AkkomaGang/file_ex
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

weeee

Browse source
This commit is contained in:
FloatingGhost 2023-08-06 17:12:15 +01:00
parent 4ff075d265
commit e2ce878c72
349 changed files with 45843 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
.gitmodules vendored Normal file
View file

@ -0,0 +1,3 @@
[submodule "file"]
path = file
url = https://github.com/file/file

5
README.md
View file

@ -1,6 +1,9 @@
# FileEx # FileEx
**TODO: Add description** To update, bump the submodule, then copy the `magic` directory out to
the top-level.
Cool, I know
## Installation ## Installation

1
file Submodule

@ -0,0 +1 @@
Subproject commit 815ae4840bf5d8c6bb4b5931c5e7082addc67f83

6
magic/.cvsignore Normal file
View file

@ -0,0 +1,6 @@
Makefile
Makefile.in
magic
*.mgc
Localstuff
.gitignore

5
magic/Header Normal file
View file

@ -0,0 +1,5 @@
# Magic data for file(1) command.
# Format is described in magic(files), where:
# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
# Don't edit this file, edit /etc/magic or send your magic improvements
# to the maintainers, at file@astron.com

7
magic/Localstuff Normal file
View file

@ -0,0 +1,7 @@
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.

102
magic/Magdir/acorn Normal file
View file

@ -0,0 +1,102 @@
#------------------------------------------------------------------------------
# $File: acorn,v 1.8 2021/04/26 15:56:00 christos Exp $
# acorn: file(1) magic for files found on Acorn systems
#
# RISC OS Chunk File Format
# From RISC OS Programmer's Reference Manual, Appendix D
# We guess the file type from the type of the first chunk.
0 lelong 0xc3cbc6c5 RISC OS Chunk data
>12 string OBJ_ \b, AOF object
>12 string LIB_ \b, ALF library
# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
16 lelong 0xef000011 RISC OS AIF executable
# RISC OS Draw files
# From RISC OS Programmer's Reference Manual, Appendix E
0 string Draw RISC OS Draw file data
# RISC OS new format font files
# From RISC OS Programmer's Reference Manual, Appendix E
0 string FONT\0 RISC OS outline font data,
>5 byte x version %d
0 string FONT\1 RISC OS 1bpp font data,
>5 byte x version %d
0 string FONT\4 RISC OS 4bpp font data
>5 byte x version %d
# RISC OS Music files
# From RISC OS Programmer's Reference Manual, Appendix E
0 string Maestro\r RISC OS music file
>8 byte x version %d
>8 byte x type %d
# Digital Symphony data files
# From: Bernard Jungen (bern8817@euphonynet.be)
0 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS),
>8 byte x version %d,
>9 pstring x named "%s",
>(9.b+19) byte =0 8-bit logarithmic
>(9.b+19) byte =1 LZW-compressed linear
>(9.b+19) byte =2 8-bit linear signed
>(9.b+19) byte =3 16-bit linear signed
>(9.b+19) byte =4 SigmaDelta-compressed linear
>(9.b+19) byte =5 SigmaDelta-compressed logarithmic
>(9.b+19) byte >5 unknown format
0 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS),
>8 byte x version %d,
>9 byte =1 1 voice,
>9 byte !1 %d voices,
>10 leshort =1 1 track,
>10 leshort !1 %d tracks,
>12 leshort =1 1 pattern
>12 leshort !1 %d patterns
0 string \x02\x01\x13\x13\x10\x14\x12\x0e
>9 byte =0 Digital Symphony sequence (RISC OS),
>>8 byte x version %d,
>>10 byte =1 1 line,
>>10 byte !1 %d lines,
>>11 leshort =1 1 position
>>11 leshort !1 %d positions
>9 byte =1 Digital Symphony pattern data (RISC OS),
>>8 byte x version %d,
>>10 leshort =1 1 pattern
>>10 leshort !1 %d patterns
# From: Joerg Jenderek
# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
# GRR: line below is too general as it matches also "Git pack" in ./revision
0 string PACK\0
# check for valid compression method 0-4
>5 ulelong <5
# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
# To skip "Git pack" version 0 test for root directory object like
# ADFS::RPC.$.websitezip.FONTFIX
>>9 string >ADFS\ PackDir archive (RISC OS)
# TrID labels above as "Acorn PackDir compressed Archive"
# compression mode y (0 - 4) for GIF LZW with a maximum n bits
# (y~n,0~12,1~13,2~14,3~15,4~16)
>>>5 ulelong+12 x \b, LZW %u-bits compression
# https://www.filebase.org.uk/filetypes
# !Packdir compressed archive has three hexadecimal digits code 68E
!:mime application/x-acorn-68E
!:ext pkd/bin
# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
>>>9 string x \b, root "%s"
# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
>>>>&1 ulelong x \b, load address %#x
# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
>>>>&5 ulelong x \b, exec address %#x
# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
>>>>&9 ulelong x \b, attributes %#x
# number of entries in this directory. for root dir 0
#>>>&13 ulelong x \b, entries %#x
# the entries start here with object name
>>>>&17 string x \b, 1st object "%s"

13
magic/Magdir/adi Normal file
View file

@ -0,0 +1,13 @@
#------------------------------------------------------------------------------
# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
# adi: file(1) magic for ADi's objects
# From Gregory McGarry <g.mcgarry@ieee.org>
#
0 leshort 0x521c COFF DSP21k
>18 lelong &02 executable,
>18 lelong ^02
>>18 lelong &01 static object,
>>18 lelong ^01 relocatable object,
>18 lelong &010 stripped
>18 lelong ^010 not stripped

122
magic/Magdir/adventure Normal file
View file

@ -0,0 +1,122 @@
#------------------------------------------------------------------------------
# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
#
# ALAN
# I assume there are other, lower versions, but these are the only ones I
# saw in the archive.
0 beshort 0x0206 ALAN game data
>2 byte <10 version 2.6%d
# Infocom (see z-machine)
#------------------------------------------------------------------------------
# Z-machine: file(1) magic for Z-machine binaries.
# Sanity checks by David Griffith <dave@661.org>
# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
#
#http://www.gnelson.demon.co.uk/zspec/sect11.html
#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
#https://en.wikipedia.org/wiki/Z-machine
# The first byte is the Z-machine revision; it is always between 1 and 8. We
# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
# well as an occasional MP3 file), so we sanity-check the version number.
#
# It might be possible to sanity-check the release number as well, as it seems
# (at least in classic Infocom games) to always be a relatively small number,
# always under 150 or so, but as this isn't rigorous, we'll wait on that until
# it becomes clear that it's needed.
#
0 ubyte >0
>0 ubyte <9
>>16 belong&0xfe00f0f0 0x3030
>>>0 ubyte < 10
>>>>2 ubeshort x
>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9]
>>>>>>0 ubyte < 10 Infocom (Z-machine %d
>>>>>>>2 ubeshort x \b, Release %d
>>>>>>>>18 string >\0 \b, Serial %.6s
>>>>>>>>18 string x \b)
!:strength + 40
!:mime application/x-zmachine
#------------------------------------------------------------------------------
# Glulx: file(1) magic for Glulx binaries.
#
# David Griffith <dave@661.org>
# I haven't checked for false matches yet.
#
0 string Glul Glulx game data
>4 beshort x (Version %d
>>6 byte x \b.%d
>>8 byte x \b.%d)
>36 string Info Compiled by Inform
!:mime application/x-glulx
# For Quetzal and blorb magic see iff
# TADS (Text Adventure Development System) version 2
# All files are machine-independent (games compile to byte-code) and are tagged
# with a version string of the form "V2.<digit>.<digit>\0".
# Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
0 string TADS2\ bin TADS
>9 belong !0x0A0D1A00 game data, CORRUPTED
>9 belong 0x0A0D1A00
>>13 string >\0 %s game data
!:mime application/x-tads
# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
0 string TADS2\ rsc TADS
>9 belong !0x0A0D1A00 resource data, CORRUPTED
>9 belong 0x0A0D1A00
>>13 string >\0 %s resource data
!:mime application/x-tads
# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
# "TADS2 save\n\r\032\0" and the interpreter version.
0 string TADS2\ save/g TADS
>12 belong !0x0A0D1A00 saved game data, CORRUPTED
>12 belong 0x0A0D1A00
>>(16.s+32) string >\0 %s saved game data
!:mime application/x-tads
# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
# version.
0 string TADS2\ save TADS
>10 belong !0x0A0D1A00 saved game data, CORRUPTED
>10 belong 0x0A0D1A00
>>14 string >\0 %s saved game data
!:mime application/x-tads
# TADS (Text Adventure Development System) version 3
# Game files start with "T3-image\015\012\032"
0 string T3-image\015\012\032
>11 leshort x TADS 3 game data (format version %d)
# Saved game files start with "T3-state-v####\015\012\032"
# where #### is a format version number
0 string T3-state-v
>14 string \015\012\032 TADS 3 saved game data (format version
>>10 byte x %c
>>11 byte x \b%c
>>12 byte x \b%c
>>13 byte x \b%c)
!:mime application/x-t3vm-image
# edited by David Griffith <dave@661.org>
# Danny Milosavljevic <danny.milo@gmx.net>
# These are ADRIFT (adventure game standard) game files, extension .taf
# Checked from source at (http://www.adrift.co/) and various taf files
# found at the Interactive Fiction Archive (https://ifarchive.org/)
0 belong 0x3C423FC9
>4 belong 0x6A87C2CF Adrift game file version
>>8 belong 0x94453661 3.80
>>8 belong 0x94453761 3.90
>>8 belong 0x93453E61 4.0
>>8 belong 0x92453E61 5.0
>>8 default x unknown
!:mime application/x-adrift

29
magic/Magdir/aes Normal file
View file

@ -0,0 +1,29 @@
#------------------------------------------------------------------------------
# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $
#
# aes: magic file for AES encrypted files
# Summary: AES Crypt Encrypted Data File
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
# Reference: https://www.aescrypt.com/aes_file_format.html
0 string AES
>3 ubyte <3 AES encrypted data, version %u
#!:mime application/aes
!:mime application/x-aes-encrypted
!:ext aes
# For Version 2 the encrypted file can have text tags
>>3 ubyte =2
# length of an extension identifier and contents like: 0 24 33 38
#>>5 ubeshort x \b, tag length %u
#>>5 pstring/H x '%s'
# standard extension tags like CREATED_BY
>>>7 string CREATED_BY \b, created by
# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ...
>>>>&1 string x "%s"
# TODO: more other tags
# tag CREATED_DATE like YYYY-MM-DD
# tag CREATED_TIME like HH:MM:SS
#

35
magic/Magdir/algol68 Normal file
View file

@ -0,0 +1,35 @@
#------------------------------------------------------------------------------
# $File: algol68,v 1.6 2022/11/06 18:36:55 christos Exp $
# algol68: file(1) magic for Algol 68 source
#
# URL: https://en.wikipedia.org/wiki/ALGOL_68
# Reference: http://www.softwarepreservation.org/projects/ALGOL/report/Algol68_revised_report-AB.pdf
# Update: Joerg Jenderek
0 search/8192 (input,
>0 use algol_68
# graph_2d.a68
0 regex/4006 \^PROC[[:space:]][a-zA-Z0-9_[:space:]]*[[:space:]]=
>0 use algol_68
0 regex/1024 \bMODE[\t\ ]
>0 use algol_68
0 regex/1024 \bMODE[\t\ ]
>0 use algol_68
0 regex/1024 \bREF[\t\ ]
>0 use algol_68
0 regex/1024 \bFLEX[\t\ ]\*\\[
>0 use algol_68
# display information like mime type and file name extension of Algol 68 source text
0 name algol_68 Algol 68 source text
!:mime text/x-Algol68
# https://file-extension.net/seeker/file_extension_a68
!:ext a68
#!:ext a68/alg
#0 regex [\t\ ]OD Algol 68 source text
#>0 use algol_68
#!:mime text/x-Algol68
#0 regex [\t\ ]FI Algol 68 source text
#>0 use algol_68
#!:mime text/x-Algol68

9
magic/Magdir/allegro Normal file
View file

@ -0,0 +1,9 @@
#------------------------------------------------------------------------------
# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
# allegro: file(1) magic for Allegro datafiles
# Toby Deshane <hac@shoelace.digivill.net>
#
0 belong 0x736C6821 Allegro datafile (packed)
0 belong 0x736C682E Allegro datafile (not packed/autodetect)
0 belong 0x736C682B Allegro datafile (appended exe data)

18
magic/Magdir/alliant Normal file
View file

@ -0,0 +1,18 @@
#------------------------------------------------------------------------------
# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
# alliant: file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0 short 0420 0420 Alliant virtual executable
>2 short &0x0020 common library
>16 long >0 not stripped
0 short 0421 0421 Alliant compact executable
>2 short &0x0020 common library
>16 long >0 not stripped

12
magic/Magdir/amanda Normal file
View file

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
# amanda: file(1) magic for amanda file format
#
0 string AMANDA:\ AMANDA
>8 string TAPESTART\ DATE tape header file,
>>23 string X
>>>25 string >\ Unused %s
>>23 string >\ DATE %s
>8 string FILE\ dump file,
>>13 string >\ DATE %s

