summaryrefslogtreecommitdiffstats
path: root/usr.bin/file
diff options
context:
space:
mode:
authorru <ru@FreeBSD.org>2008-01-30 12:56:59 +0000
committerru <ru@FreeBSD.org>2008-01-30 12:56:59 +0000
commit3c0bb170e14e9434b8974257655e260f1fafb320 (patch)
tree478fd3be2dd76c643a62692bce68badb2d60298f /usr.bin/file
parent7b230e75d8aaae0272b42f0f5d3cd9b1df0d9114 (diff)
downloadFreeBSD-src-3c0bb170e14e9434b8974257655e260f1fafb320.zip
FreeBSD-src-3c0bb170e14e9434b8974257655e260f1fafb320.tar.gz
Christos decided to keep the manpages in mdoc(7) format,
so stop using our own versions of these.
Diffstat (limited to 'usr.bin/file')
-rw-r--r--usr.bin/file/Makefile12
-rw-r--r--usr.bin/file/file.1588
-rw-r--r--usr.bin/file/magic.5444
3 files changed, 12 insertions, 1032 deletions
diff --git a/usr.bin/file/Makefile b/usr.bin/file/Makefile
index 0aec031..e6bf149 100644
--- a/usr.bin/file/Makefile
+++ b/usr.bin/file/Makefile
@@ -33,4 +33,16 @@ CFLAGS+= -I${.CURDIR}
DPADD= ${LIBMAGIC} ${LIBZ}
LDADD= -lmagic -lz
+FILEVER!= awk '$$1 == "\#define" && $$2 == "VERSION" { print $$3; exit }' \
+ ${.CURDIR}/config.h
+
+CLEANFILES+= ${MAN}
+
.include <bsd.prog.mk>
+
+.for mp in ${MAN}
+${mp}: ${mp:C/[0-9]/man/}
+ sed -e 's/__FSECTION__/5/g' -e 's/__CSECTION__/1/g' \
+ -e 's/__VERSION__/${FILEVER}/g' \
+ -e 's,__MAGIC__,${MAGICPATH}/magic,g' ${.ALLSRC} > ${.TARGET}
+.endfor
diff --git a/usr.bin/file/file.1 b/usr.bin/file/file.1
deleted file mode 100644
index c945f48..0000000
--- a/usr.bin/file/file.1
+++ /dev/null
@@ -1,588 +0,0 @@
-.\" $FreeBSD$
-.\" $Id: file.man,v 1.57 2005/08/18 15:18:22 christos Exp $
-.Dd August 18, 2005
-.Dt FILE 1 "Copyright but distributable"
-.Os
-.Sh NAME
-.Nm file
-.Nd determine file type
-.Sh SYNOPSIS
-.Nm
-.Op Fl bchikLnNprsvz
-.Op Fl f Ar namefile
-.Op Fl F Ar separator
-.Op Fl m Ar magicfiles
-.Ar
-.Nm
-.Fl C
-.Op Fl m Ar magicfile
-.Sh DESCRIPTION
-This manual page documents version 4.21 of the
-.Nm
-utility which tests each argument in an attempt to classify it.
-There are three sets of tests, performed in this order:
-file system tests, magic number tests, and language tests.
-The
-.Em first
-test that succeeds causes the file type to be printed.
-.Pp
-The type printed will usually contain one of the words
-.Dq Li text
-(the file contains only
-printing characters and a few common control
-characters and is probably safe to read on an
-.Tn ASCII
-terminal),
-.Dq Li executable
-(the file contains the result of compiling a program
-in a form understandable to some
-.Ux
-kernel or another),
-or
-.Dq Li data
-meaning anything else (data is usually
-.Sq binary
-or non-printable).
-Exceptions are well-known file formats (core files, tar archives)
-that are known to contain binary data.
-When modifying the file
-.Pa /usr/share/misc/magic
-or the program itself,
-.Em "preserve these keywords" .
-People depend on knowing that all the readable files in a directory
-have the word
-.Dq Li text
-printed.
-Do not do as Berkeley did and change
-.Dq Li "shell commands text"
-to
-.Dq Li "shell script" .
-Note that the file
-.Pa /usr/share/misc/magic
-is built mechanically from a large number of small files in
-the subdirectory
-.Pa Magdir
-in the source distribution of this program.
