diff options
| author | obrien <obrien@FreeBSD.org> | 2009-01-02 03:10:55 +0000 |
|---|---|---|
| committer | obrien <obrien@FreeBSD.org> | 2009-01-02 03:10:55 +0000 |
| commit | 729acffa050ba99227c27884a5760fdd3d6959b2 (patch) | |
| tree | d5289d633f1b84fbbf947f98b34ff58109fccca7 /contrib/file/Magdir | |
| parent | 964611a3050b11c026667dbb4ae98380fe18252a (diff) | |
| parent | 05dd1f1bd993ec12015e6782ea5c46b6a0b69ecb (diff) | |
| download | FreeBSD-src-729acffa050ba99227c27884a5760fdd3d6959b2.zip FreeBSD-src-729acffa050ba99227c27884a5760fdd3d6959b2.tar.gz | |
Record that base/vendor/file/dist@186675 was merged.
Merge base/vendor/file/dist@186675@186690, bringing FILE 4.26 to 8-CURRENT.
Diffstat (limited to 'contrib/file/Magdir')
90 files changed, 2111 insertions, 755 deletions
diff --git a/contrib/file/Magdir/adventure b/contrib/file/Magdir/adventure index 405d3cc..7b30c49 100644 --- a/contrib/file/Magdir/adventure +++ b/contrib/file/Magdir/adventure @@ -73,3 +73,13 @@ >10 belong 0x0A0D1A00 >>14 string >\0 %s saved game data +# Danny Milosavljevic <danny.milo@gmx.net> +# this are adrift (adventure game standard) game files, extension .taf +# depending on version magic continues with 0x93453E6139FA (V 4.0) +# 0x9445376139FA (V 3.90) +# 0x9445366139FA (V 3.80) +# this is from source (http://www.adrift.org.uk/) and I have some taf +# files, and checked them. +#0 belong 0x3C423FC9 +#>4 belong 0x6A87C2CF Adrift game file +#!:mime application/x-adrift diff --git a/contrib/file/Magdir/animation b/contrib/file/Magdir/animation index 6392f85..443338a 100644 --- a/contrib/file/Magdir/animation +++ b/contrib/file/Magdir/animation @@ -8,57 +8,78 @@ # SGI and Apple formats 0 string MOVI Silicon Graphics movie file +!:mime video/x-sgi-movie 4 string moov Apple QuickTime +!:mime video/quicktime >12 string mvhd \b movie (fast start) >12 string mdra \b URL >12 string cmov \b movie (fast start, compressed header) >12 string rmra \b multiple URLs 4 string mdat Apple QuickTime movie (unoptimized) -4 string wide Apple QuickTime movie (unoptimized) -4 string skip Apple QuickTime movie (modified) -4 string free Apple QuickTime movie (modified) +!:mime video/quicktime +#4 string wide Apple QuickTime movie (unoptimized) +#!:mime video/quicktime +#4 string skip Apple QuickTime movie (modified) +#!:mime video/quicktime +#4 string free Apple QuickTime movie (modified) +#!:mime video/quicktime 4 string idsc Apple QuickTime image (fast start) -4 string idat Apple QuickTime image (unoptimized) +!:mime image/x-quicktime +#4 string idat Apple QuickTime image (unoptimized) +#!:mime image/x-quicktime 4 string pckg Apple QuickTime compressed archive +!:mime application/x-quicktime-player 4 string/B jP JPEG 2000 image +!:mime image/jp2 4 string ftyp ISO Media >8 string isom \b, MPEG v4 system, version 1 +!:mime video/mp4 >8 string iso2 \b, MPEG v4 system, part 12 revision >8 string mp41 \b, MPEG v4 system, version 1 +!:mime video/mp4 >8 string mp42 \b, MPEG v4 system, version 2 +!:mime video/mp4 >8 string mp7t \b, MPEG v4 system, MPEG v7 XML >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML >8 string/B jp2 \b, JPEG 2000 +!:mime image/jp2 >8 string 3gp \b, MPEG v4 system, 3GPP +!:mime video/3gpp >>11 byte 4 \b v4 (H.263/AMR GSM 6.10) >>11 byte 5 \b v5 (H.263/AMR GSM 6.10) >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile +!:mime video/mp4 >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC +!:mime video/3gpp >8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC +!:mime audio/mp4 +>8 string/B M4V \b, MPEG v4 system, iTunes AVC-LC +!:mime video/mp4 >8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted >8 string/B M4B \b, MPEG v4 system, iTunes bookmarked >8 string/B qt \b, Apple QuickTime movie +!:mime video/quicktime # MPEG sequences # Scans for all common MPEG header start codes -0 belong 0x00000001 JVT NAL sequence ->4 byte&0x1F 0x07 \b, H.264 video +0 belong 0x00000001 +>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video >>5 byte 66 \b, baseline >>5 byte 77 \b, main >>5 byte 88 \b, extended >>7 byte x \b @ L %u -0 belong&0xFFFFFF00 0x00000100 MPEG sequence ->3 byte 0xBA +0 belong&0xFFFFFF00 0x00000100 +>3 byte 0xBA MPEG sequence >>4 byte &0x40 \b, v2, program multiplex >>4 byte ^0x40 \b, v1, system multiplex ->3 byte 0xBB \b, v1/2, multiplex (missing pack header) ->3 byte&0x1F 0x07 \b, H.264 video +>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) +>3 byte&0x1F 0x07 MPEG sequence, H.264 video >>4 byte 66 \b, baseline >>4 byte 77 \b, main >>4 byte 88 \b, extended >>6 byte x \b @ L %u ->3 byte 0xB0 \b, v4 +>3 byte 0xB0 MPEG sequence, v4 >>5 belong 0x000001B5 >>>9 byte &0x80 >>>>10 byte&0xF0 16 \b, video @@ -127,7 +148,7 @@ >>4 byte 251 \b, FGS @ L3 >>4 byte 252 \b, FGS @ L4 >>4 byte 253 \b, FGS @ L5 ->3 byte 0xB5 \b, v4 +>3 byte 0xB5 MPEG sequence, v4 >>4 byte &0x80 >>>5 byte&0xF0 16 \b, video (missing profile header) >>>5 byte&0xF0 32 \b, still texture (missing profile header) @@ -137,7 +158,7 @@ >>4 byte&0xF8 16 \b, still texture (missing profile header) >>4 byte&0xF8 24 \b, mesh (missing profile header) >>4 byte&0xF8 32 \b, face (missing profile header) ->3 byte 0xB3 +>3 byte 0xB3 MPEG sequence >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video >>12 belong 0x000001B5 \b, v2, @@ -252,22 +273,39 @@ # modified to fully support MPEG ADTS # MP3, M1A -0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1 +# modified by Joerg Jenderek +# GRR the original test are too common for many DOS files +# so don't accept as MP3 until we've tested the rate +0 beshort&0xFFFE 0xFFFA # rates ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 40 kBits ->2 byte&0xF0 0x30 \b, 48 kBits ->2 byte&0xF0 0x40 \b, 56 kBits ->2 byte&0xF0 0x50 \b, 64 kBits ->2 byte&0xF0 0x60 \b, 80 kBits ->2 byte&0xF0 0x70 \b, 96 kBits ->2 byte&0xF0 0x80 \b, 112 kBits ->2 byte&0xF0 0x90 \b, 128 kBits ->2 byte&0xF0 0xA0 \b, 160 kBits ->2 byte&0xF0 0xB0 \b, 192 kBits ->2 byte&0xF0 0xC0 \b, 224 kBits ->2 byte&0xF0 0xD0 \b, 256 kBits ->2 byte&0xF0 0xE0 \b, 320 kBits +>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps +!:mime audio/mpeg # timing >2 byte&0x0C 0x00 \b, 44.1 kHz >2 byte&0x0C 0x04 \b, 48 kHz @@ -288,20 +326,20 @@ # MP2, M1A 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 # rates ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 48 kBits ->2 byte&0xF0 0x30 \b, 56 kBits ->2 byte&0xF0 0x40 \b, 64 kBits ->2 byte&0xF0 0x50 \b, 80 kBits ->2 byte&0xF0 0x60 \b, 96 kBits ->2 byte&0xF0 0x70 \b, 112 kBits ->2 byte&0xF0 0x80 \b, 128 kBits ->2 byte&0xF0 0x90 \b, 160 kBits ->2 byte&0xF0 0xA0 \b, 192 kBits ->2 byte&0xF0 0xB0 \b, 224 kBits ->2 byte&0xF0 0xC0 \b, 256 kBits ->2 byte&0xF0 0xD0 \b, 320 kBits ->2 byte&0xF0 0xE0 \b, 384 kBits +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 160 kbps +>2 byte&0xF0 0xA0 \b, 192 kbps +>2 byte&0xF0 0xB0 \b, 224 kbps +>2 byte&0xF0 0xC0 \b, 256 kbps +>2 byte&0xF0 0xD0 \b, 320 kbps +>2 byte&0xF0 0xE0 \b, 384 kbps # timing >2 byte&0x0C 0x00 \b, 44.1 kHz >2 byte&0x0C 0x04 \b, 48 kHz @@ -322,58 +360,60 @@ # MPA, M1A # updated by Joerg Jenderek # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 -0 beshort&0xFFFE 0xFFFE ->2 ubyte&0xF0 >0x0F ->>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 -# rate ->>>2 byte&0xF0 0x10 \b, 32 kBits ->>>2 byte&0xF0 0x20 \b, 64 kBits ->>>2 byte&0xF0 0x30 \b, 96 kBits ->>>2 byte&0xF0 0x40 \b, 128 kBits ->>>2 byte&0xF0 0x50 \b, 160 kBits ->>>2 byte&0xF0 0x60 \b, 192 kBits ->>>2 byte&0xF0 0x70 \b, 224 kBits ->>>2 byte&0xF0 0x80 \b, 256 kBits ->>>2 byte&0xF0 0x90 \b, 288 kBits ->>>2 byte&0xF0 0xA0 \b, 320 kBits ->>>2 byte&0xF0 0xB0 \b, 352 kBits ->>>2 byte&0xF0 0xC0 \b, 384 kBits ->>>2 byte&0xF0 0xD0 \b, 416 kBits ->>>2 byte&0xF0 0xE0 \b, 448 kBits -# timing ->>>2 byte&0x0C 0x00 \b, 44.1 kHz ->>>2 byte&0x0C 0x04 \b, 48 kHz ->>>2 byte&0x0C 0x08 \b, 32 kHz -# channels/options ->>>3 byte&0xC0 0x00 \b, Stereo ->>>3 byte&0xC0 0x40 \b, JntStereo ->>>3 byte&0xC0 0x80 \b, 2x Monaural ->>>3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) +# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries +#0 beshort&0xFFFE 0xFFFE +#>2 ubyte&0xF0 >0x0F +#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 +## rate +#>>>2 byte&0xF0 0x10 \b, 32 kbps +#>>>2 byte&0xF0 0x20 \b, 64 kbps +#>>>2 byte&0xF0 0x30 \b, 96 kbps +#>>>2 byte&0xF0 0x40 \b, 128 kbps +#>>>2 byte&0xF0 0x50 \b, 160 kbps +#>>>2 byte&0xF0 0x60 \b, 192 kbps +#>>>2 byte&0xF0 0x70 \b, 224 kbps +#>>>2 byte&0xF0 0x80 \b, 256 kbps +#>>>2 byte&0xF0 0x90 \b, 288 kbps +#>>>2 byte&0xF0 0xA0 \b, 320 kbps +#>>>2 byte&0xF0 0xB0 \b, 352 kbps +#>>>2 byte&0xF0 0xC0 \b, 384 kbps +#>>>2 byte&0xF0 0xD0 \b, 416 kbps +#>>>2 byte&0xF0 0xE0 \b, 448 kbps +## timing +#>>>2 byte&0x0C 0x00 \b, 44.1 kHz +#>>>2 byte&0x0C 0x04 \b, 48 kHz +#>>>2 byte&0x0C 0x08 \b, 32 kHz +## channels/options +#>>>3 byte&0xC0 0x00 \b, Stereo +#>>>3 byte&0xC0 0x40 \b, JntStereo +#>>>3 byte&0xC0 0x80 \b, 2x Monaural +#>>>3 byte&0xC0 0xC0 \b, Monaural +##>1 byte ^0x01 \b, Data Verify +##>2 byte &0x02 \b, Packet Pad +##>2 byte &0x01 \b, Custom Flag +##>3 byte &0x08 \b, Copyrighted +##>3 byte &0x04 \b, Original Source +##>3 byte&0x03 1 \b, NR: 50/15 ms +##>3 byte&0x03 3 \b, NR: CCIT J.17 # MP3, M2A 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -394,20 +434,20 @@ # MP2, M2A 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -428,20 +468,20 @@ # MPA, M2A 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 # rate ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 48 kBits ->2 byte&0xF0 0x30 \b, 56 kBits ->2 byte&0xF0 0x40 \b, 64 kBits ->2 byte&0xF0 0x50 \b, 80 kBits ->2 byte&0xF0 0x60 \b, 96 kBits ->2 byte&0xF0 0x70 \b, 112 kBits ->2 byte&0xF0 0x80 \b, 128 kBits ->2 byte&0xF0 0x90 \b, 144 kBits ->2 byte&0xF0 0xA0 \b, 160 kBits ->2 byte&0xF0 0xB0 \b, 176 kBits ->2 byte&0xF0 0xC0 \b, 192 kBits ->2 byte&0xF0 0xD0 \b, 224 kBits ->2 byte&0xF0 0xE0 \b, 256 kBits +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 144 kbps +>2 byte&0xF0 0xA0 \b, 160 kbps +>2 byte&0xF0 0xB0 \b, 176 kbps +>2 byte&0xF0 0xC0 \b, 192 kbps +>2 byte&0xF0 0xD0 \b, 224 kbps +>2 byte&0xF0 0xE0 \b, 256 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -462,20 +502,20 @@ # MP3, M25A 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 11.025 kHz >2 byte&0x0C 0x04 \b, 12 kHz @@ -497,6 +537,7 @@ # Stored AAC streams (instead of the MP4 format) 0 string ADIF MPEG ADIF, AAC +!:mime audio/x-hx-aac-adif >4 byte &0x80 >>13 byte &0x10 \b, VBR >>13 byte ^0x10 \b, CBR @@ -521,6 +562,7 @@ # Live or stored single AAC stream (used with MPEG-2 systems) 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC +!:mime audio/x-hx-aac-adts >1 byte &0x08 \b, v2 >1 byte ^0x08 \b, v4 # profile @@ -557,6 +599,7 @@ # Live MPEG-4 audio streams (instead of RTP FlexMux) 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS +!:mime audio/x-mp4a-latm #>1 beshort&0x1FFF x \b, %u byte packet >3 byte&0xE0 0x40 >>4 byte&0x3C 0x04 \b, single stream @@ -570,22 +613,34 @@ >>4 byte&0x78 0x18 \b, 3 streams >>4 byte &0x20 \b, 4 or more streams >>4 byte &0x40 \b, 8 or more streams -0 beshort 0x4DE1 MPEG-4 LO-EP audio stream +# This magic isn't strong enough (matches plausible ISO-8859-1 text) +#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream +#!:mime audio/x-mp4a-latm + +# Summary: FLI animation format +# Created by: Daniel Quinlan <quinlan@yggdrasil.com> +# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) +4 leshort 0xAF11 +# standard FLI always has 320x200 resolution and 8 bit color +>8 leshort 320 +>>10 leshort 200 +>>>12 leshort 8 FLI animation, 320x200x8 +!:mime video/x-fli +>>>>6 leshort x \b, %d frames +# frame speed is multiple of 1/70s +>>>>16 leshort x \b, %d/70s per frame -# FLI animation format -4 leshort 0xAF11 FLI file ->6 leshort x - %d frames, ->8 leshort x width=%d pixels, ->10 leshort x height=%d pixels, ->12 leshort x depth=%d, ->16 leshort x ticks/frame=%d -# FLC animation format -4 leshort 0xAF12 FLC file ->6 leshort x - %d frames ->8 leshort x width=%d pixels, ->10 leshort x height=%d pixels, ->12 leshort x depth=%d, ->16 leshort x ticks/frame=%d +# Summary: FLC animation format +# Created by: Daniel Quinlan <quinlan@yggdrasil.com> +# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) +4 leshort 0xAF12 +# standard FLC always use 8 bit color +>12 leshort 8 FLC animation +!:mime video/x-flc +>>8 leshort x \b, %d +>>10 leshort x \bx%dx8 +>>6 uleshort x \b, %d frames +>>16 uleshort x \b, %dms per frame # DL animation format # XXX - collision with most `mips' magic @@ -599,9 +654,11 @@ # 255 (hex FF)! The DL format is really bad. # #0 byte 1 DL version 1, medium format (160x100, 4 images/screen) +#!:mime video/x-unknown #>42 byte x - %d screens, #>43 byte x %d commands #0 byte 2 DL version 2 +#!:mime video/x-unknown #>1 byte 1 - large format (320x200,1 image/screen), #>1 byte 2 - medium format (160x100,4 images/screen), #>1 byte >2 - unknown format, @@ -641,6 +698,7 @@ # MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 0 string \x8aMNG MNG video data, +!:mime video/x-mng >4 belong !0x0d0a1a0a CORRUPTED, >4 belong 0x0d0a1a0a >>16 belong x %ld x @@ -648,6 +706,7 @@ # JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 0 string \x8bJNG JNG video data, +!:mime video/x-jng >4 belong !0x0d0a1a0a CORRUPTED, >4 belong 0x0d0a1a0a >>16 belong x %ld x @@ -658,7 +717,16 @@ # VRML (Virtual Reality Modelling Language) 0 string/b #VRML\ V1.0\ ascii VRML 1 file +!:mime model/vrml 0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file +!:mime model/vrml + +# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] +# From Michel Briand <michelbriand@free.fr> +0 string \<?xml\ version=" +!:strength +1 +>20 search/1000/cb \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text +!:mime model/x3d #--------------------------------------------------------------------------- # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube @@ -681,7 +749,18 @@ # From: Behan Webster <behanw@websterwood.com> # NuppelVideo used by Mythtv (*.nuv) -0 regex NuppelVideo|MythTVVideo MythTV NuppelVideo +# Note: there are two identical stanzas here differing only in the +# initial string matched. It used to be done with a regex, but we're +# trying to get rid of those. +0 string NuppelVideo MythTV NuppelVideo +>12 string x v%s +>20 lelong x (%d +>24 lelong x \bx%d), +>36 string P \bprogressive, +>36 string I \binterlaced, +>40 ledouble x \baspect:%.2f, +>48 ledouble x \bfps:%.2f +0 string MythTV MythTV NuppelVideo >12 string x v%s >20 lelong x (%d >24 lelong x \bx%d), @@ -689,3 +768,25 @@ >36 string I \binterlaced, >40 ledouble x \baspect:%.2f, >48 ledouble x \bfps:%.2f + +# MPEG file +# MPEG sequences +# FIXME: This section is from the old magic.mime file and needs integrating with the rest +0 belong 0x000001BA +>4 byte &0x40 +!:mime video/mp2p +>4 byte ^0x40 +!:mime video/mpeg +0 belong 0x000001BB +!:mime video/mpeg +0 belong 0x000001B0 +!:mime video/mp4v-es +0 belong 0x000001B5 +!:mime video/mp4v-es +0 belong 0x000001B3 +!:mime video/mpv +0 belong&0xFF5FFF1F 0x47400010 +!:mime video/mp2t +0 belong 0x00000001 +>4 byte&0x1F 0x07 +!:mime video/h264 diff --git a/contrib/file/Magdir/apple b/contrib/file/Magdir/apple index 4a593ea2..669ab04 100644 --- a/contrib/file/Magdir/apple +++ b/contrib/file/Magdir/apple @@ -1,8 +1,7 @@ - #------------------------------------------------------------------------------ # apple: file(1) magic for Apple file formats # -0 string FiLeStArTfIlEsTaRt binscii (apple ][) text +0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string NuFile NuFile archive (apple ][) data @@ -10,6 +9,23 @@ 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file +# Type: Apple Emulator 2IMG format +# From: Radek Vokal <rvokal@redhat.com> +0 string 2IMG Apple ][ 2IMG Disk Image +>4 string XGS! \b, XGS +>4 string CTKG \b, Catakig +>4 string ShIm \b, Sheppy's ImageMaker +>4 string WOOF \b, Sweet 16 +>4 string B2TR \b, Bernie ][ the Rescue +>4 string !nfc \b, ASIMOV2 +>4 string x \b, Unknown Format +>0xc byte 00 \b, DOS 3.3 sector order +>>0x10 byte 00 \b, Volume 254 +>>0x10 byte&0x7f x \b, Volume %u +>0xc byte 01 \b, ProDOS sector order +>>0x14 short x \b, %u Blocks +>0xc byte 02 \b, NIB data + # magic for Newton PDA package formats # from Ruda Moura <ruda@helllabs.org> 0 string package0 Newton package, NOS 1.x, @@ -118,11 +134,12 @@ # Nevertheless this will manage to catch a lot of images that happen # to have a solid-colored line at the bottom of the screen. -8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background -8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background -8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background -8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background -8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background +# GRR: Magic too weak +#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background +#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background +#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background +#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background +#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background # Beagle Bros. Apple Mechanic fonts diff --git a/contrib/file/Magdir/archive b/contrib/file/Magdir/archive index 0b3a9ba..b75fac0 100644 --- a/contrib/file/Magdir/archive +++ b/contrib/file/Magdir/archive @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) @@ -8,7 +7,9 @@ # POSIX tar archives 257 string ustar\0 POSIX tar archive +!:mime application/x-tar # encoding: posix 257 string ustar\040\040\0 GNU tar archive +!:mime application/x-tar # encoding: gnu # cpio archives # @@ -22,7 +23,9 @@ # are defined as "short"s; I think all the new formats are # character-header formats and thus are strings, not numbers. 0 short 070707 cpio archive +!:mime application/x-cpio 0 short 0143561 byte-swapped cpio archive +!:mime application/x-cpio # encoding: swapped 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC) @@ -30,8 +33,10 @@ # Debian package (needs to go before regular portable archives) # 0 string =!<arch>\ndebian +!:mime application/x-debian-package >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package +>8 string !debian >68 string >\0 (format %s) # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only @@ -49,6 +54,7 @@ 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string =<ar> archive +!:mime application/x-archive # MIPS archive (needs to go before regular portable archives) # @@ -60,7 +66,7 @@ >19 string B and an EB hash table >22 string X -- out of date -0 string -h- Software Tools format archive text +0 search/1 -h- Software Tools format archive text # # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is @@ -79,6 +85,7 @@ # "ar" archives? # 0 string =!