0x50 \b, MPEG 33606>0 leshort 0x52 \b, RT24 33607>0 leshort 0x53 \b, PAC 33608>0 leshort 0x55 \b, MPEG Layer 3 33609>0 leshort 0x59 \b, Lucent G.723 33610>0 leshort 0x60 \b, Cirrus 33611>0 leshort 0x61 \b, ESPCM 33612>0 leshort 0x62 \b, Voxware 33613>0 leshort 0x63 \b, Canopus Atrac 33614>0 leshort 0x64 \b, ITU G.726 ADPCM 33615>0 leshort 0x65 \b, ITU G.722 ADPCM 33616>0 leshort 0x66 \b, DSAT 33617>0 leshort 0x67 \b, DSAT Display 33618>0 leshort 0x69 \b, Voxware Byte Aligned 33619>0 leshort 0x70 \b, Voxware AC8 33620>0 leshort 0x71 \b, Voxware AC10 33621>0 leshort 0x72 \b, Voxware AC16 33622>0 leshort 0x73 \b, Voxware AC20 33623>0 leshort 0x74 \b, Voxware MetaVoice 33624>0 leshort 0x75 \b, Voxware MetaSound 33625>0 leshort 0x76 \b, Voxware RT29HW 33626>0 leshort 0x77 \b, Voxware VR12 33627>0 leshort 0x78 \b, Voxware VR18 33628>0 leshort 0x79 \b, Voxware TQ40 33629>0 leshort 0x80 \b, Softsound 33630>0 leshort 0x81 \b, Voxware TQ60 33631>0 leshort 0x82 \b, MSRT24 33632>0 leshort 0x83 \b, ITU G.729A 33633>0 leshort 0x84 \b, MVI MV12 33634>0 leshort 0x85 \b, DF G.726 33635>0 leshort 0x86 \b, DF GSM610 33636>0 leshort 0x88 \b, ISIAudio 33637>0 leshort 0x89 \b, Onlive 33638>0 leshort 0x91 \b, SBC24 33639>0 leshort 0x92 \b, Dolby AC3 S/PDIF 33640>0 leshort 0x97 \b, ZyXEL ADPCM 33641>0 leshort 0x98 \b, Philips LPCBB 33642>0 leshort 0x99 \b, Packed 33643>0 leshort 0x100 \b, Rhetorex ADPCM 33644>0 leshort 0x101 \b, BeCubed Software IRAT 33645>0 leshort 0x111 \b, Vivo G.723 33646>0 leshort 0x112 \b, Vivo Siren 33647>0 leshort 0x123 \b, Digital G.723 33648>0 leshort 0x200 \b, Creative ADPCM 33649>0 leshort 0x202 \b, Creative FastSpeech8 33650>0 leshort 0x203 \b, Creative FastSpeech10 33651>0 leshort 0x220 \b, Quarterdeck 33652>0 leshort 0x300 \b, FM Towns Snd 33653>0 leshort 0x400 \b, BTV Digital 33654>0 leshort 0x680 \b, VME VMPCM 33655>0 leshort 0x1000 \b, OLIGSM 33656>0 leshort 0x1001 \b, OLIADPCM 33657>0 leshort 0x1002 \b, OLICELP 33658>0 leshort 0x1003 \b, OLISBC 33659>0 leshort 0x1004 \b, OLIOPR 33660>0 leshort 0x1100 \b, LH Codec 33661>0 leshort 0x1400 \b, Norris 33662>0 leshort 0x1401 \b, ISIAudio 33663>0 leshort 0x1500 \b, Soundspace Music Compression 33664>0 leshort 0x2000 \b, AC3 DVM 33665>0 leshort 0x2001 \b, DTS 33666>2 leshort =1 \b, mono 33667>2 leshort =2 \b, stereo 33668>2 leshort >2 33669>>2 leshort <128 \b, %d channels 33670>4 lelong >0 33671>>4 lelong <1000000 %d Hz 33672 33673# try to find "fmt " 336740 name riff-walk 33675>0 string fmt\x20 33676>>4 lelong >15 33677>>>8 use riff-wave 33678>0 string LIST 33679>>&(4.l+4) use riff-walk 33680>0 string DISP 33681>>&(4.l+4) use riff-walk 33682>0 string bext 33683>>&(4.l+4) use riff-walk 33684>0 string Fake 33685>>&(4.l+4) use riff-walk 33686>0 string fact 33687>>&(4.l+4) use riff-walk 33688>0 string VP8 33689>>11 byte 0x9d 33690>>>12 byte 0x01 33691>>>>13 byte 0x2a \b, VP8 encoding 33692>>>>>14 leshort&0x3fff x \b, %d 33693>>>>>16 leshort&0x3fff x \bx%d, Scaling: 33694>>>>>14 leshort&0xc000 0x0000 \b [none] 33695>>>>>14 leshort&0xc000 0x1000 \b [5/4] 33696>>>>>14 leshort&0xc000 0x2000 \b [5/3] 33697>>>>>14 leshort&0xc000 0x3000 \b [2] 33698>>>>>14 leshort&0xc000 0x0000 \bx[none] 33699>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 33700>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 33701>>>>>14 leshort&0xc000 0x3000 \bx[2] 33702>>>>>15 byte&0x80 =0x00 \b, YUV color 33703>>>>>15 byte&0x80 =0x80 \b, bad color specification 33704>>>>>15 byte&0x40 =0x40 \b, no clamping required 33705>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 33706#>0 string x we got %s 33707#>>&(4.l+4) use riff-walk 33708 33709# RecorderGear TR500 call recorder digits (BCD) 337100 name tr500-call-recorder-digits 33711>0 byte&0xF0 0x00 \b0 33712>0 byte&0xF0 0x10 \b1 33713>0 byte&0xF0 0x20 \b2 33714>0 byte&0xF0 0x30 \b3 33715>0 byte&0xF0 0x40 \b4 33716>0 byte&0xF0 0x50 \b5 33717>0 byte&0xF0 0x60 \b6 33718>0 byte&0xF0 0x70 \b7 33719>0 byte&0xF0 0x80 \b8 33720>0 byte&0xF0 0x90 \b9 33721>0 byte&0xF0 0xb0 \b* 33722>0 byte&0xF0 0xc0 \b# 33723>0 byte&0x0F 0 \b0 33724>0 byte&0x0F 1 \b1 33725>0 byte&0x0F 2 \b2 33726>0 byte&0x0F 3 \b3 33727>0 byte&0x0F 4 \b4 33728>0 byte&0x0F 5 \b5 33729>0 byte&0x0F 6 \b6 33730>0 byte&0x0F 7 \b7 33731>0 byte&0x0F 8 \b8 33732>0 byte&0x0F 9 \b9 33733>0 byte&0x0F 0xb \b* 33734>0 byte&0x0F 0xc \b# 33735 33736# TR500 call recorder extended header 33737# From: David Korth <gerbilsoft@gerbilsoft.com> 33738# Contains dialed/incoming phone number and timestamp. 33739# TODO: Verify byte 15. 337400 name tr500-call-recorder-header 33741>15 byte 2 (outgoing call: 33742>15 byte 4 (incoming call: 33743>1 byte 0xFF \bno number 33744>1 byte !0xFF 33745>>1 use tr500-call-recorder-digits 33746>>2 byte !0xFF 33747>>>2 use tr500-call-recorder-digits 33748>>3 byte !0xFF 33749>>>3 use tr500-call-recorder-digits 33750>>4 byte !0xFF 33751>>>4 use tr500-call-recorder-digits 33752>>5 byte !0xFF 33753>>>5 use tr500-call-recorder-digits 33754>>6 byte !0xFF 33755>>>6 use tr500-call-recorder-digits 33756>>7 byte !0xFF 33757>>>7 use tr500-call-recorder-digits 33758>>8 byte !0xFF 33759>>>8 use tr500-call-recorder-digits 33760>9 byte x \b, 20%02x 33761>10 byte x \b/%02x 33762>11 byte x \b/%02x 33763>12 byte x %02x 33764>13 byte x \b:%02x 33765>14 byte x \b:%02x) 33766 33767# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 33768# 337690 string RIFF RIFF (little-endian) data 33770# RIFF Palette format 33771# Update: Joerg Jenderek 33772# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format 33773# Reference: https://worms2d.info/Palette_file 33774# WAVE/AVI codec registry: https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 33775>8 string PAL\ \b, palette 33776!:mime application/x-riff 33777# color palette by Microsoft Corporation 33778!:ext pal 33779# file size = chunk size + 8 in most cases 33780>>4 ulelong+8 x \b, %u bytes 33781# Extended PAL Format 33782>>12 string plth \b, extended 33783# Simple PAL Format 33784>>12 string data 33785# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes 33786>>>16 ulelong x \b, data size %u 33787# palVersion is always 0x0300 33788#>>>20 leshort x \b, version %#4.4x 33789# palNumEntries specifies the number of palette color entries 33790>>>22 uleshort x \b, %u entries 33791# after palPalEntry sized (number of color entries * 4 ) vector 33792>>>(22.s*4) ubequad x 33793# jump relative 22 ( 8 + 16) bytes forward points after end of file or to 33794# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal 33795>>>>&16 ubelong x \b, extra bytes 33796>>>>>&-4 ubelong >0 %#8.8x 33797# RIFF Device Independent Bitmap format 33798# URL: http://fileformats.archiveteam.org/wiki/RDIB 33799>8 string RDIB \b, device-independent bitmap 33800!:ext rdi/dib 33801>>16 string BM 33802>>>30 leshort 12 \b, OS/2 1.x format 33803>>>>34 leshort x \b, %d x 33804>>>>36 leshort x %d 33805>>>30 leshort 64 \b, OS/2 2.x format 33806>>>>34 leshort x \b, %d x 33807>>>>36 leshort x %d 33808>>>30 leshort 40 \b, Windows 3.x format 33809>>>>34 lelong x \b, %d x 33810>>>>38 lelong x %d x 33811>>>>44 leshort x %d 33812# RIFF MIDI format 33813# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDI 33814>8 string RMID \b, MIDI 33815# http://extension.nirsoft.net/rmi 33816!:mime audio/mid 33817#!:mime audio/x-rmid 33818!:ext rmi 33819# RIFF Multimedia Movie File format 33820# URL: http://fileformats.archiveteam.org/wiki/RIFF_Multimedia_Movie 33821>8 string RMMP \b, multimedia movie 33822!:mime video/x-mmm 33823!:ext mmm 33824# RIFF wrapper for MP3 33825>8 string RMP3 \b, MPEG Layer 3 audio 33826#!:mime audio/x-rmp3 33827# Microsoft WAVE format (*.wav) 33828# URL: http://fileformats.archiveteam.org/wiki/WAV 33829>8 string WAVE \b, WAVE audio 33830#!:mime audio/vnd.wave 33831!:mime audio/x-wav 33832# https://www.macdisk.com/macsigen.php 33833#!:apple ????WAVE 33834!:ext wav/wave 33835>>12 string >\0 33836>>>12 use riff-walk 33837# TR500 call recorder extended header 33838>>16 ulelong 0x1E4 33839>>>20 leshort 0x11 33840>>>>256 byte 4 33841>>>>>256 use tr500-call-recorder-header 33842# Update: Joerg Jenderek 33843# lower case for Corel Draw version 8 Bidi 33844>8 string/c cdr 33845# skip Corel CCX Clipart 33846>>8 string !CDRXcont 33847# Corel Draw Picture 33848>>>0 use corel-draw 33849# URL: http://fileformats.archiveteam.org/wiki/CCX_(Corel) 33850# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/ccx-corel.trid.xml 33851>>8 string =CDRXcont \b, Corel Clipart 33852!:mime application/x-corel-ccx 33853!:ext ccx 33854# 3rd chunk data {Corel\040Binary\040Meta\040File} 33855#>>>20 string x \b, 3rd '%-s' 33856>>>4 ulelong+8 x \b, %u bytes 33857# From: Joerg Jenderek 33858# URL: https://en.wikipedia.org/wiki/CorelDRAW 33859# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 33860# Picture templates created by newer software start with RIFF type CDT 33861>8 string CDT 33862>>0 use corel-draw 33863# Picture templates with version 4.4 33864>8 string CDST 33865>>0 use corel-draw 33866# pattern created by newer software start with RIFF type PAT 33867>8 string PAT 33868>>0 use corel-draw 33869# From: Joerg Jenderek 33870# URL: https://en.wikipedia.org/wiki/Corel_Designer 33871# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer 33872>8 string DES 33873>>8 string !DESC 33874>>>0 use corel-des 33875# Corel Draw templates with version 12.5 or Corel Designer illustration 12 33876>>8 string =DESC 33877# MORE TESTS NEEDED HERE! 33878#>>>0 use corel-des 33879#>>>0 use corel-draw 33880>8 string NUNDROOT \b, Steinberg CuBase 33881# From: Joerg Jenderek 33882# URL: http://fileformats.archiveteam.org/wiki/MIDI_Instrument_Definition_File 33883# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/idf.trid.xml 33884# ftp://curscott.servebeer.com/Download/Apps/_Microsoft/ 33885# Visual%20Studio%206.0%20Professional%20MSDN/ 33886# SAMPLES/VC98/SDK/GRAPHICS/AUDIO/IDFEDIT/GLOBALS.H 33887# Note: called "MIDI Instrument Definition File" by TrID 33888>8 string IDF\ LIST \b, MIDI Instrument Definition File 33889!:mime audio/x-idf 33890!:ext idf 33891# 3rd chunk size like: 254 284 286 670 33892#>>0x10 ulelong x \b, 3th SIZE %u 33893# for debugging purpose display next chunk like: MMAPhdr 33894#>>0x14 string x \b, 4th "%-8.8s" 33895#>>0x1C ulelong x \b, 4th SIZE 0x%x 33896# probably MIDI instrument name like: "Universal-MIDI-Instrument" "instrument name" "General MIDI" 33897>>0x30 string x "%s" 33898# look for inst TAG 33899>>0x31 search/256 inst by 33900# probably manufacture name like: "Unspecified Company" "NVidia Corporation" 33901>>>&0x24 string x "%s" 33902# AVI == Audio Video Interleave 33903# Reference: http://fileformats.archiveteam.org/wiki/AVI 33904>8 string AVI\040 \b, AVI 33905# https://reposcope.com/mimetype/video/x-msvideo 33906!:mime video/x-msvideo 33907# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml 33908#!:mime video/vnd.avi 33909!:ext avi/divx 33910>>12 string LIST 33911>>>20 string hdrlavih 33912>>>>&36 lelong x \b, %u x 33913>>>>&40 lelong x %u, 33914>>>>&4 lelong >1000000 <1 fps, 33915>>>>&4 lelong 1000000 1.00 fps, 33916>>>>&4 lelong 500000 2.00 fps, 33917>>>>&4 lelong 333333 3.00 fps, 33918>>>>&4 lelong 250000 4.00 fps, 33919>>>>&4 lelong 200000 5.00 fps, 33920>>>>&4 lelong 166667 6.00 fps, 33921>>>>&4 lelong 142857 7.00 fps, 33922>>>>&4 lelong 125000 8.00 fps, 33923>>>>&4 lelong 111111 9.00 fps, 33924>>>>&4 lelong 100000 10.00 fps, 33925# ]9.9,10.1[ 33926>>>>&4 lelong <101010 33927>>>>>&-4 lelong >99010 33928>>>>>>&-4 lelong !100000 ~10 fps, 33929>>>>&4 lelong 83333 12.00 fps, 33930# ]11.9,12.1[ 33931>>>>&4 lelong <84034 33932>>>>>&-4 lelong >82645 33933>>>>>>&-4 lelong !83333 ~12 fps, 33934>>>>&4 lelong 66667 15.00 fps, 33935# ]14.9,15.1[ 33936>>>>&4 lelong <67114 33937>>>>>&-4 lelong >66225 33938>>>>>>&-4 lelong !66667 ~15 fps, 33939>>>>&4 lelong 50000 20.00 fps, 33940>>>>&4 lelong 41708 23.98 fps, 33941>>>>&4 lelong 41667 24.00 fps, 33942# ]23.9,24.1[ 33943>>>>&4 lelong <41841 33944>>>>>&-4 lelong >41494 33945>>>>>>&-4 lelong !41708 33946>>>>>>>&-4 lelong !41667 ~24 fps, 33947>>>>&4 lelong 40000 25.00 fps, 33948# ]24.9,25.1[ 33949>>>>&4 lelong <40161 33950>>>>>&-4 lelong >39841 33951>>>>>>&-4 lelong !40000 ~25 fps, 33952>>>>&4 lelong 33367 29.97 fps, 33953>>>>&4 lelong 33333 30.00 fps, 33954# ]29.9,30.1[ 33955>>>>&4 lelong <33445 33956>>>>>&-4 lelong >33223 33957>>>>>>&-4 lelong !33367 33958>>>>>>>&-4 lelong !33333 ~30 fps, 33959>>>>&4 lelong <32224 >30 fps, 33960##>>>>&4 lelong x (%lu) 33961##>>>>&20 lelong x %lu frames, 33962# Note: The tests below assume that the AVI has 1 or 2 streams, 33963# "vids" optionally followed by "auds". 33964# (Should cover 99.9% of all AVIs.) 33965# assuming avih length = 56 33966>>>88 string LIST 33967>>>>96 string strlstrh 33968>>>>>108 string vids video: 33969>>>>>>&0 lelong 0 uncompressed 33970# skip past vids strh 33971>>>>>>(104.l+108) string strf 33972>>>>>>>(104.l+132) lelong 1 RLE 8bpp 33973>>>>>>>(104.l+132) string/c anim Intel RDX 33974>>>>>>>(104.l+132) string/c aur2 AuraVision Aura 2 33975>>>>>>>(104.l+132) string/c aura AuraVision Aura 33976>>>>>>>(104.l+132) string/c bt20 Brooktree MediaStream 33977>>>>>>>(104.l+132) string/c btcv Brooktree Composite Video 33978>>>>>>>(104.l+132) string/c cc12 Intel YUV12 33979>>>>>>>(104.l+132) string/c cdvc Canopus DV 33980>>>>>>>(104.l+132) string/c cham Winnov Caviara Cham 33981>>>>>>>(104.l+132) string/c cljr Proprietary YUV 4 pixels 33982>>>>>>>(104.l+132) string/c cmyk Common Data Format in Printing 33983>>>>>>>(104.l+132) string/c cpla Weitek 4:2:0 YUV Planar 33984>>>>>>>(104.l+132) string/c cvid Cinepak 33985>>>>>>>(104.l+132) string/c cwlt Microsoft Color WLT DIB 33986>>>>>>>(104.l+132) string/c cyuv Creative Labs YUV 33987>>>>>>>(104.l+132) string/c d261 H.261 33988>>>>>>>(104.l+132) string/c d263 H.263 33989>>>>>>>(104.l+132) string/c duck TrueMotion 1.0 33990>>>>>>>(104.l+132) string/c dve2 DVE-2 Videoconferencing 33991>>>>>>>(104.l+132) string/c fljp Field Encoded Motion JPEG 33992>>>>>>>(104.l+132) string/c fvf1 Fractal Video Frame 33993>>>>>>>(104.l+132) string/c gwlt Microsoft Greyscale WLT DIB 33994>>>>>>>(104.l+132) string/c h260 H.260 33995>>>>>>>(104.l+132) string/c h261 H.261 33996>>>>>>>(104.l+132) string/c h262 H.262 33997>>>>>>>(104.l+132) string/c h263 H.263 33998>>>>>>>(104.l+132) string/c h264 H.264 33999>>>>>>>(104.l+132) string/c h265 H.265 34000>>>>>>>(104.l+132) string/c h266 H.266 34001>>>>>>>(104.l+132) string/c h267 H.267 34002>>>>>>>(104.l+132) string/c h268 H.268 34003>>>>>>>(104.l+132) string/c h269 H.269 34004>>>>>>>(104.l+132) string/c i263 Intel I.263 34005>>>>>>>(104.l+132) string/c i420 Intel Indeo 4 34006>>>>>>>(104.l+132) string/c ian Intel RDX 34007>>>>>>>(104.l+132) string/c iclb CellB Videoconferencing Codec 34008>>>>>>>(104.l+132) string/c ilvc Intel Layered Video 34009>>>>>>>(104.l+132) string/c ilvr ITU-T H.263+ 34010>>>>>>>(104.l+132) string/c iraw Intel YUV Uncompressed 34011>>>>>>>(104.l+132) string/c iv30 Intel Indeo 3 34012>>>>>>>(104.l+132) string/c iv31 Intel Indeo 3.1 34013>>>>>>>(104.l+132) string/c iv32 Intel Indeo 3.2 34014>>>>>>>(104.l+132) string/c iv33 Intel Indeo 3.3 34015>>>>>>>(104.l+132) string/c iv34 Intel Indeo 3.4 34016>>>>>>>(104.l+132) string/c iv35 Intel Indeo 3.5 34017>>>>>>>(104.l+132) string/c iv36 Intel Indeo 3.6 34018>>>>>>>(104.l+132) string/c iv37 Intel Indeo 3.7 34019>>>>>>>(104.l+132) string/c iv38 Intel Indeo 3.8 34020>>>>>>>(104.l+132) string/c iv39 Intel Indeo 3.9 34021>>>>>>>(104.l+132) string/c iv40 Intel Indeo 4.0 34022>>>>>>>(104.l+132) string/c iv41 Intel Indeo 4.1 34023>>>>>>>(104.l+132) string/c iv42 Intel Indeo 4.2 34024>>>>>>>(104.l+132) string/c iv43 Intel Indeo 4.3 34025>>>>>>>(104.l+132) string/c iv44 Intel Indeo 4.4 34026>>>>>>>(104.l+132) string/c iv45 Intel Indeo 4.5 34027>>>>>>>(104.l+132) string/c iv46 Intel Indeo 4.6 34028>>>>>>>(104.l+132) string/c iv47 Intel Indeo 4.7 34029>>>>>>>(104.l+132) string/c iv48 Intel Indeo 4.8 34030>>>>>>>(104.l+132) string/c iv49 Intel Indeo 4.9 34031>>>>>>>(104.l+132) string/c iv50 Intel Indeo 5.0 34032>>>>>>>(104.l+132) string/c mpeg MPEG 1 Video Frame 34033>>>>>>>(104.l+132) string/c mjpg Motion JPEG 34034>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 34035>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 34036>>>>>>>(104.l+132) string/c mrca MR Codec 34037>>>>>>>(104.l+132) string/c mrle Run Length Encoding 34038>>>>>>>(104.l+132) string/c msvc Microsoft Video 1 34039>>>>>>>(104.l+132) string/c phmo Photomotion 34040>>>>>>>(104.l+132) string/c qpeq QPEG 1.1 Format Video 34041>>>>>>>(104.l+132) string/c rgbt RGBT 34042>>>>>>>(104.l+132) string/c rle4 Run Length Encoded 4 34043>>>>>>>(104.l+132) string/c rle8 Run Length Encoded 8 34044>>>>>>>(104.l+132) string/c rt21 Intel Indeo 2.1 34045>>>>>>>(104.l+132) string/c rvx Intel RDX 34046>>>>>>>(104.l+132) string/c sdcc Sun Digital Camera Codec 34047>>>>>>>(104.l+132) string/c sfmc Crystal Net SFM Codec 34048>>>>>>>(104.l+132) string/c smsc SMSC 34049>>>>>>>(104.l+132) string/c smsd SMSD 34050>>>>>>>(104.l+132) string/c splc Splash Studios ACM Audio Codec 34051>>>>>>>(104.l+132) string/c sqz2 Microsoft VXtreme Video Codec 34052>>>>>>>(104.l+132) string/c sv10 Sorenson Video R1 34053>>>>>>>(104.l+132) string/c tlms TeraLogic Motion Intraframe Codec A 34054>>>>>>>(104.l+132) string/c tlst TeraLogic Motion Intraframe Codec B 34055>>>>>>>(104.l+132) string/c tm20 TrueMotion 2.0 34056>>>>>>>(104.l+132) string/c tmic TeraLogic Motion Intraframe Codec 2 34057>>>>>>>(104.l+132) string/c tmot TrueMotion Video Compression 34058>>>>>>>(104.l+132) string/c tr20 TrueMotion RT 2.0 34059>>>>>>>(104.l+132) string/c ulti Ultimotion 34060>>>>>>>(104.l+132) string/c uyvy UYVY 4:2:2 byte ordering 34061>>>>>>>(104.l+132) string/c v422 24-bit YUV 4:2:2 format 34062>>>>>>>(104.l+132) string/c v655 16-bit YUV 4:2:2 format 34063>>>>>>>(104.l+132) string/c vcr1 ATI VCR 1.0 34064>>>>>>>(104.l+132) string/c vcr2 ATI VCR 2.0 34065>>>>>>>(104.l+132) string/c vcr3 ATI VCR 3.0 34066>>>>>>>(104.l+132) string/c vcr4 ATI VCR 4.0 34067>>>>>>>(104.l+132) string/c vcr5 ATI VCR 5.0 34068>>>>>>>(104.l+132) string/c vcr6 ATI VCR 6.0 34069>>>>>>>(104.l+132) string/c vcr7 ATI VCR 7.0 34070>>>>>>>(104.l+132) string/c vcr8 ATI VCR 8.0 34071>>>>>>>(104.l+132) string/c vcr9 ATI VCR 9.0 34072>>>>>>>(104.l+132) string/c vdct Video Maker Pro DIB 34073>>>>>>>(104.l+132) string/c vids YUV 4:2:2 CCIR 601 for V422 34074>>>>>>>(104.l+132) string/c vivo Vivo H.263 34075>>>>>>>(104.l+132) string/c vixl VIXL 34076>>>>>>>(104.l+132) string/c vlv1 VLCAP.DRV 34077>>>>>>>(104.l+132) string/c wbvc W9960 34078>>>>>>>(104.l+132) string/c x263 mmioFOURCC('X','2','6','3') 34079>>>>>>>(104.l+132) string/c xlv0 XL Video Decoder 34080>>>>>>>(104.l+132) string/c y211 YUV 2:1:1 Packed 34081>>>>>>>(104.l+132) string/c y411 YUV 4:1:1 Packed 34082>>>>>>>(104.l+132) string/c y41b YUV 4:1:1 Planar 34083>>>>>>>(104.l+132) string/c y41p PC1 4:1:1 34084>>>>>>>(104.l+132) string/c y41t PC1 4:1:1 with transparency 34085>>>>>>>(104.l+132) string/c y42b YUV 4:2:2 Planar 34086>>>>>>>(104.l+132) string/c y42t PC1 4:2:2 with transparency 34087>>>>>>>(104.l+132) string/c yc12 Intel YUV12 Codec 34088>>>>>>>(104.l+132) string/c yuv8 Winnov Caviar YUV8 34089>>>>>>>(104.l+132) string/c yuv9 YUV9 34090>>>>>>>(104.l+132) string/c yuy2 YUY2 4:2:2 byte ordering packed 34091>>>>>>>(104.l+132) string/c yuyv BI_YUYV, Canopus 34092>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 34093>>>>>>>(104.l+132) string/c div3 DivX 3 34094>>>>>>>>112 string/c div3 Low-Motion 34095>>>>>>>>112 string/c div4 Fast-Motion 34096>>>>>>>(104.l+132) string/c divx DivX 4 34097>>>>>>>(104.l+132) string/c dx50 DivX 5 34098>>>>>>>(104.l+132) string/c xvid XviD 34099>>>>>>>(104.l+132) string/c h264 H.264 34100>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 34101>>>>>>>(104.l+132) string/c h264 X.264 or H.264 34102>>>>>>>(104.l+132) lelong 0 34103##>>>>>>>(104.l+132) string x (%.4s) 34104# skip past first (video) LIST 34105>>>>(92.l+96) string LIST 34106>>>>>(92.l+104) string strlstrh 34107>>>>>>(92.l+116) string auds \b, audio: 34108# auds strh length = 56: 34109>>>>>>>(92.l+172) string strf 34110>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 34111>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 34112>>>>>>>>(92.l+180) leshort 0x0006 aLaw 34113>>>>>>>>(92.l+180) leshort 0x0007 uLaw 34114>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 34115>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 34116>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 34117>>>>>>>>(92.l+180) leshort 0x0161 DivX 34118##>>>>>>>>(92.l+180) leshort x (%#.4x) 34119>>>>>>>>(92.l+182) leshort 1 (mono, 34120>>>>>>>>(92.l+182) leshort 2 (stereo, 34121>>>>>>>>(92.l+182) leshort >2 (%d channels, 34122>>>>>>>>(92.l+184) lelong x %d Hz) 34123# auds strh length = 64: 34124>>>>>>>(92.l+180) string strf 34125>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 34126>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 34127>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 34128>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 34129>>>>>>>>(92.l+188) leshort 0x0161 DivX 34130##>>>>>>>>(92.l+188) leshort x (%#.4x) 34131>>>>>>>>(92.l+190) leshort 1 (mono, 34132>>>>>>>>(92.l+190) leshort 2 (stereo, 34133>>>>>>>>(92.l+190) leshort >2 (%d channels, 34134>>>>>>>>(92.l+192) lelong x %d Hz) 34135# From: Joerg Jenderek 34136# URL: http://fileformats.archiveteam.org/wiki/VDR_(VirtualDub) 34137# Reference: http://sourceforge.net/projects/virtualdub/files/virtualdub-win/ 34138# 1.10.4.35491/VirtualDub-1.10.4-src.7z/src/vdremote/Main.cpp 34139# VirtualDub link handler 34140>8 string VDRM \b, VirtualDub link 34141!:mime video/x-vdr 34142!:ext vdr 34143>>12 string PATH \b, PATH 34144# remote-path to video file 34145>>16 pstring/l x %s 34146# Animated Cursor format 34147# Update: Joerg Jenderek 34148# URL: http://fileformats.archiveteam.org/wiki/Windows_Animated_Cursor 34149# Reference: https://www.gdgsoft.com/anituner/help/aniformat.htm 34150>8 string ACON \b, animated cursor 34151!:mime application/x-navi-animation 34152# http://extension.nirsoft.net/ani 34153#!:mime image/ani 34154!:ext ani 34155# INAM tag followed by length of title 34156>>24 string INAM 34157>>>28 pstring/l x "%s" 34158# IART tag followed by length of author 34159>>>(28.l+32) ubelong 0x49415254 34160>>>>&0 pstring/l x %s 34161# SoundFont 2 <mpruett@sgi.com> 34162# URL: http://fileformats.archiveteam.org/wiki/SoundFont_2.0 34163>8 string sfbk \b, SoundFont/Bank 34164!:mime audio/x-sfbk 34165!:ext sf2 34166# MPEG-1 wrapped in a RIFF, apparently 34167# URL: http://file.fyicenter.com/17_Video_.DAT_File_Extension_for_VCD_Files.html 34168>8 string CDXA \b, wrapped MPEG-1 (CDXA) 34169!:mime video/x-cdxa 34170!:ext mpg/dat 34171# URL: http://fileformats.archiveteam.org/wiki/4X_IMA_ADPCM 34172>8 string 4XMV \b, 4X Movie file 34173!:mime video/x-4xmv 34174!:ext 4xm/4xa 34175# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV 34176>8 string AMV\040 \b, AMV 34177# http://fileformats.archiveteam.org/wiki/MTV_Video_(.AMV) 34178!:mime video/x-amv 34179!:ext amv 34180#!:ext amv/mtv 34181# URL: http://fileformats.archiveteam.org/wiki/WebP 34182>8 string WEBP \b, Web/P image 34183!:mime image/webp 34184!:ext webp 34185>>12 use riff-walk 34186# From: Joerg Jenderek 34187# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDS 34188>8 string MIDS \b, MIDI Stream 34189!:mime audio/x-mids 34190!:ext mds 34191# From: Joerg Jenderek 34192# URL: http://mark0.net/soft-trid-e.html 34193# Reference: http://fileformats.archiveteam.org/wiki/Trd_(TRID) 34194>8 string TRID \b, TrID defs package 34195!:mime application/x-trid-trd 34196!:ext trd 34197# From: Joerg Jenderek 34198# URL: https://en.wikipedia.org/wiki/CorelDRAW 34199# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW 34200# Note: Since version 3 CorelDraw Pictures are RIFF based 34201# but data chunks remain proprietary. 34202# Since version 14 til 15 packed as "content/riffData.cdr" and 34203# since 16 "content/root.dat" in ZIP container 34204# TODO: distinguish templates with version 12.5 from Designer illustration 12 34205# display information of RIFF based Corel Draw pictures, templates and patterns 342060 name corel-draw 34207# display second chunk for debugging 34208#>8 string x \b, [8]=%.8s 34209>0 string x \b, Corel Draw 34210#!:mime image/x-coreldraw 34211!:mime application/vnd.corel-draw 34212# used by newer pictures templates 34213>>8 string CDT 34214# used by templates with newer versions since 16 34215>>>12 string =fver Picture template (root.dat) 34216!:ext dat 34217# used by templates with older versions with vrsn tag 34218>>>12 string !fver 34219# used by templates with older versions 14-15 34220>>>>11 string >E Picture template (riffData.cdr) 34221!:ext cdr 34222# used by templates with older versions 11-13 34223>>>>11 string <F Picture template 34224!:ext cdt/cdrt 34225# used by older templates with version 4.4 34226>>8 string CDST Picture template 34227!:ext cdt 34228# used by templates with version 12.5 34229>>8 string DESC Picture template 34230!:ext cdt 34231# used by newer patterns with version 22 34232>>8 string PAT Pattern 34233!:ext dat 34234# remaining older templates, patterns, drawings 34235>>8 default x 34236# pattern with old version 4.y 34237>>>26 ulelong =0x0000206C Pattern 34238!:ext pat 34239# pattern with newer versions 34240>>>26 ulelong =0x00000D2C Pattern 34241!:ext pat 34242# remaining older templates or pictures 34243>>>26 default x 34244# used by older versions 5 - 15 34245>>>>12 string =vrsn 34246# 4th chunk size unequal 282Ch only found for CDR 34247>>>>>26 ulelong !0x0000282c Picture 34248!:ext cdr 34249>>>>>26 default x Picture or template 34250!:ext cdr/cdt 34251# used by newer versions since 16 34252>>>>12 string =fver Picture (root.dat) 34253!:ext dat 34254# version marked by 1 ASCII char: space~3, ... , F~15, ... , N~22, ... R~22 template 34255>11 string x \b, version 34256>11 string >\040 '%-.1s' 34257>0 use corel-version 34258>4 ulelong+8 x \b, %u bytes 34259# 34260# display numeric version of RIFF based Corel after 3rd RIFF tag 342610 name corel-version 34262# for debugging purpose; vrsn for short content; fver for 16 byte size 34263#>12 string x \b, TAG "%-4.4s" 34264# 1st data chunk length 2 implies short content version 34265>16 ulelong 2 34266# vrsn chunk short content interpreted by MajorVersion * 100 + MinorVersion 34267>>20 uleshort/100 x %u 34268>>20 uleshort%100 >0 \b.%u 34269# for debugging purpose display next chunk like: DISP LIST 34270#>>22 string x \b, 4th "%-4.4s" 34271#>>26 ulelong x \b, 4th SIZE %#x 34272# for debugging purpose display 5th chunk like: LIST DISP ccmm osfp 34273#>>(26.l+30) string x \b, 5th "%-4.4s" 34274# 1st data chunk length 10h implies 16 byte content with version info 34275>16 ulelong 0x10 34276>>34 ubyte x %u 34277>>>33 ubyte >0 \b.%u 34278# display information of RIFF based Corel Design formats 342790 name corel-des 34280# display second chunk for debugging 34281#>8 string x \b, [8]=%.8s 34282>12 string x \b, Corel DESIGNER 34283!:mime image/x-corel-des 34284#!:mime application/x-vnd.corel.designer.document 34285# used by Corel Designer with newer versions since 16 34286>12 string =fver graphics (root.dat) 34287!:ext dat 34288# used by Corel Designer templates with older versions with vrsn tag 34289>12 string !fver 34290# used by Corel Designer with versions 14-15 34291>>11 string >D graphics (riffData.cdr) 34292!:ext cdr 34293# used by Corel Designer with versions 10-12 34294>>11 string <E graphics 34295!:ext des 34296# version indicated by last ASCII char of second chunk tag 34297>11 string x \b, version '%-.1s' 34298# but vrsn short content is not always version indicator 34299# exceptions: 'A'~11.4 'B'~12 'C'~12.5 34300>11 string >D 34301>>0 use corel-version 34302# for debugging purpose display next chunk like: DISP LIST 34303#>>22 string x \b, 4th "%-4.4s" 34304#>>26 ulelong x \b, 4th SIZE %#x 34305# for debugging purpose display 5th chunk like: LIST osfp 34306#>>(26.l+30) string x \b, 5th "%-4.4s" 34307>4 ulelong+8 x \b, %u bytes 34308 34309# 34310# XXX - some of the below may only appear in little-endian form. 34311# 34312# Also "MV93" appears to be for one form of Macromedia Director 34313# files, and "GDMF" appears to be another multimedia format. 34314# 343150 string RIFX RIFF (big-endian) data 34316# RIFF Palette format 34317>8 string PAL \b, palette 34318>>16 beshort x \b, version %d 34319>>18 beshort x \b, %d entries 34320# RIFF Device Independent Bitmap format 34321>8 string RDIB \b, device-independent bitmap 34322>>16 string BM 34323>>>30 beshort 12 \b, OS/2 1.x format 34324>>>>34 beshort x \b, %d x 34325>>>>36 beshort x %d 34326>>>30 beshort 64 \b, OS/2 2.x format 34327>>>>34 beshort x \b, %d x 34328>>>>36 beshort x %d 34329>>>30 beshort 40 \b, Windows 3.x format 34330>>>>34 belong x \b, %d x 34331>>>>38 belong x %d x 34332>>>>44 beshort x %d 34333# RIFF MIDI format 34334>8 string RMID \b, MIDI 34335# RIFF Multimedia Movie File format 34336>8 string RMMP \b, multimedia movie 34337# Microsoft WAVE format (*.wav) 34338>8 string WAVE \b, WAVE audio 34339>>20 leshort 1 \b, Microsoft PCM 34340>>>34 leshort >0 \b, %d bit 34341>>22 beshort =1 \b, mono 34342>>22 beshort =2 \b, stereo 34343>>22 beshort >2 \b, %d channels 34344>>24 belong >0 %d Hz 34345# Corel Draw Picture big endian not tested by real examples 34346#>8 string CDRA \b, Corel Draw Picture 34347#>8 string CDR6 \b, Corel Draw Picture, version 6 34348>8 string CDR 34349>>0 use \^corel-draw 34350 34351# AVI == Audio Video Interleave 34352>8 string AVI\040 \b, AVI 34353# Animated Cursor format 34354>8 string ACON \b, animated cursor 34355# Notation Interchange File Format (big-endian only) 34356>8 string NIFF \b, Notation Interchange File Format 34357# SoundFont 2 <mpruett@sgi.com> 34358>8 string sfbk SoundFont/Bank 34359 34360#------------------------------------------------------------------------------ 34361# Sony Wave64 34362# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 34363# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 343640 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 34365# 128 bit + total file size (64 bits) so 24 bytes 34366# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 34367>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 34368!:mime audio/x-w64 34369# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 34370>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 34371>>>&10 leshort =1 \b, mono 34372>>>&10 leshort =2 \b, stereo 34373>>>&10 leshort >2 \b, %d channels 34374>>>&12 lelong >0 %d Hz 34375 34376#------------------------------------------------------------------------------ 34377# MBWF/RF64 34378# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf 343790 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 34380!:mime audio/x-wav 34381>40 search/256 fmt\x20 \b 34382>>&6 leshort =1 \b, mono 34383>>&6 leshort =2 \b, stereo 34384>>&6 leshort >2 \b, %d channels 34385>>&8 lelong >0 %d Hz 34386#------------------------------------------------------------------------------ 34387# $File: ringdove,v 1.1 2022/08/16 12:04:30 christos Exp $ 34388# ringdove: file(1) magic for RingdoveEDA data files 34389 34390# librnd and global 343910 regex/128l ha:rnd-menu-v[0-9]+[\ \t\r\n]*[{] librnd menu system (lihata) 343920 regex/128l ha:rnd-menu-patch-v[0-9]+[\ \t\r\n]*[{] librnd menu patch (lihata) 343930 regex/128l ha:coraleda-project-v[0-9]+[\ \t\r\n]*[{] CoralEDA/Ringdove project file (lihata) 343940 regex/128l ha:ringdove-project-v[0-9]+[\ \t\r\n]*[{] Ringdove project file (lihata) 34395 34396# pcb-rnd 343970 regex/128l ha:pcb-rnd-board-v[0-9]+[\ \t\r\n]*[{] pcb-rnd board file (lihata) 343980 regex/128l li:pcb-rnd-subcircuit-v[0-9]+[\ \t\r\n]*[{] pcb-rnd subcircuit/footprint file (lihata) 343990 regex/128l ha:pcb-rnd-buffer-v[0-9]+[\ \t\r\n]*[{] pcb-rnd paste buffer content (lihata) 344000 regex/128l li:pcb-rnd-conf-v[0-9]+[\ \t\r\n]*[{] pcb-rnd configuration (lihata) 344010 regex/128l ha:pcb-rnd-drc-query-v[0-9]+[\ \t\r\n]*[{] pcb-rnd drc query string (lihata) 344020 regex/128l li:pcb-rnd-font-v[0-9]+[\ \t\r\n]*[{] pcb-rnd vector font (lihata) 344030 regex/128l ha:pcb-rnd-log-v[0-9]+[\ \t\r\n]*[{] pcb-rnd message log dump (lihata) 344040 regex/128l ha:pcb-rnd-padstack-v[0-9]+[\ \t\r\n]*[{] pcb-rnd padstack (lihata) 344050 regex/128l li:pcb-rnd-view-list-v[0-9]+[\ \t\r\n]*[{] pcb-rnd view list (lihata) 344060 regex/128l li:view-list-v[0-9]+[\ \t\r\n]*[{] pcb-rnd view list (lihata) 344070 search Netlist(Freeze) pcb-rnd or gEDA/PCB netlist forward annotation action script 34408 34409# sch-rnd (cschem data model) 344100 regex/128l li:cschem-buffer-v[0-9]+[\ \t\r\n]*[{] sch-rnd/cschem buffer content (lihata) 344110 regex/128l li:sch-rnd-conf-v[0-9]+[\ \t\r\n]*[{] sch-rnd configuration (lihata) 344120 regex/128l ha:std_devmap.v[0-9]+[\ \t\r\n]*[{] sch-rnd devmap (device mapping; lihata) 344130 regex/128l li:cschem-group-v[0-9]+[\ \t\r\n]*[{] sch-rnd/cschem group or symbol (lihata) 344140 regex/128l ha:cschem-sheet-v[0-9]+[\ \t\r\n]*[{] sch-rnd/cschem schematic sheet (lihata) 34415 34416# tEDAx (modular format) 344170 regex/1l tEDAx[\ \t\r\n]v tEDAx (Trivial EDA eXchange) 34418>0 regex begin\ symbol\ v with schematic symbol 34419>0 regex begin\ board\ v with Printed Circuit Board 34420>0 regex begin\ route_req\ v with PCB routing request 34421>0 regex begin\ route_res\ v with PCB routing result 34422>0 regex begin\ camv_layer\ v with camv-rnd exported layer 34423>0 regex begin\ netlist\ v with netlist 34424>0 regex begin\ backann\ v with Ringdove EDA back annotation 34425>0 regex begin\ footprint\ v with PCB footprint 34426>0 regex begin\ drc\ v with PCB DRC script 34427>0 regex begin\ drc_query_rule\ v with pcb-rnd drc_query rules 34428>0 regex begin\ drc_query_def\ v with pcb-rnd drc_query value/config definitions 34429>0 regex begin\ etest\ v with PCB electric test 34430 34431 34432#------------------------------------------------------------------------------ 34433# $File: rpi,v 1.3 2022/04/02 14:39:34 christos Exp $ 34434# rpi: file(1) magic for Raspberry Pi images 34435-44 lelong 0 34436>4 lelong 0 34437>>8 lelong 1 34438>>12 lelong 4 34439>>>16 string 283x 34440>>>>20 lelong 1 34441>>>>>24 lelong 4 34442>>>>>>28 string DTOK 34443>>>>>>>32 lelong 44 34444>>>>>>>>36 lelong 4 34445>>>>>>>>>40 string RPTL Raspberry PI kernel image 34446 34447-56 lelong 0 34448>4 lelong 0 34449>>8 lelong 1 34450>>12 lelong 4 34451>>>16 string 283x 34452>>>>20 lelong 1 34453>>>>>24 lelong 4 34454>>>>>>28 string DTOK 34455>>>>>>>32 lelong 1 34456>>>>>>>>36 lelong 4 34457>>>>>>>>>40 string DDTK8 34458>>>>>>>>>>48 lelong 4 34459>>>>>>>>>>>52 string RPTL Raspberry PI kernel image 34460 34461# From: Joerg Jenderek 34462# URL: https://www.raspberrypi.com/documentation/computers/raspberry-pi.html 34463# #raspberry-pi-4-boot-eeprom 34464# Reference: https://github.com/raspberrypi/rpi-eeprom/blob/master/rpi-eeprom-config 34465# Note: start with same magic as for BIOS (ia32) ROM Extension handled by ./intel 34466# masked with MAGIC_MASK and then compared with MAGIC 344670 belong&0xFFffF00F 0x55aaF00F Raspberry PI EEPROM 34468#!:mime application/octet-stream 34469!:mime application/x-raspberry-eeprom 34470# like: pieeprom-2020-09-03.bin 34471!:ext bin 34472# a 32 bit offset to the next section like: 000184d4 000184c8 00018534 ... 0000bb84 0000bbd4 0000bbd4 34473>4 ubelong x \b, offset %8.8x 34474#>(4.L) ubelong x NEXT=%8.8x 34475# self.length 34476>8 ubelong !0 \b, length %x 34477# self.filename 34478>12 string >0 \b, "%s" 34479# length is zero 34480>8 ubelong =0 34481# if length is zero then 2nd section magic here can be zero; this means sections parsing done 34482>>8 ubelong !0 \b, 2nd MAGIC=%8.8x 34483 34484#------------------------------------------------------------------------------ 34485# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 34486# 34487# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 34488# 344890 belong 0xedabeedb RPM 34490!:mime application/x-rpm 34491>4 byte x v%d 34492>5 byte x \b.%d 34493>6 beshort 1 src 34494>6 beshort 0 bin 34495>>8 beshort 1 i386/x86_64 34496>>8 beshort 2 Alpha/Sparc64 34497>>8 beshort 3 Sparc 34498>>8 beshort 4 MIPS 34499>>8 beshort 5 PowerPC 34500>>8 beshort 6 68000 34501>>8 beshort 7 SGI 34502>>8 beshort 8 RS6000 34503>>8 beshort 9 IA64 34504>>8 beshort 10 Sparc64 34505>>8 beshort 11 MIPSel 34506>>8 beshort 12 ARM 34507>>8 beshort 13 MiNT 34508>>8 beshort 14 S/390 34509>>8 beshort 15 S/390x 34510>>8 beshort 16 PowerPC64 34511>>8 beshort 17 SuperH 34512>>8 beshort 18 Xtensa 34513>>8 beshort 255 noarch 34514>>10 string x %s 34515 34516#delta RPM Daniel Novotny (dnovotny@redhat.com) 345170 string drpm Delta RPM 34518!:mime application/x-rpm 34519>12 string x %s 34520>>8 beshort 11 MIPSel 34521>>8 beshort 12 ARM 34522>>8 beshort 13 MiNT 34523>>8 beshort 14 S/390 34524>>8 beshort 15 S/390x 34525>>8 beshort 16 PowerPC64 34526>>8 beshort 17 SuperH 34527>>8 beshort 18 Xtensa 34528>>10 string x %s 34529 34530#------------------------------------------------------------------------------ 34531# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $ 34532# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages) 34533# see https://en.wikipedia.org/wiki/Rpmsg 34534 345350 string \x76\xe8\x04\x60\xc4\x11\xe3\x86 rpmsg Restricted Permission Message 34536 34537#------------------------------------------------------------------------------ 34538# $File: rst,v 1.3 2020/04/27 01:50:36 christos Exp $ 34539# rst: ReStructuredText http://docutils.sourceforge.net/rst.html 345400 search/256 \=\= 34541!:strength + 30 34542>&0 regex/256 \^[\=]+$ 34543>>&0 search/512 :Author: ReStructuredText file 34544>>&0 default x 34545>>>&0 regex/512 \^\\.