-.Pp
-The file system tests are based on examining the return from a
-.Xr stat 2
-system call.
-The program checks to see if the file is empty,
-or if it is some sort of special file.
-Any known file types appropriate to the system you are running on
-(sockets, symbolic links, or named pipes (FIFOs) on those systems that
-implement them)
-are intuited if they are defined in
-the system header file
-.In sys/stat.h .
-.Pp
-The magic number tests are used to check for files with data in
-particular fixed formats.
-The canonical example of this is a binary executable (compiled program)
-.Pa a.out
-file, whose format is defined in
-.In a.out.h
-and possibly
-.In exec.h
-in the standard include directory.
-These files have a
-.Sq "magic number"
-stored in a particular place
-near the beginning of the file that tells the
-.Ux
-operating system
-that the file is a binary executable, and which of several types thereof.
-The concept of
-.Sq "magic number"
-has been applied by extension to data files.
-Any file with some invariant identifier at a small fixed
-offset into the file can usually be described in this way.
-The information identifying these files is read from the compiled
-magic file
-.Pa /usr/share/misc/magic.mgc ,
-or
-.Pa /usr/share/misc/magic
-if the compile file does not exist.
-In addition
-.Nm
-will look in
-.Pa $HOME/.magic.mgc ,
-or
-.Pa $HOME/.magic
-for magic entries.
-.Pp
-If a file does not match any of the entries in the magic file,
-it is examined to see if it seems to be a text file.
-ASCII, ISO-8859-x, non-ISO 8-bit extended-ASCII character sets
-(such as those used on Macintosh and IBM PC systems),
-UTF-8-encoded Unicode, UTF-16-encoded Unicode, and EBCDIC
-character sets can be distinguished by the different
-ranges and sequences of bytes that constitute printable text
-in each set.
-If a file passes any of these tests, its character set is reported.
-ASCII, ISO-8859-x, UTF-8, and extended-ASCII files are identified
-as
-.Dq Li text
-because they will be mostly readable on nearly any terminal;
-UTF-16 and EBCDIC are only
-.Dq Li "character data"
-because, while
-they contain text, it is text that will require translation
-before it can be read.
-In addition,
-.Nm
-will attempt to determine other characteristics of text-type files.
-If the lines of a file are terminated by CR, CRLF, or NEL, instead
-of the
-.Ux Ns -standard
-LF, this will be reported.
-Files that contain embedded escape sequences or overstriking
-will also be identified.
-.Pp
-Once
-.Nm
-has determined the character set used in a text-type file,
-it will
-attempt to determine in what language the file is written.
-The language tests look for particular strings (cf
-.Pa names.h )
-that can appear anywhere in the first few blocks of a file.
-For example, the keyword
-.Ic .br
-indicates that the file is most likely a
-.Xr troff 1
-input file, just as the keyword
-.Ic struct
-indicates a C program.
-These tests are less reliable than the previous
-two groups, so they are performed last.
-The language test routines also test for some miscellany
-(such as
-.Xr tar 1
-archives).
-.Pp
-Any file that cannot be identified as having been written
-in any of the character sets listed above is simply said to be
-.Dq Li data .
-.Sh OPTIONS
-.Bl -tag -width indent
-.It Fl b , -brief
-Do not prepend filenames to output lines (brief mode).
-.It Fl c , -checking-printout
-Cause a checking printout of the parsed form of the magic file.
-This is usually used in conjunction with
-.Fl m
-to debug a new magic file before installing it.
-.It Fl C , -compile
-Write a
-.Pa magic.mgc
-output file that contains a pre-parsed version of
-file.
-.It Fl f , -files-from Ar namefile
-Read the names of the files to be examined from
-.Ar namefile
-(one per line)
-before the argument list.
-Either
-.Ar namefile
-or at least one filename argument must be present;
-to test the standard input, use
-.Dq Fl
-as a filename argument.
-.It Fl F , -separator Ar separator
-Use the specified string as the separator between the filename and the
-file result returned.
-Defaults to
-.Ql \&: .
-.It Fl h , -no-dereference
-Causes symlinks not to be followed
-(on systems that support symbolic links).
-This is the default if the
-environment variable
-.Ev POSIXLY_CORRECT
-is not defined.
