diff options
| author | obrien <obrien@FreeBSD.org> | 2006-06-19 07:52:15 +0000 |
|---|---|---|
| committer | obrien <obrien@FreeBSD.org> | 2006-06-19 07:52:15 +0000 |
| commit | 5c5b299c7d54da4b9c68e95d1f7a230405bd1ac2 (patch) | |
| tree | eba3401e66ba997d94604096d6095b69207f5d78 /contrib/file/Magdir | |
| parent | df11c7b63d4e785920524068f8f9cbdef5dc08ad (diff) | |
| download | FreeBSD-src-5c5b299c7d54da4b9c68e95d1f7a230405bd1ac2.zip FreeBSD-src-5c5b299c7d54da4b9c68e95d1f7a230405bd1ac2.tar.gz | |
Virgin import of Christos Zoulas's FILE 4.17.
Diffstat (limited to 'contrib/file/Magdir')
50 files changed, 2199 insertions, 498 deletions
diff --git a/contrib/file/Magdir/adventure b/contrib/file/Magdir/adventure index fb05cbe..405d3cc 100644 --- a/contrib/file/Magdir/adventure +++ b/contrib/file/Magdir/adventure @@ -12,27 +12,38 @@ 0 beshort 0x0206 ALAN game data >2 byte <10 version 2.6%d -# Conflicts with too much other stuff! -# Infocom -# (Note: to avoid false matches Z-machine version 1 and 2 are not -# recognized since only the oldest Zork I and II used them. Similarly -# there are 4 Infocom games that use version 4 that are not recognized.) -#0 byte 3 Infocom game data (Z-machine 3, -#>2 beshort <0x7fff Release %3d, -#>26 beshort >0 Size %d*2 -#>18 string >\0 Serial %.6s) -#0 byte 5 Infocom game data (Z-machine 5, -#>2 beshort <0x7fff Release %3d, -#>26 beshort >0 Size %d*4 -#>18 string >\0 Serial %.6s) -#0 byte 6 Infocom game data (Z-machine 6, -#>2 beshort <0x7fff Release %3d, -#>26 beshort >0 Size %d*8 -#>18 string >\0 Serial %.6s) -#0 byte 8 Infocom game data (Z-machine 8, -#>2 beshort <0x7fff Release %3d, -#>26 beshort >0 Size %d*8 -#>18 string >\0 Serial %.6s) + +# Infocom (see z-machine) +#------------------------------------------------------------------------------ +# Z-machine: file(1) magic for Z-machine binaries. +# +# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which +# appears to be a version-0 Z-machine binary. +# +# The (false match) message is to correct that behavior. Perhaps it is +# not needed. +# +16 belong&0xfe00f0f0 0x3030 Infocom game data +>0 ubyte 0 (false match) +>0 ubyte >0 (Z-machine %d, +>>2 ubeshort x Release %d / +>>18 string >\0 Serial %.6s) + +#------------------------------------------------------------------------------ +# Glulx: file(1) magic for Glulx binaries. +# +# I haven't checked for false matches yet. +# +0 string Glul Glulx game data +>4 beshort x (Version %d +>>6 byte x \b.%d +>>8 byte x \b.%d) +>36 string Info Compiled by Inform + + + +# For Quetzal and blorb magic see iff + # TADS (Text Adventure Development System) # All files are machine-independent (games compile to byte-code) and are tagged @@ -61,3 +72,4 @@ >10 belong !0x0A0D1A00 saved game data, CORRUPTED >10 belong 0x0A0D1A00 >>14 string >\0 %s saved game data + diff --git a/contrib/file/Magdir/amigaos b/contrib/file/Magdir/amigaos index ba2366c..bb98299 100644 --- a/contrib/file/Magdir/amigaos +++ b/contrib/file/Magdir/amigaos @@ -42,6 +42,9 @@ 0 beshort 0x0f03 AmigaOS outline font 0 belong 0x80001001 AmigaOS outline tag 0 string ##\ version catalog translation +0 string EMOD\0 Amiga E module +8 string ECXM\0 ECX module +0 string/c @database AmigaGuide file # Amiga disk types # @@ -54,3 +57,7 @@ 0 string DOS\4 Amiga Fastdir DOS disk 0 string DOS\5 Amiga Fastdir FFS disk 0 string KICK Kickstart disk + +# From: Alex Beregszaszi <alex@fsn.hu> +0 string LZX LZX compressed archive (Amiga) + diff --git a/contrib/file/Magdir/animation b/contrib/file/Magdir/animation index 08f92ae..95c842e 100644 --- a/contrib/file/Magdir/animation +++ b/contrib/file/Magdir/animation @@ -6,13 +6,58 @@ # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) +# SGI and Apple formats +0 string MOVI Silicon Graphics movie file +4 string moov Apple QuickTime +>12 string mvhd \b movie (fast start) +>12 string mdra \b URL +>12 string cmov \b movie (fast start, compressed header) +>12 string rmra \b multiple URLs +4 string mdat Apple QuickTime movie (unoptimized) +4 string wide Apple QuickTime movie (unoptimized) +4 string skip Apple QuickTime movie (modified) +4 string free Apple QuickTime movie (modified) +4 string idsc Apple QuickTime image (fast start) +4 string idat Apple QuickTime image (unoptimized) +4 string pckg Apple QuickTime compressed archive +4 string/B jP JPEG 2000 image +4 string ftyp ISO Media +>8 string isom \b, MPEG v4 system, version 1 +>8 string iso2 \b, MPEG v4 system, part 12 revision +>8 string mp41 \b, MPEG v4 system, version 1 +>8 string mp42 \b, MPEG v4 system, version 2 +>8 string mp7t \b, MPEG v4 system, MPEG v7 XML +>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML +>8 string/B jp2 \b, JPEG 2000 +>8 string 3gp \b, MPEG v4 system, 3GPP +>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) +>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) +>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) +>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile +>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC +>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC +>8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted +>8 string/B M4B \b, MPEG v4 system, iTunes bookmarked +>8 string/B qt \b, Apple QuickTime movie + # MPEG sequences # Scans for all common MPEG header start codes +0 belong 0x00000001 JVT NAL sequence +>4 byte&0x1F 0x07 \b, H.264 video +>>5 byte 66 \b, baseline +>>5 byte 77 \b, main +>>5 byte 88 \b, extended +>>7 byte x \b @ L %u 0 belong&0xFFFFFF00 0x00000100 MPEG sequence >3 byte 0xBA >>4 byte &0x40 \b, v2, program multiplex >>4 byte ^0x40 \b, v1, system multiplex >3 byte 0xBB \b, v1/2, multiplex (missing pack header) +>3 byte&0x1F 0x07 \b, H.264 video +>>4 byte 66 \b, baseline +>>4 byte 77 \b, main +>>4 byte 88 \b, extended +>>6 byte x \b @ L %u >3 byte 0xB0 \b, v4 >>5 belong 0x000001B5 >>>9 byte &0x80 @@ -20,11 +65,10 @@ >>>>10 byte&0xF0 32 \b, still texture >>>>10 byte&0xF0 48 \b, mesh >>>>10 byte&0xF0 64 \b, face ->>>9 byte ^0x80 ->>>>9 byte&0xF8 8 \b, video ->>>>9 byte&0xF8 16 \b, still texture ->>>>9 byte&0xF8 24 \b, mesh ->>>>9 byte&0xF8 32 \b, face +>>>9 byte&0xF8 8 \b, video +>>>9 byte&0xF8 16 \b, still texture +>>>9 byte&0xF8 24 \b, mesh +>>>9 byte&0xF8 32 \b, face >>4 byte 1 \b, simple @ L1 >>4 byte 2 \b, simple @ L2 >>4 byte 3 \b, simple @ L3 @@ -89,11 +133,10 @@ >>>5 byte&0xF0 32 \b, still texture (missing profile header) >>>5 byte&0xF0 48 \b, mesh (missing profile header) >>>5 byte&0xF0 64 \b, face (missing profile header) ->>4 byte ^0x80 ->>>4 byte&0xF8 8 \b, video (missing profile header) ->>>4 byte&0xF8 16 \b, still texture (missing profile header) ->>>4 byte&0xF8 24 \b, mesh (missing profile header) ->>>4 byte&0xF8 32 \b, face (missing profile header) +>>4 byte&0xF8 8 \b, video (missing profile header) +>>4 byte&0xF8 16 \b, still texture (missing profile header) +>>4 byte&0xF8 24 \b, mesh (missing profile header) +>>4 byte&0xF8 32 \b, face (missing profile header) >3 byte 0xB3 >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video @@ -131,23 +174,23 @@ >>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video >>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video >>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video ->>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video ->>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video ->>>76 belong 0x000001B5 \b, v2, ->>>80 byte&0x0F 1 \b HP ->>>80 byte&0x0F 2 \b Spt ->>>80 byte&0x0F 3 \b SNR ->>>80 byte&0x0F 4 \b MP ->>>80 byte&0x0F 5 \b SP ->>>81 byte&0xF0 64 \b@HL ->>>81 byte&0xF0 96 \b@H-14 ->>>81 byte&0xF0 128 \b@ML ->>>81 byte&0xF0 160 \b@LL ->>>81 byte &0x08 \b progressive ->>>81 byte ^0x08 \b interlaced ->>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video ->>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video ->>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>76 belong 0x000001B5 \b, v2, +>>>80 byte&0x0F 1 \b HP +>>>80 byte&0x0F 2 \b Spt +>>>80 byte&0x0F 3 \b SNR +>>>80 byte&0x0F 4 \b MP +>>>80 byte&0x0F 5 \b SP +>>>81 byte&0xF0 64 \b@HL +>>>81 byte&0xF0 96 \b@H-14 +>>>81 byte&0xF0 128 \b@ML +>>>81 byte&0xF0 160 \b@LL +>>>81 byte &0x08 \b progressive +>>>81 byte ^0x08 \b interlaced +>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video >>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P >>>7 byte&0xF0 0x10 \b, 16:9 >>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I @@ -234,13 +277,13 @@ >3 byte&0xC0 0x40 \b, JntStereo >3 byte&0xC0 0x80 \b, 2x Monaural >3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MP2, M1A 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 @@ -268,47 +311,51 @@ >3 byte&0xC0 0x40 \b, JntStereo >3 byte&0xC0 0x80 \b, 2x Monaural >3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MPA, M1A -0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1 +# modified by Joerg Jenderek +# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 +0 beshort&0xFFFE 0xFFFE +>2 byte&0xF0 >0x0F +>>2 byte&0xF0 <0xE1 MPEG ADTS, layer I, v1 # rate ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 64 kBits ->2 byte&0xF0 0x30 \b, 96 kBits ->2 byte&0xF0 0x40 \b, 128 kBits ->2 byte&0xF0 0x50 \b, 160 kBits ->2 byte&0xF0 0x60 \b, 192 kBits ->2 byte&0xF0 0x70 \b, 224 kBits ->2 byte&0xF0 0x80 \b, 256 kBits ->2 byte&0xF0 0x90 \b, 288 kBits ->2 byte&0xF0 0xA0 \b, 320 kBits ->2 byte&0xF0 0xB0 \b, 352 kBits ->2 byte&0xF0 0xC0 \b, 384 kBits ->2 byte&0xF0 0xD0 \b, 416 kBits ->2 byte&0xF0 0xE0 \b, 448 kBits +>>>2 byte&0xF0 0x10 \b, 32 kBits +>>>2 byte&0xF0 0x20 \b, 64 kBits +>>>2 byte&0xF0 0x30 \b, 96 kBits +>>>2 byte&0xF0 0x40 \b, 128 kBits +>>>2 byte&0xF0 0x50 \b, 160 kBits +>>>2 byte&0xF0 0x60 \b, 192 kBits +>>>2 byte&0xF0 0x70 \b, 224 kBits +>>>2 byte&0xF0 0x80 \b, 256 kBits +>>>2 byte&0xF0 0x90 \b, 288 kBits +>>>2 byte&0xF0 0xA0 \b, 320 kBits +>>>2 byte&0xF0 0xB0 \b, 352 kBits +>>>2 byte&0xF0 0xC0 \b, 384 kBits +>>>2 byte&0xF0 0xD0 \b, 416 kBits +>>>2 byte&0xF0 0xE0 \b, 448 kBits # timing ->2 byte&0x0C 0x00 \b, 44.1 kHz ->2 byte&0x0C 0x04 \b, 48 kHz ->2 byte&0x0C 0x08 \b, 32 kHz +>>>2 byte&0x0C 0x00 \b, 44.1 kHz +>>>2 byte&0x0C 0x04 \b, 48 kHz +>>>2 byte&0x0C 0x08 \b, 32 kHz # channels/options ->3 byte&0xC0 0x00 \b, Stereo ->3 byte&0xC0 0x40 \b, JntStereo ->3 byte&0xC0 0x80 \b, 2x Monaural ->3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +>>>3 byte&0xC0 0x00 \b, Stereo +>>>3 byte&0xC0 0x40 \b, JntStereo +>>>3 byte&0xC0 0x80 \b, 2x Monaural +>>>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MP3, M2A 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 @@ -336,13 +383,13 @@ >3 byte&0xC0 0x40 \b, JntStereo >3 byte&0xC0 0x80 \b, 2x Monaural >3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MP2, M2A 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 @@ -370,13 +417,13 @@ >3 byte&0xC0 0x40 \b, JntStereo >3 byte&0xC0 0x80 \b, 2x Monaural >3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MPA, M2A 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 @@ -404,13 +451,13 @@ >3 byte&0xC0 0x40 \b, JntStereo >3 byte&0xC0 0x80 \b, 2x Monaural >3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MP3, M25A 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 @@ -438,13 +485,13 @@ >3 byte&0xC0 0x40 \b, JntStereo >3 byte&0xC0 0x80 \b, 2x Monaural >3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # AAC (aka MPEG-2 NBC audio) and MPEG-4 audio @@ -474,13 +521,13 @@ # Live or stored single AAC stream (used with MPEG-2 systems) 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC ->1 byte ^0x08 \b, v2 ->1 byte &0x08 \b, v4 +>1 byte &0x08 \b, v2 +>1 byte ^0x08 \b, v4 # profile >>2 byte &0xC0 \b LTP ->2 byte&0xc0 0x00 \b, Main ->2 byte&0xc0 0x40 \b, LC ->2 byte&0xc0 0x80 \b, SSR +>2 byte&0xc0 0x00 \b Main +>2 byte&0xc0 0x40 \b LC +>2 byte&0xc0 0x80 \b SSR # timing >2 byte&0x3c 0x00 \b, 96 kHz >2 byte&0x3c 0x04 \b, 88.2 kHz @@ -494,7 +541,7 @@ >2 byte&0x3c 0x24 \b, 12 kHz >2 byte&0x3c 0x28 \b, 11.025 kHz >2 byte&0x3c 0x2c \b, 8 kHz -# channels/options +# channels >2 beshort&0x01c0 0x0040 \b, monaural >2 beshort&0x01c0 0x0080 \b, stereo >2 beshort&0x01c0 0x00c0 \b, stereo + center @@ -564,35 +611,6 @@ # \003. Most of them start with non-null values at hex offset 0x34 or so. #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 -# SGI formats -0 string MOVI Silicon Graphics movie file - -# Apple Quicktime and ISO types -4 string moov Apple QuickTime ->12 string mvhd \b movie (fast start) ->12 string mdra \b URL ->12 string cmov \b movie (fast start, compressed header) ->12 string rmra \b multiple URLs -4 string mdat Apple QuickTime movie (unoptimized) -4 string wide Apple QuickTime movie (unoptimized) -4 string skip Apple QuickTime movie (modified) -4 string free Apple QuickTime movie (modified) -4 string idsc Apple QuickTime image (fast start) -4 string idat Apple QuickTime image (unoptimized) -4 string pckg Apple QuickTime compressed archive -4 string/B jP JPEG 2000 image -4 string ftyp ISO Media ->8 string isom \b, MPEG v4 system ->8 string mp41 \b, MPEG v4 system, version 1 ->8 string mp42 \b, MPEG v4 system, version 2 ->8 string/B jp2 \b, JPEG 2000 image ->8 string 3gp \b, MPEG v4 system, 3GPP (H.263/AMR) ->8 string mmp4 \b, MPEG v4 system, Mobile ->8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC ->8 string/B M4P \b, MPEG v4 system, ISMA encrypted AAC-LC ->8 string/B M4B \b, MPEG v4 system, iTunes AAC-LC/AMR ->8 string/B qt \b, Apple QuickTime movie - # iso 13818 transport stream # # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) @@ -654,3 +672,9 @@ >0x26 ubeshort x %dµs, >0x42 ubeshort 0 no audio >0x42 ubeshort >0 %dHz audio + +# From: "Stefan A. Haubenthal" <polluks@web.de> +0 string DVDVIDEO-VTS Video title set, +>0x21 byte x v%x +0 string DVDVIDEO-VMG Video manager, +>0x21 byte x v%x diff --git a/contrib/file/Magdir/apple b/contrib/file/Magdir/apple index 2b0a290..6d2a07b 100644 --- a/contrib/file/Magdir/apple +++ b/contrib/file/Magdir/apple @@ -148,3 +148,44 @@ # information seems to be more useful. #0 long 0x45520200 #>0x410 string disk\ image UDIF read/write image (UDRW) + +# From: Toby Peterson <toby@apple.com> +0 string bplist00 Apple binary property list + +# Apple binary property list (bplist) +# Assumes version bytes are hex. +# Provides content hints for version 0 files. Assumes that the root +# object is the first object (true for CoreFoundation implementation). +# From: David Remahl <dremahl@apple.com> +0 string bplist +>6 byte x \bCoreFoundation binary property list data, version 0x%c +>>7 byte x \b%c +>6 string 00 \b +>>8 byte&0xF0 0x00 \b +>>>8 byte&0x0F 0x00 \b, root type: null +>>>8 byte&0x0F 0x08 \b, root type: false boolean +>>>8 byte&0x0F 0x09 \b, root type: true boolean +>>8 byte&0xF0 0x10 \b, root type: integer +>>8 byte&0xF0 0x20 \b, root type: real +>>8 byte&0xF0 0x30 \b, root type: date +>>8 byte&0xF0 0x40 \b, root type: data +>>8 byte&0xF0 0x50 \b, root type: ascii string +>>8 byte&0xF0 0x60 \b, root type: unicode string +>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) +>>8 byte&0xF0 0xa0 \b, root type: array +>>8 byte&0xF0 0xd0 \b, root type: dictionary + +# Apple/NeXT typedstream data +# Serialization format used by NeXT and Apple for various +# purposes in YellowStep/Cocoa, including some nib files. +# From: David Remahl <dremahl@apple.com> +2 string typedstream NeXT/Apple typedstream data, big endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 ubeshort x \b, system %hd +2 string streamtyped NeXT/Apple typedstream data, little endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 uleshort x \b, system %hd diff --git a/contrib/file/Magdir/archive b/contrib/file/Magdir/archive index 84a55a3..f60731b 100644 --- a/contrib/file/Magdir/archive +++ b/contrib/file/Magdir/archive @@ -29,12 +29,17 @@ # Debian package (needs to go before regular portable archives) # -0 string !