<arch> current ar archive +!:mime application/x-archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 @@ -121,15 +128,24 @@ # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched +!:mime application/x-arc # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000141a ARC+ archive data +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000481a HYP archive data +!:mime application/x-arc # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff @@ -435,6 +451,7 @@ # ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data +!:mime application/x-arj >5 byte x \b, v%d, >8 byte &0x04 multi-volume, >8 byte &0x10 slash-switched, @@ -487,19 +504,32 @@ # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 2 string -lh0- LHarc 1.x/ARX archive data [lh0] +!:mime application/x-lharc 2 string -lh1- LHarc 1.x/ARX archive data [lh1] +!:mime application/x-lharc 2 string -lz4- LHarc 1.x archive data [lz4] +!:mime application/x-lharc 2 string -lz5- LHarc 1.x archive data [lz5] +!:mime application/x-lharc # [never seen any but the last; -lh4- reported in comp.compression:] 2 string -lzs- LHa/LZS archive data [lzs] +!:mime application/x-lha 2 string -lh\40- LHa 2.x? archive data [lh ] +!:mime application/x-lha 2 string -lhd- LHa 2.x? archive data [lhd] +!:mime application/x-lha 2 string -lh2- LHa 2.x? archive data [lh2] +!:mime application/x-lha 2 string -lh3- LHa 2.x? archive data [lh3] +!:mime application/x-lha 2 string -lh4- LHa (2.x) archive data [lh4] +!:mime application/x-lha 2 string -lh5- LHa (2.x) archive data [lh5] +!:mime application/x-lha 2 string -lh6- LHa (2.x) archive data [lh6] +!:mime application/x-lha 2 string -lh7- LHa (2.x)/LHark archive data [lh7] +!:mime application/x-lha >20 byte x - header level %d # taken from idarc [JW] 2 string -lZ PUT archive data @@ -508,6 +538,7 @@ # RAR archiver (Greg Roelofs, newt@uchicago.edu) 0 string Rar! RAR archive data, +!:mime application/x-rar >44 byte x v%0x, >10 byte >0 flags: >>10 byte &0x01 Archive volume, @@ -532,17 +563,24 @@ # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 0 string PK\003\004 >4 byte 0x00 Zip archive data +!:mime application/zip >4 byte 0x09 Zip archive data, at least v0.9 to extract +!:mime application/zip >4 byte 0x0a Zip archive data, at least v1.0 to extract +!:mime application/zip >4 byte 0x0b Zip archive data, at least v1.1 to extract +!:mime application/zip +>0x161 string WINZIP Zip archive data, WinZIP self-extracting +!:mime application/zip >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract ->0x161 string WINZIP Zip archive data, WinZIP self-extracting - +!:mime application/zip # OpenOffice.org / KOffice / StarOffice documents +# Listed here because they ARE zip files +# # From: Abel Cheung <abel@oaka.org> -# Listed here because they are basically zip files +>4 byte 0x14 >>30 string mimetype # KOffice (1.2 or above) formats @@ -572,12 +610,14 @@ >>>>>69 byte !0x2e presentation >>>>>69 string .template template >>>>62 string math Math document +>>>>62 string base Database file # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # http://lists.oasis-open.org/archives/office/200505/msg00006.html >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text +!:mime application/vnd.oasis.opendocument.text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document @@ -596,6 +636,7 @@ # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data +!:mime application/x-zoo >4 byte >48 \b, v%c. >>6 byte >47 \b%c >>>7 byte >47 \b%c @@ -607,6 +648,7 @@ # Shell archives 10 string #\ This\ is\ a\ shell\ archive shell archive text +!:mime application/octet-stream # # LBR. NB: May conflict with the questionable @@ -652,6 +694,7 @@ # Felix von Leitner <felix-file@fefe.de> 0 string d8:announce BitTorrent file +!:mime application/x-bittorrent # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 0 beshort 0x0e0f Atari MSA archive data @@ -709,6 +752,7 @@ # EET archive # From: Tilman Sauerbeck <tilman@code-monkey.de> 0 belong 0x1ee7ff00 EET archive +!:mime application/x-eet # rzip archives 0 string RZIP rzip compressed data @@ -729,12 +773,11 @@ # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file +!:mime application/vnd.symbian.install >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) - -# Pack200 Java archives, http://jcp.org/en/jsr/detail?id=200 -0 belong 0xcafed00d Pack200 Java archive +!:mime x-epoc/x-sisx-app # From "Nelson A. de Oliveira" <naoliv@gmail.com> 0 string MPQ\032 MoPaQ (MPQ) archive @@ -748,3 +791,15 @@ # .kgb 0 string KGB_arch KGB Archiver file >10 string x with compression level %.1s + +# xar (eXtensible ARchiver) archive +# From: "David Remahl" <dremahl@apple.com> +0 string xar! xar archive +#>4 beshort x header size %d +>6 beshort x version %d, +#>8 quad x compressed TOC: %d, +#>16 quad x uncompressed TOC: %d, +>24 belong 0 no checksum +>24 belong 1 SHA-1 checksum +>24 belong 2 MD5 checksum + diff --git a/contrib/file/Magdir/audio b/contrib/file/Magdir/audio index 511da1d..3a9c176 100644 --- a/contrib/file/Magdir/audio +++ b/contrib/file/Magdir/audio @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # audio: file(1) magic for sound formats (see also "iff") # @@ -9,12 +8,19 @@ # Sun/NeXT audio data 0 string .snd Sun/NeXT audio data: >12 belong 1 8-bit ISDN mu-law, +!:mime audio/basic >12 belong 2 8-bit linear PCM [REF-PCM], +!:mime audio/basic >12 belong 3 16-bit linear PCM, +!:mime audio/basic >12 belong 4 24-bit linear PCM, +!:mime audio/basic >12 belong 5 32-bit linear PCM, +!:mime audio/basic >12 belong 6 32-bit IEEE floating point, +!:mime audio/basic >12 belong 7 64-bit IEEE floating point, +!:mime audio/basic >12 belong 8 Fragmented sample data, >12 belong 10 DSP program, >12 belong 11 8-bit fixed point, @@ -26,6 +32,7 @@ >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-adpcm >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -39,12 +46,19 @@ # that uses little-endian encoding and has a different magic number 0 lelong 0x0064732E DEC audio data: >12 lelong 1 8-bit ISDN mu-law, +!:mime audio/x-dec-basic >12 lelong 2 8-bit linear PCM [REF-PCM], +!:mime audio/x-dec-basic >12 lelong 3 16-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 4 24-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 5 32-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 6 32-bit IEEE floating point, +!:mime audio/x-dec-basic >12 lelong 7 64-bit IEEE floating point, +!:mime audio/x-dec-basic >12 belong 8 Fragmented sample data, >12 belong 10 DSP program, >12 belong 11 8-bit fixed point, @@ -56,6 +70,7 @@ >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-dec-basic >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -67,6 +82,7 @@ # Creative Labs AUDIO stuff 0 string MThd Standard MIDI data +!:mime audio/midi >8 beshort x (format %d) >10 beshort x using %d track >10 beshort >1 \bs @@ -74,8 +90,11 @@ >12 beshort&0x8000 >0 SMPTE 0 string CTMF Creative Music (CMF) data +!:mime audio/x-unknown 0 string SBI SoundBlaster instrument data +!:mime audio/x-unknown 0 string Creative\ Voice\ File Creative Labs voice data +!:mime audio/x-unknown # is this next line right? it came this way... >19 byte 0x1A >23 byte >0 - version %d @@ -96,7 +115,13 @@ # Real Audio (Magic .ra\0375) 0 belong 0x2e7261fd RealAudio sound file +!:mime audio/x-pn-realaudio 0 string .RMF RealMedia file +!:mime application/vnd.rn-realmedia +#video/x-pn-realvideo +#video/vnd.rn-realvideo +#application/vnd.rn-realmedia +# sigh, there are many mimes for that but the above are the most common. # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] # Oct 31, 1995 @@ -119,44 +144,84 @@ 0 string GF1PATCH110\0ID#000002\0 GUS patch 0 string GF1PATCH100\0ID#000002\0 Old GUS patch +# mime types according to http://www.geocities.com/nevilo/mod.htm: +# audio/it .it +# audio/x-zipped-it .itz +# audio/xm fasttracker modules +# audio/x-s3m screamtracker modules +# audio/s3m screamtracker modules +# audio/x-zipped-mod mdz +# audio/mod mod +# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) + # # Taken from loader code from mikmod version 2.14 # by Steve McIntyre (stevem@chiark.greenend.org.uk) # <doj@cubic.org> added title printing on 2003-06-24 0 string MAS_UTrack_V00 >14 string >/0 ultratracker V1.%.1s module sound data +!:mime audio/x-mod +#audio/x-tracker-module 0 string UN05 MikMod UNI format module sound data 0 string Extended\ Module: Fasttracker II module sound data +!:mime audio/x-mod +#audio/x-tracker-module >17 string >\0 Title: "%s" 21 string/c =!SCREAM! Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module 21 string BMOD2STM Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module 1080 string M.K. 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module >0 string >\0 Title: "%s" 1080 string M!K! 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module >0 string >\0 Title: "%s" 1080 string FLT4 4-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module >0 string >\0 Title: "%s" 1080 string FLT8 8-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module >0 string >\0 Title: "%s" 1080 string 4CHN 4-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string 6CHN 6-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string 8CHN 8-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string CD81 8-channel Octalyser module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module >0 string >\0 Title: "%s" -1080 string OKTA 8-channel Oktalyzer module sound data +1080 string OKTA 8-channel Octalyzer module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module >0 string >\0 Title: "%s" # Not good enough. #1082 string CH #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 1080 string 16CN 16-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module >0 string >\0 Title: "%s" 1080 string 32CN 32-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module >0 string >\0 Title: "%s" # TOC sound files -Trevor Johnson <trevor@jpj.net> @@ -208,7 +273,7 @@ >22 belong&0x00ffffff x %d Hz, >18 beshort =0 no loop, >18 beshort =-1 loop, ->21 ubyte <=127 note %d, +>21 ubyte <128 note %d, >22 byte =0 replay 5.485 KHz >22 byte =1 replay 8.084 KHz >22 byte =2 replay 10.971 Khz @@ -221,9 +286,11 @@ # SGI SoundTrack <mpruett@sgi.com> 0 string _SGI_SoundTrack SGI SoundTrack project file # ID3 version 2 tags <waschk@informatik.uni-rostock.de> -0 string ID3 Audio file with ID3 version 2 ->3 ubyte <0xff \b%d. ->4 ubyte <0xff \b%d tag +0 string ID3 Audio file with ID3 version 2. +# ??? Normally such a file is an MP3 file, but this will give false positives +!:mime audio/mpeg +>3 ubyte <0xff \b%d +#>4 ubyte <0xff \b%d tag >2584 string fLaC \b, FLAC encoding >>2588 byte&0x7f >0 \b, unknown version >>2588 byte&0x7f 0 \b @@ -270,6 +337,7 @@ # Impulse tracker module (audio/x-it) 0 string IMPM Impulse Tracker module sound data - +!:mime audio/x-mod >4 string >\0 "%s" >40 leshort !0 compatible w/ITv%x >42 leshort !0 created w/ITv%x @@ -380,6 +448,7 @@ # Free lossless audio codec <http://flac.sourceforge.net> # From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 0 string fLaC FLAC audio bitstream data +!:mime audio/x-flac >4 byte&0x7f >0 \b, unknown version >4 byte&0x7f 0 \b # some common bits/sample values @@ -502,9 +571,9 @@ # .preset 0 string [Equalizer\ preset] XMMS equalizer preset # .m3u -0 string #EXTM3U M3U playlist +0 search/1 #EXTM3U M3U playlist text # .pls -0 string [playlist] PLS playlist +0 search/1 [playlist] PLS playlist text # licq.conf 1 string [licq] LICQ configuration file @@ -553,9 +622,6 @@ # http://www.wx800.com/msg/download/irda/iMelody.pdf 0 string BEGIN:IMELODY iMelody Ringtone Format -# From: Matthew Flaschen <matthew.flaschen@gatech.edu> -0 string #EXTM3U M3U playlist text - # From: "Mateus Caruccio" <mateus@caruccio.com> # guitar pro v3,4,5 from http://filext.com/file-extension/gp3 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature @@ -563,3 +629,7 @@ # From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 60 string SONG SoundFX Module sound file +# Type: Adaptive Multi-Rate Codec +# URL: http://filext.com/detaillist.php?extdetail=AMR +# From: Russell Coker <russell@coker.com.au> +0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) diff --git a/contrib/file/Magdir/c-lang b/contrib/file/Magdir/c-lang index fd3f9aa..895e37f 100644 --- a/contrib/file/Magdir/c-lang +++ b/contrib/file/Magdir/c-lang @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # c-lang: file(1) magic for C programs (or REXX) # @@ -6,11 +5,15 @@ # XPM icons (Greg Roelofs, newt@uchicago.edu) # if you uncomment "/*" for C/REXX below, also uncomment this entry #0 string /*\ XPM\ */ X pixmap image data +#!:mime image/x-xpmi + +# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' +#16 beshort 0x3d3d image/x-3ds # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs -#0 string /* C or REXX program text -#0 string // C++ program text +#0 search/1 /* C or REXX program text +#0 search/1 // C++ program text # From: Mikhail Teterin <mi@aldan.algebra.com> 0 string cscope cscope reference data @@ -20,5 +23,5 @@ # The inverted index functionality was added some time betwen # versions 11 and 15, so look for -q if version is above 14: >7 string >14 ->>10 regex .+\ -q\ with inverted index ->10 regex .+\ -c\ text (non-compressed) +>>10 search/100 \ -q\ with inverted index +>10 search/100 \ -c\ text (non-compressed) diff --git a/contrib/file/Magdir/c64 b/contrib/file/Magdir/c64 index a224b21..f8a8b76 100644 --- a/contrib/file/Magdir/c64 +++ b/contrib/file/Magdir/c64 @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # c64: file(1) magic for various commodore 64 related files # diff --git a/contrib/file/Magdir/cafebabe b/contrib/file/Magdir/cafebabe index 233411c..db385ea 100644 --- a/contrib/file/Magdir/cafebabe +++ b/contrib/file/Magdir/cafebabe @@ -12,10 +12,16 @@ # (and use as a hack). Let's not use 18, because the Mach-O people # might add another one or two as time goes by... # -0 belong 0xcafebabe ->4 belong >30 compiled Java class data, ->>6 beshort x version %d. ->>4 beshort x \b%d ->4 belong 1 Mach-O fat file with 1 architecture ->4 belong >1 ->>4 belong <20 Mach-O fat file with %ld architectures +0 beshort 0xcafe +>2 beshort 0xbabe +!:mime application/x-java-applet +>>2 belong >30 compiled Java class data, +>>>6 beshort x version %d. +>>>4 beshort x \b%d +>>4 belong 1 Mach-O fat file with 1 architecture +>>4 belong >1 +>>>4 belong <20 Mach-O fat file with %ld architectures +>2 beshort 0xd00d JAR compressed with pack200, +>>5 byte x version %d. +>>4 byte x \b%d +!:mime application/x-java-pack200 diff --git a/contrib/file/Magdir/cddb b/contrib/file/Magdir/cddb index 2ea97ee..42ca416 100644 --- a/contrib/file/Magdir/cddb +++ b/contrib/file/Magdir/cddb @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # CDDB: file(1) magic for CDDB(tm) format CD text data files # @@ -8,4 +7,4 @@ # CDDB-enabled CD player applications. # -0 string/b #\040xmcd CDDB(tm) format CD text data +0 search/1/b #\040xmcd CDDB(tm) format CD text data diff --git a/contrib/file/Magdir/clarion b/contrib/file/Magdir/clarion new file mode 100644 index 0000000..5f5f6e7 --- /dev/null +++ b/contrib/file/Magdir/clarion @@ -0,0 +1,26 @@ + +#------------------------------------------------------------------------------ +# clarion: file(1) magic for # Clarion Personal/Professional Developer +# (v2 and above) +# From: Julien Blache <jb@jblache.org> + +# Database files +# signature +0 leshort 0x3343 Clarion Developer (v2 and above) data file +# attributes +>2 leshort &0x0001 \b, locked +>2 leshort &0x0004 \b, encrypted +>2 leshort &0x0008 \b, memo file exists +>2 leshort &0x0010 \b, compressed +>2 leshort &0x0040 \b, read only +# number of records +>5 lelong x \b, %ld records + +# Memo files +0 leshort 0x334d Clarion Developer (v2 and above) memo data + +# Key/Index files +# No magic? :( + +# Help files +0 leshort 0x49e0 Clarion Developer (v2 and above) help data diff --git a/contrib/file/Magdir/commands b/contrib/file/Magdir/commands index 599c190..0942802 100644 --- a/contrib/file/Magdir/commands +++ b/contrib/file/Magdir/commands @@ -2,41 +2,62 @@ #------------------------------------------------------------------------------ # commands: file(1) magic for various shells and interpreters # -0 string : shell archive or script for antique kernel text -0 string/b #!\ /bin/sh Bourne shell script text executable +#0 string : shell archive or script for antique kernel text +0 string/b #!\ /bin/sh POSIX shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /bin/csh C shell script text executable +!:mime text/x-shellscript # korn shell magic, sent by George Wu, gwu@clyde.att.com 0 string/b #!\ /bin/ksh Korn shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /bin/tcsh Tenex C shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable +!:mime text/x-shellscript # # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable +!:mime text/x-shellscript 0 string/b #!\ /bin/nawk new awk script text executable +!:mime text/x-nawk 0 string/b #!\ /usr/bin/nawk new awk script text executable +!:mime text/x-nawk 0 string/b #!\ /usr/local/bin/nawk new awk script text executable +!:mime text/x-nawk 0 string/b #!\ /bin/gawk GNU awk script text executable +!:mime text/x-gawk 0 string/b #!\ /usr/bin/gawk GNU awk script text executable +!:mime text/x-gawk 0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable +!:mime text/x-gawk # 0 string/b #!\ /bin/awk awk script text executable +!:mime text/x-awk 0 string/b #!\ /usr/bin/awk awk script text executable +!:mime text/x-awk # update to distinguish from *.vcf files # this is broken because postscript has /EBEGIN{ for example. -#0 regex BEGIN[[:space:]]*[{] awk script text +#0 search/Bb BEGIN { awk script text # AT&T Bell Labs' Plan 9 shell 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 0 string/b #!\ /bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript # using env 0 string #!/usr/bin/env a @@ -46,11 +67,16 @@ # PHP scripts # Ulf Harnhammar <ulfh@update.uu.se> -0 string/c =<?php PHP script text -0 string =<?\n PHP script text -0 string =<?\r PHP script text -0 string/b #!\ /usr/local/bin/php PHP script text executable -0 string/b #!\ /usr/bin/php PHP script text executable +0 search/1/c =<?php PHP script text +!:mime text/x-php +0 search/1 =<?\n PHP script text +!:mime text/x-php +0 search/1 =<?\r PHP script text +!:mime text/x-php +0 search/1/b #!\ /usr/local/bin/php PHP script text executable +!:mime text/x-php +0 search/1/b #!\ /usr/bin/php PHP script text executable +!:mime text/x-php 0 string Zend\x00 PHP script Zend Optimizer data diff --git a/contrib/file/Magdir/compress b/contrib/file/Magdir/compress index e9be46b..e2e4e03 100644 --- a/contrib/file/Magdir/compress +++ b/contrib/file/Magdir/compress @@ -10,6 +10,7 @@ # standard unix compress 0 string \037\235 compress'd data +!:mime application/x-compress >2 byte&0x80 >0 block compressed >2 byte&0x1f x %d bits @@ -19,6 +20,7 @@ # * Produce shorter output - notably, only report compression methods # other than 8 ("deflate", the only method defined in RFC 1952). 0 string \037\213 gzip compressed data +!:mime application/x-gzip >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII @@ -49,23 +51,29 @@ # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 0 string \037\036 packed data +!:mime application/octet-stream >2 belong >1 \b, %d characters originally >2 belong =1 \b, %d character originally # # This magic number is byte-order-independent. 0 short 0x1f1f old packed data +!:mime application/octet-stream # XXX - why *two* entries for "compacted data", one of which is # byte-order independent, and one of which is byte-order dependent? # 0 short 0x1fff compacted data +!:mime application/octet-stream # This string is valid for SunOS (BE) and a matching "short" is listed # in the Ultrix (LE) magic file. 0 string \377\037 compacted data +!:mime application/octet-stream 0 short 0145405 huf output +!:mime application/octet-stream # bzip2 0 string BZh bzip2 compressed data +!:mime application/x-bzip2 >3 byte >47 \b, block size = %c00k # squeeze and crunch @@ -102,17 +110,17 @@ # bzip a block-sorting file compressor # by Julian Seward <sewardj@cs.man.ac.uk> and others # -0 string BZ bzip compressed data ->2 byte x \b, version: %c ->3 string =1 \b, compression block size 100k ->3 string =2 \b, compression block size 200k ->3 string =3 \b, compression block size 300k ->3 string =4 \b, compression block size 400k ->3 string =5 \b, compression block size 500k ->3 string =6 \b, compression block size 600k ->3 string =7 \b, compression block size 700k ->3 string =8 \b, compression block size 800k ->3 string =9 \b, compression block size 900k +#0 string BZ bzip compressed data +#>2 byte x \b, version: %c +#>3 string =1 \b, compression block size 100k +#>3 string =2 \b, compression block size 200k +#>3 string =3 \b, compression block size 300k +#>3 string =4 \b, compression block size 400k +#>3 string =5 \b, compression block size 500k +#>3 string =6 \b, compression block size 600k +#>3 string =7 \b, compression block size 700k +#>3 string =8 \b, compression block size 800k +#>3 string =9 \b, compression block size 900k # lzop from <markus.oberhumer@jk.uni-linz.ac.at> 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data @@ -174,6 +182,13 @@ >6 byte x version %d >7 byte x \b.