-.It Fl i , -mime
-Causes the file command to output mime type strings rather than the more
-traditional human readable ones.
-Thus it may say
-.Dq Li "text/plain; charset=us-ascii"
-rather than
-.Dq Li "ASCII text" .
-In order for this option to work, file changes the way
-it handles files recognised by the command itself (such as many of the
-text file types, directories etc), and makes use of an alternative
-.Pa magic
-file.
-(See
-.Sx FILES
-section, below).
-.It Fl k , -keep-going
-Do not stop at the first match, keep going.
-.It Fl L , -dereference
-option causes symlinks to be followed, as the like-named option in
-.Xr ls 1
-(on systems that support symbolic links).
-This is the default if the environment variable
-.Ev POSIXLY_CORRECT
-is defined.
-.It Fl m , -magic-file Ar list
-Specify an alternate list of files containing magic numbers.
-This can be a single file, or a colon-separated list of files.
-If a compiled magic file is found alongside, it will be used instead.
-With the
-.Fl i
-or
-.Fl -mime
-option, the program adds
-.Pa .mime
-to each file name.
-.It Fl n , -no-buffer
-Force stdout to be flushed after checking each file.
-This is only useful if checking a list of files.
-It is intended to be used by programs that want
-filetype output from a pipe.
-.It Fl N , -no-pad
-Do not pad filenames so that they align in the output.
-.It Fl p , -preserve-date
-On systems that support
-.Xr utime 3
-or
-.Xr utimes 2 ,
-attempt to preserve the access time of files analyzed, to pretend that
-.Nm
-never read them.
-.It Fl r , -raw
-Do not translate unprintable characters to \eooo.
-Normally
-.Nm
-translates unprintable characters to their octal representation.
-.It Fl s , -special-files
-Normally,
-.Nm
-only attempts to read and determine the type of argument files which
-.Xr stat 2
-reports are ordinary files.
-This prevents problems, because reading special files may have peculiar
-consequences.
-Specifying the
-.Fl s
-option causes
-.Nm
-to also read argument files which are block or character special files.
-This is useful for determining the file system types of the data in raw
-disk partitions, which are block special files.
-This option also causes
-.Nm
-to disregard the file size as reported by
-.Xr stat 2
-since on some systems it reports a zero size for raw disk partitions.
-.It Fl v , -version
-Print the version of the program and exit.
-.It Fl z , -uncompress
-Try to look inside compressed files.
-.It Fl -help
-Print a help message and exit.
-.El
-.Sh FILES
-.Bl -tag -width ".Pa /usr/share/misc/magic.mime" -compact
-.It Pa /usr/share/misc/magic.mgc
-Default compiled list of magic numbers
-.It Pa /usr/share/misc/magic
-Default list of magic numbers
-.It Pa /usr/share/misc/magic.mime.mgc
-Default compiled list of magic numbers, used to output mime types when
-the
-.Fl i
-option is specified.
-.It Pa /usr/share/misc/magic.mime
-Default list of magic numbers, used to output mime types when the
-.Fl i
-option is specified.
-.El
-.Sh ENVIRONMENT
-The environment variable
-.Ev MAGIC
-can be used to set the default magic number file name.
-If that variable is set, then
-.Nm
-will not attempt to open
-.Pa $HOME/.magic .
-.Nm
-adds
-.Pa .mime
-and/or
-.Pa .mgc
-to the value of this variable as appropriate.
-The environment variable
-.Ev POSIXLY_CORRECT
-controls (on systems that support symbolic links), if
-.Nm
-will attempt to follow symlinks or not.
-If set, then
-.Nm
-follows symlink, otherwise it does not.
-This is also controlled
-by the
-.Fl L
-and
-.Fl h
-options.
-.Sh SEE ALSO
-.Xr hexdump 1 ,
-.Xr od 1 ,
-.Xr strings 1 ,
-.Xr magic 5
-.Sh STANDARDS CONFORMANCE
-This program is believed to exceed the
-.St -svid4
-of FILE(CMD), as near as one can determine from the vague language
-contained therein.
-Its behaviour is mostly compatible with the System V program of the same name.
-This version knows more magic, however, so it will produce
-different (albeit more accurate) output in many cases.