218
magic/Magdir/amigaos Normal file
View file

@ -0,0 +1,218 @@
#------------------------------------------------------------------------------
# $File: amigaos,v 1.20 2021/09/20 00:42:19 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
#
0 belong 0x000003fa AmigaOS shared library
0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
0 belong 0x000003e7 AmigaOS object/library data
#
0 beshort 0xe310 Amiga Workbench
>2 beshort 1
>>48 byte 1 disk icon
>>48 byte 2 drawer icon
>>48 byte 3 tool icon
>>48 byte 4 project icon
>>48 byte 5 garbage icon
>>48 byte 6 device icon
>>48 byte 7 kickstart icon
>>48 byte 8 workbench application icon
>2 beshort >1 icon, vers. %d
#
# various sound formats from the Amiga
# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
#
0 string FC14 Future Composer 1.4 Module sound file
0 string SMOD Future Composer 1.3 Module sound file
0 string AON4artofnoise Art Of Noise Module sound file
1 string MUGICIAN/SOFTEYES Mugician Module sound file
58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
0 string Synth4.0 Synthesis Module sound file
0 string ARP. The Holy Noise Module sound file
0 string BeEp\0 JamCracker Module sound file
0 string COSO\0 Hippel-COSO Module sound file
# Too simple (short, pure ASCII, deep), MPi
#26 string V.3 Brian Postma's Soundmon Module sound file v3
#26 string BPSM Brian Postma's Soundmon Module sound file v3
#26 string V.2 Brian Postma's Soundmon Module sound file v2
# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga.trid.xml
# https://wiki.amigaos.net/wiki/Graphics_Library_and_Text
# fch_FileID=FCH_ID=0x0f00
0 beshort 0x0f00
# skip some AVM powerline firmware images by check for positive number of font elements
# https://download.avm.de/fritzpowerline/fritzpowerline-1000e-t/other/fritz.os/fritz.powerline_1000ET_01_05.image
>2 ubeshort >0 AmigaOS bitmap font
#!:mime application/octet-stream
!:mime font/x-amiga-font
!:ext font
# struct FontContents fch_FC; 1st fc_FileName [MAXFONTPATH=256]; ~ filename "/" fc_YSize
# like: topazb/6 suits/8 Excel/9e emerald/17 Franklin/23 DIAMONDS/60.8C
>>4 string x "%.256s"
# fc_YSize ~number after slash in fc_FileName; like: 6 7 8 9 11 12 16 17 21 23 45 60
>>260 beshort x \b, fc_YSize %u
# fch_NumEntries; number of FontContents elements like:
# 1 (often) 2 3 (IconCondensed.font tempfont.font) 4 (Franklin.font) 6 (mcoop.font)
>>2 ubeshort >1 \b, %u elements
#>>2 beshort x \b, %u element
# plural s
#>>2 beshort !1 \bs
# like: 6 7 8 9 11 12 16 17 21 23 45 60
#>>262 beshort x \b, FLAGS_STYLE
>>2 beshort >1 \b, 2nd
# 2nd fc_FileName like: Franklin/36
>>>264 string x "%.256s"
>>2 beshort >2 \b, 3rd
# 3rd fc_FileName like: Franklin/18
>>>524 string x "%.256s"
# URL: http://fileformats.archiveteam.org/wiki/Amiga_bitmap_font
# Reference: https://wiki.amigaos.net/wiki/Graphics_Library_and_Text
# http://mark0.net/download/triddefs_xml.7z/defs/f/font-amiga-var2.trid.xml
# Note: called by TrID "Amiga bitmap Font (var.2)"
# fch_FileID=TFCH_ID=0x0f02
0 beshort 0x0f02
# skip possible misidentified foo by check for positive number of font elements
>2 ubeshort >0 AmigaOS bitmap font (TFCH)
#!:mime application/octet-stream
!:mime font/x-amiga-font
!:ext font
# struct TFontContents fch_TFC[]; 1st tfc_FileName [254]; ~ filename "/" fc_YSize
# like: Abbey/45 XScript/75 XTriumvirate/45
>>4 string x "%.254s"
# tfc_TagCount; including the TAG_END tag like: 4
>>258 ubeshort x \b, tfc_TagCount %u
# tfc_YSize ~number after slash in tfc_FileName; like: 45 75
>>260 beshort x \b, tfc_YSize %u
# tfc_Style; tfc_Flags like: 8022h 8222h
#>>262 ubeshort x \b, FLAGS_STYLE %#x
# fch_NumEntries; number of FontContents elements like: 1 (abbey.font) 2 (xscript.font xtriumvirate.font)
>>2 ubeshort >1 \b, %u elements
>>2 beshort >1 \b, 2nd
# 2nd tfc_FileName like: XScript/45 XTriumvirate/30
>>>264 string x "%.254s"
0 beshort 0x0f03 AmigaOS outline font
0 belong 0x80001001 AmigaOS outline tag
0 string ##\ version catalog translation
0 string EMOD\0 Amiga E module
8 string ECXM\0 ECX module
0 string/c @database AmigaGuide file
# Amiga disk types
# display information like volume name of root block on Amiga (floppy) disk
0 name adf-rootblock
# block primary type = T_HEADER (value 2)
>0x000 ubelong !2 \b, type %u
# header_key; unused in rootblock (value 0)
>0x004 ubelong !0 \b, header_key %u
# high_seq; unused (value 0)
>0x008 ubelong !0 \b, high_seq %u
# ht_size; hash table size; 0x48 for flopies
>0x00c ubelong !0x48 \b, hash table size %#x
# bm_flag; bitmap flag, -1 means VALID
>0x138 belong !-1 \b, bitmap flag %#x
# bm_ext; first bitmap extension block (Hard disks only)
>0x1A0 ubelong !0 \b, bitmap extension block %#x
# name_len; volume name length; diskname[30]; volume name
>0x1B0 pstring >\0 \b, "%s"
# first directory cache block for FFS; otherwise 0
>0x1F8 ubelong !0 \b, directory cache block %#x
# block secondary type = ST_ROOT (value 1)
>0x1FC ubelong !1 \b, sec_type %#x
#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
# URL: http://fileformats.archiveteam.org/wiki/ADF_(Amiga)
# https://en.wikipedia.org/wiki/Amiga_Fast_File_System
# Reference: http://lclevy.free.fr/adflib/adf_info.html
# Update: Joerg Jenderek
# Note: created by ADFOpus.exe
# and verified by `unadf -l TURBO_SILVER_SV.ADF`
0 string DOS
# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG
>3 ubyte <8 Amiga
# https://reposcope.com/mimetype/application/x-amiga-disk-format
!:mime application/x-amiga-disk-format
!:ext adf
>>3 ubyte 0 DOS disk
>>3 ubyte 1 FFS disk
>>3 ubyte 2 Inter DOS disk
>>3 ubyte 3 Inter FFS disk
# For Fastdir mode the international mode is also enabled,
>>3 ubyte 4 Fastdir DOS disk
>>3 ubyte 5 Fastdir FFS dis
# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)"
>>3 ubyte 6 Inter Fastdir DOS disk
# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)"
>>3 ubyte 7 Inter Fastdir FFS disk
# but according to Wikipedia variants with long name support
#>>3 ubyte 6 long name DOS disk
#>>3 ubyte 7 long name FFS disk
# DOES NOT only work! Partly for file size ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h
#>>-0 offset x \b, %lld bytes
# Correct file size, but next lines are NOT executed
#>>-0 offset 901120 (DD 880 KiB floppy)
# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2
>>0x6E00C ubelong 0x48
>>>0x6E000 ubelong 2 (DD 880 KiB)
# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48
>>0xDC00C ubelong 0x48
>>>0xDC000 ubelong 2 (HD 1760 KiB)
# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ...
#>>4 ubelong x \b, CRC %#x
# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF)
>>8 ubelong >0 \b, probably root block %d
# bootblock code
>>12 quad !0 \b, bootable
# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6)
>>>12 ubequad =0x43fa003e70254eae AmigaDOS 3.0
>>>12 default x
>>>>12 ubequad !0x43fa003e70254eae %#llx..
# 880 KiB Double Density floppy disk (901120 bytes)
>>0x6E00C ubelong 0x48
>>>0x6E000 ubelong 2
>>>>0x6E000 use adf-rootblock
# 1760 KiB High Density floppy disk (1802240 bytes)
>>0xDC00C ubelong 0x48
>>>0xDC000 ubelong 2
>>>>0xDC000 use adf-rootblock
# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq
>>0x80000 ubelong 2
>>>0x80004 quad 0
>>>>0x80000 use adf-rootblock
# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB
#>>0x100000 ubelong x 2 MiB TEST
#>>0x100000 ubelong 2 \b, 2 MiB hard disc rootblock
#>>>0x100000 use adf-rootblock
0 string KICK Kickstart disk
# From: Alex Beregszaszi <alex@fsn.hu>
0 string LZX LZX compressed archive (Amiga)
# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
0 string .KEY AmigaDOS script
0 string .key AmigaDOS script
# AMOS Basic file formats
# https://www.exotica.org.uk/wiki/AMOS_file_formats
0 string AMOS\040Basic\040 AMOS Basic source code
>11 byte =0x56 \b, tested
>11 byte =0x76 \b, untested
0 string AMOS\040Pro AMOS Basic source code
>11 byte =0x56 \b, tested
>11 byte =0x76 \b, untested
0 string AmSp AMOS Basic sprite bank
>4 beshort x \b, %d sprites
0 string AmIc AMOS Basic icon bank
>4 beshort x \b, %d icons
0 string AmBk AMOS Basic memory bank
>4 beshort x \b, bank number %d
>8 belong&0xFFFFFFF x \b, length %d
>12 regex .{8} \b, type %s
0 string AmBs AMOS Basic memory banks
>4 beshort x \b, %d banks

259
magic/Magdir/android Normal file
View file

@ -0,0 +1,259 @@
#------------------------------------------------------------
# $File: android,v 1.24 2023/02/20 16:51:59 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
# Dalvik .dex format. http://retrodev.com/android/dexformat.html
# From <mkf@google.com> "Mike Fleming"
# Fixed to avoid regexec 17 errors on some dex files
# From <diff@lookout.com> "Tim Strazzere"
0 string dex\n
>0 regex dex\n[0-9]{2}\0 Dalvik dex file
>4 string >000 version %s
0 string dey\n
>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host)
>4 string >000 version %s
# Android bootimg format
# From https://android.googlesource.com/\
# platform/system/core/+/master/mkbootimg/bootimg.h
# https://github.com/djrbliss/loki/blob/master/loki.h#L43
0 string ANDROID! Android bootimg
>1024 string LOKI \b, LOKI'd
>>1028 lelong 0 \b (boot)
>>1028 lelong 1 \b (recovery)
>8 lelong >0 \b, kernel
>>12 lelong >0 \b (%#x)
>16 lelong >0 \b, ramdisk
>>20 lelong >0 \b (%#x)
>24 lelong >0 \b, second stage
>>28 lelong >0 \b (%#x)
>36 lelong >0 \b, page size: %d
>38 string >0 \b, name: %s
>64 string >0 \b, cmdline (%s)
# Android Backup archive
# From: Ariel Shkedi
# Update: Joerg Jenderek
# URL: https://github.com/android/platform_frameworks_base/blob/\
# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
# android/server/BackupManagerService.java#L2367
# Reference: https://sourceforge.net/projects/adbextractor/
# android-backup-extractor/perl/backupencrypt.pl
# Note: only unix line feeds "\n" found
# After the header comes a tar file
# If compressed, the entire tar file is compressed with JAVA deflate
#
# Include the version number hardcoded with the magic string to avoid
# false positives
0 string/b ANDROID\ BACKUP\n Android Backup
# maybe look for some more characteristics like linefeed '\n' or version
#>16 string \n
# No mime-type defined officially
!:mime application/x-google-ab
!:ext ab
# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2)
>15 string >\0 \b, version %s
# "1" on 3rd line means compressed
>17 string 0\n \b, Not-Compressed
>17 string 1\n \b, Compressed
# The 4th line is encryption "none" or "AES-256"
# any string as long as it's not the word none (which is matched below)
>19 string none\n \b, Not-Encrypted
# look for backup content after line with encryption info
#>>19 search/7 \n
# data part after header for not encrypted Android Backup
#>>>&0 ubequad x \b, content %#16.16llx...
# look for zlib compressed by ./compress after message with 1 space at end
#>>>&0 indirect x \b; contains
# look for tar archive block by ./archive for package name manifest
>>288 string ustar \b; contains
>>>31 use tar-file
# look for zip/jar archive by ./archive ./zip after message with 1 space at end
#>>2079 search/1025/s PK\003\004 \b; contains
#>>>&0 indirect x
>19 string !none
>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s)
# Commented out because they don't seem useful to print
# (but they are part of the header - the tar file comes after them):
# The 5th line is User Password Salt (128 Hex)
# string length too high with standard src configuration
#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s"
#>>>&1 regex/1l .* \b, Password salt: %s
# The 6th line is Master Key Checksum Salt (128 Hex)
#>>>>&1 regex/1l .* \b, Master salt: %s
# The 7th line is Number of PBDKF2 Rounds (10000)
#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s
# The 8th line is User key Initialization Vector (IV) (32 Hex)
#>>>>>>&1 regex/1l .* \b, IV: %s
#>>>>>>&1 regex/1l .* \b, IV: %s
# The 9th line is Master IV+Key+Checksum (192 Hex)
#>>>>>>>&1 regex/1l .* \b, Key: %s
# look for new line separator char after line number 9
#>>>0x204 ubyte 0x0a NL found
#>>>>&1 ubequad x \b, Content magic %16.16llx
# *.pit files by Joerg Jenderek
# https://forum.xda-developers.com/showthread.php?p=9122369
# https://forum.xda-developers.com/showthread.php?t=816449
# Partition Information Table for Samsung's smartphone with Android
# used by flash software Odin
0 ulelong 0x12349876
# 1st pit entry marker
>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# minimal 13 and maximal 18 PIT entries found
>>4 ulelong <128 Partition Information Table for Samsung smartphone
>>>4 ulelong x \b, %d entries
# 1. pit entry
>>>4 ulelong >0 \b; #1
>>>0x01C use PIT-entry
>>>4 ulelong >1 \b; #2
>>>0x0A0 use PIT-entry
>>>4 ulelong >2 \b; #3
>>>0x124 use PIT-entry
>>>4 ulelong >3 \b; #4
>>>0x1A8 use PIT-entry
>>>4 ulelong >4 \b; #5
>>>0x22C use PIT-entry
>>>4 ulelong >5 \b; #6
>>>0x2B0 use PIT-entry
>>>4 ulelong >6 \b; #7
>>>0x334 use PIT-entry
>>>4 ulelong >7 \b; #8
>>>0x3B8 use PIT-entry
>>>4 ulelong >8 \b; #9
>>>0x43C use PIT-entry
>>>4 ulelong >9 \b; #10
>>>0x4C0 use PIT-entry
>>>4 ulelong >10 \b; #11
>>>0x544 use PIT-entry
>>>4 ulelong >11 \b; #12
>>>0x5C8 use PIT-entry
>>>4 ulelong >12 \b; #13
>>>>0x64C use PIT-entry
# 14. pit entry
>>>4 ulelong >13 \b; #14
>>>>0x6D0 use PIT-entry
>>>4 ulelong >14 \b; #15
>>>0x754 use PIT-entry
>>>4 ulelong >15 \b; #16
>>>0x7D8 use PIT-entry
>>>4 ulelong >16 \b; #17
>>>0x85C use PIT-entry
# 18. pit entry
>>>4 ulelong >17 \b; #18
>>>0x8E0 use PIT-entry
0 name PIT-entry
# garbage value implies end of pit entries
>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# skip empty partition name
>>0x24 ubyte !0
# partition name
>>>0x24 string >\0 %-.32s
# flags
>>>0x0C ulelong&0x00000002 2 \b+RW
# partition ID:
# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER
# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
>>>0x08 ulelong x (%#x)
# filename
>>>0x44 string >\0 "%-.64s"
#>>>0x18 ulelong >0
# blocksize in 512 byte units ?
#>>>>0x18 ulelong x \b, %db
# partition size in blocks ?
#>>>>0x22 ulelong x \b*%d
# Android sparse img format
# From https://android.googlesource.com/\
# platform/system/core/+/master/libsparse/sparse_format.h
0 lelong 0xed26ff3a Android sparse image
>4 leshort x \b, version: %d
>6 leshort x \b.%d
>16 lelong x \b, Total of %d
>12 lelong x \b %d-byte output blocks in
>20 lelong x \b %d input chunks.
# Android binary XML magic
# In include/androidfw/ResourceTypes.h:
# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
# The strength is increased to avoid misidentifying as Targa image data
0 lelong 0x00080003 Android binary XML
!:strength +1
# Android cryptfs footer
# From https://android.googlesource.com/\
# platform/system/vold/+/refs/heads/master/cryptfs.h
0 lelong 0xd0b5b1c4 Android cryptfs footer
>4 leshort x \b, version: %d
>6 leshort x \b.%d
# Android Vdex format
# From https://android.googlesource.com/\
# platform/art/+/master/runtime/vdex_file.h
0 string vdex Android vdex file,
>4 string >000 verifier deps version: %s,
>8 string >000 dex section version: %s,
>12 lelong >0 number of dex files: %d,
>16 lelong >0 verifier deps size: %d
# Android Vdex format, dexfile is currently being updated
# by android system
# From https://android.googlesource.com/\
# platform/art/+/master/dex2oat/dex2oat.cc
0 string wdex Android vdex file, being processed by dex2oat,
>4 string >000 verifier deps version: %s,
>8 string >000 dex section version: %s,
>12 lelong >0 number of dex files: %d,
>16 lelong >0 verifier deps size: %d
# Disassembled DEX files
0 string/t .class\x20
>&0 regex/512 \^\\.super\x20L.*;$ disassembled Android DEX Java class (smali/baksmali)
!:ext smali
# Android ART (baseline) profile + metadata: baseline.prof, baseline.profm
# Reference: https://android.googlesource.com/platform/frameworks/support/\
# +/refs/heads/androidx-main/profileinstaller/profileinstaller/\
# src/main/java/androidx/profileinstaller/ProfileTranscoder.java
# Reference: https://android.googlesource.com/platform/frameworks/support/\
# +/refs/heads/androidx-main/profileinstaller/profileinstaller/\
# src/main/java/androidx/profileinstaller/ProfileVersion.java
0 string pro\x00
>0 regex pro\x000[0-9][0-9]\x00 Android ART profile
!:ext prof
>>4 string 001\x00 \b, version 001 N
>>4 string 005\x00 \b, version 005 O
>>4 string 009\x00 \b, version 009 O MR1
>>4 string 010\x00 \b, version 010 P
>>4 string 015\x00 \b, version 015 S
0 string prm\x00
>0 regex prm\x000[0-9][0-9]\x00 Android ART profile metadata
!:ext profm
>>4 string 001\x00 \b, version 001 N
>>4 string 002\x00 \b, version 002
# Android package resource table (ARSC): resources.arsc
# Reference: https://android.googlesource.com/platform/tools/base/\
# +/refs/heads/mirror-goog-studio-main/apkparser/binary-resources/\
# src/main/java/com/google/devrel/gmscore/tools/apk/arsc
# 00: resource table type = 0x0002 (2) + header size = 12 (2)
# 04: chunk size (4, skipped)
# 08: #packages (4)
0 ulelong 0x000c0002 Android package resource table (ARSC)
!:ext arsc
>8 ulelong !1 \b, %d packages
# 12: string pool type = 0x0001 (2) + header size = 28 (2)
# 16: chunk size (4, skipped)
# 20: #strings (4), #styles (4), flags (4)
>12 ulelong 0x001c0001
>>20 ulelong !0 \b, %d string(s)
>>24 ulelong !0 \b, %d style(s)
>>28 ulelong &1 \b, sorted
>>28 ulelong &256 \b, utf8
# extracted APK Signing Block
-16 string APK\x20Sig\x20Block\x2042 APK Signing Block