\\.[A-Za-z] ReStructuredText file 34546!:ext rst 34547 34548#------------------------------------------------------------------------------ 34549# $File: rtf,v 1.9 2020/12/12 20:01:47 christos Exp $ 34550# rtf: file(1) magic for Rich Text Format (RTF) 34551# 34552# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 34553# Update: Joerg Jenderek 34554# URL: https://en.wikipedia.org/wiki/Rich_Text_Format 34555# Reference: http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf 34556# http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf 345570 string {\\rtf 34558# skip DROID fmt-355-signature-id-522.rtf by looking for valid version 34559>5 ubyte !0xAB 34560# skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version 34561>>5 ubyte !0x5C Rich Text Format data 34562!:mime text/rtf 34563!:apple ????RTF 34564!:ext rtf 34565>>>0 use rtf-info 34566# display information like version, language and code page of RTF 345670 name rtf-info 34568# 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf 34569>5 ubyte !0x7b \b, version %c 34570# The word for character set must precede any text or most other control words 34571>6 string \\mac \b, Apple Macintosh 34572>6 string \\pc 34573# control word \pca 34574>>9 ubyte =0x61 \b, IBM PS/2, code page 850 34575>>9 ubyte !0x61 \b, IBM PC, code page 437 34576# unknown character set or ANSI later after control words like 34577# \adeflang1025 \info \title \author \category \manager 34578# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 34579#>6 search/105 \\ansi \b, ANSI 34580>6 search/502 \\ansi \b, ANSI 34581>6 default x \b, unknown character set 34582# look for explicit codepage keyword 34583# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 34584#>5 search/110 \\ansicpg 34585>5 search/500 \\ansicpg 34586# skip unknown or buggy codepage string 0 like in fdo78502.rtf 34587>>&0 ubyte !0x30 \b, code page 34588# codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi 34589>>>&-1 string x %-.3s 34590# skip space or \ and display possible 4th digit of code page string 34591>>>&2 ubyte >0x2F 34592>>>>&-1 ubyte <0x3A \b%c 34593# possible 5th digit of code page string 34594>>>>>&0 ubyte >0x2F 34595>>>>>>&-1 ubyte <0x3A \b%c 34596# look again at version byte to use default clause 34597>5 ubyte x 34598# Default language ID for South Asian/Middle Eastern text 34599# language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica 34600# Readme-0.72-Persian.rtf 34601#>6 search/1 \\adeflang \b, default middle east language ID 34602>>6 search/497 \\adeflang \b, default middle east language ID 34603# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a 34604>>>&0 string x %.4s 34605# skip \ and NL and show possible 5th digit of language string 34606>>>&4 ubyte >0x2F 34607>>>>&-1 ubyte <0x3A \b%c 34608# else look for default language to be used when the \plain control word is encountered 34609>>6 default x 34610# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" 34611#>>>6 search/127 \\deflang 34612>>>6 search/505 \\deflang 34613>>>>&0 string >0 \b, default language ID %-.4s 34614# possible 5th digit of language string 34615>>>>&4 ubyte >0x2F 34616>>>>>&-1 ubyte <0x3A \b%c 34617 34618# Reference: http://latex2rtf.sourceforge.net/rtfspec_63.html 34619# Note: no real world example found 346200 string {\\urtf Rich Text Format unicoded data 34621!:mime text/rtf 34622#!:apple ????RTF 34623!:ext rtf 34624>1 use rtf-info 34625 34626# URL: https://en.wikipedia.org/wiki/Microsoft_Word 34627# Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Word 34628# Note: called by TrID "Pocket Word document" 34629# by PlanMaker "Pocket Word-Handheld PC" for pwd 34630# by PlanMaker "Pocket Word-Pocket PC" for psw 346310 string {\\pwd Pocket Word document or template 34632# by SoftMaker Office http://extension.nirsoft.net/pwd 34633#!:mime application/msword 34634# https://reposcope.com/mimetype/application/x-pocket-word 34635!:mime application/x-pocket-word 34636# PWD for Handheld PC variant and PSW for Pocket PC variant 34637# PWT for template 34638!:ext pwd/psw/pwt 34639>0 use rtf-info 34640 34641 34642#------------------------------------------------------------------------------ 34643# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $ 34644# ruby: file(1) magic for Ruby scripting language 34645# URL: https://www.ruby-lang.org/ 34646# From: Reuben Thomas <rrt@sc3d.org> 34647 34648# Ruby scripts 346490 search/1/w #!\ /usr/bin/ruby Ruby script text executable 34650!:strength + 15 34651!:mime text/x-ruby 346520 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 34653!:strength + 15 34654!:mime text/x-ruby 346550 search/1 #!/usr/bin/env\ ruby Ruby script text executable 34656!:strength + 15 34657!:mime text/x-ruby 346580 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 34659!:strength + 15 34660!:mime text/x-ruby 34661 34662# What looks like ruby, but does not have a shebang 34663# (modules and such) 34664# From: Lubomir Rintel <lkundrak@v3.sk> 346650 search/8192 require 34666>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' 34667>>0 regex def\ [a-z]|\ do$ 34668>>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 34669!:strength + 30 34670!:mime text/x-ruby 346710 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 34672>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 34673>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 34674!:strength + 30 34675!:mime text/x-ruby 34676# Classes with no modules or defs, beats simple ASCII 346770 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 34678>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text 34679!:strength + 10 34680!:mime text/x-ruby 34681# Looks for function definition to balance python magic 34682# def name (args) 34683# end 346840 search/8192 def\ 34685>0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z] 34686>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 34687!:strength + 10 34688!:mime text/x-ruby 34689 346900 search/8192 require 34691>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' Ruby script text 34692!:mime text/x-ruby 346930 search/8192 include 34694>0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text 34695!:mime text/x-ruby 34696 34697#------------------------------------------------------------------------------ 34698# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 34699# sc: file(1) magic for "sc" spreadsheet 34700# 3470138 string Spreadsheet sc spreadsheet file 34702!:mime application/x-sc 34703 34704#------------------------------------------------------------------------------ 34705# $File: sccs,v 1.8 2020/06/20 21:32:52 christos Exp $ 34706# sccs: file(1) magic for SCCS archives 34707# 34708# SCCS v4 archive structure: 34709# \001h01207 34710# \001s 00276/00000/00000 34711# \001d D 1.1 87/09/23 08:09:20 ian 1 0 34712# \001c date and time created 87/09/23 08:09:20 by ian 34713# \001e 34714# \001u 34715# \001U 34716# ... etc. 34717# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 34718# *Sigh*. And these both came from various parts of the USG. 34719# Maybe we should just switch everybody from SCCS to RCS! 34720# Further, you can't just say '\001h0', because the five-digit number 34721# is a checksum that could (presumably) have any leading digit, 34722# Fortunately we have regular expression matching: 347230 string \001h 34724>2 regex [0-9][0-9][0-9][0-9][0-9]$ 34725>>8 string \001s\040 SCCS v4 archive data 34726>2 string V6,sum= SCCS v6 archive data 34727 34728#------------------------------------------------------------------------------ 34729# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $ 34730# scientific: file(1) magic for scientific formats 34731# 34732# From: Joe Krahn <krahn@niehs.nih.gov> 34733 34734######################################################## 34735# CCP4 data and plot files: 347360 string MTZ\040 MTZ reflection file 34737 3473892 string PLOT%%84 Plot84 plotting file 34739>52 byte 1 , Little-endian 34740>55 byte 1 , Big-endian 34741 34742######################################################## 34743# Electron density MAP/MASK formats 34744 347450 string EZD_MAP NEWEZD Electron Density Map 34746109 string MAP\040( Old EZD Electron Density Map 34747 347480 string/c :-)\040Origin BRIX Electron Density Map 34749>170 string >0 , Sigma:%.12s 34750#>4 string >0 %.178s 34751#>4 addr x %.178s 34752 347537 string 18\040!NTITLE XPLOR ASCII Electron Density Map 347549 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 34755 34756208 string MAP\040 CCP4 Electron Density Map 34757# Assumes same stamp for float and double (normal case) 34758>212 byte 17 \b, Big-endian 34759>212 byte 34 \b, VAX format 34760>212 byte 68 \b, Little-endian 34761>212 byte 85 \b, Convex native 34762 34763############################################################ 34764# X-Ray Area Detector images 347650 string R-AXIS4\ \ \ R-Axis Area Detector Image: 34766>796 lelong <20 Little-endian, IP #%d, 34767>>768 lelong >0 Size=%dx 34768>>772 lelong >0 \b%d 34769>796 belong <20 Big-endian, IP #%d, 34770>>768 belong >0 Size=%dx 34771>>772 belong >0 \b%d 34772 347730 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 34774>796 lelong <20 Little-endian, IP #%d, 34775>>768 lelong >0 Size=%dx 34776>>772 lelong >0 \b%d 34777>796 belong <20 Big-endian, IP #%d, 34778>>768 belong >0 Size=%dx 34779>>772 belong >0 \b%d 34780 34781 347821028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 34783>1072 ulong >1 Compressed(%d), 34784>1100 ulong >1 %d headers, 34785>1104 ulong >0 %d x 34786>1108 ulong >0 %d, 34787>1120 ulong >0 %d bits/pixel 34788 34789# Type: GEDCOM genealogical (family history) data 34790# From: Giuseppe Bilotta 347910 search/1/c 0\ HEAD GEDCOM genealogy text 34792>&0 search 1\ GEDC 34793>>&0 search 2\ VERS version 34794>>>&1 string >\0 %s 34795# From: Phil Endecott <phil05@chezphil.org> 347960 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 347970 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 347980 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 347990 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 34800 34801# PDB: Protein Data Bank files 34802# Adam Buchbinder <adam.buchbinder@gmail.com> 34803# 34804# https://www.wwpdb.org/documentation/format32/sect2.html 34805# https://www.ch.ic.ac.uk/chemime/ 34806# 34807# The PDB file format is fixed-field, 80 columns. From the spec: 34808# 34809# COLS DATA 34810# 1 - 6 "HEADER" 34811# 11 - 50 String(40) 34812# 51 - 59 Date 34813# 63 - 66 IDcode 34814# 34815# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 34816# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 34817# uppercase letters. However, examples have been seen without the date string, 34818# e.g., the example on the chemime site. 348190 string HEADER\ \ \ \040 34820>&0 regex/1l \^.{40} 34821>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 34822>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 34823>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 34824!:mime chemical/x-pdb 34825>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 34826 34827# Type: GDSII Stream file 348280 belong 0x00060002 GDSII Stream file 34829>4 byte 0x00 34830>>5 byte x version %d.0 34831>4 byte >0x00 version %d 34832>>5 byte x \b.%d 34833 34834# Type: LXT (interLaced eXtensible Trace) 34835# chrysn <chrysn@fsfe.org> 348360 beshort 0x0138 interLaced eXtensible Trace (LXT) file 34837>2 beshort >0 (Version %u) 34838 34839#------------------------------------------------------------------------------ 34840# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 348410 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 348420 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 348430 belong 0xedfeedfe Sun 'jks' Java Keystore File data 34844 348450 string \0volume_key volume_key escrow packet 34846# Type: SE Linux policy modules *.pp reference policy 34847# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 34848# URL: https://doc.coker.com.au/computers/selinux-magic 34849# From: Russell Coker <russell@coker.com.au> 34850 348510 lelong 0xf97cff8f SE Linux modular policy 34852>4 lelong x version %d, 34853>8 lelong x %d sections, 34854>>(12.l) lelong 0xf97cff8d 34855>>>(12.l+27) lelong x mod version %d, 34856>>>(12.l+31) lelong 0 Not MLS, 34857>>>(12.l+31) lelong 1 MLS, 34858>>>(12.l+23) lelong 2 34859>>>>(12.l+47) string >\0 module name %s 34860>>>(12.l+23) lelong 1 base 34861 348621 string policy_module( SE Linux policy module source 348632 string policy_module( SE Linux policy module source 34864 348650 string ##\ <summary> SE Linux policy interface source 34866 34867#0 search gen_context( SE Linux policy file contexts 34868 34869#0 search gen_sens( SE Linux policy MLS constraints source 34870 34871#------------------------------------------------------------------------------ 34872# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $ 34873# sendmail: file(1) magic for sendmail config files 34874# 34875# XXX - byte order? 34876# 34877# Update: Joerg Jenderek 34878# GRR: this test is too general as it catches also 34879# READ.ME.FIRST.AWP Sendmail frozen configuration 34880# - version ====|====|====|====|====|====|====|====|====|====|====|====|=== 34881# Email_23_f217153422.ts Sendmail frozen configuration 34882# - version \330jK\354 348830 byte 046 34884# https://www.sendmail.com/sm/open_source/docs/older_release_notes/ 34885# freezed configuration file (dbm format?) created from sendmal.cf with -bz 34886# by older sendmail. til version 8.6 support for frozen configuration files is removed 34887# valid version numbers look like "7.14.4" and should be similar to output of commands 34888# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf" 34889>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 34890# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc 34891!:ext fc 34892>>16 string >\0 - version %s 348930 short 0x271c 34894# look for valid version number 34895>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 34896!:ext fc 34897>>16 string >\0 - version %s 34898 34899#------------------------------------------------------------------------------ 34900# sendmail: file(1) magic for sendmail m4(1) files 34901# 34902# From Hendrik Scholz <hendrik@scholz.net> 34903# i.e. files in /usr/share/sendmail/cf/ 34904# 349050 string divert(-1)\n sendmail m4 text file 34906 34907 34908#------------------------------------------------------------------------------ 34909# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $ 34910# sequent: file(1) magic for Sequent machines 34911# 34912# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 34913# For Sequent's multiprocessor systems (incomplete). 349140 lelong 0x00ea BALANCE NS32000 .o 34915>16 lelong >0 not stripped 34916>124 lelong >0 version %d 349170 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 34918>16 lelong >0 not stripped 34919>124 lelong >0 version %d 349200 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 34921>16 lelong >0 not stripped 34922>124 lelong >0 version %d 349230 lelong 0x30ea BALANCE NS32000 standalone executable 34924>16 lelong >0 not stripped 34925>124 lelong >0 version %d 34926# 34927# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 34928# Symmetry magic nums will not be reached if DOS COM comes before them; 34929# byte 0xeb is matched before these get a chance. 349300 leshort 0x12eb SYMMETRY i386 .o 34931>16 lelong >0 not stripped 34932>124 lelong >0 version %d 349330 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 34934>16 lelong >0 not stripped 34935>124 lelong >0 version %d 349360 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 34937>16 lelong >0 not stripped 34938>124 lelong >0 version %d 34939# https://en.wikipedia.org/wiki/Sequent_Computer_Systems 34940# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 34941#0 leshort 0x42eb SYMMETRY i386 standalone executable 349420 leshort 0x42eb 34943# skip unlike negative version 34944>124 lelong >-1 34945# assuming version 28867614 is very low probable 34946>>124 lelong !28867614 SYMMETRY i386 standalone executable 34947>>>16 lelong >0 not stripped 34948>>>124 lelong >0 version %d 34949 34950#------------------------------------------------------------------------------ 34951# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $ 34952# sereal: file(1) magic the Sereal binary serialization format 34953# 34954# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 34955# 34956# See the specification of the format at 34957# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 34958# 34959# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 34960# doing (byte&0xF0)>>4 here, but unfortunately that's not 34961# supported. So when we print out a message about an unknown format 34962# we'll print out e.g. 0x30 instead of the more human-readable 34963# 0x30>>4. 34964# 34965# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 34966# Sereal.git repository for test Sereal data. 349670 name sereal 34968>4 byte&0x0F x (version %d, 34969>4 byte&0xF0 0x00 uncompressed) 34970>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 34971>4 byte&0xF0 0x20 compressed with incremental Snappy) 34972>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 34973 349740 string/b \=srl Sereal data packet 34975!:mime application/sereal 34976>&0 use sereal 349770 string/b \=\xF3rl Sereal data packet 34978!:mime application/sereal 34979>&0 use sereal 349800 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 34981!:mime application/sereal 34982>&0 use sereal 34983 34984 34985#------------------------------------------------------------------------------ 34986# $File: sgi,v 1.24 2021/09/13 13:23:53 christos Exp $ 34987# sgi: file(1) magic for Silicon Graphics operating systems and applications 34988# 34989# Executable images are handled either in aout (for old-style a.out 34990# files for 68K; they are indistinguishable from other big-endian 32-bit 34991# a.out files) or in mips (for MIPS ECOFF and Ucode files) 34992# 34993 34994# kbd file definitions 349950 string kbd!map kbd map file 34996>8 byte >0 Ver %d: 34997>10 short >0 with %d table(s) 34998 349990 beshort 0x8765 disk quotas file 35000 350010 beshort 0x0506 IRIS Showcase file 35002>2 byte 0x49 - 35003>3 byte x - version %d 350040 beshort 0x0226 IRIS Showcase template 35005>2 byte 0x63 - 35006>3 byte x - version %d 350070 belong 0x5343464d IRIS Showcase file 35008>4 byte x - version %d 350090 belong 0x5443464d IRIS Showcase template 35010>4 byte x - version %d 350110 belong 0xdeadbabe IRIX Parallel Arena 35012>8 belong >0 - version %d 35013 35014# core files 35015# 35016# 32bit core file 350170 belong 0xdeadadb0 IRIX core dump 35018>4 belong 1 of 35019>16 string >\0 '%s' 35020# 64bit core file 350210 belong 0xdeadad40 IRIX 64-bit core dump 35022>4 belong 1 of 35023>16 string >\0 '%s' 35024# N32bit core file 350250 belong 0xbabec0bb IRIX N32 core dump 35026>4 belong 1 of 35027>16 string >\0 '%s' 35028# New style crash dump file 350290 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 35030>36 string >\0 '%s' 35031 35032# Trusted IRIX info 350330 string SGIAUDIT SGI Audit file 35034>8 byte x - version %d 35035>9 byte x \b.%d 35036# 350370 string WNGZWZSC Wingz compiled script 350380 string WNGZWZSS Wingz spreadsheet 350390 string WNGZWZHP Wingz help file 35040# 350410 string #Inventor\040V IRIS Inventor 1.0 file 350420 string #Inventor\040V2 Open Inventor 2.0 file 35043# GLF is OpenGL stream encoding 350440 string glfHeadMagic(); GLF_TEXT 350454 belong 0x7d000000 GLF_BINARY_LSB_FIRST 35046!:strength -30 350474 belong 0x0000007d GLF_BINARY_MSB_FIRST 35048!:strength -30 35049# GLS is OpenGL stream encoding; GLS is the successor of GLF 350500 string glsBeginGLS( GLS_TEXT 350514 belong 0x10000000 GLS_BINARY_LSB_FIRST 35052!:strength -30 350534 belong 0x00000010 GLS_BINARY_MSB_FIRST 35054!:strength -30 35055 35056# Performance Co-Pilot file types 350570 string PmNs PCP compiled namespace (V.0) 350580 string PmN PCP compiled namespace 35059>3 string >\0 (V.%1.1s) 350603 belong 0x84500526 PCP archive 35061>7 byte x (V.%d) 35062>20 belong -2 temporal index 35063>20 belong -1 metadata 35064>20 belong 0 log volume #0 35065>20 belong >0 log volume #%d 35066>24 string >\0 host: %s 350673 belong 0x28500526 PCP archive 35068>7 byte x (V.%d) 35069>24 belong -2 temporal index 35070>24 belong -1 metadata 35071>24 belong 0 log volume #0 35072>24 belong >0 log volume #%d 35073>36 string >\0 host: %s 350740 string PCPFolio PCP 35075>9 string Version: Archive Folio 35076>18 string >\0 (V.%s) 350770 string #pmchart PCP pmchart view 35078>9 string Version 35079>17 string >\0 (V%-3.3s) 350800 string #kmchart PCP pmchart view 35081>9 string Version 35082>17 string >\0 (V.%s) 350830 string pmview PCP pmview config 35084>7 string Version 35085>15 string >\0 (V%-3.3s) 350860 string #pmlogger PCP pmlogger config 35087>10 string Version 35088>18 string >\0 (V%1.1s) 350890 string #pmdahotproc PCP pmdahotproc config 35090>13 string Version 35091>21 string >\0 (V%-3.3s) 350920 string PcPh PCP Help 35093>4 string 1 Index 35094>4 string 2 Text 35095>5 string >\0 (V.%1.1s) 350960 string #pmieconf-rules PCP pmieconf rules 35097>16 string >\0 (V.%1.1s) 350983 string pmieconf-pmie PCP pmie config 35099>17 string >\0 (V.%1.1s) 351000 string #pmlogconf-setup PCP pmlogconf config 35101>17 string >\0 (V.%1.1s) 351021 string pmlogconf PCP pmlogger config 35103>11 string >\0 (V.%1.1s) 351040 string MMV PCP memory mapped values 35105>4 long x (V.%d) 35106 35107# SpeedShop data files 351080 lelong 0x13130303 SpeedShop data file 35109 35110# mdbm files 351110 lelong 0x01023962 mdbm file, version 0 (obsolete) 351120 string mdbm mdbm file, 35113>5 byte x version %d, 35114>6 byte x 2^%d pages, 35115>7 byte x pagesize 2^%d, 35116>17 byte x hash %d, 35117>11 byte x dataformat %d 35118 35119# Alias Maya files 351200 string/t //Maya\040ASCII Alias Maya Ascii File, 35121>13 string >\0 version %s 351228 string MAYAFOR4 Alias Maya Binary File, 35123>32 string >\0 version %s scene 351248 string MayaFOR4 Alias Maya Binary File, 35125>32 string >\0 version %s scene 351268 string CIMG Alias Maya Image File 351278 string DEEP Alias Maya Image File 35128 35129#------------------------------------------------------------------------------ 35130# $File: sgml,v 1.46 2022/08/16 11:16:39 christos Exp $ 35131# Type: SVG Vectorial Graphics 35132# From: Noel Torres <tecnico@ejerciciosresueltos.com> 351330 string/bt \<?xml\ version= 35134>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 35135>>19 search/4096 \<svg SVG Scalable Vector Graphics image 35136!:strength +50 35137!:mime image/svg+xml 35138!:ext svg 35139>>19 search/4096 \<gnc-v2 GnuCash file 35140!:mime application/x-gnucash 351410 string/bt \<svg SVG Scalable Vector Graphics image 35142!:mime image/svg+xml 35143!:ext svg 35144 35145# Sitemap file 351460 string/t \<?xml\ version= 35147>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 35148>>19 search/4096 \<urlset XML Sitemap document text 35149!:mime application/xml-sitemap 35150 35151# OpenStreetMap XML (.osm) 35152# https://wiki.openstreetmap.org/wiki/OSM_XML 35153# From: Markus Heidelberg <markus.heidelberg@web.de> 351540 string \<?xml\ version= 35155>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 35156>>19 search/4096 \<osm OpenStreetMap XML data 35157 35158# xhtml 351590 string/t \<?xml\ version=" 35160>19 search/4096/cWbt \<!doctype\ html XHTML document text 35161>>15 string >\0 (version %.3s) 35162!:mime text/html 351630 string/t \<?xml\ version=' 35164>19 search/4096/cWbt \<!doctype\ html XHTML document text 35165>>15 string >\0 (version %.3s) 35166!:mime text/html 351670 string/t \<?xml\ version=" 35168>19 search/4096/cWbt \<html broken XHTML document text 35169>>15 string >\0 (version %.3s) 35170!:mime text/html 35171 35172#------------------------------------------------------------------------------ 35173# sgml: file(1) magic for Standard Generalized Markup Language 35174# HyperText Markup Language (HTML) is an SGML document type, 35175# from Daniel Quinlan (quinlan@yggdrasil.com) 35176# adapted to string extensions by Anthon van der Neut <anthon@mnt.org) 351770 search/4096/cWt \<!doctype\ html HTML document text 35178!:mime text/html 35179!:strength + 5 35180 35181# SVG document 35182# https://www.w3.org/TR/SVG/single-page.html 351830 search/4096/cWbt \<!doctype\ svg SVG XML document 35184!:mime image/svg+xml 35185!:strength + 15 35186 351870 search/4096/cwt \<head\> HTML document text 35188!:mime text/html 35189!:strength + 15 351900 search/4096/cWt \<head\ HTML document text 35191!:mime text/html 35192!:strength + 15 351930 search/4096/cwt \<title\> HTML document text 35194!:mime text/html 35195!:strength + 15 351960 search/4096/cWt \<title\ HTML document text 35197!:mime text/html 35198!:strength + 15 351990 search/4096/cwt \<html\> HTML document text 35200!:mime text/html 35201!:strength + 15 352020 search/4096/cWt \<html\ HTML document text 35203!:mime text/html 35204!:strength + 15 352050 search/4096/cwt \<script\> HTML document text 35206!:mime text/html 35207!:strength + 15 352080 search/4096/cWt \<script\ HTML document text 35209!:mime text/html 35210!:strength + 15 352110 search/4096/cwt \<style\> HTML document text 35212!:mime text/html 35213!:strength + 15 352140 search/4096/cWt \<style\ HTML document text 35215!:mime text/html 35216!:strength + 15 352170 search/4096/cwt \<table\> HTML document text 35218!:mime text/html 35219!:strength + 15 352200 search/4096/cWt \<table\ HTML document text 35221!:mime text/html 35222!:strength + 15 35223 352240 search/4096/cwt \<a\ href= HTML document text 35225!:mime text/html 35226!:strength + 15 35227 35228# Extensible markup language (XML), a subset of SGML 35229# from Marc Prud'hommeaux (marc@apocalypse.org) 352300 search/1/cwt \<?xml XML document text 35231!:mime text/xml 35232!:strength + 15 352330 string/t \<?xml\ version\ " XML 35234!:mime text/xml 35235!:strength + 15 352360 string/t \<?xml\ version=" XML 35237!:mime text/xml 35238!:strength + 15 35239>15 string/t >\0 %.3s document text 35240>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 35241>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 352420 string/t \<?xml\ version=' XML 35243!:mime text/xml 35244!:strength + 15 35245>15 string/t >\0 %.3s document text 35246>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 35247>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 352480 search/1/wt \<?XML broken XML document text 35249!:mime text/xml 35250!:strength - 10 35251 35252 35253# SGML, mostly from rph@sq 352540 search/4096/cwt \<!doctype exported SGML document text 352550 search/4096/cwt \<!subdoc exported SGML subdocument text 352560 search/4096/cwt \<!-- exported SGML document text 35257!:strength - 10 35258 35259# Web browser cookie files 35260# (Mozilla, Galeon, Netscape 4, Konqueror..) 35261# Ulf Harnhammar <ulfh@update.uu.se> 352620 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 352630 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 352640 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 35265 35266# XML-based format representing braille pages in a digital format. 35267# 35268# Specification: 35269# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html 35270# 35271# Simon Aittamaa <simon.aittamaa@gmail.com> 352720 string \<?xml\ version= 35273>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 35274>>19 search/4096 \<pef Portable Embosser Format 35275!:mime application/x-pef+xml 35276 35277# https://www.qgis.org/en/site/ 352780 string \<!DOCTYPE\040qgis QGIS XML document 35279 35280#------------------------------------------------------------------------ 35281# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $ 35282# file(1) magic for sharc files 35283# 35284# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 35285# FutureGroove Music (dsp@futuregroove.de) 35286 35287#------------------------------------------------------------------------ 35288#0 string Draw RiscOS Drawfile 35289#0 string PACK RiscOS PackdDir archive 35290 35291#------------------------------------------------------------------------ 35292# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 35293 35294#0 string =! Assembler source 35295#0 string Analog ADi asm listing file 352960 string .SYSTEM SHARC architecture file 352970 string .system SHARC architecture file 35298 352990 leshort 0x521C SHARC COFF binary 35300>2 leshort >1 , %d sections 35301>>12 lelong >0 , not stripped 35302 35303#------------------------------------------------------------------------------ 35304# $File: sinclair,v 1.7 2021/04/27 20:35:51 christos Exp $ 35305# sinclair: file(1) sinclair QL 35306 35307# additions to /etc/magic by Thomas M. Ott (ThMO) 35308 35309# Sinclair QL floppy disk formats (ThMO) 353100 string =QL5 QL disk dump data, 35311>3 string =A 720 KB, 35312>3 string =B 1.44 MB, 35313>3 string =C 3.2 MB, 35314>4 string >\0 label:%.10s 35315 35316# Sinclair QL OS dump (ThMO) 353170 belong =0x30000 35318>49124 belong <47104 35319>>49128 belong <47104 35320>>>49132 belong <47104 35321>>>>49136 belong <47104 QL OS dump data, 35322>>>>>49148 string >\0 type %.3s, 35323>>>>>49142 string >\0 version %.4s 35324 35325# Sinclair QL firmware executables (ThMO) 353260 string NqNqNq`\004 QL firmware executable (BCPL) 35327 35328# Sinclair QL libraries (was ThMO) 353290 beshort 0xFB01 QDOS object 35330>2 pstring x '%s' 35331 35332# Sinclair QL executables (was ThMO) 353334 belong 0x4AFB QDOS executable 35334>9 pstring x '%s' 353356 beshort 0x4AFB QDOS executable 35336>9 pstring x '%s' 35337 35338# Sinclair QL ROM (ThMO) 353390 belong =0x4AFB0001 QL plugin-ROM data, 35340>9 pstring =\0 un-named 35341>9 pstring >\0 named: %s 35342# Type: SiSU Markup Language 35343# URL: http://www.sisudoc.org/ 35344# From: Ralph Amissah <ralph.amissah@gmail.com> 35345 353460 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 35347>5 regex [0-9.]+ %s 35348 353490 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 35350>5 regex [0-9.]+ %s 35351 353520 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 35353>5 regex [0-9.]+ %s 35354 353550 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 35356>5 regex [0-9.]+ %s 35357 353580 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 35359>5 regex [0-9.]+ %s 35360 35361#------------------------------------------------------------------------------ 35362# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $ 35363# Sketch Drawings: http://sketch.sourceforge.net/ 35364# From: Edwin Mons <e@ik.nu> 353650 search/1 ##Sketch Sketch document text 35366 35367#----------------------------------------------- 35368# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 35369# GNU Smalltalk image, starting at version 1.6.2 35370# From: catull_us@yahoo.com 35371# 353720 string GSTIm\0\0 GNU SmallTalk 35373# little-endian 35374>7 byte&1 =0 LE image version 35375>>10 byte x %d. 35376>>9 byte x \b%d. 35377>>8 byte x \b%d 35378#>>12 lelong x , data: %ld 35379#>>16 lelong x , table: %ld 35380#>>20 lelong x , memory: %ld 35381# big-endian 35382>7 byte&1 =1 BE image version 35383>>8 byte x %d. 35384>>9 byte x \b%d. 35385>>10 byte x \b%d 35386#>>12 belong x , data: %ld 35387#>>16 belong x , table: %ld 35388#>>20 belong x , memory: %ld 35389 35390 35391 35392#------------------------------------------------------------------------------ 35393# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 35394# smile: file(1) magic for Smile serialization 35395# 35396# The Smile serialization format uses a 4-byte header: 35397# 35398# Constant byte #0: 0x3A (ASCII ':') 35399# Constant byte #1: 0x29 (ASCII ')') 35400# Constant byte #2: 0x0A (ASCII linefeed, '\n') 35401# Variable byte #3, consisting of bits: 35402# Bits 4-7 (4 MSB): 4-bit version number 35403# Bits 3: Reserved 35404# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 35405# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 35406# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 35407# 35408# Reference: http://wiki.fasterxml.com/SmileFormatSpec 35409# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 35410 35411# Detection 354120 string :)\n Smile binary data 35413 35414# Versioning 35415>3 byte&0xF0 x version %d: 35416 35417# Properties 35418>3 byte&0x04 0x04 binary raw, 35419>3 byte&0x04 0x00 binary encoded, 35420>3 byte&0x02 0x02 shared String values enabled, 35421>3 byte&0x02 0x00 shared String values disabled, 35422>3 byte&0x01 0x01 shared field names enabled 35423>3 byte&0x01 0x00 shared field names disabled 35424 35425 35426#------------------------------------------------------------------------------ 35427# $File: sniffer,v 1.32 2022/07/30 16:46:56 christos Exp $ 35428# sniffer: file(1) magic for packet capture files 35429# 35430# From: guy@alum.mit.edu (Guy Harris) 35431# 35432 35433# 35434# Microsoft Network Monitor 1.x capture files. 35435# 354360 string RTSS NetMon capture file 35437>5 byte x - version %d 35438>4 byte x \b.%d 35439>6 leshort 0 (Unknown) 35440>6 leshort 1 (Ethernet) 35441>6 leshort 2 (Token Ring) 35442>6 leshort 3 (FDDI) 35443>6 leshort 4 (ATM) 35444>6 leshort >4 (type %d) 35445 35446# 35447# Microsoft Network Monitor 2.x capture files. 35448# 354490 string GMBU NetMon capture file 35450>5 byte x - version %d 35451>4 byte x \b.%d 35452>6 leshort 0 (Unknown) 35453>6 leshort 1 (Ethernet) 35454>6 leshort 2 (Token Ring) 35455>6 leshort 3 (FDDI) 35456>6 leshort 4 (ATM) 35457>6 leshort 5 (IP-over-IEEE 1394) 35458>6 leshort 6 (802.11) 35459>6 leshort 7 (Raw IP) 35460>6 leshort 8 (Raw IP) 35461>6 leshort 9 (Raw IP) 35462>6 leshort >9 (type %d) 35463 35464# 35465# Network General Sniffer capture files. 35466# Sorry, make that "Network Associates Sniffer capture files." 35467# Sorry, make that "Network General old DOS Sniffer capture files." 35468# 354690 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file 35470>33 byte 2 (compressed) 35471>23 leshort x - version %d 35472>25 leshort x \b.%d 35473>32 byte 0 (Token Ring) 35474>32 byte 1 (Ethernet) 35475>32 byte 2 (ARCNET) 35476>32 byte 3 (StarLAN) 35477>32 byte 4 (PC Network broadband) 35478>32 byte 5 (LocalTalk) 35479>32 byte 6 (Znet) 35480>32 byte 7 (Internetwork Analyzer) 35481>32 byte 9 (FDDI) 35482>32 byte 10 (ATM) 35483 35484# 35485# Cinco Networks NetXRay capture files. 35486# Sorry, make that "Network General Sniffer Basic capture files." 35487# Sorry, make that "Network Associates Sniffer Basic capture files." 35488# Sorry, make that "Network Associates Sniffer Basic, and Windows 35489# Sniffer Pro", capture files." 35490# Sorry, make that "Network General Sniffer capture files." 35491# Sorry, make that "NetScout Sniffer capture files." 35492# 354930 string XCP\0 NetXRay capture file 35494>4 string >\0 - version %s 35495>44 leshort 0 (Ethernet) 35496>44 leshort 1 (Token Ring) 35497>44 leshort 2 (FDDI) 35498>44 leshort 3 (WAN) 35499>44 leshort 8 (ATM) 35500>44 leshort 9 (802.11) 35501 35502# 35503# "libpcap" capture files. 35504# https://www.tcpdump.org/manpages/pcap-savefile.5.html 35505# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 35506# the main program that uses that format, but there are other programs 35507# that use "libpcap", or that use the same capture file format.) 35508# 355090 name pcap-be 35510>4 beshort x - version %d 35511>6 beshort x \b.