<arch>\ndebian +0 string =!<arch>\ndebian >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package >68 string >\0 (format %s) ->81 string bz2 \b, uses bzip2 compression ->84 string gz \b, uses gzip compression +# These next two lines do not work, because a bzip2 Debian archive +# still uses gzip for the control.tar (first in the archive). Only +# data.tar varies, and the location of its filename varies too. +# file/libmagic does not current have support for ascii-string based +# (offsets) as of 2005-09-15. +#>81 string bz2 \b, uses bzip2 compression +#>84 string gz \b, uses gzip compression #>136 ledate x created: %s # other archives @@ -47,7 +52,7 @@ # MIPS archive (needs to go before regular portable archives) # -0 string !<arch>\n__________E MIPS archive +0 string =!<arch>\n__________E MIPS archive >20 string U with MIPS Ucode members >21 string L with MIPSEL members >21 string B with MIPSEB members @@ -61,7 +66,7 @@ # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: # -# 0 string !<arch> current ar archive +# 0 string =!<arch> current ar archive # 0 long 0x213c6172 archive file # # and for SVR1 archives, we have: @@ -73,7 +78,7 @@ # and absolute code program modules in the same format as new-style # "ar" archives? # -0 string !<arch> current ar archive +0 string =!<arch> current ar archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 @@ -121,17 +126,313 @@ 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched +# [JW] stuff taken from idarc, obviously ARC successors: +0 lelong&0x8080ffff 0x00000a1a PAK archive data +0 lelong&0x8080ffff 0x0000141a ARC+ archive data +0 lelong&0x8080ffff 0x0000481a HYP archive data # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff # [GRR: the original entries collide with ARC, above; replaced with combined # version (not tested)] -#0 byte 0x1a RISC OS archive -#>1 string archive (ArcFS format) -#0 string \032archive RISC OS archive (ArcFS format) -0 string \032 RISC OS archive (spark format) +#0 byte 0x1a RISC OS archive (spark format) +0 string \032archive RISC OS archive (ArcFS format) 0 string Archive\000 RISC OS archive (ArcFS format) +# All these were taken from idarc, many could not be verified. Unfortunately, +# there were many low-quality sigs, i.e. easy to trigger false positives. +# Please notify me of any real-world fishy/ambiguous signatures and I'll try +# to get my hands on the actual archiver and see if I find something better. [JW] +# probably many can be enhanced by finding some 0-byte or control char near the start + +# idarc calls this Crush/Uncompressed... *shrug* +0 string CRUSH Crush archive data +# Squeeze It (.sqz) +0 string HLSQZ Squeeze It archive data +# SQWEZ +0 string SQWEZ SQWEZ archive data +# HPack (.hpk) +0 string HPAK HPack archive data +# HAP +0 string \x91\x33HF HAP archive data +# MD/MDCD +0 string MDmd MDCD archive data +# LIM +0 string LIM\x1a LIM archive data +# SAR +3 string LH5 SAR archive data +# BSArc/BS2 +0 string \212\3SB \0 BSArc/BS2 archive data +# MAR +2 string =-ah MAR archive data +# ACB +0 belong&0x00f800ff 0x00800000 ACB archive data +# CPZ +# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data +# JRC +0 string JRchive JRC archive data +# Quantum +0 string DS\0 Quantum archive data +# ReSOF +0 string PK\3\6 ReSOF archive data +# QuArk +0 string 7\4 QuArk archive data +# YAC +14 string YC YAC archive data +# X1 +0 string X1 X1 archive data +0 string XhDr X1 archive data +# CDC Codec (.dqt) +0 belong&0xffffe000 0x76ff2000 CDC Codec archive data +# AMGC +0 string \xad6" AMGC archive data +# NuLIB +0 string NõFélå NuLIB archive data +# PakLeo +0 string LEOLZW PAKLeo archive data +# ChArc +0 string SChF ChArc archive data +# PSA +0 string PSA PSA archive data +# CrossePAC +0 string DSIGDCC CrossePAC archive data +# Freeze +0 string \x1f\x9f\x4a\x10\x0a Freeze archive data +# KBoom +0 string ¨MP¨ KBoom archive data +# NSQ, must go after CDC Codec +0 string \x76\xff NSQ archive data +# DPA +0 string Dirk\ Paehl DPA archive data +# BA +# TODO: idarc says "bytes 0-2 == bytes 3-5" +# TTComp +0 string \0\6 TTComp archive data +# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? +0 string ESP ESP archive data +# ZPack +0 string \1ZPK\1 ZPack archive data +# Sky +0 string \xbc\x40 Sky archive data +# UFA +0 string UFA UFA archive data +# Dry +0 string =-H2O DRY archive data +# FoxSQZ +0 string FOXSQZ FoxSQZ archive data +# AR7 +0 string ,AR7 AR7 archive data +# PPMZ +0 string PPMZ PPMZ archive data +# MS Compress +4 string \x88\xf0\x27 MS Compress archive data +# updated by Joerg Jenderek +>9 string \0 +>>0 string KWAJ +>>>7 string \321\003 MS Compress archive data +>>>>14 ulong >0 \b, original size: %ld bytes +>>>>18 ubyte >0x65 +>>>>>18 string x \b, was %.8s +>>>>>(10.b-4) string x \b.%.3s +# MP3 (archiver, not lossy audio compression) +0 string MP3\x1a MP3-Archiver archive data +# ZET +0 string OZÝ ZET archive data +# TSComp +0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data +# ARQ +0 string gW\4\1 ARQ archive data +# Squash +3 string OctSqu Squash archive data +# Terse +0 string \5\1\1\0 Terse archive data +# PUCrunch +0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data +# UHarc +0 string UHA UHarc archive data +# ABComp +0 string \2AB ABComp archive data +0 string \3AB2 ABComp archive data +# CMP +0 string CO\0 CMP archive data +# Splint +0 string \x93\xb9\x06 Splint archive data +# InstallShield +0 string \x13\x5d\x65\x8c InstallShield Z archive Data +# Gather +1 string GTH Gather archive data +# BOA +0 string BOA BOA archive data +# RAX +0 string ULEB\xa RAX archive data +# Xtreme +0 string ULEB\0 Xtreme archive data +# Pack Magic +0 string @â\1\0 Pack Magic archive data +# BTS +0 belong&0xfeffffff 0x1a034465 BTS archive data +# ELI 5750 +0 string Ora\ ELI 5750 archive data +# QFC +0 string \x1aFC\x1a QFC archive data +0 string \x1aQF\x1a QFC archive data +# PRO-PACK +0 string RNC PRO-PACK archive data +# 777 +0 string 777 777 archive data +# LZS221 +0 string sTaC LZS221 archive data +# HPA +0 string HPA HPA archive data +# Arhangel +0 string LG Arhangel archive data +# EXP1, uses bzip2 +0 string 0123456789012345BZh EXP1 archive data +# IMP +0 string IMP\xa IMP archive data +# NRV +0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data +# Squish +0 string \x73\xb2\x90\xf4 Squish archive data +# Par +0 string PHILIPP Par archive data +0 string PAR Par archive data +# HIT +0 string UB HIT archive data +# SBX +0 belong&0xfffff000 0x53423000 SBX archive data +# NaShrink +0 string NSK NaShrink archive data +# SAPCAR +0 string #\ CAR\ archive\ header SAPCAR archive data +0 string CAR\ 2.00RG SAPCAR archive data +# Disintegrator +0 string DST Disintegrator archive data +# ASD +0 string ASD ASD archive data +# InstallShield CAB +0 string ISc( InstallShield CAB +# TOP4 +0 string T4\x1a TOP4 archive data +# BatComp left out: sig looks like COM executable +# so TODO: get real 4dos batcomp file and find sig +# BlakHole +0 string BH\5\7 BlakHole archive data +# BIX +0 string BIX0 BIX archive data +# ChiefLZA +0 string ChfLZ ChiefLZA archive data +# Blink +0 string Blink Blink archive data +# Logitech Compress +0 string \xda\xfa Logitech Compress archive data +# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) +1 string (C)\ STEPANYUK ARS-Sfx archive data +# AKT/AKT32 +0 string AKT32 AKT32 archive data +0 string AKT AKT archive data +# NPack +0 string MSTSM NPack archive data +# PFT +0 string \0\x50\0\x14 PFT archive data +# SemOne +0 string SEM SemOne archive data +# PPMD +0 string \x8f\xaf\xac\x84 PPMD archive data +# FIZ +0 string FIZ FIZ archive data +# MSXiE +0 belong&0xfffff0f0 0x4d530000 MSXiE archive data +# DeepFreezer +0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data +# DC +0 string =<DC- DC archive data +# TPac +0 string \4TPAC\3 TPac archive data +# Ai +0 string Ai\1\1\0 Ai archive data +0 string Ai\1\0\0 Ai archive data +# Ai32 +0 string Ai\2\0 Ai32 archive data +0 string Ai\2\1 Ai32 archive data +# SBC +0 string SBC SBC archive data +# Ybs +0 string YBS Ybs archive data +# DitPack +0 string \x9e\0\0 DitPack archive data +# DMS +0 string DMS! DMS archive data +# EPC +0 string \x8f\xaf\xac\x8c EPC archive data +# VSARC +0 string VS\x1a VSARC archive data +# PDZ +0 string PDZ PDZ archive data +# ReDuq +0 string rdqx ReDuq archive data +# GCA +0 string GCAX GCA archive data +# PPMN +0 string pN PPMN archive data +# WinImage +3 string WINIMAGE WinImage archive data +# Compressia +0 string CMP0CMP Compressia archive data +# UHBC +0 string UHB UHBC archive data +# WinHKI +0 string \x61\x5C\x04\x05 WinHKI archive data +# WWPack data file +0 string WWP WWPack archive data +# BSN (BSA, PTS-DOS) +0 string \xffBSG BSN archive data +1 string \xffBSG BSN archive data +3 string \xffBSG BSN archive data +1 string \0\xae\2 BSN archive data +1 string \0\xae\3 BSN archive data +1 string \0\xae\7 BSN archive data +# AIN +0 string \x33\x18 AIN archive data +0 string \x33\x17 AIN archive data +# XPA32 +0 string xpa\0\1 XPA32 archive data +# SZip (TODO: doesn't catch all versions) +0 string SZ\x0a\4 SZip archive data +# XPack DiskImage +0 string jm XPack DiskImage archive data +# XPack Data +0 string xpa XPack archive data +# XPack Single Data +0 string Í\ jm XPack single archive data + +# TODO: missing due to unknown magic/magic at end of file: +#DWC +#ARG +#ZAR +#PC/3270 +#InstallIt +#RKive +#RK +#XPack Diskimage + +# These were inspired by idarc, but actually verified +# Dzip archiver (.dz) +0 string DZ Dzip archive data +>2 byte x \b, version %i +>3 byte x \b.%i +# ZZip archiver (.zz) +0 string ZZ\ \0\0 ZZip archive data +0 string ZZ0 ZZip archive data +# PAQ archiver (.paq) +0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data +0 string PAQ PAQ archive data +>3 byte&0xf0 0x30 +>>3 byte x (v%c) +# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) +0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data +0 string JARCS JAR (ARJ Software, Inc.) archive data + # ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data >5 byte x \b, v%d, @@ -150,6 +451,8 @@ >7 byte 8 os: NeXT >7 byte 9 os: VAX/VMS >3 byte >0 %d] +# [JW] idarc says this is also possible +2 leshort 0xea60 ARJ archive data # HA archiver (Greg Roelofs, newt@uchicago.edu) # This is a really bad format. A file containing HAWAII will match this... @@ -161,6 +464,15 @@ #>4 byte&0x0f =2 first is type HSC #>4 byte&0x0f =0x0e first is type DIR #>4 byte&0x0f =0x0f first is type SPECIAL +# suggestion: at least identify small archives (<1024 files) +0 belong&0xffff00fc 0x48410000 HA archive data +>2 leshort =1 1 file, +>2 leshort >1 %u files, +>4 byte&0x0f =0 first is type CPY +>4 byte&0x0f =1 first is type ASC +>4 byte&0x0f =2 first is type HSC +>4 byte&0x0f =0x0e first is type DIR +>4 byte&0x0f =0x0f first is type SPECIAL # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 0 string HPAK HPACK archive data @@ -174,12 +486,12 @@ >>0x36 string >\0 fstype %.8s # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) -2 string -lh0- LHarc 1.x archive data [lh0] -2 string -lh1- LHarc 1.x archive data [lh1] +2 string -lh0- LHarc 1.x/ARX archive data [lh0] +2 string -lh1- LHarc 1.x/ARX archive data [lh1] 2 string -lz4- LHarc 1.x archive data [lz4] 2 string -lz5- LHarc 1.x archive data [lz5] # [never seen any but the last; -lh4- reported in comp.compression:] -2 string -lzs- LHa 2.x? archive data [lzs] +2 string -lzs- LHa/LZS archive data [lzs] 2 string -lh\40- LHa 2.x? archive data [lh ] 2 string -lhd- LHa 2.x? archive data [lhd] 2 string -lh2- LHa 2.x? archive data [lh2] @@ -187,8 +499,12 @@ 2 string -lh4- LHa (2.x) archive data [lh4] 2 string -lh5- LHa (2.x) archive data [lh5] 2 string -lh6- LHa (2.x) archive data [lh6] -2 string -lh7- LHa (2.x) archive data [lh7] +2 string -lh7- LHa (2.x)/LHark archive data [lh7] >20 byte x - header level %d +# taken from idarc [JW] +2 string -lZ PUT archive data +2 string -lz LZS archive data +2 string -sw1- Swag archive data # RAR archiver (Greg Roelofs, newt@uchicago.edu) 0 string Rar! RAR archive data, @@ -197,20 +513,77 @@ >35 byte 1 os: OS/2 >35 byte 2 os: Win32 >35 byte 3 os: Unix +# some old version? idarc says: +0 string RE\x7e\x5e RAR archive data # SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 0 string SQSH squished archive data (Acorn RISCOS) # UC2 archiver (Greg Roelofs, newt@uchicago.edu) -# I can't figure out the self-extracting form of these buggers... +# [JW] see exe section for self-extracting version 0 string UC2\x1a UC2 archive data # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) -0 string PK\003\004 Zip archive data ->4 byte 0x09 \b, at least v0.9 to extract ->4 byte 0x0a \b, at least v1.0 to extract ->4 byte 0x0b \b, at least v1.1 to extract ->4 byte 0x14 \b, at least v2.0 to extract +0 string PK\003\004 +>4 byte 0x09 Zip archive data, at least v0.9 to extract +>4 byte 0x0a Zip archive data, at least v1.0 to extract +>4 byte 0x0b Zip archive data, at least v1.1 to