%d +# Type: LZMA +# URL: http://www.7-zip.org/sdk.html +# From: Robert Millan <rmh@aybabtu.com> and Reuben Thomas <rrt@sc3d.org> +# Commented out because apparently not reliable (according to Debian +# bug #364260) +#0 string ]\000\000\200\000 LZMA compressed data + # AFX compressed files (Wolfram Kleff) 2 string -afx- AFX compressed file data diff --git a/contrib/file/Magdir/console b/contrib/file/Magdir/console index 775472d..2af6575 100644 --- a/contrib/file/Magdir/console +++ b/contrib/file/Magdir/console @@ -117,6 +117,12 @@ # 0 belong 0x37804012 V64 Nintendo 64 ROM dump +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +# Nintendo .nds +192 string \044\377\256Qi\232 Nintendo DS Game ROM Image +# Nintendo .gba +0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image + #------------------------------------------------------------------------------ # msx: file(1) magic for MSX game cartridge dumps # Too simple - MPi @@ -246,9 +252,3 @@ >>>(0x18.l-26) lelong x CRC32 0x%08x >>>(0x18.l-23) string x "%s" -# From: "Nelson A. de Oliveira" <naoliv@gmail.com> -# .w3g -0 string Warcraft\ III\ recorded\ game %s -# .w3m -0 string HM3W Warcraft III map file - diff --git a/contrib/file/Magdir/cracklib b/contrib/file/Magdir/cracklib index 8f7e0d4..a1a5a27 100644 --- a/contrib/file/Magdir/cracklib +++ b/contrib/file/Magdir/cracklib @@ -9,5 +9,5 @@ 0 belong 0x70775631 Cracklib password index, big endian >4 belong >-1 (%i words) # really bellong 0x0000000070775631 -4 belong 0x70775631 Cracklib password index, big endian ("64-bit") +0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") >12 belong >0 (%i words) diff --git a/contrib/file/Magdir/ctags b/contrib/file/Magdir/ctags index 84c5b7f..f326cf5 100644 --- a/contrib/file/Magdir/ctags +++ b/contrib/file/Magdir/ctags @@ -1,5 +1,4 @@ - # ---------------------------------------------------------------------------- # ctags: file (1) magic for Exuberant Ctags files # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> -0 string =!_TAG Exuberant Ctags tag file text +0 search/1 =!_TAG Exuberant Ctags tag file text diff --git a/contrib/file/Magdir/database b/contrib/file/Magdir/database index 8f2fc0a..2e6ad2f 100644 --- a/contrib/file/Magdir/database +++ b/contrib/file/Magdir/database @@ -9,8 +9,11 @@ # Will be maintained as part of the GDBM distribution in the future. # <downsj@teeny.org> 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian +!:mime application/x-gdbm 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian +!:mime application/x-gdbm 0 string GDBM GNU dbm 2.x database +!:mime application/x-gdbm # # Berkeley DB # @@ -21,6 +24,7 @@ # Hash and Btree 2.X and later databases store the metadata in host byte order. 0 long 0x00061561 Berkeley DB +!:mime application/x-dbm >8 belong 4321 >>4 belong >2 1.86 >>4 belong <3 1.85 @@ -107,74 +111,87 @@ #>>0x04 byte 6 non-incrementing secondary index .XGn file #>>0x04 byte 7 secondary index .YGn file #>>>0x04 byte 8 incrementing secondary index .XGn file + ## XBase database files #0 byte 0x02 #>8 leshort >0 #>>12 leshort 0 FoxBase +#!:mime application/x-dbf #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x03 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x04 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE IV no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x05 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE V no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x30 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 Visual FoxPro #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x43 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with memo var size #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x7b +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASEIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x83 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, dBaseIII+ with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8b +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8e +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with SQL Table #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xb3 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with .dbt memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xf5 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxPro with memo #>>>0x04 lelong 0 (no records) @@ -183,7 +200,8 @@ #0 leshort 0x0006 DBase 3 index file # MS Access database -4 string Standard\ Jet\ DB Microsoft Access Database +4 string Standard\ Jet\ DB Microsoft Access Database +!:mime application/x-msaccess # TDB database from Samba et al - Martin Pool <mbp@samba.org> 0 string TDB\ file TDB database @@ -216,7 +234,11 @@ 0 string PGDMP PostgreSQL custom database dump >5 byte x - v%d >6 byte x \b.%d ->5 beshort <=0x100 \b-0 +>5 beshort <0x101 \b-0 >5 beshort >0x100 >>7 byte x \b-%d +# Type: Advanced Data Format (ADF) database +# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ +# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> +0 string @(#)ADF\ Database CGNS Advanced Data Format diff --git a/contrib/file/Magdir/diff b/contrib/file/Magdir/diff index 187e892..291bae6 100644 --- a/contrib/file/Magdir/diff +++ b/contrib/file/Magdir/diff @@ -1,10 +1,14 @@ - #------------------------------------------------------------------------------ # diff: file(1) magic for diff(1) output # -0 string diff\ 'diff' output text -0 string ***\ 'diff' output text -0 string Only\ in\ 'diff' output text -0 string Common\ subdirectories:\ 'diff' output text +0 search/1 diff\ diff output text +!:mime text/x-diff +0 search/1 ***\ diff output text +!:mime text/x-diff +0 search/1 Only\ in\ diff output text +!:mime text/x-diff +0 search/1 Common\ subdirectories:\ diff output text +!:mime text/x-diff -0 string Index: RCS/CVS diff output text +0 search/1 Index: RCS/CVS diff output text +!:mime text/x-diff diff --git a/contrib/file/Magdir/dump b/contrib/file/Magdir/dump index addd954..cef191a 100644 --- a/contrib/file/Magdir/dump +++ b/contrib/file/Magdir/dump @@ -91,3 +91,41 @@ >0 leshort 5 end of volume. >0 leshort 6 map of inodes deleted. >0 leshort 7 end of medium (for floppy). + +24 belong 0x19540119 new-fs dump file (ufs2, big endian), +>896 beqdate x Previous dump %s, +>904 beqdate x This dump %s, +>12 belong >0 Volume %ld, +>692 belong 0 Level zero, type: +>692 belong >0 Level %d, type: +>0 belong 1 tape header, +>0 belong 2 beginning of file record, +>0 belong 3 map of inodes on tape, +>0 belong 4 continuation of file record, +>0 belong 5 end of volume, +>0 belong 6 map of inodes deleted, +>0 belong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 belong >0 Flags %x + +24 lelong 0x19540119 new-fs dump file (ufs2, little endian), +>896 leqdate x This dump %s, +>904 leqdate x Previous dump %s, +>12 lelong >0 Volume %ld, +>692 lelong 0 Level zero, type: +>692 lelong >0 Level %d, type: +>0 lelong 1 tape header, +>0 lelong 2 beginning of file record, +>0 lelong 3 map of inodes on tape, +>0 lelong 4 continuation of file record, +>0 lelong 5 end of volume, +>0 lelong 6 map of inodes deleted, +>0 lelong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 lelong >0 Flags %x diff --git a/contrib/file/Magdir/elf b/contrib/file/Magdir/elf index 464b436..891e2ad 100644 --- a/contrib/file/Magdir/elf +++ b/contrib/file/Magdir/elf @@ -7,7 +7,12 @@ # # What're the correct byte orders for the nCUBE and the Fujitsu VPP500? # -# updated by Daniel Quinlan (quinlan@yggdrasil.com) +# Created by: unknown +# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> +# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) +# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) +# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) +# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 0 string \177ELF ELF >4 byte 0 invalid class >4 byte 1 32-bit @@ -15,12 +20,16 @@ >5 byte 0 invalid byte order >5 byte 1 LSB >>16 leshort 0 no file type, +!:strength *2 +!:mime application/octet-stream >>16 leshort 1 relocatable, +!:mime application/x-object >>16 leshort 2 executable, +!:mime application/x-executable >>16 leshort 3 shared object, -# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> -# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> +!:mime application/x-sharedlib >>16 leshort 4 core file +!:mime application/x-coredump # Core file detection is not reliable. #>>>(0x38+0xcc) string >\0 of '%s' #>>>(0x38+0x10) lelong >0 (signal %d), @@ -74,7 +83,7 @@ >>>48 leshort &0x0008 (LP64), >>18 leshort 16 nCUBE, >>18 leshort 17 Fujitsu VPP500, ->>18 leshort 18 SPARC32PLUS, +>>18 leshort 18 SPARC32PLUS - invalid byte order, >>18 leshort 20 PowerPC, >>18 leshort 22 IBM S/390, >>18 leshort 36 NEC V800, @@ -96,9 +105,46 @@ >>18 leshort 51 Stanford MIPS-X, >>18 leshort 52 Motorola Coldfire, >>18 leshort 53 Motorola M68HC12, +>>18 leshort 54 Fujitsu MMA, +>>18 leshort 55 Siemens PCP, +>>18 leshort 56 Sony nCPU, +>>18 leshort 57 Denso NDR1, +>>18 leshort 58 Start*Core, +>>18 leshort 59 Toyota ME16, +>>18 leshort 60 ST100, +>>18 leshort 61 Tinyj emb., >>18 leshort 62 x86-64, +>>18 leshort 63 Sony DSP, +>>18 leshort 66 FX66, +>>18 leshort 67 ST9+ 8/16 bit, +>>18 leshort 68 ST7 8 bit, +>>18 leshort 69 MC68HC16, +>>18 leshort 70 MC68HC11, +>>18 leshort 71 MC68HC08, +>>18 leshort 72 MC68HC05, +>>18 leshort 73 SGI SVx, +>>18 leshort 74 ST19 8 bit, >>18 leshort 75 Digital VAX, +>>18 leshort 76 Axis cris, +>>18 leshort 77 Infineon 32-bit embedded, +>>18 leshort 78 Element 14 64-bit DSP, +>>18 leshort 79 LSI Logic 16-bit DSP, +>>18 leshort 80 MMIX, +>>18 leshort 81 Harvard machine-independent, +>>18 leshort 82 SiTera Prism, +>>18 leshort 83 Atmel AVR 8-bit, +>>18 leshort 84 Fujitsu FR30, +>>18 leshort 85 Mitsubishi D10V, +>>18 leshort 86 Mitsubishi D30V, +>>18 leshort 87 NEC v850, >>18 leshort 88 Renesas M32R, +>>18 leshort 89 Matsushita MN10300, +>>18 leshort 90 Matsushita MN10200, +>>18 leshort 91 picoJava, +>>18 leshort 92 OpenRISC, +>>18 leshort 93 ARC Cores Tangent-A5, +>>18 leshort 0x3426 OpenRISC (obsolete), +>>18 leshort 0x8472 OpenRISC (obsolete), >>18 leshort 94 Tensilica Xtensa, >>18 leshort 97 NatSemi 32k, >>18 leshort 106 Analog Devices Blackfin, @@ -108,10 +154,15 @@ >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB >>16 beshort 0 no file type, +!:mime application/octet-stream >>16 beshort 1 relocatable, +!:mime application/x-object >>16 beshort 2 executable, +!:mime application/x-executable >>16 beshort 3 shared object, +!:mime application/x-sharedlib >>16 beshort 4 core file, +!:mime application/x-coredump #>>>(0x38+0xcc) string >\0 of '%s' #>>>(0x38+0x10) belong >0 (signal %d), >>16 beshort &0xff00 processor-specific, @@ -163,10 +214,10 @@ >>18 beshort 16 nCUBE, >>18 beshort 17 Fujitsu VPP500, >>18 beshort 18 SPARC32PLUS, ->>>36 belong&0xffff00 &0x000100 V8+ Required, ->>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required, ->>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required, ->>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required, +>>>36 belong&0xffff00 0x000100 V8+ Required, +>>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, +>>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required, +>>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, >>18 beshort 20 PowerPC or cisco 4500, >>18 beshort 21 64-bit PowerPC or cisco 7500, >>18 beshort 22 IBM S/390, @@ -181,6 +232,12 @@ >>18 beshort 41 Alpha, >>18 beshort 42 Renesas SH, >>18 beshort 43 SPARC V9, +>>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, +>>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required, +>>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, +>>>48 belong&0x3 0 total store ordering, +>>>48 belong&0x3 1 partial store ordering, +>>>48 belong&0x3 2 relaxed memory ordering, >>18 beshort 44 Siemens Tricore Embedded Processor, >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., >>18 beshort 46 Renesas H8/300, @@ -194,6 +251,9 @@ >>18 beshort 73 Cray NV1, >>18 beshort 75 Digital VAX, >>18 beshort 88 Renesas M32R, +>>18 leshort 92 OpenRISC, +>>18 leshort 0x3426 OpenRISC (obsolete), +>>18 leshort 0x8472 OpenRISC (obsolete), >>18 beshort 94 Tensilica Xtensa, >>18 beshort 97 NatSemi 32k, >>18 beshort 0x18ad AVR32 (unofficial), @@ -220,7 +280,6 @@ >>7 byte 10 (Tru64) >>7 byte 11 (Novell Modesto) >>7 byte 12 (OpenBSD) -# VMS Itanium added by gerardo.cacciari@gmail.com >8 string \2 >>7 byte 13 (OpenVMS) >>7 byte 97 (ARM) diff --git a/contrib/file/Magdir/erlang b/contrib/file/Magdir/erlang new file mode 100644 index 0000000..59f55ec --- /dev/null +++ b/contrib/file/Magdir/erlang @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# erlang: file(1) magic for Erlang JAM and BEAM files +# URL: http://www.erlang.org/faq/x779.html#AEN812 + +# OTP R3-R4 +0 string \0177BEAM! Old Erlang BEAM file +>6 short >0 - version %d + +# OTP R5 and onwards +0 string FOR1 +>8 string BEAM Erlang BEAM file + +# 4.2 version may have a copyright notice! +4 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2 +79 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2 + +4 string 1.0 Fri Feb 3 09:55:56 MET 1995 Erlang JAM file - version 4.3 diff --git a/contrib/file/Magdir/filesystems b/contrib/file/Magdir/filesystems index 20b257b..36c2f72 100644 --- a/contrib/file/Magdir/filesystems +++ b/contrib/file/Magdir/filesystems @@ -833,7 +833,7 @@ # Minix filesystems - Juan Cespedes <cespedes@debian.org> 0x410 leshort 0x137f Minix filesystem -0x410 beshort 0x137f Minix filesystem (big endian), +0x410 beshort 0x137f Minix filesystem (big endian) >0x402 beshort !0 \b, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f Minix filesystem, 30 char names @@ -1025,19 +1025,42 @@ >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization -# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com> -0x438 leshort 0xEF53 Linux ->0x44c lelong x rev %d ->0x43e leshort x \b.%d ->0x45c lelong ^0x0000004 ext2 filesystem data ->>0x43a leshort ^0x0000001 (mounted or unclean) ->0x45c lelong &0x0000004 ext3 filesystem data ->>0x460 lelong &0x0000004 (needs journal recovery) ->0x43a leshort &0x0000002 (errors) ->0x460 lelong &0x0000001 (compressed) -#>0x460 lelong &0x0000002 (filetype) -#>0x464 lelong &0x0000001 (sparse_super) ->0x464 lelong &0x0000002 (large files) +# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> +# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> +0x438 leshort 0xEF53 Linux +>0x44c lelong x rev %d +>0x43e leshort x \b.%d +# No journal? ext2 +>0x45c lelong ^0x0000004 ext2 filesystem data +>>0x43a leshort ^0x0000001 (mounted or unclean) +# Has a journal? ext3 or ext4 +>0x45c lelong &0x0000004 +# and small INCOMPAT? +>>0x460 lelong <0x0000040 +# and small RO_COMPAT? +>>>0x464 lelong <0x0000008 ext3 filesystem data +# else large RO_COMPAT? +>>>0x464 lelong >0x0000007 ext4 filesystem data +# else large INCOMPAT? +>>0x460 lelong >0x000003f ext4 filesystem data +# General flags for any ext* fs +>0x460 lelong &0x0000004 (needs journal recovery) +>0x43a leshort &0x0000002 (errors) +# INCOMPAT flags +>0x460 lelong &0x0000001 (compressed) +#>0x460 lelong &0x0000002 (filetype) +#>0x460 lelong &0x0000010 (meta bg) +>0x460 lelong &0x0000040 (extents) +>0x460 lelong &0x0000080 (64bit) +#>0x460 lelong &0x0000100 (mmp) +#>0x460 lelong &0x0000200 (flex bg) +# RO_INCOMPAT flags +#>0x464 lelong &0x0000001 (sparse super) +>0x464 lelong &0x0000002 (large files) +>0x464 lelong &0x0000008 (huge files) +#>0x464 lelong &0x0000010 (gdt checksum) +#>0x464 lelong &0x0000020 (many subdirs) +#>0x463 lelong &0x0000040 (extra isize) # SGI disk labels - Nathan Scott <nathans@debian.org> 0 belong 0x0BE5A941 SGI disk label (volume header) @@ -1115,40 +1138,42 @@ # CDROM Filesystems # Modified for UDF by gerardo.cacciari@gmail.com -32769 string CD001 ->38913 string !NSR0 ISO 9660 CD-ROM filesystem data ->38913 string NSR0 UDF filesystem data ->>38917 string 1 (version 1.0) ->>38917 string 2 (version 1.5) ->>38917 string 3 (version 2.0) ->>38917 byte >0x33 (unknown version, ID 0x%X) ->>38917 byte <0x31 (unknown version, ID 0x%X) +32769 string CD001 +!:mime application/x-iso9660-image +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data +>38913 string NSR0 UDF filesystem data +>>38917 string 1 (version 1.0) +>>38917 string 2 (version 1.5) +>>38917 string 3 (version 2.0) +>>38917 byte >0x33 (unknown version, ID 0x%X) +>>38917 byte <0x31 (unknown version, ID 0x%X) # "application id" which appears to be used as a volume label ->32808 string >\0 '%s' ->34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) -37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) -32776 string CDROM High Sierra CD-ROM filesystem data +>32808 string >\0 '%s' +>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) +37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) +!:mime application/x-iso9660-image +32776 string CDROM High Sierra CD-ROM filesystem data # cramfs filesystem - russell@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian ->4 lelong x size %d +>4 lelong x size %lu >8 lelong &1 version #2 >8 lelong &2 sorted_dirs >8 lelong &4 hole_support >32 lelong x CRC 0x%x, ->36 lelong x edition %d, ->40 lelong x %d blocks, ->44 lelong x %d files +>36 lelong x edition %lu, +>40 lelong x %lu blocks, +>44 lelong x %lu files 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian ->4 belong x size %d +>4 belong x size %lu >8 belong &1 version #2 >8 belong &2 sorted_dirs >8 belong &4 hole_support >32 belong x CRC 0x%x, ->36 belong x edition %d, ->40 belong x %d blocks, ->44 belong x %d files +>36 belong x edition %lu, +>40 belong x %lu blocks, +>44 belong x %lu files # reiserfs - russell@coker.com.au 0x10034 string ReIsErFs ReiserFS V3.5 @@ -1241,6 +1266,34 @@ >>>2 short 2048 AXP generated) >>>2 short 4096 I64 generated) +# Summary: Oracle Clustered Filesystem +# Created by: Aaron Botsis <redhat@digitalmafia.org> +8 string OracleCFS Oracle Clustered Filesystem, +>4 long x rev %d +>0 long x \b.%d, +>560 string x label: %.64s, +>136 string x mountpoint: %.128s + +# Summary: Oracle ASM tagged volume +# Created by: Aaron Botsis <redhat@digitalmafia.org> +32 string ORCLDISK Oracle ASM Volume, +>40 string x Disk Name: %0.12s +32 string ORCLCLRD Oracle ASM Volume (cleared), +>40 string x Disk Name: %0.12s + +# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> +8 string OracleCFS Oracle Clustered Filesystem, +>4 long x rev %d +>0 long x \b.%d, +>560 string x label: %.64s, +>136 string x mountpoint: %.128s + +# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> +32 string ORCLDISK Oracle ASM Volume, +>40 string x Disk Name: %0.12s +32 string ORCLCLRD Oracle ASM Volume (cleared), +>40 string x Disk Name: %0.12s + # Compaq/HP RILOE floppy image # From: Dirk Jagdmann <doj@cubic.org> 0 string CPQRFBLO Compaq/HP RILOE floppy image @@ -1259,3 +1312,18 @@ # http://filext.com/file-extension/DAA # describes the daa file format. The magic would be: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive + +# From Albert Cahalan <acahalan@gmail.com> +# really le32 operation,destination,payloadsize (but quite predictable) +# 01 00 00 00 00 00 00 c0 00 02 00 00 +0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware + +# From Eric Sandeen +# GFS2 +0x10000 belong 0x01161970 GFS2 Filesystem +>0x10024 belong x (blocksize %d, +>0x10060 string >\0 lockproto %s) + +# dvdisaster's .ecc +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string *dvdisaster* dvdisaster error correction file diff --git a/contrib/file/Magdir/flash b/contrib/file/Magdir/flash index f14b460..0b985f2 100644 --- a/contrib/file/Magdir/flash +++ b/contrib/file/Magdir/flash @@ -8,10 +8,13 @@ # 0 string FWS Macromedia Flash data, >3 byte x version %d +!:mime application/x-shockwave-flash 0 string CWS Macromedia Flash data (compressed), +!:mime application/x-shockwave-flash >3 byte x version %d # From: Cal Peake <cp@absolutedigital.net> 0 string FLV Macromedia Flash Video +!:mime video/x-flv # # From Dave Wilson diff --git a/contrib/file/Magdir/fonts b/contrib/file/Magdir/fonts index cf6e0d7..a6f43e7 100644 --- a/contrib/file/Magdir/fonts +++ b/contrib/file/Magdir/fonts @@ -1,14 +1,13 @@ - #------------------------------------------------------------------------------ # fonts: file(1) magic for font data # -0 string FONT ASCII vfont text +0 search/1 FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com -0 string %!PS-AdobeFont-1. PostScript Type 1 font text ->20 string >\0 (%s) +0 search/1 %!PS-AdobeFont-1. PostScript Type 1 font text +>20 search/1 >\0 (%s) 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data # X11 font files in SNF (Server Natural Format) format @@ -16,7 +15,7 @@ 0 lelong 00000004 X11 SNF font data, LSB first # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) -0 string STARTFONT\040 X11 BDF font text +0 search/1 STARTFONT\ X11 BDF font text # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) diff --git a/contrib/file/Magdir/fortran b/contrib/file/Magdir/fortran index ce004ad..3e49033 100644 --- a/contrib/file/Magdir/fortran +++ b/contrib/file/Magdir/fortran @@ -1,2 +1,3 @@ # FORTRAN source 0 string/c c\ FORTRAN program +!:mime text/x-fortran diff --git a/contrib/file/Magdir/frame b/contrib/file/Magdir/frame index 1b397df..3699b44 100644 --- a/contrib/file/Magdir/frame +++ b/contrib/file/Magdir/frame @@ -1,11 +1,14 @@ - #------------------------------------------------------------------------------ # frame: file(1) magic for FrameMaker files # # This stuff came on a FrameMaker demo tape, most of which is # copyright, but this file is "published" as witness the following: # +# Note that this is the Framemaker Maker Interchange Format, not the +# Normal format which would be application/vnd.framemaker. +# 0 string \<MakerFile FrameMaker document +!:mime application/x-mif >11 string 5.5 (5.5 >11 string 5.0 (5.0 >11 string 4.0 (4.0 @@ -14,25 +17,32 @@ >11 string 1.0 (1.0 >14 byte x %c) 0 string \<MIFFile FrameMaker MIF (ASCII) file +!:mime application/x-mif >9 string 4.0 (4.0) >9 string 3.0 (3.0) >9 string 2.0 (2.0) >9 string 1.0 (1.x) -0 string \<MakerDictionary FrameMaker Dictionary text +0 search/1 \<MakerDictionary FrameMaker Dictionary text +!:mime application/x-mif >17 string 3.0 (3.0) >17 string 2.0 (2.0) >17 string 1.0 (1.x) 0 string \<MakerScreenFont FrameMaker Font file +!:mime application/x-mif >17 string 1.01 (%s) 0 string \<MML FrameMaker MML file +!:mime application/x-mif 0 string \<BookFile FrameMaker Book file +!:mime application/x-mif >10 string 3.0 (3.0 >10 string 2.0 (2.0 >10 string 1.0 (1.0 >13 byte x %c) # XXX - this book entry should be verified, if you find one, uncomment this #0 string \<Book\ FrameMaker Book (ASCII) file +#!:mime application/x-mif #>6 string 3.0 (3.0) #>6 string 2.0 (2.0) #>6 string 1.0 (1.0) 0 string \<Maker Intermediate Print File FrameMaker IPL file +!:mime application/x-mif diff --git a/contrib/file/Magdir/freebsd b/contrib/file/Magdir/freebsd index ee710fa..be30417 100644 --- a/contrib/file/Magdir/freebsd +++ b/contrib/file/Magdir/freebsd @@ -128,10 +128,10 @@ # What are you laughing about? 