%d 35512# clear that continuation level match 35513>20 clear x 35514>20 belong&0x03FFFFFF 0 (No link-layer encapsulation 35515>20 belong&0x03FFFFFF 1 (Ethernet 35516>20 belong&0x03FFFFFF 2 (3Mb Ethernet 35517>20 belong&0x03FFFFFF 3 (AX.25 35518>20 belong&0x03FFFFFF 4 (ProNET 35519>20 belong&0x03FFFFFF 5 (CHAOS 35520>20 belong&0x03FFFFFF 6 (Token Ring 35521>20 belong&0x03FFFFFF 7 (BSD ARCNET 35522>20 belong&0x03FFFFFF 8 (SLIP 35523>20 belong&0x03FFFFFF 9 (PPP 35524>20 belong&0x03FFFFFF 10 (FDDI 35525>20 belong&0x03FFFFFF 11 (RFC 1483 ATM 35526>20 belong&0x03FFFFFF 12 (Raw IP 35527>20 belong&0x03FFFFFF 13 (BSD/OS SLIP 35528>20 belong&0x03FFFFFF 14 (BSD/OS PPP 35529>20 belong&0x03FFFFFF 19 (Linux ATM Classical IP 35530>20 belong&0x03FFFFFF 50 (PPP or Cisco HDLC 35531>20 belong&0x03FFFFFF 51 (PPP-over-Ethernet 35532>20 belong&0x03FFFFFF 99 (Symantec Enterprise Firewall 35533>20 belong&0x03FFFFFF 100 (RFC 1483 ATM 35534>20 belong&0x03FFFFFF 101 (Raw IP 35535>20 belong&0x03FFFFFF 102 (BSD/OS SLIP 35536>20 belong&0x03FFFFFF 103 (BSD/OS PPP 35537>20 belong&0x03FFFFFF 104 (BSD/OS Cisco HDLC 35538>20 belong&0x03FFFFFF 105 (802.11 35539>20 belong&0x03FFFFFF 106 (Linux Classical IP over ATM 35540>20 belong&0x03FFFFFF 107 (Frame Relay 35541>20 belong&0x03FFFFFF 108 (OpenBSD loopback 35542>20 belong&0x03FFFFFF 109 (OpenBSD IPsec encrypted 35543>20 belong&0x03FFFFFF 112 (Cisco HDLC 35544>20 belong&0x03FFFFFF 113 (Linux cooked v1 35545>20 belong&0x03FFFFFF 114 (LocalTalk 35546>20 belong&0x03FFFFFF 117 (OpenBSD PFLOG 35547>20 belong&0x03FFFFFF 119 (802.11 with Prism header 35548>20 belong&0x03FFFFFF 122 (RFC 2625 IP over Fibre Channel 35549>20 belong&0x03FFFFFF 123 (SunATM 35550>20 belong&0x03FFFFFF 127 (802.11 with radiotap header 35551>20 belong&0x03FFFFFF 129 (Linux ARCNET 35552>20 belong&0x03FFFFFF 130 (Juniper Multi-Link PPP 35553>20 belong&0x03FFFFFF 131 (Juniper Multi-Link Frame Relay 35554>20 belong&0x03FFFFFF 132 (Juniper Encryption Services PIC 35555>20 belong&0x03FFFFFF 133 (Juniper GGSN PIC 35556>20 belong&0x03FFFFFF 134 (Juniper FRF.16 Frame Relay 35557>20 belong&0x03FFFFFF 135 (Juniper ATM2 PIC 35558>20 belong&0x03FFFFFF 136 (Juniper Advanced Services PIC 35559>20 belong&0x03FFFFFF 137 (Juniper ATM1 PIC 35560>20 belong&0x03FFFFFF 138 (Apple IP over IEEE 1394 35561>20 belong&0x03FFFFFF 139 (SS7 MTP2 with pseudo-header 35562>20 belong&0x03FFFFFF 140 (SS7 MTP2 35563>20 belong&0x03FFFFFF 141 (SS7 MTP3 35564>20 belong&0x03FFFFFF 142 (SS7 SCCP 35565>20 belong&0x03FFFFFF 143 (DOCSIS 35566>20 belong&0x03FFFFFF 144 (Linux IrDA 35567>20 belong&0x03FFFFFF 147 (Private use 0 35568>20 belong&0x03FFFFFF 148 (Private use 1 35569>20 belong&0x03FFFFFF 149 (Private use 2 35570>20 belong&0x03FFFFFF 150 (Private use 3 35571>20 belong&0x03FFFFFF 151 (Private use 4 35572>20 belong&0x03FFFFFF 152 (Private use 5 35573>20 belong&0x03FFFFFF 153 (Private use 6 35574>20 belong&0x03FFFFFF 154 (Private use 7 35575>20 belong&0x03FFFFFF 155 (Private use 8 35576>20 belong&0x03FFFFFF 156 (Private use 9 35577>20 belong&0x03FFFFFF 157 (Private use 10 35578>20 belong&0x03FFFFFF 158 (Private use 11 35579>20 belong&0x03FFFFFF 159 (Private use 12 35580>20 belong&0x03FFFFFF 160 (Private use 13 35581>20 belong&0x03FFFFFF 161 (Private use 14 35582>20 belong&0x03FFFFFF 162 (Private use 15 35583>20 belong&0x03FFFFFF 163 (802.11 with AVS header 35584>20 belong&0x03FFFFFF 164 (Juniper Passive Monitor PIC 35585>20 belong&0x03FFFFFF 165 (BACnet MS/TP 35586>20 belong&0x03FFFFFF 166 (PPPD 35587>20 belong&0x03FFFFFF 167 (Juniper PPPoE 35588>20 belong&0x03FFFFFF 168 (Juniper PPPoE/ATM 35589>20 belong&0x03FFFFFF 169 (GPRS LLC 35590>20 belong&0x03FFFFFF 170 (GPF-T 35591>20 belong&0x03FFFFFF 171 (GPF-F 35592>20 belong&0x03FFFFFF 174 (Juniper PIC Peer 35593>20 belong&0x03FFFFFF 175 (Ethernet with Endace ERF header 35594>20 belong&0x03FFFFFF 176 (Packet-over-SONET with Endace ERF header 35595>20 belong&0x03FFFFFF 177 (Linux LAPD 35596>20 belong&0x03FFFFFF 178 (Juniper Ethernet 35597>20 belong&0x03FFFFFF 179 (Juniper PPP 35598>20 belong&0x03FFFFFF 180 (Juniper Frame Relay 35599>20 belong&0x03FFFFFF 181 (Juniper C-HDLC 35600>20 belong&0x03FFFFFF 182 (FRF.16 Frame Relay 35601>20 belong&0x03FFFFFF 183 (Juniper Voice PIC 35602>20 belong&0x03FFFFFF 184 (Arinc 429 35603>20 belong&0x03FFFFFF 185 (Arinc 653 Interpartition Communication 35604>20 belong&0x03FFFFFF 186 (USB with FreeBSD header 35605>20 belong&0x03FFFFFF 187 (Bluetooth HCI H4 35606>20 belong&0x03FFFFFF 188 (802.16 MAC Common Part Sublayer 35607>20 belong&0x03FFFFFF 189 (Linux USB 35608>20 belong&0x03FFFFFF 190 (Controller Area Network (CAN) v. 2.0B 35609>20 belong&0x03FFFFFF 191 (802.15.4 with Linux padding 35610>20 belong&0x03FFFFFF 192 (PPI 35611>20 belong&0x03FFFFFF 193 (802.16 MAC Common Part Sublayer plus radiotap header 35612>20 belong&0x03FFFFFF 194 (Juniper Integrated Service Module 35613>20 belong&0x03FFFFFF 195 (802.15.4 with FCS 35614>20 belong&0x03FFFFFF 196 (SITA 35615>20 belong&0x03FFFFFF 197 (Endace ERF 35616>20 belong&0x03FFFFFF 198 (Ethernet with u10 Networks pseudo-header 35617>20 belong&0x03FFFFFF 199 (IPMB 35618>20 belong&0x03FFFFFF 200 (Juniper Secure Tunnel 35619>20 belong&0x03FFFFFF 201 (Bluetooth HCI H4 with pseudo-header 35620>20 belong&0x03FFFFFF 202 (AX.25 with KISS header 35621>20 belong&0x03FFFFFF 203 (LAPD 35622>20 belong&0x03FFFFFF 204 (PPP with direction pseudo-header 35623>20 belong&0x03FFFFFF 205 (Cisco HDLC with direction pseudo-header 35624>20 belong&0x03FFFFFF 206 (Frame Relay with direction pseudo-header 35625>20 belong&0x03FFFFFF 209 (Linux IPMB 35626>20 belong&0x03FFFFFF 215 (802.15.4 with non-ASK PHY header 35627>20 belong&0x03FFFFFF 216 (Linux evdev events 35628>20 belong&0x03FFFFFF 219 (MPLS with label as link-layer header 35629>20 belong&0x03FFFFFF 220 (Memory-mapped Linux USB 35630>20 belong&0x03FFFFFF 221 (DECT 35631>20 belong&0x03FFFFFF 222 (AOS Space Data Link protocol 35632>20 belong&0x03FFFFFF 223 (Wireless HART 35633>20 belong&0x03FFFFFF 224 (Fibre Channel FC-2 35634>20 belong&0x03FFFFFF 225 (Fibre Channel FC-2 with frame delimiters 35635>20 belong&0x03FFFFFF 226 (Solaris IPNET 35636>20 belong&0x03FFFFFF 227 (SocketCAN 35637>20 belong&0x03FFFFFF 228 (Raw IPv4 35638>20 belong&0x03FFFFFF 229 (Raw IPv6 35639>20 belong&0x03FFFFFF 230 (802.15.4 without FCS 35640>20 belong&0x03FFFFFF 231 (D-Bus messages 35641>20 belong&0x03FFFFFF 232 (Juniper Virtual Server 35642>20 belong&0x03FFFFFF 233 (Juniper SRX E2E 35643>20 belong&0x03FFFFFF 234 (Juniper Fibre Channel 35644>20 belong&0x03FFFFFF 235 (DVB-CI 35645>20 belong&0x03FFFFFF 236 (MUX27010 35646>20 belong&0x03FFFFFF 237 (STANAG 5066 D_PDUs 35647>20 belong&0x03FFFFFF 238 (Juniper ATM CEMIC 35648>20 belong&0x03FFFFFF 239 (Linux netfilter log messages 35649>20 belong&0x03FFFFFF 240 (Hilscher netAnalyzer 35650>20 belong&0x03FFFFFF 241 (Hilscher netAnalyzer with delimiters 35651>20 belong&0x03FFFFFF 242 (IP-over-Infiniband 35652>20 belong&0x03FFFFFF 243 (MPEG-2 Transport Stream packets 35653>20 belong&0x03FFFFFF 244 (ng4t ng40 35654>20 belong&0x03FFFFFF 245 (NFC LLCP 35655>20 belong&0x03FFFFFF 246 (Packet filter state syncing 35656>20 belong&0x03FFFFFF 247 (InfiniBand 35657>20 belong&0x03FFFFFF 248 (SCTP 35658>20 belong&0x03FFFFFF 249 (USB with USBPcap header 35659>20 belong&0x03FFFFFF 250 (Schweitzer Engineering Laboratories RTAC packets 35660>20 belong&0x03FFFFFF 251 (Bluetooth Low Energy air interface 35661>20 belong&0x03FFFFFF 252 (Wireshark Upper PDU export 35662>20 belong&0x03FFFFFF 253 (Linux netlink 35663>20 belong&0x03FFFFFF 254 (Bluetooth Linux Monitor 35664>20 belong&0x03FFFFFF 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets 35665>20 belong&0x03FFFFFF 256 (Bluetooth Low Energy air interface with pseudo-header 35666>20 belong&0x03FFFFFF 257 (PROFIBUS data link layer 35667>20 belong&0x03FFFFFF 258 (Apple DLT_PKTAP 35668>20 belong&0x03FFFFFF 259 (Ethernet with 802.3 Clause 65 EPON preamble 35669>20 belong&0x03FFFFFF 260 (IPMI trace packets 35670>20 belong&0x03FFFFFF 261 (Z-Wave RF profile R1 and R2 packets 35671>20 belong&0x03FFFFFF 262 (Z-Wave RF profile R3 packets 35672>20 belong&0x03FFFFFF 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto 35673>20 belong&0x03FFFFFF 264 (ISO 14443 messages 35674>20 belong&0x03FFFFFF 265 (IEC 62106 Radio Data System groups 35675>20 belong&0x03FFFFFF 266 (USB with Darwin header 35676>20 belong&0x03FFFFFF 267 (OpenBSD DLT_OPENFLOW 35677>20 belong&0x03FFFFFF 268 (IBM SDLC frames 35678>20 belong&0x03FFFFFF 269 (TI LLN sniffer frames 35679>20 belong&0x03FFFFFF 271 (Linux vsock 35680>20 belong&0x03FFFFFF 272 (Nordic Semiconductor Bluetooth LE sniffer frames 35681>20 belong&0x03FFFFFF 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames 35682>20 belong&0x03FFFFFF 274 (802.3br mPackets 35683>20 belong&0x03FFFFFF 275 (DisplayPort AUX channel monitoring data 35684>20 belong&0x03FFFFFF 276 (Linux cooked v2 35685>20 belong&0x03FFFFFF 278 (OpenVizsla USB 35686>20 belong&0x03FFFFFF 279 (Elektrobit High Speed Capture and Replay (EBHSCR) 35687>20 belong&0x03FFFFFF 281 (Broadcom tag 35688>20 belong&0x03FFFFFF 282 (Broadcom tag (prepended) 35689>20 belong&0x03FFFFFF 283 (802.15.4 with TAP 35690>20 belong&0x03FFFFFF 284 (Marvell DSA 35691>20 belong&0x03FFFFFF 285 (Marvell EDSA 35692>20 belong&0x03FFFFFF 286 (ELEE lawful intercept 35693>20 belong&0x03FFFFFF 287 (Z-Wave serial 35694>20 belong&0x03FFFFFF 288 (USB 2.0 35695>20 belong&0x03FFFFFF 289 (ATSC ALP 35696>20 belong&0x03FFFFFF 290 (Event Tracing for Windows 35697>20 belong&0x03FFFFFF 291 (Hilscher netANALYZER NG pseudo-footer 35698>20 belong&0x03FFFFFF 292 (ZBOSS NCP protocol with pseudo-header 35699>20 belong&0x03FFFFFF 293 (Low-Speed USB 2.0/1.1/1.0 35700>20 belong&0x03FFFFFF 294 (Full-Speed USB 2.0/1.1/1.0 35701>20 belong&0x03FFFFFF 295 (High-Speed USB 2.0 35702# print default match 35703>20 default x 35704>>20 belong x (linktype#%u 35705>16 belong x \b, capture length %u) 35706 35707# packets time stamps in seconds and microseconds. 357080 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) 35709!:mime application/vnd.tcpdump.pcap 35710>0 use pcap-be 357110 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) 35712!:mime application/vnd.tcpdump.pcap 35713>0 use \^pcap-be 35714 35715# packets time stamps in seconds and nanoseconds. 357160 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) 35717!:mime application/vnd.tcpdump.pcap 35718>0 use pcap-be 357190 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) 35720!:mime application/vnd.tcpdump.pcap 35721>0 use \^pcap-be 35722 35723# 35724# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 35725# 357260 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) 35727>0 use pcap-be 357280 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) 35729>0 use \^pcap-be 35730 35731# 35732# "pcapng" capture files. 35733# https://github.com/pcapng/pcapng 35734# Pcapng files can contain multiple sections. Printing the endianness, 35735# snaplen, or other information from the first SHB may be misleading. 35736# 357370 ubelong 0x0a0d0d0a 35738>8 ubelong 0x1a2b3c4d pcapng capture file 35739>>12 beshort x - version %d 35740>>14 beshort x \b.%d 357410 ulelong 0x0a0d0d0a 35742>8 ulelong 0x1a2b3c4d pcapng capture file 35743>>12 leshort x - version %d 35744>>14 leshort x \b.%d 35745 35746# 35747# AIX "iptrace" capture files. 35748# 357490 string iptrace\0401.0 AIX iptrace capture file 357500 string iptrace\0402.0 AIX iptrace capture file 35751 35752# 35753# Novell LANalyzer capture files. 35754# 357550 leshort 0x1001 Novell LANalyzer capture file 357560 leshort 0x1007 Novell LANalyzer capture file 35757 35758# 35759# HP-UX "nettl" capture files. 35760# 357610 string \x54\x52\x00\x64\x00 HP/UX nettl capture file 35762 35763# 35764# RADCOM WAN/LAN Analyzer capture files. 35765# 357660 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 35767 35768# 35769# NetStumbler log files. Not really packets, per se, but about as 35770# close as you can get. These are log files from NetStumbler, a 35771# Windows program, that scans for 802.11b networks. 35772# 357730 string NetS NetStumbler log file 35774>8 lelong x \b, %d stations found 35775 35776# 35777# *Peek tagged capture files. 35778# 357790 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 35780 35781# 35782# Visual Networks traffic capture files. 35783# 357840 string \x05VNF Visual Networks traffic capture file 35785 35786# 35787# Network Instruments Observer capture files. 35788# 357890 string ObserverPktBuffe Network Instruments Observer capture file 35790 35791# 35792# Files from Accellent Group's 5View products. 35793# 35794# URL: http://www.infovista.com 35795# Reference: http://mark0.net/download/triddefs_xml.7z 35796# defs/0/5vw.trid.xml 35797# https://2.na.dl.wireshark.org/src/wireshark-3.6.2.tar.xz 35798# wireshark-3.6.2/wiretap/5views.c 35799# Update: Joerg Jenderek 35800# Note: called "5View capture" by TrID and 35801# "Wireshark capture file" on Windows or 35802# "Packet Capture (Accellent/InfoVista 5view)" by shared MIME-info database 35803# verified/falsified by `wireshark *.5vw` 358040 string \xaa\xaa\xaa\xaa 35805# skip misidentified boot/x86_64/loader/kroete.dat on Suse LEAP DVD 35806# by check for valid record version 35807>8 ulelong =0x00010000 35808>>0 use 5view-le 358090 name 5view-le 35810# t_5VW_Info_Header.Signature = CST_5VW_INFO_HEADER_KEY = 0xAAAAAAAAU 35811>0 ulelong x 5View capture file 35812# https://reposcope.com/mimetype/application/x-5view 35813!:mime application/x-5view 35814!:ext 5vw 35815# size of header in bytes (included signature and reserved fields); probably always 20h 35816>4 ulelong !0x00000020 \b, header size %#x 35817# version of header record; apparently always CST_5VW_INFO_RECORD_VERSION=0x00010000U 35818>8 ulelong !0x00010000 \b, record version %#x 35819# DataSize; total size of data without header like: 18h 35820>12 ulelong x \b, record size %#x 35821# filetype; type of the capture file like: 18001000h 35822>16 ulelong x \b, file type %#8.8x 35823# Reserved[3]; reserved for future use; apparently zero 35824>20 quad !0 \b, Reserved %#llx 35825# look for record header key CST_5VW_RECORDS_HEADER_KEY of structure t_5VW_TimeStamped_Header 35826>0x20 search/0xB8/b \xEE\xEE\x33\x33 \b; record 35827# HeaderSize; actual size of this header in bytes like: 32 24h 35828>>&0 uleshort x size %#x 35829# HeaderType; exact type of this header; probably always 0x4000 35830>>&2 uleshort !0x4000 \b, header type %#x 35831# RecType; type of record like: 80000000h 35832>>&4 ulelong x \b, record type %#x 35833# RecSubType; subtype of record like: 0 35834>>&8 ulelong !0 \b, subtype %#x 35835# RecSize; Size of one record like: 5Ch 35836>>&12 ulelong x \b, RecSize %#x 35837# RecNb; Number of records like: 1 35838>>&16 ulelong >1 \b, %#x records 35839# Timestamp Utc 35840#>>&20 ulelong x \b, RAW TIME %#8.8x 35841>>&20 date x \b, Time-stamp %s 35842 35843#------------------------------------------------------------------------------ 35844# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 35845# softquad: file(1) magic for SoftQuad Publishing Software 35846# 35847# Author/Editor and RulesBuilder 35848# 35849# XXX - byte order? 35850# 358510 string \<!SQ\ DTD> Compiled SGML rules file 35852>9 string >\0 Type %s 358530 string \<!SQ\ A/E> A/E SGML Document binary 35854>9 string >\0 Type %s 358550 string \<!SQ\ STS> A/E SGML binary styles file 35856>9 string >\0 Type %s 358570 short 0xc0de Compiled PSI (v1) data 358580 short 0xc0da Compiled PSI (v2) data 35859>3 string >\0 (%s) 35860# Binary sqtroff font/desc files... 358610 short 0125252 SoftQuad DESC or font file binary 35862>2 short >0 - version %d 35863# Bitmaps... 358640 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 35865#0 string SQ\ BITMAP2 SoftQuad Raster Format data 35866# sqtroff intermediate language (replacement for ditroff int. lang.) 358670 string X\ SoftQuad troff Context intermediate 35868>2 string 495 for AT&T 495 laser printer 35869>2 string hp for Hewlett-Packard LaserJet 35870>2 string impr for IMAGEN imPRESS 35871>2 string ps for PostScript 35872 35873# From: Michael Piefel <piefel@debian.org> 35874# sqtroff intermediate language (replacement for ditroff int. lang.) 358750 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 358760 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 358770 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 358780 string X\ ps SoftQuad troff Context intermediate for PostScript 35879 35880#------------------------------------------------------------------------------ 35881# $File: sosi,v 1.2 2021/02/23 00:51:10 christos Exp $ 35882# SOSI 35883# Summary: Systematic Organization of Spatial Information 35884# Long description: Norwegian text based map format 35885# File extension: .sos 35886# Full name: Petter Reinholdtsen (pere@hungry.com) 35887# Reference: https://en.wikipedia.org/wiki/SOSI 35888# 35889# Example SOSI files available from 35890# https://trac.osgeo.org/gdal/ticket/3638 35891# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/ 35892# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/ 35893# 35894# Start with optional comments (from "!" to the next line end) 35895# followed by ".HODE" and end with "\n.SLUTT" followed by an optional 35896# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at 35897# the start and following ".HODE" near the start there is "..OMR=C3=85DE" 35898# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on 35899# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a 35900# separator, as well as "..SOSI-VERSJON " followed by the format 35901# version and a separator. 35902# 35903# FIXME figure out how to accept any of [space], [tab], [newline] and 35904# [carriage return] as separators, not only line end. 35905 35906# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8 35907# character sets 359080 search ..OMR 35909>0 search ..TRANSPAR 35910>>0 search .HODE SOSI map data 35911>>>&0 search ..SOSI-VERSJON 35912>>>>&1 string x \b, version %s 35913# FIXME could not figure out way to make a match for .SLUTT at the end required 35914#>-7 string \n.SLUTT slutt 35915#>-8 string \n.SLUTT\n slutt-nl 35916#>-9 string \n.SLUTT\r\n slutt-crnl2 35917!:mime text/vnd.sosi 35918!:ext sos 35919 35920#------------------------------------------------------------------------------ 35921# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 35922# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 35923# 35924# Cloyce D. Spradling <cloyce@headgear.org> 35925 359260 string spec SPEC 35927>4 string .cpu CPU 35928>>8 string <: \b%.4s 35929>>12 string . raw result text 35930 3593117 string version=SPECjbb SPECjbb 35932>32 string <: \b%.4s 35933>>37 string <: v%.4s raw result text 35934 359350 string BEGIN\040SPECWEB SPECweb 35936>13 string <: \b%.2s 35937>>15 string _SSL \b_SSL 35938>>>20 string <: v%.4s raw result text 35939>>16 string <: v%.4s raw result text 35940 35941#------------------------------------------------------------------------------ 35942# $File: spectrum,v 1.9 2021/04/26 15:56:00 christos Exp $ 35943# spectrum: file(1) magic for Spectrum emulator files. 35944# 35945# John Elliott <jce@seasip.demon.co.uk> 35946 35947# 35948# Spectrum +3DOS header 35949# 359500 string PLUS3DOS\032 Spectrum +3 data 35951>15 byte 0 - BASIC program 35952>15 byte 1 - number array 35953>15 byte 2 - character array 35954>15 byte 3 - memory block 35955>>16 belong 0x001B0040 (screen) 35956>15 byte 4 - Tasword document 35957>15 string TAPEFILE - ZXT tapefile 35958# 35959# Tape file. This assumes the .TAP starts with a Spectrum-format header, 35960# which nearly all will. 35961# 35962# Update: Sanity-check string contents to be printable. 35963# -Adam Buchbinder <adam.buchbinder@gmail.com> 35964# 359650 string \023\000\000 35966>4 string >\0 35967>>4 string <\177 Spectrum .TAP data "%-10.10s" 35968>>>3 byte 0 - BASIC program 35969>>>3 byte 1 - number array 35970>>>3 byte 2 - character array 35971>>>3 byte 3 - memory block 35972>>>>14 belong 0x001B0040 (screen) 35973 35974# The following three blocks are from pak21-spectrum@srcf.ucam.org 35975# TZX tape images 359760 string ZXTape!\x1a Spectrum .TZX data 35977>8 byte x version %d 35978>9 byte x \b.%d 35979 35980# RZX input recording files 359810 string RZX! Spectrum .RZX data 35982>4 byte x version %d 35983>5 byte x \b.%d 35984 35985# Floppy disk images 359860 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 359870 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 359880 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 359890 string SINCLAIR Spectrum .SCL Betadisk image 35990 35991# Hard disk images 359920 string RS-IDE\x1a Spectrum .HDF hard disk image 35993>7 byte x \b, version %#02x 35994 35995# SZX snapshots (fuse and spectaculator) 35996# Martin M. S. Pedersen <martin@linux.com> 35997# http://www.spectaculator.com/docs/zx-state/header.shtml 35998# 359990 string ZXST zx-state snapshot 36000>4 byte x version %d 36001>5 byte x \b.%d 36002>>6 byte 0 16k ZX Spectrum 36003>>6 byte 1 48k ZX Spectrum/ZX Spectrum+ 36004>>6 byte 2 ZX Spectrum 128 36005>>6 byte 3 ZX Spectrum +2 36006>>6 byte 4 ZX Spectrum +2A/+2B 36007>>6 byte 5 ZX Spectrum +3 36008>>6 byte 6 ZX Spectrum +3e 36009>>6 byte 7 Pentagon 128 36010>>6 byte 8 Timex Sinclair TC2048 36011>>6 byte 9 Timex Sinclair TC2068 36012>>6 byte 10 Scorpion ZS-256 36013>>6 byte 11 ZX Spectrum SE 36014>>6 byte 12 Timex Sinclair TS2068 36015>>6 byte 13 Pentagon 512 36016>>6 byte 14 Pentagon 1024 36017>>6 byte 15 48k ZX Spectrum (NTSC) 36018>>6 byte 16 ZX Spectrum 12Ke 36019>>>7 byte 1 (alternate timings) 36020 36021#------------------------------------------------------------------------------ 36022# $File: sql,v 1.24 2022/07/17 15:32:48 christos Exp $ 36023# sql: file(1) magic for SQL files 36024# 36025# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 36026# Recognize some MySQL files. 36027# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 36028# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 36029# 360300 beshort 0xfe01 MySQL table definition file 36031>2 byte x Version %d 36032>3 byte 0 \b, type UNKNOWN 36033>3 byte 1 \b, type DIAM_ISAM 36034>3 byte 2 \b, type HASH 36035>3 byte 3 \b, type MISAM 36036>3 byte 4 \b, type PISAM 36037>3 byte 5 \b, type RMS_ISAM 36038>3 byte 6 \b, type HEAP 36039>3 byte 7 \b, type ISAM 36040>3 byte 8 \b, type MRG_ISAM 36041>3 byte 9 \b, type MYISAM 36042>3 byte 10 \b, type MRG_MYISAM 36043>3 byte 11 \b, type BERKELEY_DB 36044>3 byte 12 \b, type INNODB 36045>3 byte 13 \b, type GEMINI 36046>3 byte 14 \b, type NDBCLUSTER 36047>3 byte 15 \b, type EXAMPLE_DB 36048>3 byte 16 \b, type CSV_DB 36049>3 byte 17 \b, type FEDERATED_DB 36050>3 byte 18 \b, type BLACKHOLE_DB 36051>3 byte 19 \b, type PARTITION_DB 36052>3 byte 20 \b, type BINLOG 36053>3 byte 21 \b, type SOLID 36054>3 byte 22 \b, type PBXT 36055>3 byte 23 \b, type TABLE_FUNCTION 36056>3 byte 24 \b, type MEMCACHE 36057>3 byte 25 \b, type FALCON 36058>3 byte 26 \b, type MARIA 36059>3 byte 27 \b, type PERFORMANCE_SCHEMA 36060>3 byte 127 \b, type DEFAULT 36061>0x0033 ulong x \b, MySQL version %d 360620 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 36063>3 byte x Version %d 360640 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 36065>3 byte x Version %d 360660 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 36067>3 byte x Version %d 36068>14 beshort x \b, %d key parts 36069>16 beshort x \b, %d unique key parts 36070>18 byte x \b, %d keys 36071>28 bequad x \b, %lld records 36072>36 bequad x \b, %lld deleted records 360730 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 36074>3 byte x Version %d 360750 belong&0xffffff00 0xfefe0900 MySQL Maria index file 36076>3 byte x Version %d 360770 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file 36078>3 byte x Version %d 360790 belong&0xffffff00 0xfefe0c00 36080>4 string MACF MySQL Maria control file 36081>>3 byte x Version %d 360820 string \376bin MySQL replication log, 36083>9 long x server id %d 36084>8 byte 1 36085>>13 long 69 \b, MySQL V3.2.3 36086>>>19 string x \b, server version %s 36087>>13 long 75 \b, MySQL V4.0.2-V4.1 36088>>>25 string x \b, server version %s 36089>8 byte 15 MySQL V5+, 36090>>25 string x server version %s 36091>4 string MARIALOG MySQL Maria transaction log file 36092>>3 byte x Version %d 36093 36094#------------------------------------------------------------------------------ 36095# iRiver H Series database file 36096# From Ken Guest <ken@linux.ie> 36097# As observed from iRivNavi.iDB and unencoded firmware 36098# 360990 string iRivDB iRiver Database file 36100>11 string >\0 Version %s 36101>39 string iHP-100 [H Series] 36102 36103#------------------------------------------------------------------------------ 36104# SQLite database files 36105# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 36106# 36107# Version 1 used GDBM internally; its files cannot be distinguished 36108# from other GDBM files. 36109# 36110# Version 2 used this format: 361110 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 36112 36113# URL: https://en.wikipedia.org/wiki/SQLite 36114# Reference: https://www.sqlite.org/fileformat.html 36115# Update: Joerg Jenderek 36116# Version 3 of SQLite allows applications to embed their own "user version" 36117# number in the database at offset 60. Later, SQLite added an "application id" 36118# at offset 68 that is preferred over "user version" for indicating the 36119# associated application. 36120# 361210 string SQLite\ format\ 3 36122# skip DROID fmt-729-signature-id-1053.sqlite by checking for valid page size 36123>16 ubeshort >0 SQLite 3.x 36124# deprecated 36125#!:mime application/x-sqlite3 36126!:mime application/vnd.sqlite3 36127# seldom found extension sqlite3 like in SyncData.sqlite3 36128# db 36129# db3 like: AddrBook.db3 cgipcrvp.db3 36130# https://www.maplesoft.com/support/help/Maple/view.aspx?path=worksheet%2freference%2fhelpdatabase 36131# help is used for newer Maple help database 36132# SQLite database weewx.sdb used by weather software weewx 36133# https://www.weewx.com/docs/usersguide.htm 36134# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe 36135# Unfortunately extension sqlite also used for other databases starting with string 36136# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite 36137# and with string "ZV-zlib" in like extra.sqlite 36138>>68 belong !0x5CDE09EF database 36139!:ext sqlite/sqlite3/db/db3/dbe/sdb/help 36140>>68 belong =0x5CDE09EF database 36141# maple is used for Maple Workbook 36142!:ext maple 36143>>60 belong =0x5f4d544e (Monotone source repository) 36144# if no known user version then check for Application IDs with default clause 36145>>60 belong !0x5f4d544e 36146# The "Application ID" set by PRAGMA application_id 36147>>>68 belong =0x0f055112 (Fossil checkout) 36148>>>68 belong =0x0f055113 (Fossil global configuration) 36149>>>68 belong =0x0f055111 (Fossil repository) 36150>>>68 belong =0x42654462 (Bentley Systems BeSQLite Database) 36151>>>68 belong =0x42654c6e (Bentley Systems Localization File) 36152>>>68 belong =0x47504b47 (OGC GeoPackage file) 36153# https://www.sqlite.org/src/artifact?ci=trunk&filename=magic.txt 36154>>>68 belong =0x47503130 (OGC GeoPackage version 1.0 file) 36155>>>68 belong =0x45737269 (Esri Spatially-Enabled Database) 36156>>>68 belong =0x4d504258 (MBTiles tileset) 36157# https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple 36158>>>68 belong =0x5CDE09EF (Maple Workbook) 36159# unknown application ID 36160>>>68 default x 36161>>>>68 belong !0 \b, application id %u 36162# The "user version" as read and set by the user_version pragma like: 36163# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075 36164>>60 belong !0 \b, user version %d 36165# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001 36166>>96 belong x \b, last written using SQLite version %d 36167# database page size in bytes; a power of two between 512 and 32768, or 1 for 65536 36168# like: 512 1024 often 4096 32768 36169>>16 ubeshort !4096 \b, page size %u 36170# File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite 36171>>18 ubyte !1 \b, writer version %u 36172# File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite 36173>>19 ubyte !1 \b, read version %u 36174# Bytes of unused "reserved" space at the end of each page. Usually 0 36175>>20 ubyte !0 \b, unused bytes %u 36176# maximum embedded payload fraction. Must be 64; 1 for corruptDB.sqlite 36177>>21 ubyte !64 \b, maximum payload %u 36178# Minimum embedded payload fraction. Must be 32; 1 for corruptDB.sqlite 36179>>22 ubyte !32 \b, minimum payload %u 36180# Leaf payload fraction. Must be 32; 0 for corruptDB.sqlite 36181>>23 ubyte !32 \b, leaf payload %u 36182# file change counter 36183>>24 ubelong x \b, file counter %u 36184# Size of the database file in pages 36185>>28 ubelong x \b, database pages %u 36186# page number of the first freelist trunk page like: 0 2 3 4 5 9 36187# 10 13 14 15 16 17 18 19 23 36 39 46 50 136 190 217 307 505 516 561 883 1659 36188>>32 ubelong !0 \b, 1st free page %u 36189# total number of freelist pages 36190>>36 ubelong !0 \b, free pages %u 36191# The schema cookie like: 2 3 4 6 7 9 A D E F 13 14 1C 25 2A 2F 33 44 4B 53 5A 5F 62 86 87 8F 91 A8 36192>>40 ubelong x \b, cookie %#x 36193# the schema format number. Supported formats are 1 2 3 and often 4 36194# 3328 for corruptDB.sqlite and 0 for 512 byte storage.sqlite (TorBrowser Firefox Thunderbird) 36195>>44 ubelong x \b, schema %u 36196# Suggested cache size like: 0 2000 36197>>48 ubelong !0 \b, cache page size %u 36198# The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise. 36199>>52 ubelong !0 \b, largest root page %u 36200# The database text encoding; a value of 1 means UTF-8; 2 means UTF-16le; 3 means UTF-16be 36201#>>56 ubelong x \b, encoding %u 36202>>56 ubelong x 36203>>>56 ubelong =1 \b, UTF-8 36204>>>56 ubelong =2 \b, UTF-16 little endian 36205>>>56 ubelong =3 \b, UTF-16 big endian 36206# 0 for corruptDB.sqlite and for storage.sqlite with database pages 1 (TorBrowser Firefox Thunderbird) 36207# https://mozilla.github.io/firefox-browser-architecture/text/0010-firefox-data-stores.html 36208>>>56 default x 36209>>>>56 ubelong x \b, unknown %#x encoding 36210# True (non-zero) for incremental-vacuum mode; false (zero) otherwiseqy 36211>>64 ubelong !0 \b, vacuum mode %u 36212# Reserved for expansion. Must be zero 36213>>72 uquad !0 \b, reserved %#llx 36214# The version-valid-for number like: 36215# 1 2 3 4 C F 68h 95h 266h A99h 3DCDh B7CEh 36216>>92 ubelong x \b, version-valid-for %u 36217 36218# SQLite Write-Ahead Log from SQLite version >= 3.7.0 36219# https://www.sqlite.org/fileformat.html#walformat 362200 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 36221!:ext sqlite-wal/db-wal 36222>4 belong x version %d 36223 36224# SQLite Rollback Journal 36225# https://www.sqlite.org/fileformat.html#rollbackjournal 362260 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 36227 36228# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 36229# https://github.com/PredatH0r/ChanSort 362300 string PSDB\0 Panasonic channel list DataBase 36231!:ext db/bin 36232#!:mime application/x-db-svl-panasonic 36233>126 string SQLite\ format\ 3 36234#!:mime application/x-panasonic-sqlite3 36235>>&-15 indirect x \b; contains 36236 36237# H2 Database from https://www.h2database.com/ 362380 string --\ H2\ 0.5/B\ --\ \n H2 Database file 36239 36240# DuckDB database file from https://duckdb.org 362418 string DUCK DuckDB database file 36242>12 lequad x \b, version %lld 36243#>20 lequad x \b, flags %#llx 36244#>28 lequad x \b, flags %#llx 36245# Type: OpenSSH key files 36246# From: Nicolas Collignon <tsointsoin@gmail.com> 36247 362480 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 36249>28 string >\0 version %s 362500 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 36251 362520 string ssh-dss\ OpenSSH DSA public key 362530 string ssh-rsa\ OpenSSH RSA public key 362540 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 362550 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 362560 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 362570 string ssh-ed25519 OpenSSH ED25519 public key 36258 362590 string SSHKRL\n\0 36260>8 ubelong 1 OpenSSH key/certificate revocation list, format %u 36261>>12 ubequad x \b, version %llx 36262>>>20 beqdate x \b, generated %s 36263 36264# From: Joerg Jenderek 36265# URL: https://en.wikipedia.org/wiki/PuTTY 36266# Reference: https://the.earth.li/~sgtatham/putty/latest/putty-0.73.tar.gz 36267# /sshpubk.c 362680 string PuTTY-User-Key-File- PuTTY Private Key File 36269#!:mime text/plain 36270# https://github.com/github/putty/blob/master/windows/installer.wxs 36271!:mime application/x-putty-private-key 36272!:ext ppk 36273# version 1 or 2 36274>20 string x \b, version %.1s 36275# name of the algorithm like: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ssh-ed25519 36276>23 string x \b, algorithm %s 36277# next line says "Encryption: " plus an encryption type like aes256-cbc or none 36278>32 search/13 Encryption:\040 \b, Encryption 36279>>&0 string x %s 36280# next line says "Comment: " plus the comment string 36281>>>&0 search/3 Comment:\040 36282>>>>&0 string x "%s" 36283 36284 36285#------------------------------------------------------------------------------ 36286# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $ 36287# ssl: file(1) magic for SSL file formats 36288 36289# Type: OpenSSL certificates/key files 36290# From: Nicolas Collignon <tsointsoin@gmail.com> 36291 362920 string -----BEGIN\040CERTIFICATE----- PEM certificate 362930 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request 362940 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key 362950 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key 362960 string -----BEGIN\040EC\040PRIVATE PEM EC private key 362970 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key 36298 36299# From Luc Gommans 36300# OpenSSL enc file (recognized by a magic string preceding the password's salt) 363010 string Salted__ openssl enc'd data with salted password 36302# Using the -a or -base64 option, OpenSSL will base64-encode the data. 363030 string U2FsdGVkX1 openssl enc'd data with salted password, base64 encoded 36304 36305#------------------------------------------------------------------------------ 36306# $File: statistics,v 1.3 2022/03/24 15:48:58 christos Exp $ 36307# statistics: file(1) magic for statistics related software 36308# 36309 36310# From Remy Rampin 36311 36312# Stata is a statistical software tool that was created in 1985. While I 36313# don't personally use it, data files in its native (proprietary) format 36314# are common (.dta files). 36315# 36316# Because they are so common, especially in statistical and social 36317# sciences, Stata files and SPSS files can be opened by a lot of modern 36318# software, for example Python's pandas package provides built-in 36319# support for them (read_stata() and read_spss()). 36320# 36321# I noticed that the magic database includes an entry for SPSS files but 36322# not Stata files. Stata files for Stata 13 and newer (formats 117, 118, 36323# and 119) always begin with the string "<stata_dta><header>" as per 36324# https://www.stata.com/help.cgi?dta#definition 36325# 36326# The format version number always follows, for example: 36327# <stata_dta><header><release>117</release> 36328# <stata_dta><header><release>118</release> 36329# 36330# Therefore the following line would do the trick: 36331# 0 string <stata_dta><header> Stata Data File 36332# 36333# (I'm sure the version number could be captured as well but I did not 36334# manage this without a regex) 36335# 36336# Unfortunately the previous formats (created by Stata before 13, which 36337# was released 2013) are harder to recognize. Format 115 starts with the 36338# four bytes 0x73010100 or 0x73020100, format 114 with 0x72010100 or 36339# 0x72020100, format 113 with 0x71010101 or 0x71020101. 36340# 36341# For additional reference, the Library of Congress website has an entry 36342# for the Stata Data File Format 118: 36343# https://www.loc.gov/preservation/digital/formats/fdd/fdd000471.shtml 36344# 36345# Example of those files can be found on Zenodo: 36346# https://zenodo.org/search?page=1&size=20&q=&file_type=dta 363470 string \<stata_dta\>\<header\>\<release\> Stata Data File 36348>&0 regex [0-9]+ (Release %s) 36349 36350#------------------------------------------------------------------------------ 36351# $File: subtitle,v 1.2 2022/09/07 11:29:09 christos Exp $ 36352# subtitle: file(1) magic for subtitles files 36353 36354# EBU-STL 36355# https://tech.ebu.ch/docs/tech/tech3264.pdf 363563 string STL EBU-STL subtitles 36357>6 regex =^[0-9][0-9] \b, rate %s 36358>>8 string .01 \b, v1 36359!:mime application/x-ebu-stl 36360>>>16 regex =^[^\ ]{0,32} \b, title "%s" 36361>>>>224 regex =^[0-9]{2} \b, created %-.2s 36362>>>>>&0 regex =^[0-9]{2} \b-%-.2s 36363>>>>>>&0 regex =^[0-9]{2} \b-%-.2s 36364!:ext stl 36365 36366# SubRip (srt) subtitles 363670 regex/20 =^1[\r\n]+0[01]:[0-9]{2}:[0-9]{2},[0-9]{3}\040--> SubRip 36368!:mime application/x-subrip 36369!:ext srt 36370 36371# WebVTT subtitles 36372# https://www.w3.org/TR/webvtt1/ 363730 string/t WEBVTT 36374>&0 regex/255 =[0-9]{2}:[0-9]{2}\\.[0-9]{3}\040--> WebVTT subtitles 36375!:mime text/vtt 36376!:ext vtt 36377 36378# XML TTML subtitles 36379# https://www.w3.org/TR/ttml2/ 363800 string/t \<?xml 36381>20 search/400 \020xmlns= 36382>>&0 regex ['"]http://www.w3.org/ns/ttml TTML subtitles 36383!:mime application/ttml+xml 36384# Augment strength to beat plain XML 36385!:strength * 3 36386!:ext ttml 36387 36388#------------------------------------------------------------------------------ 36389# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $ 36390# sun: file(1) magic for Sun machines 36391# 36392# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 36393# releases. (5.x uses ELF.) Entries for executables without an 36394# architecture type, used before the 68020-based Sun-3's came out, 36395# are in aout, as they're indistinguishable from other big-endian 36396# 32-bit a.out files. 36397# 363980 belong&077777777 0600413 a.out SunOS SPARC demand paged 36399>0 byte &0x80 36400>>20 belong <4096 shared library 36401>>20 belong =4096 dynamically linked executable 36402>>20 belong >4096 dynamically linked executable 36403>0 byte ^0x80 executable 36404>16 belong >0 not stripped 36405 364060 belong&077777777 0600410 a.out SunOS SPARC pure 36407>0 byte &0x80 dynamically linked executable 36408>0 byte ^0x80 executable 36409>16 belong >0 not stripped 36410 364110 belong&077777777 0600407 a.out SunOS SPARC 36412>0 byte &0x80 dynamically linked executable 36413>0 byte ^0x80 executable 36414>16 belong >0 not stripped 36415 364160 belong&077777777 0400413 a.out SunOS mc68020 demand paged 36417>0 byte &0x80 36418>>20 belong <4096 shared library 36419>>20 belong =4096 dynamically linked executable 36420>>20 belong >4096 dynamically linked executable 36421>0 byte ^0x80 executable 36422>16 belong >0 not stripped 36423 364240 belong&077777777 0400410 a.out SunOS mc68020 pure 36425>0 byte &0x80 dynamically linked executable 36426>0 byte ^0x80 executable 36427>16 belong >0 not stripped 36428 364290 belong&077777777 0400407 a.out SunOS mc68020 36430>0 byte &0x80 dynamically linked executable 36431>0 byte ^0x80 executable 36432>16 belong >0 not stripped 36433 364340 belong&077777777 0200413 a.out SunOS mc68010 demand paged 36435>0 byte &0x80 36436>>20 belong <4096 shared library 36437>>20 belong =4096 dynamically linked executable 36438>>20 belong >4096 dynamically linked executable 36439>0 byte ^0x80 executable 36440>16 belong >0 not stripped 36441 364420 belong&077777777 0200410 a.out SunOS mc68010 pure 36443>0 byte &0x80 dynamically linked executable 36444>0 byte ^0x80 executable 36445>16 belong >0 not stripped 36446 364470 belong&077777777 0200407 a.out SunOS mc68010 36448>0 byte &0x80 dynamically linked executable 36449>0 byte ^0x80 executable 36450>16 belong >0 not stripped 36451 36452# 36453# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 36454# binary executed in compatibility mode under SunOS 5.x". 