1206
magic/Magdir/animation Normal file
View file

File diff suppressed because it is too large Load diff

46
magic/Magdir/aout Normal file
View file

@ -0,0 +1,46 @@
#------------------------------------------------------------------------------
# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
# aout: file(1) magic for a.out executable/object/etc entries that
# handle executables on multiple platforms.
#
#
# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
# BSDI), netbsd, and vax (for UNIX/32V and BSD)
#
# XXX - is there anything we can look at to distinguish BSD/OS 386 from
# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag
# works only for binaries using shared libraries. Grabbing the entry
# point from the a.out header, using it to find the first code executed
# in the program, and looking at that might help.
#
0 lelong 0407 a.out little-endian 32-bit executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses BSD/OS shared libs)
0 lelong 0410 a.out little-endian 32-bit pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses BSD/OS shared libs)
0 lelong 0413 a.out little-endian 32-bit demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses BSD/OS shared libs)
#
# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
#
# XXX - is there anything we can look at to distinguish old SunOS 68010
# from old 68020 IRIX from old NetBSD? Again, I guess we could look at
# the first instruction or instructions in the program.
#
0 belong 0407 a.out big-endian 32-bit executable
>16 belong >0 not stripped
0 belong 0410 a.out big-endian 32-bit pure executable
>16 belong >0 not stripped
0 belong 0413 a.out big-endian 32-bit demand paged executable
>16 belong >0 not stripped

28
magic/Magdir/apache Executable file
View file

@ -0,0 +1,28 @@
#------------------------------------------------------------------------------
# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
# apache: file(1) magic for Apache Big Data formats
# Avro files
0 string Obj Apache Avro
>3 byte x version %d
# ORC files
# Important information is in file footer, which we can't index to :(
0 string ORC Apache ORC
# Parquet files
0 string PAR1 Apache Parquet
# Hive RC files
0 string RCF Apache Hive RC file
>3 byte x version %d
# Sequence files (and the careless first version of RC file)
0 string SEQ
>3 byte <6 Apache Hadoop Sequence file version %d
>3 byte >6 Apache Hadoop Sequence file version %d
>3 byte =6
>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0
>>3 default x Apache Hadoop Sequence file version 6

7
magic/Magdir/apl Normal file
View file

@ -0,0 +1,7 @@
#------------------------------------------------------------------------------
# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
# workspaces)
#
0 long 0100554 APL workspace (Ken's original?)

