diff options
Diffstat (limited to 'contrib/file/magic')
25 files changed, 230 insertions, 131 deletions
diff --git a/contrib/file/magic/Magdir/adventure b/contrib/file/magic/Magdir/adventure index 37b4cb3..94835e1 100644 --- a/contrib/file/magic/Magdir/adventure +++ b/contrib/file/magic/Magdir/adventure @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $ +# $File: adventure,v 1.15 2015/09/07 10:03:21 christos Exp $ # adventure: file(1) magic for Adventure game files # # from Allen Garvin <earendil@faeryland.tamu-commerce.edu> @@ -17,6 +17,7 @@ # Infocom (see z-machine) #------------------------------------------------------------------------------ # Z-machine: file(1) magic for Z-machine binaries. +# Sanity checks by David Griffith <dave@661.org> # Updated by Adam Buchbinder <adam.buchbinder@gmail.com> # #http://www.gnelson.demon.co.uk/zspec/sect11.html @@ -41,10 +42,12 @@ >>>>>>>2 ubeshort < 10 Release %d / >>>>>>>>18 string >\0 Serial %.6s) !:strength + 40 +!:mime application/x-zmachine #------------------------------------------------------------------------------ # Glulx: file(1) magic for Glulx binaries. # +# David Griffith <dave@661.org> # I haven't checked for false matches yet. # 0 string Glul Glulx game data @@ -52,7 +55,7 @@ >>6 byte x \b.%d >>8 byte x \b.%d) >36 string Info Compiled by Inform - +!:mime application/x-glulx # For Quetzal and blorb magic see iff @@ -66,11 +69,13 @@ >9 belong !0x0A0D1A00 game data, CORRUPTED >9 belong 0x0A0D1A00 >>13 string >\0 %s game data +!:mime application/x-tads # Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 0 string TADS2\ rsc TADS >9 belong !0x0A0D1A00 resource data, CORRUPTED >9 belong 0x0A0D1A00 >>13 string >\0 %s resource data +!:mime application/x-tads # Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian # 2-byte length N, the N-char name of the game file *without* a NUL (darn!), # "TADS2 save\n\r\032\0" and the interpreter version. @@ -78,12 +83,14 @@ >12 belong !0x0A0D1A00 saved game data, CORRUPTED >12 belong 0x0A0D1A00 >>(16.s+32) string >\0 %s saved game data +!:mime application/x-tads # Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter # version. 0 string TADS2\ save TADS >10 belong !0x0A0D1A00 saved game data, CORRUPTED >10 belong 0x0A0D1A00 >>14 string >\0 %s saved game data +!:mime application/x-tads # TADS (Text Adventure Development System) version 3 # Game files start with "T3-image\015\012\032" @@ -97,14 +104,18 @@ >>11 byte x \b%c >>12 byte x \b%c >>13 byte x \b%c) +!:mime application/x-t3vm-image +# edited by David Griffith <dave@661.org> # Danny Milosavljevic <danny.milo@gmx.net> -# this are adrift (adventure game standard) game files, extension .taf -# depending on version magic continues with 0x93453E6139FA (V 4.0) -# 0x9445376139FA (V 3.90) -# 0x9445366139FA (V 3.80) -# this is from source (http://www.adrift.org.uk/) and I have some taf -# files, and checked them. -#0 belong 0x3C423FC9 -#>4 belong 0x6A87C2CF Adrift game file -#!:mime application/x-adrift +# These are ADRIFT (adventure game standard) game files, extension .taf +# Checked from source at (http://www.adrift.co/) and various taf files +# found at the Interactive Fiction Archive (http://ifarchive.org/) +0 belong 0x3C423FC9 +>4 belong 0x6A87C2CF Adrift game file version +>>8 belong 0x94453661 3.80 +>>8 belong 0x94453761 3.90 +>>8 belong 0x93453E61 4.0 +>>8 belong 0x92453E61 5.0 +>>8 default x unknown +!:mime application/x-adrift diff --git a/contrib/file/magic/Magdir/apple b/contrib/file/magic/Magdir/apple index dcfa878..1418688 100644 --- a/contrib/file/magic/Magdir/apple +++ b/contrib/file/magic/Magdir/apple @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: apple,v 1.30 2015/04/13 13:09:06 christos Exp $ +# $File: apple,v 1.31 2015/08/29 07:10:35 christos Exp $ # apple: file(1) magic for Apple file formats # 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text @@ -265,14 +265,14 @@ >>20 beshort x \b, descriptors %d # Assume 8 partitions each at a multiple of the sector size. # We could glean this from the partition descriptors, but they are empty!?!? ->>(2.S*1) indirect \b, contains[@0x%x]: ->>(2.S*2) indirect \b, contains[@0x%x]: ->>(2.S*3) indirect \b, contains[@0x%x]: ->>(2.S*4) indirect \b, contains[@0x%x]: ->>(2.S*5) indirect \b, contains[@0x%x]: ->>(2.S*6) indirect \b, contains[@0x%x]: ->>(2.S*7) indirect \b, contains[@0x%x]: ->>(2.S*8) indirect \b, contains[@0x%x]: +>>(2.S*1) indirect x \b, contains[@0x%x]: +>>(2.S*2) indirect x \b, contains[@0x%x]: +>>(2.S*3) indirect x \b, contains[@0x%x]: +>>(2.S*4) indirect x \b, contains[@0x%x]: +>>(2.S*5) indirect x \b, contains[@0x%x]: +>>(2.S*6) indirect x \b, contains[@0x%x]: +>>(2.S*7) indirect x \b, contains[@0x%x]: +>>(2.S*8) indirect x \b, contains[@0x%x]: # Yes, the 3rd and 4th bytes are reserved, but we use them to make the # magic stronger. diff --git a/contrib/file/magic/Magdir/archive b/contrib/file/magic/Magdir/archive index 30cced0..f115e95 100644 --- a/contrib/file/magic/Magdir/archive +++ b/contrib/file/magic/Magdir/archive @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: archive,v 1.90 2015/04/24 15:44:12 christos Exp $ +# $File: archive,v 1.91 2015/09/16 13:49:33 christos Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # @@ -434,16 +434,34 @@ # AIN 0 string \x33\x18 AIN archive data 0 string \x33\x17 AIN archive data -# XPA32 -0 string xpa\0\1 XPA32 archive data +# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 # SZip (TODO: doesn't catch all versions) 0 string SZ\x0a\4 SZip archive data # XPack DiskImage -0 string jm XPack DiskImage archive data +# *.XDI updated by Joerg Jenderek Sep 2015 +# ftp://ftp.sac.sk/pub/sac/pack/0index.txt +# GRR: this test is still too general as it catches also text files starting with jm +0 string jm +# only found examples with this additional characteristic 2 bytes +>2 string \x2\x4 Xpack DiskImage archive data +#!:ext xdi # XPack Data -0 string xpa XPack archive data +# *.xpa updated by Joerg Jenderek Sep 2015 +# ftp://ftp.elf.stuba.sk/pub/pc/pack/ +0 string xpa XPA +!:ext xpa +# XPA32 +# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip +# created by XPA32.EXE version 1.0.2 for Windows +>0 string xpa\0\1 \b32 archive data +# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 +>3 ubeshort !0x0001 \bck archive data # XPack Single Data -0 string \xc3\x8d\ jm XPack single archive data +# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 +# letter 'I'+ acute accent is equivalent to \xcd +0 string \xcd\ jm Xpack single archive data +#!:mime application/x-xpa-compressed +!:ext xpa # TODO: missing due to unknown magic/magic at end of file: #DWC diff --git a/contrib/file/magic/Magdir/c-lang b/contrib/file/magic/Magdir/c-lang index 39889ec..0b17611 100644 --- a/contrib/file/magic/Magdir/c-lang +++ b/contrib/file/magic/Magdir/c-lang @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: c-lang,v 1.19 2014/06/03 19:17:27 christos Exp $ +# $File: c-lang,v 1.20 2015/07/27 14:33:10 christos Exp $ # c-lang: file(1) magic for C and related languages programs # @@ -29,7 +29,7 @@ # C++ # The strength of these rules is increased so they beat the C rules above -0 regex \^template[\ \t\n]+ C++ source text +0 regex \^template[\ \t]+<.