0 lelong 011421044151 ld.so hints file (Little Endian >4 lelong >0 \b, version %d) ->4 belong <=0 \b) +>4 belong <1 \b) 0 belong 011421044151 ld.so hints file (Big Endian >4 belong >0 \b, version %d) ->4 belong <=0 \b) +>4 belong <1 \b) # # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities diff --git a/contrib/file/Magdir/fsav b/contrib/file/Magdir/fsav index 4d61beb..ccc6d59 100644 --- a/contrib/file/Magdir/fsav +++ b/contrib/file/Magdir/fsav @@ -46,7 +46,7 @@ 0 string ClamAV-VDB: >11 string >\0 Clam AntiVirus database %-.23s >>34 string : ->>>35 regex [^:]+ \b, version +>>>35 string !: \b, version >>>>35 string x \b%-.1s >>>>>36 string !: >>>>>>36 string x \b%-.1s @@ -54,7 +54,9 @@ >>>>>>>>37 string x \b%-.1s >>>>>>>>>38 string !: >>>>>>>>>>38 string x \b%-.1s ->>>>512 string \037\213 \b, gzipped ->>>>769 string ustar\0 \b, tared >512 string \037\213 \b, gzipped ->769 string ustar\0 \b, tared +>769 string ustar\0 \b, tarred + +# Type: Grisoft AVG AntiVirus +# From: David Newgas <david@newgas.net> +0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data diff --git a/contrib/file/Magdir/games b/contrib/file/Magdir/games index 2dc17da..32ccdfe 100644 --- a/contrib/file/Magdir/games +++ b/contrib/file/Magdir/games @@ -1,12 +1,6 @@ #------------------------------------------------------------------------------ # games: file(1) for games -# Thomas M. Ott (ThMO) -1 string =WAD DOOM data, ->0 string =I main wad ->0 string =P patch wad ->0 byte x unknown junk - # Fabio Bonelli <fabiobonelli@libero.it> # Quake II - III data files 0 string IDP2 Quake II 3D Model file, @@ -29,11 +23,6 @@ # Doom and Quake # submitted by Nicolas Patrois -# DOOM - -0 string IWAD DOOM or DOOM ][ world -0 string PWAD DOOM or DOOM ][ extension world - 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 @@ -155,3 +144,102 @@ 0 string MComprHD MAME CHD compressed hard disk image, >12 belong x version %lu + +# doom - submitted by Jon Dowland + +0 string =IWAD doom main IWAD data +>4 lelong x containing %d lumps +0 string =PWAD doom patch PWAD data +>4 lelong x containing %d lumps + + +# Summary: Warcraft 3 save +# Extension: .w3g +# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string Warcraft\ III\ recorded\ game %s + + +# Summary: Warcraft 3 map +# Extension: .w3m +# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string HM3W Warcraft III map file + + +# Summary: SGF Smart Game Format +# Extension: .sgf +# Reference: http://www.red-bean.com/sgf/ +# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> +# Modified by (1): Abel Cheung (regex, more game format) +# FIXME: Some games don't have GM (game type) +0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format +>2 search/0x200 GM[ +>>&0 string 1] (Go) +>>&0 string 2] (Othello) +>>&0 string 3] (chess) +>>&0 string 4] (Gomoku+Renju) +>>&0 string 5] (Nine Men's Morris) +>>&0 string 6] (Backgammon) +>>&0 string 7] (Chinese chess) +>>&0 string 8] (Shogi) +>>&0 string 9] (Lines of Action) +>>&0 string 10] (Ataxx) +>>&0 string 11] (Hex) +>>&0 string 12] (Jungle) +>>&0 string 13] (Neutron) +>>&0 string 14] (Philosopher's Football) +>>&0 string 15] (Quadrature) +>>&0 string 16] (Trax) +>>&0 string 17] (Tantrix) +>>&0 string 18] (Amazons) +>>&0 string 19] (Octi) +>>&0 string 20] (Gess) +>>&0 string 21] (Twixt) +>>&0 string 22] (Zertz) +>>&0 string 23] (Plateau) +>>&0 string 24] (Yinsh) +>>&0 string 25] (Punct) +>>&0 string 26] (Gobblet) +>>&0 string 27] (hive) +>>&0 string 28] (Exxit) +>>&0 string 29] (Hnefatal) +>>&0 string 30] (Kuba) +>>&0 string 31] (Tripples) +>>&0 string 32] (Chase) +>>&0 string 33] (Tumbling Down) +>>&0 string 34] (Sahara) +>>&0 string 35] (Byte) +>>&0 string 36] (Focus) +>>&0 string 37] (Dvonn) +>>&0 string 38] (Tamsk) +>>&0 string 39] (Gipf) +>>&0 string 40] (Kropki) + + +# Summary: Civilization 4 video +# Extension: .bik +# Created by: Abel Cheung <abelcheung@gmail.com> +0 string BIKi Civilization 4 Video + + +############################################## +# NetImmerse/Gamebryo game engine entries + +# Summary: Gamebryo game engine file +# Extension: .nif, .kf +# Created by: Abel Cheung <abelcheung@gmail.com> +0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file +>&0 regex [0-9a-z.]+ \b, version %s + +# Summary: Gamebryo game engine file +# Extension: .kfm +# Created by: Abel Cheung <abelcheung@gmail.com> +0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File +>&0 regex [0-9a-z.]+ \b, version %s + +# Summary: NetImmerse game engine file +# Extension .nif +# Created by: Abel Cheung <abelcheung@gmail.com> +0 string NetImmerse\ File\ Format,\ Versio +>&0 string n\ NetImmerse game engine file +>>&0 regex [0-9a-z.]+ \b, version %s + diff --git a/contrib/file/Magdir/gimp b/contrib/file/Magdir/gimp index 9a9d61e..674bbfb 100644 --- a/contrib/file/Magdir/gimp +++ b/contrib/file/Magdir/gimp @@ -34,3 +34,7 @@ # ('Bucky' LaDieu, nega@vt.edu) 20 string GIMP GIMP brush data + +# GIMP Curves File +# From: "Nelson A. de Oliveira" <naoliv@gmail.com> +0 string #\040GIMP\040Curves\040File GIMP curve file diff --git a/contrib/file/Magdir/gnome-keyring b/contrib/file/Magdir/gnome-keyring new file mode 100644 index 0000000..80a4f88 --- /dev/null +++ b/contrib/file/Magdir/gnome-keyring @@ -0,0 +1,23 @@ +# GNOME keyring +# Contributed by Josh Triplett +# FIXME: Could be simplified if pstring supported two-byte counts +0 string GnomeKeyring\n\r\0\n GNOME keyring +>&0 ubyte 0 \b, major version 0 +>>&0 ubyte 0 \b, minor version 0 +>>>&0 ubyte 0 \b, crypto type 0 (AEL) +>>>&0 ubyte >0 \b, crypto type %hhu (unknown) +>>>&1 ubyte 0 \b, hash type 0 (MD5) +>>>&1 ubyte >0 \b, hash type %hhu (unknown) +>>>&2 ubelong 0xFFFFFFFF \b, name NULL +>>>&2 ubelong !0xFFFFFFFF +>>>>&-4 ubelong >255 \b, name too long for file's pstring type +>>>>&-4 ubelong <256 +>>>>>&-1 pstring x \b, name "%s" +>>>>>>&0 ubeqdate x \b, last modified %s +>>>>>>&8 ubeqdate x \b, created %s +>>>>>>&16 ubelong &1 +>>>>>>>&0 ubelong x \b, locked if idle for %u seconds +>>>>>>&16 ubelong ^1 \b, not locked if idle +>>>>>>&24 ubelong x \b, hash iterations %u +>>>>>>&28 ubequad x \b, salt %llu +>>>>>>&52 ubelong x \b, %u item(s) diff --git a/contrib/file/Magdir/gnu b/contrib/file/Magdir/gnu index 42d9c7b..66c670c 100644 --- a/contrib/file/Magdir/gnu +++ b/contrib/file/Magdir/gnu @@ -17,10 +17,14 @@ # The format is very similar to pgp 0 string \001gpg GPG key trust database >4 byte x version %d +# Note: magic.mime had 0x8501 for the next line instead of 0x8502 0 beshort 0x8502 GPG encrypted data +!:mime text/PGP # encoding: data + # This magic is not particularly good, as the keyrings don't have true # magic. Nevertheless, it covers many keyrings. 0 beshort 0x9901 GPG key public ring +!:mime application/x-gnupg-keyring # Gnumeric spreadsheet # This entry is only semi-helpful, as Gnumeric compresses its files, so @@ -32,3 +36,7 @@ 0 string \0LOCATE GNU findutils locate database data >7 string >\0 \b, format %s >7 string 02 \b (frcode) + +# Files produced by GNU gettext +0 long 0xDE120495 GNU-format message catalog data +0 long 0x950412DE GNU-format message catalog data diff --git a/contrib/file/Magdir/gnumeric b/contrib/file/Magdir/gnumeric new file mode 100644 index 0000000..76dfa90 --- /dev/null +++ b/contrib/file/Magdir/gnumeric @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# gnumeric: file(1) magic for Gnumeric spreadsheet +# This entry is only semi-helpful, as Gnumeric compresses its files, so +# they will ordinarily reported as "compressed", but at least -z helps +39 string =<gmr:Workbook Gnumeric spreadsheet +!:mime application/x-gnumeric diff --git a/contrib/file/Magdir/graphviz b/contrib/file/Magdir/graphviz new file mode 100644 index 0000000..cf47f4e --- /dev/null +++ b/contrib/file/Magdir/graphviz @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# graphviz: file(1) magic for http://www.graphviz.org/ +0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]*.*\\{ graphviz graph text +!:mime text/vnd.graphviz +0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]*.*\\{ graphviz digraph text +!:mime text/vnd.graphviz diff --git a/contrib/file/Magdir/hp b/contrib/file/Magdir/hp index 052f09a..2d064cc 100644 --- a/contrib/file/Magdir/hp +++ b/contrib/file/Magdir/hp @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # hp: file(1) magic for Hewlett Packard machines (see also "printer") # @@ -202,34 +201,40 @@ 0 string msgcat01 HP NLS message catalog, >8 long >0 %d messages -# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 -0 string HPHP48- HP48 binary ->7 byte >0 - Rev %c ->8 beshort 0x1129 (ADR) ->8 beshort 0x3329 (REAL) ->8 beshort 0x5529 (LREAL) ->8 beshort 0x7729 (COMPLX) ->8 beshort 0x9d29 (LCOMPLX) ->8 beshort 0xbf29 (CHAR) ->8 beshort 0xe829 (ARRAY) ->8 beshort 0x0a2a (LNKARRAY) ->8 beshort 0x2c2a (STRING) ->8 beshort 0x4e2a (HXS) ->8 beshort 0x742a (LIST) ->8 beshort 0x962a (DIR) ->8 beshort 0xb82a (ALG) ->8 beshort 0xda2a (UNIT) ->8 beshort 0xfc2a (TAGGED) ->8 beshort 0x1e2b (GROB) ->8 beshort 0x402b (LIB) ->8 beshort 0x622b (BACKUP) ->8 beshort 0x882b (LIBDATA) ->8 beshort 0x9d2d (PROG) ->8 beshort 0xcc2d (CODE) ->8 beshort 0x482e (GNAME) ->8 beshort 0x6d2e (LNAME) ->8 beshort 0x922e (XLIB) -0 string %%HP: HP48 text +# Summary: HP-48/49 calculator +# Created by: phk@data.fls.dk +# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> +# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) +0 string HPHP HP +>4 string 48 48 binary +>4 string 49 49 binary +>7 byte >64 - Rev %c +>8 leshort 0x2911 (ADR) +>8 leshort 0x2933 (REAL) +>8 leshort 0x2955 (LREAL) +>8 leshort 0x2977 (COMPLX) +>8 leshort 0x299d (LCOMPLX) +>8 leshort 0x29bf (CHAR) +>8 leshort 0x29e8 (ARRAY) +>8 leshort 0x2a0a (LNKARRAY) +>8 leshort 0x2a2c (STRING) +>8 leshort 0x2a4e (HXS) +>8 leshort 0x2a74 (LIST) +>8 leshort 0x2a96 (DIR) +>8 leshort 0x2ab8 (ALG) +>8 leshort 0x2ada (UNIT) +>8 leshort 0x2afc (TAGGED) +>8 leshort 0x2b1e (GROB) +>8 leshort 0x2b40 (LIB) +>8 leshort 0x2b62 (BACKUP) +>8 leshort 0x2b88 (LIBDATA) +>8 leshort 0x2d9d (PROG) +>8 leshort 0x2dcc (CODE) +>8 leshort 0x2e48 (GNAME) +>8 leshort 0x2e6d (LNAME) +>8 leshort 0x2e92 (XLIB) + +0 string %%HP: HP text >6 string T(0) - T(0) >6 string T(1) - T(1) >6 string T(2) - T(2) @@ -240,6 +245,45 @@ >14 string F(.) F(.); >14 string F(,) F(,); + +# Summary: HP-38/39 calculator +# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> +0 string HP3 +>3 string 8 HP 38 +>3 string 9 HP 39 +>4 string Bin binary +>4 string Asc ASCII +>7 string A (Directory List) +>7 string B (Zaplet) +>7 string C (Note) +>7 string D (Program) +>7 string E (Variable) +>7 string F (List) +>7 string G (Matrix) +>7 string H (Library) +>7 string I (Target List) +>7 string J (ASCII Vector specification) +>7 string K (wildcard) + +# Summary: HP-38/39 calculator +# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> +0 string HP3 +>3 string 8 HP 38 +>3 string 9 HP 39 +>4 string Bin binary +>4 string Asc ASCII +>7 string A (Directory List) +>7 string B (Zaplet) +>7 string C (Note) +>7 string D (Program) +>7 string E (Variable) +>7 string F (List) +>7 string G (Matrix) +>7 string H (Library) +>7 string I (Target List) +>7 string J (ASCII Vector specification) +>7 string K (wildcard) + # hpBSD magic numbers 0 beshort 200 hp200 (68010) BSD >2 beshort 0407 impure binary @@ -390,6 +434,4 @@ >>>>>>>>>0xC4 belong 33 - received SIGXCPU >>>>>>>>>0xC4 belong 34 - received SIGXFSZ -# From: AMAKAWA Shuhei <sa264@cam.ac.uk> -0 string HPHP49- HP49 binary diff --git a/contrib/file/Magdir/iff b/contrib/file/Magdir/iff index 3c88f90..4d2a832 100644 --- a/contrib/file/Magdir/iff +++ b/contrib/file/Magdir/iff @@ -13,8 +13,11 @@ #>4 belong x \b, FORM is %d bytes long # audio formats >8 string AIFF \b, AIFF audio +!:mime audio/x-aiff >8 string AIFC \b, AIFF-C compressed audio +!:mime audio/x-aiff >8 string 8SVX \b, 8SVX 8-bit sampled sound voice +!:mime audio/x-aiff >8 string 16SV \b, 16SV 16-bit sampled sound voice >8 string SAMP \b, SAMP sampled audio >8 string MAUD \b, MAUD MacroSystem audio diff --git a/contrib/file/Magdir/images b/contrib/file/Magdir/images index fd9e14f..cccc70b 100644 --- a/contrib/file/Magdir/images +++ b/contrib/file/Magdir/images @@ -1,6 +1,6 @@ - #------------------------------------------------------------------------------ -# images: file(1) magic for image formats (see also "iff") +# images: file(1) magic for image formats (see also "iff", and "c-lang" for +# XPM bitmaps) # # originally from jef@helios.ee.lbl.gov (Jef Poskanzer), # additions by janl@ifi.uio.no as well as others. Jan also suggested @@ -30,13 +30,20 @@ # PBMPLUS images # The next byte following the magic is always whitespace. -0 string P1 Netpbm PBM image text -0 string P2 Netpbm PGM image text -0 string P3 Netpbm PPM image text +0 search/1 P1 Netpbm PBM image text +!:mime image/x-portable-bitmap +0 search/1 P2 Netpbm PGM image text +!:mime image/x-portable-greymap +0 search/1 P3 Netpbm PPM image text +!:mime image/x-portable-pixmap 0 string P4 Netpbm PBM "rawbits" image data +!:mime image/x-portable-bitmap 0 string P5 Netpbm PGM "rawbits" image data +!:mime image/x-portable-greymap 0 string P6 Netpbm PPM "rawbits" image data +!:mime image/x-portable-pixmap 0 string P7 Netpbm PAM image file +!:mime image/x-portable-pixmap # From: bryanh@giraffe-data.com (Bryan Henderson) 0 string \117\072 Solitaire Image Recorder format @@ -50,13 +57,17 @@ >21 byte 51 version 3 # NIFF (Navy Interchange File Format, a modification of TIFF) images +# [GRR: this *must* go before TIFF] 0 string IIN1 NIFF image data +!:mime image/x-niff # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) # The second word of TIFF files is the TIFF version number, 42, which has # never changed. The TIFF specification recommends testing for it. 0 string MM\x00\x2a TIFF image data, big-endian +!:mime image/tiff 0 string II\x2a\x00 TIFF image data, little-endian +!:mime image/tiff # PNG [Portable Network Graphics, or "PNG's Not GIF"] images # (Greg Roelofs, newt@uchicago.edu) @@ -64,24 +75,41 @@ # # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... # -0 string \x89PNG PNG image data, ->4 belong !0x0d0a1a0a CORRUPTED, ->4 belong 0x0d0a1a0a ->>16 belong x %ld x ->>20 belong x %ld, ->>24 byte x %d-bit ->>25 byte 0 grayscale, ->>25 byte 2 \b/color RGB, ->>25 byte 3 colormap, ->>25 byte 4 gray+alpha, ->>25 byte 6 \b/color RGBA, -#>>26 byte 0 deflate/32K, ->>28 byte 0 non-interlaced ->>28 byte 1 interlaced -1 string PNG PNG image data, CORRUPTED +0 string \x89PNG\x0d\x0a\x1a\x0a PNG image +!:mime image/png +>16 belong x \b, %ld x +>20 belong x %ld, +>24 byte x %d-bit +>25 byte 0 grayscale, +>25 byte 2 \b/color RGB, +>25 byte 3 colormap, +>25 byte 4 gray+alpha, +>25 byte 6 \b/color RGBA, +#>26 byte 0 deflate/32K, +>28 byte 0 non-interlaced +>28 byte 1 interlaced + +# possible GIF replacements; none yet released! +# (Greg Roelofs, newt@uchicago.edu) +# +# GRR 950115: this was mine ("Zip GIF"): +0 string GIF94z ZIF image (GIF+deflate alpha) +!:mime image/x-unknown +# +# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): +# +0 string FGF95a FGF image (GIF+deflate beta) +!:mime image/x-unknown +# +# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal +# (best; not yet implemented): +# +0 string PBF PBF image (deflate compression) +!:mime image/x-unknown # GIF 0 string GIF8 GIF image data +!:mime image/gif >4 string 7a \b, version 8%s, >4 string 9a \b, version 8%s, >6 leshort >0 %hd x @@ -113,7 +141,7 @@ >4 long 3 \b, rectangular 32-bit (24-bit with matte) # FIG (Facility for Interactive Generation of figures), an object-based format -0 string #FIG FIG image text +0 search/1 #FIG FIG image text >5 string x \b, version %.3s # PHIGS @@ -129,9 +157,6 @@ # CGM image files 0 string BEGMF clear text Computer Graphics Metafile -# XXX - questionable magic -0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile -0 beshort 0x3020 character Computer Graphics Metafile # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 0 string yz MGR bitmap, modern format, 8-bit aligned @@ -152,15 +177,23 @@ 0 string Sfff structured fax file -# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu) -0 string BM PC bitmap data ->14 leshort 12 \b, OS/2 1.x format +# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) +0 string BM +>14 leshort 12 PC bitmap, OS/2 1.x format +!:mime image/x-ms-bmp >>18 leshort x \b, %d x >>20 leshort x %d ->14 leshort 64 \b, OS/2 2.x format +>14 leshort 64 PC bitmap, OS/2 2.x format +!:mime image/x-ms-bmp >>18 leshort x \b, %d x >>20 leshort x %d ->14 leshort 40 \b, Windows 3.x format +>14 leshort 40 PC bitmap, Windows 3.x format +!:mime image/x-ms-bmp +>>18 lelong x \b, %d x +>>22 lelong x %d x +>>28 leshort x %d +>14 leshort 128 PC bitmap, Windows NT/2000 format +!:mime image/x-ms-bmp >>18 lelong x \b, %d x >>22 lelong x %d x >>28 leshort x %d @@ -174,7 +207,7 @@ # XPM icons (Greg Roelofs, newt@uchicago.edu) # note possible collision with C/REXX entry in c-lang; currently commented out -0 string /*\ XPM\ */ X pixmap image text +0 search/1 /*\ XPM\ */ X pixmap image text # Utah Raster Toolkit RLE images (janl@ifi.uio.no) 0 leshort 0xcc52 RLE image data, @@ -260,7 +293,6 @@ # other images 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file -0 string =!! Bennet Yee's "face" format # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image # stuff. @@ -269,6 +301,7 @@ # DICOM medical imaging data 128 string DICM DICOM medical imaging data +!:mime application/dicom # XWD - X Window Dump file. # As described in /usr/X11R6/include/X11/XWDFile.h @@ -367,6 +400,7 @@ # Adobe Photoshop 0 string 8BPS Adobe Photoshop Image +!:mime image/vnd.adobe.photoshop # XV thumbnail indicator (ThMO) 0 string P7\ 332 XV thumbnail image data @@ -456,9 +490,9 @@ >12 long x \b, track size %d bytes >16 byte x \b, device type 33%2.2X -# Squeak images and - etoffi@softhome.net -0 string \146\031\0\0 Squeak image data -0 string 'From\040Squeak Squeak program text +# Squeak images and programs - etoffi@softhome.net +0 string \146\031\0\0 Squeak image data +0 search/1 'From\040Squeak Squeak program text # partimage: file(1) magic for PartImage files (experimental, incomplete) # Author: Hans-Joachim Baader <hjb@pro-linux.de> @@ -505,12 +539,18 @@ # http://www.dalibor.cz/minolta/raw_file_format.htm 0 string \000MRM Minolta Dimage camera raw image data -# From: stephane.loeuillet@tiscali.f -# http://www.djvuzone.org/ -0 string AT&TFORM DjVu Image file +# Summary: DjVu image / document +# Extension: .djvu +# Reference: http://djvu.org/docs/DjVu3Spec.djvu +# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> +# Modified by (1): Abel Cheung <abelcheung@gmail.com> +0 string AT&TFORM +!:mime image/vnd.djvu +>12 string DJVM DjVu multiple