36455# 364560 belong 0x080456 SunOS core file 36457>4 belong 432 (SPARC) 36458>>132 string >\0 from '%s' 36459>>116 belong =3 (quit) 36460>>116 belong =4 (illegal instruction) 36461>>116 belong =5 (trace trap) 36462>>116 belong =6 (abort) 36463>>116 belong =7 (emulator trap) 36464>>116 belong =8 (arithmetic exception) 36465>>116 belong =9 (kill) 36466>>116 belong =10 (bus error) 36467>>116 belong =11 (segmentation violation) 36468>>116 belong =12 (bad argument to system call) 36469>>116 belong =29 (resource lost) 36470>>120 belong x (T=%dK, 36471>>124 belong x D=%dK, 36472>>128 belong x S=%dK) 36473>4 belong 826 (68K) 36474>>128 string >\0 from '%s' 36475>4 belong 456 (SPARC 4.x BCP) 36476>>152 string >\0 from '%s' 36477# Sun SunPC 364780 long 0xfa33c08e SunPC 4.0 Hard Disk 364790 string #SUNPC_CONFIG SunPC 4.0 Properties Values 36480# Sun snoop (see RFC 1761, which describes the capture file format, 36481# RFC 3827, which describes some additional datalink types, and 36482# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 36483# which is the IANA registry of Snoop datalink types) 36484# 364850 string snoop Snoop capture file 36486>8 belong >0 - version %d 36487>12 belong 0 (IEEE 802.3) 36488>12 belong 1 (IEEE 802.4) 36489>12 belong 2 (IEEE 802.5) 36490>12 belong 3 (IEEE 802.6) 36491>12 belong 4 (Ethernet) 36492>12 belong 5 (HDLC) 36493>12 belong 6 (Character synchronous) 36494>12 belong 7 (IBM channel-to-channel adapter) 36495>12 belong 8 (FDDI) 36496>12 belong 9 (Other) 36497>12 belong 10 (type %d) 36498>12 belong 11 (type %d) 36499>12 belong 12 (type %d) 36500>12 belong 13 (type %d) 36501>12 belong 14 (type %d) 36502>12 belong 15 (type %d) 36503>12 belong 16 (Fibre Channel) 36504>12 belong 17 (ATM) 36505>12 belong 18 (ATM Classical IP) 36506>12 belong 19 (type %d) 36507>12 belong 20 (type %d) 36508>12 belong 21 (type %d) 36509>12 belong 22 (type %d) 36510>12 belong 23 (type %d) 36511>12 belong 24 (type %d) 36512>12 belong 25 (type %d) 36513>12 belong 26 (IP over Infiniband) 36514>12 belong >26 (type %d) 36515 36516#--------------------------------------------------------------------------- 36517# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 36518# lead Sun/Cobalt developer) who agrees that they are good and worthy of 36519# inclusion. 36520 36521# Boot ROM images for Sun/Cobalt Linux server appliances 365220 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 36523>38 string x V%.4s 36524 36525# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 36526# at the very end where file(1) can't get it. 365270 string CRfs COBALT boot rom data (Flat boot rom or file system) 36528 36529#------------------------------------------------------------------------------ 36530# $File: sylk,v 1.1 2020/04/05 22:18:34 christos Exp $ 36531# sylk: file(1) magic for SYLK text files 36532 36533# From: Joerg Jenderek 36534# URL: https://en.wikipedia.org/wiki/SYmbolic_LinK_%28SYLK%29 36535# http://fileformats.archiveteam.org/wiki/SYLK 36536# Note: called by TrID "SYLK - SYmbolic LinK data", 36537# by DROID "Microsoft Symbolic Link (SYLK) File" 36538# by FreeDesktop.org "spreadsheet interchange document" 365390 string ID;P 36540# skip short DROID x-fmt-106-signature-id-603.slk 36541>7 ubyte >0 spreadsheet interchange document 36542# https://reposcope.com/mimetype/text/spreadsheet 36543#!:mime text/spreadsheet 36544# https://reposcope.com/mimetype/application/x-sylk by Gnumeric 36545!:mime application/x-sylk 36546!:ext slk/sylk 36547>>4 ubyte >037 \b, created by 36548# Gnumeric, pmw~PlanMaker, CALCOOO32~LibreOffice OpenOffice, SCALC3~StarOffice 36549# MP~Multiplan, XL~Excel WXL~Excel Windows 36550>>>4 string Gnumeric Gnumeric 36551>>>4 string pmw PlanMaker 36552>>>4 string CALCOOO32 Libre/OpenOffice Calc 36553>>>4 string SCALC3 StarOffice Calc 36554>>>4 string XL Excel 36555# Excel, version probably running on Windows 36556>>>4 string WXL Excel 36557# not tested 36558>>>4 string MP Multiplan 36559# unknown spreadsheet software 36560>>>4 default x 36561>>>>4 string x %s 36562 36563 36564 36565#------------------------------------------------------------------------------ 36566# msx: file(1) magic for the SymbOS operating system 36567# http://www.symbos.de 36568# Fabio R. Schmidlin <frs@pop.com.br> 36569 36570# SymbOS EXE file 365710x30 string SymExe SymbOS executable 36572>0x36 ubyte x v%c 36573>0x37 ubyte x \b.%c 36574>0xF string x \b, name: %s 36575 36576# SymbOS DOX document 365770 string INFOq\0 SymbOS DOX document 36578 36579# Symbos driver 365800 string SMD1 SymbOS driver 36581>19 byte x \b, name: %c 36582>20 byte x \b%c 36583>21 byte x \b%c 36584>22 byte x \b%c 36585>23 byte x \b%c 36586>24 byte x \b%c 36587>25 byte x \b%c 36588>26 byte x \b%c 36589>27 byte x \b%c 36590>28 byte x \b%c 36591>29 byte x \b%c 36592>30 byte x \b%c 36593>31 byte x \b%c 36594 36595# Symbos video 365960 string SymVid SymbOS video 36597>6 ubyte x v%c 36598>7 ubyte x \b.%c 36599 36600# Soundtrakker 128 ST2 music 366010 byte 0 36602>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 36603>>1 string x name: %s 36604 36605 36606 36607#------------------------------------------------------------------------ 36608# $File: sysex,v 1.11 2022/01/17 17:16:51 christos Exp $ 36609# sysex: file(1) magic for MIDI sysex files 36610# 36611# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 36612# where real SYStem EXclusive messages at offset 1 are limited to seven bits 36613# https://en.wikipedia.org/wiki/MIDI 36614# test for StartSysEx byte and upper unsed bit of vendor ID 366150 ubeshort&0xFF80 0xF000 36616# MIDI System Exclusive (SysEx) messages (strength=50) after Microsoft Visual C library (strength=70) 36617#!:strength +0 36618# skip Microsoft Visual C library with page size 16 misidentifed as ADA and 36619# page size 32 misidentifed as Inventronics by looking for terminating End Of eXclusive byte (EOX) 36620>2 search/12 \xF7 36621>>0 use midi-sysex 36622# display information about MIDI System Exclusive (SysEx) messages 366230 name midi-sysex 36624# https://fileinfo.com/extension/syx 36625>1 ubyte x MIDI audio System Exclusive (SysEx) message - 36626# Note: file (version 5.41) labeled the above entry as "SysEx File" 36627#!:mime application/octet-stream 36628!:mime audio/x-syx 36629# https://onsongapp.com/docs/features/formats/sysex 36630!:ext syx/sysex 36631# https://www.midi.org/specifications-old/item/manufacturer-id-numbers 36632# https://raw.githubusercontent.com/insolace/MIDI-Sysex-MFG-IDs/master/Sysex%20ID%20Tables/MIDI%20Sysex%20MFG%20IDs.csv 36633# SysEx manufacturer ID; originally one byte, but now 0 is used as an escapement to reach the next two 36634# North American Group 36635#>1 byte 0x01 Sequential 36636>1 byte 0x01 Sequential Circuits 36637>1 byte 0x02 IDP 36638#>1 byte 0x03 OctavePlateau 36639>1 byte 0x03 Voyetra Turtle Beach 36640>1 byte 0x04 Moog 36641#>1 byte 0x05 Passport 36642>1 byte 0x05 Passport Designs 36643#>1 byte 0x06 Lexicon 36644>1 byte 0x06 Lexicon Inc. 36645>1 byte 0x07 Kurzweil/Future Retro 36646>>3 byte 0x77 777 36647>>4 byte 0x00 Bank 36648>>4 byte 0x01 Song 36649>>5 byte 0x0f 16 36650>>5 byte 0x0e 15 36651>>5 byte 0x0d 14 36652>>5 byte 0x0c 13 36653>>5 byte 0x0b 12 36654>>5 byte 0x0a 11 36655>>5 byte 0x09 10 36656>>5 byte 0x08 9 36657>>5 byte 0x07 8 36658>>5 byte 0x06 7 36659>>5 byte 0x05 6 36660>>5 byte 0x04 5 36661>>5 byte 0x03 4 36662>>5 byte 0x02 3 36663>>5 byte 0x01 2 36664>>5 byte 0x00 1 36665>>5 byte 0x10 (ALL) 36666>>2 byte x \b, Channel %d 36667>1 byte 0x08 Fender 36668#>1 byte 0x09 Gulbransen 36669>1 byte 0x09 MIDI9 36670#>1 byte 0x0a AKG 36671>1 byte 0x0a AKG Acoustics 36672>1 byte 0x0b Voyce 36673>1 byte 0x0c Waveframe 36674# not ADA programming language 36675#>1 byte 0x0d ADA 36676>1 byte 0x0d ADA Signal Processors Inc. 36677#>1 byte 0x0e Garfield 36678>1 byte 0x0e Garfield Electronics 36679>1 byte 0x0f Ensoniq 36680>1 byte 0x10 Oberheim 36681>>2 byte 0x06 Matrix 6 series 36682>>3 byte 0x0A Dump (All) 36683>>3 byte 0x01 Dump (Bank) 36684>>4 belong 0x0002040E Matrix 1000 36685>>>11 byte <2 User bank %d 36686>>>11 byte >1 Preset bank %d 36687>1 byte 0x11 Apple 36688>1 byte 0x12 GreyMatter 36689>1 byte 0x14 PalmTree 36690>1 byte 0x15 JLCooper 36691>1 byte 0x16 Lowrey 36692>1 byte 0x17 AdamsSmith 36693>1 byte 0x18 E-mu 36694#>1 byte 0x19 Harmony 36695>1 byte 0x19 Harmony Systems 36696>1 byte 0x1a ART 36697>1 byte 0x1b Baldwin 36698>1 byte 0x1c Eventide 36699>1 byte 0x1d Inventronics 36700>1 byte 0x1f Clarity 36701 36702# European Group 36703#>1 byte 0x21 SIEL 36704>1 byte 0x21 Proel Labs (SIEL) 36705>1 byte 0x22 Synthaxe 36706>1 byte 0x24 Hohner 36707>1 byte 0x25 Twister 36708#>1 byte 0x26 Solton 36709>1 byte 0x26 Ketron s.r.l. 36710>1 byte 0x27 Jellinghaus 36711>1 byte 0x28 Southworth 36712>1 byte 0x29 PPG 36713>1 byte 0x2a JEN 36714#>1 byte 0x2b SSL 36715>1 byte 0x2b Solid State Logic Organ Systems 36716#>1 byte 0x2c AudioVertrieb 36717>1 byte 0x2c Audio Veritrieb-P. Struven 36718 36719>1 byte 0x2f ELKA 36720>>3 byte 0x09 EK-44 36721 36722>1 byte 0x30 Dynacord 36723#>1 byte 0x31 Jomox 36724>1 byte 0x31 Viscount International Spa 36725>1 byte 0x33 Clavia 36726>1 byte 0x39 Soundcraft 36727# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 36728>1 byte 0x3e Waldorf 36729>>2 byte 0x00 microWave 36730>>2 byte 0x0E microwave2 / XT 36731>>2 byte 0x0F Q / Q+ 36732>>3 byte =0 (default id) 36733>>3 byte >0 ( 36734>>>3 byte <0x7F \bdevice %d) 36735>>>3 byte =0x7F \bbroadcast id) 36736>>3 byte 0x7f Microwave I 36737>>>4 byte 0x00 SNDR (Sound Request) 36738>>>4 byte 0x10 SNDD (Sound Dump) 36739>>>4 byte 0x20 SNDP (Sound Parameter Change) 36740>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 36741>>>4 byte 0x70 BOOT (Sound Reserved) 36742>>>4 byte 0x01 MULR (Multi Request) 36743>>>4 byte 0x11 MULD (Multi Dump) 36744>>>4 byte 0x21 MULP (Multi Parameter Change) 36745>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 36746>>>4 byte 0x71 OS (Multi Reserved) 36747>>>4 byte 0x02 DRMR (Drum Map Request) 36748>>>4 byte 0x12 DRMD (Drum Map Dump) 36749>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 36750>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 36751>>>4 byte 0x72 BIN (Drum Map Reserved) 36752>>>4 byte 0x03 PATR (Sequencer Pattern Request) 36753>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 36754>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 36755>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 36756>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 36757>>>4 byte 0x04 GLBR (Global Parameter Request) 36758>>>4 byte 0x14 GLBD (Global Parameter Dump) 36759>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 36760>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 36761>>>4 byte 0x07 MODR (Mode Parameter Request) 36762>>>4 byte 0x17 MODD (Mode Parameter Dump) 36763>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 36764>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 36765>>2 byte 0x10 microQ 36766>>>4 byte 0x00 SNDR (Sound Request) 36767>>>4 byte 0x10 SNDD (Sound Dump) 36768>>>4 byte 0x20 SNDP (Sound Parameter Change) 36769>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 36770>>>4 byte 0x70 (Sound Reserved) 36771>>>4 byte 0x01 MULR (Multi Request) 36772>>>4 byte 0x11 MULD (Multi Dump) 36773>>>4 byte 0x21 MULP (Multi Parameter Change) 36774>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 36775>>>4 byte 0x71 OS (Multi Reserved) 36776>>>4 byte 0x02 DRMR (Drum Map Request) 36777>>>4 byte 0x12 DRMD (Drum Map Dump) 36778>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 36779>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 36780>>>4 byte 0x72 BIN (Drum Map Reserved) 36781>>>4 byte 0x04 GLBR (Global Parameter Request) 36782>>>4 byte 0x14 GLBD (Global Parameter Dump) 36783>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 36784>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 36785>>2 byte 0x11 rackAttack 36786>>>4 byte 0x00 SNDR (Sound Parameter Request) 36787>>>4 byte 0x10 SNDD (Sound Parameter Dump) 36788>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 36789>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 36790>>>4 byte 0x01 PRGR (Program Parameter Request) 36791>>>4 byte 0x11 PRGD (Program Parameter Dump) 36792>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 36793>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 36794>>>4 byte 0x71 OS (Program Parameter Reserved) 36795>>>4 byte 0x03 PATR (Pattern Parameter Request) 36796>>>4 byte 0x13 PATD (Pattern Parameter Dump) 36797>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 36798>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 36799>>>4 byte 0x04 GLBR (Global Parameter Request) 36800>>>4 byte 0x14 GLBD (Global Parameter Dump) 36801>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 36802>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 36803>>>4 byte 0x05 EFXR (FX Parameter Request) 36804>>>4 byte 0x15 EFXD (FX Parameter Dump) 36805>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 36806>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 36807>>>4 byte 0x07 MODR (Mode Command Request) 36808>>>4 byte 0x17 MODD (Mode Command Dump) 36809>>>4 byte 0x27 MODP (Mode Command Parameter Change) 36810>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 36811>>2 byte 0x03 Wave 36812>>>4 byte 0x00 SBPR (Soundprogram) 36813>>>4 byte 0x01 SAPR (Performance) 36814>>>4 byte 0x02 SWAVE (Wave) 36815>>>4 byte 0x03 SWTBL (Wave control table) 36816>>>4 byte 0x04 SVT (Velocity Curve) 36817>>>4 byte 0x05 STT (Tuning Table) 36818>>>4 byte 0x06 SGLB (Global Parameters) 36819>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 36820>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 36821>>>4 byte 0x09 SBPRPAR (Sound Parameter) 36822>>>4 byte 0x0A SARRPAR (Performance Parameter) 36823>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 36824>>>4 byte 0x0F SBULK (Bulk Switch on/off) 36825 36826# Japanese Group 36827>1 byte 0x40 Kawai 36828>>3 byte 0x20 K1 36829>>3 byte 0x22 K4 36830 36831>1 byte 0x41 Roland 36832>>3 byte 0x14 D-50 36833>>3 byte 0x2b U-220 36834>>3 byte 0x02 TR-707 36835 36836>1 byte 0x42 Korg 36837>>3 byte 0x19 M1 36838 36839>1 byte 0x43 Yamaha 36840>1 byte 0x44 Casio 36841>1 byte 0x46 Kamiya 36842>1 byte 0x47 Akai 36843#>1 byte 0x48 Victor 36844>1 byte 0x48 Victor Company of Japan. Ltd. 36845>1 byte 0x49 Mesosha 36846>1 byte 0x4b Fujitsu 36847>1 byte 0x4c Sony 36848>1 byte 0x4e Teac 36849>1 byte 0x50 Matsushita 36850>1 byte 0x51 Fostex 36851#>1 byte 0x52 Zoom 36852>1 byte 0x52 Zoom Corporation 36853>1 byte 0x54 Matsushita 36854>1 byte 0x57 Acoustic tech. lab. 36855# https://www.midi.org/techspecs/manid.php 36856>1 belong&0xffffff00 0x00007400 Ta Horng 36857>1 belong&0xffffff00 0x00007500 e-Tek 36858>1 belong&0xffffff00 0x00007600 E-Voice 36859>1 belong&0xffffff00 0x00007700 Midisoft 36860>1 belong&0xffffff00 0x00007800 Q-Sound 36861>1 belong&0xffffff00 0x00007900 Westrex 36862>1 belong&0xffffff00 0x00007a00 Nvidia* 36863>1 belong&0xffffff00 0x00007b00 ESS 36864>1 belong&0xffffff00 0x00007c00 Mediatrix 36865>1 belong&0xffffff00 0x00007d00 Brooktree 36866>1 belong&0xffffff00 0x00007e00 Otari 36867>1 belong&0xffffff00 0x00007f00 Key Electronics 36868>1 belong&0xffffff00 0x00010000 Shure 36869>1 belong&0xffffff00 0x00010100 AuraSound 36870>1 belong&0xffffff00 0x00010200 Crystal 36871>1 belong&0xffffff00 0x00010300 Rockwell 36872>1 belong&0xffffff00 0x00010400 Silicon Graphics 36873>1 belong&0xffffff00 0x00010500 Midiman 36874>1 belong&0xffffff00 0x00010600 PreSonus 36875>1 belong&0xffffff00 0x00010800 Topaz 36876>1 belong&0xffffff00 0x00010900 Cast Lightning 36877>1 belong&0xffffff00 0x00010a00 Microsoft 36878>1 belong&0xffffff00 0x00010b00 Sonic Foundry 36879>1 belong&0xffffff00 0x00010c00 Line 6 36880>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 36881>1 belong&0xffffff00 0x00010e00 Van Koerving 36882>1 belong&0xffffff00 0x00010f00 Altech Systems 36883>1 belong&0xffffff00 0x00011000 S & S Research 36884>1 belong&0xffffff00 0x00011100 VLSI Technology 36885>1 belong&0xffffff00 0x00011200 Chromatic 36886>1 belong&0xffffff00 0x00011300 Sapphire 36887>1 belong&0xffffff00 0x00011400 IDRC 36888>1 belong&0xffffff00 0x00011500 Justonic Tuning 36889>1 belong&0xffffff00 0x00011600 TorComp 36890>1 belong&0xffffff00 0x00011700 Newtek Inc. 36891>1 belong&0xffffff00 0x00011800 Sound Sculpture 36892>1 belong&0xffffff00 0x00011900 Walker Technical 36893>1 belong&0xffffff00 0x00011a00 Digital Harmony 36894>1 belong&0xffffff00 0x00011b00 InVision 36895>1 belong&0xffffff00 0x00011c00 T-Square 36896>1 belong&0xffffff00 0x00011d00 Nemesys 36897>1 belong&0xffffff00 0x00011e00 DBX 36898>1 belong&0xffffff00 0x00011f00 Syndyne 36899>1 belong&0xffffff00 0x00012000 Bitheadz 36900>1 belong&0xffffff00 0x00012100 Cakewalk 36901>1 belong&0xffffff00 0x00012200 Staccato 36902>1 belong&0xffffff00 0x00012300 National Semicon. 36903>1 belong&0xffffff00 0x00012400 Boom Theory 36904>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 36905>1 belong&0xffffff00 0x00012600 Antares 36906>1 belong&0xffffff00 0x00012700 Angel Software 36907>1 belong&0xffffff00 0x00012800 St Louis Music 36908>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 36909>1 belong&0xffffff00 0x00012a00 Ashley Audio 36910>1 belong&0xffffff00 0x00012b00 Vari-Lite 36911>1 belong&0xffffff00 0x00012c00 Summit Audio 36912>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 36913>1 belong&0xffffff00 0x00012e00 SeaSound 36914>1 belong&0xffffff00 0x00012f00 U.S. Robotics 36915>1 belong&0xffffff00 0x00013000 Aurisis 36916>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 36917>1 belong&0xffffff00 0x00013200 FM7 Inc. 36918>1 belong&0xffffff00 0x00013300 Swivel Systems 36919>1 belong&0xffffff00 0x00013400 Hyperactive 36920>1 belong&0xffffff00 0x00013500 MidiLite 36921>1 belong&0xffffff00 0x00013600 Radical 36922>1 belong&0xffffff00 0x00013700 Roger Linn 36923>1 belong&0xffffff00 0x00013800 Helicon 36924>1 belong&0xffffff00 0x00013900 Event 36925>1 belong&0xffffff00 0x00013a00 Sonic Network 36926>1 belong&0xffffff00 0x00013b00 Realtime Music 36927>1 belong&0xffffff00 0x00013c00 Apogee Digital 36928 36929>1 belong&0xffffff00 0x00202b00 Medeli Electronics 36930>1 belong&0xffffff00 0x00202c00 Charlie Lab 36931>1 belong&0xffffff00 0x00202d00 Blue Chip Music 36932>1 belong&0xffffff00 0x00202e00 BEE OH Corp 36933>1 belong&0xffffff00 0x00202f00 LG Semicon America 36934>1 belong&0xffffff00 0x00203000 TESI 36935>1 belong&0xffffff00 0x00203100 EMAGIC 36936>1 belong&0xffffff00 0x00203200 Behringer 36937>1 belong&0xffffff00 0x00203300 Access Music 36938>1 belong&0xffffff00 0x00203400 Synoptic 36939>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 36940>1 belong&0xffffff00 0x00203600 Terratec 36941>1 belong&0xffffff00 0x00203700 Proel SpA 36942>1 belong&0xffffff00 0x00203800 IBK MIDI 36943>1 belong&0xffffff00 0x00203900 IRCAM 36944>1 belong&0xffffff00 0x00203a00 Propellerhead Software 36945>1 belong&0xffffff00 0x00203b00 Red Sound Systems 36946>1 belong&0xffffff00 0x00203c00 Electron ESI AB 36947>1 belong&0xffffff00 0x00203d00 Sintefex Audio 36948>1 belong&0xffffff00 0x00203e00 Music and More 36949>1 belong&0xffffff00 0x00203f00 Amsaro 36950>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 36951>1 belong&0xffffff00 0x00204100 Touched by Sound 36952>1 belong&0xffffff00 0x00204200 DSP Arts 36953>1 belong&0xffffff00 0x00204300 Phil Rees Music 36954>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 36955>1 belong&0xffffff00 0x00204500 Soundart 36956>1 belong&0xffffff00 0x00204600 C-Mexx Software 36957>1 belong&0xffffff00 0x00204700 Klavis Tech. 36958>1 belong&0xffffff00 0x00204800 Noteheads AB 36959 36960# Update: Joerg Jenderek; January 2022 36961>1 byte 0x00 ID EXTENSIONS 36962>1 byte 0x13 Digidesign Inc. 36963>1 byte 0x1e Key Concepts 36964>1 byte 0x20 Passac 36965>1 byte 0x23 Stepp 36966>1 byte 0x2d Neve 36967>1 byte 0x2e Soundtracs Ltd. 36968>1 byte 0x32 Drawmer 36969>1 byte 0x34 Audio Architecture 36970>1 byte 0x35 Generalmusic Corp SpA 36971>1 byte 0x36 Cheetah Marketing 36972>1 byte 0x37 C.T.M. 36973>1 byte 0x38 Simmons UK 36974>1 byte 0x3a Steinberg 36975>1 byte 0x3b Wersi GmbH 36976>1 byte 0x3c AVAB Niethammer AB 36977>1 byte 0x3d Digigram 36978>1 byte 0x3f Quasimidi 36979# 36980>1 byte 0x40 Kawai Musical Instruments MFG. CO. Ltd 36981#>1 byte 0x45 foo 36982#>1 byte 0x4a foo 36983#>1 byte 0x4d foo 36984#>1 byte 0x4f foo 36985#>1 byte 0x53 foo 36986>1 byte 0x55 Suzuki Musical Instruments MFG. Co. Ltd. 36987>1 byte 0x56 Fuji Sound Corporation Ltd. 36988#>1 byte 0x58 foo 36989>1 byte 0x59 Faith. Inc. 36990>1 byte 0x5a Internet Corporation 36991#>1 byte 0x5b foo 36992>1 byte 0x5c Seekers Co. Ltd. 36993#>1 byte 0x5d foo 36994#>1 byte 0x5e foo 36995>1 byte 0x5f SD Card Association 36996# Reserved for other uses for 60H to 7FH 36997# URL: https://www.philscomputerlab.com/roland-midi-emulator-project-20.html 36998# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/syx--midiemu.trid.xml 36999# Note: called by TrID "MIDI Emulator Project SysEx preset command" 37000>1 byte 0x66 MIDI Emulator 37001# https://electronicmusic.fandom.com/wiki/List_of_MIDI_Manufacturer_IDs 37002# Educational, prototyping, test, private use and experimentation 37003>1 byte 0x7D PROTOTYPING 37004# universal non-real-time (sample dump, tuning table, etc.) 37005>1 byte 0x7E UNIVERSAL 37006# universal real time (MIDI time code, MIDI Machine control, etc.) 37007>1 byte 0x7F universal real time 37008# display information about End Of eXclusive byte (EOX=F7) 37009#>2 ubyte 0xF7 \b, at 2 EOX 37010#>3 ubyte 0xF7 \b, at 3 EOX 37011# https://tttapa.github.io/Control-Surface-doc/new-input/Doxygen/d2/d93/SysEx-Send-Receive_8ino-example.html 37012>4 ubyte 0xF7 \b, at 4 EOX 37013# http://www.1manband.nl/tutorials2/sysex.htm 37014>5 ubyte 0xF7 \b, at 5 EOX 37015# http://www.somascape.org/midi/tech/mfile.html#sysex 37016>6 ubyte 0xF7 \b, at 6 EOX 37017# 37018>7 ubyte 0xF7 \b, at 7 EOX 37019# https://webmidijs.org/forum/discussion/34/how-to-send-or-receive-system-exclusive-messages 37020>8 ubyte 0xF7 \b, at 8 EOX 37021# 37022>9 ubyte 0xF7 \b, at 9 EOX 37023# https://www.chd-el.cz/wp-content/uploads/845010_syxcom.pdf 37024>10 ubyte 0xF7 \b, at 10 EOX 37025# https://stackoverflow.com/questions/52906076/handling-midi-the-input-of-multiple-system-exclusive-messages-in-vb 37026>11 ubyte 0xF7 \b, at 11 EOX 37027# https://www.2writers.com/eddie/TutSysEx.htm 37028>12 ubyte 0xF7 \b, at 12 EOX 37029>13 ubyte 0xF7 \b, at 13 EOX 37030# http://www.chromakinetics.com/handsonic/rolSysEx.htm 37031>14 ubyte 0xF7 \b, at 14 EOX 37032#>15 ubyte 0xF7 \b, at 15 EOX 37033 370340 string T707 Roland TR-707 Data 37035#------------------------------------------------------------------------------ 37036# file: file(1) magic for Tcl scripting language 37037# URL: https://www.tcl.tk/ 37038# From: gustaf neumann 37039 37040# Tcl scripts 370410 search/1/w #!\ /usr/bin/tcl Tcl script text executable 37042!:mime text/x-tcl 370430 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 37044!:mime text/x-tcl 370450 search/1 #!/usr/bin/env\ tcl Tcl script text executable 37046!:mime text/x-tcl 370470 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 37048!:mime text/x-tcl 370490 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 37050!:mime text/x-tcl 370510 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 37052!:mime text/x-tcl 370530 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 37054!:mime text/x-tcl 370550 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 37056!:mime text/x-tcl 37057 37058# check the first line 370590 search/1 package\ req 37060>0 regex \^package[\ \t]+req Tcl script 37061# not 'p', check other lines 370620 search/1 !p 37063>0 regex \^package[\ \t]+req Tcl script 37064 37065#------------------------------------------------------------------------------ 37066# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 37067# teapot: file(1) magic for "teapot" spreadsheet 37068# 370690 string #!teapot\012xdr teapot work sheet (XDR format) 37070 37071#------------------------------------------------------------------------------ 37072# $File: terminfo,v 1.12 2021/02/23 00:51:10 christos Exp $ 37073# terminfo: file(1) magic for terminfo 37074# 37075# URL: https://invisible-island.net/ncurses/man/term.5.html 37076# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html 37077# 37078# Workaround for Targa image type by Joerg Jenderek 37079# GRR: line below too general as it catches also 37080# Targa image type 1 with 26 long identification field 37081# and HELP.DSK 370820 string \032\001 37083# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32) 37084>16 ubyte >32 37085# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1" 37086>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s" 37087!:mime application/x-terminfo 37088# no extension 37089#!:ext 37090# 37091#------------------------------------------------------------------------------ 37092# The following was added for ncurses6 development: 37093#------------------------------------------------------------------------------ 37094# 370950 string \036\002 37096# imitate the legacy compiled-format, to get the entry-name printed 37097>16 ubyte >32 37098# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1" 37099>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled 32-bit terminfo entry "%-s" 37100!:mime application/x-terminfo2 37101# 37102# While the compiled terminfo uses little-endian format regardless of 37103# platform, SystemV screen dumps do not. They came later, and that detail was 37104# overlooked. 37105# 37106# AIX and HPUX use the SVr4 big-endian format 37107# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness) 371080 beshort 0433 SVr2 curses screen image, big-endian 371090 beshort 0434 SVr3 curses screen image, big-endian 371100 beshort 0435 SVr4 curses screen image, big-endian 37111# 371120 leshort 0433 SVr2 curses screen image, little-endian 371130 leshort 0434 SVr3 curses screen image, little-endian 371140 leshort 0435 SVr4 curses screen image, little-endian 37115# 37116# Rather than SVr4, Solaris "xcurses" writes this header: 371170 regex \^MAX=[0-9]+,[0-9]+$ 37118>1 regex \^BEG=[0-9]+,[0-9]+$ 37119>2 regex \^SCROLL=[0-9]+,[0-9]+$ 37120>3 regex \^VMIN=[0-9]+$ 37121>4 regex \^VTIME=[0-9]+$ 37122>5 regex \^FLAGS=0x[[:xdigit:]]+$ 37123>6 regex \^FG=[0-9],[0-9]+$ 37124>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image 37125# 37126# ncurses5 (and before) did not use a magic number, making screen dumps "data". 37127# ncurses6 (2015) uses this format, ignoring byte-order 371280 string \210\210\210\210ncurses ncurses6 screen image 37129# 37130# PDCurses added this in 2005 371310 string PDC\001 PDCurses screen image 37132 37133#------------------------------------------------------------------------------ 37134# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $ 37135# tex: file(1) magic for TeX files 37136# 37137# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 37138# 37139# From <conklin@talisman.kaleida.com> 37140 37141# Although we may know the offset of certain text fields in TeX DVI 37142# and font files, we can't use them reliably because they are not 37143# zero terminated. [but we do anyway, christos] 371440 string \367\002 TeX DVI file 37145!:mime application/x-dvi 37146>16 string >\0 (%s) 371470 string \367\203 TeX generic font data 371480 string \367\131 TeX packed font data 37149>3 string >\0 (%s) 371500 string \367\312 TeX virtual font data 371510 search/1 This\ is\ TeX, TeX transcript text 371520 search/1 This\ is\ METAFONT, METAFONT transcript text 37153 37154# There is no way to detect TeX Font Metric (*.tfm) files without 37155# breaking them apart and reading the data. The following patterns 37156# match most *.tfm files generated by METAFONT or afm2tfm. 371572 string \000\021 TeX font metric data 37158!:mime application/x-tex-tfm 37159>33 string >\0 (%s) 371602 string \000\022 TeX font metric data 37161!:mime application/x-tex-tfm 37162>33 string >\0 (%s) 37163 37164# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 371650 search/1 \\input\ texinfo Texinfo source text 37166!:mime text/x-texinfo 371670 search/1 This\ is\ Info\ file GNU Info text 37168!:mime text/x-info 37169 37170# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 371710 search/4096 \\input TeX document text 37172!:mime text/x-tex 37173!:strength + 15 371740 search/4096 \\begin LaTeX document text 37175!:mime text/x-tex 37176!:strength + 15 371770 search/4096 \\section LaTeX document text 37178!:mime text/x-tex 37179!:strength + 18 371800 search/4096 \\setlength LaTeX document text 37181!:mime text/x-tex 37182!:strength + 15 371830 search/4096 \\documentstyle LaTeX document text 37184!:mime text/x-tex 37185!:strength + 18 371860 search/4096 \\chapter LaTeX document text 37187!:mime text/x-tex 37188!:strength + 18 371890 search/4096 \\documentclass LaTeX 2e document text 37190!:mime text/x-tex 37191!:strength + 15 371920 search/4096 \\relax LaTeX auxiliary file 37193!:mime text/x-tex 37194!:strength + 15 371950 search/4096 \\contentsline LaTeX table of contents 37196!:mime text/x-tex 37197!:strength + 15 371980 search/4096 %\ -*-latex-*- LaTeX document text 37199!:mime text/x-tex 37200 37201# Tex document, from Hendrik Scholz <hendrik@scholz.net> 372020 search/1 \\ifx TeX document text 37203 37204# Index and glossary files 372050 search/4096 \\indexentry LaTeX raw index file 372060 search/4096 \\begin{theindex} LaTeX sorted index 372070 search/4096 \\glossaryentry LaTeX raw glossary 372080 search/4096 \\begin{theglossary} LaTeX sorted glossary 372090 search/4096 This\ is\ makeindex Makeindex log file 37210 37211# End of TeX 37212 37213#------------------------------------------------------------------------------ 37214# file(1) magic for BibTex text files 37215# From Hendrik Scholz <hendrik@scholz.net> 37216 372170 search/1/c @article{ BibTeX text file 372180 search/1/c @book{ BibTeX text file 372190 search/1/c @inbook{ BibTeX text file 372200 search/1/c @incollection{ BibTeX text file 372210 search/1/c @inproceedings{ BibTeX text file 372220 search/1/c @manual{ BibTeX text file 372230 search/1/c @misc{ BibTeX text file 372240 search/1/c @preamble{ BibTeX text file 372250 search/1/c @phdthesis{ BibTeX text file 372260 search/1/c @techreport{ BibTeX text file 372270 search/1/c @unpublished{ BibTeX text file 37228 3722973 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 37230 3723173 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 37232 372330 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 37234 372350 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 37236 372370 search/1 @c\ @mapfile{ TeX font aliases text file 37238 372390 string #LyX LyX document text 37240 37241# ConTeXt documents 37242# https://wiki.contextgarden.net/ 372430 search/4096 \\setupcolors[ ConTeXt document text 37244!:strength + 15 372450 search/4096 \\definecolor[ ConTeXt document text 37246!:strength + 15 372470 search/4096 \\setupinteraction[ ConTeXt document text 37248!:strength + 15 372490 search/4096 \\useURL[ ConTeXt document text 37250!:strength + 15 372510 search/4096 \\setuppapersize[ ConTeXt document text 37252!:strength + 15 372530 search/4096 \\setuplayout[ ConTeXt document text 37254!:strength + 15 372550 search/4096 \\setupfooter[ ConTeXt document text 37256!:strength + 15 372570 search/4096 \\setupfootertexts[ ConTeXt document text 37258!:strength + 15 372590 search/4096 \\setuppagenumbering[ ConTeXt document text 37260!:strength + 15 372610 search/4096 \\setupbodyfont[ ConTeXt document text 37262!:strength + 15 372630 search/4096 \\setuphead[ ConTeXt document text 37264!:strength + 15 372650 search/4096 \\setupitemize[ ConTeXt document text 37266!:strength + 15 372670 search/4096 \\setupwhitespace[ ConTeXt document text 37268!:strength + 15 372690 search/4096 \\setupindenting[ ConTeXt document text 37270!:strength + 15 37271 37272#------------------------------------------------------------------------------ 37273# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 37274# file(1) magic for tgif(1) files 37275# From Hendrik Scholz <hendrik@scholz.net> 372760 string %TGIF\ Tgif file version 37277>6 string x %s 37278 37279#------------------------------------------------------------------------------ 37280# $File: ti-8x,v 1.8 2020/02/12 22:13:01 christos Exp $ 37281# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 37282# 37283# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 37284# 37285# Update: Romain Lievin (roms@lpg.ticalc.org). 37286# 37287# NOTE: This list is not complete. 37288# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 37289# program/group magic numbers in here because I cannot find any. 372900 string **TI80** TI-80 Graphing Calculator File. 372910 string **TI81** TI-81 Graphing Calculator File. 37292# 37293# Magic Numbers for the TI-73 37294# 372950 string **TI73** TI-73 Graphing Calculator 37296>0x00003B byte 0x00 (real number) 37297>0x00003B byte 0x01 (list) 37298>0x00003B byte 0x02 (matrix) 37299>0x00003B byte 0x03 (equation) 37300>0x00003B byte 0x04 (string) 37301>0x00003B byte 0x05 (program) 37302>0x00003B byte 0x06 (assembly program) 37303>0x00003B byte 0x07 (picture) 37304>0x00003B byte 0x08 (gdb) 37305>0x00003B byte 0x0C (complex number) 37306>0x00003B byte 0x0F (window settings) 37307>0x00003B byte 0x10 (zoom) 37308>0x00003B byte 0x11 (table setup) 37309>0x00003B byte 0x13 (backup) 37310 37311# Magic Numbers for the TI-82 37312# 373130 string **TI82** TI-82 Graphing Calculator 37314>0x00003B byte 0x00 (real) 37315>0x00003B byte 0x01 (list) 37316>0x00003B byte 0x02 (matrix) 37317>0x00003B byte 0x03 (Y-variable) 37318>0x00003B byte 0x05 (program) 37319>0x00003B byte 0x06 (protected prgm) 37320>0x00003B byte 0x07 (picture) 37321>0x00003B byte 0x08 (gdb) 37322>0x00003B byte 0x0B (window settings) 37323>0x00003B byte 0x0C (window settings) 37324>0x00003B byte 0x0D (table setup) 37325>0x00003B byte 0x0E (screenshot) 37326>0x00003B byte 0x0F (backup) 37327# 37328# Magic Numbers for the TI-83 37329# 373300 string **TI83** TI-83 Graphing Calculator 37331>0x00003B byte 0x00 (real) 37332>0x00003B byte 0x01 (list) 37333>0x00003B byte 0x02 (matrix) 37334>0x00003B byte 0x03 (Y-variable) 37335>0x00003B byte 0x04 (string) 37336>0x00003B byte 0x05 (program) 37337>0x00003B byte 0x06 (protected prgm) 37338>0x00003B byte 0x07 (picture) 37339>0x00003B byte 0x08 (gdb) 37340>0x00003B byte 0x0B (window settings) 37341>0x00003B byte 0x0C (window settings) 37342>0x00003B byte 0x0D (table setup) 37343>0x00003B byte 0x0E (screenshot) 37344>0x00003B byte 0x13 (backup) 37345# 37346# Magic Numbers for the TI-83+ 37347# 373480 string **TI83F* TI-83+ Graphing Calculator 37349>0x00003B byte 0x00 (real number) 37350>0x00003B byte 0x01 (list) 37351>0x00003B byte 0x02 (matrix) 37352>0x00003B byte 0x03 (equation) 37353>0x00003B byte 0x04 (string) 37354>0x00003B byte 0x05 (program) 37355>0x00003B byte 0x06 (assembly program) 37356>0x00003B byte 0x07 (picture) 37357>0x00003B byte 0x08 (gdb) 37358>0x00003B byte 0x0C (complex number) 37359>0x00003B byte 0x0F (window settings) 37360>0x00003B byte 0x10 (zoom) 37361>0x00003B byte 0x11 (table setup) 37362>0x00003B byte 0x13 (backup) 37363>0x00003B byte 0x15 (application variable) 37364>0x00003B byte 0x17 (group of variable) 37365 37366# 37367# Magic Numbers for the TI-85 37368# 373690 string **TI85** TI-85 Graphing Calculator 37370>0x00003B byte 0x00 (real number) 37371>0x00003B byte 0x01 (complex number) 37372>0x00003B byte 0x02 (real vector) 37373>0x00003B byte 0x03 (complex vector) 37374>0x00003B byte 0x04 (real list) 37375>0x00003B byte 0x05 (complex list) 37376>0x00003B byte 0x06 (real matrix) 37377>0x00003B byte 0x07 (complex matrix) 37378>0x00003B byte 0x08 (real constant) 37379>0x00003B byte 0x09 (complex constant) 37380>0x00003B byte 0x0A (equation) 37381>0x00003B byte 0x0C (string) 37382>0x00003B byte 0x0D (function GDB) 37383>0x00003B byte 0x0E (polar GDB) 37384>0x00003B byte 0x0F (parametric GDB) 37385>0x00003B byte 0x10 (diffeq GDB) 37386>0x00003B byte 0x11 (picture) 37387>0x00003B byte 0x12 (program) 37388>0x00003B byte 0x13 (range) 37389>0x00003B byte 0x17 (window settings) 37390>0x00003B byte 0x18 (window settings) 37391>0x00003B byte 0x19 (window settings) 37392>0x00003B byte 0x1A (window settings) 37393>0x00003B byte 0x1B (zoom) 37394>0x00003B byte 0x1D (backup) 37395>0x00003B byte 0x1E (unknown) 37396>0x00003B byte 0x2A (equation) 37397>0x000032 string ZS4 - ZShell Version 4 File. 37398>0x000032 string ZS3 - ZShell Version 3 File. 37399# 37400# Magic Numbers for the TI-86 37401# 374020 string **TI86** TI-86 Graphing Calculator 37403>0x00003B byte 0x00 (real number) 37404>0x00003B byte 0x01 (complex number) 37405>0x00003B byte 0x02 (real vector) 37406>0x00003B byte 0x03 (complex vector) 37407>0x00003B byte 0x04 (real list) 37408>0x00003B byte 0x05 (complex list) 37409>0x00003B byte 0x06 (real matrix) 37410>0x00003B byte 0x07 (complex matrix) 37411>0x00003B byte 0x08 (real constant) 37412>0x00003B byte 0x09 (complex constant) 37413>0x00003B byte 0x0A (equation) 37414>0x00003B byte 0x0C (string) 37415>0x00003B byte 0x0D (function GDB) 37416>0x00003B byte 0x0E (polar GDB) 37417>0x00003B byte 0x0F (parametric GDB) 37418>0x00003B byte 0x10 (diffeq GDB) 37419>0x00003B byte 0x11 (picture) 37420>0x00003B byte 0x12 (program) 37421>0x00003B byte 0x13 (range) 37422>0x00003B byte 0x17 (window settings) 37423>0x00003B byte 0x18 (window settings) 37424>0x00003B byte 0x19 (window settings) 37425>0x00003B byte 0x1A (window settings) 37426>0x00003B byte 0x1B (zoom) 37427>0x00003B byte 0x1D (backup) 37428>0x00003B byte 0x1E (unknown) 37429>0x00003B byte 0x2A (equation) 37430# 37431# Magic Numbers for the TI-89 37432# 374330 string **TI89** TI-89 Graphing Calculator 37434>0x000048 byte 0x00 (expression) 37435>0x000048 byte 0x04 (list) 37436>0x000048 byte 0x06 (matrix) 37437>0x000048 byte 0x0A (data) 37438>0x000048 byte 0x0B (text) 37439>0x000048 byte 0x0C (string) 37440>0x000048 byte 0x0D (graphic data base) 37441>0x000048 byte 0x0E (figure) 37442>0x000048 byte 0x10 (picture) 37443>0x000048 byte 0x12 (program) 37444>0x000048 byte 0x13 (function) 37445>0x000048 byte 0x14 (macro) 37446>0x000048 byte 0x1C (zipped) 37447>0x000048 byte 0x21 (assembler) 37448# 37449# Magic Numbers for the TI-92 37450# 374510 string **TI92** TI-92 Graphing Calculator 37452>0x000048 byte 0x00 (expression) 37453>0x000048 byte 0x04 (list) 37454>0x000048 byte 0x06 (matrix) 37455>0x000048 byte 0x0A (data) 37456>0x000048 byte 0x0B (text) 37457>0x000048 byte 0x0C (string) 37458>0x000048 byte 0x0D (graphic data base) 37459>0x000048 byte 0x0E (figure) 37460>0x000048 byte 0x10 (picture) 37461>0x000048 byte 0x12 (program) 37462>0x000048 byte 0x13 (function) 37463>0x000048 byte 0x14 (macro) 37464>0x000048 byte 0x1D (backup) 37465# 37466# Magic Numbers for the TI-92+/V200 37467# 374680 string **TI92P* TI-92+/V200 Graphing Calculator 37469>0x000048 byte 0x00 (expression) 37470>0x000048 byte 0x04 (list) 37471>0x000048 byte 0x06 (matrix) 37472>0x000048 byte 0x0A (data) 37473>0x000048 byte 0x0B (text) 37474>0x000048 byte 0x0C (string) 37475>0x000048 byte 0x0D (graphic data base) 37476>0x000048 byte 0x0E (figure) 37477>0x000048 byte 0x10 (picture) 37478>0x000048 byte 0x12 (program) 37479>0x000048 byte 0x13 (function) 37480>0x000048 byte 0x14 (macro) 37481>0x000048 byte 0x1C (zipped) 37482>0x000048 byte 0x21 (assembler) 37483# 37484# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 37485# 37486#0x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 374870 string **TIFL** TI-XX Graphing Calculator (FLASH) 37488>8 byte >0 - Revision %d 37489>>9 byte x \b.