1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
|
#------------------------------------------------------------------------------
# msdos: file(1) magic for MS-DOS files
#
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0 string @echo\ off MS-DOS batch file text
# WinNT/WinCE PE files (Warner Losh, imp@village.org)
#
128 string PE\000\000 MS Windows PE
>132 leshort 0x0000 Unknown CPU
>132 leshort 0x14c Intel 386
>132 leshort 0x14d Intel 486
>132 leshort 0x14e Intel 586
>132 leshort 0x162 MIPS ISA I
>132 leshort 0x163 MIPS ISA II
>132 leshort 0x166 MIPS ISA III
>132 leshort 0x184 Digital Alpha
>132 leshort 0x1a2 Hitachi SH3
>132 leshort 0x1a6 Hitachi SH4
>132 leshort 0x1c0 ARM
>132 leshort 0x1f0 Power PC
>132 leshort 0x268 Motorola 68000 series
>132 leshort 0x290 PA-RISC
>148 leshort >27
>>220 leshort 0 unknown subsystem
>>220 leshort 1 native
>>220 leshort 2 GUI
>>220 leshort 3 console
>>220 leshort 7 POSIX
>150 leshort&0x2000 =0 executable
#>>136 ledate x stamp %s,
>>150 leshort&0x0001 >0 not relocatable
#>>150 leshort&0x0004 =0 with line numbers,
#>>150 leshort&0x0008 =0 with local symbols,
#>>150 leshort&0x0200 =0 with debug symbols,
>>150 leshort&0x1000 >0 system file
#>>148 leshort >0
#>>>154 byte x linker %d
#>>>155 byte x \b.%d,
#>>148 leshort >27
#>>>192 leshort x requires OS %d
#>>>194 leshort x \b.%d,
#>>>196 leshort x user version %d
#>>>198 leshort x \b.%d,
#>>>200 leshort x subsystem version %d
#>>>202 leshort x \b.%d,
>150 leshort&0x2000 >0 DLL
#>>136 ledate x stamp %s,
>>150 leshort&0x0001 >0 not relocatable
#>>150 leshort&0x0004 =0 with line numbers,
#>>150 leshort&0x0008 =0 with local symbols,
#>>150 leshort&0x0200 =0 with debug symbols,
>>150 leshort&0x1000 >0 system file
#>>148 leshort >0
#>>>154 byte x linker %d
#>>>155 byte x \b.%d,
#>>148 leshort >27
#>>>192 leshort x requires OS %d
#>>>194 leshort x \b.%d,
#>>>196 leshort x user version %d
#>>>198 leshort x \b.%d,
#>>>200 leshort x subsystem version %d
#>>>202 leshort x \b.%d,
0 string PE\000\000 MS Windows PE (no DOS header)