-.Pp
-The one significant difference
-between this version and System V
-is that this version treats any white space
-as a delimiter, so that spaces in pattern strings must be escaped.
-For example,
-.Pp
-.Dl ">10 string language impress\ (imPRESS data)"
-.Pp
-in an existing magic file would have to be changed to
-.Pp
-.Dl ">10 string language\e impress (imPRESS data)"
-.Pp
-In addition, in this version, if a pattern string contains a backslash,
-it must be escaped.
-For example
-.Pp
-.Dl "0 string \ebegindata Andrew Toolkit document"
-.Pp
-in an existing magic file would have to be changed to
-.Pp
-.Dl "0 string \e\ebegindata Andrew Toolkit document"
-.Pp
-SunOS releases 3.2 and later from Sun Microsystems include a
-.Xr file 1
-command derived from the System V one, but with some extensions.
-My version differs from Sun's only in minor ways.
-It includes the extension of the
-.Sq Ic &
-operator, used as,
-for example,
-.Pp
-.Dl ">16 long&0x7fffffff >0 not stripped"
-.Sh MAGIC DIRECTORY
-The magic file entries have been collected from various sources,
-mainly USENET, and contributed by various authors.
-.An Christos Zoulas
-(address below) will collect additional
-or corrected magic file entries.
-A consolidation of magic file entries
-will be distributed periodically.
-.Pp
-The order of entries in the magic file is significant.
-Depending on what system you are using, the order that
-they are put together may be incorrect.
-If your old
-.Nm
-command uses a magic file,
-keep the old magic file around for comparison purposes
-(rename it to
-.Pa /usr/share/misc/magic.orig ) .
-.Sh EXAMPLES
-.Bd -literal
-$ file file.c file /dev/{wd0a,hda}
-file.c: C program text
-file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
- dynamically linked (uses shared libs), stripped
-/dev/wd0a: block special (0/0)
-/dev/hda: block special (3/0)
-$ file -s /dev/wd0{b,d}
-/dev/wd0b: data
-/dev/wd0d: x86 boot sector
-$ file -s /dev/hda{,1,2,3,4,5,6,7,8,9,10}
-/dev/hda: x86 boot sector
-/dev/hda1: Linux/i386 ext2 filesystem
-/dev/hda2: x86 boot sector
-/dev/hda3: x86 boot sector, extended partition table
-/dev/hda4: Linux/i386 ext2 filesystem
-/dev/hda5: Linux/i386 swap file
-/dev/hda6: Linux/i386 swap file
-/dev/hda7: Linux/i386 swap file
-/dev/hda8: Linux/i386 swap file
-/dev/hda9: empty
-/dev/hda10: empty
-
-$ file -i file.c file /dev/{wd0a,hda}
-file.c: text/x-c
-file: application/x-executable, dynamically linked (uses shared libs),
- not stripped
-/dev/hda: application/x-not-regular-file
-/dev/wd0a: application/x-not-regular-file
-.Ed
-.Sh HISTORY
-There has been a
-.Nm
-command in every
-.Ux
-since at least Research Version 4
-(man page dated November, 1973).
-The System V version introduced one significant major change:
-the external list of magic number types.
-This slowed the program down slightly but made it a lot more flexible.
-.Pp
-This program, based on the System V version,
-was written by
-.An Ian Darwin Aq ian@darwinsys.com
-without looking at anybody else's source code.
-.Pp
-.An John Gilmore
-revised the code extensively, making it better than
-the first version.
-.An Geoff Collyer
-found several inadequacies
-and provided some magic file entries.
-Contributions by the
-.Sq Ic &
-operator by
-.An Rob McMahon Aq cudcv@warwick.ac.uk ,
-1989.
-.Pp
-.An Guy Harris Aq guy@netapp.com ,
-made many changes from 1993 to the present.
-.Pp
-Primary development and maintenance from 1990 to the present by
-.An Christos Zoulas Aq christos@astron.com .
-.Pp
-Altered by
-.An Chris Lowth Aq chris@lowth.com ,
-2000:
-Handle the
-.Fl i
-option to output mime type strings and using an alternative
-magic file and internal logic.
-.Pp
-Altered by
-.An Eric Fischer Aq enf@pobox.com ,
-July, 2000,
-to identify character codes and attempt to identify the languages
-of
-.No non- Ns Tn ASCII
-files.