*>[\ \t\n]+ C++ source text !:strength + 5 !:mime text/x-c++ 0 regex \^virtual[\ \t\n]+ C++ source text diff --git a/contrib/file/magic/Magdir/c64 b/contrib/file/magic/Magdir/c64 index eea3e31..eb79ac3 100644 --- a/contrib/file/magic/Magdir/c64 +++ b/contrib/file/magic/Magdir/c64 @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: c64,v 1.5 2009/09/19 16:28:08 christos Exp $ +# $File: c64,v 1.6 2015/08/24 05:17:42 christos Exp $ # c64: file(1) magic for various commodore 64 related files # # From: Dirk Jagdmann <doj@cubic.org> @@ -41,3 +41,9 @@ >32 leshort x Version:0x%x >36 leshort !0 Entries:%i >40 string x Name:%.24s + +# Raw tape file format (.tap files) +# Esa Hyyti <esa@netlab.tkk.fi> +0 string C64-TAPE-RAW C64 Raw Tape File (.tap), +>0x0c byte x Version:%u, +>0x10 lelong x Length:%u cycles diff --git a/contrib/file/magic/Magdir/compress b/contrib/file/magic/Magdir/compress index c2266d4..8452f52 100644 --- a/contrib/file/magic/Magdir/compress +++ b/contrib/file/magic/Magdir/compress @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: compress,v 1.63 2015/03/11 19:27:35 christos Exp $ +# $File: compress,v 1.64 2015/07/27 15:41:09 christos Exp $ # compress: file(1) magic for pure-compression formats (no archives) # # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. @@ -258,7 +258,8 @@ !:mime application/x-qpress # Zlib https://www.ietf.org/rfc/rfc6713.txt -0 beshort%31 =0 ->0 byte&0xf =8 ->>0 byte&0x80 =0 zlib compressed data +0 string/b x +>0 beshort%31 =0 +>>0 byte&0xf =8 +>>>0 byte&0x80 =0 zlib compressed data !:mime application/zlib diff --git a/contrib/file/magic/Magdir/database b/contrib/file/magic/Magdir/database index b00252b..f39acfda 100644 --- a/contrib/file/magic/Magdir/database +++ b/contrib/file/magic/Magdir/database @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: database,v 1.43 2014/10/28 15:47:39 christos Exp $ +# $File: database,v 1.45 2015/09/09 16:25:29 christos Exp $ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) @@ -533,9 +533,15 @@ # From: Stephane Blondon http://www.yaal.fr # Database file for Zope (done by FileStorage) -0 string FS21 Zope Object Database File Storage (data) +0 string FS21 Zope Object Database File Storage v3 (data) +0 string FS30 Zope Object Database File Storage v4 (data) + # Cache file for the database of Zope (done by ClientStorage) 0 string ZEC3 Zope Object Database Client Cache File (data) # IDA (Interactive Disassembler) database 0 string IDA1 IDA (Interactive Disassembler) database + +# Hopper (reverse engineering tool) http://www.hopperapp.com/ +0 string hopperdb Hopper database + diff --git a/contrib/file/magic/Magdir/elf b/contrib/file/magic/Magdir/elf index 04ee37e..1509c44 100644 --- a/contrib/file/magic/Magdir/elf +++ b/contrib/file/magic/Magdir/elf @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: elf,v 1.68 2014/09/19 19:05:57 christos Exp $ +# $File: elf,v 1.69 2015/06/16 17:23:08 christos Exp $ # elf: file(1) magic for ELF executables # # We have to check the byte order flag to see what byte order all the @@ -15,6 +15,32 @@ # Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) # Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) +0 name elf-mips +>0 lelong&0xf0000000 0x00000000 MIPS-I +>0 lelong&0xf0000000 0x10000000 MIPS-II +>0 lelong&0xf0000000 0x20000000 MIPS-III +>0 lelong&0xf0000000 0x30000000 MIPS-IV +>0 lelong&0xf0000000 0x40000000 MIPS-V +>0 lelong&0xf0000000 0x50000000 MIPS32 +>0 lelong&0xf0000000 0x60000000 MIPS64 +>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 +>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 +>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 +>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 + +0 name elf-sparc +>0 lelong&0x00ffff00 0x00000100 V8+ Required, +>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, +>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, +>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, +>0 lelong&0x3 0 total store ordering, +>0 lelong&0x3 1 partial store ordering, +>0 lelong&0x3 2 relaxed memory ordering, + +0 name elf-pa-risc +>2 leshort 0x0214 2.0 +>0 leshort &0x0008 (LP64) + 0 name elf-le >16 leshort 0 no file type, !:mime application/octet-stream @@ -55,47 +81,26 @@ >18 leshort 8 # only for 32-bit >>4 byte 1 ->>>36 lelong&0xf0000000 0x00000000 MIPS-I ->>>36 lelong&0xf0000000 0x10000000 MIPS-II ->>>36 lelong&0xf0000000 0x20000000 MIPS-III ->>>36 lelong&0xf0000000 0x30000000 MIPS-IV ->>>36 lelong&0xf0000000 