%d, 37490>12 byte >0 Revision date %02x 37491>>13 byte x \b/%02x 37492>>14 beshort x \b/%04x, 37493>17 string >/0 name: '%s', 37494>48 byte 0x74 device: TI-73, 37495>48 byte 0x73 device: TI-83+, 37496>48 byte 0x98 device: TI-89, 37497>48 byte 0x88 device: TI-92+, 37498>49 byte 0x23 type: OS upgrade, 37499>49 byte 0x24 type: application, 37500>49 byte 0x25 type: certificate, 37501>49 byte 0x3e type: license, 37502>74 lelong >0 size: %d bytes 37503 37504# VTi & TiEmu skins (TI Graphing Calculators). 37505# From: Romain Lievin (roms@lpg.ticalc.org). 37506# Magic Numbers for the VTi skins 375070 string VTI Virtual TI skin 37508>3 string v - Version 37509>>4 byte >0 \b %c 37510>>6 byte x \b.%c 37511# Magic Numbers for the TiEmu skins 375120 string TiEmu TiEmu skin 37513>6 string v - Version 37514>>7 byte >0 \b %c 37515>>9 byte x \b.%c 37516>>10 byte x \b%c 37517 37518#------------------------------------------------------------------------------ 37519# $File: timezone,v 1.13 2021/07/21 17:57:20 christos Exp $ 37520# timezone: file(1) magic for timezone data 37521# 37522# from Daniel Quinlan (quinlan@yggdrasil.com) 37523# this should work on Linux, SunOS, and maybe others 37524# Added new official magic number for recent versions of the Olson code 375250 name timezone 37526>4 byte 0 \b, old version 37527>4 byte >0 \b, version %c 37528>20 belong 0 \b, no gmt time flags 37529>20 belong 1 \b, 1 gmt time flag 37530>20 belong >1 \b, %d gmt time flags 37531>24 belong 0 \b, no std time flags 37532>24 belong 1 \b, 1 std time flag 37533>24 belong >1 \b, %d std time flags 37534>28 belong 0 \b, no leap seconds 37535>28 belong 1 \b, 1 leap second 37536>28 belong >1 \b, %d leap seconds 37537>32 belong 0 \b, no transition times 37538>32 belong 1 \b, 1 transition time 37539>32 belong >1 \b, %d transition times 37540>36 belong 0 \b, no local time types 37541>36 belong 1 \b, 1 local time type 37542>36 belong >1 \b, %d local time types 37543>40 belong 0 \b, no abbreviation chars 37544>40 belong 1 \b, 1 abbreviation char 37545>40 belong >1 \b, %d abbreviation chars 37546 375470 string TZif timezone data 37548>51 string TZif \b(slim) 37549>>51 use timezone 37550>51 default x \b(fat) 37551>>0 use timezone 37552 375530 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 375540 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 375550 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 375560 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 375570 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 375580 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 37559 37560#------------------------------------------------------------------------------ 37561# $File: tplink,v 1.7 2021/04/26 15:56:00 christos Exp $ 37562# tplink: File magic for openwrt firmware files 37563 37564# URL: https://wiki.openwrt.org/doc/techref/header 37565# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c 37566# From: Joerg Jenderek 37567# check for valid header version 1 or 2 375680 ulelong <3 37569>0 ulelong !0 37570# test for header padding with nulls 37571>>0x100 long 0 37572# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor 37573>>>4 ubelong >0x1F000000 37574# skip user.dbt by looking for positive hardware id 37575>>>>0x40 ubeshort >0 37576>>>>>0 use firmware-tplink 37577 375780 name firmware-tplink 37579>0 ubyte x firmware 37580!:mime application/x-tplink-bin 37581!:ext bin 37582# hardware id like 10430001 07410001 09410004 09410006 37583>0x40 ubeshort x %x 37584>0x42 ubeshort x v%x 37585# hardware revision like 1 37586>0x44 ubelong !1 (revision %u) 37587# vendor_name[24] like OpenWrt or TP-LINK Technologies 37588>4 string x %.24s 37589# fw_version[36] like r49389 or ver. 1.0 37590>0x1c string x %.36s 37591# header version 1 or 2 37592>0 ubyte !1 V%X 37593# ver_hi.ver_mid.ver_lo 37594>0x98 long !0 \b, version 37595>>0x98 ubeshort x %u 37596>>0x9A ubeshort x \b.%u 37597>>0x9C ubeshort x \b.%u 37598# region code 0~universal 1~US 37599>0x48 ubelong x 37600#>>0x48 ubelong 0 (universal) 37601>>0x48 ubelong 1 (US) 37602>>0x48 ubelong >1 (region %u) 37603# total length of the firmware. not always true 37604>0x7C ubelong x \b, %u bytes or less 37605# unknown 1 37606>0x48 ubelong !0 \b, UNKNOWN1 %#x 37607# md5sum1[16] 37608#>0x4c ubequad x \b, MD5 %llx 37609#>>0x54 ubequad x \b%llx 37610# unknown 2 37611>0x5c ubelong !0 \b, UNKNOWN2 %#x 37612# md5sum2[16] 37613#>0x60 ubequad !0 \b, 2nd MD5 %llx 37614#>>0x68 ubequad x \b%llx 37615# unknown 3 37616>0x70 ubelong !0 \b, UNKNOWN3 %#x 37617# kernel load address 37618#>0x74 ubelong x \b, %#x load 37619# kernel entry point 37620#>0x78 ubelong x \b, %#x entry 37621# kernel data offset. 200h means direct after header 37622>0x80 ubelong x \b, at %#x 37623# kernel data length and 1 space 37624>0x84 ubelong x %u bytes 37625# look for kernel type (gzip compressed vmlinux.bin by ./compress) 37626>(0x80.L) indirect x 37627# root file system data offset 37628# WRONG in 5.35 with above indirect expression 37629>0x88 ubelong x \b, at %#x 37630# rootfs data length and 1 space 37631>0x8C ubelong x %u bytes 37632# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h 37633>(0x88.L) indirect x 37634# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin 37635#>(0x88.L) string x \b, file system '%.4s' 37636#>(0x88.L) ubequad x \b, file system %#llx 37637# bootloader data offset 37638>0x90 ubelong !0 \b, at %#x 37639# bootloader data length only reasonable if bootloader offset not null 37640>>0x94 ubelong !0 %u bytes 37641# pad[354] should be 354 null bytes. 37642#>0x9E ubequad !0 \b, padding %#llx 37643# But at 0x120 18 non null bytes in examples like 37644# wr940nv4_eu_3_16_9_up_boot(160620).bin 37645# wr940nv6_us_3_18_1_up_boot(171030).bin 37646#>0x120 ubequad !0 \b, other padding %#llx 37647 37648#------------------------------------------------------------------------------ 37649# $File: troff,v 1.13 2020/05/30 23:12:34 christos Exp $ 37650# troff: file(1) magic for *roff 37651# 37652# updated by Daniel Quinlan (quinlan@yggdrasil.com) 37653 37654# troff input 376550 search/1 .\\" troff or preprocessor input text 37656!:mime text/troff 376570 search/1 '\\" troff or preprocessor input text 37658!:mime text/troff 376590 search/1 '.\\" troff or preprocessor input text 37660!:mime text/troff 376610 search/1 \\" troff or preprocessor input text 37662!:mime text/troff 37663#0 search/1 ''' troff or preprocessor input text 37664#!:mime text/troff 376650 regex/20l \^\\.[A-Za-z][A-Za-z0-9][\ \t] troff or preprocessor input text 37666!:mime text/troff 376670 regex/20l \^\\.[A-Za-z][A-Za-z0-9]$ troff or preprocessor input text 37668!:mime text/troff 37669 37670# ditroff intermediate output text 376710 search/1 x\ T ditroff output text 37672>4 search/1 cat for the C/A/T phototypesetter 37673>4 search/1 ps for PostScript 37674>4 search/1 dvi for DVI 37675>4 search/1 ascii for ASCII 37676>4 search/1 lj4 for LaserJet 4 37677>4 search/1 latin1 for ISO 8859-1 (Latin 1) 37678>4 search/1 X75 for xditview at 75dpi 37679>>7 search/1 -12 (12pt) 37680>4 search/1 X100 for xditview at 100dpi 37681>>8 search/1 -12 (12pt) 37682 37683# output data formats 376840 string \100\357 very old (C/A/T) troff output data 37685 37686#------------------------------------------------------------------------------ 37687# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 37688# tuxedo: file(1) magic for BEA TUXEDO data files 37689# 37690# from Ian Springer <ispringer@hotmail.com> 37691# 376920 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 37693 37694#------------------------------------------------------------------------------ 37695# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 37696# typeset: file(1) magic for other typesetting 37697# 376980 string Interpress/Xerox Xerox InterPress data 37699>16 string / (version 37700>>17 string >\0 %s) 37701 37702#------------------------------------------------------------------------------ 37703# $File: uf2,v 1.3 2021/04/28 01:00:31 christos Exp $ 37704# uf2: file(1) magic for UF2 firmware image files 37705# 37706# https://github.com/microsoft/uf2 37707# 37708# Created by Blake Ramsdell <blaker@gmail.com> 37709 377100 string UF2\n UF2 firmware image 37711!:ext uf2 37712# This is for checking the other magic numbers, do we want to do that? 37713#>4 lelong 0x9E5D5157 howdy 37714#>>508 lelong 0x0AB16F30 doody 37715>8 lelong &0x0001 \b, not main flash 37716>8 lelong &0x1000 \b, file container 37717>8 lelong &0x2000 \b, family 37718 37719# To update the UF2 family data, use this fine command 37720# 37721# families=`curl \ 37722# https://raw.githubusercontent.com/microsoft/uf2/master/utils/uf2families.json \ 37723# | jq -r '.[] | ">>28\tlelong\t\(.id)\t\(.description)"' | sort -n -k 3` && \ 37724# perl -0777 -i -pe \ 37725# "s/(### BEGIN UF2 FAMILIES\\n).*(\\n### END UF2 FAMILIES)/\$1$families\$2/s" \ 37726# uf2 37727 37728### BEGIN UF2 FAMILIES 37729>>28 lelong 0x00ff6919 ST STM32L4xx 37730>>28 lelong 0x04240bdf ST STM32L5xx 37731>>28 lelong 0x16573617 Microchip (Atmel) ATmega32 37732>>28 lelong 0x1851780a Microchip (Atmel) SAML21 37733>>28 lelong 0x1b57745f Nordic NRF52 37734>>28 lelong 0x1c5f21b0 ESP32 37735>>28 lelong 0x1e1f432d ST STM32L1xx 37736>>28 lelong 0x202e3a91 ST STM32L0xx 37737>>28 lelong 0x21460ff0 ST STM32WLxx 37738>>28 lelong 0x2abc77ec NXP LPC55xx 37739>>28 lelong 0x300f5633 ST STM32G0xx 37740>>28 lelong 0x31d228c6 GD32F350 37741>>28 lelong 0x4c71240a ST STM32G4xx 37742>>28 lelong 0x4fb2d5bd NXP i.MX RT10XX 37743>>28 lelong 0x53b80f00 ST STM32F7xx 37744>>28 lelong 0x55114460 Microchip (Atmel) SAMD51 37745>>28 lelong 0x57755a57 ST STM32F401 37746>>28 lelong 0x5a18069b Cypress FX2 37747>>28 lelong 0x5d1a0a2e ST STM32F2xx 37748>>28 lelong 0x5ee21072 ST STM32F103 37749>>28 lelong 0x647824b6 ST STM32F0xx 37750>>28 lelong 0x68ed2b88 Microchip (Atmel) SAMD21 37751>>28 lelong 0x6b846188 ST STM32F3xx 37752>>28 lelong 0x6d0922fa ST STM32F407 37753>>28 lelong 0x6db66082 ST STM32H7xx 37754>>28 lelong 0x70d16653 ST STM32WBxx 37755>>28 lelong 0x7eab61ed ESP8266 37756>>28 lelong 0x7f83e793 NXP KL32L2x 37757>>28 lelong 0x8fb060fe ST STM32F407VG 37758>>28 lelong 0xada52840 Nordic NRF52840 37759>>28 lelong 0xbfdd4eee ESP32-S2 37760>>28 lelong 0xc47e5767 ESP32-S3 37761>>28 lelong 0xd42ba06c ESP32-C3 37762>>28 lelong 0xe48bff56 Raspberry Pi RP2040 37763### END UF2 FAMILIES 37764 37765>>28 default x 37766>>>28 lelong x %#08x 37767>8 lelong&0x2000 0 \b, file size 37768>>28 lelong x %#08x 37769>8 lelong &0x4000 \b, MD5 checksum present 37770>8 lelong &0x8000 \b, extension tags present 37771>12 lelong x \b, address %#08x 37772>24 lelong x \b, %u total blocks 37773 37774#------------------------------------------------------------------------------ 37775# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $ 37776# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 37777# These types are recognised in file_ascmagic so these encodings can be 37778# treated by text patterns. Missing types are already dealt with internally. 37779# 377800 string +/v8 Unicode text, UTF-7 377810 string +/v9 Unicode text, UTF-7 377820 string +/v+ Unicode text, UTF-7 377830 string +/v/ Unicode text, UTF-7 377840 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 377850 string \000\000\376\377 Unicode text, UTF-32, big-endian 377860 string \377\376\000\000 Unicode text, UTF-32, little-endian 377870 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 37788 37789#------------------------------------------------------------------------------ 37790# $File: unisig,v 1.1 2020/04/09 19:05:44 christos Exp $ 37791# unisig: file(1) magic for files carrying a uniform signature (Unisig) 37792# From: Lassi Kortela, John Cowan 37793# URL: https://github.com/unisig 37794# 377950 string \xDC\xDC\x0D\x0A\x1A\x0A\x00 Unisig: 37796>7 ubyte =0 UUID 37797>>8 guid x %s 37798>7 ubyte >0 URI 37799>>7 pstring x %s 37800 37801#------------------------------------------------------------------------------ 37802# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 37803# unknown: file(1) magic for unknown machines 37804# 37805# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 37806# (executable, pure, and split I&D, respectively), but the PDP-11 version 37807# doesn't have the "version %ld", which may be a bogus COFFism (I don't 37808# think there was ever COFF for the PDP-11). 37809# 37810# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 37811# long, as it would be on a VAX. In any case, that could collide with 37812# VAX demand-paged files, as the magic number is little-endian on those 37813# binaries, so the first 16 bits of the file would contain 0x10B. 37814# 37815# Therefore, those entries are commented out. 37816# 37817# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 37818# 37819#0 short 0x107 unknown machine executable 37820#>8 short >0 not stripped 37821#>15 byte >0 - version %ld 37822#0 short 0x108 unknown pure executable 37823#>8 short >0 not stripped 37824#>15 byte >0 - version %ld 37825#0 short 0x109 PDP-11 separate I&D 37826#>8 short >0 not stripped 37827#>15 byte >0 - version %ld 37828#0 short 0x10b unknown pure executable 37829#>8 short >0 not stripped 37830#>15 byte >0 - version %ld 378310 long 0x10c unknown demand paged pure executable 37832>16 long >0 not stripped 378330 long 0x10e unknown readable demand paged pure executable 37834 37835#------------------------------------------------------------------------------ 37836# $File: usd,v 1.2 2020/05/21 22:17:00 christos Exp $ 37837# 37838# From Christian Schmidbauer 37839# 37840# https://github.com/PixarAnimationStudios/USD 37841 37842# USD crate file 37843# https://github.com/PixarAnimationStudios/USD/blob/ebac0a8b6703f4fa1c27115f1f013bb9819662f4/pxr/usd/usd/crateFile.h#L441-L450 378440 string PXR-USDC USD crate 37845>8 byte x \b, version %x. 37846>9 byte x \b%x. 37847>10 byte x \b%x 37848!:ext usd 37849 37850# USD ASCII file 378510 string #usda\040 USD ASCII 37852>6 string x \b, version %s 37853!:mime text/plain 37854!:ext usd 37855 37856#------------------------------------------------------------------------------ 37857# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $ 37858# file(1) magic for uterus files 37859# http://freecode.com/projects/uterus 37860# 378610 string UTE+ uterus file 37862>4 string v \b, version 37863>5 byte x %c 37864>6 string . \b. 37865>7 byte x \b%c 37866>8 string \<\> \b, big-endian 37867>>16 belong >0 \b, slut size %u 37868>8 string \>\< \b, litte-endian 37869>>16 lelong >0 \b, slut size %u 37870>10 byte &8 \b, compressed 37871 37872#------------------------------------------------------------------------------ 37873# $File: uuencode,v 1.9 2021/11/13 17:48:10 christos Exp $ 37874# uuencode: file(1) magic for ASCII-encoded files 37875# 37876 37877# The first line of xxencoded files is identical to that in uuencoded files, 37878# but the first character in most subsequent lines is 'h' instead of 'M'. 37879# (xxencoding uses lowercase letters in place of most of uuencode's 37880# punctuation and survives BITNET gateways better.) 378810 regex/1024 \^begin\040[0-7]{3}\040 37882>&0 regex/256 [\012\015]+M[\040-\140]{60}[\012\015]+ uuencoded text 37883>&0 regex/256 [\012\015]+h[0-9A-Za-z\053\055]{60}[\012\015]+ xxencoded text 37884>&0 default x uuencoded or xxencoded text 37885>&0 string >\0 \b, file name "%s" 37886 37887# btoa(1) is an alternative to uuencode that requires less space. 378880 search/1 xbtoa\ Begin btoa'd text 37889 37890# ship(1) is another, much cooler alternative to uuencode. 37891# Greg Roelofs, newt@uchicago.edu 378920 search/1 $\012ship ship'd binary text 37893 37894# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 37895# Greg Roelofs, newt@uchicago.edu 378960 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 37897 37898# GRR: handle BASE64 37899 37900#------------------------------------------------------------------------------ 37901# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $ 37902# vacuum cleaner magic by Thomas M. Ott (ThMO) 37903# 37904# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx 37905# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk 37906# -> yyyymmdd: year, month, day of cleaning 37907# -> hhmmss: hour, minute, second of cleaning 37908# -> xxxxxx: 6 digits 37909# -> cc: cleaning runs counter 37910# size: 136044 bytes 37911# 37912# struct maphdr { 37913# int32_t map_cnt; /* 0: single map */ 37914# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */ 37915# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */ 37916# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */ 37917# int32_t unknown; /* 16: 50000 ??? */ 37918# int32_t cell_bytes; /* 20: # of bytes for cells per block */ 37919# int32_t block_max; /* 24: 1000 == max. # of blocks */ 37920# int32_t route_max; /* 28: 1000 == max. # of routes */ 37921# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */ 37922# int32_t cell_dim; /* 36: 10 == cell dimension */ 37923# int32_t clock_tick; /* 40: 100 == clock ticks */ 37924# #if 0 37925# struct { /* 44: 1000 blocks for 10x10 cells */ 37926# int32_t yoffset; 37927# int32_t xoffset; 37928# int32_t posxy; 37929# int32_t timecode; 37930# } blocks[ 1000]; 37931# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */ 37932# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */ 37933# #endif 37934# }; 37935 379360 lelong =1 37937>4 lelong =100 37938>>8 lelong =10000 37939>>>12 lelong =50 37940>>>>16 lelong =50000 37941>>>>>20 lelong =100 37942>>>>>>24 lelong =1000 37943>>>>>>>28 lelong =1000 37944>>>>>>>>36 lelong =10 37945>>>>>>>>>40 lelong =100 37946>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation 37947>>>>>>>>>>136040 lelong =-1 reuse map data 37948>>>>>>>>>>136040 lelong =0 map data 37949>>>>>>>>>>136040 lelong >0 spurious map data 37950>>>>>>>>>>136040 lelong <-1 spurious map data 37951 37952 37953 37954#------------------------------------------------------------------------------ 37955# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $ 37956# varied.out: file(1) magic for various USG systems 37957# 37958# Herewith many of the object file formats used by USG systems. 37959# Most have been moved to files for a particular processor, 37960# and deleted if they duplicate other entries. 37961# 379620 short 0610 Perkin-Elmer executable 37963# AMD 29K 379640 beshort 0572 amd 29k coff noprebar executable 379650 beshort 01572 amd 29k coff prebar executable 379660 beshort 0160007 amd 29k coff archive 37967# Cray 379686 beshort 0407 unicos (cray) executable 37969# Ultrix 4.3 37970596 string \130\337\377\377 Ultrix core file 37971>600 string >\0 from '%s' 37972# BeOS and MAcOS PEF executables 37973# From: hplus@zilker.net (Jon Watte) 379740 string Joy!peffpwpc header for PowerPC PEF executable 37975# 37976# ava assembler/linker Uros Platise <uros.platise@ijs.si> 379770 string avaobj AVR assembler object code 37978>7 string >\0 version '%s' 37979# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 379800 string gmon GNU prof performance data 37981>4 long x - version %d 37982# From: Dave Pearson <davep@davep.org> 37983# Harbour <URL:http://harbour-project.org/> HRB files. 379840 string \xc0HRB Harbour HRB file 37985>4 leshort x version %d 37986# Harbour HBV files 379870 string \xc0HBV Harbour variable dump file 37988>4 leshort x version %d 37989 37990# From: Alex Beregszaszi <alex@fsn.hu> 37991# 0 string exec BugOS executable 37992# 0 string pack BugOS archive 37993 37994# From: Jason Spence <jspence@lightconsulting.com> 37995# Generated by the "examples" in STM's ST40 devkit, and derived code. 379960 lelong 0x13a9f17e ST40 component image format 37997>4 string >\0 \b, name '%s' 37998 37999#------------------------------------------------------------------------------ 38000# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $ 38001# varied.script: file(1) magic for various interpreter scripts 38002 380030 string/t #!\ / a 38004>3 string >\0 %s script text executable 38005!:strength / 2 38006 380070 string/b #!\ / a 38008>3 string >\0 %s script executable (binary data) 38009!:strength / 2 38010 380110 string/t #!\t/ a 38012>3 string >\0 %s script text executable 38013!:strength / 2 38014 380150 string/b #!\t/ a 38016>3 string >\0 %s script executable (binary data) 38017!:strength / 2 38018 380190 string/t #!/ a 38020>2 string >\0 %s script text executable 38021!:strength / 2 38022 380230 string/b #!/ a 38024>2 string >\0 %s script executable (binary data) 38025!:strength / 2 38026 380270 string/t #!\ script text executable 38028>3 string >\0 for %s 38029!:strength / 2 38030 380310 string/b #!\ script executable 38032>3 string >\0 for %s (binary data) 38033!:strength / 2 38034 38035# using env 380360 string/t #!/usr/bin/env a 38037>15 string/t >\0 %s script text executable 38038!:strength / 10 38039 380400 string/b #!/usr/bin/env a 38041>15 string/b >\0 %s script executable (binary data) 38042!:strength / 10 38043 380440 string/t #!\ /usr/bin/env a 38045>16 string/t >\0 %s script text executable 38046!:strength / 10 38047 380480 string/b #!\ /usr/bin/env a 38049>16 string/b >\0 %s script executable (binary data) 38050!:strength / 10 38051 38052# From: arno <arenevier@fdn.fr> 38053# mozilla xpconnect typelib 38054# see https://www.mozilla.org/scriptable/typelib_file.html 380550 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 38056>0x10 byte x version %d 38057>>0x11 byte x \b.%d 38058 38059#------------------------------------------------------------------------------ 38060# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $ 38061# vax: file(1) magic for VAX executable/object and APL workspace 38062# 380630 lelong 0101557 VAX single precision APL workspace 380640 lelong 0101556 VAX double precision APL workspace 38065 38066# 38067# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 38068# executables, and are handled in aout) 38069# 380700 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 38071>16 lelong >0 not stripped 38072 38073# 38074# VAX COFF 38075# 38076# The `versions' were commented out, but have been un-commented out. 38077# (Was the problem just one of endianness?) 38078# 380790 leshort 0570 38080>2 uleshort <100 VAX COFF executable, sections %d 38081>>4 ledate x \b, created %s 38082>>12 lelong >0 \b, not stripped 38083>>22 leshort >0 \b, version %d 38084 380850 leshort 0575 38086>2 uleshort <100 VAX COFF pure executable, sections %d 38087>>4 ledate x \b, created %s 38088>>12 lelong >0 \b, not stripped 38089>>22 leshort >0 \b, version %d 38090 38091#------------------------------------------------------------------------------ 38092# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 38093# vicar: file(1) magic for VICAR files. 38094# 38095# From: Ossama Othman <othman@astrosun.tn.cornell.edu 38096# VICAR is JPL's in-house spacecraft image processing program 38097# VICAR image 380980 string LBLSIZE= VICAR image data 38099>32 string BYTE \b, 8 bits = VAX byte 38100>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 38101>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 38102>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 38103>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 38104>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 38105# VICAR label file 3810643 string SFDU_LABEL VICAR label file 38107 38108#------------------------------------------------------------------------------ 38109# $File: virtual,v 1.17 2022/08/23 08:00:54 christos Exp $ 38110# From: James Nobis <quel@quelrod.net> 38111# Microsoft hard disk images for: 38112# Virtual Server 38113# Virtual PC 38114# VirtualBox 38115# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) 38116# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ 38117# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc 381180 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 38119# alternative shorter names 38120#0 string conectix Microsoft Virtual Hard Disk image 38121#0 string conectix Microsoft Virtual HD image 38122!:mime application/x-virtualbox-vhd 38123!:ext vhd 38124# Features is a bit field used to indicate specific feature support 38125#>8 ubelong !0x00000002 \b, Features %#x 38126# Reserved. This bit must always be set to 1. 38127#>8 ubelong &0x00000002 \b, Reserved %#x 38128# File Format Version for the current specification 0x00010000 38129#>12 ubelong !0x00010000 \b, Version %#8.8x 38130# Data Offset only found 0x200 38131#>16 ubequad !0x200 \b, Data Offset %#llx 38132#>16 ubequad x \b, at %#llx 38133# Dynamic Disk Header cookie like cxsparse 38134#>(16.Q) string x "%-.8s" 38135# This field contains a Unicode string (UTF-16) of the parent hard disk filename 38136#>(16.Q+64) ubequad x \b, parent name %#llx 38137# Creator Application 38138# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd 38139>28 string x \b, Creator %-4.4s 38140# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 38141# holds the major/minor version of the application that created the image 38142>32 ubeshort x %x 38143>34 ubeshort x \b.%x 38144#>32 ubelong x \b, Version %#8.8x 38145# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) 38146>36 ubelong x ( 38147>>36 ubelong 0x5769326B \bW2k 38148>>36 ubelong 0x4D616320 \bMac 38149>>36 default x \b0x 38150>>>36 ubelong x \b%8.8x 38151# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch 38152>24 bedate+946684800 x \b) %s 38153# Original Size 38154#>40 ubequad x \b, o.-Size %#llx 38155# Current Size is same as original size, but change when disk is expanded 38156#>48 ubequad x \b, Size %#llx 38157>48 ubequad x \b, %llu bytes 38158# Disk Geometry: cylinder, heads, and sectors/track for hard disk 38159#>56 ubeshort x \b, Cylinder %#x 38160>56 ubeshort x \b, CHS %u 38161# Heads 38162#>58 ubyte x \b, Heads %#x 38163>58 ubyte x \b/%u 38164# Sectors per track 38165#>59 ubyte x \b, Sectors %#x 38166>59 ubyte x \b/%u 38167# Disk Type: 3~Dynamic hard disk 38168>60 ubelong !0x3 \b, type %#x 38169# Checksum 38170#>64 ubelong x \b, cksum %#x 38171# universally unique identifier (UUID) to associate a parent with its differencing image 38172#>68 ubequad x \b, id %#16.16llx 38173#>76 ubequad x \b-%16.16llx 38174# Saved State: 1~Saved State 38175>84 ubyte !0 \b, State %#x 38176# Reserved 427 bytes with nils 38177#>85 ubequad !0 \b, Reserved %#16.16llx 38178 38179# From: Joerg Jenderek 38180# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx 38181# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ 38182# MS-VHDX/[MS-VHDX].pdf 38183# Note: extends the VHD format with new capabilities, such as a 16TB maximum size 38184# TODO: find and display values like virtual size, disk size, cluster_size, etc 38185# display id in GUID format 38186# 38187# VHDX_FILE_IDENTIFIER signature 0x656C696678646876 381880 string vhdxfile 38189# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB 38190>0x10000 string head Microsoft Disk Image eXtended 38191#>0x20000 string head \b, 2nd header 38192#!:mime application/x-virtualbox-vhdx 38193!:ext vhdx 38194# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" 38195>>8 lestring16 x \b, by %.256s 38196# The Checksum field is a CRC-32C hash over the entire 4 KB structure 38197#>>0x10004 ulelong x \b, CRC %#x 38198# SequenceNumber 38199>>0x10008 ulequad x \b, sequence %#llx 38200# FileWriteGuid 38201#>>0x10010 ubequad x \b, file id %#llx 38202#>>>0x10018 ubequad x \b-%llx 38203# DataWriteGuid 38204#>>0x10020 ubequad x \b, data id %#llx 38205#>>>0x10028 ubequad x \b-%llx 38206# LogGuid. If this field is zero, then the log is empty or has no valid entries 38207>>0x10030 ubequad >0 \b, log id %#llx 38208>>>0x10038 ubequad x \b-%llx 38209# LogVersion. If not 0 there is a log to replay 38210>>0x10040 uleshort >0 \b, LogVersion %#x 38211# Version. This field must be set to 1 38212>>0x10042 uleshort !1 \b, Version %#x 38213# LogLength must be multiples of 1 MB 38214>>0x10044 ulelong/1048576 >1 \b, LogLength %u MB 38215# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB 38216>>0x10048 ulequad !0x100000 \b, LogOffset %#llx 38217# Log Entry Signature must be 0x65676F6C~loge 38218>>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature 38219>>(0x10048.q) ulelong =0x65676F6C \b; LOG 38220# Log Entry Checksum 38221#>>>(0x10048.q+4) ulelong x \b, Log CRC %#x 38222# Log Entry Length must be a multiple of 4 KB 38223>>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB 38224# Log Entry Tail must be a multiple of 4 KB 38225#>>>(0x10048.q+12) ulelong x \b, Tail %#x 38226# Log Entry SequenceNumber 38227#>>>(0x10048.q+16) ulequad x \b, # %#llx 38228# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 38229#>>>(0x10048.q+24) ulelong x \b, DescriptorCount %#llx 38230# Log Entry Reserved must be set to 0 38231>>>(0x10048.q+28) ulelong !0 \b, Reserved %#x 38232# Log Entry LogGuid 38233#>>>(0x10048.q+32) ubequad x \b, Log id %#llx 38234#>>>(0x10048.q+40) ubequad x \b-%llx 38235# Log Entry FlushedFileOffset should VHDX size when entry is written. 38236#>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu 38237# Log Entry LastFileOffset 38238#>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu 38239# filling 38240#>>>(0x10048.q+64) ulequad >0 \b, filling %llx 38241# Reserved[4016] 38242#>>0x10050 ulequad >0 \b, Reserved %#llx 38243# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB 38244>0x30000 ulelong !0x69676572 \b, 1st region INVALID 38245>0x30000 ulelong =0x69676572 \b; region 38246# region Checksum. CRC-32C hash over the entire 64-KB table 38247#>>0x30004 ulelong x \b, CRC %#x 38248# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. 38249>>0x30008 ulelong x \b, %u entries 38250# reserved must be zero 38251#>>0x3000C ulelong !0 \b, RESERVED %#x 38252# Region Table Entry starts with identifier for the object. often BAT id 38253>>0x30010 use vhdx-id 38254# FileOffset 38255>>0x30020 ulequad x \b, at %#llx 38256# Length. Specifies the length of the object within the file 38257#>>0x30028 ulelong x \b, Length %#x 38258# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 38259>>0x3002C ulelong x \b, Required %u 38260# 2nd region entry often metadata id 38261>>0x30030 use vhdx-id 38262# 2nd entry FileOffset 38263>>0x30040 ulequad x \b, at %#llx 38264# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 38265>>0x3004C ulelong x \b, Required %u 38266# 2nd region 38267>>0x40000 ulelong !0x69676572 \b, 2nd region INVALID 38268# check in vhdx images for known id and show names instead hexadecimal 382690 name vhdx-id 38270# https://www.windowstricks.in/online-windows-guid-converter 38271# 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID 38272# 6677C22D23F600429D64115E9BFD4A08 BAT ID 38273>0 ubequad =0x6677C22D23F60042 38274>>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT 38275# no BAT id 38276>>8 default x 38277>>>0 use vhdx-id-hex 38278# 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID 38279# 06A27C8B90479A4BB8FE575F050F886E Metadata region ID 38280>0 ubequad =0x06A27C8B90479A4B 38281>>8 ubequad =0xB8FE575F050F886E \b, id Metadata 38282# no Metadata id 38283>>8 default x 38284>>>0 use vhdx-id-hex 38285# 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID 38286# 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID 38287# value "virtual size" can be verified by command `qemu-img info ` 38288>0 ubequad =0x2442A52F1BCD7648 38289>>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize 38290# no Virtual Disk Size ID 38291>>8 default x 38292>>>0 use vhdx-id-hex 38293# other ids 38294>0 default x 38295>>0 use vhdx-id-hex 38296# in vhdx images show id as hexadecimal 382970 name vhdx-id-hex 38298>0 ubequad x \b, ID %#16.16llx 38299>8 ubequad x \b-%16.16llx 38300# 38301# libvirt 38302# From: Philipp Hahn <hahn@univention.de> 383030 string LibvirtQemudSave Libvirt QEMU Suspend Image 38304>0x10 lelong x \b, version %u 38305>0x14 lelong x \b, XML length %u 38306>0x18 lelong 1 \b, running 38307>0x1c lelong 1 \b, compressed 38308 383090 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 38310# From: Alex Beregszaszi <alex@fsn.hu> 383110 string/b COWD VMWare3 38312>4 byte 3 disk image 38313>>32 lelong x (%d/ 38314>>36 lelong x \b%d/ 38315>>40 lelong x \b%d) 38316>4 byte 2 undoable disk image 38317>>32 string >\0 (%s) 38318 383190 string/b VMDK VMware4 disk image 383200 string/b KDMV VMware4 disk image 38321 38322#-------------------------------------------------------------------- 38323# Qemu Emulator Images 38324# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 38325# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 38326# Made by reading sources, reading documentation, and doing trial and error 38327# on existing QCOW files 383280 string/b QFI\xFB QEMU QCOW Image 38329!:mime application/x-qemu-disk 38330 38331# Uncomment the following line to display Magic (only used for debugging 38332# this magic number) 38333#>0 string/b x , Magic: %s 38334 38335# There are currently 2 Versions: "1" and "2". 38336# https://www.gnome.org/~markmc/qcow-image-format-version-1.html 38337>4 belong x (v%d) 38338 38339# Using the existence of the Backing File Offset to determine whether 38340# to read Backing File Information 38341>>12 belong >0 \b, has backing file ( 38342# Note that this isn't a null-terminated string; the length is actually 38343# (16.L). Assuming a null-terminated string happens to work usually, but it 38344# may spew junk until it reaches a \0 in some cases. 38345>>>(12.L) string >\0 \bpath %s 38346 38347# Modification time of the Backing File 38348# Really useful if you want to know if your backing 38349# file is still usable together with this image 38350>>>>20 bedate >0 \b, mtime %s) 38351>>>>20 default x \b) 38352 38353# Size is stored in bytes in a big-endian u64. 38354>>24 bequad x \b, %lld bytes 38355 38356# 1 for AES encryption, 0 for none. 38357>>36 belong 1 \b, AES-encrypted 38358 38359# https://www.gnome.org/~markmc/qcow-image-format.html 38360>4 belong 2 (v2) 38361# Using the existence of the Backing File Offset to determine whether 38362# to read Backing File Information 38363>>8 bequad >0 \b, has backing file 38364# Note that this isn't a null-terminated string; the length is actually 38365# (16.L). Assuming a null-terminated string happens to work usually, but it 38366# may spew junk until it reaches a \0 in some cases. Also, since there's no 38367# .Q modifier, we just use the bottom four bytes as an offset. Note that if 38368# the file is over 4G, and the backing file path is stored after the first 4G, 38369# the wrong filename will be printed. (This should be (8.Q), when that syntax 38370# is introduced.) 