extract +>4 byte 0x14 +>>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract + +# OpenOffice.org / KOffice / StarOffice documents +# From: Abel Cheung <abel@oaka.org> +# Listed here because they are basically zip files +>>30 string mimetype + +# KOffice (1.2 or above) formats +>>>50 string vnd.kde. KOffice (>=1.2) +>>>>58 string karbon Karbon document +>>>>58 string kchart KChart document +>>>>58 string kformula KFormula document +>>>>58 string kivio Kivio document +>>>>58 string kontour Kontour document +>>>>58 string kpresenter KPresenter document +>>>>58 string kspread KSpread document +>>>>58 string kword KWord document + +# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) +>>>50 string vnd.sun.xml. OpenOffice.org 1.x +>>>>62 string writer Writer +>>>>>68 byte !0x2e document +>>>>>68 string .template template +>>>>>68 string .global global document +>>>>62 string calc Calc +>>>>>66 byte !0x2e spreadsheet +>>>>>66 string .template template +>>>>62 string draw Draw +>>>>>66 byte !0x2e document +>>>>>66 string .template template +>>>>62 string impress Impress +>>>>>69 byte !0x2e presentation +>>>>>69 string .template template +>>>>62 string math Math document + +# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +# http://lists.oasis-open.org/archives/office/200505/msg00006.html +>>>50 string vnd.oasis.opendocument. OpenDocument +>>>>73 string text +>>>>>77 byte !0x2d Text +>>>>>77 string -template Text Template +>>>>>77 string -web HTML Document Template +>>>>>77 string -master Master Document +>>>>73 string graphics Drawing +>>>>>81 string -template Template +>>>>73 string presentation Presentation +>>>>>85 string -template Template +>>>>73 string spreadsheet Spreadsheet +>>>>>84 string -template Template +>>>>73 string chart Chart +>>>>>78 string -template Template +>>>>73 string formula Formula +>>>>>80 string -template Template +>>>>73 string database Database +>>>>73 string image Image # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data @@ -284,7 +657,7 @@ # ACE archive (from http://www.wotsit.org/download.asp?f=ace) # by Stefan `Sec` Zehl <sec@42.org> -7 string **ACE** ACE compressed archive +7 string **ACE** ACE archive data >15 byte >0 version %d >16 byte =0x00 \b, from MS-DOS >16 byte =0x01 \b, from OS/2 @@ -306,7 +679,7 @@ >5 leshort &0x0400 \b, small dictionary >5 leshort &0x0800 \b, multi-volume >5 leshort &0x1000 \b, contains AV-String ->>30 string\x16*UNREGISTERED\x20VERSION* (unregistered) +>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) >5 leshort &0x2000 \b, with recovery record >5 leshort &0x4000 \b, locked >5 leshort &0x8000 \b, solid @@ -320,3 +693,10 @@ >>0x1 string >\0 Version %s >>0x2A string >\0 : %s +# DR-DOS 7.03 Packed File *.??_ +0 string Packed\ File\ Personal NetWare Packed File +>12 string x \b, was "%.12s" + +# EET archive +# From: Tilman Sauerbeck <tilman@code-monkey.de> +0 belong 0x1ee7ff00 EET archive diff --git a/contrib/file/Magdir/audio b/contrib/file/Magdir/audio index ccdf14c..252a9de 100644 --- a/contrib/file/Magdir/audio +++ b/contrib/file/Magdir/audio @@ -131,7 +131,7 @@ 0 string Extended\ Module: Fasttracker II module sound data >17 string >\0 Title: "%s" -21 string/c !SCREAM! Screamtracker 2 module sound data +21 string/c =!SCREAM! Screamtracker 2 module sound data 21 string BMOD2STM Screamtracker 2 module sound data 1080 string M.K. 4-channel Protracker module sound data >0 string >\0 Title: "%s" @@ -236,7 +236,7 @@ >122 byte&0x1 =1 PAL >122 byte&0x1 =0 NTSC -# Impuse tracker module (audio/x-it) +# Impulse tracker module (audio/x-it) 0 string IMPM Impulse Tracker module sound data - >4 string >\0 "%s" >40 leshort !0 compatible w/ITv%x @@ -399,13 +399,83 @@ # From "Simon Hosie 0 string TFMX-SONG TFMX module sound data +# Monkey's Audio compressed audio format (.ape) # From danny.milo@gmx.net (Danny Milosavljevic) -# monkeysaudio for magic.mime -0 string MAC\ X/Monkey audio, ->4 leshort >0 version %d, ->6 leshort >0 compression level %d, ->8 leshort >0 flags %x, ->10 leshort >0 channels %d, ->12 lelong >0 samplerate %d, ->24 lelong >0 frames %d - +# New version from Abel Cheung <abel (@) oaka.org> +0 string MAC\040 Monkey's Audio compressed format +>4 uleshort >0x0F8B version %d +>>(0x08.l) uleshort =1000 with fast compression +>>(0x08.l) uleshort =2000 with normal compression +>>(0x08.l) uleshort =3000 with high compression +>>(0x08.l) uleshort =4000 with extra high compression +>>(0x08.l) uleshort =5000 with insane compression +>>(0x08.l+18) uleshort =1 \b, mono +>>(0x08.l+18) uleshort =2 \b, stereo +>>(0x08.l+20) ulelong x \b, sample rate %d +>4 uleshort <0x0F8C version %d +>>6 uleshort =1000 with fast compression +>>6 uleshort =2000 with normal compression +>>6 uleshort =3000 with high compression +>>6 uleshort =4000 with extra high compression +>>6 uleshort =5000 with insane compression +>>10 uleshort =1 \b, mono +>>10 uleshort =2 \b, stereo +>>12 ulelong x \b, sample rate %d + +# adlib sound files +# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu +0 string RAWADATA RdosPlay RAW + +1068 string RoR AMUSIC Adlib Tracker + +0 string JCH EdLib + +0 string mpu401tr MPU-401 Trakker + +0 string SAdT Surprise! Adlib Tracker +>4 byte x Version %d + +0 string XAD! eXotic ADlib + +0 string ofTAZ! eXtra Simple Music + +# Spectrum 128 tunes (.ay files). +# From: Emanuel Haupt <ehaupt@critical.ch> +0 string ZXAYEMUL Spectrum 128 tune + +# From: Alex Beregszaszi <alex@fsn.hu> +0 string MP+ Musepack +>3 byte&0x0f x SV%d + +0 string \0BONK BONK, +#>5 byte x version %d +>14 byte x %d channel(s), +>15 byte =1 lossless, +>15 byte =0 lossy, +>16 byte x mid-side + +384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) + +# format VQF (proprietary codec for sound) +# some infos on the header file available at : +# http://www.twinvq.org/english/technology_format.html +0 string TWIN97012000 VQF data +>27 short 0 \b, Mono +>27 short 1 \b, Stereo +>31 short >0 \b, %d kbit/s +>35 short >0 \b, %d kHz + +# Nelson A. de Oliveira (naoliv@gmail.com) +# .eqf +0 string Winamp\ EQ\ library\ file %s +# it will match only versions like v<digit>.<digit> +# Since I saw only eqf files with version v1.1 I think that it's OK +>23 string x \b%.4s +# .preset +0 string \[Equalizer\ preset\] XMMS equalizer preset +# .m3u +0 string \#EXTM3U M3U playlist +# .pls +0 string \[playlist\] PLS playlist +# licq.conf +1 string \[licq\] LICQ configuration file diff --git a/contrib/file/Magdir/basis b/contrib/file/Magdir/basis new file mode 100644 index 0000000..1813c0e --- /dev/null +++ b/contrib/file/Magdir/basis @@ -0,0 +1,16 @@ +#---------------------------------------------------------------- +# basis: file(1) magic for BBx/Pro5-files +# Oliver Dammer <dammer@olida.de> 2005/11/07 +# http://www.basis.com business-basic-files. +# +0 string \074\074bbx\076\076 BBx +>7 string \000 indexed file +>7 string \001 serial file +>7 string \002 keyed file +>>13 short 0 (sort) +>7 string \004 program +>>18 byte x (LEVEL %d) +>>>23 string >\000 psaved +>7 string \006 mkeyed file +>>13 short 0 (sort) +>>8 string \000 (mkey) diff --git a/contrib/file/Magdir/bflt b/contrib/file/Magdir/bflt new file mode 100644 index 0000000..5e288d1 --- /dev/null +++ b/contrib/file/Magdir/bflt @@ -0,0 +1,12 @@ +#------------------------------------------------------------------------------ +# bFLT: file(1) magic for BFLT uclinux binary files +# +# From Philippe De Muyter <phdm@macqel.be> +# +0 string bFLT BFLT executable +>4 belong x - version %ld +>4 belong 4 +>>36 belong&0x1 0x1 ram +>>36 belong&0x2 0x2 gotpic +>>36 belong&0x4 0x4 gzip +>>36 belong&0x8 0x8 gzdata diff --git a/contrib/file/Magdir/bout b/contrib/file/Magdir/bout index ab771fe..4cd6f76 100644 --- a/contrib/file/Magdir/bout +++ b/contrib/file/Magdir/bout @@ -5,5 +5,5 @@ >16 long >0 not stripped # # b.out archive (hp-rt on i960) -0 string !<bout> b.out archive +0 string =!<bout> b.out archive >8 string __.SYMDEF random library diff --git a/contrib/file/Magdir/btsnoop b/contrib/file/Magdir/btsnoop new file mode 100644 index 0000000..85d867a --- /dev/null +++ b/contrib/file/Magdir/btsnoop @@ -0,0 +1,11 @@ +#------------------------------------------------------------------------------ +# BTSnoop: file(1) magic for BTSnoop files +# +# From <marcel@holtmann.org> +0 string btsnoop\0 BTSnoop +>8 belong x version %d, +>12 belong 1001 Unencapsulated HCI +>12 belong 1002 HCI UART (H4) +>12 belong 1003 HCI BCSP +>12 belong 1004 HCI Serial (H5) +>>12 belong x type %d diff --git a/contrib/file/Magdir/c64 b/contrib/file/Magdir/c64 index 4ca143f..a224b21 100644 --- a/contrib/file/Magdir/c64 +++ b/contrib/file/Magdir/c64 @@ -2,7 +2,7 @@ #------------------------------------------------------------------------------ # c64: file(1) magic for various commodore 64 related files # -# From <doj@cubic.org> +# From: Dirk Jagdmann <doj@cubic.org> 0x16500 belong 0x12014100 D64 Image 0x16500 belong 0x12014180 D71 Image @@ -11,7 +11,7 @@ 0 belong 0x43154164 X64 Image 0 string GCR-1541 GCR Image ->8 byte x version: $i +>8 byte x version: %i >9 byte x tracks: %i 9 string PSUR ARC archive (c64) @@ -25,3 +25,18 @@ 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 0 belong 0xFF424CFF WRAptor packer (c64) + +0 string C64S\x20tape\x20file T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s diff --git a/contrib/file/Magdir/cad b/contrib/file/Magdir/cad index 92aa837..0326340 100644 --- a/contrib/file/Magdir/cad +++ b/contrib/file/Magdir/cad @@ -11,7 +11,7 @@ >5 string \064\000\000\000\000 DWG ver. R14 # Microstation DGN/CIT Files (www.bentley.com) -# Written October 30, 2003 by Lester Hightower +# Last updated July 29, 2005 by Lester Hightower # DGN is the default file extension of Microstation/Intergraph CAD files. # CIT is the proprietary raster format (similar to TIFF) used to attach # raster underlays to Microstation DGN (vector) drawings. @@ -24,13 +24,31 @@ # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F -0 string \010\011\376 Microstation ->3 string \002 ->>30 string \372\104 DGN File ->>30 string \172\104 DGN File ->>30 string \026\105 DGN File ->4 string \030\000\000 CIT File +0 string \010\011\376 Microstation +>3 string \002 +>>30 string \026\105 DGNFile +>>30 string \034\105 DGNFile +>>30 string \073\107 DGNFile +>>30 string \073\110 DGNFile +>>30 string \106\107 DGNFile +>>30 string \110\103 DGNFile +>>30 string \120\104 DGNFile +>>30 string \172\104 DGNFile +>>30 string \172\105 DGNFile +>>30 string \234\106 DGNFile +>>30 string \273\105 DGNFile +>>30 string \306\106 DGNFile +>>30 string \310\104 DGNFile +>>30 string \341\104 DGNFile +>>30 string \372\103 DGNFile +>>30 string \372\104 DGNFile +>>30 string \372\106 DGNFile +>>30 string \376\103 DGNFile +>4 string \030\000\000 CITFile +>4 string \030\000\003 CITFile # AutoCad, from Nahuel Greco +# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 0 string AC1012 AutoCad (release 12) +0 string AC1013 AutoCad (release 13) 0 string AC1014 AutoCad (release 14) diff --git a/contrib/file/Magdir/commands b/contrib/file/Magdir/commands index 93244b8..2464984 100644 --- a/contrib/file/Magdir/commands +++ b/contrib/file/Magdir/commands @@ -27,7 +27,8 @@ # 0 string/b #!\ /bin/awk awk script text executable 0 string/b #!\ /usr/bin/awk awk script text executable -0 string BEGIN awk script text +# update to distinguish from *.vcf files +0 regex BEGIN[[:space:]]*[{] awk script text # AT&T Bell Labs' Plan 9 shell 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable diff --git a/contrib/file/Magdir/compress b/contrib/file/Magdir/compress index 71e689c..e9be46b 100644 --- a/contrib/file/Magdir/compress +++ b/contrib/file/Magdir/compress @@ -22,22 +22,28 @@ >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII ->3 byte &0x02 \b, continuation +>3 byte &0x02 \b, has CRC >3 byte &0x04 \b, extra field >3 byte&0xC =0x08 >>10 string x \b, was "%s" ->9 byte =0x00 \b, from MS-DOS +>3 byte &0x10 \b, has comment +>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) >9 byte =0x01 \b, from Amiga >9 byte =0x02 \b, from VMS >9 byte =0x03 \b, from Unix +>9 byte =0x04 \b, from VM/CMS >9 byte =0x05 \b, from Atari ->9 byte =0x06 \b, from OS/2 +>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) >9 byte =0x07 \b, from MacOS ->9 byte =0x0A \b, from Tops/20 ->9 byte =0x0B \b, from Win/32 +>9 byte =0x08 \b, from Z-System +>9 byte =0x09 \b, from CP/M +>9 byte =0x0A \b, from TOPS/20 +>9 byte =0x0B \b, from NTFS filesystem (NT) +>9 byte =0x0C \b, from QDOS +>9 byte =0x0D \b, from Acorn RISCOS >3 byte &0x10 \b, comment >3 byte &0x20 \b, encrypted -### >4 ledate x last modified: %s, +>4 ledate >0 \b, last modified: %s >8 byte 2 \b, max compression >8 byte 4 \b, max speed @@ -161,12 +167,23 @@ >4 belong 0x090A0C0C very good compression >4 belong 0x090A0C0D best compression -# 7z archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) +# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) # http://www.7-zip.org or DOC/7zFormat.txt # -0 string 7z\274\257\047\034 7z archive data, +0 string 7z\274\257\047\034 7-zip archive data, >6 byte x version %d >7 byte x \b.%d # AFX compressed files (Wolfram Kleff) 2 string -afx- AFX compressed file data + +# Supplementary magic data for the file(1) command to support +# rzip(1). The format is described in magic(5). +# +# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with +# this file. +# +0 string RZIP rzip compressed data +>4 byte x - version %d +>5 byte x \b.