-.Pp
-The list of contributors to the
-.Pa Magdir
-directory (source for the
-.Pa /usr/share/misc/magic
-file) is too long to include here.
-You know who you are; thank you.
-.Sh LEGAL NOTICE
-Copyright (c)
-.An Ian F. Darwin ,
-Toronto, Canada, 1986-1999.
-Covered by the standard Berkeley Software Distribution copyright; see the file
-.Pa LEGAL.NOTICE
-in the source distribution.
-.Pp
-The files
-.Pa tar.h
-and
-.Pa is_tar.c
-were written by
-.An John Gilmore
-from his public-domain
-.Nm tar
-program, and are not covered by the above license.
-.Sh BUGS
-There must be a better way to automate the construction of the
-.Pa Magic
-file from all the glop in
-.Pa Magdir .
-What is it?
-Better yet, the magic file should be compiled into binary (say,
-.Xr ndbm 3
-or, better yet, fixed-length
-.Tn ASCII
-strings for use in heterogenous network environments) for faster startup.
-Then the program would run as fast as the Version 7 program of the same name,
-with the flexibility of the System V version.
-.Pp
-The
-.Nm
-utility uses several algorithms that favor speed over accuracy,
-thus it can be misled about the contents of
-text
-files.
-.Pp
-The support for
-text
-files (primarily for programming languages)
-is simplistic, inefficient and requires recompilation to update.
-.Pp
-There should be an
-.Ic else
-clause to follow a series of continuation lines.
-.Pp
-The magic file and keywords should have regular expression support.
-Their use of
-.Tn "ASCII TAB"
-as a field delimiter is ugly and makes
-it hard to edit the files, but is entrenched.
-.Pp
-It might be advisable to allow upper-case letters in keywords
-for e.g.,
-.Xr troff 1
-commands vs man page macros.
-Regular expression support would make this easy.
-.Pp
-The program does not grok
-.Tn FORTRAN .
-It should be able to figure
-.Tn FORTRAN
-by seeing some keywords which
-appear indented at the start of line.
-Regular expression support would make this easy.
-.Pp
-The list of keywords in
-.Pa ascmagic
-probably belongs in the
-.Pa Magic
-file.
-This could be done by using some keyword like
-.Sq Ic *
-for the offset value.
-.Pp
-Another optimisation would be to sort
-the magic file so that we can just run down all the
-tests for the first byte, first word, first long, etc, once we
-have fetched it.
-Complain about conflicts in the magic file entries.
-Make a rule that the magic entries sort based on file offset rather
-than position within the magic file?
-.Pp
-The program should provide a way to give an estimate
-of
-.Dq how good
-a guess is.
-We end up removing guesses (e.g.\&
-.Dq Li "From "
-as first 5 chars of file) because
-they are not as good as other guesses (e.g.\&
-.Dq Li "Newsgroups:"
-versus
-.Dq Li "Return-Path:" ) .
-Still, if the others do not pan out, it should be possible to use the
-first guess.
-.Pp
-This program is slower than some vendors' file commands.
-The new support for multiple character codes makes it even slower.
-.Pp
-This manual page, and particularly this section, is too long.
-.Sh AVAILABILITY
-You can obtain the original author's latest version by anonymous FTP
-on
-.Pa ftp.astron.com
-in the directory
-.Pa /pub/file/file-X.YZ.tar.gz
diff --git a/usr.bin/file/magic.5 b/usr.bin/file/magic.5
deleted file mode 100644
index ea60544..0000000
--- a/usr.bin/file/magic.5
+++ /dev/null
@@ -1,444 +0,0 @@
-.\"
-.\" $FreeBSD$
-.\"
-.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems.
-.\"
-.Dd February 19, 2006
-.Dt MAGIC 5 "Public Domain"
-.Os
-.Sh NAME
-.Nm magic
-.Nd file command's magic number file
-.Sh DESCRIPTION
-This manual page documents the format of the magic file as
-used by the
-.Nm
-command, version 4.21.
-The
-.Nm file
-command identifies the type of a file using,
-among other tests,
-a test for whether the file begins with a certain
-.Em "magic number" .
-The file
-.Pa /usr/share/misc/magic
-specifies what magic numbers are to be tested for,
-what message to print if a particular magic number is found,
-and additional information to extract from the file.