38371>>>(12.L) string >\0 (path %s) 38372>>24 bequad x \b, %lld bytes 38373>>32 belong 1 \b, AES-encrypted 38374 38375>4 belong 3 (v3) 38376# Using the existence of the Backing File Offset to determine whether 38377# to read Backing File Information 38378>>8 bequad >0 \b, has backing file 38379# Note that this isn't a null-terminated string; the length is actually 38380# (16.L). Assuming a null-terminated string happens to work usually, but it 38381# may spew junk until it reaches a \0 in some cases. Also, since there's no 38382# .Q modifier, we just use the bottom four bytes as an offset. Note that if 38383# the file is over 4G, and the backing file path is stored after the first 4G, 38384# the wrong filename will be printed. (This should be (8.Q), when that syntax 38385# is introduced.) 38386>>>(12.L) string >\0 (path %s) 38387>>24 bequad x \b, %lld bytes 38388>>32 belong 1 \b, AES-encrypted 38389 38390>4 default x (unknown version) 38391 383920 string/b QEVM QEMU suspend to disk image 38393 38394# QEMU QED Image 38395# https://wiki.qemu.org/Features/QED/Specification 383960 string/b QED\0 QEMU QED Image 38397 38398# VDI Image 38399# Sun xVM VirtualBox Disk Image 38400# From: Richard W.M. Jones <rich@annexia.org> 38401# VirtualBox Disk Image 384020x40 ulelong 0xbeda107f VirtualBox Disk Image 38403>0x44 uleshort >0 \b, major %u 38404>0x46 uleshort >0 \b, minor %u 38405>0 string >\0 (%s) 38406>368 lequad x \b, %lld bytes 38407 384080 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 38409>32 string x type %s, 38410>48 string x subtype %s 38411 384120 lelong 0x02468ace Bochs Sparse disk image 38413 38414 38415#------------------------------------------------------------------------------ 38416# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 38417# Virtutech Compressed Random Access File Format 38418# 38419# From <gustav@virtutech.com> 384200 string \211\277\036\203 Virtutech CRAFF 38421>4 belong x v%d 38422>20 belong 0 uncompressed 38423>20 belong 1 bzipp2ed 38424>20 belong 2 gzipped 38425>24 belong 0 not clean 38426 38427#------------------------------------------------------------------------------ 38428# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 38429# visx: file(1) magic for Visx format files 38430# 384310 short 0x5555 VISX image file 38432>2 byte 0 (zero) 38433>2 byte 1 (unsigned char) 38434>2 byte 2 (short integer) 38435>2 byte 3 (float 32) 38436>2 byte 4 (float 64) 38437>2 byte 5 (signed char) 38438>2 byte 6 (bit-plane) 38439>2 byte 7 (classes) 38440>2 byte 8 (statistics) 38441>2 byte 10 (ascii text) 38442>2 byte 15 (image segments) 38443>2 byte 100 (image set) 38444>2 byte 101 (unsigned char vector) 38445>2 byte 102 (short integer vector) 38446>2 byte 103 (float 32 vector) 38447>2 byte 104 (float 64 vector) 38448>2 byte 105 (signed char vector) 38449>2 byte 106 (bit plane vector) 38450>2 byte 121 (feature vector) 38451>2 byte 122 (feature vector library) 38452>2 byte 124 (chain code) 38453>2 byte 126 (bit vector) 38454>2 byte 130 (graph) 38455>2 byte 131 (adjacency graph) 38456>2 byte 132 (adjacency graph library) 38457>2 string .VISIX (ascii text) 38458 38459#------------------------------------------------------------------------------ 38460# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $ 38461# vms: file(1) magic for VMS executables (experimental) 38462# 38463# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 38464 38465# GRR 950122: I'm just guessing on these, based on inspection of the headers 38466# of three executables each for Alpha and VAX architectures. The VAX files 38467# all had headers similar to this: 38468# 38469# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 38470# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 38471# 384720 string \xb0\0\x30\0 VMS VAX executable 38473>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 38474# 38475# The AXP files all looked like this, except that the byte at offset 0x22 38476# was 06 in some of them and 07 in others: 38477# 38478# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 38479# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 38480# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 38481# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 38482# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 38483# 38484# GRR this test is still too general as it catches example adressen.dbt 384850 belong 0x03000000 38486>8 ubelong 0xec020000 VMS Alpha executable 38487>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 38488 38489#------------------------------------------------------------------------------ 38490# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $ 38491# VMware specific files (deducted from version 1.1 and log file entries) 38492# Anthon van der Neut (anthon@mnt.org) 384930 belong 0x4d52564e VMware nvram 38494 38495#------------------------------------------------------------------------------ 38496# $File: vorbis,v 1.26 2020/08/22 18:30:55 christos Exp $ 38497# vorbis: file(1) magic for Ogg/Vorbis files 38498# 38499# From Felix von Leitner <leitner@fefe.de> 38500# Extended by Beni Cherniavsky <cben@crosswinds.net> 38501# Further extended by Greg Wooledge <greg@wooledge.org> 38502# 38503# Most (everything but the number of channels and bitrate) is commented 38504# out with `##' as it's not interesting to the average user. The most 38505# probable things advanced users would want to uncomment are probably 38506# the number of comments and the encoder version. 38507# 38508# FIXME: The first match has been made a search, so that it can skip 38509# over prepended ID3 tags. This will work for MIME type detection, but 38510# won't work for detecting other properties of the file (they all need 38511# to be made relative to the search). In any case, if the file has ID3 38512# tags, the ID3 information will be printed, not the Ogg information, 38513# so until that's fixed, this doesn't matter. 38514# FIXME[2]: Disable the above for now, since search assumes text mode. 38515# 38516# --- Ogg Framing --- 38517#0 search/1000 OggS Ogg data 385180 string OggS Ogg data 38519>4 byte !0 UNKNOWN REVISION %u 38520##>4 byte 0 revision 0 38521>4 byte 0 38522##>>14 lelong x (Serial %lX) 38523# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 38524>>28 string \x7fFLAC \b, FLAC audio 38525# non-Vorbis content: Theora 38526!:mime audio/ogg 38527>>28 string \x80theora \b, Theora video 38528!:mime video/ogg 38529# non-Vorbis content: Kate 38530>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 38531!:mime application/ogg 38532>>>37 ubyte x v%u 38533>>>38 ubyte x \b.%u, 38534>>>40 byte 0 utf8 encoding, 38535>>>40 byte !0 unknown character encoding, 38536>>>60 string >\0 language %s, 38537>>>60 string \0 no language set, 38538>>>76 string >\0 category %s 38539>>>76 string \0 no category set 38540# non-Vorbis content: Skeleton 38541>>28 string fishead\0 \b, Skeleton 38542!:mime video/ogg 38543>>>36 leshort x v%u 38544>>>40 leshort x \b.%u 38545# non-Vorbis content: Speex 38546>>28 string Speex\ \ \ \b, Speex audio 38547!:mime audio/ogg 38548# non-Vorbis content: OGM 38549>>28 string \x01video\0\0\0 \b, OGM video 38550!:mime video/ogg 38551>>>37 string/c div3 (DivX 3) 38552>>>37 string/c divx (DivX 4) 38553>>>37 string/c dx50 (DivX 5) 38554>>>37 string/c xvid (XviD) 38555# --- First vorbis packet - general header --- 38556>>28 string \x01vorbis \b, Vorbis audio, 38557!:mime audio/ogg 38558>>>35 lelong !0 UNKNOWN VERSION %u, 38559##>>>35 lelong 0 version 0, 38560>>>35 lelong 0 38561>>>>39 ubyte 1 mono, 38562>>>>39 ubyte 2 stereo, 38563>>>>39 ubyte >2 %u channels, 38564>>>>40 lelong x %u Hz 38565# Minimal, nominal and maximal bitrates specified when encoding 38566>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 38567# The above tests if at least one of these is specified: 38568>>>>>52 lelong !-1 38569# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 38570# instead of -1. 38571# Vorbis 1.0 uses 0 instead of -1. 38572>>>>>>52 lelong !0 38573>>>>>>>52 lelong !-1000 38574>>>>>>>>52 lelong x <%u 38575>>>>>48 lelong !-1 38576>>>>>>48 lelong x ~%u 38577>>>>>44 lelong !-1 38578>>>>>>44 lelong !-1000 38579>>>>>>>44 lelong !0 38580>>>>>>>>44 lelong x >%u 38581>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 38582# -- Second vorbis header packet - the comments 38583# A kludge to read the vendor string. It's a counted string, not a 38584# zero-terminated one, so file(1) can't read it in a generic way. 38585# libVorbis is the only one existing currently, so I detect specifically 38586# it. The interesting value is the cvs date (8 digits decimal). 38587# Post-RC1 Ogg files have the second header packet (and thus the version) 38588# in a different place, so we must use an indirect offset. 38589>>>(84.b+85) string \x03vorbis 38590>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 38591>>>>>(84.b+120) string >00000000 38592# Map to beta version numbers: 38593>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 38594>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 38595>>>>>>(84.b+120) string >20000508 38596>>>>>>>(84.b+120) string <20001031 (beta2-3) 38597>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 38598>>>>>>(84.b+120) string >20001031 38599>>>>>>>(84.b+120) string <20010225 (beta3-4) 38600>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 38601>>>>>>(84.b+120) string >20010225 38602>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 38603>>>>>>(84.b+120) string 20010615 (1.0 RC1) 38604>>>>>>(84.b+120) string 20010813 (1.0 RC2) 38605>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 38606>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 38607>>>>>>(84.b+120) string 20011217 (1.0 RC3) 38608>>>>>>(84.b+120) string 20011231 (1.0 RC3) 38609# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 38610>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 38611# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 38612>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 38613>>>>>(84.b+117) string >00000000 38614>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 38615>>>>>>(84.b+117) string 20020717 (1.0) 38616>>>>>>(84.b+117) string 20030909 (1.0.1) 38617>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 38618>>>>>>(84.b+117) string 20050304 (1.1.2) 38619>>>>>>(84.b+117) string 20070622 (1.2.0) 38620>>>>>>(84.b+117) string 20090624 (1.2.2) 38621>>>>>>(84.b+117) string 20090709 (1.2.3) 38622>>>>>>(84.b+117) string 20100325 (1.3.1) 38623>>>>>>(84.b+117) string 20101101 (1.3.2) 38624>>>>>>(84.b+117) string 20120203 (1.3.3) 38625>>>>>>(84.b+117) string 20140122 (1.3.4) 38626>>>>>>(84.b+117) string 20150105 (1.3.5) 38627 38628# non-Vorbis content: Opus https://tools.ietf.org/html/rfc7845#section-5 38629>>28 string OpusHead \b, Opus audio, 38630!:mime audio/ogg 38631>>>36 ubyte >0x0F UNKNOWN VERSION %u, 38632>>>36 ubyte&0x0F !0 version 0.%u, 38633>>>>46 ubyte >1 38634>>>>>46 ubyte !255 unknown channel mapping family %u, 38635>>>>>37 ubyte x %u channels 38636>>>>46 ubyte 0 38637>>>>>37 ubyte 1 mono 38638>>>>>37 ubyte 2 stereo 38639>>>>46 ubyte 1 38640>>>>>37 ubyte 1 mono 38641>>>>>37 ubyte 2 stereo 38642>>>>>37 ubyte 3 linear surround 38643>>>>>37 ubyte 4 quadraphonic 38644>>>>>37 ubyte 5 5.0 surround 38645>>>>>37 ubyte 6 5.1 surround 38646>>>>>37 ubyte 7 6.1 surround 38647>>>>>37 ubyte 8 7.1 surround 38648>>>>40 lelong !0 \b, %u Hz (Input Sample Rate) 38649#------------------------------------------------------------------------------ 38650# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 38651# VXL: file(1) magic for VXL binary IO data files 38652# 38653# from Ian Scott <scottim@sf.net> 38654# 38655# VXL is a collection of C++ libraries for Computer Vision. 38656# See the vsl chapter in the VXL Book for more info 38657# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 38658# http:/vxl.sf.net 38659 386602 lelong 0x472b2c4e VXL data file, 38661>0 leshort >0 schema version no %d 38662 38663#------------------------------------------------------------------------------ 38664# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $ 38665# warc: file(1) magic for WARC files 38666 386670 string WARC/ WARC Archive 38668>5 string x version %.4s 38669!:mime application/warc 38670 38671#------------------------------------------------------------------------------ 38672# Arc File Format from Internet Archive 38673# see https://www.archive.org/web/researcher/ArcFileFormat.php 386740 string filedesc:// Internet Archive File 38675!:mime application/x-ia-arc 38676>11 search/256 \x0A \b 38677>>&0 ubyte >0 \b version %c 38678 38679#------------------------------------------------------------------------------ 38680# weak: file(1) magic for very weak magic entries, disabled by default 38681# 38682# These entries are so weak that they might interfere identification of 38683# other formats. Example include: 38684# - Only identify for 1 or 2 bytes 38685# - Match against very wide range of values 38686# - Match against generic word in some spoken languages (e.g. English) 38687 38688# Summary: Computer Graphics Metafile 38689# Extension: .cgm 38690#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 38691#0 beshort 0x3020 character Computer Graphics Metafile 38692 38693#0 string =!! Bennet Yee's "face" format 38694 38695#------------------------------------------------------------------------------ 38696# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $ 38697 38698# http://www.rdfhdt.org/ 38699# From Christoph Biedl 38700# http://www.rdfhdt.org/hdt-internals/ 38701# https://github.com/rdfhdt/hdt-cpp 38702 387030 string $HDT\x01 HDT file (binary compressed indexed RDF triples) type 1 38704!:mime application/vnd.hdt 38705!:ext hdt 38706#------------------------------------------------------------------------------ 38707# $File: webassembly,v 1.4 2022/08/16 11:16:39 christos Exp $ 38708# webassembly: file(1) magic for WebAssembly modules 38709# 38710# WebAssembly is a virtual architecture developed by a W3C Community 38711# Group at https://webassembly.org/. The file extension is .wasm, and 38712# the MIME type is application/wasm. 38713# 38714# https://webassembly.org/docs/binary-encoding/ is the main 38715# document describing the binary format. 38716# From: Pip Cet <pipcet@gmail.com> and Joel Martin 38717 387180 string \0asm WebAssembly (wasm) binary module 38719>4 lelong =1 version %#x (MVP) 38720!:mime application/wasm 38721!:ext wasm 38722>4 lelong >1 version %#x 38723 38724#------------------------------------------------------------------------------ 38725# $File: windows,v 1.46 2022/07/02 17:46:09 christos Exp $ 38726# windows: file(1) magic for Microsoft Windows 38727# 38728# This file is mainly reserved for files where programs 38729# using them are run almost always on MS Windows 3.x or 38730# above, or files only used exclusively in Windows OS, 38731# where there is no better category to allocate for. 38732# For example, even though WinZIP almost run on Windows 38733# only, it is better to treat them as "archive" instead. 38734# For format usable in DOS, such as generic executable 38735# format, please specify under "msdos" file. 38736# 38737 38738 38739# Summary: Outlook Express DBX file 38740# Created by: Christophe Monniez 38741# Update: Joerg Jenderek 38742# URL: http://fileformats.archiveteam.org/wiki/Outlook_Express_Database 38743# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbx.trid.xml 38744# https://sourceforge.net/projects/ol2mbox/files/LibDBX/ 38745# v1.0.4/libdbx_1.0.4.tar.gz/FILE-FORMAT 38746# Note: called "Outlook Express Database" by TrID and DROID via PUID fmt/838 fmt/839 38747# and partly verified by `undbx --verbosity 4 Posteingang.dbx` 387480 string \xCF\xAD\x12\xFE 38749# skip DROID fmt-838-signature-id-1193.dbx fmt-839-signature-id-1194.dbx by check for valid file size 38750>0x7C ulelong >0 MS Outlook Express DBX file 38751#!:mime application/octet-stream 38752#!:mime application/vnd.ms-outlook 38753!:mime application/x-ms-dbx 38754!:ext dbx 38755>>4 byte =0xC5 \b, message database 38756>>4 byte =0xC6 \b, folder database 38757>>4 byte =0xC7 \b, account information 38758>>4 byte =0x30 \b, offline database 38759# version like: 5.2 5.5 (typical) 38760>>20 ulequad !0x0000000500000005 \b, version 38761# major version 38762>>>24 ulelong x %u 38763# minor version 38764>>>20 ulelong x \b.%u 38765# CLSID: 6F74FDC5-E366-11d1-9A4E-00C04FA309D4~Message 6F74FDC6-E366-11D1-9A4E-00C04FA309D4~Folder 38766# 26FE9D30-1A8F-11D2-AABF-006097D474C4~offline 38767#>>4 guid x \b, CLSID %s 38768# file size; total size of file; sometimes real size a little bit higher 38769>>0x7C ulelong x \b, ~ %u bytes 38770# highest Email ID; the next email will have a number one higher than this 38771>>0x5c ulelong x \b, highest ID %#x 38772# item count; number of items stored in this DBX file 38773>>0xC4 ulelong x \b, %u item 38774# plural s 38775>>0xC4 ulelong !1 \bs 38776# index pointer; file offset pointing to a page of Data Indexes 38777>>0xE4 ulelong >0 \b, index pointer %#x 38778 38779# From: Joerg Jenderek 38780# URL: http://fileformats.archiveteam.org/wiki/Nickfile 38781# https://www.nirsoft.net/utils/outlook_nk2_edit.html 38782# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nk2.trid.xml 38783# https://github.com/libyal/libnk2/blob/main/documentation 38784# Nickfile%20(NK2)%20format.asciidoc 38785# Note: called "Outlook Nickfile" by TrID & TestDisk and 38786# "Outlook Nickname File" by Microsoft Outlook and 38787# "Outlook AutoComplete File" by Nirsoft NK2Edit 38788# partly verfied by NK2Edit Raw Text Edit Mode 387890 ubelong 0x0DF0ADBA MS Outlook Nickfile 38790#!:mime application/octet-stream 38791#!:mime application/vnd.ms-outlook 38792!:mime application/x-ms-nickfile 38793!:ext nk2/dat/bak 38794# nick is used by "older" Outlook; dat is used by "newer" Outlook (probably 2010 - 2016); bak is used for backup 38795#!:ext nick/nk2/dat/bak 38796# Unknown; probably a version indicator like: 0000000Ah 0000000Ch 38797>4 ulelong x \b, probably version %u 38798# Unknown2; probably a version indicator like: 1 0 38799>8 ulelong x \b.%u 38800# number of rows (nickname or alias items) in file 38801>12 ulelong x \b, %u items 38802# number of item entries/columns/properties value like: 17h 38803>16 ulelong x \b, %u entries 38804# value type/property tag: 001Fh~4 bytes for data size of UTF-16 LE string 38805>20 uleshort x \b, value type %#4.4x 38806# entry type/property identifier: 6001h~PR_DOTSTUFF_STATE/PR_NICK_NAME_W 38807>22 uleshort x \b, entry type %#4.4x 38808# Reserved like: 0013FD90h 38809#>24 ulelong x \b, reserved %#8.8x 38810# value data array/Irrelevant Union like: 0000000004E31A80h 38811#>28 ulequad x \b, data %#16.16llx 38812# UTF-16 38813>20 uleshort =0x001F 38814# unicode string bytes like: 2Ch 38815>>36 ulelong x \b, %u bytes 38816# unicode string value PT_UNICODE like: janesmith@contoso.org 38817>>40 lestring16 x "%s" 38818 38819# Summary: Windows crash dump 38820# Extension: .dmp 38821# Created by: Andreas Schuster (https://computer.forensikblog.de/) 38822# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html 38823# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 388240 string PAGE 38825>4 string DUMP MS Windows 32bit crash dump 38826>>0x05c byte 0 \b, no PAE 38827>>0x05c byte 1 \b, PAE 38828>>0xf88 lelong 1 \b, full dump 38829>>0xf88 lelong 2 \b, kernel dump 38830>>0xf88 lelong 3 \b, small dump 38831>>0x068 lelong x \b, %d pages 38832>4 string DU64 MS Windows 64bit crash dump 38833>>0xf98 lelong 1 \b, full dump 38834>>0xf98 lelong 2 \b, kernel dump 38835>>0xf98 lelong 3 \b, small dump 38836>>0x090 lequad x \b, %lld pages 38837 38838 38839# Summary: Vista Event Log 38840# Extension: .evtx 38841# Created by: Andreas Schuster (https://computer.forensikblog.de/) 38842# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html 388430 string ElfFile\0 MS Windows Vista Event Log 38844>0x2a leshort x \b, %d chunks 38845>>0x10 lelong x \b (no. %d in use) 38846>0x18 lelong >1 \b, next record no. %d 38847>0x18 lelong =1 \b, empty 38848>0x78 lelong &1 \b, DIRTY 38849>0x78 lelong &2 \b, FULL 38850 38851# Summary: Windows System Deployment Image 38852# Created by: Joerg Jenderek 38853# URL: http://en.wikipedia.org/wiki/System_Deployment_Image 38854# Reference: http://skolk.livejournal.com/1320.html 388550 string $SDI 38856>4 string 0001 System Deployment Image 38857!:mime application/x-ms-sdi 38858#!:mime application/octet-stream 38859# \Boot\boot.sdi 38860!:ext sdi 38861# MDBtype: 0~Unspecified 1~RAM 2~ROM 38862>>8 ulequad !0 \b, MDBtype %#llx 38863# BootCodeOffset 38864>>16 ulequad !0 \b, BootCodeOffset %#llx 38865# BootCodeSize 38866>>24 ulequad !0 \b, BootCodeSize %#llx 38867# VendorID 38868>>32 ulequad !0 \b, VendorID %#llx 38869# DeviceID 38870>>40 ulequad !0 \b, DeviceID %#llx 38871# DeviceModel 38872>>48 ulequad !0 \b, DeviceModel %#llx 38873>>>56 ulequad !0 \b%llx 38874# DeviceRole 38875>>64 ulequad !0 \b, DeviceRole %#llx 38876# Reserved1; reserved fields and gaps between BLOBs are padded with \0 38877#>>72 ulequad !0 \b, Reserved1 %#llx 38878# RuntimeGUID 38879>>80 ulequad !0 \b, RuntimeGUID %#llx 38880>>>88 ulequad !0 \b%llx 38881# RuntimeOEMrev 38882>>96 ulequad !0 \b, RuntimeOEMrev %#llx 38883# Reserved2 38884#>>104 ulequad !0 \b, Reserved2 %#llx 38885# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 38886>>112 ulequad !0 \b, PageAlignment %llu 38887# Reserved3[48] 38888#>>120 ulequad !0 \b, Reserved3 %#llx 38889# SDI checksum 39h 38890>>0x1f8 ulequad x \b, checksum %#llx 38891# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 38892>>0x400 string >\0 \b, type %-3.8s 38893# 0~non-filesystem 7~NTFS 6~BIGFAT 38894>>>0x420 ulequad !0 (%#llx) 38895# ATTRibutes 38896>>>0x408 ulequad !0 %#llx attributes 38897# Offset 38898>>>0x410 ulequad x at %#llx 38899# print 1 space after size and then handles NTFS boot sector by ./filesystems 38900>>>0x418 ulequad >0 %llu bytes 38901>>>>(0x410.l) indirect x 38902# 2nd BLOB: WIM 38903>>0x440 string >\0 \b, type %-3.8s 38904>>>0x428 ulequad !0 (%#llx) 38905# ATTRibutes 38906>>>0x448 ulequad !0 %#llx attributes 38907# Offset 38908>>>0x450 ulequad x at %#llx 38909>>>0x458 ulequad >0 %llu bytes 38910>>>>(0x450.l) indirect x 38911# 3rd BLOB 38912>>0x480 string >\0 \b, type %-3.8s 38913 38914# Summary: Windows boot status log BOOTSTAT.DAT 38915# From: Joerg Jenderek 38916# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm 38917# Note: mainly refers to older Windows Vista, sometimes 38918# BOOTSTAT.DAT only contains nulls or invalid data 38919# checking for valid version below 5 389200 ulelong <5 38921# skip many ISO images by checking for valid 64 KiB file size 38922>8 ulelong =0x00010000 38923>>0 use bootstat-dat 38924# display information of BOOTSTAT.DAT 389250 name bootstat-dat 38926>0 ulelong x Windows boot log 38927#!:mime application/octet-stream 38928!:mime application/x-ms-dat 38929# BOOTSTAT.DAT in BOOT subdirectory 38930!:ext dat 38931# apparently a version number: 2 for older like Vista, 3, 4 Windows 10 38932>0 ulelong >2 \b, version %u 38933# apparently the size of the header: often 10h in older Windows, 14h, 18h 38934>4 ulelong !0x10 \b, header size %#x 38935#>4 ulelong !0x10 \b, header size %u 38936# apparently the size of the file: always 0x00010000~64KiB 38937# the file is acceptable to BOOTMGR only if it is exactly 64 KiB 38938>8 ulelong !0x00010000 \b, file size %#x 38939# size of valid data, in bytes: C8h 50h 172h 5D5Ch 38940>0xc ulelong x \b, %#x valid bytes 38941# skip header and jump to first bootstat entry and display information 38942>(0x4.l-1) ubyte x 38943>>&0 use bootstat-entry 38944# jump to first entry again because pointer are bad after "use" 38945>(0x4.l-1) ubyte x 38946# by 1st entry size jump to 2nd entry and display information 38947>>&(&0x18.l-1) ubyte x 38948>>>&0 use bootstat-entry 38949# jump to possible 3rd boot entry and display information 38950# >(0x4.l-1) ubyte x 38951# >>&(&0x18.l-1) ubyte x 38952# >>>&(&0x18.l-1) ubyte x 38953# >>>>&0 use bootstat-entry 38954# display BOOTSTAT.DAT entry 389550 name bootstat-entry 38956#>0x00 ubequad x \b, ENTRY %16.16llx 38957# size of entry, in bytes: 40h(init) 78h(launced) 9Ch 38958#>0x18 ulelong x \b; entry size %u 38959>0x18 ulelong x \b; entry size %#x 38960# time stamp, in seconds 38961>0x00 ulelong x \b, %#x seconds 38962# always zero, significance unknown 38963>0x04 ulelong !0 \b, not null %u 38964# GUID of event source; but empty if event source is BOOTMGR 38965>0x08 ubequad !0 \b, GUID %#16.16llx 38966>>0x10 ubequad x \b%16.16llx 38967# severity code: 1~informational 3~errors 38968>0x1C ulelong !1 \b, severity %#x 38969# apparently a version number: 2 38970>0x20 ulelong !2 \b, version %u 38971# event identifier 1~log file initialised 11h~boot application launched 38972#>0x24 ulelong x \b, event %#x 38973>0x24 ulelong !1 38974>>0x24 ulelong !0x11 \b, event %#x 38975# entry data; size depends on event identifier 38976#>0x28 ubequad x \b, data %#16.16llx 38977>0x24 ulelong =0x1 \b, Init 38978# always 0, significance unknown 38979>>0x34 uleshort !0 \b, not null %u 38980# always 7, significance unknown 38981>>0x36 uleshort !7 \b, not seven %u 38982# year 38983>>0x28 uleshort x %u 38984# month 38985>>0x2A uleshort x \b-%u 38986# day 38987>>0x2C uleshort x \b-%u 38988# hour 38989>>0x2E uleshort x %u 38990# minute 38991>>0x30 uleshort x \b:%u 38992# second 38993>>0x32 uleshort x \b:%u 38994# boot application launched 38995>0x24 ulelong =0x11 \b, launched 38996# type of start: 0 normally, 1 or 2 maybe in a recovery sequence 38997>>0x38 uleshort !0 \b, type %u 38998# pathname of boot application, as null-terminated Unicode string; typically 38999# \Windows\system32\winload.exe \Windows\system32\winload.efi 39000>>0x3C lestring16 x %s 39001 39002# Summary: Windows Error Report text files 39003# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 39004# Reference: https://www.nirsoft.net/utils/app_crash_view.html 39005# Created by: Joerg Jenderek 39006# Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 39007# %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 390080 lestring16 Version= 39009>22 lestring16 EventType Windows Error Report 39010!:mime text/plain 39011# Report.wer 39012!:ext wer 39013 39014# Summary: Windows 3.1 group files 39015# Extension: .grp 39016# Created by: unknown 390170 string \120\115\103\103 MS Windows 3.1 group files 39018 39019 39020# Summary: Old format help files 39021# URL: https://en.wikipedia.org/wiki/WinHelp 39022# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 39023# Update: Joerg Jenderek 39024# Created by: Dirk Jagdmann <doj@cubic.org> 39025# 39026# check and then display version and date inside MS Windows HeLP file fragment 390270 name help-ver-date 39028# look for Magic of SYSTEMHEADER 39029>0 leshort 0x036C 39030# version Major 1 for right file fragment 39031>>4 leshort 1 Windows 39032# print non empty string above to avoid error message 39033# Warning: Current entry does not yet have a description for adding a MIME type 39034!:mime application/winhelp 39035!:ext hlp 39036# version Minor of help file format is hint for windows version 39037>>>2 leshort 0x0F 3.x 39038>>>2 leshort 0x15 3.0 39039>>>2 leshort 0x21 3.1 39040>>>2 leshort 0x27 x.y 39041>>>2 leshort 0x33 95 39042>>>2 default x y.z 39043>>>>2 leshort x %#x 39044# to complete message string like "MS Windows 3.x help file" 39045>>>2 leshort x help 39046# GenDate often older than file creation date 39047>>>6 ldate x \b, %s 39048# 39049# Magic for HeLP files 390500 lelong 0x00035f3f 39051# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 39052# file header magic 0x293B at DirectoryStart+9 39053>(4.l+9) uleshort 0x293B MS 39054# look for @VERSION bmf.. like IBMAVW.ANN 39055>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 39056!:mime application/x-winhelp 39057!:ext ann 39058>>0xD4 string !\x62\x6D\x66\x01\x00 39059# "GID Help index" by TrID 39060>>>(4.l+0x65) string =|Pete Windows help Global Index 39061!:mime application/x-winhelp 39062!:ext gid 39063# HeLP Bookmark or 39064# "Windows HELP File" by TrID 39065>>>(4.l+0x65) string !|Pete 39066# maybe there exist a cleaner way to detect HeLP fragments 39067# brute search for Magic 0x036C with matching Major maximal 7 iterations 39068# discapp.hlp 39069>>>>16 search/0x49AF/s \x6c\x03 39070>>>>>&0 use help-ver-date 39071>>>>>&4 leshort !1 39072# putty.hlp 39073>>>>>>&0 search/0x69AF/s \x6c\x03 39074>>>>>>>&0 use help-ver-date 39075>>>>>>>&4 leshort !1 39076>>>>>>>>&0 search/0x49AF/s \x6c\x03 39077>>>>>>>>>&0 use help-ver-date 39078>>>>>>>>>&4 leshort !1 39079>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 39080>>>>>>>>>>>&0 use help-ver-date 39081>>>>>>>>>>>&4 leshort !1 39082>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 39083>>>>>>>>>>>>>&0 use help-ver-date 39084>>>>>>>>>>>>>&4 leshort !1 39085>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 39086>>>>>>>>>>>>>>>&0 use help-ver-date 39087>>>>>>>>>>>>>>>&4 leshort !1 39088>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 39089# GCC.HLP is detected after 7 iterations 39090>>>>>>>>>>>>>>>>>&0 use help-ver-date 39091# this only happens if bigger hlp file is detected after used search iterations 39092>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 39093!:mime application/winhelp 39094!:ext hlp 39095# repeat search again or following default line does not work 39096>>>>16 search/0x49AF/s \x6c\x03 39097# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 39098>>>>16 default x Windows help Bookmark 39099!:mime application/x-winhelp 39100!:ext bmk 39101## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 39102##>>8 lelong x \b, FirstFreeBlock %#8.8x 39103# EntireFileSize 39104>>12 lelong x \b, %d bytes 39105## ReservedSpace normally 042Fh AFh for *.ANN 39106#>>(4.l) lelong x \b, ReservedSpace %#8.8x 39107## UsedSpace normally 0426h A6h for *.ANN 39108#>>(4.l+4) lelong x \b, UsedSpace %#8.8x 39109## FileFlags normally 04... 39110#>>(4.l+5) lelong x \b, FileFlags %#8.8x 39111## file header magic 0x293B 39112#>>(4.l+9) uleshort x \b, file header magic %#4.4x 39113## file header Flags 0x0402 39114#>>(4.l+11) uleshort x \b, file header Flags %#4.4x 39115## file header PageSize 0400h 80h for *.ANN 39116#>>(4.l+13) uleshort x \b, PageSize %#4.4x 39117## Structure[16] z4 39118#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 39119## MustBeZero 0 39120#>>(4.l+31) uleshort x \b, MustBeZero %#4.4x 39121## PageSplits 39122#>>(4.l+33) uleshort x \b, PageSplits %#4.4x 39123## RootPage 39124#>>(4.l+35) uleshort x \b, RootPage %#4.4x 39125## MustBeNegOne 0xffff 39126#>>(4.l+37) uleshort x \b, MustBeNegOne %#4.4x 39127## TotalPages 1 39128#>>(4.l+39) uleshort x \b, TotalPages %#4.4x 39129## NLevels 0x0001 39130#>>(4.l+41) uleshort x \b, NLevels %#4.4x 39131## TotalBtreeEntries 39132#>>(4.l+43) ulelong x \b, TotalBtreeEntries %#8.8x 39133## pages of the B+ tree 39134#>>(4.l+47) ubequad x \b, PageStart %#16.16llx 39135 39136# start with colon or semicolon for comment line like Back2Life.cnt 391370 regex \^(:|;) 39138# look for first keyword Base 39139>0 search/45 :Base 39140>>&0 use cnt-name 39141# only solution to search again from beginning , because relative offsets changes when use is called 39142>0 search/45 :Base 39143>0 default x 39144# look for other keyword Title like in putty.cnt 39145>>0 search/45 :Title 39146>>>&0 use cnt-name 39147# 39148# display mime type and name of Windows help Content source 391490 name cnt-name 39150# skip space at beginning 39151>0 string \040 39152# name without extension and greater character or name with hlp extension 39153>>1 regex/c \^([^\xd>]*|.*\\.hlp) MS Windows help file Content, based "%s" 39154!:mime text/plain 39155!:apple ????TEXT 39156!:ext cnt 39157# 39158# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 391590 string tfMR MS Windows help Full Text Search index 39160!:mime application/x-winhelp-fts 39161!:ext fts 39162>16 string >\0 for "%s" 39163 39164# Summary: Hyper terminal 39165# Extension: .ht 39166# Created by: unknown 391670 string HyperTerminal\040 39168>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 39169 39170# https://ithreats.files.wordpress.com/2009/05/\040 39171# lnk_the_windows_shortcut_file_format.pdf 39172# Summary: Windows shortcut 39173# Extension: .lnk 39174# Created by: unknown 39175# 'L' + GUUID 391760 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 39177!:mime application/x-ms-shortcut 39178!:ext lnk 39179>20 lelong&1 1 \b, Item id list present 39180>20 lelong&2 2 \b, Points to a file or directory 39181>20 lelong&4 4 \b, Has Description string 39182>20 lelong&8 8 \b, Has Relative path 39183>20 lelong&16 16 \b, Has Working directory 39184>20 lelong&32 32 \b, Has command line arguments 39185>20 lelong&64 64 \b, Icon 39186>>56 lelong x \b number=%d 39187>24 lelong&1 1 \b, Read-Only 39188>24 lelong&2 2 \b, Hidden 39189>24 lelong&4 4 \b, System 39190>24 lelong&8 8 \b, Volume Label 39191>24 lelong&16 16 \b, Directory 39192>24 lelong&32 32 \b, Archive 39193>24 lelong&64 64 \b, Encrypted 39194>24 lelong&128 128 \b, Normal 39195>24 lelong&256 256 \b, Temporary 39196>24 lelong&512 512 \b, Sparse 39197>24 lelong&1024 1024 \b, Reparse point 39198>24 lelong&2048 2048 \b, Compressed 39199>24 lelong&4096 4096 \b, Offline 39200>28 leqwdate x \b, ctime=%s 39201>36 leqwdate x \b, mtime=%s 39202>44 leqwdate x \b, atime=%s 39203>52 lelong x \b, length=%u, window= 39204>60 lelong&1 1 \bhide 39205>60 lelong&2 2 \bnormal 39206>60 lelong&4 4 \bshowminimized 39207>60 lelong&8 8 \bshowmaximized 39208>60 lelong&16 16 \bshownoactivate 39209>60 lelong&32 32 \bminimize 39210>60 lelong&64 64 \bshowminnoactive 39211>60 lelong&128 128 \bshowna 39212>60 lelong&256 256 \brestore 39213>60 lelong&512 512 \bshowdefault 39214#>20 lelong&1 0 39215#>>20 lelong&2 2 39216#>>>(72.l-64) pstring/h x \b [%s] 39217#>20 lelong&1 1 39218#>>20 lelong&2 2 39219#>>>(72.s) leshort x 39220#>>>&75 pstring/h x \b [%s] 39221 39222# Summary: Outlook Personal Folders 39223# Created by: unknown 39224# Update: Joerg Jenderek 39225# URL: http://fileformats.archiveteam.org/wiki/Personal_Folder_File 39226# https://en.wikipedia.org/wiki/Personal_Storage_Table 39227# Reference: https://interoperability.blob.core.windows.net/files/MS-PST/%5bMS-PST%5d.pdf 39228# http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 39229# dwMagic !BDN 392300 lelong 0x4E444221 39231# skip DROID x-fmt-75-signature-id-472.pab x-fmt-248-signature-id-260.pst x-fmt-249-signature-id-261.pst 39232# by check for existance of bPlatformCreate value 39233>14 ubyte x Microsoft Outlook 39234#!:mime application/octet-stream 39235# NOT official registered ! 39236!:mime application/vnd.ms-outlook 39237# dwCRCPartial; 32-bit cyclic redundancy check (CRC) value of followin 471 bytes; zero for 64-bit 39238#>>4 ulelong !0 \b, CRC %#x 39239# wMagicClient; AB (4142h) is used for PAB files; SM (534Dh) is used for PST files; SO (534Fh) is used for OST files 39240#>>8 leshort x \b, wMagicClient=%#x 39241# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pab.trid.xml 39242# Note: called "Microsoft Personal Address Book" by TrID and 39243# "Microsoft Outlook Personal Address Book" by DROID via x-fmt/75 39244>>8 leshort 0x4142 Personal Address Book 39245#!:mime application/x-ms-pab 39246!:ext pab 39247# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pst.trid.xml 39248# http://mark0.net/download/triddefs_xml.7z/defs/p/pst-unicode.trid.xml 39249# Note: called "Microsoft OutLook Personal Folder" by TrID and 39250# by DROID via x-fmt/248 for ANSI and via x-fmt/249 for Unicode 39251#>>8 leshort 0x4D53 \b, PST~ 39252# called "Microsoft Outlook email folder" in ./windows version 1.37 and older 39253>>8 leshort 0x4D53 Personal Storage 39254#!:mime application/x-ms-pst 39255!:ext pst 39256# Reference: http://mark0.net/download/triddefs_xml.7z/defs/o/ost.trid.xml 39257# Note: called "Outlook Exchange Offline Storage" by TrID 39258>>8 leshort 0x4F53 Offline Storage 39259#!:mime application/x-ms-ost 39260!:ext ost 39261# wVer; file format version. 