%d +>6 belong x (%d bytes) diff --git a/contrib/file/Magdir/console b/contrib/file/Magdir/console index fdad7c4..65fe327 100644 --- a/contrib/file/Magdir/console +++ b/contrib/file/Magdir/console @@ -161,37 +161,7 @@ >2 beshort x RAM start $%04x >6 string BS93 -#------------------------------------------------------------------------------ -# Z-machine: file(1) magic for Z-machine binaries. -# -# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which -# appears to be a version-0 Z-machine binary. -# -# The (false match) message is to correct that behavior. Perhaps it is -# not needed. -# ->16 belong&0xfe00f0f0 0x3030 Infocom game data ->0 ubyte 0 (false match) ->0 ubyte >0 (Z-machine %d, ->>2 ubeshort x Release %d / ->>18 string >\0 Serial %.6s) - -#------------------------------------------------------------------------------ -# Glulx: file(1) magic for Glulx binaries. -# -# I haven't checked for false matches yet. -# -0 string Glul Glulx game data - - - -# These go at the end of the iff rules -# -# I don't see why these might collide with anything else. -# -# Interactive Fiction related formats -# ->8 string IFRS \b, Blorb Interactive Fiction ->>24 string Exec with executable chunk ->8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) +# Opera file system that is used on the 3DO console +# From: Serge van den Boom <svdb@stack.nl> +0 string \x01ZZZZZ\x01 3DO "Opera" file system diff --git a/contrib/file/Magdir/cracklib b/contrib/file/Magdir/cracklib new file mode 100644 index 0000000..8f7e0d4 --- /dev/null +++ b/contrib/file/Magdir/cracklib @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# cracklib: file (1) magic for cracklib v2.7 + +0 lelong 0x70775631 Cracklib password index, little endian +>4 long >0 (%i words) +>4 long 0 ("64-bit") +>>8 long >-1 (%i words) +0 belong 0x70775631 Cracklib password index, big endian +>4 belong >-1 (%i words) +# really bellong 0x0000000070775631 +4 belong 0x70775631 Cracklib password index, big endian ("64-bit") +>12 belong >0 (%i words) diff --git a/contrib/file/Magdir/ctags b/contrib/file/Magdir/ctags index 5c039e7..84c5b7f 100644 --- a/contrib/file/Magdir/ctags +++ b/contrib/file/Magdir/ctags @@ -2,4 +2,4 @@ # ---------------------------------------------------------------------------- # ctags: file (1) magic for Exuberant Ctags files # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> -0 string !_TAG Exuberant Ctags tag file text +0 string =!_TAG Exuberant Ctags tag file text diff --git a/contrib/file/Magdir/database b/contrib/file/Magdir/database index f31aee5..b2f68d9 100644 --- a/contrib/file/Magdir/database +++ b/contrib/file/Magdir/database @@ -67,6 +67,15 @@ >16 belong >0 (Queue, version %d, big-endian) 12 lelong 0x00042253 Berkeley DB >16 lelong >0 (Queue, version %d, little-endian) + +# From Max Bowsher. +12 long 0x00040988 Berkeley DB +>16 long >0 (Log, version %d, native byte-order) +12 belong 0x00040988 Berkeley DB +>16 belong >0 (Log, version %d, big-endian) +12 lelong 0x00040988 Berkeley DB +>16 lelong >0 (Log, version %d, little-endian) + # # # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> @@ -201,3 +210,7 @@ 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data + +# SQLite (Ty Sarna) +0 string **\ This\ file\ contains\ an\ SQLite SQLite Database +>&1 regex [^\ ]+ Version %s diff --git a/contrib/file/Magdir/diff b/contrib/file/Magdir/diff index 9e65146..187e892 100644 --- a/contrib/file/Magdir/diff +++ b/contrib/file/Magdir/diff @@ -6,3 +6,5 @@ 0 string ***\ 'diff' output text 0 string Only\ in\ 'diff' output text 0 string Common\ subdirectories:\ 'diff' output text + +0 string Index: RCS/CVS diff output text diff --git a/contrib/file/Magdir/digital b/contrib/file/Magdir/digital index 6a573a6..615ef7a 100644 --- a/contrib/file/Magdir/digital +++ b/contrib/file/Magdir/digital @@ -1,6 +1,6 @@ # Digital UNIX - Info # -0 string !<arch>\n________64E Alpha archive +0 string =!<arch>\n________64E Alpha archive >22 string X -- out of date # # Alpha COFF Based Executables @@ -32,7 +32,7 @@ 0 string \033c\033 LN03 output 0 long 04553207 X image # -0 string !<PDF>!\n profiling data file +0 string =!<PDF>!\n profiling data file # # Locale data tables (MIPS and Alpha). # diff --git a/contrib/file/Magdir/dump b/contrib/file/Magdir/dump index 628ead8..addd954 100644 --- a/contrib/file/Magdir/dump +++ b/contrib/file/Magdir/dump @@ -79,3 +79,15 @@ >760 string >\0 Device %s, >824 string >\0 Host %s, >888 lelong >0 Flags %x + +18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), +>2 medate x Previous dump %s, +>6 medate x This dump %s, +>10 leshort >0 Volume %ld, +>0 leshort 1 tape header. +>0 leshort 2 beginning of file record. +>0 leshort 3 map of inodes on tape. +>0 leshort 4 continuation of file record. +>0 leshort 5 end of volume. +>0 leshort 6 map of inodes deleted. +>0 leshort 7 end of medium (for floppy). diff --git a/contrib/file/Magdir/elf b/contrib/file/Magdir/elf index 1dee0bd..9b559b1 100644 --- a/contrib/file/Magdir/elf +++ b/contrib/file/Magdir/elf @@ -11,22 +11,39 @@ 0 string \177ELF ELF >4 byte 0 invalid class >4 byte 1 32-bit -# only for MIPS - in the future, the ABI field of e_flags should be used. ->>18 leshort 8 ->>>36 lelong &0x20 N32 ->>18 leshort 10 ->>>36 lelong &0x20 N32 ->>18 beshort 8 ->>>36 belong &0x20 N32 ->>18 beshort 10 ->>>36 belong &0x20 N32 >4 byte 2 64-bit >5 byte 0 invalid byte order >5 byte 1 LSB +>>16 leshort 0 no file type, +>>16 leshort 1 relocatable, +>>16 leshort 2 executable, +>>16 leshort 3 shared object, +# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> +# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> +>>16 leshort 4 core file +# Core file detection is not reliable. +#>>>(0x38+0xcc) string >\0 of '%s' +#>>>(0x38+0x10) lelong >0 (signal %d), +>>16 leshort &0xff00 processor-specific, +>>18 leshort 0 no machine, +>>18 leshort 1 AT&T WE32100 - invalid byte order, +>>18 leshort 2 SPARC - invalid byte order, +>>18 leshort 3 Intel 80386, +>>18 leshort 4 Motorola +>>>36 lelong &0x01000000 68000 - invalid byte order, +>>>36 lelong &0x00810000 CPU32 - invalid byte order, +>>>36 lelong 0 68020 - invalid byte order, +>>18 leshort 5 Motorola 88000 - invalid byte order, +>>18 leshort 6 Intel 80486, +>>18 leshort 7 Intel 80860, # The official e_machine number for MIPS is now #8, regardless of endianness. # The second number (#10) will be deprecated later. For now, we still # say something if #10 is encountered, but only gory details for #8. ->>18 leshort 8 +>>18 leshort 8 MIPS, +>>>36 lelong &0x20 N32 +>>18 leshort 10 MIPS, +>>>36 lelong &0x20 N32 +>>18 leshort 8 # only for 32-bit >>>4 byte 1 >>>>36 lelong&0xf0000000 0x00000000 MIPS-I @@ -49,29 +66,6 @@ >>>>48 lelong&0xf0000000 0x70000000 MIPS64 >>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2 >>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2 ->>16 leshort 0 no file type, ->>16 leshort 1 relocatable, ->>16 leshort 2 executable, ->>16 leshort 3 shared object, -# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> -# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> ->>16 leshort 4 core file -# Core file detection is not reliable. -#>>>(0x38+0xcc) string >\0 of '%s' -#>>>(0x38+0x10) lelong >0 (signal %d), ->>16 leshort &0xff00 processor-specific, ->>18 leshort 0 no machine, ->>18 leshort 1 AT&T WE32100 - invalid byte order, ->>18 leshort 2 SPARC - invalid byte order, ->>18 leshort 3 Intel 80386, ->>18 leshort 4 Motorola ->>>36 lelong &0x01000000 68000 - invalid byte order, ->>>36 lelong &0x00810000 CPU32 - invalid byte order, ->>>36 lelong 0 68020 - invalid byte order, ->>18 leshort 5 Motorola 88000 - invalid byte order, ->>18 leshort 6 Intel 80486, ->>18 leshort 7 Intel 80860, ->>18 leshort 8 MIPS, >>18 leshort 9 Amdahl - invalid byte order, >>18 leshort 10 MIPS (deprecated), >>18 leshort 11 RS6000 - invalid byte order, @@ -98,7 +92,7 @@ >>18 leshort 47 Hitachi H8/300H, >>18 leshort 48 Hitachi H8S, >>18 leshort 49 Hitachi H8/500, ->>18 leshort 50 IA-64 (Intel 64 bit architecture) +>>18 leshort 50 IA-64, >>18 leshort 51 Stanford MIPS-X, >>18 leshort 52 Motorola Coldfire, >>18 leshort 53 Motorola M68HC12, @@ -111,8 +105,31 @@ >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB +>>16 beshort 0 no file type, +>>16 beshort 1 relocatable, +>>16 beshort 2 executable, +>>16 beshort 3 shared object, +>>16 beshort 4 core file, +#>>>(0x38+0xcc) string >\0 of '%s' +#>>>(0x38+0x10) belong >0 (signal %d), +>>16 beshort &0xff00 processor-specific, +>>18 beshort 0 no machine, +>>18 beshort 1 AT&T WE32100, +>>18 beshort 2 SPARC, +>>18 beshort 3 Intel 80386 - invalid byte order, +>>18 beshort 4 Motorola +>>>36 belong &0x01000000 68000, +>>>36 belong &0x00810000 CPU32, +>>>36 belong 0 68020, +>>18 beshort 5 Motorola 88000, +>>18 beshort 6 Intel 80486 - invalid byte order, +>>18 beshort 7 Intel 80860, # only for MIPS - see comment in little-endian section above. ->>18 beshort 8 +>>18 beshort 8 MIPS, +>>>36 belong &0x20 N32 +>>18 beshort 10 MIPS, +>>>36 belong &0x20 N32 +>>18 beshort 8 # only for 32-bit >>>4 byte 1 >>>>36 belong&0xf0000000 0x00000000 MIPS-I @@ -135,26 +152,6 @@ >>>>48 belong&0xf0000000 0x70000000 MIPS64 >>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2 >>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2 ->>16 beshort 0 no file type, ->>16 beshort 1 relocatable, ->>16 beshort 2 executable, ->>16 beshort 3 shared object, ->>16 beshort 4 core file, -#>>>(0x38+0xcc) string >\0 of '%s' -#>>>(0x38+0x10) belong >0 (signal %d), ->>16 beshort &0xff00 processor-specific, ->>18 beshort 0 no machine, ->>18 beshort 1 AT&T WE32100, ->>18 beshort 2 SPARC, ->>18 beshort 3 Intel 80386 - invalid byte order, ->>18 beshort 4 Motorola ->>>36 belong &0x01000000 68000, ->>>36 belong &0x00810000 CPU32, ->>>36 belong 0 68020, ->>18 beshort 5 Motorola 88000, ->>18 beshort 6 Intel 80486 - invalid byte order, ->>18 beshort 7 Intel 80860, ->>18 beshort 8 MIPS, >>18 beshort 9 Amdahl, >>18 beshort 10 MIPS (deprecated), >>18 beshort 11 RS6000, @@ -187,7 +184,7 @@ >>18 beshort 47 Hitachi H8/300H, >>18 beshort 48 Hitachi H8S, >>18 beshort 49 Hitachi H8/500, ->>18 beshort 50 Intel Merced Processor, +>>18 beshort 50 IA-64, >>18 beshort 51 Stanford MIPS-X, >>18 beshort 52 Motorola Coldfire, >>18 beshort 53 Motorola M68HC12, diff --git a/contrib/file/Magdir/filesystems b/contrib/file/Magdir/filesystems index 5a4ac23..1fbe281 100644 --- a/contrib/file/Magdir/filesystems +++ b/contrib/file/Magdir/filesystems @@ -23,15 +23,520 @@ >0770 long x %ld blocks # Is there a boot block written 1 sector in? >512 belong&077777777 0600407 \b, boot block present +# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc +# (http://btmgr.sourceforge.net/docs/user-guide-3.html) +0 string SBMBAKUP_ Smart Boot Manager backup file +>9 string x \b, version %-5.5s +>>14 string =_ +>>>15 string x %-.1s +>>>>16 string =_ \b. +>>>>>17 string x \b%-.1s +>>>>>>18 string =_ \b. +>>>>>>>19 string x \b%-.1s +>>>22 ubyte 0 +>>>>21 ubyte x \b, from drive 0x%x +>>>22 ubyte >0 +>>>>21 string x \b, from drive %s + +# Joerg Jenderek +# DOS Emulator image is 128 byte, null right padded header + harddisc image +0 string DOSEMU\0 +>0x27E leshort 0xAA55 +#offset is 128 +>>19 ubyte 128 +>>>(19.b-1) ubyte 0x0 DOS Emulator image +>>>>7 ulelong >0 \b, %u heads +>>>>11 ulelong >0 \b, %d sectors/track +>>>>15 ulelong >0 \b, %d cylinders + 0x1FE leshort 0xAA55 x86 boot sector >2 string OSBS \b, OS/BS MBR -# J\xf6rg Jenderek <joerg.jenderek@gmx.net> +# J\xf6rg Jenderek <joerg dot jenderek at web dot de> >0x8C string Invalid\ partition\ table \b, MS-DOS MBR ->0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03 +# dr-dos with some upper-, lowercase variants +>0x9D string Invalid\ partition\ table$ +>>181 string No\ Operating\ System$ +>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 +>0x9D string Invalid\ partition\ table$ +>>181 string No\ operating\ system$ +>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 +>342 string Invalid\ partition\ table$ +>>366 string No\ operating\ system$ +>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 +>295 string NEWLDR\0 +>>302 string Bad\ PT\ $ +>>>310 string No\ OS\ $ +>>>>317 string OS\ load\ err$ +>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r +>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ +>>>>>>>387 string Copyright\ (c)\ 1984,1998 +>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 +>>0x1B8 ubelong >0 \b, Serial 0x%-.4x >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 ->0x145 string Default:\ F \b, FREE-DOS MBR ->0 string \0\0\0\0 \b, extended partition table +>271 string Invalid\ partition\ table\0 +>>295 string Error\ loading\ operating\ system\0 +>>>326 string Missing\ operating\ system\0 \b, mbr +# +>139 string Invalid\ partition\ table\0 +>>163 string Error\ loading\ operating\ system\0 +>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr +# http://www.heise.de/ct/05/09/006/ page 184 +#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes +>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x +>300 string Invalid\ partition\ table\0 +>>324 string Error\ loading\ operating\ system\0 +>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR +#??>>>389 string Invalid\ system\ disk +>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x +>300 string Ung\201ltige\ Partitionstabelle +#split string to avoid error: String too long +>>328 string Fehler\ beim\ Laden\ +>>>346 string des\ Betriebssystems +>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) +>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x +>0x145 string Default:\ F \b, FREE-DOS MBR +>64 string no\ active\ partition\ found +>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR +>271 string Operating\ system\ loading +>>296 string error\r \b, SYSLINUX MBR (2.10) +# bootloader, bootmanager +>43 string SMART\ BTMGRFAT12\ \ \ +>>430 string SBMK\ Bad!\r +>>>3 string SBM \b, Smart Boot Manager +>>>>6 string >\0 \b, version %s +>382 string XOSLLOADXCF \b, eXtended Operating System Loader +>6 string LILO \b, LInux i386 boot LOader +>>120 string LILO \b, version 22.3.4 SuSe +>>172 string LILO \b, version 22.5.8 Debian +>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>394 string stage1 \b, GRand Unified Bootloader (0.5.95) +>343 string Geom\0Read\0\ Error\0 +>>321 string Loading\ stage1.5 \b, Grand Unified Bootloader +>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>374 string GRUB\ \0 \b, GRand Unified Bootloader +>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>376 string GRUB\ \0 \b, GRand Unified Bootloader (0.93) +>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>377 string GRUB\ \0 \b, GRand Unified Bootloader (0.94) +>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>379 string GRUB\ \0 \b, GRand Unified Bootloader (0.95) +>480 string Boot\ failed\r +>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06) +>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader +# mbr partion table entries, if not fat boot secor, activ flag 0 or 0x80 and type > 0 +>3 string !MS +>>3 string !SYSLINUX +>>>82 string !FAT32 +>>>>446 ubyte <0x81 +>>>>>446 ubyte&0x7F 0 +>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x +>>>>>>>446 ubyte 0x80 \b, active +>>>>>>>447 ubyte x \b, starthead %u +#>>>>>>>448 ubyte x \b, start C_S: 0x%x +#>>>>>>448 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>454 ulelong x \b, startsector %u +>>>>>>>458 ulelong x \b, %u sectors +# +>>>>462 ubyte <0x81 +>>>>>462 ubyte&0x7F 0 +>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x +>>>>>>>462 ubyte 0x80 \b, active +>>>>>>>463 ubyte x \b, starthead %u +#>>>>>>>464 ubyte x \b, start C_S: 0x%x +#>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>470 ulelong x \b, startsector %u +>>>>>>>474 ulelong x \b, %u sectors +# +>>>>478 ubyte <0x81 +>>>>>478 ubyte&0x7F 0 +>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x +>>>>>>>478 ubyte 0x80 \b, active +>>>>>>>479 ubyte x \b, starthead %u +#>>>>>>>480 ubyte x \b, start C_S: 0x%x +#>>>>>>>481 ubyte x \b, start C2S: 0x%x +#>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>486 ulelong x \b, startsector %u +>>>>>>>490 ulelong x \b, %u sectors +# +>>>>494 ubyte <0x81 +>>>>>494 ubyte&0x7F 0 +>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x +>>>>>>>494 ubyte 0x80 \b, active +>>>>>>>495 ubyte x \b, starthead %u +#>>>>>>>496 ubyte x \b, start C_S: 0x%x +#>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>502 ulelong x \b, startsector %u +>>>>>>>506 ulelong x \b, %u sectors +# mbr partion table entries end +>185 string FDBOOT\ Version\ +>>204 string \rNo\ Systemdisk.