page document +>12 string DJVU DjVu image or single page document +>12 string DJVI DjVu shared document +>12 string THUM DjVu page thumbnails -# From: Jason Bacon <bacon@smithers.neuro.mcw.edu> -0 beshort 0x3020 character Computer Graphics Metafile # From Marc Espie 0 lelong 20000630 OpenEXR image data @@ -523,9 +563,40 @@ # Hierarchical Data Format, used to facilitate scientific data exchange # specifications at http://hdf.ncsa.uiuc.edu/ 0 belong 0x0e031301 Hierarchical Data Format (version 4) data +!:mime application/x-hdf 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data +!:mime application/x-hdf # From: Tobias Burnus <burnus@net-b.de> # Xara (for a while: Corel Xara) is a graphic package, see -# http://www.xara.com/ for Windows and as GPL application for +# http://www.xara.com/ for Windows and as GPL application for Linux 0 string XARA\243\243 Xara graphics file + +# http://www.cartesianinc.com/Tech/ +0 string CPC\262 Cartesian Perceptual Compression image +!:mime image/x-cpi + +# From Albert Cahalan <acahalan@gmail.com> +# puredigital used it for the CVS disposable camcorder +#8 lelong 4 ZBM bitmap image data +#>4 leshort x %u x +#>6 leshort x %u + +# From Albert Cahalan <acahalan@gmail.com> +# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons +0 string C565 OLPC firmware icon image data +>4 leshort x %u x +>6 leshort x %u + +# Applied Images - Image files from Cytovision +# Gustavo Junior Alves <gjalves@gjalves.com.br> +0 string \xce\xda\xde\xfa Cytovision Metaphases file +0 string \xed\xad\xef\xac Cytovision Karyotype file +0 string \x0b\x00\x03\x00 Cytovision FISH Probe file +0 string \xed\xfe\xda\xbe Cytovision FLEX file +0 string \xed\xab\xed\xfe Cytovision FLEX file +0 string \xad\xfd\xea\xad Cytovision RATS file + +# Wavelet Scalar Quantization format used in gray-scale fingerprint images +# From Tano M Fotang <mfotang@quanteq.com> +0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data diff --git a/contrib/file/Magdir/inform b/contrib/file/Magdir/inform new file mode 100644 index 0000000..ba35d61 --- /dev/null +++ b/contrib/file/Magdir/inform @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# inform: file(1) magic for Inform interactive fiction language + +# URL: http://www.inform-fiction.org/ +# From: Reuben Thomas <rrt@sc3d.org> + +0 search/cB/100 constant\ story Inform source text diff --git a/contrib/file/Magdir/java b/contrib/file/Magdir/java index 971b72ce..cca5542 100644 --- a/contrib/file/Magdir/java +++ b/contrib/file/Magdir/java @@ -9,8 +9,9 @@ >2 beshort >0x0004 \b, version %d 0 belong 0xfeedfeed Java KeyStore - +!:mime application/x-java-keystore 0 belong 0xcececece Java JCE KeyStore +!:mime application/x-java-jce-keystore # Dalvik .dex format. http://retrodev.com/android/dexformat.html # From <mkf@google.com> "Mike Fleming" diff --git a/contrib/file/Magdir/jpeg b/contrib/file/Magdir/jpeg index af646d6..d728de6 100644 --- a/contrib/file/Magdir/jpeg +++ b/contrib/file/Magdir/jpeg @@ -9,6 +9,8 @@ # both of which turn into "JPEG image data" here. # 0 beshort 0xffd8 JPEG image data +!:mime image/jpeg +!:strength +1 >6 string JFIF \b, JFIF standard # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 # in a vain attempt to add image size reporting for JFIF. Note that these @@ -125,6 +127,8 @@ # At least we can show a comment if no other segments got inserted before: >(4.S+5) byte 0xFE >>(4.S+8) string >\0 \b, comment: "%s" +# FIXME: When we can do non-byte counted strings, we can use that to get +# the string's count, and fix Debian bug #283760 #>(4.S+5) byte 0xFE \b, comment #>>(4.S+6) beshort x \b length=%d #>>(4.S+8) string >\0 \b, "%s" @@ -153,3 +157,8 @@ # From: David Santinoli <david@santinoli.com> 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data + +# Type: JPEG 2000 codesream +# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> +0 belong 0xff4fff51 JPEG 2000 codestream +45 beshort 0xff52 diff --git a/contrib/file/Magdir/kde b/contrib/file/Magdir/kde new file mode 100644 index 0000000..d81ee69 --- /dev/null +++ b/contrib/file/Magdir/kde @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# kde: file(1) magic for KDE + +0 string [KDE\ Desktop\ Entry] KDE desktop entry +!:mime application/x-kdelnk +0 string #\ KDE\ Config\ File KDE config file +!:mime application/x-kdelnk +0 string #\ xmcd xmcd database file for kscd +!:mime text/x-xmcd diff --git a/contrib/file/Magdir/lex b/contrib/file/Magdir/lex index 7b6d0f7..eae9b10 100644 --- a/contrib/file/Magdir/lex +++ b/contrib/file/Magdir/lex @@ -1,11 +1,10 @@ - #------------------------------------------------------------------------------ # lex: file(1) magic for lex # # derived empirically, your offsets may vary! -53 string yyprevious C program text (from lex) ->3 string >\0 for %s +0 search/100 yyprevious C program text (from lex) +>3 search/1 >\0 for %s # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> -21 string generated\ by\ flex C program text (from flex) +0 search/100 generated\ by\ flex C program text (from flex) # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> -0 string %{ lex description text +0 search/1 %{ lex description text diff --git a/contrib/file/Magdir/linux b/contrib/file/Magdir/linux index fe68013..aaedff4 100644 --- a/contrib/file/Magdir/linux +++ b/contrib/file/Magdir/linux @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # linux: file(1) magic for Linux files # @@ -84,7 +83,7 @@ # Linux kernel boot images (i386 arch) (Wolfram Kleff) 514 string HdrS Linux kernel >510 leshort 0xAA55 x86 boot executable ->>518 leshort >=0x200 +>>518 leshort >0x1ff >>529 byte 0 zImage, >>>529 byte 1 bzImage, >>>(526.s+0x200) string >\0 version %s, @@ -103,16 +102,18 @@ >0x1e9 string Loading from prehistoric times # System.map files - Nicolás Lichtmaier <nick@debian.org> -8 string \ A\ _text Linux kernel symbol map text +8 search/1 \ A\ _text Linux kernel symbol map text # LSM entries - Nicolás Lichtmaier <nick@debian.org> -0 string Begin3 Linux Software Map entry text -0 string Begin4 Linux Software Map entry text (new format) +0 search/1 Begin3 Linux Software Map entry text +0 search/1 Begin4 Linux Software Map entry text (new format) -# From Matt Zimmerman -0 belong 0x4f4f4f4d User-mode Linux COW file ->4 belong x \b, version %d ->8 string >\0 \b, backing file %s +# From Matt Zimmerman, enhanced for v3 by Matthew Palmer +0 belong 0x4f4f4f4d User-mode Linux COW file +>4 belong <3 \b, version %d +>>8 string >\0 \b, backing file %s +>4 belong >2 \b, version %d +>>32 string >\0 \b, backing file %s ############################################################################ # Linux kernel versions @@ -230,6 +231,14 @@ 0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) >(0x614.l+0x600) string >\0 , UUID: %s +# LVM snapshot +# from Jason Farrel +0 string SnAp LVM Snapshot (CopyOnWrite store) +>4 lelong !0 - valid, +>4 lelong 0 - invalid, +>8 lelong x version %d, +>12 lelong x chunk_size %d + # SE Linux policy database 0 lelong 0xf97cff8c SE Linux policy >16 lelong x v%d @@ -246,3 +255,10 @@ >72 string x %s] >168 string x UUID: %s + +# Summary: Xen saved domain file +# Created by: Radek Vokal <rvokal@redhat.com> +0 string LinuxGuestRecord Xen saved domain +>20 search/256 (name +>>&1 string x (name %s) + diff --git a/contrib/file/Magdir/lisp b/contrib/file/Magdir/lisp index e9c8ba8..60b740a 100644 --- a/contrib/file/Magdir/lisp +++ b/contrib/file/Magdir/lisp @@ -1,44 +1,52 @@ - #------------------------------------------------------------------------------ # lisp: file(1) magic for lisp programs # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) # updated by Joerg Jenderek -0 string ;; +# GRR: This lot is too weak +#0 string ;; # windows INF files often begin with semicolon and use CRLF as line end # lisp files are mainly created on unix system with LF as line end ->2 search/2048 !\r Lisp/Scheme program text ->2 search/2048 \r Windows INF file +#>2 search/2048 !\r Lisp/Scheme program text +#>2 search/2048 \r Windows INF file 0 search/256 (if\ Lisp/Scheme program text +!:mime text/x-lisp 0 search/256 (setq\ Lisp/Scheme program text +!:mime text/x-lisp 0 search/256 (defvar\ Lisp/Scheme program text +!:mime text/x-lisp 0 search/256 (defparam\ Lisp/Scheme program text +!:mime text/x-lisp 0 search/256 (defun\ Lisp/Scheme program text +!:mime text/x-lisp 0 search/256 (autoload\ Lisp/Scheme program text +!:mime text/x-lisp 0 search/256 (custom-set-variables\ Lisp/Scheme program text +!:mime text/x-lisp # Emacs 18 - this is always correct, but not very magical. 0 string \012( Emacs v18 byte-compiled Lisp data +!:mime application/x-elc # Emacs 19+ - ver. recognition added by Ian Springer -# Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp -# support or similar - Chris Chittleborough <cchittleborough@yahoo.com.au> -0 string ;ELC ->4 byte >19 +# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs +# - Chris Chittleborough <cchittleborough@yahoo.com.au> +0 string ;ELC +>4 byte >18 >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data +!:mime application/x-elc # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> -0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text +0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) +0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text + 0 long 0x70768BD2 CLISP memory image data 0 long 0xD28B7670 CLISP memory image data, other endian -# Files produced by GNU gettext -0 long 0xDE120495 GNU-format message catalog data -0 long 0x950412DE GNU-format message catalog data - #.com and .bin for MIT scheme 0 string \372\372\372\372 MIT scheme (library?) # From: David Allouche <david@allouche.net> -0 string \<TeXmacs| TeXmacs document text +0 search/1 \<TeXmacs| TeXmacs document text +!:mime text/texmacs diff --git a/contrib/file/Magdir/llvm b/contrib/file/Magdir/llvm new file mode 100644 index 0000000..8c1610c --- /dev/null +++ b/contrib/file/Magdir/llvm @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# llvm: file(1) magic for LLVM byte-codes +# URL: http://llvm.cs.uiuc.edu/docs/BytecodeFormat.html#signature +# From: Al Stone <ahs3@fc.hp.com> + +0 string llvm LLVM byte-codes, uncompressed +0 string llvc0 LLVM byte-codes, null compression +0 string llvc1 LLVM byte-codes, gzip compression +0 string llvc2 LLVM byte-codes, bzip2 compression diff --git a/contrib/file/Magdir/lua b/contrib/file/Magdir/lua new file mode 100644 index 0000000..9aa87b1 --- /dev/null +++ b/contrib/file/Magdir/lua @@ -0,0 +1,19 @@ +#------------------------------------------------------------------------------ +# lua: file(1) magic for Lua scripting language +# URL: http://www.lua.org/ +# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> + +# Lua scripts +0 search/1/b #!\ /usr/bin/lua Lua script text executable +!:mime text/x-lua +0 search/1/b #!\ /usr/local/bin/lua Lua script text executable +!:mime text/x-lua +0 search/1 #!/usr/bin/env\ lua Lua script text executable +!:mime text/x-lua +0 search/1 #!\ /usr/bin/env\ lua Lua script text executable +!:mime text/x-lua + +# Lua bytecode +0 string \033Lua Lua bytecode, +>4 byte 0x50 version 5.0 +>4 byte 0x51 version 5.1 diff --git a/contrib/file/Magdir/luks b/contrib/file/Magdir/luks new file mode 100644 index 0000000..2ab2393 --- /dev/null +++ b/contrib/file/Magdir/luks @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# luks: file(1) magic for Linux Unified Key Setup +# URL: http://luks.endorphin.org/spec +# From: Anthon van der Neut <anthon@mnt.org> + +0 string LUKS\xba\xbe LUKS encrypted file, +>6 beshort x ver %d +>8 string x [%s, +>40 string x %s, +>72 string x %s] +>168 string x UUID: %s diff --git a/contrib/file/Magdir/macintosh b/contrib/file/Magdir/macintosh index 4acd5c8..77187a3 100644 --- a/contrib/file/Magdir/macintosh +++ b/contrib/file/Magdir/macintosh @@ -5,6 +5,7 @@ # BinHex is the Macintosh ASCII-encoded file format (see also "apple") # Daniel Quinlan, quinlan@yggdrasil.com 11 string must\ be\ converted\ with\ BinHex BinHex binary text +!:mime application/mac-binhex40 >41 string x \b, version %.3s # Stuffit archives are the de facto standard of compression for Macintosh @@ -18,37 +19,41 @@ # Newer StuffIt archives (grant@netbsd.org) 0 string StuffIt StuffIt Archive +!:mime application/x-stuffit #>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@tuns.ca) -0 string APPL Macintosh Application (data) ->2 string x \b: %s +# GRR: Too weak +#0 string APPL Macintosh Application (data) +#>2 string x \b: %s # Macintosh System files (franklsm@tuns.ca) -0 string zsys Macintosh System File (data) -0 string FNDR Macintosh Finder (data) -0 string libr Macintosh Library (data) ->2 string x : %s -0 string shlb Macintosh Shared Library (data) ->2 string x : %s -0 string cdev Macintosh Control Panel (data) ->2 string x : %s -0 string INIT Macintosh Extension (data) ->2 string x : %s -0 string FFIL Macintosh Truetype Font (data) ->2 string x : %s -0 string LWFN Macintosh Postscript Font (data) ->2 string x : %s +# GRR: Too weak +#0 string zsys Macintosh System File (data) +#0 string FNDR Macintosh Finder (data) +#0 string libr Macintosh Library (data) +#>2 string x : %s +#0 string shlb Macintosh Shared Library (data) +#>2 string x : %s +#0 string cdev Macintosh Control Panel (data) +#>2 string x : %s +#0 string INIT Macintosh Extension (data) +#>2 string x : %s +#0 string FFIL Macintosh Truetype Font (data) +#>2 string x : %s +#0 string LWFN Macintosh Postscript Font (data) +#>2 string x : %s # Additional Macintosh Files (franklsm@tuns.ca) -0 string PACT Macintosh Compact Pro Archive (data) ->2 string x : %s -0 string ttro Macintosh TeachText File (data) ->2 string x : %s -0 string TEXT Macintosh TeachText File (data) ->2 string x : %s -0 string PDF Macintosh PDF File (data) ->2 string x : %s +# GRR: Too weak +#0 string PACT Macintosh Compact Pro Archive (data) +#>2 string x : %s +#0 string ttro Macintosh TeachText File (data) +#>2 string x : %s +#0 string TEXT Macintosh TeachText File (data) +#>2 string x : %s +#0 string PDF Macintosh PDF File (data) +#>2 string x : %s # MacBinary format (Eric Fischer, enf@pobox.com) # @@ -320,41 +325,50 @@ # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a # cstring. Of course, partitions can contain more than four entries, but # what're you gonna do? -0x200 beshort 0x504D Apple Partition data ->0x2 beshort x block size: %d, ->0x230 string x first type: %s, ->0x210 string x name: %s, ->0x254 belong x number of blocks: %d, ->0x400 beshort 0x504D ->>0x430 string x second type: %s, ->>0x410 string x name: %s, ->>0x454 belong x number of blocks: %d, ->>0x800 beshort 0x504D ->>>0x830 string x third type: %s, ->>>0x810 string x name: %s, ->>>0x854 belong x number of blocks: %d, ->>>0xa00 beshort 0x504D ->>>>0xa30 string x fourth type: %s, ->>>>0xa10 string x name: %s, ->>>>0xa54 belong x number of blocks: %d -# AFAIK, only the signature is different -0x200 beshort 0x5453 Apple Old Partition data ->0x2 beshort x block size: %d, ->0x230 string x first type: %s, ->0x210 string x name: %s, ->0x254 belong x number of blocks: %d, ->0x400 beshort 0x504D ->>0x430 string x second type: %s, ->>0x410 string x name: %s, ->>0x454 belong x number of blocks: %d, ->>0x800 beshort 0x504D ->>>0x830 string x third type: %s, ->>>0x810 string x name: %s, ->>>0x854 belong x number of blocks: %d, ->>>0xa00 beshort 0x504D ->>>>0xa30 string x fourth type: %s, ->>>>0xa10 string x name: %s, ->>>>0xa54 belong x number of blocks: %d +# GRR: This magic is too weak, it is just "PM" +#0x200 beshort 0x504D Apple Partition data +#>0x2 beshort x (block size: %d): +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x600 beshort 0x504D +#>>>0x630 string x third type: %s, +#>>>0x610 string x name: %s, +#>>>0x654 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x fourth type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fifth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d +#>>>0xc00 beshort 0x504D +#>>>>0xc30 string x sixth type: %s, +#>>>>0xc10 string x name: %s, +#>>>>0xc54 belong x number of blocks: %d +## AFAIK, only the signature is different +#0x200 beshort 0x5453 Apple Old Partition data +#>0x2 beshort x block size: %d, +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x third type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fourth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d # From: Remi Mommsen <mommsen@slac.stanford.edu> 0 string BOMStore Mac OS X bill of materials (BOM) file diff --git a/contrib/file/Magdir/mail.news b/contrib/file/Magdir/mail.news index f08261c..0b9d90a 100644 --- a/contrib/file/Magdir/mail.news +++ b/contrib/file/Magdir/mail.news @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # mail.news: file(1) magic for mail and news # @@ -6,17 +5,28 @@ #0 string From mail text # There are tests to ascmagic.c to cope with mail and news. 0 string Relay-Version: old news text +!:mime message/rfc822 0 string #!\ rnews batched news text +!:mime message/rfc822 0 string N#!\ rnews mailed, batched news text +!:mime message/rfc822 0 string Forward\ to mail forwarding text +!:mime message/rfc822 0 string Pipe\ to mail piping text +!:mime message/rfc822 0 string Return-Path: smtp mail text +!:mime message/rfc822 0 string Path: news text +!:mime message/news 0 string Xref: news text +!:mime message/news 0 string From: news or mail text +!:mime message/rfc822 0 string Article saved news text +!:mime message/news 0 string BABYL Emacs RMAIL text 0 string Received: RFC 822 mail text +!:mime message/rfc822 0 string MIME-Version: MIME entity text #0 string Content- MIME entity text @@ -39,3 +49,5 @@ # XXX: Weak magic #256 leshort 0xAFAE4453 Squish message area data file #>4 leshort >0 (%d messages) + +#0 string \<!