14 or 15 if the file is ANSI; > 21 or 23(=17h) if Unicode; 37 for written by Outlook with WIP 39262>>10 uleshort x ( 39263# probably NO intermediate versions exist 39264>>10 leshort <0x10 \b<=2002, ANSI, 39265>>10 leshort >0x14 \b>=2003, Unicode, 39266>>10 uleshort x version %u) 39267# wVerClient; client file format version like: 19 22 39268#>>12 uleshort x \b, wVerClient=%u 39269# bPlatformCreate; This value MUST be set to 1 but also found 2 39270>>14 ubyte >1 \b, bPlatformCreate=%u 39271# bPlatformAccess; This value MUST be set to 1 but also found 2 39272>>15 ubyte >1 \b, bPlatformAccess=%u 39273# dwReserved1; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 39274>>16 ulelong !0 \b, dwReserved1=%#x 39275# dwReserved2; SHOULD ignore and NOT modify this value; SHOULD initialize to zero 39276>>20 ulelong !0 \b, dwReserved2=%#x 39277# ANSI 32-bit variant Outlook 1997-2002 39278>>10 uleshort <16 39279# bidNextB; next BlockID (ANSI 4 bytes) 39280#>>>24 ulelong !0 \b, bidNextB=%#x 39281# bidNextP; Next available back BlockID pointer 39282#>>>28 ulelong !0 \b, bidNextP=%#x 39283# dwUnique; value monotonically increased when modifying PST; so CRC is changing 39284>>>32 ulelong !0 \b, dwUnique=%#x 39285# rgnid[128]; A fixed array of 32 NodeIDs, each corresponding to one of the 32 possible NID_TYPEs 39286#>>>36 ubequad x \b, rgnid=%#llx... 39287# dwReserved; Implementations SHOULD ignore this value and SHOULD NOT modify it; Initialized zero 39288>>>164 ulelong !0 \b, dwReserved=%#x 39289# ibFileEof; the size of the PST file, in bytes (ANSI 4 bytes) 39290>>>168 ulelong x \b, %u bytes 39291# ibAMapLast; offset to the last AMap page 39292#>>>172 ulelong x \b, ibAMapLast=%#x 39293# bSentinel; MUST be set to 0x80 39294>>>460 ubyte !0x80 \b, bSentinel=%#x 39295# bCryptMethod: 0~No encryption 1~encryption with permutation 2~encryption with cyclic 16~encryption with Windows Information Protection (WIP) 39296>>>461 ubyte >0 \b, bCryptMethod=%u 39297# UNICODE 64-bit variant Outlook 2003-2007 39298>>10 uleshort >20 39299# bidUnused; Unused 8 bytes padding (Unicode only); sometimes like: 0x0000000100000004 39300>>>24 ulequad !0x0000000100000004 \b, bidUnused=%#16.16llx 39301# dwUnique; value monotonically increased when modifying PST; so CRC is changing 39302>>>40 ulelong !0 \b, dwUnique=%#x 39303# rgnid[] (128 bytes): A fixed array of 32 NIDs, each corresponding to one of the 32 possible 39304#>>>44 ubequad x \b, rgnid=%#llx... 39305# ibFileEof; the size of the PST file, in bytes (Unicode 8 bytes) 39306>>>184 ulequad x \b, %llu bytes 39307# bSentinel; MUST be set to 0x80 39308>>>512 ubyte !0x80 \b, bSentinel=%#x 39309# bCryptMethod; Encryption type like: 0 1 2 16 39310>>>513 ubyte >0 \b, bCryptMethod=%u 39311# dwCRC; 32-bit CRC of the of the previous 516 bytes 39312>>>524 ulelong x \b, CRC32 %#x 39313 39314 39315# Summary: Windows help cache 39316# Created by: unknown 393170 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 39318 39319 39320# Summary: IE cache file 39321# Created by: Christophe Monniez 393220 string Client\ UrlCache\ MMF Internet Explorer cache file 39323>20 string >\0 version %s 39324 39325 39326# Summary: Registry files 39327# Created by: unknown 39328# Modified by (1): Joerg Jenderek 393290 string regf MS Windows registry file, NT/2000 or above 393300 string CREG MS Windows 95/98/ME registry file 393310 string SHCC3 MS Windows 3.1 registry file 39332 39333 39334# Summary: Windows Registry text 39335# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 39336# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 39337# Submitted by: Abel Cheung <abelcheung@gmail.com> 39338# Update: Joerg Jenderek 39339# Windows 3-9X variant 393400 string REGEDIT 39341# skip ASCII text like "REGEDITor.txt" but match 39342# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 39343>7 search/3 \n Windows Registry text 39344!:mime text/x-ms-regedit 39345!:ext reg 39346# Windows 9X variant 39347>>0 string REGEDIT4 (Win95 or above) 39348# Windows 2K ANSI variant 393490 string Windows\ Registry\ Editor\ 39350>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 39351!:mime text/x-ms-regedit 39352!:ext reg 39353# Windows 2K UTF-16 variant 393542 lestring16 Windows\ Registry\ Editor\ 39355>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 39356# relative offset not working 39357#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 39358!:mime text/x-ms-regedit 39359!:ext reg 39360# WINE variant 39361# URL: https://en.wikipedia.org/wiki/Wine_(software) 39362# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 39363# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 39364# instead binary hiv structure like Windows 393650 string WINE\ REGISTRY\ Version\ WINE registry text 39366# version 2 39367>&0 string x \b, version %s 39368!:mime text/x-wine-extension-reg 39369!:ext reg 39370 39371# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 39372# empty ,comment , section 39373# PR/383: remove unicode BOM because it is not portable across regex impls 39374#0 regex/s \\`(\\r\\n|;|[[]) 39375# empty line CRLF 393760 ubeshort 0x0D0A 39377>0 use ini-file 39378# comment line starting with semicolon 393790 string ; 39380# look for phrase of Windows policy ADMinistrative template (with starting remark) 39381# like: WINDOW_95_CD/TOOLS/RESKIT/netadmin/poledit/conf.adm 39382>1 search/3548 END\040CATEGORY 39383# ADM with remark (by adm-rem.trid.xml) already done by generic ASCII variant 39384# if no Windows policy ADMinistrative template then Windows INItialization 39385>1 default x 39386>>0 use ini-file 39387# section line starting with left bracket 393880 string [ 39389>0 use ini-file 39390# check and then display Windows INItialization configuration 393910 name ini-file 39392# look for left bracket in section line 39393>0 search/8192 [ 39394# https://en.wikipedia.org/wiki/Autorun.inf 39395# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 39396# space after right bracket 39397# or AutoRun.Amd64 for 64 bit systems 39398# or only NL separator 39399>>&0 regex/c \^autorun 39400# but sometimes total commander directory tree file "treeinfo.wc" with lines like 39401# [AUTORUN] 39402# [boot] 39403>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 39404!:mime text/plain 39405!:ext wc 39406# From: Pal Tamas <folti@balabit.hu> 39407# Autorun File 39408>>>&0 string !]\r\n[ Microsoft Windows Autorun file 39409!:mime application/x-setupscript 39410!:ext inf 39411# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 39412# version strings ASCII coded case-independent for Windows setup information script file 39413>>&0 regex/c \^(version|strings)] Windows setup INFormation 39414!:mime application/x-setupscript 39415#!:mime application/x-wine-extension-inf 39416!:ext inf 39417# NETCRC.INF OEMCPL.INF 39418>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 39419!:mime application/x-setupscript 39420!:ext inf 39421# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 39422# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 39423# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 39424>>&0 regex/1024c \^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 39425!:mime application/x-wine-extension-ini 39426#!:mime text/plain 39427# https://support.microsoft.com/kb/84709/ 39428>>&0 regex/c \^don't\ load] Windows CONTROL.INI 39429!:mime application/x-wine-extension-ini 39430!:ext ini 39431>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 39432!:mime application/x-wine-extension-ini 39433!:ext ini 39434# https://technet.microsoft.com/en-us/library/cc722567.aspx 39435# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 39436>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 39437!:mime application/x-wine-extension-ini 39438!:ext ini 39439# https://en.wikipedia.org/wiki/SYSTEM.INI 39440>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 39441!:mime application/x-wine-extension-ini 39442!:ext ini 39443# http://www.mdgx.com/newtip6.htm 39444>>&0 regex/c \^SafeList] Windows IOS.INI 39445!:mime application/x-wine-extension-ini 39446!:ext ini 39447# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 39448>>&0 regex/c \^boot\x20loader] Windows boot.ini 39449!:mime application/x-wine-extension-ini 39450!:ext ini 39451# https://en.wikipedia.org/wiki/CONFIG.SYS 39452>>&0 regex/c \^menu] MS-DOS CONFIG.SYS 39453# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 39454# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE 39455# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE 39456# dos and w40 used in dual booting scene 39457!:ext sys/dos/w40 39458# https://support.microsoft.com/kb/118579/ 39459>>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS 39460!:ext sys/dos 39461# http://chmspec.nongnu.org/latest/INI.html#HHP 39462>>&0 regex/c \^options]\r\n Microsoft HTML Help Project 39463!:mime text/plain 39464!:ext hhp 39465# From: Joerg Jenderek 39466# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/ODBC_Driver/obdcdriv_character_translation.htm 39467# Reference: https://www.garykessler.net/library/file_sigs.html 39468# http://mark0.net/download/triddefs_xml.7z/defs/c/cpx.trid.xml 39469# Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system 39470# second word often Latin but sometimes Cyrillic like in 12510866.CPX 39471>>&0 regex/c \^Windows\ (Latin|Cyrillic) Windows codepage translator 39472#!:mime text/plain 39473!:mime text/x-ms-cpx 39474# like: 12510866.CPX 39475!:ext cpx 39476# From: Joerg Jenderek 39477# URL: https://en.wikipedia.org/wiki/InstallShield 39478# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml 39479# Note: contain also 3 keywords like: count Default key0 39480>>&0 regex/c \^Languages] InstallShield Language Identifier 39481#!:mime text/plain 39482!:mime text/x-installshield-lid 39483# like: SETUP.LID 39484!:ext lid 39485# From: Joerg Jenderek 39486# URL: https://www.file-extensions.org/tag-file-extension 39487# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/taginfo.trid.xml 39488# Note: contain also keywords like: Application Category Company Misc Version 39489>>&0 regex/c \^TagInfo] TagInfo 39490#!:mime text/plain 39491#!:mime text/prs.lines.tag 39492!:mime text/x-ms-tag 39493# like: DATA.TAG 39494!:ext tag 39495# unknown keyword after opening bracket 39496>>&0 default x 39497#>>>&0 string/c x UNKNOWN [%s 39498# look for left bracket of second section 39499>>>&0 search/8192 [ 39500# version Strings FileIdentification 39501>>>>&0 string/c version Windows setup INFormation 39502!:mime application/x-setupscript 39503!:ext inf 39504# https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 39505>>>>&0 default x 39506>>>>>&0 ubyte x 39507# characters, digits, underscore and white space followed by right bracket 39508# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 39509>>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 39510# NETDEF.INF multiarc.ini 39511#!:mime application/x-setupscript 39512!:mime application/x-wine-extension-ini 39513#!:mime text/plain 39514!:ext ini/inf 39515# UTF-16 BOM 395160 ubeshort =0xFFFE 39517# look for phrase of Windows policy ADMinistrative template (UTF-16 by adm-uni.trid.xml) 39518# like: wuau.adm 39519>2 search/0x384A E\0N\0D\0\040\0C\0A\0T\0E\0G\0O\0R\0Y\0 39520>>0 use windows-adm 39521# if no Windows policy ADMinistrative template then Windows INFormation 39522>2 default x 39523# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 39524>>0 ubelong&0xFFff89FF =0xFFFE0900 39525# look for left bracket in section line 39526>>>2 search/8192 [ 39527# keyword without 1st letter which is maybe up-/down-case 39528>>>>&3 lestring16 ersion] Windows setup INFormation 39529!:mime application/x-setupscript 39530# like: hdaudio.inf iscsi.inf spaceport.inf tpm.inf usbhub3.inf UVncVirtualDisplay.inf 39531!:ext inf 39532>>>>&3 lestring16 trings] Windows setup INFormation 39533!:mime application/x-setupscript 39534# like: arduino_gemma.inf iis.inf MSM8960.inf 39535!:ext inf 39536>>>>&3 lestring16 ourceDisksNames] Windows setup INFormation 39537!:mime application/x-setupscript 39538# like: atiixpag.inf mdmnokia.inf netefe32.inf rdpbus.inf 39539!:ext inf 39540# netnwcli.inf start with ;---[ NetNWCli.INX ] 39541>>>>&3 default x 39542# look for NL followed by left bracket 39543>>>>>&0 search/8192 \x0A\x00\x5b 39544# like: defltwk.inf netvwifibus.inf WSDPrint.inf 39545>>>>>>&3 lestring16 ersion] Windows setup INFormation 39546!:mime application/x-setupscript 39547!:ext inf 39548 39549# Summary: Windows Policy ADMinistrative template 39550# From: Joerg Jenderek 39551# URL: https://en.wikipedia.org/wiki/Administrative_Template 39552# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/adm.trid.xml 39553# Note: typically stored in directory like: %WINDIR%\system32\GroupPolicy\ADM 39554# worst case ASCII variant starting with remark line like: inetset.adm 395550 search/0x4E CLASS\040 39556>&0 string MACHINE 39557>>0 use windows-adm 39558>&0 string USER 39559>>0 use windows-adm 39560# display information about Windows policy ADMinistrative template 395610 name windows-adm Windows Policy Administrative Template 39562!:mime text/x-ms-adm 39563!:ext adm 39564# UTF-16 BOM implies UTF-16 encoded ADM (by adm-uni.trid.xml) 39565>0 ubeshort =0xFFFE 39566>>2 lestring16 x \b, 1st line "%s" 39567# look for UTF-16 encoded CarriageReturn LineFeed 39568>>>2 search/0x3A \r\0\n\0 39569>>>>&0 lestring16 x \b, 2nd line "%s" 39570# no UTF-16 BOM implies "ASCII" encoded ADM (by adm.trid.xml) 39571>0 ubeshort !0xFFFE 39572>>0 string x \b, 1st line "%s" 39573#>>>&0 ubequad x \b, 2ND %16.16llx 39574# 2nd line empty 39575>>>&2 beshort =0x0D0A 39576>>>>&0 beshort !0x0D0A \b, 3th line 39577>>>>>&-2 string x "%s" 39578# 2nd line with content 39579>>>&2 beshort !0x0D0A \b, 2nd line 39580>>>>&-2 string x "%s" 39581 39582# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 39583# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 39584# URL: http://fileformats.archiveteam.org/wiki/INF_(Windows) 39585# Reference: http://en.verysource.com/code/10350344_1/inf.h.html 39586# Note: stored in %Windir%\Inf %Windir%\System32\DriverStore\FileRepository 39587# check for valid major and minor versions: 101h - 303h 395880 leshort&0xFcFc =0x0000 39589# GRR: line above (strength 50) is too general as it catches also "PDP-11 UNIX/RT ldp" ./pdp 39590>0 leshort&0x0303 !0x0000 39591# test for valid InfStyles: 1 2 39592>>2 uleshort >0 39593>>>2 uleshort <3 39594# look for colon in WinDirPath after PNF header 39595#>>>>0x59 search/18 : 39596>>>>0 use PreCompiledInf 395970 name PreCompiledInf 39598>0 uleshort x Windows Precompiled iNF 39599!:mime application/x-pnf 39600!:ext pnf 39601# major version 1 for older Windows like XP and 3 since about Windows Vista 39602# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362 39603>1 ubyte x \b, version %u 39604>0 ubyte x \b.%u 39605>0 uleshort =0x0101 (Windows 39606>>4 ulelong&0x00000001 !0x00000001 98) 39607>>4 ulelong&0x00000001 =0x00000001 XP) 39608>0 uleshort =0x0301 (Windows Vista-8.1) 39609>0 uleshort =0x0302 (Windows 10 older) 39610>0 uleshort =0x0303 (Windows 10) 39611# 1 ,2 (windows 98 SE) 39612>2 uleshort !2 \b, InfStyle %u 39613# PNF_FLAG_IS_UNICODE 0x00000001 39614# PNF_FLAG_HAS_STRINGS 0x00000002 39615# PNF_FLAG_SRCPATH_IS_URL 0x00000004 39616# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 39617# PNF_FLAG_INF_VERIFIED 0x00000010 39618# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 39619# UNKNOWN8 0x00000080 39620# UNKNOWN 0x00000100 39621# UNKNOWN1 0x01000000 39622# UNKNOWN2 0x02000000 39623>4 ulelong&0x03000180 >0 \b, flags 39624>>4 ulelong x %#x 39625>4 ulelong&0x00000001 0x00000001 \b, unicoded 39626>4 ulelong&0x00000002 0x00000002 \b, has strings 39627>4 ulelong&0x00000004 0x00000004 \b, src URL 39628>4 ulelong&0x00000008 0x00000008 \b, volatile dir ids 39629>4 ulelong&0x00000010 0x00000010 \b, verified 39630>4 ulelong&0x00000020 0x00000020 \b, digitally signed 39631# >4 ulelong&0x00000080 0x00000080 \b, UNKNOWN8 39632# >4 ulelong&0x00000100 0x00000100 \b, UNKNOWN 39633# >4 ulelong&0x01000000 0x01000000 \b, UNKNOWN1 39634# >4 ulelong&0x02000000 0x02000000 \b, UNKNOWN2 39635#>8 ulelong x \b, InfSubstValueListOffset %#x 39636# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 39637# , 6 bth.PNF, 9 usbport.PNF, d netnwifi.PNF, 10h nettcpip.PNF 39638#>12 uleshort x \b, InfSubstValueCount %#x 39639# only < 9 found: 8 hcw85b64.PNF 39640#>14 uleshort x \b, InfVersionDatumCount %#x 39641# only found values lower 0x0000ffff ?? 39642#>16 ulelong x \b, InfVersionDataSize %#x 39643# only found positive values lower 0x00ffFFff for InfVersionDataOffset 39644>20 ulelong x \b, at %#x 39645>4 ulelong&0x00000001 =0x00000001 39646# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 39647>>(20.l) lestring16 x "%s" 39648>4 ulelong&0x00000001 !0x00000001 39649>>(20.l) string x "%s" 39650# FILETIME is number of 100-nanosecond intervals since 1 January 1601 39651#>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 39652#>24 foodate-0xbar x \b, InfVersionLastWriteTime %s 39653# for Windows 98, XP 39654>0 uleshort <0x0102 39655# only found values lower 0x00ffFFff 39656# often 70 but also 78h for corelist.PNF 39657# >>32 ulelong x \b, StringTableBlockOffset %#x 39658# >>36 ulelong x \b, StringTableBlockSize %#x 39659# >>40 ulelong x \b, InfSectionCount %#x 39660# >>44 ulelong x \b, InfSectionBlockOffset %#x 39661# >>48 ulelong x \b, InfSectionBlockSize %#x 39662# >>52 ulelong x \b, InfLineBlockOffset %#x 39663# >>56 ulelong x \b, InfLineBlockSize %#x 39664# >>60 ulelong x \b, InfValueBlockOffset %#x 39665# >>64 ulelong x \b, InfValueBlockSize %#x 39666# WinDirPathOffset 39667# like 58h, which means direct after PNF header 39668#>>68 ulelong x \b, at %#x 39669>>68 ulelong x 39670>>>4 ulelong&0x00000001 =0x00000001 39671#>>>>(68.l) ubequad =0x43003a005c005700 39672# normally unicoded C:\Windows 39673#>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 39674>>>>(68.l) ubequad !0x43003a005c005700 39675>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 39676>>>4 ulelong&0x00000001 !0x00000001 39677# normally ASCII C:\WINDOWS 39678#>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 39679>>>>(68.l) string !C:\\WINDOWS 39680>>>>>(68.l) string x \b, WinDirPath "%s" 39681# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 39682>>>72 ulelong >0 \b, 39683>>>>4 ulelong&0x00000001 =0x00000001 39684>>>>>(72.l) lestring16 x OsLoaderPath "%s" 39685>>>>4 ulelong&0x00000001 !0x00000001 39686# seldom C:\ instead empty 39687>>>>>(72.l) string x OsLoaderPath "%s" 39688# 1fdh 39689#>>>76 uleshort x \b, StringTableHashBucketCount %#x 39690# only 407h found 39691>>>78 uleshort !0x409 \b, LanguageID %x 39692#>>>78 uleshort =0x409 \b, LanguageID %x 39693# InfSourcePathOffset often 0 39694>>>80 ulelong >0 \b, at %#x 39695>>>>4 ulelong&0x00000001 =0x00000001 39696>>>>>(80.l) lestring16 x SourcePath "%s" 39697>>>>4 ulelong&0x00000001 !0x00000001 39698>>>>>(80.l) string >\0 SourcePath "%s" 39699# OriginalInfNameOffset often 0 39700>>>84 ulelong >0 \b, at %#x 39701>>>>4 ulelong&0x00000001 =0x00000001 39702>>>>>(84.l) lestring16 x InfName "%s" 39703>>>>4 ulelong&0x00000001 !0x00000001 39704>>>>>(84.l) string >\0 InfName "%s" 39705 39706# for newer Windows like Vista, 7 , 8.1 , 10 39707>0 uleshort >0x0101 39708>>80 ulelong x \b, at %#x WinDirPath 39709>>>4 ulelong&0x00000001 0x00000001 39710# normally unicoded C:\Windows 39711#>>>>(80.l) ubequad =0x43003a005c005700 39712#>>>>>(80.l) lestring16 x "%s" 39713>>>>(80.l) ubequad !0x43003a005c005700 39714>>>>>(80.l) lestring16 x "%s" 39715# language id: 0 407h~german 409h~English_US 39716>>90 uleshort !0x409 \b, LanguageID %x 39717#>>90 uleshort =0x409 \b, LanguageID %x 39718>>92 ulelong >0 \b, at %#x 39719>>>4 ulelong&0x00000001 0x00000001 39720# language string like: de-DE en-US 39721>>>>(92.l) lestring16 x language %s 39722 39723# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 39724# Extension: .bkf 39725# Created by: Joerg Jenderek 39726# URL: https://en.wikipedia.org/wiki/NTBackup 39727# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 39728# Descriptor BloCK name of Microsoft Tape Format 397290 string TAPE 39730# Format Logical Address is zero 39731>20 ulequad 0 39732# Reserved for MBC is zero 39733>>28 uleshort 0 39734# Control Block ID is zero 39735>>>36 ulelong 0 39736# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 39737>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 39738#!:mime application/x-ntbackup 39739!:ext bkf 39740# OS ID 39741>>>>>10 ubyte 1 \b NetWare 39742>>>>>10 ubyte 13 \b NetWare SMS 39743>>>>>10 ubyte 14 \b NT 39744>>>>>10 ubyte 24 \b 3 39745>>>>>10 ubyte 25 \b OS/2 39746>>>>>10 ubyte 26 \b 95 39747>>>>>10 ubyte 27 \b Macintosh 39748>>>>>10 ubyte 28 \b UNIX 39749# OS Version (2) 39750#>>>>>11 ubyte x OS V=%x 39751# MTF_CONTINUATION Media Sequence Number > 1 39752#>>>>>4 ulelong&0x00000001 !0 \b, continued 39753# MTF_COMPRESSION 39754>>>>>4 ulelong&0x00000004 !0 \b, compressed 39755# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 39756>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 39757>>>>>4 ulelong&0x00020000 0 39758# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 39759>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 39760# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 39761>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 39762# Offset To First Event 238h,240h,28Ch 39763#>>>>>8 uleshort x \b, event offset %4.4x 39764# Displayable Size (20e0230h 20e024ch 20e0224h) 39765#>>>>>8 ulequad x dis. size %16.16llx 39766# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 39767#>>>>>52 ulelong x family ID %8.8x 39768# TAPE Attributes (3) 39769#>>>>>56 ulelong x TAPE %8.8x 39770# Media Sequence Number 39771>>>>>60 uleshort >1 \b, sequence %u 39772# Password Encryption Algorithm (3) 39773>>>>>62 uleshort >0 \b, %#x encrypted 39774# Soft Filemark Block Size * 512 (2) 39775#>>>>>64 uleshort =2 \b, soft size %u*512 39776>>>>>64 uleshort !2 \b, soft size %u*512 39777# Media Based Catalog Type (1,2) 39778#>>>>>66 uleshort x \b, catalog type %4.4x 39779# size of Media Name (66,68,6Eh) 39780>>>>>68 uleshort >0 39781# offset of Media Name (5Eh) 39782>>>>>>70 uleshort >0 39783# 0~, 1~ANSI, 2~UNICODE 39784>>>>>>>48 ubyte 1 39785# size terminated ansi coded string normally followed by "MTF Media Label" 39786>>>>>>>>(70.s) string >\0 \b, name: %s 39787>>>>>>>48 ubyte 2 39788# Not null, but size terminated unicoded string 39789>>>>>>>>(70.s) lestring16 x \b, name: %s 39790# size of Media Label (104h) 39791>>>>>72 uleshort >0 39792# offset of Media Label (C4h,C6h,CCh) 39793>>>>>74 uleshort >0 39794>>>>>>48 ubyte 1 39795#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 39796>>>>>>>(74.s) string >\0 \b, label: %s 39797>>>>>>48 ubyte 2 39798>>>>>>>(74.s) lestring16 x \b, label: %s 39799# size of password name (0,1Ch) 39800#>>>>>76 uleshort >0 \b, password size %4.4x 39801# Software Vendor ID (CBEh) 39802>>>>>86 uleshort x \b, software (%#x) 39803# size of Software Name (6Eh) 39804>>>>>80 uleshort >0 39805# offset of Software Name (1C8h,1CAh,1D0h) 39806>>>>>>82 uleshort >0 39807# 1~ANSI, 2~UNICODE 39808>>>>>>>48 ubyte 1 39809>>>>>>>>(82.s) string >\0 \b: %s 39810>>>>>>>48 ubyte 2 39811# size terminated unicoded coded string normally followed by "SPAD" 39812>>>>>>>>(82.s) lestring16 x \b: %s 39813# Format Logical Block Size (512,1024) 39814#>>>>>84 uleshort =1024 \b, block size %u 39815>>>>>84 uleshort !1024 \b, block size %u 39816# Media Date of MTF_DATE_TIME type with 5 bytes 39817#>>>>>>88 ubequad x DATE %16.16llx 39818# MTF Major Version (1) 39819#>>>>>>93 ubyte x \b, MFT version %x 39820# 39821 39822# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 39823# Reference: https://www.cryer.co.uk/file-types/p/pal.htm 39824# Created by: Joerg Jenderek 39825# Note: there exist other color palette formats also with .pal extension 398260 string JASC-PAL\r\n PaintShop Pro color palette 39827#!:mime text/plain 39828# PspPalette extension is used by newer (probably 8) PaintShopPro versions 39829!:ext pal/PspPalette 39830# 2nd line contains palette file version. For example "0100" 39831>10 string !0100 \b, version %.4s 39832# third line contains the number of colours: 16 256 ... 39833>16 string x \b, %.3s colors 39834 39835# URL: https://en.wikipedia.org/wiki/Innosetup 39836# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 39837# Created by: Joerg Jenderek 39838# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 39839# TrID labeles the entry as "Inno Setup Uninstall Log" 39840# TUninstallLogID 398410 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 39842!:mime application/x-innosetup 39843# unins000.dat, unins001.dat, ... 39844!:ext dat 39845# " 64-bit" variant 39846>0x1c string >\0 \b%.7s 39847# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 39848>0xc0 string x %s 39849# AppId[0x80] is similar to AppName or 39850# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 39851>0x40 ubyte 0x7b 39852>>0x40 string x %-.38s 39853# do not know how this log version correlates to program version 39854>0x140 ulelong x \b, version %#x 39855# NumRecs 39856#>0x144 ulelong x \b, %#4.4x records 39857# EndOffset means files size 39858>0x148 ulelong x \b, %u bytes 39859# Flags 5 25h 35h 39860#>0x14c ulelong x \b, flags %8.8x 39861# Reserved: array[0..26] of Longint 39862# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 39863>0x140 ulelong <1000 39864# hostname 39865>>0x1d6 pstring x \b, %s 39866# user name 39867>>>&0 pstring x \b\%s 39868# directory like C:\Program Files (x86)\GnuWin32 39869>>>>&0 pstring x \b, "%s" 39870# version 1000 or higher implies unicode 39871>0x140 ulelong >999 39872# hostname 39873>>0x1db lestring16 x \b, %-.9s 39874# utf string variant with prepending fe??ffFFff 39875>>0x1db search/43 \xFF\xFF\xFF 39876# user name 39877>>>&0 lestring16 x \b\%-.9s 39878>>>&0 search/43 \xFF\xFF\xFF 39879# directory like C:\Program Files\GIMP 2 39880>>>>&0 lestring16 x \b, %-.42s 39881 39882# URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller 39883# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas 39884# From: Joerg Jenderek 398850 string Inno\ Setup\ Messages\ ( 39886# null padded til 0x40 boundary 39887>0x38 quad 0 InnoSetup messages 39888!:mime application/x-innosetup-msg 39889# unins000.msg, unins001.msg, ... 39890!:ext msg 39891# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0 39892>>0x15 string x \b, version %.5s 39893# look for 6th char of version string or terminating right parentheses 39894>>>0x1a ubyte !0x29 \b%c 39895# NumMessages 39896>>0x40 ulelong x \b, %u messages 39897# TotalSize: Cardinal; 39898#>>0x44 ulelong x \b, TotalSize %u 39899# NotTotalSize: Cardinal; 39900#>>0x48 ulelong x \b, NotTotalSize %u 39901# CRCMessages: Longint; 39902#>>0x4C ulelong x \b, CRC %#x 39903>>0x40 ulelong x 39904# (u) after version means unicoded messages 39905>>>0x1c search/2 (u) (UTF-16), 39906>>>>0x50 lestring16 x %s 39907# ASCII coded message 39908>>>0x1c default x (ASCII), 39909>>>>0x50 string x %s 39910 39911# Windows Imaging (WIM) Image 39912# Update: Joerg Jenderek at Mar 2019, 2021 39913# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 39914# http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format 39915# Reference: https://download.microsoft.com/download/f/e/f/ 39916# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 39917# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 399180 string MSWIM\000\000\000 39919>0 use wim-archive 39920# https://wimlib.net/man1/wimoptimize.html 399210 string WLPWM\000\000\000 39922>0 use wim-archive 399230 name wim-archive 39924# _WIMHEADER_V1_PACKED ImageTag[8] 39925>0 string x Windows imaging 39926!:mime application/x-ms-wim 39927# TO avoid in file version 5.36 error like 39928# Magdir/windows, 760: Warning: Current entry does not yet have a description 39929# file: could not find any valid magic files! (No error) 39930# split WIM 39931>16 ulelong &0x00000008 (SWM 39932!:ext swm 39933# usPartNumber; 1, unless the file was split into multiple parts 39934>>40 uleshort x \b %u 39935# usTotalParts; The total number of WIM file parts in a spanned set 39936>>42 uleshort x \b of %u) image 39937# non split WIM 39938>16 ulelong ^0x00000008 39939# https://wimlib.net/man1/wimmount.html 39940# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 39941>>12 ulelong 3584 (ESD) image 39942!:ext esd 39943>>12 ulelong !3584 ( 39944# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg 39945>>>156 search/68233/s RunTime.xml \bWindows provisioning package) 39946!:ext ppkg 39947# if is is not a Windows provisioning package, then it is a WIM 39948>>>156 default x \bWIM) image 39949# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2 39950!:ext wim/wim2 39951>0 string/b WLPWM\000\000\000 \b, wimlib pipable format 39952# cbSize size of the WIM header in bytes like 208 39953#>8 ulelong x \b, headersize %u 39954# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 39955>14 uleshort x v%u 39956>13 ubyte x \b.%u 39957# dwImageCount; The number of images contained in the WIM file 39958>44 ulelong >1 \b, %u images 39959# dwBootIndex 39960# 1-based index of the bootable image of the WIM, or 0 if no image is bootable 39961>0x78 ulelong >0 \b, bootable no. %u 39962# dwFlags 39963#>16 ulelong x \b, flags %#8.8x 39964#define FLAG_HEADER_COMPRESSION 0x00000002 39965#define FLAG_HEADER_READONLY 0x00000004 39966#define FLAG_HEADER_SPANNED 0x00000008 39967#define FLAG_HEADER_RESOURCE_ONLY 0x00000010 39968#define FLAG_HEADER_METADATA_ONLY 0x00000020 39969#define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 39970#define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 39971#define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 39972#define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 39973#define FLAG_HEADER_COMPRESS_LZX 0x00040000 39974#define FLAG_HEADER_COMPRESS_LZMS 0x00080000 39975#define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 39976# XPRESS, with small chunk size 39977>16 ulelong &0x00100000 \b, XPRESS2 39978>16 ulelong &0x00080000 \b, LZMS 39979>16 ulelong &0x00040000 \b, LZX 39980>16 ulelong &0x00020000 \b, XPRESS 39981>16 ulelong &0x00000002 compressed 39982>16 ulelong &0x00000004 \b, read only 39983>16 ulelong &0x00000010 \b, resource only 39984>16 ulelong &0x00000020 \b, metadata only 39985>16 ulelong &0x00000080 \b, reparse point fixup 39986#>16 ulelong &0x00010000 \b, RESERVED 39987# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 39988#>20 ulelong >0 \b, chunk size %u bytes 39989# gWIMGuid 39990#>24 ubequad x \b, GUID %#16.16llx 39991#>>32 ubequad x \b%16.16llx 39992# rhOffsetTable; the location of the resource lookup table 39993# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 39994#>48 ubequad x \b, rhOffsetTable %#16.16llx 39995# rhXmlData; the location of the XML data 39996#>0x50 ulelong x \b, at %#8.8x 39997# NOT WORKING \xff\xfe<\0W\0I\0M\0 39998#>(0x50.l) ubequad x \b, xml=%16.16llx 39999# rhBootMetadata; the location of the metadata resource 40000#>0x60 ubequad x \b, rhBootMetadata %#16.16llx 40001# rhIntegrity; the location of integrity table used to verify files 40002#>0x7c ubequad x \b, rhIntegrity %#16.16llx 40003# Unused[60] 40004#>148 ubequad !0 \b,unused %#16.16llx 40005# 40006 40007# From: Joerg Jenderek 40008# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer 40009# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml 40010# Note: called "Windows Easy Transfer migration data" by TrID, 40011# "Migration Store" or "EasyTransfer file" by Microsoft 400120 string 1giM Windows Easy Transfer migration data 40013#!:mime application/octet-stream 40014!:mime application/x-ms-mig 40015!:ext mig 40016>0x18 string =MRTS without password 40017# data offset with 1 space at end 40018>>0x1c ulelong+0x38 x \b, at %#x 40019# look for zlib compressed data by ./compress 40020>>(0x1c.l+0x38) ubyte x 40021>>>&-1 indirect x 40022# in password protected examples MRTS comes some bytes further 40023>0x18 string !MRTS with password 40024# look for first MRTS tag 40025>0x18 search/29/b MRTS 40026# probably first file name length like 178, ... 40027#>>&0 ulelong x \b, 1st length %u 40028# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 40029>>&20 lestring16 x \b, 1st %-s 40030 40031# Microsoft SYLK 40032# https://en.wikipedia.org/wiki/SYmbolic_LinK_(SYLK) 40033# https://outflank.nl/upload/sylksum.txt 400340 string ID;P Microsoft SYLK program 40035>4 string >0 \b, created by %s 40036!:ext slk/sylk 40037 40038# Summary: Windows Performance Monitor Alert 40039# From: Joerg Jenderek 40040# URL: https://en.wikipedia.org/wiki/Performance_Monitor 40041# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pma.trid.xml 40042# Note: called "Windows Performance Monitor Alert" by TrID 400430 ubelong =0xDC058340 40044>4 ubyte =0 Windows Performance Monitor Alert 40045#!:mime application/octet-stream 40046# https://www.thoughtco.com/mime-types-by-content-type-3469108 40047# https://filext.com/file-extension/PAM 40048!:mime application/x-perfmon 40049#!:mime application/x-ms-pma 40050!:ext pma 40051# metric type like: "BrowserMetrics" "CrashpadMetrics" "SetupMetrics" 40052>>80 string x \b, "%s" 40053 40054# From: Joerg Jenderek 40055# URL: https://en.wikipedia.org/wiki/InstallShield 40056# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ins.trid.xml 40057# Note: contain also keywords like: BATCH_INSTALL ISVERSION LOGHANDLE SRCDIR SRCDISK WINDIR WINSYSDISK 400580 ubelong 0xB8C90C00 InstallShield Script 40059#!:mime application/octet-stream 40060!:mime application/x-installshield-ins 40061# like test.ins Setup.ins 40062!:ext ins 40063# UNKNOWN like: 160034121de07e00 1600341260befe00 16003412e0783700 40064# 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700 40065#>4 ubequad x \b, at 4 %#16.16llx 40066# copyright text like: "Stirling Technologies, Inc. (c) 1990-1994" 40067# "InstallSHIELD Software Coporation (c) 1990-1997" 40068>13 pstring/h x "%s" 40069# look for specific ASCII variable names 40070>1 search/0x121/s SRCDIR \b, variable names: 40071# 1st like: SRCDIR 40072>>&-4 leshort x #%u 40073>>&-2 pstring/h x %s 40074# 2nd like: SRCDISK 40075>>>&0 leshort x #%u 40076>>>&2 pstring/h x %s 40077# 3rd like: TARGETDISK 40078>>>>&0 leshort x #%u 40079>>>>&2 pstring/h x %s 40080# 4th like: TARGETDIR 40081#>>>>>&0 leshort x #%u 40082#>>>>>&2 pstring/h x %s 40083# 5th like: WINDIR 40084#>>>>>>&0 leshort x #%u 40085#>>>>>>&2 pstring/h x %s 40086# 6th like: WINDISK 40087#>>>>>>>&0 leshort x #%u 40088#>>>>>>>&2 pstring/h x %s 40089# 7th like: WINSYSDIR 40090#>>>>>>>>&0 leshort x #%u 40091#>>>>>>>>&2 pstring/h x %s 40092# ... LOGHANDLE 40093>0 ubelong x ... 40094# 40095 40096#------------------------------------------------------------------------------ 40097# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 40098# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 40099# 401000 string RGDB CRDA wireless regulatory database file 40101>4 belong 19 (Version 1) 40102 40103#------------------------------------------------------------------------------ 40104# $File: wordprocessors,v 1.31 2022/08/31 08:00:53 christos Exp $ 40105# wordprocessors: file(1) magic fo word processors. 40106# 40107####### PWP file format used on Smith Corona Personal Word Processors: 401082 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 40109>24 byte 2 \b, single spaced 40110>24 byte 3 \b, 1.5 spaced 40111>24 byte 4 \b, double spaced 40112>25 byte 0x42 \b, letter 40113>25 byte 0x54 \b, legal 40114>26 byte 0x46 \b, A4 40115 40116# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor 40117# reference: http://mark0.net/download/triddefs_xml.7z 40118# /defs/w/wps-works-dos.trid.xml 40119# From: Joerg Jenderek 40120# Note: older non OLE 2 Compound based versions 401210 ubeshort =0x01FE 40122>112 ubeshort =0x0100 Microsoft Works 1-3 (DOS) or 2 (Windows) document 40123# title like THE GREAT KHAN GAME 40124>>0x100 string x %s 40125!:mime application/vnd-ms-works 40126#!:mime application/x-msworks 40127# https://www.macdisk.com/macsigen.php 40128!:apple ????AWWP 40129!:ext wps 40130 40131# Corel/WordPerfect 40132# URL: https://en.wikipedia.org/wiki/WordPerfect 40133# Reference: https://github.com/OneWingedShark/WordPerfect/blob/master/doc/SDK_Help/FileFormats/WPFF_DocumentStructure.htm 40134# http://mark0.net/download/triddefs_xml.7z/defs/w/wp-generic.trid.xml 401350 string \xffWPC 40136# WordPerfect 40137>8 byte 1 40138# Reference: http://mark0.net/download/triddefs_xml.7z/defs/w/wpm-macro.trid.xml 40139# Note: there exist other macro variants 40140>>9 byte 1 WordPerfect macro 40141#!:mime application/octet-stream 40142!:mime application/x-wordperfect-wpm 40143# like: ALTD.WPM ENDFOOT.WPM FOOTEND.WPM LABELS.WPM REVEALTX.WPM 40144!:ext wpm 40145# Note: used in WordPerfect 5.1; there exist other FIL variants 40146>>9 byte 2 WordPerfect help file 40147#!:mime application/octet-stream 40148!:mime application/x-wordperfect-help 40149# like: WPHELP.FIL 40150!:ext fil 40151# pointer to document area like: 10h 40152>>>4 ulelong !0x10 \b, at %#x document area 40153>>9 byte 3 WordPerfect keyboard file 40154#!:mime application/octet-stream 40155!:mime application/x-wordperfect-keyboard 40156!:ext wpk 40157# no document area, so point to end of file; so this is file size like: 23381 2978 32835 3355 3775 919 40158>>>4 ulelong x \b, %u bytes 40159>>9 byte 4 WordPerfect VAX keyboard definition 40160#!:mime application/octet-stream 40161!:mime application/x-wordperfect-keyboard 40162#!:ext foo 40163# URL: http://fileformats.archiveteam.org/wiki/WordPerfect 40164# Reference: http://mark0.net/download/triddefs_xml.7z/defs/w/wpd-doc-gen.trid.xml 40165>>9 byte 10 WordPerfect document 40166# https://www.iana.org/assignments/media-types/application/vnd.wordperfect 40167!:mime application/vnd.wordperfect 40168#!:apple ????WPC2 40169# TODO: distinguish different suffix 40170!:ext wpd/wpt/wkb/icr/tut/sty/tst/crs 40171>>9 byte 11 WordPerfect dictionary 40172>>9 byte 12 WordPerfect thesaurus 40173>>9 byte 13 WordPerfect block 40174>>9 byte 14 WordPerfect rectangular block 40175>>9 byte 15 WordPerfect column block 40176>>9 byte 16 WordPerfect printer data 40177#!:mime application/octet-stream 40178!:mime application/x-wordperfect-prs 40179# like: STANDARD.PRS WORKBOOK.PRS 40180!:ext prs 40181# like: "Standard Printer" "Workbook Printer" 40182>>>0x64 pstring/B >A "%s" 40183#>>9 byte 18 WordPerfect Prefix information file 40184# printer resource .ALL 40185>>9 byte 19 WordPerfect printer data 40186#!:mime application/octet-stream 40187!:mime application/x-wordperfect-all 40188!:ext all 40189# display Resource 40190>>9 byte 20 WordPerfect driver resource data 40191#!:mime application/octet-stream 40192!:mime application/x-wordperfect-drs 40193# like: WPSMALL.DRS 40194!:ext drs 40195# pointer to index area with string "smalldrs" like: 46h 40196>>>4 uleshort !0x46 \b, at %#x index area 40197>>9 byte 21 WordPerfect Overlay file 40198#!:mime application/octet-stream 40199!:mime application/x-wordperfect-fil 40200# like: WP.FIL 40201!:ext fil 40202# URL: http://fileformats.archiveteam.org/wiki/WordPerfect_Graphics 40203# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-wpg.trid.xml 40204# Note: called "WordPerfect Graphics bitmap" by TrID and 40205# "WordPerfect Graphics Metafile" by DROID via x-fmt/395 fmt/1042 40206# "WPG (Word Perfect Graphics)" by ImageMagick `identify -verbose BUTTRFLY.WPG` 40207>>9 byte 22 WordPerfect graphic image 40208# TODO: skip DROID x-fmt-395-signature-id-132.wpg by check for existing document area 40209#>>>4 ulelong >15 WordPerfect_graphic_OK 40210#!:mime application/octet-stream 40211# http://extension.nirsoft.net/wpg 40212!:mime image/x-wordperfect-graphics 40213# https://reposcope.com/mimetype/application/x-wpg 40214#!:mime application/x-wpg 40215# like: BUTTRFLY.WPG STAR-5.WPG input.wpg WORDPFCT.WPG 40216!:ext wpg 40217# pointer to document area like: 10h 1Ah 40218>>>4 ulelong !0x1A \b, at %#x document area 40219>>9 byte 23 WordPerfect hyphenation code 40220>>9 byte 24 WordPerfect hyphenation data 40221>>9 byte 25 WordPerfect macro resource data 40222#!:mime application/octet-stream 40223!:mime application/x-wordperfect-mrs 40224# like: WP.MRS 40225!:ext mrs 40226>>9 byte 27 WordPerfect hyphenation lex 40227>>9 byte 29 WordPerfect wordlist 40228>>9 byte 30 WordPerfect equation resource data 40229#!:mime application/octet-stream 40230!:mime application/x-wordperfect-qrs 40231# like: WQ.QRS wpDE.qrs wpen.qrs 40232!:ext qrs 40233# jump to document area with some marker and equation 40234>>>(4.l) ubyte x 40235# equation like: "Fraction: x OVER y" 40236>>>>&1 string >A (...