\ +>>>220 string Booting\ from\ harddisk.\n\r +>>>245 string Cannot\ load\ from\ harddisk.\n\r +>>>>273 string Insert\ Systemdisk\ +>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader +>>>>>>200 string >\0 \b, version %-3s +>242 string Bootsector\ from\ C.H.\ Hochst\204 +>>278 string No\ Systemdisk.\ +>>>293 string Booting\ from\ harddisk.\n\r +>>>441 string Cannot\ load\ from\ harddisk.\n\r +>>>>469 string Insert\ Systemdisk\ +>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader +>>>>>>209 string >\0 \b, version %-4.4s +>(1.b+2) ubyte 0xe +>>(1.b+3) ubyte 0x1f +>>>(1.b+4) ubyte 0xbe +>>>>(1.b+5) ubyte 0x77 +>>>>(1.b+6) ubyte 0x7c +>>>>>(1.b+7) ubyte 0xac +>>>>>>(1.b+8) ubyte 0x22 +>>>>>>>(1.b+9) ubyte 0xc0 +>>>>>>>>(1.b+10) ubyte 0x74 +>>>>>>>>>(1.b+11) ubyte 0xb +>>>>>>>>>>(1.b+12) ubyte 0x56 +>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display +>103 string This\ is\ not\ a\ bootable\ disk.\ +>>132 string Please\ insert\ a\ bootable\ +>>>157 string floppy\ and\r\n +>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display +# +>66 string Solaris\ Boot\ Sector +>>99 string Incomplete\ MDBoot\ load. +>>>89 string Version \b, Sun Solaris Bootloader +>>>>97 byte x version %c +# +>408 string OS/2\ !!\ SYS01475\r\0 +>>429 string OS/2\ !!\ SYS02025\r\0 +>>>450 string OS/2\ !!\ SYS02027\r\0 +>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader +# +>409 string OS/2\ !!\ SYS01475\r\0 +>>430 string OS/2\ !!\ SYS02025\r\0 +>>>451 string OS/2\ !!\ SYS02027\r\0 +>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader +>112 string This\ disk\ is\ not\ bootable\r +>>142 string If\ you\ wish\ to\ make\ it\ bootable +>>>176 string run\ the\ DOS\ program\ SYS\ +>>>200 string after\ the\r +>>>>216 string system\ has\ been\ loaded\r\n +>>>>>242 string Please\ insert\ a\ DOS\ diskette\ +>>>>>271 string into\r\n\ the\ drive\ and\ +>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display +# XP +>430 string NTLDR\ is\ missing\xFF\r\n +>>449 string Disk\ error\xFF\r\n +>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader +# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# +>430 string NTLDR\ nicht\ gefunden\xFF\r\n +>>453 string Datentr\204gerfehler\xFF\r\n +>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# +>>>>368 ubyte&0xDF >0 +>>>>>368 string x %-.5s +>>>>>>373 ubyte&0xDF >0 +>>>>>>>373 string x \b%-.3s +>>>>>376 ubyte&0xDF >0 +>>>>>>376 string x \b.%-.3s +# +>430 string NTLDR\ fehlt\xFF\r\n +>>444 string Datentr\204gerfehler\xFF\r\n +>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# variant +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# +>430 string NTLDR\ fehlt\xFF\r\n +>>444 string Medienfehler\xFF\r\n +>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# variant +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# +>430 string Datentr\204ger\ entfernen\xFF\r\n +>>454 string Medienfehler\xFF\r\n +>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) +>>>>368 ubyte&0xDF >0 +>>>>>368 string x %-.5s +>>>>>>373 ubyte&0xDF >0 +>>>>>>>373 string x \b%-.3s +>>>>>376 ubyte&0xDF >0 +>>>>>>376 string x \b.%-.3s +#>3 string NTFS\ \ \ \ +>389 string Fehler\ beim\ Lesen\ +>>407 string des\ Datentr\204gers +>>>426 string NTLDR\ fehlt +>>>>440 string NTLDR\ ist\ komprimiert +>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) +#>3 string NTFS\ \ \ \ +>313 string A\ disk\ read\ error\ occurred.\r +>>345 string A\ kernel\ file\ is\ missing\ +>>>370 string from\ the\ disk.\r +>>>>484 string NTLDR\ is\ compressed +>>>>>429 string Insert\ a\ system\ diskette\ +>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS +# DOS loader variants different languages,offsets +>472 ubyte&0xDF >0 +>>389 string Invalid\ system\ disk\xFF\r\n +>>>411 string Disk\ I/O\ error +>>>>428 string Replace\ the\ disk,\ and\ +>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader +#IO.SYS +>>>>>>472 ubyte&0xDF >0 +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>390 string Invalid\ system\ disk\xFF\r\n +>>>412 string Disk\ I/O\ error\xFF\r\n +>>>>429 string Replace\ the\ disk,\ and\ +>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader +>>388 string Ungueltiges\ System\ \xFF\r\n +>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>427 string Datentraeger\ wechseln\ und\ +>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.5s +>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>390 string Ungueltiges\ System\ \xFF\r\n +>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>429 string Datentraeger\ wechseln\ und\ +>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.7s +>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.6s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>389 string Ungueltiges\ System\ \xFF\r\n +>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>428 string Datentraeger\ wechseln\ und\ +>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) +# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes +>>>>>>472 string x %-.2s +>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>474 string x \b%-.5s +>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>479 string x \b%-.1s +>>>>>>480 ubyte&0xDF >0 +>>>>>>>480 string x \b.%-.3s +>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>483 string x \b%-.5s +>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>488 string x \b%-.2s +>>>>>>>>490 ubyte&0xDF >0 +>>>>>>>>>490 string x \b%-.1s +>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>491 string x \b.%-.3s +>479 ubyte&0xDF >0 +>>416 string Kein\ System\ oder\ +>>>433 string Laufwerksfehler +>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) +#IO.SYS +>>>>>479 string x \b %-.2s +>>>>>>481 ubyte&0xDF >0 +>>>>>>>481 string x \b%-.6s +>>>>>487 ubyte&0xDF >0 +>>>>>>487 string x \b.%-.3s +#MSDOS.SYS +>>>>>>490 ubyte&0xDF >0 \b+ +>>>>>>>490 string x \b%-.5s +>>>>>>>>495 ubyte&0xDF >0 +>>>>>>>>>495 string x \b%-.3s +>>>>>>>498 ubyte&0xDF >0 +>>>>>>>>498 string x \b.%-.3s +# +>486 ubyte&0xDF >0 +>>416 string Non-System\ disk\ or\ +>>>435 string disk\ error\r +>>>>447 string Replace\ and\ press\ any\ key\ +>>>>>473 string when\ ready\r \b, Microsoft DOS Bootloader +>480 ubyte&0xDF >0 +>>393 string Non-System\ disk\ or\ +>>>412 string disk\ error\r +>>>>424 string Replace\ and\ press\ any\ key\ +>>>>>450 string when\ ready\r \b, Microsoft DOS bootloader +#IO.SYS +>>>>>480 string x \b %-.2s +>>>>>>482 ubyte&0xDF >0 +>>>>>>>48 string x \b%-.6s +>>>>>488 ubyte&0xDF >0 +>>>>>>488 string x \b.%-.3s +#MSDOS.SYS +>>>>>>491 ubyte&0xDF >0 \b+ +>>>>>>>491 string x \b%-.5s +>>>>>>>>496 ubyte&0xDF >0 +>>>>>>>>>496 string x \b%-.3s +>>>>>>>499 ubyte&0xDF >0 +>>>>>>>>499 string x \b.%-.3s +#>43 string \224R-LOADER\ \ SYS =label +>54 string SYS +>>324 string VASKK +>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) +# +>70 string IBMBIO\ \ COM +>>472 string Cannot\ load\ DOS!\ +>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader +>>471 string Cannot\ load\ DOS\ +>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader +>444 string KERNEL\ \ SYS +>>314 string BOOT\ error! \b, FREE-DOS Bootloader +>499 string KERNEL\ \ SYS +>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader +>449 string KERNEL\ \ SYS +>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader +>125 string Loading\ FreeDOS...\r +>>311 string BOOT\ error!\r \b, FREE-DOS bootloader +>>>441 ubyte&0xDF >0 +>>>>441 string x \b %-.6s +>>>>>447 ubyte&0xDF >0 +>>>>>>447 string x \b%-.1s +>>>>>>>448 ubyte&0xDF >0 +>>>>>>>>448 string x \b%-.1s +>>>>449 ubyte&0xDF >0 +>>>>>449 string x \b.%-.3s +>124 string FreeDOS\0 +>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader +# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>336 string Error!\ +>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +# loader end +# Joerg Jenderek +>446 ubyte 0 +>>450 ubyte >0 +>>>482 ubyte 0 +>>>>498 ubyte 0 +>>>>466 ubyte 0x05 \b, extended partition table +>>>>466 ubyte 0x0F \b, extended partition table (LBA) +>>>>466 ubyte 0x0 \b, extended partition table (last) # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # older drives may use E9 xx xx >0 lelong&0x009000EB 0x009000EB @@ -89,7 +594,7 @@ >>>>>>>43 string <NO\ NAME \b, label: "%11.11s" >>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>43 string =NO\ NAME \b, unlabeled ->>>>>>54 string FAT1 \b, FAT +>>>>>>54 string FAT \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific @@ -338,3 +843,39 @@ # JFFS2 file system 0 leshort 0x1984 Linux old jffs2 filesystem data little endian 0 lelong 0xe0011985 Linux jffs2 filesystem data little endian + +# Squashfs +0 string sqsh Squashfs filesystem, big endian, +>28 beshort x version %d. +>30 beshort x \b%d, +>8 belong x %d bytes, +>4 belong x %d inodes, +>28 beshort <2 +>>32 beshort x blocksize: %d bytes, +>28 beshort >1 +>>51 belong x blocksize: %d bytes, +>39 bedate x created: %s +0 string hsqs Squashfs filesystem, little endian, +>28 leshort x version %d. +>30 leshort x \b%d, +>8 lelong x %d bytes, +>4 lelong x %d inodes, +>28 leshort <2 +>>32 leshort x blocksize: %d bytes, +>28 leshort >1 +>>51 lelong x blocksize: %d bytes, +>39 ledate x created: %s + +# AFS Dump Magic +# From: Ty Sarna <tsarna@sarna.org> +0 string \x01\xb3\xa1\x13\x22 AFS Dump +>&0 belong x (v%d) +>>&0 byte 0x76 +>>>&0 belong x Vol %d, +>>>>&0 byte 0x6e +>>>>>&0 string x %s +>>>>>>&1 byte 0x74 +>>>>>>>&0 beshort 2 +>>>>>>>>&4 bedate x on: %s +>>>>>>>>&0 bedate =0 full dump +>>>>>>>>&0 bedate !0 incremental since: %s diff --git a/contrib/file/Magdir/flash b/contrib/file/Magdir/flash index 2f343d8..f14b460 100644 --- a/contrib/file/Magdir/flash +++ b/contrib/file/Magdir/flash @@ -10,6 +10,9 @@ >3 byte x version %d 0 string CWS Macromedia Flash data (compressed), >3 byte x version %d +# From: Cal Peake <cp@absolutedigital.net> +0 string FLV Macromedia Flash Video + # # From Dave Wilson 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document diff --git a/contrib/file/Magdir/fsav b/contrib/file/Magdir/fsav index 4218936..4d61beb 100644 --- a/contrib/file/Magdir/fsav +++ b/contrib/file/Magdir/fsav @@ -2,26 +2,59 @@ #------------------------------------------------------------------------------ # fsav: file(1) magic for datafellows fsav virus definition files # Anthon van der Neut (anthon@mnt.org) -0 beshort 0x1575 fsav (linux) macro virus + +# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} +0 beshort 0x1575 fsav macro virus signatures >8 leshort >0 (%d- >11 byte >0 \b%02d- >10 byte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign.zip +#10 ubyte <12 +#>9 ubyte <32 +#>>8 ubyte 0x0a +#>>>12 ubyte 0x07 +#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- +#>>>>10 byte 0 \b01- +#>>>>10 byte 1 \b02- +#>>>>10 byte 2 \b03- +#>>>>10 byte 3 \b04- +#>>>>10 byte 4 \b05- +#>>>>10 byte 5 \b06- +#>>>>10 byte 6 \b07- +#>>>>10 byte 7 \b08- +#>>>>10 byte 8 \b09- +#>>>>10 byte 9 \b10- +#>>>>10 byte 10 \b11- +#>>>>10 byte 11 \b12- +#>>>>9 ubyte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign2.zip +#0 ubyte 0x62 +#>1 ubyte 0xF5 +#>>2 ubyte 0x1 +#>>>3 ubyte 0x1 +#>>>>4 ubyte 0x0e +#>>>>>13 ubyte >0 fsav virus signatures +#>>>>>>11 ubyte x size 0x%02x +#>>>>>>12 ubyte x \b%02x +#>>>>>>13 ubyte x \b%02x bytes -# comment this out for now because it regognizes every file where -# the eighth character is \n -#8 byte 0x0a -#>12 byte 0x07 -#>11 leshort >0 fsav (linux) virus (%d- -#>10 byte 0 \b01- -#>10 byte 1 \b02- -#>10 byte 2 \b03- -#>10 byte 3 \b04- -#>10 byte 4 \b05- -#>10 byte 5 \b06- -#>10 byte 6 \b07- -#>10 byte 7 \b08- -#>10 byte 8 \b08- -#>10 byte 9 \b10- -#>10 byte 10 \b11- -#>10 byte 11 \b12- -#>9 byte >0 \b%02d) +# Joerg Jenderek: joerg dot jenderek at web dot de +# http://www.clamav.net/doc/latest/html/node45.html +# .cvd files start with a 512 bytes colon separated header +# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime +# + gzipped tarball files +0 string ClamAV-VDB: +>11 string >\0 Clam AntiVirus database %-.23s +>>34 string : +>>>35 regex [^:]+ \b, version +>>>>35 string x \b%-.1s +>>>>>36 string !: +>>>>>>36 string x \b%-.1s +>>>>>>>37 string !: +>>>>>>>>37 string x \b%-.1s +>>>>>>>>>38 string !: +>>>>>>>>>>38 string x \b%-.1s +>>>>512 string \037\213 \b, gzipped +>>>>769 string ustar\0 \b, tared +>512 string \037\213 \b, gzipped +>769 string ustar\0 \b, tared diff --git a/contrib/file/Magdir/gnu b/contrib/file/Magdir/gnu index 99b9830..42d9c7b 100644 --- a/contrib/file/Magdir/gnu +++ b/contrib/file/Magdir/gnu @@ -1,3 +1,5 @@ +#------------------------------------------------------------------------------ +# gnu: file(1) magic for various GNU tools # # GNU nlsutils message catalog file format # @@ -10,15 +12,23 @@ # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> 0 string *nazgul* Nazgul style compiled message catalog >8 lelong >0 \b, version %ld + # GnuPG # The format is very similar to pgp 0 string \001gpg GPG key trust database >4 byte x version %d -0 beshort 0x9901 GPG key public ring +0 beshort 0x8502 GPG encrypted data # This magic is not particularly good, as the keyrings don't have true # magic. Nevertheless, it covers many keyrings. +0 beshort 0x9901 GPG key