0x40000000 MIPS-V ->>>36 lelong&0xf0000000 0x50000000 MIPS32 ->>>36 lelong&0xf0000000 0x60000000 MIPS64 ->>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2 ->>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2 +>>>36 use elf-mips # only for 64-bit >>4 byte 2 ->>>48 lelong&0xf0000000 0x00000000 MIPS-I ->>>48 lelong&0xf0000000 0x10000000 MIPS-II ->>>48 lelong&0xf0000000 0x20000000 MIPS-III ->>>48 lelong&0xf0000000 0x30000000 MIPS-IV ->>>48 lelong&0xf0000000 0x40000000 MIPS-V ->>>48 lelong&0xf0000000 0x50000000 MIPS32 ->>>48 lelong&0xf0000000 0x60000000 MIPS64 ->>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2 ->>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2 +>>>48 use elf-mips >18 leshort 9 Amdahl, >18 leshort 10 MIPS (deprecated), >18 leshort 11 RS6000, >18 leshort 15 PA-RISC, # only for 32-bit >>4 byte 1 ->>>38 leshort 0x0214 2.0 ->>>36 leshort &0x0008 (LP64) +>>>36 use elf-pa-risc # only for 64-bit >>4 byte 2 ->>>50 leshort 0x0214 2.0 ->>>48 leshort &0x0008 (LP64) +>>>48 use elf-pa-risc >18 leshort 16 nCUBE, >18 leshort 17 Fujitsu VPP500, >18 leshort 18 SPARC32PLUS, # only for 32-bit >>4 byte 1 ->>>36 lelong&0xffff00 0x000100 V8+ Required, ->>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, ->>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required, ->>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, +>>>36 use elf-sparc >18 leshort 19 Intel 80960, >18 leshort 20 PowerPC or cisco 4500, >18 leshort 21 64-bit PowerPC or cisco 7500, @@ -117,12 +122,7 @@ >18 leshort 42 Renesas SH, >18 leshort 43 SPARC V9, >>4 byte 2 ->>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, ->>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required, ->>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, ->>>48 lelong&0x3 0 total store ordering, ->>>48 lelong&0x3 1 partial store ordering, ->>>48 lelong&0x3 2 relaxed memory ordering, +>>>48 use elf-sparc >18 leshort 44 Siemens Tricore Embedded Processor, >18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., >18 leshort 46 Renesas H8/300, diff --git a/contrib/file/magic/Magdir/filesystems b/contrib/file/magic/Magdir/filesystems index d8a802a..87c067e 100644 --- a/contrib/file/magic/Magdir/filesystems +++ b/contrib/file/magic/Magdir/filesystems @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: filesystems,v 1.109 2015/02/22 01:22:54 christos Exp $ +# $File: filesystems,v 1.111 2015/09/09 16:26:54 christos Exp $ # filesystems: file(1) magic for different filesystems # 0 name partid @@ -1721,7 +1721,7 @@ 0x410 leshort 0x137f !:strength / 2 >0x402 beshort < 100 ->0x402 beshort > -1 Minix filesystem, V1, %d zones +>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones >0x1e string minix \b, bootable 0x410 beshort 0x137f !:strength / 2 @@ -1740,27 +1740,26 @@ >0x1e string minix \b, bootable 0x410 leshort 0x2468 >0x402 beshort < 100 ->>0x402 beshort > -1 Minix filesystem, V2, %d zones +>>0x402 beshort > -1 Minix filesystem, V2, 14 char names >0x1e string minix \b, bootable 0x410 beshort 0x2468 >0x402 beshort < 100 ->0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones +>0x402 beshort > -1 Minix filesystem, V2 (big endian) >0x1e string minix \b, bootable - 0x410 leshort 0x2478 >0x402 beshort < 100 ->0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones +>0x402 beshort > -1 Minix filesystem, V2, 30 char names >0x1e string minix \b, bootable 0x410 leshort 0x2478 >0x402 beshort < 100 ->0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones +>0x402 beshort > -1 Minix filesystem, V2, 30 char names >0x1e string minix \b, bootable 0x410 beshort 0x2478 ->0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones ->0x1e string minix \b, bootable -0x410 leshort 0x4d5a ->0x402 beshort !0 Minix filesystem, V3, %d zones +>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) >0x1e string minix \b, bootable +0x418 leshort 0x4d5a +>0x402 