%-.19s...) 40237# pointer to document area like: 17C4h 40238>>>4 ulelong x \b, at %#x document area 40239#>>9 byte 31 reserved 40240#>>9 byte 32 WordPerfect VAX .SET 40241>>9 byte 33 WordPerfect spell rules 40242>>9 byte 34 WordPerfect dictionary rules 40243#>>9 byte 35 reserved 40244# video resource device driver 40245# Note: filetype 26 for VRS and filetype 36 for WPD apparently is wrong 40246>>9 byte 36 WordPerfect Video Resource 40247#!:mime application/octet-stream 40248!:mime application/x-wordperfect-vrs 40249# like: STANDARD.VRS 40250!:ext vrs 40251# like: "IBM CGA (& compatibles)" 40252>>>0x20 string >A "%.23s" 40253>>9 byte 39 WordPerfect spell rules (Microlytics) 40254#>>9 byte 40 reserved 40255>>9 byte 41 WordPerfect Install options 40256#!:mime application/octet-stream 40257!:mime application/x-wordperfect-ins 40258# like: WP51.INS 40259!:ext ins 40260# probably default directory name like: "C:\WP51\" 40261>>>0x12 string >A "%.8s" 40262# maybe mouse driver for WP5.1 40263>>9 byte 42 WordPerfect Resource 40264#!:mime application/octet-stream 40265!:mime application/x-wordperfect-irs 40266# like: STANDARD.IRS 40267!:ext irs 40268# like: "Mouse Driver (MOUSE.COM)" 40269>>>0x28 string >A "%.24s" 40270>>9 byte 43 WordPerfect settings file 40271# maybe Macintosh WP2.0 document 40272>>9 byte 44 WordPerfect 3.5 document 40273!:mime application/vnd.wordperfect 40274!:apple ????WPD3 40275# like: WP3.wpd 40276!:ext wpd 40277>>9 byte 45 WordPerfect 4.2 document 40278# External spell code module (WP5.1) 40279#>>9 byte 46 WordPerfect external spell 40280# external spell dictionary .LEX 40281#>>9 byte 47 WordPerfect external spell dictionary 40282# Macintosh SOFT graphics file (SOFT (Sequential Object Format) 40283#>>9 byte 48 WordPerfect SOFT graphics 40284#>>9 byte 49 reserved 40285#>>9 byte 50 reserved 40286# WPWin 5.1 Application Resource Library added for WPWin 5.1 40287#>>9 byte 51 WordPerfect application resource library 40288>>9 byte 69 WordPerfect dialog file 40289# From: Joerg Jenderek 40290# Note: found in sub directory WritingTools inside WordPerfect 2021 program directory 40291>>9 byte 70 WordPerfect Writing Tools 40292#!:mime application/octet-stream 40293!:mime application/x-wordperfect-cbt 40294# like: Wt13cbede.cbt Wt13cbeit.cbt Wt13cbefr.cbt WT21cbede.cbt Wt13cbeEN.CBD WT21cbeEN.CBD 40295!:ext cbd/cbt 40296>>9 byte 76 WordPerfect button bar 40297>>9 default x 40298>>>9 byte x Corel WordPerfect: Unknown filetype %d 40299# Corel Shell 40300>8 byte 2 40301>>9 byte 1 Corel shell macro 40302>>9 byte 10 Corel shell definition 40303>>9 default x 40304>>>9 byte x Corel Shell: Unknown filetype %d 40305# Corel Notebook 40306>8 byte 3 40307>>9 byte 1 Corel Notebook macro 40308>>9 byte 2 Corel Notebook help file 40309>>9 byte 3 Corel Notebook keyboard file 40310>>9 byte 10 Corel Notebook definition 40311>>9 default x 40312>>>9 byte x Corel Notebook: Unknown filetype %d 40313# Corel Calculator 40314>8 byte 4 40315>>9 byte 2 Corel Calculator help file 40316>>9 default x 40317>>>9 byte x Corel Calculator: Unknown filetype %d 40318# Corel File Manager 40319>8 byte 5 40320>>9 default x 40321>>>9 byte x Corel File Manager: Unknown filetype %d 40322# Corel Calendar 40323>8 byte 6 40324>>9 byte 2 Corel Calendar help file 40325>>9 byte 10 Corel Calendar data file 40326>>9 default x 40327>>>9 byte x Corel Calendar: Unknown filetype %d 40328# Corel Program Editor/Ed Editor 40329>8 byte 7 40330>>9 byte 1 Corel Editor macro 40331>>9 byte 2 Corel Editor help file 40332>>9 byte 3 Corel Editor keyboard file 40333>>9 byte 25 Corel Editor macro resource file 40334>>9 default x 40335>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d 40336# Corel Macro Editor 40337>8 byte 8 40338>>9 byte 1 Corel Macro editor macro 40339>>9 byte 2 Corel Macro editor help file 40340>>9 byte 3 Corel Macro editor keyboard file 40341>>9 default x 40342>>>9 byte x Corel Macro Editor: Unknown filetype %d 40343# Corel Plan Perfect 40344>8 byte 9 40345>>9 default x 40346>>>9 byte x Corel Plan Perfect: Unknown filetype %d 40347# Corel DataPerfect 40348>8 byte 10 40349# CHECK: Don't these belong into product 9? 40350>>9 byte 1 Corel PlanPerfect macro 40351>>9 byte 2 Corel PlanPerfect help file 40352>>9 byte 3 Corel PlanPerfect keyboard file 40353>>9 byte 10 Corel PlanPerfect worksheet 40354>>9 byte 15 Corel PlanPerfect printer definition 40355>>9 byte 18 Corel PlanPerfect graphic definition 40356>>9 byte 19 Corel PlanPerfect data 40357>>9 byte 20 Corel PlanPerfect temporary printer 40358>>9 byte 25 Corel PlanPerfect macro resource data 40359>>9 default x 40360>>>9 byte x Corel DataPerfect: Unknown filetype %d 40361# Corel Mail 40362>8 byte 11 40363>>9 byte 2 Corel Mail help file 40364>>9 byte 5 Corel Mail distribution list 40365>>9 byte 10 Corel Mail out box 40366>>9 byte 11 Corel Mail in box 40367>>9 byte 20 Corel Mail users archived mailbox 40368>>9 byte 21 Corel Mail archived message database 40369>>9 byte 22 Corel Mail archived attachments 40370>>9 default x 40371>>>9 byte x Corel Mail: Unknown filetype %d 40372# Corel Printer 40373>8 byte 12 40374>>9 byte 11 Corel Printer temporary file 40375>>9 default x 40376>>>9 byte x Corel Printer: Unknown filetype %d 40377# Corel Scheduler 40378>8 byte 13 40379>>9 byte 2 Corel Scheduler help file 40380>>9 byte 10 Corel Scheduler in file 40381>>9 byte 11 Corel Scheduler out file 40382>>9 default x 40383>>>9 byte x Corel Scheduler: Unknown filetype %d 40384# Corel WordPerfect Office 40385>8 byte 14 40386>>9 byte 10 Corel GroupWise settings file 40387>>9 byte 17 Corel GroupWise directory services 40388>>9 byte 43 Corel GroupWise settings file 40389>>9 default x 40390>>>9 byte x Corel WordPerfect Office: Unknown filetype %d 40391# Corel DrawPerfect 40392>8 byte 15 40393>>9 default x 40394>>>9 byte x Corel DrawPerfect: Unknown filetype %d 40395# Corel LetterPerfect 40396>8 byte 16 40397>>9 default x 40398>>>9 byte x Corel LetterPerfect: Unknown filetype %d 40399# Corel Terminal 40400>8 byte 17 40401>>9 byte 10 Corel Terminal resource data 40402>>9 byte 11 Corel Terminal resource data 40403>>9 byte 43 Corel Terminal resource data 40404>>9 default x 40405>>>9 byte x Corel Terminal: Unknown filetype %d 40406# Corel loadable file 40407>8 byte 18 40408>>9 byte 10 Corel loadable file 40409>>9 byte 11 Corel GUI loadable text 40410>>9 byte 12 Corel graphics resource data 40411>>9 byte 13 Corel printer settings file 40412>>9 byte 14 Corel port definition file 40413>>9 byte 15 Corel print queue parameters 40414>>9 byte 16 Corel compressed file 40415>>9 default x 40416>>>9 byte x Corel loadable file: Unknown filetype %d 40417>>15 byte 0 \b, optimized for Intel 40418>>15 byte 1 \b, optimized for Non-Intel 40419# Network service 40420>8 byte 20 40421>>9 byte 10 Corel Network service msg file 40422>>9 byte 11 Corel Network service msg file 40423>>9 byte 12 Corel Async gateway login msg 40424>>9 byte 14 Corel GroupWise message file 40425>>9 default x 40426>>>9 byte x Corel Network service: Unknown filetype %d 40427# GroupWise 40428>8 byte 31 40429>>9 byte 20 GroupWise admin domain database 40430>>9 byte 21 GroupWise admin host database 40431>>9 byte 23 GroupWise admin remote host database 40432>>9 byte 24 GroupWise admin ADS deferment data file 40433>>9 default x 40434>>>9 byte x GroupWise: Unknown filetype %d 40435# Corel Writing Tools WT*.* 40436# From: Joerg Jenderek 40437# URL: https://support.corel.com/hc/en-us/articles/215876258-Writing-Tools-Spell-Check-Dictionary-does-not-work-in-WordPerfect-X5 40438# http://wordperfect.helpmax.net/en/editing-and-formatting-documents/using-the-writing-tools/working-with-user-word-lists/ 40439# Reference: http://mark0.net/download/triddefs_xml.7z/defs/u/uwl-wp.trid.xml 40440>8 byte 32 40441>>9 byte 10 Corel Writing Tools User Word List 40442#!:mime application/octet-stream 40443!:mime application/x-wordperfect-wordlist 40444# personal user word list UWL under user directory like: WTDE.UWL WTUS.UWL WT21DE.UWL WT21US.UWL WT13DE.UWL ... 40445# and "template" SAV/HWL variant under program directory like: wt13en.hwl Wt13de.sav Wt13it.sav wt13ru.sav WT21us.sav Wtcz.sav ... 40446!:ext uwl/hwl/sav 40447# jump to document area with some marker and word list 40448>>>(4.l) ubyte x 40449# look for beginning of word list starting mostly with letter a as UTF-16 like: Wt13es.sav 40450# but not found in russian wt13ru.sav 40451>>>>&0 search/91/sb a\0 40452# word list starting like: "acsesory\022accessory.\001\026acomodate\026accommodate4\001" 40453>>>>>&0 lestring16 x (...%-.33s...) 40454# pointer to document area like: 200h 40455>>>4 ulelong !0x200 \b, at %#x document area 40456# file size, not including pad characters at EOF 40457>>>0x14 uleshort x \b, %u bytes 40458# IntelliTAG 40459>8 byte 33 40460>>9 byte 10 IntelliTAG (SGML) compiled DTD 40461>>9 default x 40462>>>9 byte x IntelliTAG: Unknown filetype %d 40463# Summary: Corel WordPerfect WritingTools advise part 40464# From: Joerg Jenderek 40465# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/adv-wp.trid.xml 40466>8 byte 34 40467>>9 byte 11 Corel WordPerfect dictionary advise 40468#!:mime application/octet-stream 40469!:mime application/x-wordperfect-adv 40470#!:mime application/vnd.wordperfect.adv 40471# like: WT21de.adv Wt13de.adv Wt13es.adv Wt13fr.adv wt13us.adv 40472!:ext adv 40473# advise text part often start with tag like: 580A 40474#>>>(16.s) ubequad x ADVISE PART %#llx 40475# part of advise text like: "This is too informal for most writing." 40476>>>(16.s+16) string x (...%-.33s...) 40477# everything else 40478>8 default x 40479>>8 byte x Unknown Corel/Wordperfect product %d, 40480>>>9 byte x file type %d 40481>10 byte 0 \b, v5. 40482>10 byte !0 \b, v%d. 40483>11 byte x \b%d 40484 40485# Hangul (Korean) Word Processor File 404860 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 40487 40488# CosmicBook, from Benoit Rouits 404890 string CSBK Ted Neslson's CosmicBook hypertext file 40490 404912 string EYWR AmigaWriter file 40492 40493# chi: file(1) magic for ChiWriter files 404940 string \\1cw\ ChiWriter file 40495>5 string >\0 version %s 404960 string \\1cw ChiWriter file 40497 40498# Quark Express from https://www.garykessler.net/library/file_sigs.html 404992 string IIXPR3 Intel Quark Express Document (English) 405002 string IIXPRa Intel Quark Express Document (Korean) 405012 string MMXPR3 Motorola Quark Express Document (English) 40502!:mime application/x-quark-xpress-3 405032 string MMXPRa Motorola Quark Express Document (Korean) 40504 40505# From: Joerg Jenderek 40506# URL: http://fileformats.archiveteam.org/wiki/PageMaker 40507# https://en.wikipedia.org/wiki/Adobe_PageMaker 40508# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p 40509# pm4-pagemaker.trid.xml 40510# pm5-pagemaker.trid.xml 40511# Note: since version 6 in 1995 called Adobe PageMaker and 40512# embedded in Compound Document handled by ./ole2compounddocs 40513# mainly tested little endian variant 405144 ubelong =0x0000FF99 40515>0 use PageMaker 40516# big endian variant 405174 ubelong =0x000099FF 40518>0 use \^PageMaker 40519# display information of Aldus/Adobe PageMaker document/publication 405200 name PageMaker 40521>110 uleshort <0x0600 Aldus 40522>110 uleshort >0x05FF Adobe 40523>110 uleshort x PageMaker 40524# "MP" marker for newer version 4 and above according to TrID 40525#>108 string x \b, MARKER "%.2s" 40526# http://www.nationalarchives.gov.uk/pronom/fmt/876 40527!:mime application/vnd.pagemaker 40528#!:mime application/x-pagemaker 40529# different file name extensions are used depending on version 40530# older version like 3 40531>110 uleshort/256 =0 document 40532# https://www.macdisk.com/macsigen.php 40533!:apple ALB3ALD3 40534# PT3 for template and no example for PageMaker document/publiction with PM3 extension 40535!:ext pm3/pt3 40536>110 uleshort/256 =4 document 40537!:apple ALD4ALB4 40538# no example for PT4 template 40539!:ext pm4/pt4 40540>110 uleshort/256 =5 document 40541!:apple ALD5ALB5 40542# no example for PT5 template 40543!:ext pm5/pt5 40544>110 uleshort =0x0600 document 40545!:apple ALD6ALB6 40546# PT6 for template 40547!:ext pm6/pt6 40548# HOWTO to distinguish version 7 from 6.5 ? 40549>110 uleshort =0x0632 document 40550!:apple AD65AB65 40551# no example for T65 template 40552!:ext p65/t65/pmd/pmt 40553# version 7 with PMT extension for template 40554#!:ext pmd/pmt 40555#!:apple ????PUBF 40556# endian marker FF 99 for little endian 40557>6 ubyte =0xFF \b, little-endian 40558>6 ubyte =0x99 \b, big-endian 40559# newer numeric version like: 4 5 6 6.50 40560#>110 uleshort x \b, VERSION=%#x 40561>110 uleshort >0x03FF 40562>>110 uleshort/256 x \b, version %u 40563>>110 uleshort%256 >0 \b.%u 40564# older version like 3 40565>110 uleshort <0x0400 \b, maybe version 3 40566 40567# adobe indesign (document, whatever...) from querkan 405680 belong 0x0606edf5 Adobe InDesign 40569>16 string DOCUMENT Document 40570 40571#------------------------------------------------------------------------------ 40572# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 40573# 40574# Contributor kenzo-: 40575# Reversed-engineered JS Ichitaro magic numbers 40576# 40577 405780 string DOC 40579>43 byte 0x14 Just System Word Processor Ichitaro v4 40580!:mime application/x-ichitaro4 40581>144 string JDASH application/x-ichitaro4 40582 405830 string DOC 40584>43 byte 0x15 Just System Word Processor Ichitaro v5 40585!:mime application/x-ichitaro5 40586 405870 string DOC 40588>43 byte 0x16 Just System Word Processor Ichitaro v6 40589!:mime application/x-ichitaro6 40590 40591# Type: Freemind mindmap documents 40592# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 405930 string/w \<map\ version Freemind document 40594!:mime application/x-freemind 40595 40596# Type: Freeplane mindmap documents 40597# From: Felix Natter <fnatter@gmx.net> 405980 string/w \<map\ version="freeplane Freeplane document 40599!:mime application/x-freeplane 40600 40601# Type: Scribus 40602# From: Werner Fink <werner@suse.de> 406030 string \<SCRIBUSUTF8\ Version Scribus Document 406040 string \<SCRIBUSUTF8NEW\ Version Scribus Document 40605!:mime application/x-scribus 40606 40607# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 40608# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 406090 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 40610 40611# From: Joerg Jenderek 40612# URL: https://en.wikipedia.org/wiki/StarOffice 40613# Reference: http://mark0.net/download/triddefs_xml.7z 40614# /defs/t/thm-staroffice.trid.xml 40615# Note: used in Star-, Open- and Libre-Office 40616# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others 406170 ubeshort 0x0400 40618# non nil gap 40619#>(2.s+8) ubequad x \b, gap %#16.16llx 40620# test for null value in gap after theme name maybe unreliable 40621#>(2.s+9) ubyte 0 \b, 0-byte 40622# look for keyword GALRESRV near the end 40623# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects 40624#>0 search/8415 GALRESRV \b, GALRESRV found 40625# "neues thema6.thm" MorePictures, 315 objects 40626#>0 search/19299 GALRESRV \b, GALRESRV FOUND 40627#>2 uleshort x \b, name length %u 40628# skip file2147.chk by check for positive name length like for sg16.thm "3D" 40629>2 uleshort >0 40630# skip dBase printer form T6.PRF with misidentified gallery 40631# name :\DBASE\IV\T6.txts by check for 1st object name or RESRV keyword 40632# https://www.clicketyclick.dk/databases/xbase/xbase/dbase_ex.zip 40633# template/t6/with_data/T6.PRF 40634# by first char of object name or RESRV part of keyword GALRESRV 40635>>(2.s+13) ubyte >0x1F StarOffice Gallery theme 40636!:mime application/x-stargallery-thm 40637# thm is also used for JPEG thumbnail images 40638!:ext thm 40639# gallery name often 1 word like: 3D sounds Diagrams Flussdiagramme Fotos 40640# or like private://gallery/hidden/imgppt "Cisco - WAN - LAN" 40641>>>2 pstring/h x %s 40642# number of objects 40643>>>(2.s+4) ulelong x \b, %u object 40644# plural s 40645>>>(2.s+4) ulelong !1 \bs 40646# if available then display first object name 40647>>>(2.s+4) ulelong >0 40648# partial file name, URL or internal name like "dd2*" of 1st object or RESRV 40649>>>>(2.s+11) pstring/h x \b, 1st %s 40650 40651# From: Joerg Jenderek 40652# URL: http://fileformats.archiveteam.org/wiki/StarOffice_Gallery 40653# Note: used in Star-, Open- and Libre-Office and found in directories like 40654# %APPDATA%\Roaming\LibreOffice\4\user\gallery 40655# $HOME/.config/libreoffice/4/user/gallery 406560 string SGA3 StarOffice Gallery thumbnails 40657# Unknown like 0x04000?0001000142 40658#>4 ubequad x \b, UNKNOWN %#16.16llx 40659#!:mime application/x-sdg 40660!:mime application/x-stargallery-sdg 40661!:ext sdg 40662# display image magic for debugging purpose like 'BM' 40663# looking like PC bitmap, Windows 3.x format with unknown compression 40664#>11 string x \b, image magic '%-.2s' 40665# inspect 1st GALLERY thumbnail magic by ./images with 1 space at end 40666#>11 indirect x \b; contains 40667 40668 40669#------------------------------------------------------------------------------ 40670# $File: wsdl,v 1.6 2021/04/26 15:56:00 christos Exp $ 40671# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php 40672# Cache format extracted from source: 40673# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 40674# Requires file >= 5.05 40675# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 406760 string wsdl PHP WSDL cache, 40677>4 byte x version %#02x 40678>6 ledate x \b, created %s 40679 40680# uri 40681>10 lelong <0x7fffffff 40682>>10 pstring/l x \b, uri: "%s" 40683 40684# source 40685>>>&0 lelong <0x7fffffff 40686>>>>&-4 pstring/l x \b, source: "%s" 40687 40688# target_ns 40689>>>>>&0 lelong <0x7fffffff 40690>>>>>>&-4 pstring/l x \b, target_ns: "%s" 40691#------------------------------------------------------------------------------ 40692# x68000: file(1) magic for the Sharp Home Computer 40693# v1.0 40694# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 40695 40696# Yanagisawa PIC picture 406970 string PIC 40698>3 search/0x200 \x1A 40699>>&0 search/0x200 \x0 40700>>>&0 ubyte 0 Yanagisawa PIC image file, 40701>>>>&0 ubyte&15 0 model: X68000, 40702>>>>&0 ubyte&15 1 model: PC-88VA, 40703>>>>&0 ubyte&15 2 model: FM-TOWNS, 40704>>>>&0 ubyte&15 3 model: MAC, 40705>>>>&0 ubyte&15 15 model: Generic, 40706>>>>&3 ubeshort x %dx 40707>>>>&5 ubeshort x \b%d, 40708>>>>&1 ubeshort 4 colors: 16 40709>>>>&1 ubeshort 8 colors: 256 40710>>>>&1 ubeshort 12 colors: 4096 40711>>>>&1 ubeshort 15 colors: 32768 40712>>>>&1 ubeshort 16 colors: 65536 40713>>>>&1 ubeshort >16 colors: %d-bit 40714 40715 40716 40717#------------------------------------------------------------------------------ 40718# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 40719# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 40720# 407210 string %XDELTA% XDelta binary patch file 0.14 407220 string %XDZ000% XDelta binary patch file 0.18 407230 string %XDZ001% XDelta binary patch file 0.20 407240 string %XDZ002% XDelta binary patch file 1.0 407250 string %XDZ003% XDelta binary patch file 1.0.4 407260 string %XDZ004% XDelta binary patch file 1.1 40727 407280 string \xD6\xC3\xC4\x00 VCDIFF binary diff 40729 40730#------------------------------------------------------------------------------ 40731# $File: xenix,v 1.14 2021/04/26 15:56:00 christos Exp $ 40732# xenix: file(1) magic for Microsoft Xenix 40733# 40734# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 40735# model" lifted from "magic.xenix", with comment "derived empirically; 40736# treat as folklore until proven" 40737# 40738# "small model", "large model", "huge model" stuff lifted from XXX 40739# 40740# XXX - "x.out" collides with PDP-11 archives 40741# 407420 string core core file (Xenix) 40743# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 40744# http://fileformats.archiveteam.org/wiki/OMF 40745# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 40746# Update: Joerg Jenderek 40747# recordtype~TranslatorHEADerRecord 407480 byte 0x80 40749# GRR: line above is too general as it catches also Extensible storage engine DataBase, 40750# all lif files like forth.lif hpcc88.lif lex90b.lif ( See ./lif) 40751# and all compressed DEGAS low-res bitmaps like: MUNCHIE.PC1 PIDER1.PC1 40752# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 40753>1 uleshort <1022 40754# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length 40755>>1 uleshort >0 40756# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length 40757>>>3 ubyte >0 40758# skip examples like OMBRE.6 with "UUUUUU" name by looking for valid high second record type 40759>>>>(1.s+3) ubyte >0x6D 8086 relocatable (Microsoft) 40760#!:mime application/octet-stream 40761!:mime application/x-object 40762!:ext obj/o/a 40763# T-module name often source name like "hello.c" or "jmppm32.asm" in JMPPM32.OBJ or 40764# "kbhit" in KBHITS.OBJ or "CAUSEWAY_KERNAL" in CWAPI.OBJ 40765>>>>>3 pstring x \b, "%s" 40766# data length probably lower 256 according to TrID obj_omf.trid.xml 40767>>>>>1 uleshort x \b, 1st record data length %u 40768# checksum 40769#>>>>>(3.b+4) ubyte x \b, checksum %#2.2x 40770# second recordtype: 96h~LNAMES 88h~COMENT 8CH~EXTDEF 40771>>>>>(1.s+3) ubyte x \b, 2nd record type %#x 40772>>>>>(1.s+4) uleshort x \b, 2nd record data length %u 407730 leshort 0xff65 x.out 40774>2 string __.SYMDEF randomized 40775>0 byte x archive 407760 leshort 0x206 Microsoft a.out 40777>8 leshort 1 Middle model 40778>0x1e leshort &0x10 overlay 40779>0x1e leshort &0x2 separate 40780>0x1e leshort &0x4 pure 40781>0x1e leshort &0x800 segmented 40782>0x1e leshort &0x400 standalone 40783>0x1e leshort &0x8 fixed-stack 40784>0x1c byte &0x80 byte-swapped 40785>0x1c byte &0x40 word-swapped 40786>0x10 lelong >0 not-stripped 40787>0x1e leshort ^0xc000 pre-SysV 40788>0x1e leshort &0x4000 V2.3 40789>0x1e leshort &0x8000 V3.0 40790>0x1c byte &0x4 86 40791>0x1c byte &0xb 186 40792>0x1c byte &0x9 286 40793>0x1c byte &0xa 386 40794>0x1f byte <0x040 small model 40795>0x1f byte =0x048 large model 40796>0x1f byte =0x049 huge model 40797>0x1e leshort &0x1 executable 40798>0x1e leshort ^0x1 object file 40799>0x1e leshort &0x40 Large Text 40800>0x1e leshort &0x20 Large Data 40801>0x1e leshort &0x120 Huge Objects Enabled 40802>0x10 lelong >0 not stripped 40803 408040 leshort 0x140 old Microsoft 8086 x.out 40805>0x3 byte &0x4 separate 40806>0x3 byte &0x2 pure 40807>0 byte &0x1 executable 40808>0 byte ^0x1 relocatable 40809>0x14 lelong >0 not stripped 40810 408110 lelong 0x206 b.out 40812>0x1e leshort &0x10 overlay 40813>0x1e leshort &0x2 separate 40814>0x1e leshort &0x4 pure 40815>0x1e leshort &0x800 segmented 40816>0x1e leshort &0x400 standalone 40817>0x1e leshort &0x1 executable 40818>0x1e leshort ^0x1 object file 40819>0x1e leshort &0x4000 V2.3 40820>0x1e leshort &0x8000 V3.0 40821>0x1c byte &0x4 86 40822>0x1c byte &0xb 186 40823>0x1c byte &0x9 286 40824>0x1c byte &0x29 286 40825>0x1c byte &0xa 386 40826>0x1e leshort &0x4 Large Text 40827>0x1e leshort &0x2 Large Data 40828>0x1e leshort &0x102 Huge Objects Enabled 40829 408300 leshort 0x580 XENIX 8086 relocatable or 80286 small model 40831 40832#------------------------------------------------------------------------------ 40833# $File: xilinx,v 1.9 2021/04/26 15:56:00 christos Exp $ 40834# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 40835# Xilinx-Magic@RevRagnarok.com 40836# Got the info from FPGA-FAQ 0026 40837# 40838# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 40839# fixes at least reading of bitfiles from Spartan 2, 3, 6. 40840# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 40841# 40842# First there is the sync header and its length 408430 beshort 0x0009 40844>2 belong =0x0ff00ff0 40845>>&0 belong =0x0ff00ff0 40846>>>&0 byte =0x00 40847>>>&1 beshort =0x0001 40848>>>&3 string a Xilinx BIT data 40849# Next is a Pascal-style string with the NCD name. We want to capture that. 40850>>>>&0 pstring/H x - from %s 40851# And then 'b' 40852>>>>>&1 string b 40853# Then the model / part number: 40854>>>>>>&0 pstring/H x - for %s 40855# Then 'c' 40856>>>>>>>&1 string c 40857# Then the build-date 40858>>>>>>>>&0 pstring/H x - built %s 40859# Then 'd' 40860>>>>>>>>>&1 string d 40861# Then the build-time 40862>>>>>>>>>>&0 pstring/H x \b(%s) 40863# Then 'e' 40864>>>>>>>>>>>&1 string e 40865# And length of data 40866>>>>>>>>>>>>&0 belong x - data length %#x 40867 40868# Raw bitstream files 408690 long 0xffffffff 40870>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 40871 40872#------------------------------------------------------------------------------ 40873# $File: xo65,v 1.5 2022/07/17 15:36:20 christos Exp $ 40874# https://cc65.github.io/doc/sim65.html 40875# xo65 object files 40876# From: "Ullrich von Bassewitz" <uz@cc65.org> 40877# 408780 string \x55\x7A\x6E\x61 xo65 object, 40879>4 leshort x version %d, 40880>6 leshort&0x0001 =0x0001 with debug info 40881>6 leshort&0x0001 =0x0000 no debug info 40882 40883# xo65 library files 408840 string \x6E\x61\x55\x7A xo65 library, 40885>4 leshort x version %d 40886 40887# o65 object files 408880 string \x01\x00\x6F\x36\x35 o65 40889>6 leshort&0x1000 =0x0000 executable, 40890>6 leshort&0x1000 =0x1000 object, 40891>5 byte x version %d, 40892>6 leshort&0x8000 =0x8000 65816, 40893>6 leshort&0x8000 =0x0000 6502, 40894>6 leshort&0x2000 =0x2000 32 bit, 40895>6 leshort&0x2000 =0x0000 16 bit, 40896>6 leshort&0x4000 =0x4000 page reloc, 40897>6 leshort&0x4000 =0x0000 byte reloc, 40898>6 leshort&0x0003 =0x0000 alignment 1 40899>6 leshort&0x0003 =0x0001 alignment 2 40900>6 leshort&0x0003 =0x0002 alignment 4 40901>6 leshort&0x0003 =0x0003 alignment 256 40902 40903# sim65 executable files 409040 string \x73\x69\x6d\x36\x35 sim65 executable, 40905>5 byte x version %d, 40906>6 leshort&0x0000 =0x0000 6502 40907>6 leshort&0x0001 =0x0001 65C02 40908 40909#------------------------------------------------------------------------------ 40910# $File: xwindows,v 1.13 2022/03/24 15:48:58 christos Exp $ 40911# xwindows: file(1) magic for various X/Window system file formats. 40912 40913# Compiled X Keymap 40914# XKM (compiled X keymap) files (including version and byte ordering) 409151 string mkx Compiled XKB Keymap: lsb, 40916>0 byte >0 version %d 40917>0 byte =0 obsolete 409180 string xkm Compiled XKB Keymap: msb, 40919>3 byte >0 version %d 40920>3 byte =0 obsolete 40921 40922# xfsdump archive 409230 string xFSdump0 xfsdump archive 40924>8 belong x (version %d) 40925 40926# Jaleo XFS files 409270 long 395726 Jaleo XFS file 40928>4 long x - version %d 40929>8 long x - [%d - 40930>20 long x \b%dx 40931>24 long x \b%dx 40932>28 long 1008 \bYUV422] 40933>28 long 1000 \bRGB24] 40934 40935# Xcursor data 40936# X11 mouse cursor format defined in libXcursor, see 40937# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 40938# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 409390 string Xcur Xcursor data 40940!:mime image/x-xcursor 40941>10 leshort x version %d 40942>>8 leshort x \b.%d 40943 40944# X bitmap https://en.wikipedia.org/wiki/X_BitMap 409450 search/2048 #define\040 40946>&0 regex [a-zA-Z0-9]+_width\040 xbm image 40947>>&0 regex [0-9]+ (%sx 40948>>>&0 string \n#define\040 40949>>>>&0 regex [a-zA-Z0-9]+_height\040 40950>>>>>&0 regex [0-9]+ \b%s) 40951 40952 40953#------------------------------------------------------------------------------ 40954# $File: yara,v 1.4 2021/04/26 15:56:00 christos Exp $ 40955# yara: file(1) magic for https://virustotal.github.io/yara/ 40956# 40957 409580 string YARA 40959>4 lelong >2047 40960>8 byte <20 YARA 3.x compiled rule set 40961# version 40962>>8 clear x 40963>>8 byte 6 created with version 3.3.0 40964>>8 byte 8 created with version 3.4.0 40965>>8 byte 11 created with version 3.5.0 40966>>8 default x 40967>>>8 byte x development version %#02x 40968#------------------------------------------------------------------------------ 40969# zfs: file(1) magic for ZFS dumps 40970# 40971# From <rea-fbsd@codelabs.ru> 40972# ZFS dump header has the following structure (as per zfs_ioctl.h 40973# in FreeBSD with drr_type is set to DRR_BEGIN) 40974# 40975# enum { 40976# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 40977# DRR_WRITE, DRR_FREE, DRR_END, 40978# } drr_type; 40979# uint32_t drr_pad; 40980# uint64_t drr_magic; 40981# uint64_t drr_version; 40982# uint64_t drr_creation_time; 40983# dmu_objset_type_t drr_type; 40984# uint32_t drr_pad; 40985# uint64_t drr_toguid; 40986# uint64_t drr_fromguid; 40987# char drr_toname[MAXNAMELEN]; 40988# 40989# Backup magic is 0x00000002f5bacbac (quad word) 40990# The drr_type is defined as 40991# typedef enum dmu_objset_type { 40992# DMU_OST_NONE, 40993# DMU_OST_META, 40994# DMU_OST_ZFS, 40995# DMU_OST_ZVOL, 40996# DMU_OST_OTHER, /* For testing only! */ 40997# DMU_OST_ANY, /* Be careful! */ 40998# DMU_OST_NUMTYPES 40999# } dmu_objset_type_t; 41000# 41001# Almost all uint64_t fields are printed as the 32-bit ones (with high 41002# 32 bits zeroed), because there is no simple way to print them as the 41003# full 64-bit values. 41004 41005# Big-endian values 410068 string \000\000\000\002\365\272\313\254 ZFS snapshot (big-endian machine), 41007>20 belong x version %u, 41008>32 belong 0 type: NONE, 41009>32 belong 1 type: META, 41010>32 belong 2 type: ZFS, 41011>32 belong 3 type: ZVOL, 41012>32 belong 4 type: OTHER, 41013>32 belong 5 type: ANY, 41014>32 belong >5 type: UNKNOWN (%u), 41015>40 byte x destination GUID: %02X 41016>41 byte x %02X 41017>42 byte x %02X 41018>43 byte x %02X 41019>44 byte x %02X 41020>45 byte x %02X 41021>46 byte x %02X 41022>47 byte x %02X, 41023>48 ulong >0 41024>>52 ulong >0 41025>>>48 byte x source GUID: %02X 41026>>>49 byte x %02X 41027>>>50 byte x %02X 41028>>>51 byte x %02X 41029>>>52 byte x %02X 41030>>>53 byte x %02X 41031>>>54 byte x %02X 41032>>>55 byte x %02X, 41033>56 string >\0 name: '%s' 41034 41035# Little-endian values 410368 string \254\313\272\365\002\000\000\000 ZFS snapshot (little-endian machine), 41037>16 lelong x version %u, 41038>32 lelong 0 type: NONE, 41039>32 lelong 1 type: META, 41040>32 lelong 2 type: ZFS, 41041>32 lelong 3 type: ZVOL, 41042>32 lelong 4 type: OTHER, 41043>32 lelong 5 type: ANY, 41044>32 lelong >5 type: UNKNOWN (%u), 41045>47 byte x destination GUID: %02X 41046>46 byte x %02X 41047>45 byte x %02X 41048>44 byte x %02X 41049>43 byte x %02X 41050>42 byte x %02X 41051>41 byte x %02X 41052>40 byte x %02X, 41053>48 ulong >0 41054>>52 ulong >0 41055>>>55 byte x source GUID: %02X 41056>>>54 byte x %02X 41057>>>53 byte x %02X 41058>>>52 byte x %02X 41059>>>51 byte x %02X 41060>>>50 byte x %02X 41061>>>49 byte x %02X 41062>>>48 byte x %02X, 41063>56 string >\0 name: '%s' 41064 41065#------------------------------------------------------------------------------ 41066# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 41067# zilog: file(1) magic for Zilog Z8000. 41068# 41069# Was it big-endian or little-endian? My Product Specification doesn't 41070# say. 41071# 410720 long 0xe807 object file (z8000 a.out) 410730 long 0xe808 pure object file (z8000 a.out) 410740 long 0xe809 separate object file (z8000 a.out) 410750 long 0xe805 overlay object file (z8000 a.out) 41076#------------------------------------------------------------------------------ 41077# $File: zip,v 1.8 2021/10/24 15:53:56 christos Exp $ 41078# zip: file(1) magic for zip files; this is not use 41079# Note the version of magic in archive is currently stronger, this is 41080# just an example until negative offsets are supported better 41081# Note: All fields unless otherwise noted are unsigned! 41082 41083# Zip Central Directory record 410840 name zipcd 41085>0 string PK\001\002 Zip archive data 41086!:mime application/zip 41087# no "made by" in local file header with PK\3\4 magic 41088>>4 leshort x \b, made by 41089>>4 use zipversion 41090>>4 use ziphost 41091# inside ./archive 1.151 called "at least" zipversion "to extract" 41092>>6 leshort x \b, extract using at least 41093>>6 use zipversion 41094# This is DOS date like: ledate 21:00:48 19 Dec 2001 != DOS 00:00 1 Jan 2010 ~ 0000213C 41095>>12 ulelong x \b, last modified 41096>>14 lemsdosdate x \b, last modified %s 41097>>12 lemsdostime x %s 41098# uncompressed size of 1st entry; FFffFFff means real value stored in ZIP64 record 41099>>24 ulelong !0xFFffFFff \b, uncompressed size %u 41100# inside ./archive 1.151 called "compression method="zipcompression 41101>>10 leshort x \b, method= 41102>>10 use zipcompression 41103 41104# URL: https://en.wikipedia.org/wiki/Zip_(file_format) 41105# reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT (Version: 6.3.9) 41106# Zip known compressions 411070 name zipcompression 41108>0 leshort 0 \bstore 41109>0 leshort 1 \bShrinking 41110>0 leshort 6 \bImploding 41111>0 leshort 7 \bTokenizing 41112>0 leshort 8 \bdeflate 41113>0 leshort 9 \bdeflate64 41114>0 leshort 10 \bLibrary imploding 41115#>0 leshort 11 \bReserved by PKWARE 41116>0 leshort 12 \bbzip2 41117#>0 leshort 13 \bReserved by PKWARE 41118>0 leshort 14 \blzma 41119#>0 leshort 15 \bReserved by PKWARE 41120>0 leshort 16 \bCMPSC (IBM z/OS) 41121#>0 leshort 17 \bReserved by PKWARE 41122>0 leshort 18 \bIBM TERSE 41123>0 leshort 19 \bIBM LZ77 (z/Architecture) 41124>0 leshort 20 \bZstd (deprecated) 41125>0 leshort 93 \bZstd 41126>0 leshort 94 \bMP3 41127>0 leshort 95 \bxz 41128>0 leshort 96 \bJpeg 41129>0 leshort 97 \bWavPack 41130>0 leshort 98 \bPPMd 41131>0 leshort 99 \bAES Encrypted 41132>0 default x 41133>>0 leshort x \b[%#x] 41134 41135# Zip known versions 411360 name zipversion 41137# The lower byte indicates the ZIP version of this file. The value/10 indicates 41138# the major version number, and the value mod 10 is the minor version number. 41139>0 ubyte/10 x v%u 41140>0 ubyte%10 x \b.%u 41141# >0 leshort 0x09 v0.9 41142# >0 leshort 0x0a v1.0 41143# >0 leshort 0x0b v1.1 41144# >0 leshort 0x14 v2.0 41145# >0 leshort 0x15 v2.1 41146# >0 leshort 0x19 v2.5 41147# >0 leshort 0x1b v2.7 41148# >0 leshort 0x2d v4.5 41149# >0 leshort 0x2e v4.6 41150# >0 leshort 0x32 v5.0 41151# >0 leshort 0x33 v5.1 41152# >0 leshort 0x34 v5.2 41153# >0 leshort 0x3d v6.1 41154# >0 leshort 0x3e v6.2 41155# >0 leshort 0x3f v6.3 41156# >0 default x 41157# >>0 leshort x v?[%#x] 41158 41159# display compatible host system name of ZIP archive 411600 name ziphost 41161# The upper byte indicates the compatibility of the file attribute information. 41162# If the file is compatible with MS-DOS (v 2.04g) then this value will be zero. 41163#>1 ubyte 0 DOS 41164>1 ubyte 1 Amiga 41165>1 ubyte 2 OpenVMS 41166>1 ubyte 3 UNIX 41167>1 ubyte 4 VM/CMS 41168>1 ubyte 6 OS/2 41169>1 ubyte 7 Macintosh 41170>1 ubyte 11 MVS 41171>1 ubyte 13 Acorn Risc 41172>1 ubyte 16 BeOS 41173>1 ubyte 17 Tandem 41174# 9 untested 41175>1 ubyte 5 Atari ST 41176>1 ubyte 8 Z-System 41177>1 ubyte 9 CP/M 41178>1 ubyte 10 Windows NTFS 41179>1 ubyte 12 VSE 41180>1 ubyte 14 VFAT 41181>1 ubyte 15 alternate MVS 41182>1 ubyte 18 OS/400 41183>1 ubyte 19 OS X 41184# unused 41185#>1 ubyte >19 unused %#x 41186 41187# Zip End Of Central Directory record 41188# GRR: wrong for ZIP with comment archive 41189-22 string PK\005\006 41190#>4 uleshort !0xFFff \b, %u disks 41191#>6 uleshort !0xFFff \b, central directory disk %u 41192#>8 uleshort !0xFFff \b, %u central directories on this disk 41193#>10 uleshort !0xFFff \b, %u central directories 41194#>12 ulelong !0xFFffFFff \b, %u central directory bytes 41195# offset of central directory 41196#>16 ulelong x \b, central directory offset %#x 41197>(16.l) use zipcd 41198# archive comment length n 41199#>>20 uleshort >0 \b, comment length %u 41200# archive comment 41201>>20 pstring/l >0 \b, %s 41202 41203#------------------------------------------------------------------------------ 41204# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 41205# zyxel: file(1) magic for ZyXEL modems 41206# 41207# From <rob@pe1chl.ampr.org> 41208# These are the /etc/magic entries to decode datafiles as used for the 41209# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 41210# ZyXEL-defined standard) 41211 412120 string ZyXEL\002 ZyXEL voice data 41213>10 byte 0 - CELP encoding 41214>10 byte&0x0B 1 - ADPCM2 encoding 41215>10 byte&0x0B 2 - ADPCM3 encoding 41216>10 byte&0x0B 3 - ADPCM4 encoding 41217>10 byte&0x0B 8 - New ADPCM3 encoding 41218>10 byte&0x04 4 with resync 41219