public ring # Gnumeric spreadsheet # This entry is only semi-helpful, as Gnumeric compresses its files, so # they will ordinarily reported as "compressed", but at least -z helps 39 string =<gmr:Workbook Gnumeric spreadsheet + +# From: James Youngman <jay@gnu.org> +# gnu find magic +0 string \0LOCATE GNU findutils locate database data +>7 string >\0 \b, format %s +>7 string 02 \b (frcode) diff --git a/contrib/file/Magdir/iff b/contrib/file/Magdir/iff index 334d71e..3c88f90 100644 --- a/contrib/file/Magdir/iff +++ b/contrib/file/Magdir/iff @@ -15,18 +15,46 @@ >8 string AIFF \b, AIFF audio >8 string AIFC \b, AIFF-C compressed audio >8 string 8SVX \b, 8SVX 8-bit sampled sound voice +>8 string 16SV \b, 16SV 16-bit sampled sound voice >8 string SAMP \b, SAMP sampled audio ->8 string DTYP \b, DTYP datatype description ->8 string PTCH \b, PTCH binary patch +>8 string MAUD \b, MAUD MacroSystem audio +>8 string SMUS \b, SMUS simple music +>8 string CMUS \b, CMUS complex music # image formats >8 string ILBMBMHD \b, ILBM interleaved image >>20 beshort x \b, %d x >>22 beshort x %d >8 string RGBN \b, RGBN 12-bit RGB image >8 string RGB8 \b, RGB8 24-bit RGB image +>8 string DEEP \b, DEEP TVPaint/XiPaint image >8 string DR2D \b, DR2D 2-D object >8 string TDDD \b, TDDD 3-D rendering +>8 string LWOB \b, LWOB 3-D object +>8 string LWO2 \b, LWO2 3-D object, v2 +>8 string LWLO \b, LWLO 3-D layered object +>8 string REAL \b, REAL Real3D rendering +>8 string MC4D \b, MC4D MaxonCinema4D rendering +>8 string ANIM \b, ANIM animation +>8 string YAFA \b, YAFA animation +>8 string SSA\ \b, SSA super smooth animation +>8 string ACBM \b, ACBM continuous image +>8 string FAXX \b, FAXX fax image # other formats >8 string FTXT \b, FTXT formatted text >8 string CTLG \b, CTLG message catalog >8 string PREF \b, PREF preferences +>8 string DTYP \b, DTYP datatype description +>8 string PTCH \b, PTCH binary patch +>8 string AMFF \b, AMFF AmigaMetaFile format +>8 string WZRD \b, WZRD StormWIZARD resource +>8 string DOC\ \b, DOC desktop publishing document + +# These go at the end of the iff rules +# +# I don't see why these might collide with anything else. +# +# Interactive Fiction related formats +# +>8 string IFRS \b, Blorb Interactive Fiction +>>24 string Exec with executable chunk +>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) diff --git a/contrib/file/Magdir/images b/contrib/file/Magdir/images index b992a92..70fd84c2 100644 --- a/contrib/file/Magdir/images +++ b/contrib/file/Magdir/images @@ -260,7 +260,7 @@ # other images 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file -0 string !! Bennet Yee's "face" format +0 string =!! Bennet Yee's "face" format # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image # stuff. @@ -514,8 +514,15 @@ # From: Jason Bacon <bacon@smithers.neuro.mcw.edu> 0 beshort 0x3020 character Computer Graphics Metafile - +# From Marc Espie +0 lelong 20000630 OpenEXR image data # From: Tom Hilinski <tom.hilinski@comcast.net> # http://www.unidata.ucar.edu/packages/netcdf/ -0 string CDF\001 netcdf file +0 string CDF\001 NetCDF Data Format data + +#----------------------------------------------------------------------- +# Hierarchical Data Format, used to facilitate scientific data exchange +# specifications at http://hdf.ncsa.uiuc.edu/ +0 belong 0x0e031301 Hierarchical Data Format (version 4) data +0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data diff --git a/contrib/file/Magdir/java b/contrib/file/Magdir/java index d0677bf..f9b7091 100644 --- a/contrib/file/Magdir/java +++ b/contrib/file/Magdir/java @@ -1,9 +1,10 @@ #------------------------------------------------------------ # Java ByteCode # From Larry Schwimmer (schwim@cs.stanford.edu) -0 belong 0xcafebabe compiled Java class data, ->6 beshort x version %d. ->4 beshort x \b%d +# Handled in Mach now +#0 belong 0xcafebabe compiled Java class data, +#>6 beshort x version %d. +#>4 beshort x \b%d #------------------------------------------------------------ # Java serialization # From Martin Pool (m.pool@pharos.com.au) diff --git a/contrib/file/Magdir/linux b/contrib/file/Magdir/linux index 37c41bb..36cc24f 100644 --- a/contrib/file/Magdir/linux +++ b/contrib/file/Magdir/linux @@ -53,10 +53,15 @@ >3 byte >0 8x%d # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 4086 string SWAP-SPACE Linux/i386 swap file +# From: Jeff Bailey <jbailey@ubuntu.com> +# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> +4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image # according to man page of mkswap (8) March 1999 4086 string SWAPSPACE2 Linux/i386 swap file (new style) >0x400 long x %d (4K pages) >0x404 long x size %d pages +>>4086 string SWAPSPACE2 +>>>1052 string >\0 Label %s # ECOFF magic for OSF/1 and Linux (only tested under Linux though) # # from Erik Troan (ewt@redhat.com) examining od dumps, so this @@ -79,7 +84,7 @@ # Linux kernel boot images (i386 arch) (Wolfram Kleff) 514 string HdrS Linux kernel >510 leshort 0xAA55 x86 boot executable ->>518 leshort >=3D0x200 +>>518 leshort >=0x200 >>529 byte 0 zImage, >>>529 byte 1 bzImage, >>>(526.s+0x200) string >\0 version %s, @@ -178,3 +183,49 @@ 0 lelong =0x1413f33d SYSLINUX' LSS16 image data >4 leshort x \b, width %d >6 leshort x \b, height %d + +0 string OOOM User-Mode-Linux's Copy-On-Write disk image +>4 belong x version %d + +# SE Linux policy database +# From: Mike Frysinger <vapier@gentoo.org> +0 lelong 0xf97cff8c SE Linux policy +>16 lelong x v%d +>20 lelong 1 MLS +>24 lelong x %d symbols +>28 lelong x %d ocons + +# Linux Logical Volume Manager (LVM) +# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> +# +# System ID, UUID and volume group name are 128 bytes long +# but they should never be full and initialized with zeros... +# +# LVM1 +# +0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 +>0x12c string >\0 , System ID: %s + +0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 +>0x12c string >\0 , System ID: %s + +# LVM2 +# +# It seems that the label header can be in one the four first sector +# of the disk... (from _find_labeller in lib/label/label.c of LVM2) +# +# 0x200 seems to be the common case + +0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +# read the offset to add to the start of the header, and the header +# start in 0x200 +>(0x214.l+0x200) string >\0 , UUID: %s + +0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x014.l) string >\0 , UUID: %s + +0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x414.l+0x400) string >\0 , UUID: %s + +0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x614.l+0x600) string >\0 , UUID: %s diff --git a/contrib/file/Magdir/lisp b/contrib/file/Magdir/lisp index 42698c0..c72b06c 100644 --- a/contrib/file/Magdir/lisp +++ b/contrib/file/Magdir/lisp @@ -4,8 +4,18 @@ # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) -# This is a guess, but a good one. -0 string ;; Lisp/Scheme program text +# updated by Joerg Jenderek +0 string ;; +# windows INF files often begin with semicolon and use CRLF as line end +# lisp files are mainly created on unix system with LF as line end +>2 search/2048 !\r Lisp/Scheme program text +>2 search/2048 \r Windows INF file +0 string ( +>1 string if\ Lisp/Scheme program text +>1 string setq\ Lisp/Scheme program text +>1 string defvar\ Lisp/Scheme program text +>1 string autoload\ Lisp/Scheme program text +>1 string custom-set-variables Lisp/Scheme program text # Emacs 18 - this is always correct, but not very magical. 0 string \012( Emacs v18 byte-compiled Lisp data diff --git a/contrib/file/Magdir/mach b/contrib/file/Magdir/mach index d3fd470..6289a2d 100644 --- a/contrib/file/Magdir/mach +++ b/contrib/file/Magdir/mach @@ -1,21 +1,75 @@ #------------------------------------------------------------------------------ # mach file description # -0 belong 0xcafebabe Mach-O fat file ->4 belong 1 with 1 architecture +# Since Java bytecode and Mach-O fat-files have the same magic number the test +# must be preformed in the same "magic" sequence to get both right. The long +# at offset 4 in a fat file tells the number of architectures. The short at +# offset 4 in a Java bytecode file is the compiler minor version and the +# short at offset 6 is the compiler major version. Since there are only +# only 18 labeled Mach-O architectures at current, and the first released +# Java class format was version 43.0, we can safely choose any number +# between 18 and 39 to test the number of architectures against +# (and use as a hack). +# +0 belong 0xcafebabe +>4 belong >19 compiled Java class data, +>>6 beshort x version %d. +>>4 beshort x \b%d +>4 belong 1 Mach-O fat file with 1 architecture >4 belong >1 ->>4 belong x with %ld architectures +# The following is necessary to support java class files. +>>4 belong <20 Mach-O fat file with %ld architectures +#>>4 belong <0xffff Mach-O fat file with %ld architectures +# +0 lelong&0xfeffffff 0xfeedface Mach-O +>0 byte 0xcf 64-bit +>12 lelong 1 object +>12 lelong 2 executable +>12 lelong 3 fixed virtual memory shared library +>12 lelong 4 core +>12 lelong 5 preload executable +>12 lelong 6 dynamically linked shared library +>12 lelong 7 dynamic linker +>12 lelong 8 bundle +>12 lelong 9 dynamically linked shared library stub +>12 lelong >9 +>>12 lelong x filetype=%ld +>4 lelong <0 +>>4 lelong x architecture=%ld +>4 lelong 1 vax +>4 lelong 2 romp +>4 lelong 3 architecture=3 +>4 lelong 4 ns32032 +>4 lelong 5 ns32332 +>4 lelong 6 m68k +>4 lelong 7 i386 +>4 lelong 8 mips +>4 lelong 9 ns32532 +>4 lelong 10 architecture=10 +>4 lelong 11 hppa +>4 lelong 12 acorn +>4 lelong 13 m88k +>4 lelong 14 sparc +>4 lelong 15 i860-big +>4 lelong 16 i860 +>4 lelong 17 rs6000 +>4 lelong 18 ppc +>4 lelong 16777234 ppc64 +>4 lelong >16777234 +>>4 lelong x architecture=%ld # -0 belong 0xfeedface Mach-O +0 belong&0xfffffffe 0xfeedface Mach-O +>3 byte 0xcf 64-bit >12 belong 1 object >12 belong 2 executable ->12 belong 3 shared library +>12 belong 3 fixed virtual memory shared library >12 belong 4 core >12 belong 5 preload executable >12 belong 6 dynamically linked shared library >12 belong 7 dynamic linker >12 belong 8 bundle ->12 belong >8 +>12 belong 9 dynamically linked shared library stub +>12 belong >9 >>12 belong x filetype=%ld >4 belong <0 >>4 belong x architecture=%ld @@ -34,7 +88,7 @@ >4 belong 8 mips >4 belong 9 ns32532 >4 belong 10 architecture=10 ->4 belong 11 hp pa-risc +>4 belong 11 hppa >4 belong 12 acorn >4 belong 13 m88k >4 belong 14 sparc @@ -42,5 +96,6 @@ >4 belong 16 i860 >4 belong 17 rs6000 >4 belong 18 ppc ->4 belong >18 +>4 belong 16777234 ppc64 +>4 belong >16777234 >>4 belong x architecture=%ld diff --git a/contrib/file/Magdir/macintosh b/contrib/file/Magdir/macintosh index 91364a0..5d96376 100644 --- a/contrib/file/Magdir/macintosh +++ b/contrib/file/Magdir/macintosh @@ -18,7 +18,7 @@ # Newer StuffIt archives (grant@netbsd.org) 0 string StuffIt StuffIt Archive ->162 string >0 : %s +#>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@tuns.ca) 0 string APPL Macintosh Application (data) diff --git a/contrib/file/Magdir/mail.news b/contrib/file/Magdir/mail.news index 2cace95..f08261c 100644 --- a/contrib/file/Magdir/mail.news +++ b/contrib/file/Magdir/mail.news @@ -36,5 +36,6 @@ # Squish Fidonet message area databases # SQD file (requires at least one message in the area) -256 leshort 0xAFAE4453 Squish message area data file ->4 leshort >0 (%d messages) +# XXX: Weak magic +#256 leshort 0xAFAE4453 Squish message area data file +#>4 leshort >0 (%d messages) diff --git a/contrib/file/Magdir/maple b/contrib/file/Magdir/maple index eea4794..6bc7562 100644 --- a/contrib/file/Magdir/maple +++ b/contrib/file/Magdir/maple @@ -32,7 +32,6 @@ # that is {VERSION major_version miunor_version computer_type version_string} 0 string {VERSION\ Maple worksheet >9 string >\0 version %.1s. ->>10 string >>>11 string >\0 %.1s # .mps diff --git a/contrib/file/Magdir/misctools b/contrib/file/Magdir/misctools index c32d52c..d3fa270 100644 --- a/contrib/file/Magdir/misctools +++ b/contrib/file/Magdir/misctools @@ -1,5 +1,10 @@ #----------------------------------------------------------------------------- # misctools: file(1) magic for miscelanous UNIX tools. # -0 string %%!! X-Post-It-Note text -0 string BEGIN:VCALENDAR vCalendar calendar file +0 string %%!! X-Post-It-Note text +0 string BEGIN:VCALENDAR vCalendar calendar file +0 string BEGIN:VCARD vCard visiting card + +# From: Alex Beregszaszi <alex@fsn.hu> +4 string gtktalog GNOME Catalogue (gtktalog) +>13 string >\0 version %s diff --git a/contrib/file/Magdir/msdos b/contrib/file/Magdir/msdos index 3c230b7..c02ca99 100644 --- a/contrib/file/Magdir/msdos +++ b/contrib/file/Magdir/msdos @@ -4,70 +4,19 @@ # # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) -0 string/c @echo\ off MS-DOS batch file text +# updated by Joerg Jenderek +0 string @ +>1 string/cB \ echo\ off MS-DOS batch file text +>1 string/cB echo\ off MS-DOS batch file text +>1 string/cB rem\ MS-DOS batch file text +>1 string/cB set\ MS-DOS batch file text + + +# OS/2 batch files are REXX. the second regex is a bit generic, oh well +# the matched commands seem to be common in REXX and uncommon elsewhere +100 regex/c =^\\s*call\s+rxfuncadd.*sysloadfu OS/2 REXX batch file text +100 regex/c =^\\s*say\ ['"] OS/2 REXX batch file text -# XXX - according to Microsoft's spec, at an offset of 0x3c in a -# PE-format executable is the offset in the file of the PE header; -# unfortunately, that's a little-endian offset, and there's no way -# to specify an indirect offset with a specified byte order. -# So, for now, we assume the standard MS-DOS stub, which puts the -# PE header at 0x80 = 128. -# -# Required OS version and subsystem version were 4.0 on some NT 3.51 -# executables built with Visual C++ 4.0, so it's not clear that -# they're interesting. The user version was 0.0, but there's -# probably some linker directive to set it. The linker version was -# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). -# -128 string PE\0\0 MS Windows PE ->150 leshort&0x0100 >0 32-bit ->132 leshort 0x0 unknown processor ->132 leshort 0x14c Intel 80386 ->132 leshort 0x166 MIPS R4000 ->132 leshort 0x184 Alpha ->132 leshort 0x268 Motorola 68000 ->132 leshort 0x1f0 PowerPC ->132 leshort 0x290 PA-RISC ->148 leshort >27 ->>220 leshort 0 unknown subsystem ->>220 leshort 1 native ->>220 leshort 2 GUI ->>220 leshort 3 console ->>220 leshort 7 POSIX ->150 leshort&0x2000 =0 executable -#>>136 ledate x stamp %s, ->>150 leshort&0x0001 >0 not relocatable -#>>150 leshort&0x0004 =0 with line numbers, -#>>150 leshort&0x0008 =0 with local symbols, -#>>150 leshort&0x0200 =0 with debug symbols, ->>150 leshort&0x1000 >0 system file -#>>148 leshort >0 -#>>>154 byte x linker %d -#>>>155 byte x \b.