>4 leshort 0x0000 Unknown CPU
>4 leshort 0x14c Intel 386
>4 leshort 0x14d Intel 486
>4 leshort 0x14e Intel 586
>4 leshort 0x162 MIPS ISA I
>4 leshort 0x163 MIPS ISA II
>4 leshort 0x166 MIPS ISA III
>4 leshort 0x184 Digital Alpha
>4 leshort 0x1a2 Hitachi SH3
>4 leshort 0x1a6 Hitachi SH4
>4 leshort 0x1c0 ARM
>4 leshort 0x1f0 Power PC
>4 leshort 0x268 Motorola 68000 series
>4 leshort 0x290 PA-RISC
# It would appear that the debugger information is in basically the same
# format as what binutils calls PEI files.
0 string DI\000\000 Microsoft PE Debugger Information
>4 leshort 0x0000 Unknown CPU
>4 leshort 0x14c Intel 386
>4 leshort 0x14d Intel 486
>4 leshort 0x14e Intel 586
>4 leshort 0x162 MIPS ISA I
>4 leshort 0x163 MIPS ISA II
>4 leshort 0x166 MIPS ISA III
>4 leshort 0x184 Digital Alpha
>4 leshort 0x1a2 Hitachi SH3
>4 leshort 0x1a6 Hitachi SH4
>4 leshort 0x1c0 ARM
>4 leshort 0x1f0 Power PC
>4 leshort 0x268 Motorola 68000 series
>4 leshort 0x290 PA-RISC
0 leshort 0x0000 MS Windows COFF Unknown CPU
0 leshort 0x14c MS Windows COFF Intel 386
0 leshort 0x14d MS Windows COFF Intel 486
0 leshort 0x14e MS Windows COFF Intel 586
0 leshort 0x162 MS Windows COFF MIPS ISA I
0 leshort 0x163 MS Windows COFF MIPS ISA II
0 leshort 0x166 MS Windows COFF MIPS ISA III
0 leshort 0x184 MS Windows COFF Digital Alpha
0 leshort 0x1a2 MS Windows COFF Hitachi SH3
0 leshort 0x1a6 MS Windows COFF Hitachi SH4
0 leshort 0x1c0 MS Windows COFF ARM
0 leshort 0x1f0 MS Windows COFF Power PC
0 leshort 0x268 MS Windows COFF Motorola 68000 series
0 leshort 0x290 MS Windows COFF PA-RISC
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0 string MZ MS-DOS executable (EXE)
>24 string @ \b, OS/2 or MS Windows
>>0xe7 string LH/2\ Self-Extract \b, %s
>>0xe9 string PKSFX2 \b, %s
>0x1c string RJSX\xff\xff \b, ARJ SFX
>0x1c string diet\xf9\x9c \b, diet compressed
>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX
# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"
>0x1e string PKLITE\ Copr. \b, %.6s compressed
>0x24 string LHa's\ SFX \b, %.15s
>0x24 string LHA's\ SFX \b, %.15s
>1638 string -lh5- \b, LHa SFX archive v2.13S
>7195 string Rar! \b, RAR self-extracting archive
#
# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
# 8161 bytes are ignored. To make the following entries work, increase
# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
# NT/Win32 and VMS.]
# [GRR: some company sells a self-extractor/displayer for image data(!)]
#
>11696 string PK\003\004 \b, PKZIP SFX archive v1.1
>13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
>15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
>15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
>28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
# these are the DOS versions:
>25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# these are the OS/2 versions (OS/2 is flagged above):
>47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# this is the NT/Win32 version:
>69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0 byte 0xe9 MS-DOS executable (COM)
#>6 string SFX\ of\ LHarc (%s)
#0 byte 0x8c MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0 byte 0xeb MS-DOS executable (COM)
#0 byte 0xb8 MS-DOS executable (COM)
# miscellaneous formats
0 string LZ MS-DOS executable (built-in)
#0 byte 0xf0 MS-DOS program library data
#
#
# Windows NT Registry files.
#
0 string regf Windows NT Registry file
# Popular applications
2080 string Microsoft\ Word\ 6.0\ Document %s
2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
2112 string MSWordDoc Microsoft Word document data
#
0 belong 0x31be0000 Microsoft Word Document
#
0 string PO^Q` Microsoft Word 6.0 Document
#
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
#
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
2114 string Biff5 Microsoft Excel 5.0 Worksheet
#
0 belong 0x00001a00 Lotus 1-2-3
>4 belong 0x00100400 wk3 document data
>4 belong 0x02100400 wk4 document data
>4 belong 0x07800100 fm3 or fmb document data
>4 belong 0x07800000 fm3 or fmb document data
#
0 belong 0x00000200 Lotus 1-2-3
>4 belong 0x06040600 wk1 document data
>4 belong 0x06800200 fmt document data
# WordPerfect documents - Trevor Johnson <trevor@jpj.net>
#
1 string WPC WordPerfect document
# Help files
0 string ?_\3\0 MS Windows Help Data
|