--\ MHonArc text/html; x-type=mhonarc diff --git a/contrib/file/Magdir/mathcad b/contrib/file/Magdir/mathcad new file mode 100644 index 0000000..4180196 --- /dev/null +++ b/contrib/file/Magdir/mathcad @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# mathcad: file(1) magic for Mathcad documents +# URL: http://www.mathsoft.com/ +# From: Josh Triplett <josh@freedesktop.org> + +0 string .MCAD\t Mathcad document diff --git a/contrib/file/Magdir/mathematica b/contrib/file/Magdir/mathematica index 0eca5d4..abbc112 100644 --- a/contrib/file/Magdir/mathematica +++ b/contrib/file/Magdir/mathematica @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # mathematica: file(1) magic for mathematica files # "H. Nanosecond" <aldomel@ix.netcom.com> @@ -56,7 +55,8 @@ 0 string (*********************** Mathematica 3.0 notebook # other (* matches it is a comment start in these langs -0 string (* Mathematica, or Pascal, Modula-2 or 3 code text +# GRR: Too weak; also matches other languages e.g. ML +#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text ######################### # MatLab v5 diff --git a/contrib/file/Magdir/mercurial b/contrib/file/Magdir/mercurial new file mode 100644 index 0000000..3f1bdfc --- /dev/null +++ b/contrib/file/Magdir/mercurial @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# mercurial: file(1) magic for Mercurial changeset bundles +# http://www.selenic.com/mercurial/wiki/ +# +# Jesse Glick (jesse.glick@sun.com) +# + +0 string HG10 Mercurial changeset bundle +>4 string UN (uncompressed) +>4 string GZ (gzip compressed) +>4 string BZ (bzip2 compressed) diff --git a/contrib/file/Magdir/misctools b/contrib/file/Magdir/misctools index bb995ba..9a43e7b 100644 --- a/contrib/file/Magdir/misctools +++ b/contrib/file/Magdir/misctools @@ -1,13 +1,21 @@ #----------------------------------------------------------------------------- -# misctools: file(1) magic for miscelanous UNIX tools. +# misctools: file(1) magic for miscellaneous UNIX tools. # -0 string %%!! X-Post-It-Note text +0 search/1 %%!! X-Post-It-Note text 0 string/c BEGIN:VCALENDAR vCalendar calendar file 0 string/c BEGIN:VCARD vCard visiting card +!:mime text/x-vcard # From: Alex Beregszaszi <alex@fsn.hu> 4 string gtktalog GNOME Catalogue (gtktalog) >13 string >\0 version %s -# From: Tomasz Trojanowski <tomek@uninet.com.pl> +# Summary: Libtool library file +# Extension: .la +# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file + +# Summary: Libtool object file +# Extension: .lo +# Submitted by: Abel Cheung <abelcheung@gmail.com> +0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file diff --git a/contrib/file/Magdir/mozilla b/contrib/file/Magdir/mozilla new file mode 100644 index 0000000..0698860 --- /dev/null +++ b/contrib/file/Magdir/mozilla @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# mozilla: file(1) magic for Mozilla XUL fastload files +# (XUL.mfasl and XPC.mfasl) +# URL: http://www.mozilla.org/ +# From: Josh Triplett <josh@freedesktop.org> + +0 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data diff --git a/contrib/file/Magdir/msdos b/contrib/file/Magdir/msdos index 10ce8ae..cdd7c93 100644 --- a/contrib/file/Magdir/msdos +++ b/contrib/file/Magdir/msdos @@ -7,9 +7,13 @@ # updated by Joerg Jenderek 0 string @ >1 string/cB \ echo\ off MS-DOS batch file text +!:mime text/x-msdos-batch >1 string/cB echo\ off MS-DOS batch file text +!:mime text/x-msdos-batch >1 string/cB rem\ MS-DOS batch file text +!:mime text/x-msdos-batch >1 string/cB set\ MS-DOS batch file text +!:mime text/x-msdos-batch # OS/2 batch files are REXX. the second regex is a bit generic, oh well @@ -39,13 +43,15 @@ # # Required OS version and subsystem version were 4.0 on some NT 3.51 # executables built with Visual C++ 4.0, so it's not clear that -# they're interesting. The user version was 0.0, but there's +# they're interesting. The user version was 0.0, but there's # probably some linker directive to set it. The linker version was # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). # # many of the compressed formats were extraced from IDARC 1.23 source code # -0 string MZ MS-DOS executable +0 string MZ +!:mime application/x-dosexec +>0x18 leshort <0x40 MS-DOS executable >0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows >>&18 leshort&0x2000 >0 (DLL) >>&88 leshort 0 (unknown subsystem) @@ -64,29 +70,42 @@ >>&18 leshort&0x1000 >0 system file >>&0xf4 search/0x140 \x0\x40\x1\x0 >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive +>30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive +!:mime application/zip +# Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect. +>30 string PKLITE\ Copr. Self-extracting PKZIP archive +!:mime application/zip >0x18 leshort >0x3f ->>(0x3c.l) string PE\0\0 PE +>>(0x3c.l) string PE\0\0 PE +>>>(0x3c.l+25) byte 1 \b32 executable +>>>(0x3c.l+25) byte 2 \b32+ executable # hooray, there's a DOS extender using the PE format, with a valid PE # executable inside (which just prints a message and exits if run in win) ->>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender ->>>(8.s*16) string !32STUB for MS Windows ->>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) ->>>>(0x3c.l+92) leshort 0 (unknown subsystem) ->>>>(0x3c.l+92) leshort 1 (native) ->>>>(0x3c.l+92) leshort 2 (GUI) ->>>>(0x3c.l+92) leshort 3 (console) ->>>>(0x3c.l+92) leshort 7 (POSIX) ->>>>(0x3c.l+4) leshort 0x0 unknown processor ->>>>(0x3c.l+4) leshort 0x14c Intel 80386 ->>>>(0x3c.l+4) leshort 0x166 MIPS R4000 ->>>>(0x3c.l+4) leshort 0x184 Alpha ->>>>(0x3c.l+4) leshort 0x268 Motorola 68000 ->>>>(0x3c.l+4) leshort 0x1f0 PowerPC ->>>>(0x3c.l+4) leshort 0x290 PA-RISC ->>>>(0x3c.l+22) leshort&0x0100 >0 32-bit ->>>>(0x3c.l+22) leshort&0x1000 >0 system file ->>>>(0x3c.l+232) lelong >0 Mono/.Net assembly +>>>(0x3c.l+92) leshort <10 +>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender +>>>>(8.s*16) string !32STUB for MS Windows +>>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) +>>>>>(0x3c.l+92) leshort 0 (unknown subsystem) +>>>>>(0x3c.l+92) leshort 1 (native) +>>>>>(0x3c.l+92) leshort 2 (GUI) +>>>>>(0x3c.l+92) leshort 3 (console) +>>>>>(0x3c.l+92) leshort 7 (POSIX) +>>>(0x3c.l+92) leshort 10 (EFI application) +>>>(0x3c.l+92) leshort 11 (EFI boot service driver) +>>>(0x3c.l+92) leshort 12 (EFI runtime driver) +>>>(0x3c.l+92) leshort 13 (XBOX) +>>>(0x3c.l+4) leshort 0x0 unknown processor +>>>(0x3c.l+4) leshort 0x14c Intel 80386 +>>>(0x3c.l+4) leshort 0x166 MIPS R4000 +>>>(0x3c.l+4) leshort 0x184 Alpha +>>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>>(0x3c.l+4) leshort 0x1f0 PowerPC +>>>(0x3c.l+4) leshort 0x290 PA-RISC +>>>(0x3c.l+4) leshort 0x200 Intel Itanium +>>>(0x3c.l+22) leshort&0x0100 >0 32-bit +>>>(0x3c.l+22) leshort&0x1000 >0 system file +>>>(0x3c.l+232) lelong >0 Mono/.Net assembly >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed @@ -115,6 +134,8 @@ >>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive >>>>0x30 string Inno \b, InnoSetup self-extracting archive +>>(0x3c.l) string !PE\0\0 MS-DOS executable + >>(0x3c.l) string NE \b, NE >>>(0x3c.l+0x36) byte 0 (unknown OS) >>>(0x3c.l+0x36) byte 1 for OS/2 1.x @@ -176,7 +197,7 @@ >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS # header data too small for extended executable >2 long !0 ->>0x18 leshort <0x40 +>>0x18 leshort <0x40 >>>(4.s*512) leshort !0x014c >>>>&(2.s-514) string !LE @@ -206,29 +227,31 @@ # .EXE formats (Greg Roelofs, newt@uchicago.edu) # ->0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed +>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed >0xe7 string LH/2\ Self-Extract \b, %s >0x1c string diet \b, diet compressed >0x1c string LZ09 \b, LZEXE v0.90 compressed >0x1c string LZ91 \b, LZEXE v0.91 compressed ->0x1c string tz \b, TinyProg compressed +>0x1c string tz \b, TinyProg compressed >0x1e string PKLITE \b, %s compressed ->0x64 string W\ Collis\0\0 \b, Compack compressed +>0x64 string W\ Collis\0\0 \b, Compack compressed >0x24 string LHa's\ SFX \b, LHa self-extracting archive +!:mime application/x-lha >0x24 string LHA's\ SFX \b, LHa self-extracting archive ->0x24 string \ $ARX \b, ARX self-extracting archive ->0x24 string \ $LHarc \b, LHarc self-extracting archive ->0x20 string SFX\ by\ LARC \b, LARC self-extracting archive +!:mime application/x-lha +>0x24 string \ $ARX \b, ARX self-extracting archive +>0x24 string \ $LHarc \b, LHarc self-extracting archive +>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive >1638 string -lh5- \b, LHa self-extracting archive v2.13S ->0x17888 string Rar! \b, RAR self-extracting archive ->0x40 string aPKG \b, aPackage self-extracting archive +>0x17888 string Rar! \b, RAR self-extracting archive +>0x40 string aPKG \b, aPackage self-extracting archive ->32 string AIN ->>35 string 2 \b, AIN 2.x compressed ->>35 string <2 \b, AIN 1.x compressed ->>35 string >2 \b, AIN 1.x compressed ->28 string UC2X \b, UCEXE compressed ->28 string WWP\ \b, WWPACK compressed +>32 string AIN +>>35 string 2 \b, AIN 2.x compressed +>>35 string <2 \b, AIN 1.x compressed +>>35 string >2 \b, AIN 1.x compressed +>28 string UC2X \b, UCEXE compressed +>28 string WWP\ \b, WWPACK compressed # skip to the end of the exe >(4.s*512) long x @@ -255,15 +278,15 @@ # TELVOX Teleinformatica CODEC self-extractor for OS/2: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 ->>49824 leshort =1 \b, 1 file ->>49824 leshort >1 \b, %u files +>>49824 leshort =1 \b, 1 file +>>49824 leshort >1 \b, %u files # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least # two dozen different one-byte "magics". -0 byte 0xe9 DOS executable (COM) ->0x1FE leshort 0xAA55 \b, boot code +#0 byte 0xe9 DOS executable (COM) +#>0x1FE leshort 0xAA55 \b, boot code >6 string SFX\ of\ LHarc (%s) 0 belong 0xffffffff DOS executable (device driver) #CMD640X2.SYS @@ -286,25 +309,25 @@ >>77 string >\x40 >>>77 string <\x5B >>>>77 string x \b, name: %.8s -0 byte 0x8c DOS executable (COM) +#0 byte 0x8c DOS executable (COM) # 0xeb conflicts with "sequent" magic -0 byte 0xeb DOS executable (COM) ->0x1FE leshort 0xAA55 \b, boot code ->85 string UPX \b, UPX compressed ->4 string \ $ARX \b, ARX self-extracting archive ->4 string \ $LHarc \b, LHarc self-extracting archive ->0x20e string SFX\ by\ LARC \b, LARC self-extracting archive -0 byte 0xb8 COM executable +#0 byte 0xeb DOS executable (COM) +#>0x1FE leshort 0xAA55 \b, boot code +#>85 string UPX \b, UPX compressed +#>4 string \ $ARX \b, ARX self-extracting archive +#>4 string \ $LHarc \b, LHarc self-extracting archive +#>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive +#0 byte 0xb8 COM executable # modified by Joerg Jenderek ->1 lelong !0x21cd4cff for DOS +>1 lelong !0x21cd4cff for DOS # http://syslinux.zytor.com/comboot.php # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode # start with assembler instructions mov eax,21cd4cffh ->1 lelong 0x21cd4cff (32-bit COMBOOT) +>1 lelong 0x21cd4cff (32-bit COMBOOT) 0 string \x81\xfc >4 string \x77\x02\xcd\x20\xb9 ->>36 string UPX! FREE-DOS executable (COM), UPX compressed -252 string Must\ have\ DOS\ version DR-DOS executable (COM) +>>36 string UPX! FREE-DOS executable (COM), UPX compressed +252 string Must\ have\ DOS\ version DR-DOS executable (COM) # GRR search is not working #2 search/28 \xcd\x21 COM executable for MS-DOS #WHICHFAT.cOM @@ -341,14 +364,6 @@ #0 byte 0xf0 MS-DOS program library data # -# -# Windows Registry files. -# updated by Joerg Jenderek -0 string regf Windows NT/XP registry file -0 string CREG Windows 95/98/ME registry file -0 string SHCC3 Windows 3.1 registry file - - # AAF files: # <stuartc@rd.bbc.co.uk> Stuart Cunningham 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage @@ -360,54 +375,73 @@ # Popular applications 2080 string Microsoft\ Word\ 6.0\ Document %s +!:mime application/msword 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data +!:mime application/msword # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 2112 string MSWordDoc Microsoft Word document data +!:mime application/msword # 0 belong 0x31be0000 Microsoft Word Document +!:mime application/msword # -0 string PO^Q` Microsoft Word 6.0 Document +0 string PO^Q` Microsoft Word 6.0 Document +!:mime application/msword # 0 string \376\067\0\043 Microsoft Office Document +!:mime application/msword 0 string \333\245-\0\0\0 Microsoft Office Document +!:mime application/msword +512 string \354\245\301 Microsoft Word Document +!:mime application/msword # 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s +!:mime application/vnd.ms-excel + 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s +!:mime application/vnd.ms-excel # # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 2114 string Biff5 Microsoft Excel 5.0 Worksheet +!:mime application/vnd.ms-excel # Italian MS-Excel 2121 string Biff5 Microsoft Excel 5.0 Worksheet +!:mime application/vnd.ms-excel 0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet +!:mime application/vnd.ms-excel # 0 belong 0x00001a00 Lotus 1-2-3 +!:mime application/x-123 >4 belong 0x00100400 wk3 document data >4 belong 0x02100400 wk4 document data >4 belong 0x07800100 fm3 or fmb document data >4 belong 0x07800000 fm3 or fmb document data # -0 belong 0x00000200 Lotus 1-2-3 +0 belong 0x00000200 Lotus 1-2-3 +!:mime application/x-123 >4 belong 0x06040600 wk1 document data >4 belong 0x06800200 fmt document data +0 string WordPro\0 Lotus WordPro +!:mime application/vnd.lotus-wordpro +0 string WordPro\r\373 Lotus WordPro +!:mime application/vnd.lotus-wordpro -# Help files -0 string ?_\3\0 MS Windows Help Data -# DeIsL1.isu what this is I don't know -0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is +# Summary: Script used by InstallScield to uninstall applications +# Extension: .isu +# Submitted by: unknown +# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) +0 string \x71\xa8\x00\x00\x01\x02 +>12 string Stirling\ Technologies, InstallShield Uninstall Script # Winamp .avs -#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player +#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 0 string Nullsoft\ AVS\ Preset\ Winamp plug in -# Hyper terminal: -0 string HyperTerminal\ hyperterm ->15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal - # Windows Metafont .WMF -0 string \327\315\306\232 ms-windows metafont .wmf -0 string \002\000\011\000 ms-windows metafont .wmf -0 string \001\000\011\000 ms-windows metafont .wmf +0 string \327\315\306\232 ms-windows metafont .wmf +0 string \002\000\011\000 ms-windows metafont .wmf +0 string \001\000\011\000 ms-windows metafont .wmf #tz3 files whatever that is (MS Works files) 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file @@ -427,21 +461,12 @@ 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file -# Windows help file FTG FTS -0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache - -# grp old windows 3.1 group files -0 string \120\115\103\103 MS Windows 3.1 group files - - -# lnk files windows symlinks -0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut - #ico files 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows # Windows icons (Ian Springer <ips@fpk.hp.com>) 0 string \000\000\001\000 MS Windows icon resource +!:mime image/x-ico >4 byte 1 - 1 icon >4 byte >1 - %d icons >>6 byte >0 \b, %dx @@ -462,18 +487,27 @@ # then there is a copyright notice -# recycled/info the windows trash bin index -9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info +# Windows Recycle Bin record file (named INFO2) +# By Abel Cheung (abelcheung AT gmail dot com) +# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes +# Since Vista uses another structure, INFO2 structure probably won't change +# anymore. Detailed analysis in: +# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf +0 lelong 0x00000004 +>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) + +0 lelong 0x00000005 +>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) ##### put in Either Magic/font or Magic/news -# Acroread or something files wrongly identified as G3 .pfm +# Acroread or something files wrongly identified as G3 .pfm # these have the form \000 \001 any? \002 \000 \000 # or \000 \001 any? \022 \000 \000 -#0 string \000\001 pfm? -#>3 string \022\000\000Copyright\ yes -#>3 string \002\000\000Copyright\ yes -#>3 string >\0 oops, not a font file. Cancel that. +#0 string \000\001 pfm? +#>3 string \022\000\000Copyright\ yes +#>3 string \002\000\000Copyright\ yes +#>3 string >\0 oops, not a font file. Cancel that. #it clashes with ttf files so put it lower down. # From Doug Lee via a FreeBSD pr @@ -516,10 +550,12 @@ >>>>24 long >0 length %d # TNEF magic From "Joomy" <joomy@se-ed.net> +# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 0 leshort 0x223e9f78 TNEF +!:mime application/vnd.ms-tnef # HtmlHelp files (.chm) -0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data +0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data # GFA-BASIC (Wolfram Kleff) 2 string GFA-BASIC3 GFA-BASIC 3 data @@ -534,8 +570,8 @@ # InstallShield Cabinet files 0 string ISc( InstallShield Cabinet archive data ->5 byte&0xf0 =0x60 version 6, ->5 byte&0xf0 !0x60 version 4/5, +>5 byte&0xf0 =0x60 version 6, +>5 byte&0xf0 !0x60 version 4/5, >(12.l+40) lelong x %u files # Windows CE package files @@ -549,57 +585,27 @@ >20 lelong 10004 \b, Hitachi SH3E >20 lelong 10005 \b, Hitachi SH4 >20 lelong 70001 \b, ARM 7TDMI ->52 leshort 1 \b, 1 file ->52 leshort >1 \b, %u files ->56 leshort 1 \b, 1 registry entry ->56 leshort >1 \b, %u registry entries - -# Outlook Personal Folders -0 lelong 0x4E444221 Microsoft Outlook binary email folder ->10 leshort 0x0e (Outlook <=2002) ->10 leshort 0x17 (Outlook >=2003) - - -# From: Dirk Jagdmann <doj@cubic.org> -0 lelong 0x00035f3f Windows 3.x help file - -# Christophe Monniez -0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File ->20 string >\0 Version %s -0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File ->4 byte =0xC5 Message database ->4 byte =0xC6 Folder database ->4 byte =0xC7 Accounts informations ->4 byte =0x30 Offline database +>52 leshort 1 \b, 1 file +>52 leshort >1 \b, %u files +>56 leshort 1 \b, 1 registry entry +>56 leshort >1 \b, %u registry entries # Windows Enhanced Metafile (EMF) # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp -# for further information. Note that "0 lelong 1" should be true i.e. -# the first double word in the file should be 1. With the extended -# syntax available by some file commands you could write: -# 0 lelong 1 -# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data -40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data ->44 ulelong x version 0x%x. -# If the description has a length greater than zero, it exists and is -# found at offset (*64). ->64 ulelong >0 Description available at offset 0x%x ->>60 ulelong >0 (length 0x%x) -# Note it would be better to print out the description, which is found -# as below. Unfortunately the following only prints out the first couple -# of characters instead of all the "description length" -# number of characters -- indicated by the ulelong at offset 60. ->>(64.l) lestring16 >0 Description: %15.15s +# for further information. +0 ulelong 1 +>40 string \ EMF Windows Enhanced Metafile (EMF) image data +>>44 ulelong x version 0x%x # From: Alex Beregszaszi <alex@fsn.hu> 0 string COWD VMWare3 ->4 byte 3 disk image +>4 byte 3 disk image >>32 lelong x (%d/ >>36 lelong x \b%d/ >>40 lelong x \b%d) ->4 byte 2 undoable disk image ->>32 string >\0 (%s) +>4 byte 2 undoable disk image +>>32 string >\0 (%s) 0 string VMDK VMware4 disk image 0 string KDMV VMware4 disk image @@ -609,39 +615,39 @@ # Lines written by Friedrich Schwittay (f.schwittay@yousable.de) # Made by reading sources and doing trial and error on existing # qcow files -0 string QFI Qemu Image, Format: Qcow +0 string QFI Qemu Image, Format: Qcow # Uncomment the following line to display Magic (only used for debugging # this magic number) -#>0 string x , Magic: %s +#>0 string x , Magic: %s # There are currently 2 Versions: "1" and "2" # I do not use Version 2 and therefor branch here # but can assure: it works (tested on both versions) # Also my Qemu 0.9.0 which uses this Version 2 refuses # to start in its bios ->0x04 belong 2 , Version: 2 ->0x04 belong 1 , Version: 1 +>0x04 belong 2 , Version: 2 +>0x04 belong 1 , Version: 1 # Using the existence of the Backing File Offset to Branch or not # to read Backing File Information ->>0xc belong >0 , Backing File( Offset: %d ->>>(0xc.L) string >\0 , Path: %s +>>0xc belong >0 , Backing File( Offset: %lu +>>>(0xc.L) string >\0 , Path: %s -# Didnt got the Trick here how qemu stores the "Size" at this Position +# Didn't get the trick here how qemu stores the "Size" at this Position # There is actually something stored but nothing makes sense # The header in the sources talks about it -#>>>16 lelong x , Size: %d +#>>>16 lelong x , Size: %lu # Modification time of the Backing File -# Really usefull if you want to know if your backing +# Really useful if you want to know if your backing # file is still usable together with this image ->>>20 bedate x , Mtime: %s ) +>>>20 bedate x , Mtime: %s ) -# Dont know how to calculate in Magicfiles +# Don't know how to calculate in Magicfiles # Also: this Information is not reliably -# stored in image-files ->>24 lelong x , Disk Size could be: %d * 256 bytes +# stored in image-files +>>24 lelong x , Disk Size could be: %d * 256 bytes 0 string QEVM QEMU's suspend to disk image @@ -652,9 +658,21 @@ 0 lelong 0x02468ace Bochs Sparse disk image # from http://filext.com by Derek M Jones <derek@knosof.co.uk> -# False positive with PPT -#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer +# False positive with PPT (also currently this string is too long) +#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document +#>48 byte 0x1B Excel Document +#!:mime application/vnd.ms-excel +>546 string bjbj Microsoft Word Document +!:mime application/msword +>546 string jbjb Microsoft Word Document +!:mime application/msword + +0 string \224\246\056 Microsoft Word Document +!:mime application/msword + +512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document +!:mime application/msword # From: "Nelson A. de Oliveira" <naoliv@gmail.com> # Magic type for Dell's BIOS .hdr files @@ -663,3 +681,20 @@ >23 string Dell %s system BIOS >48 string x version %.3s +# Type: Microsoft DirectDraw Surface +# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp +# From: Morten Hustveit <morten@debian.org> +0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), +>16 lelong >0 %hd x +>12 lelong >0 %hd, +>84 string x %.4s + +# Type: Microsoft Document Imaging Format (.mdi) +# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format +# From: Daniele Sempione <scrows@oziosi.org> +0 short 0x5045 Microsoft Document Imaging Format + +# MS eBook format (.lit) +0 string ITOLITLS Microsoft Reader eBook Data +>8 lelong x \b, version %u +!:mime application/x-ms-reader diff --git a/contrib/file/Magdir/mup b/contrib/file/Magdir/mup index fd9a7b1..f1022e3 100644 --- a/contrib/file/Magdir/mup +++ b/contrib/file/Magdir/mup @@ -8,7 +8,7 @@ # compatibility. Noteedit also use mup format, but is not forcing # user to use any header as well. # -0 string //!Mup Mup music publication program input text +0 search/1 //!Mup Mup music publication program input text >6 string -Arkkra (Arkkra) >>13 string - >>>16 string . diff --git a/contrib/file/Magdir/netware b/contrib/file/Magdir/netware new file mode 100644 index 0000000..fbc1605 --- /dev/null +++ b/contrib/file/Magdir/netware @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# netware: file(1) magic for NetWare Loadable Modules (NLMs) +# From: Mads Martin Joergensen <mmj@suse.de> + +0 string NetWare\ Loadable\ Module NetWare Loadable Module diff --git a/contrib/file/Magdir/ole2compounddocs b/contrib/file/Magdir/ole2compounddocs new file mode 100644 index 0000000..ee07514 --- /dev/null +++ b/contrib/file/Magdir/ole2compounddocs @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured +# storage (http://en.wikipedia.org/wiki/Structured_Storage) +# Additional tests for OLE 2 Compound Documents should be under this recipe. + +0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document +# - Microstation V8 DGN files (www.bentley.com) +# Last update on 10/23/2006 by Lester Hightower +> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN +# - Visio documents +# Last update on 10/23/2006 by Lester Hightower +> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document diff --git a/contrib/file/Magdir/os2 b/contrib/file/Magdir/os2 index 99dd63a..35f79ef 100644 --- a/contrib/file/Magdir/os2 +++ b/contrib/file/Magdir/os2 @@ -1,12 +1,11 @@ - #------------------------------------------------------------------------------ # os2: file(1) magic for OS/2 files # # Provided 1998/08/22 by # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> -1 string InternetShortcut MS Windows 95 Internet shortcut text ->24 string >\ (URL=<%s>) +1 search/1 InternetShortcut MS Windows 95 Internet shortcut text +>24 search/1 >\ (URL=<%s>) # OS/2 URL objects # Provided 1998/08/22 by diff --git a/contrib/file/Magdir/palm b/contrib/file/Magdir/palm index 79af1f0..e57e119 100644 --- a/contrib/file/Magdir/palm +++ b/contrib/file/Magdir/palm @@ -45,7 +45,7 @@ >0 string >\0 "%s" 60 string SM01SMem SuperMemo PalmOS document >0 string >\0 "%s" -60 string DataTlPt TealDoc PalmOS document +60 string TEXtTlDc TealDoc PalmOS document >0 string >\0 "%s" 60 string InfoTlIf TealInfo PalmOS document >0 string >\0 "%s" diff --git a/contrib/file/Magdir/pdf b/contrib/file/Magdir/pdf index e90214e..8a4d2e7 100644 --- a/contrib/file/Magdir/pdf +++ b/contrib/file/Magdir/pdf @@ -3,11 +3,12 @@ # 0 string %PDF- PDF document +!:mime application/pdf >5 byte x \b, version %c >7 byte x \b.