-.Pp
-Each line of the file specifies a test to be performed.
-A test compares the data starting at a particular offset
-in the file with a 1-byte, 2-byte, or 4-byte numeric value or
-a string.
-If the test succeeds, a message is printed.
-The line consists of the following fields:
-.Bl -tag -width indent
-.It offset
-A number specifying the offset, in bytes, into the file of the data
-which is to be tested.
-.It type
-The type of the data to be tested.
-The possible values are:
-.Bl -tag -width indent
-.It byte
-A one-byte value.
-.It short
-A two-byte value (on most systems) in this machine's native byte order.
-.It long
-A four-byte value (on most systems) in this machine's native byte order.
-.It string
-A string of bytes.
-The string type specification can be optionally followed
-by /[Bbc]*.
-The
-.Dq B
-flag compacts whitespace in the target, which must contain
-at least one whitespace character.
-If the magic has
-.Ar n
-consecutive blanks, the target needs at least
-.Ar n
-consecutive blanks to match.
-The
-.Dq b
-flag treats every blank in the target as an optional blank.
-Finally the
-.Dq c
-flag, specifies case insensitive matching: lowercase characters
-in the magic match both lower and upper case characters in the
-targer, whereas upper case characters in the magic, only much
-uppercase characters in the target.
-.It pstring
-A pascal style string where the first byte is interpreted as the an
-unsigned length.
-The string is not
-.Dv NUL
-terminated.
-.It date
-A four-byte value interpreted as a
-.Ux
-date.
-.It ldate
-A four-byte value interpreted as a
-.Ux Ns -style
-date, but interpreted as
-local time rather than UTC.
-.It beshort
-A two-byte value (on most systems) in big-endian byte order.
-.It belong
-A four-byte value (on most systems) in big-endian byte order.
-.It bedate
-A four-byte value (on most systems) in big-endian byte order,
-interpreted as a
-.Ux
-date.
-.It beldate
-A four-byte value (on most systems) in big-endian byte order,
-interpreted as a
-.Ux Ns -style
-date, but interpreted as local time rather
-than UTC.
-.It bestring16
-A two-byte unicode (UCS16) string in big-endian byte order.
-.It leshort
-A two-byte value (on most systems) in little-endian byte order.
-.It lelong
-A four-byte value (on most systems) in little-endian byte order.
-.It ledate
-A four-byte value (on most systems) in little-endian byte order,
-interpreted as a
-.Ux
-date.
-.It leldate
-A four-byte value (on most systems) in little-endian byte order,
-interpreted as a
-.Ux Ns -style
-date, but interpreted as local time rather
-than UTC.
-.It lestring16
-A two-byte unicode (UCS16) string in little-endian byte order.
-.It melong
-A four-byte value (on most systems) in middle-endian (PDP-11) byte order.
-.It medate
-A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
-interpreted as a
-.Ux
-date.
-.It meldate
-A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
-interpreted as a
-.Ux Ns -style
-date, but interpreted as local time rather
-than UTC.
-.It regex
-A regular expression match in extended
-.Tn POSIX
-regular expression syntax
-(much like egrep).
-The type specification can be optionally followed by
-.Ql /c
-for case-insensitive matches.
-The regular expression is always
-tested against the first
-.Ar N
-lines, where
-.Ar N
-is the given offset, thus it
-is only useful for (single-byte encoded) text.
-.Ql ^
-and
-.Ql $
-will match the beginning and end of individual lines, respectively,
-not beginning and end of file.
-.It search
-A literal string search starting at the given offset.
-It must be followed by
-.Li / Ns Aq Ar number
-which specifies how many matches shall be attempted (the range).
-This is suitable for searching larger binary expressions with variable
-offsets, using
-.Ql \e
-escapes for special characters.
-.El
-.El
-.Pp
-The numeric types may optionally be followed by
-.Em &
-and a numeric value,
-to specify that the value is to be AND'ed with the
-numeric value before any comparisons are done.
-Prepending a
-.Em u
-to the type indicates that ordered comparisons should be unsigned.
-.Bl -tag -width indent
-.It test
-The value to be compared with the value from the file.
-If the type is
-numeric, this value
-is specified in C form; if it is a string, it is specified as a C string
-with the usual escapes permitted (e.g.\& \en for new-line).
-.It ""
-Numeric values
-may be preceded by a character indicating the operation to be performed.
-It may be
-.Em = ,
-to specify that the value from the file must equal the specified value,
-.Em < ,
-to specify that the value from the file must be less than the specified
-value,
-.Em > ,
-to specify that the value from the file must be greater than the specified
-value,
-.Em & ,
-to specify that the value from the file must have set all of the bits
-that are set in the specified value,
-.Em ^ ,
-to specify that the value from the file must have clear any of the bits
-that are set in the specified value, or
-.Em ~ ,
-the value specified after is negated before tested, or
-.Em x ,
-to specify that any value will match.
-If the character is omitted,
-it is assumed to be
-.Em = .
-For all tests except
-.Dq string
-and
-.Dq regex ,
-operation
-.Em !\&
-specifies that the line matches if the test does
-.Em not
-succeed.
-.It ""
-Numeric values are specified in C form; e.g.\&
-.Em 13
-is decimal,
-.Em 013
-is octal, and
-.Em 0x13
-is hexadecimal.
-.It ""
-For string values, the byte string from the
-file must match the specified byte string.
-The operators
-.Em = ,
-.Em <
-and
-.Em >
-(but not
-.Em & )
-can be applied to strings.
-The length used for matching is that of the string argument
-in the magic file.
-This means that a line can match any string, and
-then presumably print that string, by doing
-.Em >\e0
-(because all strings are greater than the null string).
-.It message
-The message to be printed if the comparison succeeds.
-If the string
-contains a
-.Xr printf 3
-format specification, the value from the file (with any specified masking
-performed) is printed using the message as the format string.
-.El
-.Pp
-Some file formats contain additional information which is to be printed
-along with the file type or need additional tests to determine the true
-file type.
-These additional tests are introduced by one or more
-.Em >
-characters preceding the offset.
-The number of
-.Em >
-on the line indicates the level of the test; a line with no
-.Em >
-at the beginning is considered to be at level 0.
-Tests are arranged in a tree-like hierarchy:
-If a the test on a line at level
-.Em n
-succeeds, all following tests at level
-.Em n+1
-are performed, and the messages printed if the tests succeed, until a line
-with level
-.Em n
-(or less) appears.
-For more complex files, one can use empty messages to get just the
-"if/then" effect, in the following way:
-.Bd -literal -offset indent
-0 string MZ
->0x18 leshort <0x40 MS-DOS executable
->0x18 leshort >0x3f extended PC executable (e.g., MS Windows)
-.Ed
-.Pp
-Offsets do not need to be constant, but can also be read from the file
-being examined.
-If the first character following the last
-.Em >
-is a
-.Em \&(
-then the string after the parenthesis is interpreted as an indirect offset.
-That means that the number after the parenthesis is used as an offset in
-the file.
-The value at that offset is read, and is used again as an offset
-in the file.
-Indirect offsets are of the form:
-.Em (x[.[bslBSL]][+\-][y]) .
-The value of
-.Em x
-is used as an offset in the file.
-A byte, short or long is read at that offset
-depending on the
-.Em [bslBSLm]
-type specifier.
-The capitalized types interpret the number as a big endian value, whereas
-a small letter versions interpret the number as a little endian value;
-the
-.Em m
-type interprets the number as a middle endian (PDP-11) value.
-To that number the value of
-.Em y
-is added and the result is used as an offset in the file.
-The default type
-if one is not specified is long.
-.Pp
-That way variable length structures can be examined:
-.Bd -literal -offset indent
-# MS Windows executables are also valid MS-DOS executables
-0 string MZ
->0x18 leshort <0x40 MZ executable (MS-DOS)
-# skip the whole block below if it is not an extended executable
->0x18 leshort >0x3f
->>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
->>(0x3c.l) string LX\e0\e0 LX executable (OS/2)
-.Ed
-.Pp
-This strategy of examining has one drawback: You must make sure that
-you eventually print something, or users may get empty output (like, when
-there is neither PE\e0\e0 nor LE\e0\e0 in the above example).
-.Pp
-If this indirect offset cannot be used as-is, there are simple calculations
-possible: appending
-.Em [+-*/%&|^]<number>
-inside parentheses allows one to modify
-the value read from the file before it is used as an offset:
-.Bd -literal -offset indent
-# MS Windows executables are also valid MS-DOS executables
-0 string MZ
-# sometimes, the value at 0x18 is less that 0x40 but there's still an
-# extended executable, simply appended to the file
->0x18 leshort <0x40
->>(4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)
->>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
-.Ed
-.Pp
-Sometimes you do not know the exact offset as this depends on the length or
-position (when indirection was used before) of preceding fields.
-You can
-specify an offset relative to the end of the last uplevel field using
-.Em &
-as a prefix to the offset:
-.Bd -literal -offset indent
-0 string MZ
->0x18 leshort >0x3f
->>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
-# immediately following the PE signature is the CPU type
->>>&0 leshort 0x14c for Intel 80386
->>>&0 leshort 0x184 for DEC Alpha
-.Ed
-.Pp
-Indirect and relative offsets can be combined:
-.Bd -literal -offset indent
-0 string MZ
->0x18 leshort <0x40
->>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
-# if it's not COFF, go back 512 bytes and add the offset taken
-# from byte 2/3, which is yet another way of finding the start
-# of the extended executable
->>>&(2.s-514) string LE LE executable (MS Windows VxD driver)
-.Ed
-.Pp
-Or the other way around:
-.Bd -literal -offset indent
-0 string MZ
->0x18 leshort >0x3f
->>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
-# at offset 0x80 (-4, since relative offsets start at the end
-# of the uplevel match) inside the LE header, we find the absolute
-# offset to the code area, where we look for a specific signature
->>>(&0x7c.l+0x26) string UPX \eb, UPX compressed
-.Ed
-.Pp
-Or even both!
-.Bd -literal -offset indent
-0 string MZ
->0x18 leshort >0x3f
->>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
-# at offset 0x58 inside the LE header, we find the relative offset
-# to a data area where we look for a specific signature
->>>&(&0x54.l-3) string UNACE \eb, ACE self-extracting archive
-.Ed
-.Pp
-Finally, if you have to deal with offset/length pairs in your file, even the
-second value in a parenthesed expression can be taken from the file itself,
-using another set of parentheses.
-Note that this additional indirect offset
-is always relative to the start of the main indirect offset.
-.Bd -literal -offset indent
-0 string MZ
->0x18 leshort >0x3f
->>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
-# search for the PE section called ".idata"...
->>>&0xf4 search/0x140 .idata
-# ...and go to the end of it, calculated from start+length;
-# these are located 14 and 10 bytes after the section name
->>>>(&0xe.l+(-4)) string PK\e3\e4 \eb, ZIP self-extracting archive
-.Ed
-.Sh BUGS
-The formats
-.Em long ,
-.Em belong ,
-.Em lelong ,
-.Em melong ,
-.Em short ,
-.Em beshort ,
-.Em leshort ,
-.Em date ,
-.Em bedate ,
-.Em medate ,
-.Em ledate ,
-.Em beldate ,
-.Em leldate ,
-and
-.Em meldate
-are system-dependent; perhaps they should be specified as a number
-of bytes (2B, 4B, etc),
-since the files being recognized typically come from
-a system on which the lengths are invariant.
-.Pp
-If
-.Pa /usr/share/misc/magic
-is newer than
-.Pa /usr/share/misc/magic.mgc
-it is not used.
-Use the command:
-.Dq Li "cd /usr/share/misc && file -C -m magic"
-to rebuild.
-.Sh SEE ALSO
-.Xr file 1
-.\"
-.\" From: guy@sun.uucp (Guy Harris)
-.\" Newsgroups: net.bugs.usg
-.\" Subject: /etc/magic's format isn't well documented
-.\" Message-ID: <2752@sun.uucp>
-.\" Date: 3 Sep 85 08:19:07 GMT
-.\" Organization: Sun Microsystems, Inc.
-.\" Lines: 136
-.\"
-.\" Here's a manual page for the format accepted by the "file" made by adding
-.\" the changes I posted to the S5R2 version.
-.\"
-.\" Modified for Ian Darwin's version of the file command.
-.\" @(#)$Id: magic.man,v 1.30 2006/02/19 18:16:03 christos Exp $
OpenPOWER on IntegriCloud