beshort <100 +>>0x402 beshort > -1 Minix filesystem, V3, 60 char names # SGI disk labels - Nathan Scott <nathans@debian.org> 0 belong 0x0BE5A941 SGI disk label (volume header) @@ -2209,13 +2208,21 @@ >>0x10024 belong x (blocksize %d, >>0x10060 string >\0 lockproto %s) -# BTRFS -0x10040 string _BHRfS_M BTRFS Filesystem ->0x1012b string >\0 (label "%s", ->0x10090 lelong x sectorsize %d, ->0x10094 lelong x nodesize %d, ->0x10098 lelong x leafsize %d) - +# Russell Coker <russell@coker.com.au> +0x10040 string _BHRfS_M BTRFS Filesystem +>0x1012b string >\0 label "%s", +>0x10090 lelong x sectorsize %d, +>0x10094 lelong x nodesize %d, +>0x10098 lelong x leafsize %d, +>0x10020 belong x UUID=%8x- +>0x10024 beshort x \b%4x- +>0x10026 beshort x \b%4x- +>0x10028 beshort x \b%4x- +>0x1002a beshort x \b%4x +>0x1002c belong x \b%8x, +>0x10078 lequad x %lld/ +>0x10070 lequad x \b%lld bytes used, +>0x10088 lequad x %lld devices # dvdisaster's .ecc # From: "Nelson A. de Oliveira" <naoliv@gmail.com> diff --git a/contrib/file/magic/Magdir/fortran b/contrib/file/magic/Magdir/fortran index 921beec..826e912 100644 --- a/contrib/file/magic/Magdir/fortran +++ b/contrib/file/magic/Magdir/fortran @@ -1,7 +1,7 @@ #------------------------------------------------------------------------------ -# $File: fortran,v 1.8 2014/06/03 19:01:34 christos Exp $ +# $File: fortran,v 1.9 2015/06/17 19:55:27 christos Exp $ # FORTRAN source -0 regex/100l \^[Cc][\ \t] FORTRAN program +0 regex/100l \^[Cc][\ \t] FORTRAN program text !:mime text/x-fortran !:strength - 5 diff --git a/contrib/file/magic/Magdir/frame b/contrib/file/magic/Magdir/frame index babe890..08f884d 100644 --- a/contrib/file/magic/Magdir/frame +++ b/contrib/file/magic/Magdir/frame @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $ +# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $ # frame: file(1) magic for FrameMaker files # # This stuff came on a FrameMaker demo tape, most of which is @@ -41,10 +41,10 @@ >10 string 1.0 (1.0 >13 byte x %c) # XXX - this book entry should be verified, if you find one, uncomment this -#0 string \<Book\ FrameMaker Book (ASCII) file +#0 string \<Book\040 FrameMaker Book (ASCII) file #!:mime application/x-mif #>6 string 3.0 (3.0) #>6 string 2.0 (2.0) #>6 string 1.0 (1.0) -0 string \<Maker Intermediate Print File FrameMaker IPL file +0 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file !:mime application/x-mif diff --git a/contrib/file/magic/Magdir/iff b/contrib/file/magic/Magdir/iff index b991ab7..9437dd6 100644 --- a/contrib/file/magic/Magdir/iff +++ b/contrib/file/magic/Magdir/iff @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $ +# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $ # iff: file(1) magic for Interchange File Format (see also "audio" & "images") # # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic @@ -62,6 +62,7 @@ # These go at the end of the iff rules # +# David Griffith <dave@661.org> # I don't see why these might collide with anything else. # # Interactive Fiction related formats @@ -69,3 +70,4 @@ >8 string IFRS \b, Blorb Interactive Fiction >>24 string Exec with executable chunk >8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) +!:mime application/x-blorb diff --git a/contrib/file/magic/Magdir/images b/contrib/file/magic/Magdir/images index e6dd414..a3ac70b 100644 --- a/contrib/file/magic/Magdir/images +++ b/contrib/file/magic/Magdir/images @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: images,v 1.106 2015/02/22 01:26:05 christos Exp $ +# $File: images,v 1.107 2015/07/11 14:40:10 christos Exp $ # images: file(1) magic for image formats (see also "iff", and "c-lang" for # XPM bitmaps) # @@ -37,7 +37,7 @@ # The next byte following the magic is always whitespace. # strength is changed to try these patterns before "x86 boot sector" 0 name netpbm ->3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm PPM image data +>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data >>&0 regex =[0-9]{1,50} \b, size = %s x >>>&0 regex =[0-9]{1,50} \b %s @@ -59,7 +59,6 @@ !:strength + 45 !:mime image/x-portable-pixmap - 0 string P4 >0 use netpbm >>0 string x \b, rawbits, bitmap diff --git a/contrib/file/magic/Magdir/karma b/contrib/file/magic/Magdir/karma index 47d5d97..938a51d 100644 --- a/contrib/file/magic/Magdir/karma +++ b/contrib/file/magic/Magdir/karma @@ -1,9 +1,9 @@ #------------------------------------------------------------------------------ -# $File: karma,v 1.7 2014/04/30 21:41:02 christos Exp $ +# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ # karma: file(1) magic for Karma data files # # From <rgooch@atnf.csiro.au> -0 string KarmaRHD Version Karma Data Structure Version +0 string KarmaRHD\040Version Karma Data Structure Version >16 belong x %u diff --git a/contrib/file/magic/Magdir/linux b/contrib/file/magic/Magdir/linux index 44aaa66..c8cc0df 100644 --- a/contrib/file/magic/Magdir/linux +++ b/contrib/file/magic/Magdir/linux @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: linux,v 1.62 2015/05/03 13:06:36 christos Exp $ +# $File: linux,v 1.63 2015/08/24 05:16:11 christos Exp $ # linux: file(1) magic for Linux files # # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> @@ -417,6 +417,25 @@ 0 lelong 0xde020109 locale archive >24 lelong x %d strings +# Linux Software RAID (mdadm) +# Russell Coker <russell@coker.com.au> +0 name linuxraid +>16 belong x UUID=%8x: +>20 belong x \b%8x: +>24 belong x \b%8x: +>28 belong x \b%8x +>32 string x name=%s +>72 lelong x level=%d +>92 lelong x disks=%d + +4096 lelong 0xa92b4efc Linux Software RAID +>4100 lelong x version 1.2 (%d) +>4096 use linuxraid + +0 lelong 0xa92b4efc Linux Software RAID +>4 lelong x version 1.1 (%d) +>0 use linuxraid + # Summary: Database file for mlocate # Description: A database file as used by mlocate, a fast implementation # of locate/updatedb. It uses merging to reuse the existing diff --git a/contrib/file/magic/Magdir/mail.news b/contrib/file/magic/Magdir/mail.news index 7a8123a..a61bc72 100644 --- a/contrib/file/magic/Magdir/mail.news +++ b/contrib/file/magic/Magdir/mail.news @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: mail.news,v 1.22 2013/01/04 14:22:07 christos Exp $ +# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $ # mail.news: file(1) magic for mail and news # # Unfortunately, saved netnews also has From line added in some news software. @@ -41,6 +41,7 @@ # From: Simon Matter <simon.matter@invoca.ch> 0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB +0 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB # JAM(mbp) Fidonet message area databases # JHR file diff --git a/contrib/file/magic/Magdir/make b/contrib/file/magic/Magdir/make index ba7630d..f8509d6 100644 --- a/contrib/file/magic/Magdir/make +++ b/contrib/file/magic/Magdir/make @@ -1,15 +1,21 @@ #------------------------------------------------------------------------------ -# $File: make,v 1.1 2011/12/08 12:12:46 rrt Exp $ +# $File: make,v 1.2 2015/08/25 07:34:06 christos Exp $ # make: file(1) magic for makefiles # -0 regex \^CFLAGS makefile script text +0 regex/100l \^CFLAGS makefile script text !:mime text/x-makefile -0 regex \^LDFLAGS makefile script text +0 regex/100l \^VPATH makefile script text !:mime text/x-makefile -0 regex \^all: makefile script text +0 regex/100l \^LDFLAGS makefile script text !:mime text/x-makefile -0 regex \^.PRECIOUS makefile script text +0 regex/100l \^all: makefile script text +!:mime text/x-makefile +0 regex/100l \^\.PRECIOUS makefile script text +!:mime text/x-makefile +0 regex/100l \^\.BEGIN BSD makefile script text +!:mime text/x-makefile +0 regex/100l \^\.include BSD makefile script text !:mime text/x-makefile -0 regex \^SUBDIRS automake makefile script text +0 regex/100l \^SUBDIRS automake makefile script text !:mime text/x-makefile