%c # From: Nick Schmalenberger <nick@schmalenberger.us> # Forms Data Format -0 string %FDF- FDF text +0 string %FDF- FDF document >5 byte x \b, version %c >7 byte x \b.%c diff --git a/contrib/file/Magdir/perl b/contrib/file/Magdir/perl index a8daee4..73fb88b 100644 --- a/contrib/file/Magdir/perl +++ b/contrib/file/Magdir/perl @@ -1,26 +1,32 @@ - #------------------------------------------------------------------------------ # perl: file(1) magic for Larry Wall's perl language. # -# The ``eval'' line recognizes an outrageously clever hack for USG systems. +# The `eval' lines recognizes an outrageously clever hack. # Keith Waclena <keith@cerberus.uchicago.edu> # Send additions to <perl5-porters@perl.org> -0 string/b #!\ /bin/perl perl script text executable -0 string eval\ "exec\ /bin/perl perl script text -0 string/b #!\ /usr/bin/perl perl script text executable -0 string eval\ "exec\ /usr/bin/perl perl script text -0 string/b #!\ /usr/local/bin/perl perl script text -0 string eval\ "exec\ /usr/local/bin/perl perl script text executable -0 string eval\ '(exit\ $?0)'\ &&\ eval\ 'exec perl script text +0 search/1/b #!\ /bin/perl Perl script text executable +!:mime text/x-perl +0 search/1 eval\ "exec\ /bin/perl Perl script text +!:mime text/x-perl +0 search/1/b #!\ /usr/bin/perl Perl script text executable +!:mime text/x-perl +0 search/1 eval\ "exec\ /usr/bin/perl Perl script text +!:mime text/x-perl +0 search/1/b #!\ /usr/local/bin/perl Perl script text executable +!:mime text/x-perl +0 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text +!:mime text/x-perl +0 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text +!:mime text/x-perl # by Dmitry V. Levin and Alexey Tourbin # check the first line -0 string package ->1 regex \^package[\ \t]+[A-Za-z_] ->>1 regex \^package[\ \t]+[0-9A-Za-z_:]*\ *; Perl5 module source text +0 search/1 package +0 regex \^package[\ \t]+[A-Za-z_] +>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text # not 'p', check other lines -0 byte !0x70 +0 search/1 !p >0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; >>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text @@ -28,21 +34,21 @@ # Perl POD documents # From: Tom Hukins <tom@eborcom.com> -0 string/B \=pod\n Perl POD document -0 string/B \n\=pod\n Perl POD document -0 string/B \=head1\ Perl POD document -0 string/B \n\=head1\ Perl POD document -0 string/B \=head2\ Perl POD document -0 string/B \n\=head2\ Perl POD document +0 search/1/B \=pod\n Perl POD document text +0 search/1/B \n\=pod\n Perl POD document text +0 search/1/B \=head1\ Perl POD document text +0 search/1/B \n\=head1\ Perl POD document text +0 search/1/B \=head2\ Perl POD document text +0 search/1/B \n\=head2\ Perl POD document text # Perl Storable data files. -0 string perl-store perl Storable(v0.6) data +0 string perl-store perl Storable (v0.6) data >4 byte >0 (net-order %d) >>4 byte &01 (network-ordered) >>4 byte =3 (major 1) >>4 byte =2 (major 1) -0 string pst0 perl Storable(v0.7) data +0 string pst0 perl Storable (v0.7) data >4 byte >0 >>4 byte &01 (network-ordered) >>4 byte =5 (major 2) diff --git a/contrib/file/Magdir/pgp b/contrib/file/Magdir/pgp index 038d098..63042ad 100644 --- a/contrib/file/Magdir/pgp +++ b/contrib/file/Magdir/pgp @@ -1,13 +1,26 @@ #------------------------------------------------------------------------------ # pgp: file(1) magic for Pretty Good Privacy +# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html # 0 beshort 0x9900 PGP key public ring +!:mime application/x-pgp-keyring 0 beshort 0x9501 PGP key security ring +!:mime application/x-pgp-keyring 0 beshort 0x9500 PGP key security ring +!:mime application/x-pgp-keyring 0 beshort 0xa600 PGP encrypted data -0 string -----BEGIN\040PGP PGP armored data ->15 string PUBLIC\040KEY\040BLOCK- public key block ->15 string MESSAGE- message ->15 string SIGNED\040MESSAGE- signed message ->15 string PGP\040SIGNATURE- signature +#!:mime application/pgp-encrypted +#0 string -----BEGIN\040PGP text/PGP armored data +!:mime text/PGP # encoding: armored data +#>15 string PUBLIC\040KEY\040BLOCK- public key block +#>15 string MESSAGE- message +#>15 string SIGNED\040MESSAGE- signed message +#>15 string PGP\040SIGNATURE- signature + +2 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block +!:mime application/pgp-keys +0 string -----BEGIN\040PGP\40MESSAGE- PGP message +!:mime application/pgp +0 string -----BEGIN\040PGP\40SIGNATURE- PGP signature +!:mime application/pgp-signature diff --git a/contrib/file/Magdir/pkgadd b/contrib/file/Magdir/pkgadd index dc8ef5d..876dacd 100644 --- a/contrib/file/Magdir/pkgadd +++ b/contrib/file/Magdir/pkgadd @@ -3,3 +3,4 @@ # pkgadd: file(1) magic for SysV R4 PKG Datastreams # 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) +!:mime application/x-svr4-package diff --git a/contrib/file/Magdir/printer b/contrib/file/Magdir/printer index 77ba780..15a1758 100644 --- a/contrib/file/Magdir/printer +++ b/contrib/file/Magdir/printer @@ -5,21 +5,26 @@ # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 0 string %! PostScript document text +!:mime application/postscript >2 string PS-Adobe- conforming ->>11 string >\0 at level %.3s ->>>15 string EPS - type %s ->>>15 string Query - type %s ->>>15 string ExitServer - type %s +>>11 string >\0 DSC level %.3s +>>>15 string EPS \b, type %s +>>>15 string Query \b, type %s +>>>15 string ExitServer \b, type %s +>>>15 search/1000 %%LanguageLevel:\ +>>>>&0 string >\0 \b, Level %s # Some PCs have the annoying habit of adding a ^D as a document separator 0 string \004%! PostScript document text +!:mime application/postscript >3 string PS-Adobe- conforming ->>12 string >\0 at level %.3s ->>>16 string EPS - type %s ->>>16 string Query - type %s ->>>16 string ExitServer - type %s +>>12 string >\0 DSC level %.3s +>>>16 string EPS \b, type %s +>>>16 string Query \b, type %s +>>>16 string ExitServer \b, type %s +>>>16 search/1000 %%LanguageLevel:\ +>>>>&0 string >\0 \b, Level %s 0 string \033%-12345X%!PS PostScript document - # DOS EPS Binary File Header # From: Ed Sznyter <ews@Black.Market.NET> 0 belong 0xC5D0D3C6 DOS EPS Binary File @@ -30,11 +35,13 @@ >>>20 long >0 TIFF starts at byte %d >>>>24 long >0 length %d -# Adobe's PostScript Printer Description (PPD) files -# Yves Arrouye <arrouye@marin.fdn.fr> +# Summary: Adobe's PostScript Printer Description File +# Extension: .ppd +# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 +# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> # -0 string *PPD-Adobe: PPD file ->13 string x \b, ve +0 string *PPD-Adobe:\x20 PPD file +>&0 string x \b, version %s # HP Printer Job Language 0 string \033%-12345X@PJL HP Printer Job Language data diff --git a/contrib/file/Magdir/psion b/contrib/file/Magdir/psion index 578ea59..7aa2d74 100644 --- a/contrib/file/Magdir/psion +++ b/contrib/file/Magdir/psion @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # psion: file(1) magic for Psion handhelds data # from: Peter Breitenlohner <peb@mppmu.mpg.de> @@ -11,6 +10,7 @@ >4 lelong 0x1000006A application information file >4 lelong 0x1000006D >>8 lelong 0x1000007D sketch image +!:mime image/x-psion-sketch >>8 lelong 0x1000007E voice note >>8 lelong 0x1000007F word file >>8 lelong 0x10000085 OPL program diff --git a/contrib/file/Magdir/revision b/contrib/file/Magdir/revision index e47416a..a809cb9 100644 --- a/contrib/file/Magdir/revision +++ b/contrib/file/Magdir/revision @@ -7,3 +7,13 @@ # Conary changesets # From: Jonathan Smith <smithj@rpath.com> 0 belong 0xea3f81bb Conary changeset data + +# Type: Git bundles (git-bundle) +# From: Josh Triplett <josh@freedesktop.org> +0 string #\ v2\ git\ bundle\n Git bundle + +# Type: Mercurial bundles +# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> +0 string HG10 Mercurial bundle, +>4 string UN uncompressed +>4 string BZ bzip2 compressed diff --git a/contrib/file/Magdir/riff b/contrib/file/Magdir/riff index 5aa9d10..c6e3070 100644 --- a/contrib/file/Magdir/riff +++ b/contrib/file/Magdir/riff @@ -33,6 +33,7 @@ >8 string RMP3 \b, MPEG Layer 3 audio # Microsoft WAVE format (*.wav) >8 string WAVE \b, WAVE audio +!:mime audio/x-wav >>20 leshort 1 \b, Microsoft PCM >>>34 leshort >0 \b, %d bit >>20 leshort 2 \b, Microsoft ADPCM @@ -50,8 +51,10 @@ >>24 lelong >0 %d Hz # Corel Draw Picture >8 string CDRA \b, Corel Draw Picture +!:mime image/x-coreldraw # AVI == Audio Video Interleave >8 string AVI\040 \b, AVI +!:mime video/x-msvideo >>12 string LIST >>>20 string hdrlavih >>>>&36 lelong x \b, %lu x @@ -130,8 +133,9 @@ >>>>>>>(104.l+132) string/c divx DivX 4 >>>>>>>(104.l+132) string/c dx50 DivX 5 >>>>>>>(104.l+132) string/c xvid XviD +>>>>>>>(104.l+132) string/c h264 H.264 >>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 ->>>>>>>(104.l+132) string/c h264 X.264 +>>>>>>>(104.l+132) string/c h264 X.264 or H.264 >>>>>>>(104.l+132) lelong 0 ##>>>>>>>(104.l+132) string x (%.4s) # skip past first (video) LIST diff --git a/contrib/file/Magdir/rpm b/contrib/file/Magdir/rpm index 09ee51b..6d7e850 100644 --- a/contrib/file/Magdir/rpm +++ b/contrib/file/Magdir/rpm @@ -4,6 +4,7 @@ # 0 beshort 0xedab >2 beshort 0xeedb RPM +!:mime application/x-rpm >>4 byte x v%d >>6 beshort 0 bin >>6 beshort 1 src @@ -13,7 +14,7 @@ >>8 beshort 4 MIPS >>8 beshort 5 PowerPC >>8 beshort 6 68000 ->>8 beshort 7 SGI +>>8 beshort 7 SGI >>8 beshort 8 RS6000 >>8 beshort 9 IA64 >>8 beshort 10 Sparc64 diff --git a/contrib/file/Magdir/rtf b/contrib/file/Magdir/rtf index 8e2d416..8e5bfe0 100644 --- a/contrib/file/Magdir/rtf +++ b/contrib/file/Magdir/rtf @@ -5,8 +5,11 @@ # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk # 0 string {\\rtf Rich Text Format data, ->5 byte x version %c, ->6 string \\ansi ANSI ->6 string \\mac Apple Macintosh ->6 string \\pc IBM PC, code page 437 ->6 string \\pca IBM PS/2, code page 850 +!:mime text/rtf +>5 string 1 version 1, +>>6 string \\ansi ANSI +>>6 string \\mac Apple Macintosh +>>6 string \\pc IBM PC, code page 437 +>>6 string \\pca IBM PS/2, code page 850 +>>6 default x unknown character set +>5 default x unknown version diff --git a/contrib/file/Magdir/ruby b/contrib/file/Magdir/ruby new file mode 100644 index 0000000..de6f2a0 --- /dev/null +++ b/contrib/file/Magdir/ruby @@ -0,0 +1,10 @@ +#------------------------------------------------------------------------------ +# ruby: file(1) magic for Lua scripting language +# URL: http://www.ruby-lang.org/ +# From: Reuben Thomas <rrt@sc3d.org> + +# Ruby scripts +0 search/1/b #!\ /usr/bin/ruby Ruby script text executable +0 search/1/b #!\ /usr/local/bin/ruby Ruby script text executable +0 search/1 #!/usr/bin/env\ ruby Ruby script text executable +0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable diff --git a/contrib/file/Magdir/sc b/contrib/file/Magdir/sc index 98599f2..72027d6 100644 --- a/contrib/file/Magdir/sc +++ b/contrib/file/Magdir/sc @@ -3,3 +3,4 @@ # sc: file(1) magic for "sc" spreadsheet # 38 string Spreadsheet sc spreadsheet file +!:mime application/x-sc diff --git a/contrib/file/Magdir/scientific b/contrib/file/Magdir/scientific index 81beac1..f7aedae 100644 --- a/contrib/file/Magdir/scientific +++ b/contrib/file/Magdir/scientific @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # scientific: file(1) magic for scientific formats # @@ -58,3 +57,15 @@ >1104 ulong >0 %d x >1108 ulong >0 %d, >1120 ulong >0 %d bits/pixel + +# Type: GEDCOM genealogical (family history) data +# From: Giuseppe Bilotta +0 search/1/c 0\ HEAD GEDCOM genealogy text +>&0 search 1\ GEDC +>>&0 search 2\ VERS version +>>>&1 search/1 >\0 %s +# From: Phil Endecott <phil05@chezphil.org> +0 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data +0 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data +0 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data +0 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data diff --git a/contrib/file/Magdir/securitycerts b/contrib/file/Magdir/securitycerts new file mode 100644 index 0000000..aa55d21 --- /dev/null +++ b/contrib/file/Magdir/securitycerts @@ -0,0 +1,3 @@ +0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text +0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text +0 belong 0xedfeedfe Sun 'jks' Java Keystore File data diff --git a/contrib/file/Magdir/sgi b/contrib/file/Magdir/sgi index f7de138..5b54027 100644 --- a/contrib/file/Magdir/sgi +++ b/contrib/file/Magdir/sgi @@ -8,12 +8,17 @@ 0 string PmNs PCP compiled namespace (V.0) 0 string PmN PCP compiled namespace >3 string >\0 (V.%1.1s) -3 lelong 0x84500526 PCP archive +#3 lelong 0x84500526 PCP archive +3 belong 0x84500526 PCP archive >7 byte x (V.%d) ->20 lelong -2 temporal index ->20 lelong -1 metadata ->20 lelong 0 log volume #0 ->20 lelong >0 log volume #%ld +#>20 lelong -2 temporal index +#>20 lelong -1 metadata +#>20 lelong 0 log volume #0 +#>20 lelong >0 log volume #%ld +>20 belong -2 temporal index +>20 belong -1 metadata +>20 belong 0 log volume #0 +>20 belong >0 log volume #%ld >24 string >\0 host: %s 0 string PCPFolio PCP >9 string Version: Archive Folio @@ -30,6 +35,9 @@ 0 string #pmlogger PCP pmlogger config >10 string Version >18 string >\0 (V%1.1s) +0 string #pmdahotproc PCP pmdahotproc config +>13 string Version +>21 string >\0 (V%-3.3s) 0 string PcPh PCP Help >4 string 1 Index >4 string 2 Text diff --git a/contrib/file/Magdir/sgml b/contrib/file/Magdir/sgml index ba6c3ef..7e3391b 100644 --- a/contrib/file/Magdir/sgml +++ b/contrib/file/Magdir/sgml @@ -1,35 +1,63 @@ +#------------------------------------------------------------------------------ +# Type: SVG Vectorial Graphics +# From: Noel Torres <tecnico@ejerciciosresueltos.com> +0 string \<?xml\ version=" +>15 string >\0 +>>23 search/400 \<svg SVG Scalable Vector Graphics image +!:mime image/svg+xml +>>23 search/400 \<gnc-v2 GnuCash file +!:mime application/x-gnucash + +# Sitemap file +0 string \<?xml\ version=" +>15 string >\0 +>>23 search/400 \<urlset XML Sitemap document text +!:mime application/xml-sitemap #------------------------------------------------------------------------------ # sgml: file(1) magic for Standard Generalized Markup Language # HyperText Markup Language (HTML) is an SGML document type, # from Daniel Quinlan (quinlan@yggdrasil.com) # adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) -0 string/cB \<!DOCTYPE\ html HTML document text -0 string/cb \<head HTML document text -0 string/cb \<title HTML document text -0 string/cb \<html HTML document text +0 search/1/cB \<!doctype\ html HTML document text +!:mime text/html +0 search/1/cb \<head HTML document text +!:mime text/html +0 search/1/cb \<title HTML document text +!:mime text/html +0 search/1/cb \<html HTML document text +!:mime text/html # Extensible markup language (XML), a subset of SGML # from Marc Prud'hommeaux (marc@apocalypse.org) -0 string/cb \<?xml XML document text +0 search/1/cb \<?xml XML document text +!:mime application/xml 0 string \<?xml\ version\ " XML +!:mime application/xml 0 string \<?xml\ version=" XML +!:mime application/xml +>15 search/1 >\0 %.3s document text +>>23 search/1 \<xsl:stylesheet (XSL stylesheet) +>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 0 string \<?xml\ version=' XML ->15 string >\0 %.3s document text ->>23 string \<xsl:stylesheet (XSL stylesheet) ->>24 string \<xsl:stylesheet (XSL stylesheet) -0 string/b \<?xml XML document text -0 string/cb \<?xml broken XML document text +!:mime application/xml +>15 search/1 >\0 %.3s document text +>>23 search/1 \<xsl:stylesheet (XSL stylesheet) +>>24 search/1 \<xsl:stylesheet (XSL stylesheet) +0 search/1/b \<?xml XML document text +!:mime application/xml +0 search/1/b \<?XML broken XML document text +!:mime application/xml # SGML, mostly from rph@sq -0 string/cb \<!doctype exported SGML document text -0 string/cb \<!subdoc exported SGML subdocument text -0 string/cb \<!-- exported SGML document text +0 search/1/cb \<!doctype exported SGML document text +0 search/1/cb \<!subdoc exported SGML subdocument text +0 search/1/cb \<!-- exported SGML document text # Web browser cookie files # (Mozilla, Galeon, Netscape 4, Konqueror..) # Ulf Harnhammar <ulfh@update.uu.se> -0 string #\ HTTP\ Cookie\ File Web browser cookie text -0 string #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text -0 string #\ KDE\ Cookie\ File Konqueror cookie text +0 search/1 #\ HTTP\ Cookie\ File Web browser cookie text +0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text +0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text diff --git a/contrib/file/Magdir/sharc b/contrib/file/Magdir/sharc index 8c2cae4..0e0e4e3 100644 --- a/contrib/file/Magdir/sharc +++ b/contrib/file/Magdir/sharc @@ -6,14 +6,14 @@ # FutureGroove Music (dsp@futuregroove.de) #------------------------------------------------------------------------ -0 string Draw RiscOS Drawfile -0 string PACK RiscOS PackdDir archive +#0 string Draw RiscOS Drawfile +#0 string PACK RiscOS PackdDir archive #------------------------------------------------------------------------ # SHARC DSP stuff (based on the FGM SHARC DSP SDK) -0 string =! Assembler source -0 string Analog ADi asm listing file +#0 string =! Assembler source +#0 string Analog ADi asm listing file 0 string .SYSTEM SHARC architecture file 0 string .system SHARC architecture file diff --git a/contrib/file/Magdir/sketch b/contrib/file/Magdir/sketch index d31d184..a14803e 100644 --- a/contrib/file/Magdir/sketch +++ b/contrib/file/Magdir/sketch @@ -1,5 +1,4 @@ - #------------------------------------------------------------------------------ # Sketch Drawings: http://sketch.sourceforge.net/ # From: Edwin Mons <e@ik.nu> -0 string ##Sketch Sketch document text +0 search/1 ##Sketch Sketch document text diff --git a/contrib/file/Magdir/softquad b/contrib/file/Magdir/softquad index aa16904..ac7891d 100644 --- a/contrib/file/Magdir/softquad +++ b/contrib/file/Magdir/softquad @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # softquad: file(1) magic for SoftQuad Publishing Software # @@ -19,7 +18,7 @@ 0 short 0125252 SoftQuad DESC or font file binary >2 short >0 - version %d # Bitmaps... -0 string SQ\ BITMAP1 SoftQuad Raster Format text +0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text #0 string SQ\ BITMAP2 SoftQuad Raster Format data # sqtroff intermediate language (replacement for ditroff int. lang.) 0 string X\ SoftQuad troff Context intermediate @@ -27,3 +26,10 @@ >2 string hp for Hewlett-Packard LaserJet >2 string impr for IMAGEN imPRESS >2 string ps for PostScript + +# From: Michael Piefel <piefel@debian.org> +# sqtroff intermediate language (replacement for ditroff int. lang.) +0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer +0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet +0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS +0 string X\ ps SoftQuad troff Context intermediate for PostScript diff --git a/contrib/file/Magdir/spectrum b/contrib/file/Magdir/spectrum index ab9fd04..a48ac41 100644 --- a/contrib/file/Magdir/spectrum +++ b/contrib/file/Magdir/spectrum @@ -31,14 +31,19 @@ # TZX tape images 0 string ZXTape!