diff options
Diffstat (limited to 'contrib/file/Magdir/linux')
| -rw-r--r-- | contrib/file/Magdir/linux | 101 |
1 files changed, 101 insertions, 0 deletions
diff --git a/contrib/file/Magdir/linux b/contrib/file/Magdir/linux new file mode 100644 index 0000000..295edd9 --- /dev/null +++ b/contrib/file/Magdir/linux @@ -0,0 +1,101 @@ + +#------------------------------------------------------------------------------ +# linux: file(1) magic for Linux files +# +# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> +# The following basic Linux magic is useful for reference, but using +# "long" magic is a better practice in order to avoid collisions. +# +# 2 leshort 100 Linux/i386 +# >0 leshort 0407 impure executable (OMAGIC) +# >0 leshort 0410 pure executable (NMAGIC) +# >0 leshort 0413 demand-paged executable (ZMAGIC) +# >0 leshort 0314 demand-paged executable (QMAGIC) +# +0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) +>16 lelong 0 \b, stripped +0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) +>16 lelong 0 \b, stripped +0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) +>16 lelong 0 \b, stripped +0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) +>16 lelong 0 \b, stripped +# +0 string \007\001\000 Linux/i386 object file +>20 lelong >0x1020 \b, DLL library +# Linux-8086 stuff: +0 string \01\03\020\04 Linux-8086 impure executable +>28 long !0 not stripped +0 string \01\03\040\04 Linux-8086 executable +>28 long !0 not stripped +# +0 string \243\206\001\0 Linux-8086 object file +# +0 string \01\03\020\20 Minix-386 impure executable +>28 long !0 not stripped +0 string \01\03\040\20 Minix-386 executable +>28 long !0 not stripped +# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> +216 lelong 0421 Linux/i386 core file +>220 string >\0 of '%s' +>200 lelong >0 (signal %d) +# +# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> +# this can be overridden by the DOS executable (COM) entry +2 string LILO Linux/i386 LILO boot/chain loader +# +# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de> +0 string 0.9 +>8 byte 0x0a old Debian Binary Package +>>3 byte >0 \b, created by dpkg 0.9%c +>>4 byte >0 pl%c +# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> +0 leshort 0x0436 Linux/i386 PC Screen Font data, +>2 byte 0 256 characters, no directory, +>2 byte 1 512 characters, no directory, +>2 byte 2 256 characters, Unicode directory, +>2 byte 3 512 characters, Unicode directory, +>3 byte >0 8x%d +# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> +4086 string SWAP-SPACE Linux/i386 swap file +# ECOFF magic for OSF/1 and Linux (only tested under Linux though) +# +# from Erik Troan (ewt@redhat.com) examining od dumps, so this +# could be wrong +# updated by David Mosberger (davidm@azstarnet.com) based on +# GNU BFD and MIPS info found below. +# +0 leshort 0x0183 ECOFF alpha +>24 leshort 0407 executable +>24 leshort 0410 pure +>24 leshort 0413 demand paged +>8 long >0 not stripped +>8 long 0 stripped +>23 leshort >0 - version %ld. +# +# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> +# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> +# and Nicolás Lichtmaier <nick@debian.org> +# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 +514 string HdrS Linux kernel +>518 leshort >0 +>>529 byte 0 zImage data, +>>529 byte 1 bzImage data, +>0x048c byte 0x31 +>>0x048c string x version %s +>0x0493 byte 0x31 +>>0x0493 string x version %s +>0x048c byte 0x32 +>>0x048c string x version %s +>0x0493 byte 0x32 +>>0x0493 string x version %s +>0x04df byte 0x32 +>>0x04df string x version %s +>0x04fb byte 0x32 +>>0x04fb string x version %s +# This also matches new kernels, which were caught above by "HdrS". +0 belong 0xb8c0078e Linux kernel +>0x1e3 string Loading version 1.3.79 or older +>0x1e9 string Loading from prehistoric times +# LSM entries - Nicolás Lichtmaier <nick@feedback.net.ar> +0 string Begin3 Linux Software Map entry text |