diff --git a/contrib/file/magic/Magdir/map b/contrib/file/magic/Magdir/map index d9471fe..e02b205 100644 --- a/contrib/file/magic/Magdir/map +++ b/contrib/file/magic/Magdir/map @@ -1,7 +1,7 @@ #------------------------------------------------------------------------------ -# $File: map,v 1.1 2014/06/03 18:22:25 christos Exp $ +# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $ # map: file(1) magic for Map data # @@ -9,9 +9,11 @@ 8 string .FIT FIT Map data >15 byte 0 >>35 belong x \b, unit id %d -# 20 years after unix epoch >>39 lelong x \b, serial %u ->>43 ledate/631152000 x \b, %s +# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml +# 20 years after unix epoch +# TZ=GMT date -d '1989-12-31 0:00' +%s +>>43 leldate+631065600 x \b, %s >>47 leshort x \b, manufacturer %d >>47 leshort 1 \b (garmin) @@ -23,3 +25,17 @@ >>53 byte 4 \b (Activity) >>53 byte 8 \b (Elevations) >>53 byte 10 \b (Totals) + +# TOM TOM GPS watches ttbin files: +# http://github.com/ryanbinns/ttwatch/tree/master/ttbin +# From: Daniel Lenski +0 byte 0x20 +>1 leshort 0x0007 +>>0x76 byte 0x20 +>>>0x77 leshort 0x0075 TomTom activity file, v7 +>>>>8 leldate x (%s, +>>>>3 byte x device firmware %d. +>>>>4 byte x \b%d. +>>>>5 byte x \b%d, +>>>>6 leshort x product ID %04d) + diff --git a/contrib/file/magic/Magdir/msdos b/contrib/file/magic/Magdir/msdos index 64d4862..89c141e 100644 --- a/contrib/file/magic/Magdir/msdos +++ b/contrib/file/magic/Magdir/msdos @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: msdos,v 1.100 2014/06/03 19:17:27 christos Exp $ +# $File: msdos,v 1.101 2015/08/24 05:08:48 christos Exp $ # msdos: file(1) magic for MS-DOS files # @@ -772,7 +772,7 @@ 0 ulequad 0x3a000000024e4c MS Advisor help file # HtmlHelp files (.chm) -0 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data +0 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data # GFA-BASIC (Wolfram Kleff) 2 string/b GFA-BASIC3 GFA-BASIC 3 data diff --git a/contrib/file/magic/Magdir/netscape b/contrib/file/magic/Magdir/netscape index 942f08a..a9b43cd 100644 --- a/contrib/file/magic/Magdir/netscape +++ b/contrib/file/magic/Magdir/netscape @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $ +# $File: netscape,v 1.7 2015/08/24 05:20:52 christos Exp $ # netscape: file(1) magic for Netscape files # "H. Nanosecond" <aldomel@ix.netcom.com> # version 3 and 4 I think @@ -22,4 +22,5 @@ # #This is files ending in .art, FIXME add more rules -0 string JG\004\016\0\0\0\0 ART +0 string JG\004\016\0\0\0\0 AOL ART image +0 string JG\003\016\0\0\0\0 AOL ART image diff --git a/contrib/file/magic/Magdir/python b/contrib/file/magic/Magdir/python index 36cdfd8..0668a93 100644 --- a/contrib/file/magic/Magdir/python +++ b/contrib/file/magic/Magdir/python @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: python,v 1.26 2014/08/04 05:58:40 christos Exp $ +# $File: python,v 1.27 2015/09/08 13:59:44 christos Exp $ # python: file(1) magic for python # # Outlook puts """ too for urgent messages @@ -26,12 +26,16 @@ 0 belong 0xee0c0d0a python 3.4 byte-compiled 0 search/1/w #!\ /usr/bin/python Python script text executable +!:strength + 10 !:mime text/x-python 0 search/1/w #!\ /usr/local/bin/python Python script text executable +!:strength + 10 !:mime text/x-python 0 search/1 #!/usr/bin/env\ python Python script text executable +!:strength + 10 !:mime text/x-python -0 search/1 #!\ /usr/bin/env\ python Python script text executable +0 search/10 #!\ /usr/bin/env\ python Python script text executable +!:strength + 10 !:mime text/x-python diff --git a/contrib/file/magic/Magdir/scientific b/contrib/file/magic/Magdir/scientific index f780743..e39720c 100644 --- a/contrib/file/magic/Magdir/scientific +++ b/contrib/file/magic/Magdir/scientific @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: scientific,v 1.9 2014/06/03 19:01:34 christos Exp $ +# $File: scientific,v 1.10 2015/08/24 05:18:55 christos Exp $ # scientific: file(1) magic for scientific formats # # From: Joe Krahn <krahn@niehs.nih.gov> @@ -104,3 +104,8 @@ >>5 byte x version %d.0 >4 byte >0x00 version %d >>5 byte x \b.