\x1a Spectrum .TZX data >8 byte x version %d ->9 byte x .%d +>9 byte x \b.%d # RZX input recording files 0 string RZX! Spectrum .RZX data >4 byte x version %d ->5 byte x .%d +>5 byte x \b.%d -# And three sorts of disk image +# Floppy disk images 0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data +0 string SINCLAIR Spectrum .SCL Betadisk image + +# Hard disk images +0 string RS-IDE\x1a Spectrum .HDF hard disk image +>7 byte x \b, version 0x%02x diff --git a/contrib/file/Magdir/tex b/contrib/file/Magdir/tex index 52adb87..5416db1 100644 --- a/contrib/file/Magdir/tex +++ b/contrib/file/Magdir/tex @@ -1,46 +1,61 @@ - #------------------------------------------------------------------------------ # tex: file(1) magic for TeX files # +# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) +# # From <conklin@talisman.kaleida.com> # Although we may know the offset of certain text fields in TeX DVI # and font files, we can't use them reliably because they are not # zero terminated. [but we do anyway, christos] 0 string \367\002 TeX DVI file +!:mime application/x-dvi >16 string >\0 (%s) 0 string \367\203 TeX generic font data 0 string \367\131 TeX packed font data >3 string >\0 (%s) 0 string \367\312 TeX virtual font data -0 string This\ is\ TeX, TeX transcript text -0 string This\ is\ METAFONT, METAFONT transcript text +0 search/1 This\ is\ TeX, TeX transcript text +0 search/1 This\ is\ METAFONT, METAFONT transcript text # There is no way to detect TeX Font Metric (*.tfm) files without # breaking them apart and reading the data. The following patterns # match most *.tfm files generated by METAFONT or afm2tfm. 2 string \000\021 TeX font metric data +!:mime application/x-tex-tfm >33 string >\0 (%s) 2 string \000\022 TeX font metric data +!:mime application/x-tex-tfm >33 string >\0 (%s) # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) -0 string \\input\ texinfo Texinfo source text -0 string This\ is\ Info\ file GNU Info text +0 search/1 \\input\ texinfo Texinfo source text +!:mime text/x-texinfo +0 search/1 This\ is\ Info\ file GNU Info text +!:mime text/x-info # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 0 search/400 \\input TeX document text +!:mime text/x-tex 0 search/400 \\section LaTeX document text +!:mime text/x-tex 0 search/400 \\setlength LaTeX document text +!:mime text/x-tex 0 search/400 \\documentstyle LaTeX document text +!:mime text/x-tex 0 search/400 \\chapter LaTeX document text +!:mime text/x-tex 0 search/400 \\documentclass LaTeX 2e document text +!:mime text/x-tex 0 search/400 \\relax LaTeX auxiliary file +!:mime text/x-tex 0 search/400 \\contentsline LaTeX table of contents +!:mime text/x-tex 0 search/400 %\ -*-latex-*- LaTeX document text +!:mime text/x-tex # Tex document, from Hendrik Scholz <hendrik@scholz.net> -0 string \\ifx TeX document text +0 search/1 \\ifx TeX document text # Index and glossary files 0 search/400 \\indexentry LaTeX raw index file @@ -55,25 +70,24 @@ # file(1) magic for BibTex text files # From Hendrik Scholz <hendrik@scholz.net> -0 string/c @article{ BibTeX text file -0 string/c @book{ BibTeX text file -0 string/c @inbook{ BibTeX text file -0 string/c @incollection{ BibTeX text file -0 string/c @inproceedings{ BibTeX text file -0 string/c @manual{ BibTeX text file -0 string/c @misc{ BibTeX text file -0 string/c @preamble{ BibTeX text file -0 string/c @phdthesis{ BibTeX text file -0 string/c @techreport{ BibTeX text file -0 string/c @unpublished{ BibTeX text file - -73 string %%%\ \ BibTeX-file{ BibTex text file (with full header) +0 search/1/c @article{ BibTeX text file +0 search/1/c @book{ BibTeX text file +0 search/1/c @inbook{ BibTeX text file +0 search/1/c @incollection{ BibTeX text file +0 search/1/c @inproceedings{ BibTeX text file +0 search/1/c @manual{ BibTeX text file +0 search/1/c @misc{ BibTeX text file +0 search/1/c @preamble{ BibTeX text file +0 search/1/c @phdthesis{ BibTeX text file +0 search/1/c @techreport{ BibTeX text file +0 search/1/c @unpublished{ BibTeX text file -73 string %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) +73 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) -0 string %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file +73 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) -0 string %\ BibTeX\ ` BibTeX custom bibliography style text file +0 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file -0 string @c\ @mapfile{ TeX font aliases text file +0 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file +0 search/1 @c\ @mapfile{ TeX font aliases text file diff --git a/contrib/file/Magdir/troff b/contrib/file/Magdir/troff index 01ad88a..337ca68 100644 --- a/contrib/file/Magdir/troff +++ b/contrib/file/Magdir/troff @@ -1,28 +1,32 @@ - #------------------------------------------------------------------------------ # troff: file(1) magic for *roff # # updated by Daniel Quinlan (quinlan@yggdrasil.com) # troff input -0 string .\\" troff or preprocessor input text -0 string '\\" troff or preprocessor input text -0 string '.\\" troff or preprocessor input text -0 string \\" troff or preprocessor input text -0 string ''' troff or preprocessor input text +0 search/1 .\\" troff or preprocessor input text +!:mime text/troff +0 search/1 '\\" troff or preprocessor input text +!:mime text/troff +0 search/1 '.\\" troff or preprocessor input text +!:mime text/troff +0 search/1 \\" troff or preprocessor input text +!:mime text/troff +0 search/1 ''' troff or preprocessor input text +!:mime text/troff # ditroff intermediate output text -0 string x\ T ditroff output text ->4 string cat for the C/A/T phototypesetter ->4 string ps for PostScript ->4 string dvi for DVI ->4 string ascii for ASCII ->4 string lj4 for LaserJet 4 ->4 string latin1 for ISO 8859-1 (Latin 1) ->4 string X75 for xditview at 75dpi ->>7 string -12 (12pt) ->4 string X100 for xditview at 100dpi ->>8 string -12 (12pt) +0 search/1 x\ T ditroff output text +>4 search/1 cat for the C/A/T phototypesetter +>4 search/1 ps for PostScript +>4 search/1 dvi for DVI +>4 search/1 ascii for ASCII +>4 search/1 lj4 for LaserJet 4 +>4 search/1 latin1 for ISO 8859-1 (Latin 1) +>4 search/1 X75 for xditview at 75dpi +>>7 search/1 -12 (12pt) +>4 search/1 X100 for xditview at 100dpi +>>8 search/1 -12 (12pt) # output data formats 0 string \100\357 very old (C/A/T) troff output data diff --git a/contrib/file/Magdir/unicode b/contrib/file/Magdir/unicode index 45a32d45..5f4a576 100644 --- a/contrib/file/Magdir/unicode +++ b/contrib/file/Magdir/unicode @@ -1,15 +1,14 @@ - #--------------------------------------------------------------------------- # Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> +# GRR: These types should be recognised in file_ascmagic so these +# encodings can be treated by text patterns. +# Missing types are already dealt with internally. # 0 string +/v8 Unicode text, UTF-7 0 string +/v9 Unicode text, UTF-7 0 string +/v+ Unicode text, UTF-7 0 string +/v/ Unicode text, UTF-7 -0 string \357\273\277 Unicode text, UTF-8 0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 0 string \376\377\000\000 Unicode text, UTF-32, big-endian 0 string \377\376\000\000 Unicode text, UTF-32, little-endian -0 string \376\377 Unicode text, UTF-16, big-endian -0 string \377\376 Unicode text, UTF-16, little-endian 0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) diff --git a/contrib/file/Magdir/uuencode b/contrib/file/Magdir/uuencode index 7e88619..982cba9 100644 --- a/contrib/file/Magdir/uuencode +++ b/contrib/file/Magdir/uuencode @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # uuencode: file(1) magic for ASCII-encoded files # @@ -9,22 +8,22 @@ # punctuation and survives BITNET gateways better.) If regular expressions # were supported, this entry could possibly be split into two with # "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). -0 string begin\040 uuencoded or xxencoded text +0 search/1 begin\ uuencoded or xxencoded text # btoa(1) is an alternative to uuencode that requires less space. -0 string xbtoa\ Begin btoa'd text +0 search/1 xbtoa\ Begin btoa'd text # ship(1) is another, much cooler alternative to uuencode. # Greg Roelofs, newt@uchicago.edu -0 string $\012ship ship'd binary text +0 search/1 $\012ship ship'd binary text # bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) # Greg Roelofs, newt@uchicago.edu -0 string Decode\ the\ following\ with\ bdeco bencoded News text +0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text # BinHex is the Macintosh ASCII-encoded file format (see also "apple") # Daniel Quinlan, quinlan@yggdrasil.com -11 string must\ be\ converted\ with\ BinHex BinHex binary text ->41 string x \b, version %.3s +11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text +>41 search/1 x \b, version %.3s -# GRR: is MIME BASE64 encoding handled somewhere? +# GRR: handle BASE64 diff --git a/contrib/file/Magdir/varied.script b/contrib/file/Magdir/varied.script index ab5bece..61f935c 100644 --- a/contrib/file/Magdir/varied.script +++ b/contrib/file/Magdir/varied.script @@ -10,3 +10,9 @@ 0 string #!\ script text executable >3 string >\0 for %s +# From: arno <arenevier@fdn.fr> +# mozilla xpconnect typelib +# see http://www.mozilla.org/scriptable/typelib_file.html +0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib +>0x10 byte x version %d +>>0x11 byte x \b.%d diff --git a/contrib/file/Magdir/vorbis b/contrib/file/Magdir/vorbis index 5957ea0..cbef5fd 100644 --- a/contrib/file/Magdir/vorbis +++ b/contrib/file/Magdir/vorbis @@ -11,16 +11,40 @@ # probable things advanced users would want to uncomment are probably # the number of comments and the encoder version. # +# FIXME: The first match has been made a search, so that it can skip +# over prepended ID3 tags. This will work for MIME type detection, but +# won't work for detecting other properties of the file (they all need +# to be made relative to the search). In any case, if the file has ID3 +# tags, the ID3 information will be printed, not the Ogg information, +# so until that's fixed, this doesn't matter. +# FIXME[2]: Disable the above for now, since search assumes text mode. +# # --- Ogg Framing --- -0 string OggS Ogg data +#0 search/1000 OggS Ogg data +0 string OggS Ogg data +!:mime application/ogg >4 byte !0 UNKNOWN REVISION %u ##>4 byte 0 revision 0 >4 byte 0 ##>>14 lelong x (Serial %lX) # non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) ->>28 string fLaC \b, FLAC audio +>>28 string \x7fFLAC \b, FLAC audio # non-Vorbis content: Theora >>28 string \x80theora \b, Theora video +# non-Vorbis content: Kate +>>28 string \x80kate\0\0\0\0 \b, Kate +>>>37 ubyte x v%u +>>>38 ubyte x \b.%u, +>>>40 byte 0 utf8 encoding, +>>>40 byte !0 unknown character encoding, +>>>60 string >\0 language %s, +>>>60 string \0 no language set, +>>>76 string >\0 category %s +>>>76 string \0 no category set +# non-Vorbis content: Skeleton +>>28 string fishead\0 \b, Skeleton +>>>36 short x v%u +>>>40 short x \b.%u # non-Vorbis content: Speex >>28 string Speex\ \ \ \b, Speex audio # non-Vorbis content: OGM diff --git a/contrib/file/Magdir/warc b/contrib/file/Magdir/warc new file mode 100644 index 0000000..968e267 --- /dev/null +++ b/contrib/file/Magdir/warc @@ -0,0 +1,6 @@ + +#------------------------------------------------------------------------------ +# warc: file(1) magic for WARC files + +0 string WARC/ WARC Archive +>5 string x version %.4s diff --git a/contrib/file/Magdir/weak b/contrib/file/Magdir/weak new file mode 100644 index 0000000..21324ea --- /dev/null +++ b/contrib/file/Magdir/weak @@ -0,0 +1,15 @@ +#------------------------------------------------------------------------------ +# weak: file(1) magic for very weak magic entries, disabled by default +# +# These entries are so weak that they might interfere identification of +# other formats. Example include: +# - Only identify for 1 or 2 bytes +# - Match against very wide range of values +# - Match against generic word in some spoken languages (e.g. English) + +# Summary: Computer Graphics Metafile +# Extension: .cgm +#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile +#0 beshort 0x3020 character Computer Graphics Metafile + +#0 string =!! Bennet Yee's "face" format diff --git a/contrib/file/Magdir/windows b/contrib/file/Magdir/windows new file mode 100644 index 0000000..5cde739 --- /dev/null +++ b/contrib/file/Magdir/windows @@ -0,0 +1,115 @@ + +#------------------------------------------------------------------------------ +# windows: file(1) magic for Microsoft Windows +# +# This file is mainly reserved for files where programs +# using them are run almost always on MS Windows 3.x or +# above, or files only used exclusively in Windows OS, +# where there is no better category to allocate for. +# For example, even though WinZIP almost run on Windows +# only, it is better to treat them as "archive" instead. +# For format usable in DOS, such as generic executable +# format, please specify under "msdos" file. +# + + +# Summary: Outlook Express DBX file +# Extension: .dbx +# Created by: Christophe Monniez +0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file +>4 byte =0xC5 \b, message database +>4 byte =0xC6 \b, folder database +>4 byte =0xC7 \b, account information +>4 byte =0x30 \b, offline database + + +# Summary: Windows crash dump +# Extension: .dmp +# Created by: Andreas Schuster (http://computer.forensikblog.de/) +# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html +# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) +0 string PAGE +>4 string DUMP MS Windows 32bit crash dump +>>0x05c byte 0 \b, no PAE +>>0x05c byte 1 \b, PAE +>>0xf88 lelong 1 \b, full dump +>>0xf88 lelong 2 \b, kernel dump +>>0xf88 lelong 3 \b, small dump +>>0x068 lelong x \b, %ld pages +>4 string DU64 MS Windows 64bit crash dump +>>0xf98 lelong 1 \b, full dump +>>0xf98 lelong 2 \b, kernel dump +>>0xf98 lelong 3 \b, small dump +>>0x090 lequad x \b, %lld pages + + +# Summary: Vista Event Log +# Extension: .evtx +# Created by: Andreas Schuster (http://computer.forensikblog.de/) +# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html +0 string ElfFile\0 MS Windows Vista Event Log +>0x2a leshort x \b, %d chunks +>>0x10 lelong x \b (no. %d in use) +>0x18 lelong >1 \b, next record no. %d +>0x18 lelong =1 \b, empty +>0x78 lelong &1 \b, DIRTY +>0x78 lelong &2 \b, FULL + + +# Summary: Windows 3.1 group files +# Extension: .grp +# Created by: unknown +0 string \120\115\103\103 MS Windows 3.1 group files + + +# Summary: Old format help files +# Extension: .hlp +# Created by: Dirk Jagdmann <doj@cubic.org> +0 lelong 0x00035f3f MS Windows 3.x help file + + +# Summary: Hyper terminal +# Extension: .ht +# Created by: unknown +0 string HyperTerminal\ +>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile + + +# Summary: Windows shortcut +# Extension: .lnk +# Created by: unknown +0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut + + +# Summary: Outlook Personal Folders +# Created by: unknown +0 lelong 0x4E444221 Microsoft Outlook email folder +>10 leshort 0x0e (<=2002) +>10 leshort 0x17 (>=2003) + + +# Summary: Windows help cache +# Created by: unknown +0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache + + +# Summary: IE cache file +# Created by: Christophe Monniez +0 string Client\ UrlCache\ MMF Internet Explorer cache file +>20 string >\0 version %s + + +# Summary: Registry files +# Created by: unknown +# Modified by (1): Joerg Jenderek +0 string regf MS Windows registry file, NT/2000 or above +0 string CREG MS Windows 95/98/ME registry file +0 string SHCC3 MS Windows 3.1 registry file + + +# Summary: Windows Registry text +# Extension: .reg +# Submitted by: Abel Cheung <abelcheung@gmail.com> +0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) +0 string Windows\ Registry\ Editor\ +>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) diff --git a/contrib/file/Magdir/wordprocessors b/contrib/file/Magdir/wordprocessors index 546d261..8965d33 100644 --- a/contrib/file/Magdir/wordprocessors +++ b/contrib/file/Magdir/wordprocessors @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # wordprocessors: file(1) magic fo word processors. # @@ -12,7 +11,7 @@ >26 byte 0x46 \b, A4 #WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE -0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text +0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file >15 byte 0 Optimized for Intel >15 byte 1 Optimized for Non-Intel 1 string WPC (Corel/WP) @@ -107,6 +106,7 @@ 0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 # From: Won-Kyu Park <wkpark@kldp.org> 512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 +!:mime application/x-hwp # CosmicBook, from Benoît Rouits 0 string CSBK Ted Neslson's CosmicBook hypertext file @@ -122,15 +122,29 @@ 2 string IIXPR3 Intel Quark Express Document (English) 2 string IIXPRa Intel Quark Express Document (Korean) 2 string MMXPR3 Motorola Quark Express Document (English) +!:mime application/x-quark-xpress-3 2 string MMXPRa Motorola Quark Express Document (Korean) # adobe indesign (document, whatever...) from querkan 0 belong 0x0606edf5 Adobe InDesign >16 string DOCUMENT Document -# From: Michael Piefel <piefel@debian.org> -# sqtroff intermediate language (replacement for ditroff int. lang.) -0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer -0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet -0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS -0 string X\ ps SoftQuad troff Context intermediate for PostScript +#------------------------------------------------------------------------------ +# ichitaro456: file(1) magic for Just System Word Processor Ichitaro +# +# Contributor kenzo-: +# Reversed-engineered JS Ichitaro magic numbers +# + +0 string DOC +>43 byte 0x14 Just System Word Processor Ichitaro v4 +!:mime application/x-ichitaro4 +>144 string JDASH application/x-ichitaro4 + +0 string DOC +>43 byte 0x15 Just System Word Processor Ichitaro v5 +!:mime application/x-ichitaro5 + +0 string DOC +>43 byte 0x16 Just System Word Processor Ichitaro v6 +!:mime application/x-ichitaro6 diff --git a/contrib/file/Magdir/xilinx b/contrib/file/Magdir/xilinx new file mode 100644 index 0000000..8f411ce --- /dev/null +++ b/contrib/file/Magdir/xilinx @@ -0,0 +1,34 @@ + +#------------------------------------------------------------------------------ +# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. +# Xilinx-Magic@RevRagnarok.com +# Got the info from FPGA-FAQ 0026 +# +# First there is the sync header and its length +0 beshort 0x0009 +>2 belong =0x0ff00ff0 +>>&0 belong =0x0ff00ff0 +>>>&0 beshort =0x0000 +>>>>&0 pstring a Xilinx BIT data +# Next is a Pascal-style string with the NCD name. We want to capture that. +>>>>0x0F pstring x - from %s +# It is followed by a NUL +>>>>>&1 byte 0x00 +# And then 'b' +>>>>>&2 string b +# With the part number: +#>>>>>&5 string 4v (Virtex4) +#>>>>>&5 string 2v (Virtex II +#>>>>>>&0 string !p \b) +#>>>>>>&0 string p Pro) +>>>>>&4 pstring x - for %s +# And then NUL / 'c' / Build Data / NUL / 'd' / Date / NUL / 'e' / Data Length +>>>>>>&1 byte 0x00 +>>>>>>&2 string c +>>>>>>&4 pstring x - built %s +>>>>>>>&1 byte 0x00 +>>>>>>>&2 string d +>>>>>>>&4 pstring x \b(%s) +>>>>>>>>&1 byte 0x00 +>>>>>>>>&2 string e +>>>>>>>>&4 belong x - data length 0x%lx |