%d, -#>>148 leshort >27 -#>>>192 leshort x requires OS %d -#>>>194 leshort x \b.%d, -#>>>196 leshort x user version %d -#>>>198 leshort x \b.%d, -#>>>200 leshort x subsystem version %d -#>>>202 leshort x \b.%d, ->150 leshort&0x2000 >0 DLL -#>>136 ledate x stamp %s, ->>150 leshort&0x0001 >0 not relocatable -#>>150 leshort&0x0004 =0 with line numbers, -#>>150 leshort&0x0008 =0 with local symbols, -#>>150 leshort&0x0200 =0 with debug symbols, ->>150 leshort&0x1000 >0 system file -#>>148 leshort >0 -#>>>154 byte x linker %d -#>>>155 byte x \b.%d, -#>>148 leshort >27 -#>>>192 leshort x requires OS %d -#>>>194 leshort x \b.%d, -#>>>196 leshort x user version %d -#>>>198 leshort x \b.%d, -#>>>200 leshort x subsystem version %d -#>>>202 leshort x \b.%d, 0 leshort 0x14c MS Windows COFF Intel 80386 object file #>4 ledate x stamp %s 0 leshort 0x166 MS Windows COFF MIPS R4000 object file @@ -81,47 +30,228 @@ 0 leshort 0x290 MS Windows COFF PA-RISC object file #>4 ledate x stamp %s -# .EXE formats (Greg Roelofs, newt@uchicago.edu) +# XXX - according to Microsoft's spec, at an offset of 0x3c in a +# PE-format executable is the offset in the file of the PE header; +# unfortunately, that's a little-endian offset, and there's no way +# to specify an indirect offset with a specified byte order. +# So, for now, we assume the standard MS-DOS stub, which puts the +# PE header at 0x80 = 128. # -0 string MZ MS-DOS executable (EXE) ->24 string @ \b, OS/2 or MS Windows ->>0xe7 string LH/2\ Self-Extract \b, %s ->>0xe9 string PKSFX2 \b, %s ->>122 string Windows\ self-extracting\ ZIP \b, %s ->0x1c string RJSX\xff\xff \b, ARJ SFX ->0x1c string diet\xf9\x9c \b, diet compressed ->0x1c string LZ09 \b, LZEXE v0.90 compressed ->0x1c string LZ91 \b, LZEXE v0.91 compressed ->0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX -# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0" ->0x1e string PKLITE\ Copr. \b, %.6s compressed ->0x24 string LHa's\ SFX \b, %.15s ->0x24 string LHA's\ SFX \b, %.15s ->1638 string -lh5- \b, LHa SFX archive v2.13S ->7195 string Rar! \b, RAR self-extracting archive +# Required OS version and subsystem version were 4.0 on some NT 3.51 +# executables built with Visual C++ 4.0, so it's not clear that +# they're interesting. The user version was 0.0, but there's +# probably some linker directive to set it. The linker version was +# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). # -# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than -# 8161 bytes are ignored. To make the following entries work, increase -# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2, -# NT/Win32 and VMS.] -# [GRR: some company sells a self-extractor/displayer for image data(!)] +# many of the compressed formats were extraced from IDARC 1.23 source code # ->11696 string PK\003\004 \b, PKZIP SFX archive v1.1 ->13297 string PK\003\004 \b, PKZIP SFX archive v1.93a ->15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09 ->15770 string PK\003\004 \b, PKZIP SFX archive v2.04g ->28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02 +0 string MZ MS-DOS executable +>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows +>>&18 leshort&0x2000 >0 (DLL) +>>&88 leshort 0 (unknown subsystem) +>>&88 leshort 1 (native) +>>&88 leshort 2 (GUI) +>>&88 leshort 3 (console) +>>&88 leshort 7 (POSIX) +>>&0 leshort 0x0 unknown processor +>>&0 leshort 0x14c Intel 80386 +>>&0 leshort 0x166 MIPS R4000 +>>&0 leshort 0x184 Alpha +>>&0 leshort 0x268 Motorola 68000 +>>&0 leshort 0x1f0 PowerPC +>>&0 leshort 0x290 PA-RISC +>>&18 leshort&0x0100 >0 32-bit +>>&18 leshort&0x1000 >0 system file +>>&0xf4 search/0x140 \x0\x40\x1\x0 +>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive + +>0x18 leshort >0x3f +>>(0x3c.l) string PE\0\0 PE +# hooray, there's a DOS extender using the PE format, with a valid PE +# executable inside (which just prints a message and exits if run in win) +>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender +>>>(8.s*16) string !32STUB for MS Windows +>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) +>>>>(0x3c.l+92) leshort 0 (unknown subsystem) +>>>>(0x3c.l+92) leshort 1 (native) +>>>>(0x3c.l+92) leshort 2 (GUI) +>>>>(0x3c.l+92) leshort 3 (console) +>>>>(0x3c.l+92) leshort 7 (POSIX) +>>>>(0x3c.l+4) leshort 0x0 unknown processor +>>>>(0x3c.l+4) leshort 0x14c Intel 80386 +>>>>(0x3c.l+4) leshort 0x166 MIPS R4000 +>>>>(0x3c.l+4) leshort 0x184 Alpha +>>>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>>>(0x3c.l+4) leshort 0x1f0 PowerPC +>>>>(0x3c.l+4) leshort 0x290 PA-RISC +>>>>(0x3c.l+22) leshort&0x0100 >0 32-bit +>>>>(0x3c.l+22) leshort&0x1000 >0 system file + +>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed +>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed +>>>>(0x3c.l+0xf8) search/0x140 UPX2 +>>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>>(0x3c.l+0xf8) search/0x140 .idata +>>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive +>>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .rsrc +>>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive +>>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive +>>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive +>>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .data +>>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed +>>>>>(0x3c.l+0xf7) byte x +>>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .reloc +>>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip) + +>>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) +>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive +>>>>0x30 string Inno \b, InnoSetup self-extracting archive + +>>(0x3c.l) string NE \b, NE +>>>(0x3c.l+0x36) byte 0 (unknown OS) +>>>(0x3c.l+0x36) byte 1 for OS/2 1.x +>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x +>>>(0x3c.l+0x36) byte 3 for MS-DOS +>>>(0x3c.l+0x36) byte >3 (unknown OS) +>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender +>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) +>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) +>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive +>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) + +>>(0x3c.l) string LX\0\0 \b, LX +>>>(0x3c.l+0x0a) leshort <1 (unknown OS) +>>>(0x3c.l+0x0a) leshort 1 for OS/2 +>>>(0x3c.l+0x0a) leshort 2 for MS Windows +>>>(0x3c.l+0x0a) leshort 3 for DOS +>>>(0x3c.l+0x0a) leshort >3 (unknown OS) +>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) +>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) +>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) +>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) +>>>(0x3c.l+0x08) leshort 1 i80286 +>>>(0x3c.l+0x08) leshort 2 i80386 +>>>(0x3c.l+0x08) leshort 3 i80486 +>>>(8.s*16) string emx \b, emx +>>>>&1 string x %s +>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive + +# MS Windows system file, supposedly a collection of LE executables +>>(0x3c.l) string W3 \b, W3 for MS Windows + +>>(0x3c.l) string LE\0\0 \b, LE executable +>>>(0x3c.l+0x0a) leshort 1 +# some DOS extenders use LE files with OS/2 header +>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender +>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender +>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender +>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender +>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) +>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) +>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) +# this is a wild guess; hopefully it is a specific signature +>>>>&0x24 lelong <0x50 +>>>>>(&0x4c.l) string \xfc\xb8WATCOM +>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed +# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP +#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 +# fails with DOS-Extenders. +>>>(0x3c.l+0x0a) leshort 2 for MS Windows +>>>(0x3c.l+0x0a) leshort 3 for DOS +>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) +>>>(&0x7c.l+0x26) string UPX \b, UPX compressed +>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive + +# looks like ASCII, probably some embedded copyright message. +# and definitely not NE/LE/LX/PE +>>0x3c lelong >0x20000000 +>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS +# header data too small for extended executable +>2 long !0 +>>0x18 leshort <0x40 +>>>(4.s*512) leshort !0x014c + +>>>>&(2.s-514) string !LE +>>>>>&-2 string !BW \b, MZ for MS-DOS +>>>>&(2.s-514) string LE \b, LE +>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender +# educated guess since indirection is still not capable enough for complex offset +# calculations (next embedded executable would be at &(&2*512+&0-2) +# I suspect there are only LE executables in these multi-exe files +>>>>&(2.s-514) string BW +>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) +>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS + +# This sequence skips to the first COFF segment, usually .text +>(4.s*512) leshort 0x014c \b, COFF +>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender +>>(8.s*16) string emx +>>>&1 string x for DOS, Win or OS/2, emx %s +>>&(&0x42.l-3) byte x +>>>&0x26 string UPX \b, UPX compressed +# and yet another guess: small .text, and after large .data is unusal, could be 32lite +>>&0x2c search/0xa0 .text +>>>&0x0b lelong <0x2000 +>>>>&0 lelong >0x6000 \b, 32lite compressed + +>(8.s*16) string $WdX \b, WDos/X DOS extender + +# .EXE formats (Greg Roelofs, newt@uchicago.edu) # -# Info-ZIP self-extractors -# these are the DOS versions: ->25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12 ->26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption -# these are the OS/2 versions (OS/2 is flagged above): ->47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12 ->49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption -# this is the NT/Win32 version: ->69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption +>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed +>0xe7 string LH/2\ Self-Extract \b, %s +>0x1c string diet \b, diet compressed +>0x1c string LZ09 \b, LZEXE v0.90 compressed +>0x1c string LZ91 \b, LZEXE v0.91 compressed +>0x1c string tz \b, TinyProg compressed +>0x1e string PKLITE \b, %s compressed +>0x64 string W\ Collis\0\0 \b, Compack compressed +>0x24 string LHa's\ SFX \b, LHa self-extracting archive +>0x24 string LHA's\ SFX \b, LHa self-extracting archive +>0x24 string \ $ARX \b, ARX self-extracting archive +>0x24 string \ $LHarc \b, LHarc self-extracting archive +>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive +>1638 string -lh5- \b, LHa self-extracting archive v2.13S +>0x17888 string Rar! \b, RAR self-extracting archive +>0x40 string aPKG \b, aPackage self-extracting archive + +>32 string AIN +>>35 string 2 \b, AIN 2.x compressed +>>35 string <2 \b, AIN 1.x compressed +>>35 string >2 \b, AIN 1.x compressed +>28 string UC2X \b, UCEXE compressed +>28 string WWP\ \b, WWPACK compressed + +# skip to the end of the exe +>(4.s*512) long x +>>&(2.s-517) byte x +>>>&0 string PK\3\4 \b, ZIP self-extracting archive +>>>&0 string Rar! \b, RAR self-extracting archive +>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive +>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive +>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive +>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive +>>>&7 search/400 **ACE** \b, ACE self-extracting archive +>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive + +>0x1c string RJSX \b, ARJ self-extracting archive +# winarj stores a message in the stub instead of the sig in the MZ header +>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive + +# a few unknown ZIP sfxes, no idea if they are needed or if they are +# already captured by the generic patterns above +>122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive +>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) +# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive # + # TELVOX Teleinformatica CODEC self-extractor for OS/2: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 >>49824 leshort =1 \b, 1 file @@ -131,12 +261,79 @@ # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least # two dozen different one-byte "magics". -#0 byte 0xe9 MS-DOS executable (COM) -#>6 string SFX\ of\ LHarc (%s) -#0 byte 0x8c MS-DOS executable (COM) +0 byte 0xe9 DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code +>6 string SFX\ of\ LHarc (%s) +0 belong 0xffffffff DOS executable (device driver) +#CMD640X2.SYS +>10 string >\x23 +>>10 string !\x2e +>>>17 string <\x5B +>>>>10 string x \b, name: %.8s +#UDMA.SYS KEYB.SYS CMD640X2.SYS +>10 string <\x41 +>>12 string >\x40 +>>>10 string !$ +>>>>12 string x \b, name: %.8s +#BTCDROM.SYS ASPICD.SYS +>22 string >\x40 +>>22 string <\x5B +>>>23 string <\x5B +>>>>22 string x \b, name: %.8s +#ATAPICD.SYS +>76 string \0 +>>77 string >\x40 +>>>77 string <\x5B +>>>>77 string x \b, name: %.8s +0 byte 0x8c DOS executable (COM) # 0xeb conflicts with "sequent" magic -#0 byte 0xeb MS-DOS executable (COM) -#0 byte 0xb8 MS-DOS executable (COM) +0 byte 0xeb DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code +>85 string UPX \b, UPX compressed +>4 string \ $ARX \b, ARX self-extracting archive +>4 string \ $LHarc \b, LHarc self-extracting archive +>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive +0 byte 0xb8 COM executable +# modified by Joerg Jenderek +>1 lelong !0x21cd4cff for DOS +# http://syslinux.zytor.com/comboot.php +# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode +# start with assembler instructions mov eax,21cd4cffh +>1 lelong 0x21cd4cff (32-bit COMBOOT) +0 string \x81\xfc +>4 string \x77\x02\xcd\x20\xb9 +>>36 string UPX! FREE-DOS executable (COM), UPX compressed +252 string Must\ have\ DOS\ version DR-DOS executable (COM) +# GRR search is not working +#2 search/28 \xcd\x21 COM executable for MS-DOS +#WHICHFAT.cOM +2 string \xcd\x21 COM executable for DOS +#DELTREE.cOM DELTREE2.cOM +4 string \xcd\x21 COM executable for DOS +#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM +5 string \xcd\x21 COM executable for DOS +#DELTMP.COm HASFAT32.cOM +7 string \xcd\x21 +>0 byte !0xb8 COM executable for DOS +#COMP.cOM MORE.COm +10 string \xcd\x21 +>5 string !\xcd\x21 COM executable for DOS +#comecho.com +13 string \xcd\x21 COM executable for DOS +#HELP.COm EDIT.coM +18 string \xcd\x21 COM executable for MS-DOS +#NWRPLTRM.COm +23 string \xcd\x21 COM executable for MS-DOS +#LOADFIX.cOm LOADFIX.cOm +30 string \xcd\x21 COM executable for MS-DOS +#syslinux.com 3.11 +70 string \xcd\x21 COM executable for DOS +# many compressed/converted COMs start with a copy loop instead of a jump +0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS +0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS +>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed +0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed +# FIXME: missing diet .com compression # miscellaneous formats 0 string LZ MS-DOS executable (built-in) @@ -145,9 +342,10 @@ # # Windows Registry files. -# -0 string regf Windows NT registry file -0 string CREG Windows 95 registry file +# updated by Joerg Jenderek +0 string regf Windows NT/XP registry file +0 string CREG Windows 95/98/ME registry file +0 string SHCC3 Windows 3.1 registry file # AAF files: @@ -207,7 +405,9 @@ >15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal # Windows Metafont .WMF -0 string \327\315\306\232\000\000\000\000\000\000 ms-windows metafont .wmf +0 string \327\315\306\232 ms-windows metafont .wmf +0 string \002\000\011\000 ms-windows metafont .wmf +0 string \001\000\011\000 ms-windows metafont .wmf #tz3 files whatever that is (MS Works files) 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file @@ -224,24 +424,24 @@ 0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig # windows zips files .dmf -0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 Ms-windows special zipped file +0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file # Windows help file FTG FTS -0 string \164\146\115\122\012\000\000\000\001\000\000\000 ms-windows help cache +0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache # grp old windows 3.1 group files -0 string \120\115\103\103 Ms-windows 3.1 group files +0 string \120\115\103\103 MS Windows 3.1 group files # lnk files windows symlinks -0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 ms-Windows shortcut +0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut #ico files -0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for ms-windows +0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows # Windows icons (Ian Springer <ips@fpk.hp.com>) -0 string \000\000\001\000 ms-windows icon resource +0 string \000\000\001\000 MS Windows icon resource >4 byte 1 - 1 icon >4 byte >1 - %d icons >>6 byte >0 \b, %dx @@ -263,7 +463,7 @@ # recycled/info the windows trash bin index -9 string \000\000\000\030\001\000\000\000 ms-windows recycled bin info +9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info ##### put in Either Magic/font or Magic/news @@ -283,8 +483,8 @@ 0 string GERBIL First Choice device file 9 string RABBITGRAPH RabbitGraph file 0 string DCU1 Borland Delphi .DCU file -0 string !<spell> MKS Spell hash list (old format) -0 string !<spell2> MKS Spell hash list +0 string =!<spell> MKS Spell hash list (old format) +0 string =!<spell2> MKS Spell hash list # Too simple - MPi #0 string AH Halo(TM) bitmapped font file 0 lelong 0x08086b70 TurboC BGI file @@ -324,32 +524,16 @@ # GFA-BASIC (Wolfram Kleff) 2 string GFA-BASIC3 GFA-BASIC 3 data -# DJGPP compiled files -# v >2, uses DPMI & small(2k) stub (Robert vd Boon, rjvdboon@europe.com) -0x200 string go32stub DOS-executable compiled w/DJGPP ->0x20c string >0 (stub v%.4s) ->>0x8b2 string djp [compressed w/%s ->>>&1 string >\0 %.4s] ->>0x8ad string UPX [compressed w/%s ->>>&1 string >\0 %.4s] ->>0x1c string pmodedj stubbed with %s - -# QDOS -4 belong 0x4AFB QDOS executable ->9 pstring x '%s' -0 beshort 0xFB01 QDOS object ->2 pstring x '%s' - #------------------------------------------------------------------------------ # From Stuart Caie <kyzer@4u.net> (developer of cabextract) # Microsoft Cabinet files -0 string MSCF\0\0\0\0 Microsoft Cabinet file +0 string MSCF\0\0\0\0 Microsoft Cabinet archive data >8 lelong x \b, %u bytes >28 leshort 1 \b, 1 file >28 leshort >1 \b, %u files # InstallShield Cabinet files -0 string ISc( InstallShield Cabinet file +0 string ISc( InstallShield Cabinet archive data >5 byte&0xf0 =0x60 version 6, >5 byte&0xf0 !0x60 version 4/5, >(12.l+40) lelong x %u files @@ -404,3 +588,22 @@ # of characters instead of all the "description length" # number of characters -- indicated by the ulelong at offset 60. >>(64.l) lestring16 >0 Description: %15.15s + +# From: Alex Beregszaszi <alex@fsn.hu> +0 string COWD VMWare3 disk image +>12 belong x %d bytes + +0 string VMDK VMware4 disk image + +0 belong 0x514649fb QEMU Copy-On-Write disk image +>4 belong x version %d, +>24 belong x size %d + +>28 belong x %d + +0 string QEVM QEMU's suspend to disk image + +0 string Bochs\ Virtual\ HD\ Image Bochs disk image, +>32 string x type %s, +>48 string x subtype %s + +0 lelong 0x02468ace Bochs Sparse disk image diff --git a/contrib/file/Magdir/mup b/contrib/file/Magdir/mup new file mode 100644 index 0000000..fd9a7b1 --- /dev/null +++ b/contrib/file/Magdir/mup @@ -0,0 +1,22 @@ +# ------------------------------------------------------------------------ +# mup: file(1) magic for Mup (Music Publisher) input file. +# +# From: Abel Cheung <abel (@) oaka.org> +# +# NOTE: This header is mainly proposed in the Arkkra mailing list, +# and is not a mandatory header because of old mup input file +# compatibility. Noteedit also use mup format, but is not forcing +# user to use any header as well. +# +0 string //!Mup Mup music publication program input text +>6 string -Arkkra (Arkkra) +>>13 string - +>>>16 string . +>>>>14 string x \b, need V%.4s +>>>15 string . +>>>>14 string x \b, need V%.3s +>6 string - +>>9 string . +>>>7 string x \b, need V%.4s +>>8 string . +>>>7 string x \b, need V%.3s diff --git a/contrib/file/Magdir/ncr b/contrib/file/Magdir/ncr index 987c94e..2faf98a 100644 --- a/contrib/file/Magdir/ncr +++ b/contrib/file/Magdir/ncr @@ -34,14 +34,14 @@ 0 beshort 000640 Tower32/800 68020 >18 beshort &020000 w/68881 object >18 beshort &040000 compatible object ->18 beshort &~060000 object +>18 beshort &060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped >22 beshort >0 - version %ld 0 beshort 000645 Tower32/800 68010 >18 beshort &040000 compatible object ->18 beshort &~060000 object +>18 beshort &060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped diff --git a/contrib/file/Magdir/perl b/contrib/file/Magdir/perl index 417220e..a00c642 100644 --- a/contrib/file/Magdir/perl +++ b/contrib/file/Magdir/perl @@ -18,6 +18,15 @@ #0 regex package Perl5 module source text (via regex) 0 string package Perl5 module source text +# Perl POD documents +# From: Tom Hukins <tom@eborcom.com> +0 string/B \=pod\n Perl POD document +0 string/B \n\=pod\n Perl POD document +0 string/B \=head1\ Perl POD document +0 string/B \n\=head1\ Perl POD document +0 string/B \=head2\ Perl POD document +0 string/B \n\=head2\ Perl POD document + # Perl Storable data files. 0 string perl-store perl Storable(v0.6) data >4 byte >0 (net-order %d) diff --git a/contrib/file/Magdir/printer b/contrib/file/Magdir/printer index 388facf..77ba780 100644 --- a/contrib/file/Magdir/printer +++ b/contrib/file/Magdir/printer @@ -114,3 +114,7 @@ #------------------------------------------------------------------------------ # HP LaserJet 1000 series downloadable firmware file 0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware + +# From: Paolo <oopla@users.sf.net> +# Epson ESC/Page, ESC/PageColor +0 string \x1b\x01@EJL Epson ESC/Page language printer data diff --git a/contrib/file/Magdir/psion b/contrib/file/Magdir/psion index 5e6ab1a..578ea59 100644 --- a/contrib/file/Magdir/psion +++ b/contrib/file/Magdir/psion @@ -8,7 +8,7 @@ >4 lelong 0x1000003A printer driver >4 lelong 0x1000003B clipboard >4 lelong 0x10000042 multi-bitmap image ->4 lelong 0x1000006A application infomation file +>4 lelong 0x1000006A application information file >4 lelong 0x1000006D >>8 lelong 0x1000007D sketch image >>8 lelong 0x1000007E voice note @@ -37,7 +37,7 @@ >4 lelong 0x100000AD physical device driver >4 lelong 0x100000E5 file transfer protocol >4 lelong 0x100000E5 file transfer protocol ->4 lelong 0x10000140 printer defintion ->4 lelong 0x10000141 printer defintion +>4 lelong 0x10000140 printer definition +>4 lelong 0x10000141 printer definition 0 lelong 0x1000007A Psion Series 5 executable diff --git a/contrib/file/Magdir/python b/contrib/file/Magdir/python index ec4c121..5aea137 100644 --- a/contrib/file/Magdir/python +++ b/contrib/file/Magdir/python @@ -12,3 +12,7 @@ 0 belong 0x2aeb0d0a python 2.1 byte-compiled 0 belong 0x2ded0d0a python 2.2 byte-compiled 0 belong 0x3bf20d0a python 2.3 byte-compiled +0 belong 0x6df20d0a python 2.4 byte-compiled + +0 string/b #!\ /usr/bin/python python script text executable + diff --git a/contrib/file/Magdir/riff b/contrib/file/Magdir/riff index a79dd66a..1f1deec 100644 --- a/contrib/file/Magdir/riff +++ b/contrib/file/Magdir/riff @@ -127,6 +127,7 @@ >>>>>>>(104.l+132) string/c divx DivX 4 >>>>>>>(104.l+132) string/c dx50 DivX 5 >>>>>>>(104.l+132) string/c xvid XviD +>>>>>>>(104.l+132) string/c h264 X.264 >>>>>>>(104.l+132) lelong 0 ##>>>>>>>(104.l+132) string x (%.4s) # skip past first (video) LIST diff --git a/contrib/file/Magdir/scientific b/contrib/file/Magdir/scientific new file mode 100644 index 0000000..81beac1 --- /dev/null +++ b/contrib/file/Magdir/scientific @@ -0,0 +1,60 @@ + +#------------------------------------------------------------------------------ +# scientific: file(1) magic for scientific formats +# +# From: Joe Krahn <krahn@niehs.nih.gov> + +######################################################## +# CCP4 data and plot files: +0 string MTZ\040 MTZ reflection file + +92 string PLOT%%84 Plot84 plotting file +>52 byte 1 , Little-endian +>55 byte 1 , Big-endian + +######################################################## +# Electron density MAP/MASK formats + +0 string EZD_MAP NEWEZD Electron Density Map +109 string MAP\040( Old EZD Electron Density Map + +0 string/c :-)\040Origin BRIX Electron Density Map +>170 string >0 , Sigma:%.12s +#>4 string >0 %.178s +#>4 addr x %.178s + +7 string 18\040!NTITLE XPLOR ASCII Electron Density Map +9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map + +208 string MAP\040 CCP4 Electron Density Map +# Assumes same stamp for float and double (normal case) +>212 byte 17 \b, Big-endian +>212 byte 34 \b, VAX format +>212 byte 68 \b, Little-endian +>212 byte 85 \b, Convex native + +############################################################ +# X-Ray Area Detector images +0 string R-AXIS4\ \ \ R-Axis Area Detector Image: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + +0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + + +1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, +>1072 ulong >1 Compressed(%d), +>1100 ulong >1 %d headers, +>1104 ulong >0 %d x +>1108 ulong >0 %d, +>1120 ulong >0 %d bits/pixel diff --git a/contrib/file/Magdir/sgi b/contrib/file/Magdir/sgi index 23f182a..43cb63f 100644 --- a/contrib/file/Magdir/sgi +++ b/contrib/file/Magdir/sgi @@ -48,12 +48,12 @@ >17 byte x hash %d, >11 byte x dataformat %d -# Alias|Wavefront Maya files -0 string //Maya ASCII Alias|Wavefront Maya Ascii File, +# Alias Maya files +0 string //Maya ASCII Alias Maya Ascii File, >13 string >\0 version %s -8 string MAYAFOR4 Alias|Wavefront Maya Binary File, +8 string MAYAFOR4 Alias Maya Binary File, >32 string >\0 version %s scene -8 string MayaFOR4 Alias|Wavefront Maya Binary File, +8 string MayaFOR4 Alias Maya Binary File, >32 string >\0 version %s scene -8 string CIMG Alias|Wavefront Maya Image File -8 string DEEP Alias|Wavefront Maya Image File +8 string CIMG Alias Maya Image File +8 string DEEP Alias Maya Image File diff --git a/contrib/file/Magdir/sharc b/contrib/file/Magdir/sharc index 7201e85..8c2cae4 100644 --- a/contrib/file/Magdir/sharc +++ b/contrib/file/Magdir/sharc @@ -12,7 +12,7 @@ #------------------------------------------------------------------------ # SHARC DSP stuff (based on the FGM SHARC DSP SDK) -0 string ! Assembler source +0 string =! Assembler source 0 string Analog ADi asm listing file 0 string .SYSTEM SHARC architecture file 0 string .system SHARC architecture file diff --git a/contrib/file/Magdir/sql b/contrib/file/Magdir/sql index 29741d95..016e030 100644 --- a/contrib/file/Magdir/sql +++ b/contrib/file/Magdir/sql @@ -16,3 +16,19 @@ 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file >3 byte x Version %d 0 string \376bin MySQL replication log + +#------------------------------------------------------------------------------ +# iRiver H Series database file +# From Ken Guest <ken@linux.ie> +# As observed from iRivNavi.iDB and unencoded firmware +# +0 string iRivDB iRiver Database file +>11 string >\0 Version %s +>39 string iHP-100 [H Series] + +#------------------------------------------------------------------------------ +# SQLite database file +# From Ken Guest <ken@linux.ie> +# +0 string SQLite SQLite database +>14 string >\0 (Version %s) diff --git a/contrib/file/Magdir/varied.out b/contrib/file/Magdir/varied.out index 537c5af..6126f36 100644 --- a/contrib/file/Magdir/varied.out +++ b/contrib/file/Magdir/varied.out @@ -31,5 +31,6 @@ 0 string \xc0HRB Harbour HRB file >4 short x version %d -# From: "Stefan A. Haubenthal" <polluks@web.de> -0 belong 0x000001EB Plan 9 executable +# From: Alex Beregszaszi <alex@fsn.hu> +# 0 string exec BugOS executable +# 0 string pack BugOS archive diff --git a/contrib/file/Magdir/wordprocessors b/contrib/file/Magdir/wordprocessors index 9b122c1..369fd40 100644 --- a/contrib/file/Magdir/wordprocessors +++ b/contrib/file/Magdir/wordprocessors @@ -106,6 +106,12 @@ # Hangul (Korean) Word Processor File 0 string HWP\ Document\ File Hangul (Korean) Word Processor File -# CosmicBook, from Benoît Rouits +# CosmicBook, from Beno�t Rouits 0 string CSBK Ted Neslson's CosmicBook hypertext file +2 string EYWR AmigaWriter file + +# chi: file(1) magic for ChiWriter files +0 string \\1cw\ ChiWriter file +>5 string >\0 version %s +0 string \\1cw ChiWriter file |