%d + +# Type: LXT (interLaced eXtensible Trace) +# chrysn <chrysn@fsfe.org> +0 beshort 0x0138 interLaced eXtensible Trace (LXT) file +>2 beshort >0 (Version %u) diff --git a/contrib/file/magic/Magdir/sgi b/contrib/file/magic/Magdir/sgi index a6223d7..ece9988 100644 --- a/contrib/file/magic/Magdir/sgi +++ b/contrib/file/magic/Magdir/sgi @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: sgi,v 1.21 2014/04/30 21:41:02 christos Exp $ +# $File: sgi,v 1.22 2015/08/29 07:10:35 christos Exp $ # sgi: file(1) magic for Silicon Graphics operating systems and applications # # Executable images are handled either in aout (for old-style a.out @@ -55,8 +55,8 @@ 0 string WNGZWZSS Wingz spreadsheet 0 string WNGZWZHP Wingz help file # -0 string #Inventor V IRIS Inventor 1.0 file -0 string #Inventor V2 Open Inventor 2.0 file +0 string #Inventor\040V IRIS Inventor 1.0 file +0 string #Inventor\040V2 Open Inventor 2.0 file # GLF is OpenGL stream encoding 0 string glfHeadMagic(); GLF_TEXT 4 belong 0x7d000000 GLF_BINARY_LSB_FIRST diff --git a/contrib/file/magic/Magdir/sgml b/contrib/file/magic/Magdir/sgml index cf2b40e..0d48255 100644 --- a/contrib/file/magic/Magdir/sgml +++ b/contrib/file/magic/Magdir/sgml @@ -1,5 +1,4 @@ -#------------------------------------------------------------------------------ -# $File: sgml,v 1.31 2015/03/11 19:38:04 christos Exp $ +#------------------------------------------------------------------------------ # $File: sgml,v 1.32 2015/07/11 15:08:53 christos Exp $ # Type: SVG Vectorial Graphics # From: Noel Torres <tecnico@ejerciciosresueltos.com> 0 string \<?xml\ version=" @@ -24,16 +23,16 @@ # xhtml 0 string/t \<?xml\ version=" ->15 string >\0 ->>19 search/4096/cWbt \<!doctype\ html XHTML document text +>19 search/4096/cWbt \<!doctype\ html XHTML document text +>>15 string >\0 (version %.3s) !:mime text/html 0 string/t \<?xml\ version=' ->15 string >\0 ->>19 search/4096/cWbt \<!doctype\ html XHTML document text +>19 search/4096/cWbt \<!doctype\ html XHTML document text +>>15 string >\0 (version %.3s) !:mime text/html 0 string/t \<?xml\ version=" ->15 string >\0 ->>19 search/4096/cWbt \<html broken XHTML document text +>19 search/4096/cWbt \<html broken XHTML document text +>>15 string >\0 (version %.3s) !:mime text/html #------------------------------------------------------------------------------ @@ -106,9 +105,6 @@ >15 string/t >\0 %.3s document text >>23 search/1 \<xsl:stylesheet (XSL stylesheet) >>24 search/1 \<xsl:stylesheet (XSL stylesheet) -0 search/1/wbt \<?xml XML document text -!:mime application/xml -!:strength - 10 0 search/1/wt \<?XML broken XML document text !:mime application/xml !:strength - 10 diff --git a/contrib/file/magic/Magdir/windows b/contrib/file/magic/Magdir/windows index 3f7bded..7e0d4d1 100644 --- a/contrib/file/magic/Magdir/windows +++ b/contrib/file/magic/Magdir/windows @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: windows,v 1.10 2014/09/24 19:52:46 christos Exp $ +# $File: windows,v 1.12 2015/08/29 07:10:35 christos Exp $ # windows: file(1) magic for Microsoft Windows # # This file is mainly reserved for files where programs @@ -89,7 +89,7 @@ >20 lelong&16 16 \b, Has Working directory >20 lelong&32 32 \b, Has command line arguments >20 lelong&64 64 \b, Icon ->>56 lelong \b number=%d +>>56 lelong x \b number=%d >24 lelong&1 1 \b, Read-Only >24 lelong&2 2 \b, Hidden >24 lelong&4 4 \b, System @@ -239,6 +239,7 @@ # http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm # GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 0 leshort&0xFeFe 0x0000 +!:strength -5 # test for unused null bits in PNF_FLAGs >4 ulelong&0xFCffFe00 0x00000000 # only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure |
