diff options
Diffstat (limited to 'Magdir/msdos')
| -rw-r--r-- | Magdir/msdos | 335 |
1 files changed, 185 insertions, 150 deletions
diff --git a/Magdir/msdos b/Magdir/msdos index 10ce8ae..cdd7c93 100644 --- a/Magdir/msdos +++ b/Magdir/msdos @@ -7,9 +7,13 @@ # updated by Joerg Jenderek 0 string @ >1 string/cB \ echo\ off MS-DOS batch file text +!:mime text/x-msdos-batch >1 string/cB echo\ off MS-DOS batch file text +!:mime text/x-msdos-batch >1 string/cB rem\ MS-DOS batch file text +!:mime text/x-msdos-batch >1 string/cB set\ MS-DOS batch file text +!:mime text/x-msdos-batch # OS/2 batch files are REXX. the second regex is a bit generic, oh well @@ -39,13 +43,15 @@ # # Required OS version and subsystem version were 4.0 on some NT 3.51 # executables built with Visual C++ 4.0, so it's not clear that -# they're interesting. The user version was 0.0, but there's +# they're interesting. The user version was 0.0, but there's # probably some linker directive to set it. The linker version was # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). # # many of the compressed formats were extraced from IDARC 1.23 source code # -0 string MZ MS-DOS executable +0 string MZ +!:mime application/x-dosexec +>0x18 leshort <0x40 MS-DOS executable >0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows >>&18 leshort&0x2000 >0 (DLL) >>&88 leshort 0 (unknown subsystem) @@ -64,29 +70,42 @@ >>&18 leshort&0x1000 >0 system file >>&0xf4 search/0x140 \x0\x40\x1\x0 >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive +>30 string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive +!:mime application/zip +# Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect. +>30 string PKLITE\ Copr. Self-extracting PKZIP archive +!:mime application/zip >0x18 leshort >0x3f ->>(0x3c.l) string PE\0\0 PE +>>(0x3c.l) string PE\0\0 PE +>>>(0x3c.l+25) byte 1 \b32 executable +>>>(0x3c.l+25) byte 2 \b32+ executable # hooray, there's a DOS extender using the PE format, with a valid PE # executable inside (which just prints a message and exits if run in win) ->>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender ->>>(8.s*16) string !32STUB for MS Windows ->>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) ->>>>(0x3c.l+92) leshort 0 (unknown subsystem) ->>>>(0x3c.l+92) leshort 1 (native) ->>>>(0x3c.l+92) leshort 2 (GUI) ->>>>(0x3c.l+92) leshort 3 (console) ->>>>(0x3c.l+92) leshort 7 (POSIX) ->>>>(0x3c.l+4) leshort 0x0 unknown processor ->>>>(0x3c.l+4) leshort 0x14c Intel 80386 ->>>>(0x3c.l+4) leshort 0x166 MIPS R4000 ->>>>(0x3c.l+4) leshort 0x184 Alpha ->>>>(0x3c.l+4) leshort 0x268 Motorola 68000 ->>>>(0x3c.l+4) leshort 0x1f0 PowerPC ->>>>(0x3c.l+4) leshort 0x290 PA-RISC ->>>>(0x3c.l+22) leshort&0x0100 >0 32-bit ->>>>(0x3c.l+22) leshort&0x1000 >0 system file ->>>>(0x3c.l+232) lelong >0 Mono/.Net assembly +>>>(0x3c.l+92) leshort <10 +>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender +>>>>(8.s*16) string !32STUB for MS Windows +>>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) +>>>>>(0x3c.l+92) leshort 0 (unknown subsystem) +>>>>>(0x3c.l+92) leshort 1 (native) +>>>>>(0x3c.l+92) leshort 2 (GUI) +>>>>>(0x3c.l+92) leshort 3 (console) +>>>>>(0x3c.l+92) leshort 7 (POSIX) +>>>(0x3c.l+92) leshort 10 (EFI application) +>>>(0x3c.l+92) leshort 11 (EFI boot service driver) +>>>(0x3c.l+92) leshort 12 (EFI runtime driver) +>>>(0x3c.l+92) leshort 13 (XBOX) +>>>(0x3c.l+4) leshort 0x0 unknown processor +>>>(0x3c.l+4) leshort 0x14c Intel 80386 +>>>(0x3c.l+4) leshort 0x166 MIPS R4000 +>>>(0x3c.l+4) leshort 0x184 Alpha +>>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>>(0x3c.l+4) leshort 0x1f0 PowerPC +>>>(0x3c.l+4) leshort 0x290 PA-RISC +>>>(0x3c.l+4) leshort 0x200 Intel Itanium +>>>(0x3c.l+22) leshort&0x0100 >0 32-bit +>>>(0x3c.l+22) leshort&0x1000 >0 system file +>>>(0x3c.l+232) lelong >0 Mono/.Net assembly >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed @@ -115,6 +134,8 @@ >>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive >>>>0x30 string Inno \b, InnoSetup self-extracting archive +>>(0x3c.l) string !PE\0\0 MS-DOS executable + >>(0x3c.l) string NE \b, NE >>>(0x3c.l+0x36) byte 0 (unknown OS) >>>(0x3c.l+0x36) byte 1 for OS/2 1.x @@ -176,7 +197,7 @@ >>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS # header data too small for extended executable >2 long !0 ->>0x18 leshort <0x40 +>>0x18 leshort <0x40 >>>(4.s*512) leshort !0x014c >>>>&(2.s-514) string !LE @@ -206,29 +227,31 @@ # .EXE formats (Greg Roelofs, newt@uchicago.edu) # ->0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed +>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed >0xe7 string LH/2\ Self-Extract \b, %s >0x1c string diet \b, diet compressed >0x1c string LZ09 \b, LZEXE v0.90 compressed >0x1c string LZ91 \b, LZEXE v0.91 compressed ->0x1c string tz \b, TinyProg compressed +>0x1c string tz \b, TinyProg compressed >0x1e string PKLITE \b, %s compressed ->0x64 string W\ Collis\0\0 \b, Compack compressed +>0x64 string W\ Collis\0\0 \b, Compack compressed >0x24 string LHa's\ SFX \b, LHa self-extracting archive +!:mime application/x-lha >0x24 string LHA's\ SFX \b, LHa self-extracting archive ->0x24 string \ $ARX \b, ARX self-extracting archive ->0x24 string \ $LHarc \b, LHarc self-extracting archive ->0x20 string SFX\ by\ LARC \b, LARC self-extracting archive +!:mime application/x-lha +>0x24 string \ $ARX \b, ARX self-extracting archive +>0x24 string \ $LHarc \b, LHarc self-extracting archive +>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive >1638 string -lh5- \b, LHa self-extracting archive v2.13S ->0x17888 string Rar! \b, RAR self-extracting archive ->0x40 string aPKG \b, aPackage self-extracting archive +>0x17888 string Rar! \b, RAR self-extracting archive +>0x40 string aPKG \b, aPackage self-extracting archive ->32 string AIN ->>35 string 2 \b, AIN 2.x compressed ->>35 string <2 \b, AIN 1.x compressed ->>35 string >2 \b, AIN 1.x compressed ->28 string UC2X \b, UCEXE compressed ->28 string WWP\ \b, WWPACK compressed +>32 string AIN +>>35 string 2 \b, AIN 2.x compressed +>>35 string <2 \b, AIN 1.x compressed +>>35 string >2 \b, AIN 1.x compressed +>28 string UC2X \b, UCEXE compressed +>28 string WWP\ \b, WWPACK compressed # skip to the end of the exe >(4.s*512) long x @@ -255,15 +278,15 @@ # TELVOX Teleinformatica CODEC self-extractor for OS/2: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 ->>49824 leshort =1 \b, 1 file ->>49824 leshort >1 \b, %u files +>>49824 leshort =1 \b, 1 file +>>49824 leshort >1 \b, %u files # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least # two dozen different one-byte "magics". -0 byte 0xe9 DOS executable (COM) ->0x1FE leshort 0xAA55 \b, boot code +#0 byte 0xe9 DOS executable (COM) +#>0x1FE leshort 0xAA55 \b, boot code >6 string SFX\ of\ LHarc (%s) 0 belong 0xffffffff DOS executable (device driver) #CMD640X2.SYS @@ -286,25 +309,25 @@ >>77 string >\x40 >>>77 string <\x5B >>>>77 string x \b, name: %.8s -0 byte 0x8c DOS executable (COM) +#0 byte 0x8c DOS executable (COM) # 0xeb conflicts with "sequent" magic -0 byte 0xeb DOS executable (COM) ->0x1FE leshort 0xAA55 \b, boot code ->85 string UPX \b, UPX compressed ->4 string \ $ARX \b, ARX self-extracting archive ->4 string \ $LHarc \b, LHarc self-extracting archive ->0x20e string SFX\ by\ LARC \b, LARC self-extracting archive -0 byte 0xb8 COM executable +#0 byte 0xeb DOS executable (COM) +#>0x1FE leshort 0xAA55 \b, boot code +#>85 string UPX \b, UPX compressed +#>4 string \ $ARX \b, ARX self-extracting archive +#>4 string \ $LHarc \b, LHarc self-extracting archive +#>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive +#0 byte 0xb8 COM executable # modified by Joerg Jenderek ->1 lelong !0x21cd4cff for DOS +>1 lelong !0x21cd4cff for DOS # http://syslinux.zytor.com/comboot.php # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode # start with assembler instructions mov eax,21cd4cffh ->1 lelong 0x21cd4cff (32-bit COMBOOT) +>1 lelong 0x21cd4cff (32-bit COMBOOT) 0 string \x81\xfc >4 string \x77\x02\xcd\x20\xb9 ->>36 string UPX! FREE-DOS executable (COM), UPX compressed -252 string Must\ have\ DOS\ version DR-DOS executable (COM) +>>36 string UPX! FREE-DOS executable (COM), UPX compressed +252 string Must\ have\ DOS\ version DR-DOS executable (COM) # GRR search is not working #2 search/28 \xcd\x21 COM executable for MS-DOS #WHICHFAT.cOM @@ -341,14 +364,6 @@ #0 byte 0xf0 MS-DOS program library data # -# -# Windows Registry files. -# updated by Joerg Jenderek -0 string regf Windows NT/XP registry file -0 string CREG Windows 95/98/ME registry file -0 string SHCC3 Windows 3.1 registry file - - # AAF files: # <stuartc@rd.bbc.co.uk> Stuart Cunningham 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage @@ -360,54 +375,73 @@ # Popular applications 2080 string Microsoft\ Word\ 6.0\ Document %s +!:mime application/msword 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data +!:mime application/msword # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 2112 string MSWordDoc Microsoft Word document data +!:mime application/msword # 0 belong 0x31be0000 Microsoft Word Document +!:mime application/msword # -0 string PO^Q` Microsoft Word 6.0 Document +0 string PO^Q` Microsoft Word 6.0 Document +!:mime application/msword # 0 string \376\067\0\043 Microsoft Office Document +!:mime application/msword 0 string \333\245-\0\0\0 Microsoft Office Document +!:mime application/msword +512 string \354\245\301 Microsoft Word Document +!:mime application/msword # 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s +!:mime application/vnd.ms-excel + 2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s +!:mime application/vnd.ms-excel # # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 2114 string Biff5 Microsoft Excel 5.0 Worksheet +!:mime application/vnd.ms-excel # Italian MS-Excel 2121 string Biff5 Microsoft Excel 5.0 Worksheet +!:mime application/vnd.ms-excel 0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet +!:mime application/vnd.ms-excel # 0 belong 0x00001a00 Lotus 1-2-3 +!:mime application/x-123 >4 belong 0x00100400 wk3 document data >4 belong 0x02100400 wk4 document data >4 belong 0x07800100 fm3 or fmb document data >4 belong 0x07800000 fm3 or fmb document data # -0 belong 0x00000200 Lotus 1-2-3 +0 belong 0x00000200 Lotus 1-2-3 +!:mime application/x-123 >4 belong 0x06040600 wk1 document data >4 belong 0x06800200 fmt document data +0 string WordPro\0 Lotus WordPro +!:mime application/vnd.lotus-wordpro +0 string WordPro\r\373 Lotus WordPro +!:mime application/vnd.lotus-wordpro -# Help files -0 string ?_\3\0 MS Windows Help Data -# DeIsL1.isu what this is I don't know -0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is +# Summary: Script used by InstallScield to uninstall applications +# Extension: .isu +# Submitted by: unknown +# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) +0 string \x71\xa8\x00\x00\x01\x02 +>12 string Stirling\ Technologies, InstallShield Uninstall Script # Winamp .avs -#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player +#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 0 string Nullsoft\ AVS\ Preset\ Winamp plug in -# Hyper terminal: -0 string HyperTerminal\ hyperterm ->15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal - # Windows Metafont .WMF -0 string \327\315\306\232 ms-windows metafont .wmf -0 string \002\000\011\000 ms-windows metafont .wmf -0 string \001\000\011\000 ms-windows metafont .wmf +0 string \327\315\306\232 ms-windows metafont .wmf +0 string \002\000\011\000 ms-windows metafont .wmf +0 string \001\000\011\000 ms-windows metafont .wmf #tz3 files whatever that is (MS Works files) 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file @@ -427,21 +461,12 @@ 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file -# Windows help file FTG FTS -0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache - -# grp old windows 3.1 group files -0 string \120\115\103\103 MS Windows 3.1 group files - - -# lnk files windows symlinks -0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut - #ico files 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows # Windows icons (Ian Springer <ips@fpk.hp.com>) 0 string \000\000\001\000 MS Windows icon resource +!:mime image/x-ico >4 byte 1 - 1 icon >4 byte >1 - %d icons >>6 byte >0 \b, %dx @@ -462,18 +487,27 @@ # then there is a copyright notice -# recycled/info the windows trash bin index -9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info +# Windows Recycle Bin record file (named INFO2) +# By Abel Cheung (abelcheung AT gmail dot com) +# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes +# Since Vista uses another structure, INFO2 structure probably won't change +# anymore. Detailed analysis in: +# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf +0 lelong 0x00000004 +>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) + +0 lelong 0x00000005 +>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) ##### put in Either Magic/font or Magic/news -# Acroread or something files wrongly identified as G3 .pfm +# Acroread or something files wrongly identified as G3 .pfm # these have the form \000 \001 any? \002 \000 \000 # or \000 \001 any? \022 \000 \000 -#0 string \000\001 pfm? -#>3 string \022\000\000Copyright\ yes -#>3 string \002\000\000Copyright\ yes -#>3 string >\0 oops, not a font file. Cancel that. +#0 string \000\001 pfm? +#>3 string \022\000\000Copyright\ yes +#>3 string \002\000\000Copyright\ yes +#>3 string >\0 oops, not a font file. Cancel that. #it clashes with ttf files so put it lower down. # From Doug Lee via a FreeBSD pr @@ -516,10 +550,12 @@ >>>>24 long >0 length %d # TNEF magic From "Joomy" <joomy@se-ed.net> +# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 0 leshort 0x223e9f78 TNEF +!:mime application/vnd.ms-tnef # HtmlHelp files (.chm) -0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data +0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data # GFA-BASIC (Wolfram Kleff) 2 string GFA-BASIC3 GFA-BASIC 3 data @@ -534,8 +570,8 @@ # InstallShield Cabinet files 0 string ISc( InstallShield Cabinet archive data ->5 byte&0xf0 =0x60 version 6, ->5 byte&0xf0 !0x60 version 4/5, +>5 byte&0xf0 =0x60 version 6, +>5 byte&0xf0 !0x60 version 4/5, >(12.l+40) lelong x %u files # Windows CE package files @@ -549,57 +585,27 @@ >20 lelong 10004 \b, Hitachi SH3E >20 lelong 10005 \b, Hitachi SH4 >20 lelong 70001 \b, ARM 7TDMI ->52 leshort 1 \b, 1 file ->52 leshort >1 \b, %u files ->56 leshort 1 \b, 1 registry entry ->56 leshort >1 \b, %u registry entries - -# Outlook Personal Folders -0 lelong 0x4E444221 Microsoft Outlook binary email folder ->10 leshort 0x0e (Outlook <=2002) ->10 leshort 0x17 (Outlook >=2003) - - -# From: Dirk Jagdmann <doj@cubic.org> -0 lelong 0x00035f3f Windows 3.x help file - -# Christophe Monniez -0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File ->20 string >\0 Version %s -0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File ->4 byte =0xC5 Message database ->4 byte =0xC6 Folder database ->4 byte =0xC7 Accounts informations ->4 byte =0x30 Offline database +>52 leshort 1 \b, 1 file +>52 leshort >1 \b, %u files +>56 leshort 1 \b, 1 registry entry +>56 leshort >1 \b, %u registry entries # Windows Enhanced Metafile (EMF) # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp -# for further information. Note that "0 lelong 1" should be true i.e. -# the first double word in the file should be 1. With the extended -# syntax available by some file commands you could write: -# 0 lelong 1 -# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data -40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data ->44 ulelong x version 0x%x. -# If the description has a length greater than zero, it exists and is -# found at offset (*64). ->64 ulelong >0 Description available at offset 0x%x ->>60 ulelong >0 (length 0x%x) -# Note it would be better to print out the description, which is found -# as below. Unfortunately the following only prints out the first couple -# of characters instead of all the "description length" -# number of characters -- indicated by the ulelong at offset 60. ->>(64.l) lestring16 >0 Description: %15.15s +# for further information. +0 ulelong 1 +>40 string \ EMF Windows Enhanced Metafile (EMF) image data +>>44 ulelong x version 0x%x # From: Alex Beregszaszi <alex@fsn.hu> 0 string COWD VMWare3 ->4 byte 3 disk image +>4 byte 3 disk image >>32 lelong x (%d/ >>36 lelong x \b%d/ >>40 lelong x \b%d) ->4 byte 2 undoable disk image ->>32 string >\0 (%s) +>4 byte 2 undoable disk image +>>32 string >\0 (%s) 0 string VMDK VMware4 disk image 0 string KDMV VMware4 disk image @@ -609,39 +615,39 @@ # Lines written by Friedrich Schwittay (f.schwittay@yousable.de) # Made by reading sources and doing trial and error on existing # qcow files -0 string QFI Qemu Image, Format: Qcow +0 string QFI Qemu Image, Format: Qcow # Uncomment the following line to display Magic (only used for debugging # this magic number) -#>0 string x , Magic: %s +#>0 string x , Magic: %s # There are currently 2 Versions: "1" and "2" # I do not use Version 2 and therefor branch here # but can assure: it works (tested on both versions) # Also my Qemu 0.9.0 which uses this Version 2 refuses # to start in its bios ->0x04 belong 2 , Version: 2 ->0x04 belong 1 , Version: 1 +>0x04 belong 2 , Version: 2 +>0x04 belong 1 , Version: 1 # Using the existence of the Backing File Offset to Branch or not # to read Backing File Information ->>0xc belong >0 , Backing File( Offset: %d ->>>(0xc.L) string >\0 , Path: %s +>>0xc belong >0 , Backing File( Offset: %lu +>>>(0xc.L) string >\0 , Path: %s -# Didnt got the Trick here how qemu stores the "Size" at this Position +# Didn't get the trick here how qemu stores the "Size" at this Position # There is actually something stored but nothing makes sense # The header in the sources talks about it -#>>>16 lelong x , Size: %d +#>>>16 lelong x , Size: %lu # Modification time of the Backing File -# Really usefull if you want to know if your backing +# Really useful if you want to know if your backing # file is still usable together with this image ->>>20 bedate x , Mtime: %s ) +>>>20 bedate x , Mtime: %s ) -# Dont know how to calculate in Magicfiles +# Don't know how to calculate in Magicfiles # Also: this Information is not reliably -# stored in image-files ->>24 lelong x , Disk Size could be: %d * 256 bytes +# stored in image-files +>>24 lelong x , Disk Size could be: %d * 256 bytes 0 string QEVM QEMU's suspend to disk image @@ -652,9 +658,21 @@ 0 lelong 0x02468ace Bochs Sparse disk image # from http://filext.com by Derek M Jones <derek@knosof.co.uk> -# False positive with PPT -#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer +# False positive with PPT (also currently this string is too long) +#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document +#>48 byte 0x1B Excel Document +#!:mime application/vnd.ms-excel +>546 string bjbj Microsoft Word Document +!:mime application/msword +>546 string jbjb Microsoft Word Document +!:mime application/msword + +0 string \224\246\056 Microsoft Word Document +!:mime application/msword + +512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document +!:mime application/msword # From: "Nelson A. de Oliveira" <naoliv@gmail.com> # Magic type for Dell's BIOS .hdr files @@ -663,3 +681,20 @@ >23 string Dell %s system BIOS >48 string x version %.3s +# Type: Microsoft DirectDraw Surface +# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp +# From: Morten Hustveit <morten@debian.org> +0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), +>16 lelong >0 %hd x +>12 lelong >0 %hd, +>84 string x %.4s + +# Type: Microsoft Document Imaging Format (.mdi) +# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format +# From: Daniele Sempione <scrows@oziosi.org> +0 short 0x5045 Microsoft Document Imaging Format + +# MS eBook format (.lit) +0 string ITOLITLS Microsoft Reader eBook Data +>8 lelong x \b, version %u +!:mime application/x-ms-reader |