773
magic/Magdir/apple Normal file
View file

@ -0,0 +1,773 @@
#------------------------------------------------------------------------------
# $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
0 string \x0aGL Binary II (apple ][) data
0 string \x76\xff Squeezed (apple ][) data
0 string NuFile NuFile archive (apple ][) data
0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
0 belong 0x00051600 AppleSingle encoded Macintosh file
0 belong 0x00051607 AppleDouble encoded Macintosh file
# Type: Apple Emulator A2R format
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://applesaucefdc.com/a2r2-reference/
# Ref: https://applesaucefdc.com/a2r/
0 string A2R
>3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image
>3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image
>3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image
>8 string INFO
>>49 byte 01 \b, 5.25″ SS 40trk
>>49 byte 02 \b, 3.5″ DS 80trk
>>49 byte 03 \b, 5.25″ DS 80trk
>>49 byte 04 \b, 5.25″ DS 40trk
>>49 byte 05 \b, 3.5″ DS 80trk
>>49 byte 06 \b, 8″ DS
>>50 byte 01 \b, write protected
>>51 byte 01 \b, cross track synchronized
>>17 string/T x \b, %.32s
# Type: Apple Emulator WOZ format
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://applesaucefdc.com/woz/reference/
# Ref: https://applesaucefdc.com/woz/reference2/
0 string WOZ
>3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image
>3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image
>12 string INFO
>>21 byte 01 \b, 5.25 inch
>>21 byte 02 \b, 3.5 inch
>>22 byte 01 \b, write protected
>>23 byte 01 \b, cross track synchronized
>>25 string/T x \b, %.32s
# Type: Apple Macintosh Emulator MOOF format
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://applesaucefdc.com/moof-reference/
0 string MOOF
>4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image
>12 string INFO
>>21 byte 01 \b, SSDD GCR (400K)
>>21 byte 02 \b, DSDD GCR (800K)
>>21 byte 03 \b, DSHD MFM (1.44M)
>>22 byte 01 \b, write protected
>>23 byte 01 \b, cross track synchronized
>>25 string/T x \b, %.32s
# Type: Apple Emulator disk images
# From: Greg Wildman <greg@apple2.org.za>
# ProDOS boot loader?
0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image
# Detect Volume Directory block ($02)
>0x400 string \x00\x00\x03\x00
>>0x404 byte &0xF0
>>>0x405 string x \b, Volume /%s
>>>0x429 uleshort x \b, %u Blocks
# ProDOS ordered ?
>0xb00 string \x00\x00\x03\x00
>>0xb04 byte &0xF0
>>>0xb05 string x \b, Volume /%s
>>>0xb29 uleshort x \b, %u Blocks
#
# Proboot HD
0 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image
>0x400 string \x00\x00\x03\x00
>>0x404 byte &0xF0
>>>0x405 string x \b, Volume /%s
>>>0x429 uleshort x \b, %u Blocks
>0xb00 string \x00\x00\x03\x00
>>0xb04 byte &0xF0
>>>0xb05 string x \b, Volume /%s
>>>0xb29 uleshort x \b, %u Blocks
0 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image
>0x400 string \x00\x00\x03\x00
>>0x404 byte &0xF0
>>>0x405 string x \b, Volume /%s
>>>0x429 uleshort x \b, %u Blocks
>0xb00 string \x00\x00\x03\x00
>>0xb04 byte &0xF0
>>>0xb05 string x \b, Volume /%s
>>>0xb29 uleshort x \b, %u Blocks
0 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image
>0x400 string \x00\x00\x03\x00
>>0x404 byte &0xF0
>>>0x405 string x \b, Volume /%s
>>>0x429 uleshort x \b, %u Blocks
>0xb00 string \x00\x00\x03\x00
>>0xb04 byte &0xF0
>>>0xb05 string x \b, Volume /%s
>>>0xb29 uleshort x \b, %u Blocks
#
# ProDOS formatted
0 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image
>0x400 string \x00\x00\x03\x00
>>0x404 byte &0xF0
>>>0x405 string x \b, Volume /%s
>>>0x429 uleshort x \b, %u Blocks
>0xb00 string \x00\x00\x03\x00
>>0xb04 byte &0xF0
>>>0xb05 string x \b, Volume /%s
>>>0xb29 uleshort x \b, %u Blocks
0 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image
>0x400 string \x00\x00\x03\x00
>>0x404 byte &0xF0
>>>0x405 string x \b, Volume /%s
>>>0x429 uleshort x \b, %u Blocks
>0xb00 string \x00\x00\x03\x00
>>0xb04 byte &0xF0
>>>0xb05 string x \b, Volume /%s
>>>0xb29 uleshort x \b, %u Blocks
#
# DOS3 boot loader
0 string \x01\xA5\x27\xC9\x09\xD0
>0x11001 byte 0x11
>>0x11003 ubyte x Apple DOS 3.%u Image
>>0x11006 ubyte x \b, Volume #%03u
>>0x11034 ubyte x \b, %u Tracks
>>0x11035 ubyte x \b, %u Sectors
>>0x11036 uleshort x \b, %u bytes per sector
#
# DOS3 uninitialized disk
0 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A
>0x11001 byte 0x11
>>0x11003 ubyte x Apple DOS 3.%u Unbootable Image
>>>0x11006 ubyte x \b, Volume #%03u
>>>0x11034 ubyte x \b, %u Tracks
>>>0x11035 ubyte x \b, %u Sectors
>>>0x11036 uleshort x \b, %u bytes per sector
#
# Pascal boot loader?
0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
>0xd6 pstring SYSTEM.APPLE
>>0xb00 leshort 0x0000
>>>0xb04 leshort 0x0000 Apple Pascal Image
>>>>0xb06 pstring x \b, Volume %s:
>>>>0xb0e leshort x \b, %u Blocks
>>>>0xb10 leshort x \b, %u Files
#
# Diversi Dos boot loader?
0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image
>>0x11006 byte x \b, Volume %u
>>0x11034 byte x \b, %u Tracks
>>0x11035 byte x \b, %u Sectors
>>0x11036 leshort x \b, %u bytes per sector
# Type: Apple Emulator 2IMG format
# From: Radek Vokal <rvokal@redhat.com>
# Update: Greg Wildman <greg@apple2.org.za>
0 string 2IMG Apple ][ 2IMG Disk Image
>4 clear x
>4 string XGS! \b, XGS
>4 string CTKG \b, Catakig
>4 string ShIm \b, Sheppy's ImageMaker
>4 string SHEP \b, Sheppy's ImageMaker
>4 string WOOF \b, Sweet 16
>4 string B2TR \b, Bernie ][ the Rescue
>4 string \!nfc \b, ASIMOV2
>4 string \>BD\< \b, Brutal Deluxe's Cadius
>4 string CdrP \b, CiderPress
>4 string Vi][ \b, Virtual ][
>4 string PRFS \b, ProFUSE
>4 string FISH \b, FishWings
>4 string RVLW \b, Revival for Windows
>4 default x
>>4 string x \b, Creator tag "%-4.4s"
>0xc byte 00 \b, DOS 3.3 sector order
>>0x10 byte 00 \b, Volume 254
>>0x10 byte&0x7f x \b, Volume %u
>0xc byte 01 \b, ProDOS sector order
# Detect Volume Directory block ($02) + 2mg header offset
>>0x440 string \x00\x00\x03\x00
>>>0x444 byte &0xF0
>>>>0x445 string x \b, Volume /%s
>>>>0x469 uleshort x \b, %u Blocks
>0xc byte 02 \b, NIB data
# Type: Peter Ferrie QBoot
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://github.com/peterferrie/qboot
0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image
# Type: Peter Ferrie 0Boot
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://github.com/peterferrie/0boot
0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image
# Different proprietary boot sectors
0 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image
0 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image
0 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image
0 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image
0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image
0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image
0 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image
0 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image
0 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image
0 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image
0 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image
0 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image
0 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image
0 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image
0 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image
0 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image
0 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image
0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image
0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image
0 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image
0 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image
0 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image
0 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image
0 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image
0 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image
0 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image
0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image
0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image
0 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image
0 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image
0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image
0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image
0 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image
0 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image
0 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image
0 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
0 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
0 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
0 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image
0 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image
# magic for Newton PDA package formats
# from Ruda Moura <ruda@helllabs.org>
0 string package0 Newton package, NOS 1.x,
>12 belong &0x80000000 AutoRemove,
>12 belong &0x40000000 CopyProtect,
>12 belong &0x10000000 NoCompression,
>12 belong &0x04000000 Relocation,
>12 belong &0x02000000 UseFasterCompression,
>16 belong x version %d
0 string package1 Newton package, NOS 2.x,
>12 belong &0x80000000 AutoRemove,
>12 belong &0x40000000 CopyProtect,
>12 belong &0x10000000 NoCompression,
>12 belong &0x04000000 Relocation,
>12 belong &0x02000000 UseFasterCompression,
>16 belong x version %d
0 string package4 Newton package,
>8 byte 8 NOS 1.x,
>8 byte 9 NOS 2.x,
>12 belong &0x80000000 AutoRemove,
>12 belong &0x40000000 CopyProtect,
>12 belong &0x10000000 NoCompression,
# The following entries for the Apple II are for files that have
# been transferred as raw binary data from an Apple, without having
# been encapsulated by any of the above archivers.
#
# In general, Apple II formats are hard to identify because Apple DOS
# and especially Apple ProDOS have strong typing in the file system and
# therefore programmers never felt much need to include type information
# in the files themselves.
#
# Eric Fischer <enf@pobox.com>
# AppleWorks word processor:
# URL: https://en.wikipedia.org/wiki/AppleWorks
# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
# Update: Joerg Jenderek
# NOTE:
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.
# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
# the newer AppleWorks is from claris with extension CWK
4 string O
# test for unused bits of zoom- , paginated-boolean bytes
>84 ubequad ^0x00Fe00000000Fe00
# look for tabstop definitions "=" no tab, "|" no tab
# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
# unofficial "!" other , "\x8a" other
# official only if SFMinVers is nonzero
>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor
# AppleWorks Word Processor File (Apple II)
# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
# application/x-appleworks is mime type for claris version with cwk extension
!:mime application/x-appleworks3
# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
# $70 $1A $F8 $FF is this the apple type ?
#:apple pdosp^Z\xf8\xff
!:ext awp
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
>>>183 ubyte 30 3.0
>>>183 ubyte !30
>>>>183 ubyte !0 %#x
# usual tabstop start sequence "=====<"
>>>5 string x \b, tabstop ruler "%6.6s"
# tabstop ruler
#>>>5 string >\0 \b, tabstops "%-79s"
# zoom switch
>>>85 byte&0x01 >0 \b, zoomed
# whether paginated
>>>90 byte&0x01 >0 \b, paginated
# contains any mail-merge commands
>>>92 byte&0x01 >0 \b, with mail merge
# left margin in 1/10 inches ( normally 0 or 10 )
>>>91 ubyte >0
>>>>91 ubyte x \b, %d/10 inch left margin
# AppleWorks database:
#
# This isn't really a magic number, but it's the closest thing to one
# that I could find. The 1 and 2 really mean "order in which you defined
# categories" and "left to right, top to bottom," respectively; the D and R
# mean that the cursor should move either down or right when you press Return.
#30 string \x01D AppleWorks database data
#30 string \x02D AppleWorks database data
#30 string \x01R AppleWorks database data
#30 string \x02R AppleWorks database data
# AppleWorks spreadsheet:
#
# Likewise, this isn't really meant as a magic number. The R or C means
# row- or column-order recalculation; the A or M means automatic or manual
# recalculation.
#131 string RA AppleWorks spreadsheet data
#131 string RM AppleWorks spreadsheet data
#131 string CA AppleWorks spreadsheet data
#131 string CM AppleWorks spreadsheet data
# Applesoft BASIC:
#
# This is incredibly sloppy, but will be true if the program was
# written at its usual memory location of 2048 and its first line
# number is less than 256. Yuck.
# update by Joerg Jenderek at Feb 2013
# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
#0 belong&0xff00ff 0x80000 Applesoft BASIC program data
0 belong&0x00ff00ff 0x00080000
# assuming that line number must be positive
>2 leshort >0 Applesoft BASIC program data, first line number %d
#>2 leshort x \b, first line number %d
# ORCA/EZ assembler:
#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
#>5 byte x \b, build number %d
# Broderbund Fantavision
#
# I don't know what these values really mean, but they seem to recur.
# Will they cause too many conflicts?
# Probably :-)
#2 belong&0xFF00FF 0x040008 Fantavision movie data
# Some attempts at images.
#
# These are actually just bit-for-bit dumps of the frame buffer, so
# there's really no reasonably way to distinguish them except for their
# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
# or, occasionally, 8184.
#
# Nevertheless this will manage to catch a lot of images that happen
# to have a solid-colored line at the bottom of the screen.
# GRR: Magic too weak
#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
# Beagle Bros. Apple Mechanic fonts
0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
# Apple Universal Disk Image Format (UDIF) - dmg files.
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
# Note there might be some problems with the "VAX COFF executable"
# entry. Note this entry should be placed before the mac filesystem section,
# particularly the "Apple Partition data" entry.
#
# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn't then it is not of that type.
#
#0 long 0x7801730d
#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
#
# Note that this entry is recognized correctly by the "Apple Partition
# data" entry - however since this entry is more specific - this
# information seems to be more useful.
#0 long 0x45520200
#>0x410 string disk\ image UDIF read/write image (UDRW)
# From: Toby Peterson <toby@apple.com>
# From https://www.nationalarchives.gov.uk/pronom/fmt/866
0 string bplist00
>8 search/500 WebMainResource Apple Safari Webarchive
!:mime application/x-webarchive
!:strength +50
0 string bplist00 Apple binary property list
!:mime application/x-bplist
# Apple binary property list (bplist)
# Assumes version bytes are hex.
# Provides content hints for version 0 files. Assumes that the root
# object is the first object (true for CoreFoundation implementation).
# From: David Remahl <dremahl@apple.com>
0 string bplist
>6 byte x \bCoreFoundation binary property list data, version %#c
>>7 byte x \b%c
>6 string 00 \b
>>8 byte&0xF0 0x00 \b
>>>8 byte&0x0F 0x00 \b, root type: null
>>>8 byte&0x0F 0x08 \b, root type: false boolean
>>>8 byte&0x0F 0x09 \b, root type: true boolean
>>8 byte&0xF0 0x10 \b, root type: integer
>>8 byte&0xF0 0x20 \b, root type: real
>>8 byte&0xF0 0x30 \b, root type: date
>>8 byte&0xF0 0x40 \b, root type: data
>>8 byte&0xF0 0x50 \b, root type: ascii string
>>8 byte&0xF0 0x60 \b, root type: unicode string
>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
>>8 byte&0xF0 0xa0 \b, root type: array
>>8 byte&0xF0 0xd0 \b, root type: dictionary
# Apple/NeXT typedstream data
# Serialization format used by NeXT and Apple for various
# purposes in YellowStep/Cocoa, including some nib files.
# From: David Remahl <dremahl@apple.com>
2 string typedstream NeXT/Apple typedstream data, big endian
>0 byte x \b, version %d
>0 byte <5 \b
>>13 byte 0x81 \b
>>>14 ubeshort x \b, system %d
2 string streamtyped NeXT/Apple typedstream data, little endian
>0 byte x \b, version %d
>0 byte <5 \b
>>13 byte 0x81 \b
>>>14 uleshort x \b, system %d
#------------------------------------------------------------------------------
# CAF: Apple CoreAudio File Format
#
# Container format for high-end audio purposes.
# From: David Remahl <dremahl@apple.com>
#
0 string caff CoreAudio Format audio file
>4 beshort <10 version %d
>6 beshort x
#------------------------------------------------------------------------------
# Keychain database files
0 string kych Mac OS X Keychain File
#------------------------------------------------------------------------------
# Code Signing related file types
0 belong 0xfade0c00 Mac OS X Code Requirement
>8 belong 1 (opExpr)
>4 belong x - %d bytes
0 belong 0xfade0c01 Mac OS X Code Requirement Set
>8 belong >1 containing %d items
>4 belong x - %d bytes
0 belong 0xfade0c02 Mac OS X Code Directory
>8 belong x version %x
>12 belong >0 flags %#x
>4 belong x - %d bytes
0 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable)
>4 belong x - %d bytes
0 belong 0xfade0cc1 Mac OS X Detached Code Signature
>8 belong >1 (%d elements)
>4 belong x - %d bytes
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
# .vdi
4 string innotek\ VirtualBox\ Disk\ Image %s
# Apple disk partition stuff
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
# Update: Joerg Jenderek
# "ER" is APPLE_DRVR_MAP_MAGIC signature
0 beshort 0x4552
# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
#!:strength +0
# strengthen the magic by looking for used blocksizes 512 2048
>2 ubeshort&0xf1FF 0 Apple Driver Map
# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
#>>504 ubequad&0x0000FFffFFff0000 0
!:mime application/x-apple-diskimage
!:apple ????devr
# https://en.wikipedia.org/wiki/Apple_Disk_Image
!:ext dmg/iso
# sbBlkSize for driver descriptor map 512 2048
>>2 beshort x \b, blocksize %d
# sbBlkCount sometimes garbish like
# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
# 0xf2720100 for bunziped Firefox 48.0-2.dmg
# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
# 0x00009090 by syslinux-6.03/utils/isohybrid.c
>>4 ubelong x \b, blockcount %u
# following device/driver information not very useful
# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>8 ubeshort x \b, devtype %u
# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>10 ubeshort x \b, devid %u
# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>12 ubelong >0
>>>12 ubelong x \b, driver data %u
# number of driver descriptors sbDrvrCount <= 61
# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>16 ubeshort x \b, driver count %u
# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
# >>18 use apple-driver-map
# >>26 use apple-driver-map
# # ...
# >>500 use apple-driver-map
# number of partitions is always same in every partition (map block count)
#>>0x0204 ubelong x \b, %u partitions
>>0x0204 ubelong >0 \b, contains[@0x200]:
>>>0x0200 use apple-apm
>>0x0204 ubelong >1 \b, contains[@0x400]:
>>>0x0400 use apple-apm
>>0x0204 ubelong >2 \b, contains[@0x600]:
>>>0x0600 use apple-apm
>>0x0204 ubelong >3 \b, contains[@0x800]:
>>>0x0800 use apple-apm
>>0x0204 ubelong >4 \b, contains[@0xA00]:
>>>0x0A00 use apple-apm
>>0x0204 ubelong >5 \b, contains[@0xC00]:
>>>0x0C00 use apple-apm
>>0x0204 ubelong >6 \b, contains[@0xE00]:
>>>0x0E00 use apple-apm
>>0x0204 ubelong >7 \b, contains[@0x1000]:
>>>0x1000 use apple-apm
# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
0 name apple-driver-map
>0 ubequad !0
# descBlock first block of driver
>>0 ubelong x \b, driver start block %u
# descSize driver size in blocks
>>4 ubeshort x \b, size %u
# descType driver system type 1 701h F8FFh FFFFh
>>6 ubeshort x \b, type %#x
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
# Update: Joerg Jenderek
# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
# for apple partition map stored as a single file
0 belong 0x504d0000
# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
#!:strength +0
>0 use apple-apm
# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file: could not find any valid magic files!
#!:ext bin
# display apple partition map. Normally called after Apple driver map
0 name apple-apm
>0 belong 0x504d0000 Apple Partition Map
# number of partitions
>>4 ubelong x \b, map block count %u
# logical block (512 bytes) start of partition
>>8 ubelong x \b, start block %u
>>12 ubelong x \b, block count %u
>>16 string >0 \b, name %s
>>48 string >0 \b, type %s
# processor type dpme_process_id[16] e.g. "68000" "68020"
>>120 string >0 \b, processor %s
# A/UX boot arguments BootArgs[128]
>>136 string >0 \b, boot arguments %s
# status of partition dpme_flags
>>88 belong & 1 \b, valid
>>88 belong & 2 \b, allocated
>>88 belong & 4 \b, in use
>>88 belong & 8 \b, has boot info
>>88 belong & 16 \b, readable
>>88 belong & 32 \b, writable
>>88 belong & 64 \b, pic boot code
>>88 belong & 128 \b, chain compatible driver
>>88 belong & 256 \b, real driver
>>88 belong & 512 \b, chain driver
# mount automatically at startup APPLE_PS_AUTO_MOUNT
>>88 ubelong &0x40000000 \b, mount at startup
# is the startup partition APPLE_PS_STARTUP
>>88 ubelong &0x80000000 \b, is the startup partition
#https://wiki.mozilla.org/DS_Store_File_Format
#https://en.wikipedia.org/wiki/.DS_Store
0 string \0\0\0\1Bud1\0 Apple Desktop Services Store
# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
# Usually not in separate files, but have either filename rsrc with
# no extension, or a filename corresponding to another file, with
# extensions rsr/rsrc
# URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file
# https://en.wikipedia.org/wiki/Resource_fork
# Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
# http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf
# https://formats.kaitai.io/resource_fork/
# Update: Joerg Jenderek
# Note: verified often by command like `deark -m macrsrc Icon_.rsrc`
# offset of resource data; usually starts at offset 0x0100
0 string \000\000\001\000
# skip NPETraceSession.etl with invalid "low" map offset 0
>4 ubelong >0xFF
# skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length
>>12 ubelong <0x8001
# most examples with zeroed system reserved field
>>>16 lelong =0
>>>>0 use apple-rsr
# few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont
>>>16 lelong !0
# resource fork variant with not zeroed system reserved field and copy of header
>>>>(4.L) ubelong 0x100
# GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont)
>>>>>0 use apple-rsr
# data fork variant with not zeroed system reserved field and no copy of header
>>>>(4.L) ubelong 0
>>>>>0 use apple-rsr
# Note: moved and merged from ./macintosh
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
# don't know what they mean.
# display information about Mac OSX datafork font DFONT
0 name apple-dfont
>(4.L+30) ubelong x Mac OSX datafork font,
# https://en.wikipedia.org/wiki/Datafork_TrueType
!:mime application/x-dfont
!:ext dfont
# https://exiftool.org/TagNames/RSRC.html
>(4.L+30) ubelong 0x73666e74 TrueType
>(4.L+30) ubelong 0x464f4e54 'FONT'
>(4.L+30) ubelong 0x4e464e54 'NFNT'
>(4.L+30) ubelong 0x504f5354 PostScript
>(4.L+30) ubelong 0x464f4e44 'FOND'
>(4.L+30) ubelong 0x76657273 'vers'
# display information about Macintosh resource
0 name apple-rsr
>(4.L+30) ubelong 0x73666e74
>>0 use apple-dfont
>(4.L+30) ubelong 0x464f4e54
>>0 use apple-dfont
>(4.L+30) ubelong 0x4e464e54
>>0 use apple-dfont
>(4.L+30) ubelong 0x504f5354
>>0 use apple-dfont
>(4.L+30) ubelong 0x464f4e44
>>0 use apple-dfont
>(4.L+30) ubelong 0x76657273
>>0 use apple-dfont
>(4.L+30) default x Apple HFS/HFS+ resource fork
#!:mime application/octet-stream
!:mime application/x-apple-rsr
!:ext rsrc/rsr
# offset to resource data; usually starts at offset 0x0100
>0 ubelong !0x100 \b, data offset %#x
# offset to resource map; positive but not nil like in NPETraceSession.etl
>4 ubelong x \b, map offset %#x
# length of resource map; positive with 32K limitation but not
# nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1
>12 ubelong x \b, map length %#x
# length of resource data; positive but not nil like in NPETraceSession.etl
>8 ubelong x \b, data length %#x
# reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont
>16 ubelong !0 \b, at 16 %#8.8x
# https://fontforge.org/docs/techref/macformats.html
# jump to resource map
# a copy of resource header or 16 bytes of zeros for data fork
#>(4.L) ubelong x \b, DATA offset %#x
#>(4.L+4) ubelong x \b, MAP offset %#x
#>(4.L+8) ubelong x \b, DATA length %#x
#>(4.L+12) ubelong x \b, MAP length %#x
# nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero
>(4.L+16) ubelong !0 \b, nextResourceMap %#x
# fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero
>(4.L+20) ubeshort !0 \b, fileRef %#x
# attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero
>(4.L+22) ubeshort !0 \b, attributes %#x
# typeListOffset; offset from resource map to start of type list like: 1Ch
>(4.L+24) ubeshort x \b, list offset %#x
# nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont)
>(4.L+26) ubeshort x \b, name offset %#x
# typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF
>(4.L+28) beshort+1 >0 \b, %u type
# plural s
>>(4.L+28) beshort+1 >1 \bs
# resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz
>>(4.L+30) ubelong x \b, %#x
>>(4.L+30) string x '%-.4s'
# resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000
>>(4.L+34) beshort+1 x * %d
# resourceListOffset; offset from type list to resource list like: Ah 12h DAh
>(4.L+36) ubeshort x resource offset %#x
#https://en.wikipedia.org/wiki/AppleScript
0 string FasdUAS AppleScript compiled
# AppleWorks/ClarisWorks
# https://github.com/joshenders/appleworks_format
# http://fileformats.archiveteam.org/wiki/AppleWorks
0 name appleworks
>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document
>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document
>0 default x
>>0 belong x AppleWorks/ClarisWorks CWK Document
>0 byte x \b, version %d
>30 beshort x \b, %d
>32 beshort x \bx%d
!:ext cwk
4 string BOBO
>0 byte >4
>>12 belong 0
>>>26 belong 0
>>>>0 use appleworks
>0 belong 0x0481ad00
>>0 use appleworks
# magic for Apple File System (APFS)
# from Alex Myczko <alex@aiei.ch>
32 string NXSB Apple File System (APFS)
>36 ulelong x \b, blocksize %u
# iTunes cover art (versions 1 and 2)
4 string itch
>24 string artw
>>0x1e8 string data iTunes cover art
>>>0x1ed string PNG (PNG)
>>>0x1ec beshort 0xffd8 (JPEG)
# MacPaint image
65 string PNTGMPNT MacPaint image data
#0 belong 2 MacPaint image data

7
magic/Magdir/application Normal file
View file

@ -0,0 +1,7 @@
#------------------------------------------------------------------------------
# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
# application: file(1) magic for applications on small devices
#
# Pebble Application
0 string PBLAPP\000\000 Pebble application

13
magic/Magdir/applix Normal file
View file

@ -0,0 +1,13 @@
#------------------------------------------------------------------------------
# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
# applix: file(1) magic for Applixware
# From: Peter Soos <sp@osb.hu>
#
0 string *BEGIN Applixware
>7 string WORDS Words Document
>7 string GRAPHICS Graphic
>7 string RASTER Bitmap
>7 string SPREADSHEETS Spreadsheet
>7 string MACRO Macro
>7 string BUILDER Builder Object

52
magic/Magdir/apt Normal file
View file

@ -0,0 +1,52 @@
#------------------------------------------------------------------------------
# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
# apt: file(1) magic for APT Cache files
# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
# before version 10 ("old format"), data was in arch-specific long/short
# old format 64 bit
0 name apt-cache-64bit-be
>12 beshort 1 \b, dirty
>40 bequad x \b, %llu packages
>48 bequad x \b, %llu versions
# old format 32 bit
0 name apt-cache-32bit-be
>8 beshort 1 \b, dirty
>40 belong x \b, %u packages
>44 belong x \b, %u versions
# new format
0 name apt-cache-be
>6 byte 1 \b, dirty
>24 belong x \b, %u packages
>28 belong x \b, %u versions
0 bequad 0x98FE76DC
>8 ubeshort <10 APT cache data, version %u
>>10 beshort x \b.%u, 64 bit big-endian
>>0 use apt-cache-64bit-be
0 lequad 0x98FE76DC
>8 uleshort <10 APT cache data, version %u
>>10 leshort x \b.%u, 64 bit little-endian
>>0 use \^apt-cache-64bit-be
0 belong 0x98FE76DC
>4 ubeshort <10 APT cache data, version %u
>>6 ubeshort x \b.%u, 32 bit big-endian
>>0 use apt-cache-32bit-be
>4 ubyte >9 APT cache data, version %u
>>5 ubyte x \b.%u, big-endian
>>0 use apt-cache-be
0 lelong 0x98FE76DC
>4 uleshort <10 APT cache data, version %u
>>6 uleshort x \b.%u, 32 bit little-endian
>>0 use \^apt-cache-32bit-be
>4 ubyte >9 APT cache data, version %u
>>5 ubyte x \b.%u, little-endian
>>0 use \^apt-cache-be

2607
magic/Magdir/archive Normal file
View file

File diff suppressed because it is too large Load diff

38
magic/Magdir/aria Normal file
View file

@ -0,0 +1,38 @@
#------------------------------------------------------------------------------
# URL: https://de.wikipedia.org/wiki/Aria_(Software)
# Reference: https://github.com/aria2/aria2/blob/master/doc/manual-src/en/technical-notes.rst
# From: Joerg Jenderek
# Note: only version 1 suited
# check for valid version one
0 beshort 0x0001
# skip most uncompressed DEGAS med-res bitmap *.PI2 and GEM bitmap (v1) *.IMG
# by test for valid infoHashCheck extension
>2 ubelong&0xffFFffFE 0x00000000
# skip DEGAS med-res bitmap DIAGRAM1.PI2 by test for valid length of download
>>(6.L+14) ubequad >0
>>>0 use aria
0 name aria
# version; (0x0000) or (0x0001); for 0 all multi-byte are in host byte order. For 1 big endian
>0 beshort x aria2 control file, version %u
#!:mime application/octet-stream
!:mime application/x-aria
!:ext aria2
# EXTension; if EXT[3]&1 == 1 checks whether saved InfoHash and current downloading the same; infoHashCheck extension
>2 ubelong !0 \b, infoHashCheck %#x
# info hash length like: 0 14h
>6 ubelong !0 \b, %#x bytes info hash
# info hash; BitTorrent InfoHash
>>10 ubequad x %#16.16llx...
# piece length; the length of the piece like: 400h 100000h
>(6.L+10) ubelong x \b, piece length 0x%x
# total length; the total length of the download
>(6.L+14) ubequad x \b, total length %llu
#>(6.L+14) ubequad x \b, total length %#llx
# upload length; the uploaded length of download like: 0 400h
>(6.L+22) ubequad !0 \b, upload length %#llx
# bitfield length; the length of bitfield like: 4 6 Ah 10h 13h 167h
>(6.L+30) ubelong x \b, %#x bytes bitfield
# bitfield; bitfield which represents current download progress
>(6.L+34) ubequad !0 %#llx...

50
magic/Magdir/arm Normal file
View file

@ -0,0 +1,50 @@
#------------------------------------------------------------------------------
# $File: arm,v 1.3 2022/10/31 14:35:39 christos Exp $
# arm: file(1) magic for ARM COFF
#
# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
# Aarch64
0 leshort 0xaa64
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARM
0 leshort 0x01c0
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARM Thumb
0 leshort 0x01c2
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARMv7 Thumb
0 leshort 0x01c4
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARM64EC
0 leshort 0xa641
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10

132
magic/Magdir/asf Normal file
View file

@ -0,0 +1,132 @@
#------------------------------------------------------------------------------
# $File: asf,v 1.4 2022/10/31 13:22:26 christos Exp $
# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files
# http://www.staroceans.org/e-book/ASF_Specification.pdf
0 name asf-name
# ASF_Data_Object
#>0 guid 75B22636-668E-11CF-A6D9-00AA0062CE6C
#>16 lequad >0
#>>(16.q) use asf-object
# ASF_Simple_Index_Object
>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB
>0 guid D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object
>0 guid FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object
>0 guid 3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object
# ASF_File_Properties_Object
>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365
# ASF_Stream_Properties_Object
>0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365
#>>56 lequad x Time Offset %lld
#>>64 lelong x Type-Specific Data Length %d
#>>68 lelong x Error Correction Data Length %d
#>>72 leshort x Flags %#x
#>>74 lelong x Reserved %x
# ASF_Audio_Media
>>24 guid F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media (
>>>78 leshort x \bCodec Id %d
>>>80 leshort x \b, Number of channels %d
>>>82 lelong x \b, Samples Per Second %d
>>>86 lelong x \b, Average Number of Bytes Per Second %d
>>>90 lelong x \b, Block Alignment %d
>>>94 leshort x \b, Bits Per Sample %d
# ASF_Video_Media
>>24 guid BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media (
>>>78 lelong x \bEncoded Image Width %d
>>>82 lelong x \b, Encoded Image Height %d
#>>>85 leshort x \b, Format Data Size %x
>>>93 lelong x \b, Image Width %d
>>>97 lelong x \b, Image Height %d
#>>>101 leshort x \b, Reserved %#x
>>>103 leshort x \b, Bits Per Pixel Count %d
#>>>105 lelong x \b, Compression ID %d
#>>>109 lelong x \b, Image Size %d
#>>>113 lelong x \b, Horizontal Pixels Per Meter %d
#>>>117 lelong x \b, Vertical Pixels Per Meter %d
#>>>121 lelong x \b, Colors Used Count %d
#>>>125 lelong x \b, Important Colors Count %d
>>0 lelong x \b, Error correction type
>>40 use asf-name
>>0 lelong x \b)
#ASF_Header_Extension_Object
>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365
# ASF_Codec_List_Object
>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6
>0 guid 1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object
>0 guid F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object
>0 guid D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object
>0 guid 75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object
# ASF_Content_Description_Object
>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C
#>>24 leshort title length %d
#>>26 leshort author length %d
#>>28 leshort copyright length %d
#>>30 leshort descriptor length %d
#>>32 leshort rating length %d
>0 guid D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object
>0 guid 2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object
>0 guid 7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object
>0 guid 2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object
>0 guid 298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object
>0 guid 2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object
# ASF_Padding_Object
>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8
>0 guid 14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object
>0 guid A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object
>0 guid D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object
>0 guid D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object
>0 guid A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object
>0 guid 7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object
>0 guid C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object
>0 guid 44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object
>0 guid D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object
>0 guid 6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object
>0 guid F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object
>0 guid 26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object
>0 guid 43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object
>0 guid 59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media
>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C442B ASF_JFIF_Media
>0 guid 35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media
>0 guid 91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media
>0 guid 3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media
>0 guid 776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype
>0 guid DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format
>0 guid 20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction
>0 guid BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread
>0 guid ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1
>0 guid 7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM
# _Network_Devices
>0 guid 86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2
>0 guid 4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3
>0 guid 4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4
>0 guid D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language
>0 guid D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate
>0 guid D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown
>0 guid AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive
>0 guid AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial
>0 guid 399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode
>0 guid E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name
>0 guid D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type
>0 guid 1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio
>0 guid C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration
>0 guid 6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID
>0 guid 00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG
0 name asf-object
>0 use asf-name
#>>16 lequad >0 (size %lld) [
>>16 lequad >0
>>>(16.q) use asf-object
#>>16 lequad 0 ]
# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
0 guid 75B22630-668E-11CF-A6D9-00AA0062CE6C Microsoft ASF
!:mime video/x-ms-asf
#>16 lequad >0 (size %lld
#>>24 lelong x \b, %d header objects)
>16 lequad >0
>>30 use asf-object
>>(16.q) use asf-object

18
magic/Magdir/assembler Normal file
View file

@ -0,0 +1,18 @@
#------------------------------------------------------------------------------
# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
# make: file(1) magic for assembler source
#
0 regex \^[\040\t]{0,50}\\.asciiz assembler source text
!:mime text/x-asm
0 regex \^[\040\t]{0,50}\\.byte assembler source text
!:mime text/x-asm
0 regex \^[\040\t]{0,50}\\.even assembler source text
!:mime text/x-asm
0 regex \^[\040\t]{0,50}\\.globl assembler source text
!:mime text/x-asm
0 regex \^[\040\t]{0,50}\\.text assembler source text
!:mime text/x-asm
0 regex \^[\040\t]{0,50}\\.file assembler source text
!:mime text/x-asm
0 regex \^[\040\t]{0,50}\\.type assembler source text
!:mime text/x-asm

18
magic/Magdir/asterix Normal file
View file

@ -0,0 +1,18 @@
#------------------------------------------------------------------------------
# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
# From: guy@netapp.com (Guy Harris)
#
0 string *STA Aster*x
>7 string WORD Words Document
>7 string GRAP Graphic
>7 string SPRE Spreadsheet
>7 string MACR Macro
0 string 2278 Aster*x Version 2
>29 byte 0x36 Words Document
>29 byte 0x35 Graphic
>29 byte 0x32 Spreadsheet
>29 byte 0x38 Macro

41
magic/Magdir/att3b Normal file
View file

@ -0,0 +1,41 @@
#------------------------------------------------------------------------------
# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
# The 3B20 conflicts with SCCS.
#0 beshort 0550 3b20 COFF executable
#>12 belong >0 not stripped
#>22 beshort >0 - version %d
#0 beshort 0551 3b20 COFF executable (TV)
#>12 belong >0 not stripped
#>22 beshort >0 - version %d
#
# WE32K
#
0 beshort 0560 WE32000 COFF
>18 beshort ^00000020 object
>18 beshort &00000020 executable
>12 belong >0 not stripped
>18 beshort ^00010000 N/A on 3b2/300 w/paging
>18 beshort &00020000 32100 required
>18 beshort &00040000 and MAU hardware required
>20 beshort 0407 (impure)
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0443 (target shared library)
>22 beshort >0 - version %d
0 beshort 0561 WE32000 COFF executable (TV)
>12 belong >0 not stripped
#>18 beshort &00020000 - 32100 required
#>18 beshort &00040000 and MAU hardware required
#>22 beshort >0 - version %d
#
# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
>364 string >\0 of '%s'

1291
magic/Magdir/audio Normal file
View file

File diff suppressed because it is too large Load diff

33
magic/Magdir/avm Normal file
View file

@ -0,0 +1,33 @@
#------------------------------------------------------------------------------
# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $
# avm: file(1) magic for avm files; this is not use
# Summary: FRITZ!Box router configuration backup
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Fritz!Box
# Reference: http://www.mengelke.de/Projekte/FritzBoxTools2
# Note: only tested with models 4040 and 6490 Cable (lgi)
0 string ****\ FRITZ!Box\ FRITZ!Box configuration backup
#!:mime text/plain
!:mime application/x-avm-export
!:ext export
# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT"
>15 string x of %-.4s
# on 2nd line hashed password
#>41 search/54 Password= \b, password
# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83
>41 search/172 FirmwareVersion= \b, firmware version
>>&0 string x %s
# on 5th line oem like: avme lgi
>41 search/285 OEM= \b, oem
>>&0 string x %s
# on 7th line language like: de en
>41 search/305 Language= \b, language
>>&0 string x %s
# on 10th line cfg file name like: /var/tmp.cfg
>41 search/349 tmp.cfg
# on 11th line date inside c-comment like: Thu Jun 4 22:25:19 2015
>>&4 string x \b, %s
#

18
magic/Magdir/basis Normal file
View file

@ -0,0 +1,18 @@
#----------------------------------------------------------------
# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $
# basis: file(1) magic for BBx/Pro5-files
# Oliver Dammer <dammer@olida.de> 2005/11/07
# https://www.basis.com business-basic-files.
#
0 string \074\074bbx\076\076 BBx
>7 string \000 indexed file
>7 string \001 serial file
>7 string \002 keyed file
>>13 short 0 (sort)
>7 string \004 program
>>18 byte x (LEVEL %d)
>>>23 string >\000 psaved
>7 string \006 mkeyed file
>>13 short 0 (sort)
>>8 string \000 (mkey)

7
magic/Magdir/beetle Normal file
View file

@ -0,0 +1,7 @@
#------------------------------------------------------------------------------
# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $
# beetle: file(1) magic for Beetle VM object files
# https://github.com/rrthomas/beetle/
# Beetle object module
0 string BEETLE\000 Beetle VM object file

65
magic/Magdir/ber Normal file
View file

@ -0,0 +1,65 @@
#------------------------------------------------------------------------------
# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
# ber: file(1) magic for several BER formats used in the mobile
# telecommunications industry (Georg Sauthoff)
# The file formats are standardized by the GSMA (GSM association).
# They are specified via ASN.1 schemas and some prose. Basic encoding
# rules (BER) is the used encoding. The formats are used for exchanging
# call data records (CDRs) between mobile operators and associated
# parties for roaming clearing purposes and fraud detection.
# The magic file covers:
# - TAP files (TD.57) - CDR batches and notifications
# - RAP files (TD.32) - return batches and acknowledgements
# - NRT files (TD.35) - CDR batches for 'near real time' processing
#
# TAP 3 Files
# TAP -> Transferred Account Procedure
# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
# TransferBatch short tag
0 byte 0x61
# BatchControlInfo short tag
>&1 search/b5 \x64
# Sender long tag #TAP 3.x (BER encoded)
>>&1 search/b8 \x5f\x81\x44
# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account)
# Notification short tag
0 byte 0x62
# Sender long tag
>2 search/b8 \x5f\x81\x44
# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account)
# NRT Files
# NRT a.k.a. NRTRDE
0 byte 0x61
# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01
>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
# RAP Files
# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
# Long ReturnBatch tag
0 string \x7f\x84\x16
# Long RapBatchControlInfo tag
>&1 search/b8 \x7f\x84\x19
# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure),
>>>&0 byte x TAP 3.%d
# Long Acknowledgement tag
0 string \x7f\x84\x17
# Long Sender tag
>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure)

14
magic/Magdir/bflt Normal file
View file

@ -0,0 +1,14 @@
#------------------------------------------------------------------------------
# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
# bFLT: file(1) magic for BFLT uclinux binary files
#
# From Philippe De Muyter <phdm@macqel.be>
#
0 string bFLT BFLT executable
>4 belong x - version %d
>4 belong 4
>>36 belong&0x1 0x1 ram
>>36 belong&0x2 0x2 gotpic
>>36 belong&0x4 0x4 gzip
>>36 belong&0x8 0x8 gzdata

10
magic/Magdir/bhl Normal file
View file

@ -0,0 +1,10 @@
#------------------------------------------------------------------------------
# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
# BlockHashLoc
# ext: bhl
# Marco Pontello marcopon@gmail.com
# reference: https://github.com/MarcoPon/BlockHashLoc
0 string BlockHashLoc\x1a BlockHashLoc recovery info,
>13 byte x version %d
!:ext bhl

178
magic/Magdir/bioinformatics Normal file
View file

@ -0,0 +1,178 @@
#------------------------------------------------------------------------------
# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $
# bioinfomatics: file(1) magic for Bioinfomatics file formats
###############################################################################
# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
###############################################################################
0 string \037\213
>3 byte &0x04
>>12 string BC
>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible)
>>>>16 leshort x \b, block length %d
!:mime application/x-gzip
###############################################################################
# Tabix index file
# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
###############################################################################
0 string TBI\1 SAMtools TBI (Tabix index format)
>0x04 lelong =1 \b, with %d reference sequence
>0x04 lelong >1 \b, with %d reference sequences
>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style)
>0x08 lelong ^0x10000
>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style)
>>0x08 lelong =1 \b, using SAM format
>>0x08 lelong =2 \b, using VCF format
>0x0c lelong x \b, sequence name column: %d
>0x10 lelong x \b, region start column: %d
>0x08 lelong =0
>>0x14 lelong x \b, region end column: %d
>0x18 byte x \b, comment character: %c
>0x1c lelong x \b, skip line count: %d
###############################################################################
# BAM (Binary Sequence Alignment/Map format)
# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map)
>0x04 lelong >0
>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header
>>>&0 regex =[0-9.]+ \b version %s
>>&(0x04) lelong >0 \b, with %d reference sequences
###############################################################################
# BAI (BAM indexing format)
# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
###############################################################################
0 string BAI\1 SAMtools BAI (BAM indexing format)
>0x04 lelong >0 \b, with %d reference sequences
###############################################################################
# CRAM (Binary Sequence Alignment/Map format)
###############################################################################
0 string CRAM CRAM
>0x04 byte >-1 version %d.
>0x05 byte >-1 \b%d
>0x06 string >\0 (identified as %s)
###############################################################################
# BCF (Binary Call Format), version 1
# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0 string BCF\4
# length of seqnm data in bytes is positive
>&0x00 lelong >0
# length of smpl data in bytes is positive
>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format)
# length of meta in bytes
>>>&(&-0x04) lelong >0
# have meta text string
>>>>&0x00 search ##samtoolsVersion=
>>>>>&0x00 string x \b, generated by SAMtools version %s
###############################################################################
# BCF (Binary Call Format), version 2.1
# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0 string BCF\2\1 Binary Call Format (BCF) version 2.1
# length of header text
>&0x00 lelong >0
# have header string
>>&0x00 search ##samtoolsVersion=
>>>&0x00 string x \b, generated by SAMtools version %s
###############################################################################
# BCF (Binary Call Format), version 2.2
# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0 string BCF\2\2 Binary Call Format (BCF) version 2.2
# length of header text
>&0x00 lelong >0
# have header string
>>&0x00 search ##samtoolsVersion=
>>>&0x00 string x \b, generated by SAMtools version %s
###############################################################################
# VCF (Variant Call Format)
# used by VCFtools (http://vcftools.sourceforge.net/)
###############################################################################
0 search ##fileformat=VCFv Variant Call Format (VCF)
>&0 string x \b version %s
###############################################################################
# FASTQ
# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
###############################################################################
# XXX Broken?
# @<seqname>
#0 regex =^@[A-Za-z0-9_.:-]+\?\n
# <seq>
#>&1 regex =^[A-Za-z\n.~]++
# +[<seqname>]
#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n
# <qual>
#>>>&1 regex =^[!-~\n]+\n FASTQ
###############################################################################
# FASTA
# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
###############################################################################
#0 byte 0x3e
# q>0 regex =^[>][!-~\t\ ]+$
# Amino Acid codes: [A-IK-Z*-]+
#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA
# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
# not in IUPAC codes/gaps: [EFIJLOPQZ]
#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes
#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes
###############################################################################
# SAM (Sequence Alignment/Map format)
# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
###############################################################################
# Short-cut version to recognise SAM files with (optional) header at beginning
###############################################################################
0 string @HD\t
>4 search VN: Sequence Alignment/Map (SAM), with header
>>&0 regex [0-9.]+ \b version %s
###############################################################################
# Longer version to recognise SAM alignment lines using (many) regexes
###############################################################################
# SAM Alignment QNAME
0 regex =^[!-?A-~]{1,255}(\t[^\t]+){11}
# SAM Alignment FLAG
>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t
# SAM Alignment RNAME
>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t
# SAM Alignment POS
>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t
# SAM Alignment MAPQ
>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t
# SAM Alignment CIGAR
>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t
# SAM Alignment RNEXT
>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t
# SAM Alignment PNEXT
>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t
# SAM Alignment TLEN
>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t
# SAM Alignment SEQ
>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
# SAM Alignment QUAL
>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM)
>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header
>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s

154
magic/Magdir/biosig Normal file
View file

@ -0,0 +1,154 @@
##############################################################################
#
# Magic ids for biomedical signal file formats
# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
#
# The list has been derived from biosig projects
# http://biosig.sourceforge.net
# https://pub.ist.ac.at/~schloegl/matlab/eeg/
# https://pub.ist.ac.at/~schloegl/biosig/TESTED
#
##############################################################################
#
0 string ABF\x20 Biosig/Axon Binary format
!:mime biosig/abf2
0 string ABF2\0\0 Biosig/Axon Binary format
!:mime biosig/abf2
#
0 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows
!:mime biosig/ates
#
0 string ATF\x09 Biosig/Axon Text format
!:mime biosig/atf
#
0 string ADU1 Biosig/Axona file format
!:mime biosig/axona
0 string ADU2 Biosig/Axona file format
!:mime biosig/axona
#
0 string ALPHA-TRACE-MEDICAL Biosig/alpha trace
!:mime biosig/alpha
#
0 string AxGr Biosig/AXG
0 string axgx Biosig/AXG
!:mime biosig/axg
#
0 string HeaderLen= Biosig/BCI2000
0 string BCI2000V Biosig/BCI2000
!:mime biosig/bci2000
#
### Specification: https://www.biosemi.com/faq/file_format.htm
0 string \xffBIOSEMI Biosig/Biosemi data format
!:mime biosig/bdf
#
0 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file
0 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file
0 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file
!:mime biosig/brainvision
#
0 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format
!:mime biosig/ced
#
### Specification: https://www.edfplus.info/specs/index.html
0 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format
!:mime biosig/edf
#
### Specifications: https://arxiv.org/abs/cs/0608052
0 string GDF Biosig/GDF: General data format for biosignals
!:mime biosig/gdf
#
0 string DATA\0\0\0\0 Biosig/Heka Patchmaster
0 string DAT1\0\0\0\0 Biosig/Heka Patchmaster
0 string DAT2\0\0\0\0 Biosig/Heka Patchmaster
!:mime biosig/heka
#
0 string (C)\x20CED\x2087 Biosig/CED SMR
!:mime biosig/ced-smr
#
0 string CFWB\1\0\0\0 Biosig/CFWB
!:mime biosig/cfwb
#
0 string DEMG Biosig/DEMG
!:mime biosig/demg
#
0 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS
!:mime biosig/ebs
#
0 string Embla\x20data\x20file Biosig/Embla
!:mime biosig/embla
#
0 string Header\r\nFile Version Biosig/ETG4000
!:mime biosig/etg4000
#
0 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo
!:mime biosig/galileo
#
0 string IGOR Biosig/IgorPro ITX file
!:mime biosig/igorpro
#
# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf
0 string ISHNE1.0 Biosig/ISHNE
!:mime biosig/ishne
#
# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm
0 string @\x20\x20MFER\x20 Biosig/MFER
0 string @\x20MFR\x20 Biosig/MFER
!:mime biosig/mfer
#
0 string NEURALEV Biosig/NEV
0 string N.EV.\0 Biosig/NEV
!:mime biosig/nev
#
0 string NEX1 Biosig/NEX
!:mime biosig/nex1
#
0 string PLEX Biosig/Plexon v1.0
10 string PLEXON Biosig/Plexon v2.0
!:mime biosig/plexon
#
0 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format
#
# Specification: CEN 1064:2005/ISO 11073:91064
16 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064
!:mime biosig/scpecg
#
0 string IAvSFo Biosig/SIGIF
!:mime biosig/sigif
#
0 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32
!:mime biosig/tms32
#
0 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG
!:mime biosig/tmsilog
#
4 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0
>63 string CRawDataElement
>>85 string CRawDataBuffer Biosig/SYNERGY
!:mime biosig/synergy
#
4 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO
!:mime biosig/unipro
#
0 string VER=9\r\nCTIME= Biosig/WCP
!:mime biosig/wcp
#
0 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek
0 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek
0 string \x55\x55\xFE\xAF Biosig/Walter Graphtek
!:mime biosig/walter-graphtek
#
0 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
>32 string [PatInfo] Biosig/Sigma
!:mime biosig/sigma
#
0 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF)
!:mime biosig/fef
0 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF)
!:mime biosig/fef
#
0 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1
>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0
>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF
!:mime biosig/fiff
#

8
magic/Magdir/blackberry Normal file
View file

@ -0,0 +1,8 @@
#------------------------------------------------------------------------------
# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
# blackberry: file(1) magic for BlackBerry file formats
#
5 belong 0
>8 belong 010010010 BlackBerry RIM ETP file
>>22 string x \b for %s

25
magic/Magdir/blcr Normal file
View file

@ -0,0 +1,25 @@
# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
# https://ftg.lbl.gov/checkpoint
0 string C\0\0\0R\0\0\0 BLCR
>16 lelong 1 x86
>16 lelong 3 alpha
>16 lelong 5 x86-64
>16 lelong 7 ARM
>8 lelong x context data (little endian, version %d)
# Uncomment the following only of your "file" program supports "search"
#>0 search/1024 VMA\06 for kernel
#>>&1 byte x %d.
#>>&2 byte x %d.
#>>&3 byte x %d
0 string \0\0\0C\0\0\0R BLCR
>16 belong 2 SPARC
>16 belong 4 ppc
>16 belong 6 ppc64
>16 belong 7 ARMEB
>16 belong 8 SPARC64
>8 belong x context data (big endian, version %d)
# Uncomment the following only of your "file" program supports "search"
#>0 search/1024 VMA\06 for kernel
#>>&1 byte x %d.
#>>&2 byte x \b%d.
#>>&3 byte x \b%d

50
magic/Magdir/blender Normal file
View file

@ -0,0 +1,50 @@
#------------------------------------------------------------------------------
# $File: blender,v 1.9 2022/12/21 15:53:27 christos Exp $
# blender: file(1) magic for Blender 3D related files
#
# Native format rule v1.2. For questions use the developers list
# https://lists.blender.org/mailman/listinfo/bf-committers
# GLOB chunk was moved near start and provides subversion info since 2.42
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/BLEND
# http://www.blender.org/
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/blend.trid.xml
# http://formats.kaitai.io/blender_blend/index.html
# Note: called "Blender 3D data" by TrID
# and gzip compressed variant handled by ./compress
0 string =BLENDER Blender3D,
#!:mime application/octet-stream
!:mime application/x-blender
!:ext blend
# no sample found with extension blender
#!:ext blend/blender
>7 string =_ saved as 32-bits
>>8 string =v little endian
>>>9 byte x with version %c.
>>>10 byte x \b%c
>>>11 byte x \b%c
>>>0x40 string =GLOB \b.
>>>>0x58 leshort x \b%.4d
>>8 string =V big endian
>>>9 byte x with version %c.
>>>10 byte x \b%c
>>>11 byte x \b%c
>>>0x40 string =GLOB \b.
>>>>0x58 beshort x \b%.4d
>7 string =- saved as 64-bits
>>8 string =v little endian
>>9 byte x with version %c.
>>10 byte x \b%c
>>11 byte x \b%c
>>0x44 string =GLOB \b.
>>>0x60 leshort x \b%.4d
>>8 string =V big endian
>>>9 byte x with version %c.
>>>10 byte x \b%c
>>>11 byte x \b%c
>>>0x44 string =GLOB \b.
>>>>0x60 beshort x \b%.4d
# Scripts that run in the embedded Python interpreter
0 string #!BPY Blender3D BPython script

24
magic/Magdir/blit Normal file
View file

@ -0,0 +1,24 @@
#------------------------------------------------------------------------------
# $File: blit,v 1.9 2021/07/03 14:01:46 christos Exp $
# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well? If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0 long 0407 68K Blit (standalone) executable
#0 short 0407 VAX-order2 68K Blit (standalone) executable
0 short 03401 VAX-order 68K Blit (standalone) executable
0 long 0406 68k Blit mpx/mux executable
0 short 0406 VAX-order2 68k Blit mpx/mux executable
# GRR: line below is too general as it matches also TTComp archive, ASCII, 4K handled by ./archive
0 short 03001 VAX-order 68k Blit mpx/mux executable
# TODO:
# skip TTComp archive, ASCII, 4K by looking for executable keyword like main
#>0 search/5536 main\0 VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0 short 0520 tty630 layers executable

10
magic/Magdir/bm Normal file
View file

@ -0,0 +1,10 @@
#------------------------------------------------------------------------------
# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $
# bm: file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm
0 string bm\001\244 Birtual Machine
>4 leshort x \b, version %d
>6 lelong x \b, program size %u
>14 lelong x \b, memory size %u
>22 lelong x \b, memory capacity %u

11
magic/Magdir/bout Normal file
View file

@ -0,0 +1,11 @@
#------------------------------------------------------------------------------
# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
# i80960 b.out objects and archives
#
0 long 0x10d i960 b.out relocatable object
>16 long >0 not stripped
#
# b.out archive (hp-rt on i960)
0 string =!<bout> b.out archive
>8 string __.SYMDEF random library

33
magic/Magdir/bsdi Normal file
View file

@ -0,0 +1,33 @@
#------------------------------------------------------------------------------
# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
# Some object/executable formats use the same magic numbers as are used
# in other OSes; those are handled by entries in aout.
#
0 lelong 0314 386 compact demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
# same as in SunOS 4.x, except for static shared libraries
0 belong&077777777 0600413 SPARC demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
0 belong&077777777 0600410 SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
0 belong&077777777 0600407 SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)

10
magic/Magdir/bsi Normal file
View file

@ -0,0 +1,10 @@
# Chiasmus is an encryption standard developed by the German Federal
# Office for Information Security (Bundesamt fuer Sicherheit in der
# Informationstechnik).
# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html
0 string XIA1\r Chiasmus Encrypted data
!:ext xia
0 string XIS Chiasmus key
!:ext xis

13
magic/Magdir/btsnoop Normal file
View file

@ -0,0 +1,13 @@
#------------------------------------------------------------------------------
# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
# BTSnoop: file(1) magic for BTSnoop files
#
# From <marcel@holtmann.org>
0 string btsnoop\0 BTSnoop
>8 belong x version %d,
>12 belong 1001 Unencapsulated HCI
>12 belong 1002 HCI UART (H4)
>12 belong 1003 HCI BCSP
>12 belong 1004 HCI Serial (H5)
>>12 belong x type %d

7
magic/Magdir/burp Normal file
View file

@ -0,0 +1,7 @@
#------------------------------------------------------------
# $File: burp,v 1.1 2022/07/04 17:15:09 christos Exp $
# Burp file, I don't know the version
#------------------------------------------------------------
# From wof (wof@stachelkaktus.net)
0 bequad 0x6685828000000001 Burp project save file

41
magic/Magdir/bytecode Normal file
View file

@ -0,0 +1,41 @@
#------------------------------------------------------------
# $File: bytecode,v 1.5 2023/02/20 16:25:05 christos Exp $
# magic for various bytecodes
# From: Mikhail Gusarov <dottedmag@dottedmag.net>
# NekoVM (https://nekovm.org/) bytecode
0 string NEKO NekoVM bytecode
>4 lelong x (%d global symbols,
>8 lelong x %d global fields,
>12 lelong x %d bytecode ops)
!:mime application/x-nekovm-bytecode
# https://www.iana.org/assignments/media-types/application/vnd.resilient.logic
# From: Benedikt Muessig <benedikt@resilient-group.de>
0 belong 0x07524c4d Resilient Logic bytecode
!:mime application/vnd.resilient.logic
>4 byte/16 x \b, version %d
>4 byte&0x0f x \b.%d
# Guile file magic from <dalepsmith@gmail.com>
# https://www.gnu.org/s/guile/
# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
0 string GOOF---- Guile Object
>8 string LE \b, little endian
>8 string BE \b, big endian
>11 string 4 \b, 32bit
>11 string 8 \b, 64bit
>13 regex .\\.. \b, bytecode v%s
# Racket file magic
# From: Haelwenn (lanodan) Monnier <contact+libmagic@hacktivis.me>
# https://racket-lang.org/
# https://github.com/racket/racket/blob/master/racket/src/expander/compile/write-linklet.rkt
0 string #~
>&0 pstring x
>>&0 pstring racket
>>>0 string #~ Racket bytecode
>>>>&0 pstring x (version %s)

110
magic/Magdir/c-lang Normal file
View file

@ -0,0 +1,110 @@
#------------------------------------------------------------------------------
# $File: c-lang,v 1.32 2023/06/16 19:57:19 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
# The strength is to beat standard HTML
# BCPL
0 search/8192 "libhdr" BCPL source text
!:mime text/x-bcpl
0 search/8192 "LIBHDR" BCPL source text
!:mime text/x-bcpl
# C
# Check for class if include is found, otherwise class is beaten by include because of lowered strength
0 search/8192 #include
>0 regex \^#include C
>>0 regex \^class[[:space:]]+
>>>&0 regex \\{[\.\*]\\}(;)?$ \b++
>>&0 clear x source text
!:strength + 15
!:mime text/x-c
0 search/8192 pragma
>0 regex \^#[[:space:]]*pragma C source text
!:mime text/x-c
0 search/8192 endif
>0 regex \^#[[:space:]]*(if\|ifn)def
>>&0 regex \^#[[:space:]]*endif$ C source text
!:mime text/x-c
0 search/8192 define
>0 regex \^#[[:space:]]*(if\|ifn)def
>>&0 regex \^#[[:space:]]*define C source text
!:mime text/x-c
0 search/8192 char
>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 search/8192 double
>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 search/8192 extern
>0 regex \^[[:space:]]*extern[[:space:]]+ C source text
!:mime text/x-c
0 search/8192 float
>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text
!:mime text/x-c
0 search/8192 struct
>0 regex \^struct[[:space:]]+ C source text
!:mime text/x-c
0 search/8192 union
>0 regex \^union[[:space:]]+ C source text
!:mime text/x-c
0 search/8192 main(
>&0 search/64 String Java source text
!:mime text/x-java
>&0 default x
>>&0 regex \\)[[:space:]]*\\{ C source text
!:mime text/x-c
# C++
# The strength of these rules is increased so they beat the C rules above
0 search/8192 namespace
>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text
!:strength + 30
!:mime text/x-c++
# using namespace [namespace] or using std::[lib]
0 search/8192 using
>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text
!:strength + 30
!:mime text/x-c++
0 search/8192 template
>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text
!:strength + 30
!:mime text/x-c++
0 search/8192 virtual
>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text
!:strength + 30
!:mime text/x-c++
# But class alone is reduced to avoid beating php (Jens Schleusener)
0 search/8192 class
>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text
!:strength + 13
!:mime text/x-c++
0 search/8192 public
>0 regex \^[[:space:]]*public: C++ source text
!:strength + 30
!:mime text/x-c++
0 search/8192 private
>0 regex \^[[:space:]]*private: C++ source text
!:strength + 30
!:mime text/x-c++
0 search/8192 protected
>0 regex \^[[:space:]]*protected: C++ source text
!:strength + 30
!:mime text/x-c++
# Objective-C
0 search/8192 #import
>0 regex \^#import[[:space:]]+["<] Objective-C source text
!:strength + 25
!:mime text/x-objective-c
# From: Mikhail Teterin <mi@aldan.algebra.com>
0 string cscope cscope reference data
>7 string x version %.2s
# We skip the path here, because it is often long (so file will
# truncate it) and mostly redundant.
# The inverted index functionality was added some time between
# versions 11 and 15, so look for -q if version is above 14:
>7 string >14
>>10 search/100 \ -q\ with inverted index
>10 search/100 \ -c\ text (non-compressed)

549
magic/Magdir/c64 Normal file
View file

@ -0,0 +1,549 @@
#------------------------------------------------------------------------------
# $File: c64,v 1.14 2023/06/16 19:24:06 christos Exp $
# c64: file(1) magic for various commodore 64 related files
#
# From: Dirk Jagdmann <doj@cubic.org>
0x16500 belong 0x12014100 D64 Image
0x16500 belong 0x12014180 D71 Image
0x61800 belong 0x28034400 D81 Image
0 belong 0x43154164 X64 Image
# C64 (and other CBM) cartridges
# Extended by David Korth <gerbilsoft@gerbilsoft.com>
# Reference: https://vice-emu.sourceforge.io/vice_17.html#SEC391
0 string C64\40CARTRIDGE Commodore 64 cartridge
>0x20 ubyte 0 \b,
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s",
>0x16 beshort 0
>>0x18 beshort 0x0000 16 KB game
>>0x18 beshort 0x0001 8 KB game
>>0x18 beshort 0x0100 UltiMax mode
>>0x18 beshort 0x0101 RAM/disabled
>0x16 beshort 1 Action Replay
>0x16 beshort 2 KCS Power Cartridge
>0x16 beshort 3 Final Cartridge III
>0x16 beshort 4 Simons' BASIC
>0x16 beshort 5 Ocean type 1
>0x16 beshort 6 Expert Cartridge
>0x16 beshort 7 Fun Play, Power Play
>0x16 beshort 8 Super Games
>0x16 beshort 9 Atomic Power
>0x16 beshort 10 Epyx Fastload
>0x16 beshort 11 Westermann Learning
>0x16 beshort 12 Rex Utility
>0x16 beshort 13 Final Cartridge I
>0x16 beshort 14 Magic Formel
>0x16 beshort 15 C64 Game System, System 3
>0x16 beshort 16 Warp Speed
>0x16 beshort 17 Dinamic
>0x16 beshort 18 Zaxxon / Super Zaxxon (Sega)
>0x16 beshort 19 Magic Desk, Domark, HES Australia
>0x16 beshort 20 Super Snapshot V5
>0x16 beshort 21 Comal-80
>0x16 beshort 22 Structured BASIC
>0x16 beshort 23 Ross
>0x16 beshort 24 Dela EP64
>0x16 beshort 25 Dela EP7x8
>0x16 beshort 26 Dela EP256
>0x16 beshort 27 Rex EP256
>0x16 beshort 28 Mikro Assembler
>0x16 beshort 29 Final Cartridge Plus
>0x16 beshort 30 Action Replay 4
>0x16 beshort 31 Stardos
>0x16 beshort 32 EasyFlash
>0x16 beshort 33 EasyFlash Xbank
>0x16 beshort 34 Capture
>0x16 beshort 35 Action Replay 3
>0x16 beshort 36
>>0x1A ubyte 1 Nordic Replay
>>0x1A ubyte !1 Retro Replay
>0x16 beshort 37 MMC64
>0x16 beshort 38 MMC Replay
>0x16 beshort 39 IDE64
>0x16 beshort 40 Super Snapshot V4
>0x16 beshort 41 IEEE-488
>0x16 beshort 42 Game Killer
>0x16 beshort 43 Prophet64
>0x16 beshort 44 EXOS
>0x16 beshort 45 Freeze Frame
>0x16 beshort 46 Freeze Machine
>0x16 beshort 47 Snapshot64
>0x16 beshort 48 Super Explode V5.0
>0x16 beshort 49 Magic Voice
>0x16 beshort 50 Action Replay 2
>0x16 beshort 51 MACH 5
>0x16 beshort 52 Diashow-Maker
>0x16 beshort 53 Pagefox
>0x16 beshort 54 Kingsoft
>0x16 beshort 55 Silverrock 128K Cartridge
>0x16 beshort 56 Formel 64
>0x16 beshort 57
>>0x1A ubyte 1 Hucky
>>0x1A ubyte !1 RGCD
>0x16 beshort 58 RR-Net MK3
>0x16 beshort 59 EasyCalc
>0x16 beshort 60 GMod2
>0x16 beshort 61 MAX Basic
>0x16 beshort 62 GMod3
>0x16 beshort 63 ZIPP-CODE 48
>0x16 beshort 64 Blackbox V8
>0x16 beshort 65 Blackbox V3
>0x16 beshort 66 Blackbox V4
>0x16 beshort 67 REX RAM-Floppy
>0x16 beshort 68 BIS-Plus
>0x16 beshort 69 SD-BOX
>0x16 beshort 70 MultiMAX
>0x16 beshort 71 Blackbox V9
>0x16 beshort 72 Lt. Kernal Host Adaptor
>0x16 beshort 73 RAMLink
>0x16 beshort 74 H.E.R.O.
>0x16 beshort 75 IEEE Flash! 64
>0x16 beshort 76 Turtle Graphics II
>0x16 beshort 77 Freeze Frame MK2
0 string C128\40CARTRIDGE Commodore 128 cartridge
>0x20 ubyte 0 \b,
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s",
>0x16 beshort 0 generic cartridge
>0x16 beshort 1 Warpspeed128
>>0x1A ubyte 1 \b, REU support
>>0x1A ubyte 2 \b, REU support, with I/O and ROM banking
0 string CBM2\40CARTRIDGE Commodore CBM-II cartridge
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s"
0 string VIC20\40CARTRIDGE Commodore VIC-20 cartridge
>0x20 ubyte 0 \b,
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s",
>0x16 beshort 0 generic cartridge
>0x16 beshort 1 Mega-Cart
>0x16 beshort 2 Behr Bonz
>0x16 beshort 3 Vic Flash Plugin
>0x16 beshort 4 UltiMem
>0x16 beshort 5 Final Expansion
0 string PLUS4\40CARTRIDGE Commodore 16/Plus4 cartridge
>0x20 ubyte !0
>>0x20 string/T x \b: "%.32s"
# DreamLoad archives see:
# https://www.lemon64.com/forum/viewtopic.php?t=37415\
# &sid=494dc2ca91289e05dadf80a7f8a968fe (at the bottom).
# https://www.c64-wiki.com/wiki/DreamLoad.
# Example HVSC Commodore 64 music collection:
# https://kohina.duckdns.org/HVSC/C64Music/10_Years_HVSC.dfi
0 byte 0
>1 string DREAMLOAD\40FILE\40ARCHIVE
>>0x17 byte 0 DFI Image
>>>0x1a leshort x version: %d.
>>>0x18 leshort x \b%d
>>>0x1c lelong x tracks: %d
0 string GCR-1541 GCR Image
>8 byte x version: %i
>9 byte x tracks: %i
9 string PSUR ARC archive (c64)
2 string -LH1- LHA archive (c64)
0 string C64File PC64 Emulator file
>8 string >\0 "%s"
0 string C64Image PC64 Freezer Image
0 beshort 0x38CD C64 PCLink Image
0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
0 belong 0xFF424CFF WRAptor packer (c64)
0 string C64S\x20tape\x20file T64 tape Image
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
# Raw tape file format (.tap files)
# Esa Hyyti <esa@netlab.tkk.fi>
0 string C64-TAPE-RAW C64 Raw Tape File (.tap),
>0x0c byte x Version:%u,
>0x10 lelong x Length:%u cycles
# magic for Goattracker2, http://covertbitops.c64.org/
# from Alex Myczko <alex@aiei.ch>
0 string GTS5 GoatTracker 2 song
>4 string >\0 \b, "%s"
>36 string >\0 \b by %s
>68 string >\0 \b (C) %s
>100 byte >0 \b, %u subsong(s)
# CBM BASIC (cc65 compiled)
# Summary: binary executable or Basic program for Commodore C64 computers
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Commodore_BASIC_tokenized_file
# Reference: https://www.c64-wiki.com/wiki/BASIC_token
# https://github.com/thezerobit/bastext/blob/master/bastext.doc
# http://mark0.net/download/triddefs_xml.7z/defs/p/prg-c64.trid.xml
# TODO: unify Commodore BASIC/program sub routines
# Note: "PUCrunch archive data" moved from ./archive and merged with c64-exe
0 leshort 0x0801
# display Commodore C64 BASIC program (strength=50) after "Lynx archive" (strength=330) handled by ./archive
#!:strength +0
# if first token is not SYS this implies BASIC program in most cases
>6 ubyte !0x9e
# but sELF-ExTRACTING-zIP executable unzp6420.prg contains SYS token at end of second BASIC line (at 0x35)
>>23 search/30 \323ELF-E\330TRACTING-\332IP
>>>0 use c64-exe
>>23 default x
>>>0 use c64-prg
# if first token is SYS this implies binary executable
>6 ubyte =0x9e
>>0 use c64-exe
# display information about C64 binary executable (memory address, line number, token)
0 name c64-exe
>0 uleshort x Commodore C64
# http://a1bert.kapsi.fi/Dev/pucrunch/
# start address 0801h; next offset 080bh; BASIC line number is 239=00EFh; BASIC instruction is SYS 2061
# the above combination appartly also occur for other Commodore programs like: gunzip111.c64.prg
# and there exist PUCrunch archive for other machines like C16 with other magics
>0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 program, probably PUCrunch archive data
!:mime application/x-compress-pucrunch
!:ext prg/pck
>0 string !\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 program
!:mime application/x-commodore-exec
!:ext prg/
# start address like: 801h
>0 uleshort !0x0801 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x800) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# valid 2nd BASIC fragment found only in sELF-ExTRACTING-zIP executable unzp6420.prg
>>23 search/30 \323ELF-E\330TRACTING-\332IP
# jump again from beginning
>>>(2.s-0x800) ubyte x
>>>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# display information about tokenized C64 BASIC program (memory address, line number, token)
0 name c64-prg
>0 uleshort x Commodore C64 BASIC program
!:mime application/x-commodore-basic
# Tokenized BASIC programs were stored by Commodore as file type program "PRG" in separate field in directory structures.
# So file name can have no suffix like in saveroms; When transferring to other platforms, they are often saved with .prg extensions.
# BAS suffix is typically used for the BASIC source but also found in program pods.bas
!:ext prg/bas/
# start address like: 801h
>0 uleshort !0x0801 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x0800) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# 2nd BASIC fragment
>>&0 use basic-line
# zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# Summary: binary executable or Basic program for Commodore C128 computers
# URL: https://en.wikipedia.org/wiki/Commodore_128
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-c128.trid.xml
# From: Joerg Jenderek
# Note: Commodore 128 BASIC 7.0 variant; there exist varaints with different start addresses
0 leshort 0x1C01
!:strength +1
# GRR: line above with strength 51 (50+1) is too generic because it matches SVr3 curses screen image, big-endian with strength (50) handled by ./terminfo
# probably skip SVr3 curses images with "invalid high" second line offset
>2 uleshort <0x1D02
# skip foo with "invalid low" second line offset
>>2 uleshort >0x1C06
# if first token is not SYS this implies BASIC program
>>>6 ubyte !0x9e
>>>>0 use c128-prg
# if first token is SYS this implies binary executable
>>>6 ubyte =0x9e
>>>>0 use c128-exe
# Summary: binary executable or Basic program for Commodore C128 computers
# Note: Commodore 128 BASIC 7.1 extension by Rick Simon
# start adress 132Dh
#0 leshort 0x132D THIS_IS_C128_7.1
#>0 use c128-prg
# Summary: binary executable or Basic program for Commodore C128 computers
# Note: Commodore 128 BASIC 7.0 saved with graphics mode enabled
# start adress 4001h
#0 leshort 0x4001 THIS_IS_C128_GRAPHIC
#>0 use c128-prg
# display information about tokenized C128 BASIC program (memory address, line number, token)
0 name c128-prg
>0 uleshort x Commodore C128 BASIC program
!:mime application/x-commodore-basic
!:ext prg
# start address like: 1C01h
>0 uleshort !0x1C01 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x1C00) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# 2nd BASIC fragment
>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# display information about C128 program (memory address, line number, token)
0 name c128-exe
>0 uleshort x Commodore C128 program
!:mime application/x-commodore-exec
!:ext prg/
# start address like: 1C01h
>0 uleshort !0x1C01 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x1C00) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# no valid 2nd BASIC fragment in Commodore executables
#>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# Summary: binary executable or Basic program for Commodore C16/VIC-20/Plus4 computers
# URL: https://en.wikipedia.org/wiki/Commodore_Plus/4
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-vic20.trid.xml
# defs/p/prg-plus4.trid.xml
# From: Joerg Jenderek
# Note: there exist VIC-20 variants with different start address
# GRR: line below is too generic because it matches Novell LANalyzer capture
# with regular trace header record handled by ./sniffer
0 leshort 0x1001
# skip regular Novell LANalyzer capture (novell-2.tr1 novell-lanalyzer.tr1 novell-win10.tr1) with "invalid low" token value 54h
>6 ubyte >0x7F
# skip regular Novell LANalyzer capture (novell-2.tr1 novell-lanalyzer.tr1 novell-win10.tr1) with "invalid low" second line offset 4Ch
#>>2 uleshort >0x1006 OFFSET_NOT_TOO_LOW
# skip foo with "invalid high" second line offset but not for 0x123b (Minefield.prg)
#>>>2 uleshort <0x1102 OFFSET_NOT_TOO_HIGH
# if first token is not SYS this implies BASIC program
>>6 ubyte !0x9e
# valid second end of line separator implies BASIC program
>>>(2.s-0x1000) ubyte =0
>>>>0 use c16-prg
# invalid second end of line separator !=0 implies binary executable like: Minefield.prg
>>>(2.s-0x1000) ubyte !0
>>>>0 use c16-exe
# if first token is SYS this implies binary executable
>>6 ubyte =0x9e
>>>0 use c16-exe
# display information about C16 program (memory address, line number, token)
0 name c16-exe
>0 uleshort x Commodore C16/VIC-20/Plus4 program
!:mime application/x-commodore-exec
!:ext prg/
# start address like: 1001h
>0 uleshort !0x1001 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x1000) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# no valid 2nd BASIC fragment in excutables
#>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# display information about tokenized C16 BASIC program (memory address, line number, token)
0 name c16-prg
>0 uleshort x Commodore C16/VIC-20/Plus4 BASIC program
!:mime application/x-commodore-basic
!:ext prg
# start address like: 1001h
>0 uleshort !0x1001 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x1000) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# 2nd BASIC fragment
>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# Summary: binary executable or Basic program for Commodore VIC-20 computer with 8K RAM expansion
# URL: https://en.wikipedia.org/wiki/VIC-20
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-vic20-8k.trid.xml
# From: Joerg Jenderek
# Note: Basic v2.0 with Basic v4.0 extension (VIC20); there exist VIC-20 variants with different start addresses
# start adress 1201h
0 leshort 0x1201
# if first token is not SYS this implies BASIC program
>6 ubyte !0x9e
>>0 use vic-prg
# if first token is SYS this implies binary executable
>6 ubyte =0x9e
>>0 use vic-exe
# display information about Commodore VIC-20 BASIC+8K program (memory address, line number, token)
0 name vic-prg
>0 uleshort x Commodore VIC-20 +8K BASIC program
!:mime application/x-commodore-basic
!:ext prg
# start address like: 1201h
>0 uleshort !0x1201 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x1200) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# 2nd BASIC fragment
>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# display information about Commodore VIC-20 +8K program (memory address, line number, token)
0 name vic-exe
>0 uleshort x Commodore VIC-20 +8K program
!:mime application/x-commodore-exec
!:ext prg/
# start address like: 1201h
>0 uleshort !0x1201 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x0400) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# no valid 2nd BASIC fragment in excutables
#>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# Summary: binary executable or Basic program for Commodore PET computers
# URL: https://en.wikipedia.org/wiki/Commodore_PET
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-pet.trid.xml
# From: Joerg Jenderek
# start adress 0401h
0 leshort 0x0401
!:strength +1
# GRR: line above with strength 51 (50+1) is too generic because it matches TTComp archive data, ASCII, 1K dictionary
# (strength=48=50-2) handled by ./archive and shared library (strength=50) handled by ./ibm6000
# skip TTComp archive data, ASCII, 1K dictionary ttcomp-ascii-1k.bin with "invalid high" second line offset 4162h
>2 uleshort <0x0502
# skip foo with "invalid low" second line offset
#>>2 uleshort >0x0406 OFFSET_NOT_TOO_LOW
# skip bar with "invalid end of line"
#>>>(2.s-0x0400) ubyte =0 END_OF_LINE_OK
# if first token is not SYS this implies BASIC program
>>6 ubyte !0x9e
>>>0 use pet-prg
# if first token is SYS this implies binary executable
>>6 ubyte =0x9e
>>>0 use pet-exe
# display information about Commodore PET BASIC program (memory address, line number, token)
0 name pet-prg
>0 uleshort x Commodore PET BASIC program
!:mime application/x-commodore-basic
!:ext prg
# start address like: 0401h
>0 uleshort !0x0401 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x0400) ubyte x
# 2nd BASIC fragment
>>&0 use basic-line
# zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# display information about Commodore PET program (memory address, line number, token)
0 name pet-exe
>0 uleshort x Commodore PET program
!:mime application/x-commodore-exec
!:ext prg/
# start address like: 0401h
>0 uleshort !0x0401 \b, start address %#4.4x
# 1st BASIC fragment
>2 use basic-line
# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
>(2.s-0x0400) ubyte x
>>&-1 ubyte !0 \b, no EOL=%#x
# no valid 2nd BASIC fragment in excutables
#>>&0 use basic-line
# Zero-byte marking the end of the BASIC line
>-3 ubyte !0 \b, 3 last bytes %#2.2x
# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
>>-2 ubeshort x \b%4.4x
# display information about tokenized BASIC line (memory address, line number, Token)
0 name basic-line
# pointer to memory address of beginning of "next" BASIC line
# greater then previous offset but maximal 100h difference
>0 uleshort x \b, offset %#4.4x
# offset 0x0000 indicates the end of BASIC program; so bytes afterwards may be some other data
>0 uleshort 0
# not line number but first 2 data bytes
>>2 ubeshort x \b, data %#4.4x
# not token but next 2 data bytes
>>4 ubeshort x \b%4.4x
# not token arguments but next data bytes
>>6 ubequad x \b%16.16llx
>>14 ubequad x \b%16.16llx...
# like 0x0d20352020204c594e5820495820204259205749 "\r 5 LYNX IX BY WILL CORLEY" for LyNX archive Darkon.lnx handled by ./archive
#>>3 string x "%-0.30s"
>0 uleshort >0
# BASIC line number with range from 0 to 65520; practice to increment numbers by some value (5, 10 or 100)
>>2 uleshort x \b, line %u
# https://www.c64-wiki.com/wiki/BASIC_token
# The "high-bit" bytes from #128-#254 stood for the various BASIC commands and mathematical operators
>>4 ubyte x \b, token (%#x)
# https://www.c64-wiki.com/wiki/REM
>>4 string \x8f REM
# remark string like: ** SYNTHESIZER BY RICOCHET **
>>>5 string >\0 %s
#>>>>&1 uleshort x \b, NEXT OFFSET %#4.4x
# https://www.c64-wiki.com/wiki/PRINT
>>4 string \x99 PRINT
# string like: "Hello world" "\021 \323ELF-E\330TRACTING-\332IP (64 ONLY)\016\231":\2362141
>>>5 string x %s
#>>>>&0 ubequad x AFTER_PRINT=%#16.16llx
# https://www.c64-wiki.com/wiki/POKE
>>4 string \x97 POKE
# <Memory address>,<number>
>>>5 regex \^[0-9,\040]+ %s
# BASIC command delimiter colon (:=3Ah)
>>>>&-2 ubyte =0x3A
# after BASIC command delimiter colon remaining (<255) other tokenized BASIC commands
>>>>>&0 string x "%s"
# https://www.c64-wiki.com/wiki/SYS 0x9e=\236
>>4 string \x9e SYS
# SYS <Address> parameter is a 16-bit unsigned integer; in the range 0 - 65535
>>>5 regex \^[0-9]{1,5} %s
# maybe followed by spaces, "control-characters" or colon (:) followed by next commnds or in victracker.prg
# (\302(43)\252256\254\302(44)\25236) /T.L.R/
#>>>5 string x SYS_STRING="%s"
# https://www.c64-wiki.com/wiki/GOSUB
>>4 string \x8d GOSUB
# <line>
>>>5 string >\0 %s

437
magic/Magdir/cad Normal file
View file

@ -0,0 +1,437 @@
#------------------------------------------------------------------------------
# $File: cad,v 1.31 2022/12/09 15:36:23 christos Exp $
# autocad: file(1) magic for cad files
#
# Microstation DGN/CIT Files (www.bentley.com)
# Last updated July 29, 2005 by Lester Hightower
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
#
# http://www.wotsit.org/search.asp
# https://filext.com/detaillist.php?extdetail=DGN
# https://filext.com/detaillist.php?extdetail=CIT
#
# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
#
# URL: https://en.wikipedia.org/wiki/MicroStation
# reference: http://dgnlib.maptools.org/dgn.html
# http://dgnlib.maptools.org/dl/ref18.pdf
# Update: Joerg Jenderek
# Note: verfied by command like `dgndump seed2d_b.dgn`
# test for level 8 and type 5 or 9
0 beshort&0x3F73 0x0801
# level of element like 8
#>0 ubyte&0x3F x \b, level %u
#>0 ubyte &0x80 \b, complex
#>0 ubyte &0x40 \b, reserved
# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements
#>1 ubyte&0x7F x \b, type %u
# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT
#>2 uleshort x \b, words %#4.4x to follow
# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL)
#>508 ubelong x \b, RESERVED %8.8x
>508 ubelong&0xFFffFF00 =0
# test for level 8 and type 9 for INGR raster image
>>0 beshort 0x0809
# test for length of 1st element is multiple of blocks a 512 bytes
>>>2 ubyte 0xfe
>>>>0 use ingr-image
# test for DGN or CEL by jump words (uleshort) forward to next element
>(2.s*2) ulong x
# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT
#>>&1 ubyte&0x7F x \b, 2nd type %u
# DGN
>>&1 ubyte&0x7F 8
>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing
!:mime application/x-bentley-dgn
!:ext dgn
# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0
>>>>1214 ubyte &0x40 3D
>>>>1214 ubyte ^0x40 2D
# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040
>>>>1120 string x \b, units %-.2s
# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0
>>>>1122 string >\0 %-.2s
#>>>>1120 ubelong x \b, units %#8.8x
# element range low,high x y z like xlow=0 08010000h 01080000h
#>>>>4 ubelong !0 \b, xlow %8.8x
#>>>>8 ubelong !0 \b, ylow %8.8x
#>>>>12 ubelong !0 \b, zlow %8.8x
#>>>>16 ubelong !0 \b, xhigh %8.8x
#>>>>20 ubelong !0 \b, yhigh %8.8x
#>>>>24 ubelong !0 \b, zhigh %8.8x
# graphic group number; all other elements in that group have same non-0 number
#>>>>28 leshort x \b, grphgrp %#4.4x
# words to optional attribute linkage
#>>>>30 ubyte x \b, attindx \%o
#>>>>31 ubyte x \b\%o
# >>30 string \026\105 DGNFile
# >>30 string \034\105 DGNFile
# >>30 string \073\107 DGNFile
# >>30 string \073\110 DGNFile
# >>30 string \106\107 DGNFile
# >>30 string \110\103 DGNFile
# >>30 string \120\104 DGNFile
# >>30 string \172\104 DGNFile
# >>30 string \172\105 DGNFile
# >>30 string \172\106 DGNFile
# >>30 string \234\106 DGNFile
# >>30 string \273\105 DGNFile
# >>30 string \306\106 DGNFile
# >>30 string \310\104 DGNFile
# >>30 string \341\104 DGNFile
# >>30 string \372\103 DGNFile
# >>30 string \372\104 DGNFile
# >>30 string \372\106 DGNFile
# >>30 string \376\103 DGNFile
# elements properties indicator
#>>>>32 uleshort !0 \b, properties %#4.4x
# class 0~Primary
#>>>>>32 uleshort&0x000F !0 \b, class %#4.4x
# Symbology
#>>>>>34 uleshort x \b, Symbology %#4.4x
# test for 2nd element type 1~library cell header
>>&1 ubyte&0x7F 1
# test for 1st element with level 8 and type 5 for cell library
>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library
!:mime application/x-bentley-cel
!:ext cel
#
# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster
# reference: https://web.archive.org/web/20140903185431/
# http://oreilly.com/www/centers/gff/formats/ingr/index.htm
# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT`
# display information for intergraph raster bitmap
0 name ingr-image
# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD"
# DataTypeCode indicates format, depth of the pixel data and used compression
>4 uleshort x Intergraph raster image
>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit
!:mime image/x-intergraph-rle
!:ext rel
>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit
!:mime image/x-intergraph-cit
!:ext cit
>>4 uleshort 27 \b, Adaptive RLE RGB
!:mime image/x-intergraph-rgb
!:ext rgb
>>4 default x
>>>4 uleshort x \b, Type %u
!:mime image/x-intergraph
# TODO:
#>4 uleshort 0 \b, no data
# ...
#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed)
# ApplicationType: 0~generic raster image 3~drawing, scanning
# 8~I/IMAGE and MicroStation Imager 9~ModelView
>6 uleshort !0 \b, ApplicationType %u
#>6 uleshort x \b, ApplicationType %u
# XViewOrigin; Raster grid data X origin
#>8 ulequad !0 \b, XViewOrigin %llx
# PixelsPerLine is the number of pixels in a scan line of bitmapp
>184 ulelong x \b, %u x
# NumberOfLines is height of the raster data in scanlines
>188 ulelong x %u
# DeviceResolution; resolution of scanning device
# positive indicates number of micros between lines; negative indicates DPI
#>192 leshort x \b, DeviceResolution %d
# ScanlineOrient indicates the origin and the orientation of the scan lines
#>194 ubyte x \b, ScanlineOrient %x
>194 ubyte x \b, orientation
>194 ubyte &0x01 right
>194 ubyte ^0x01 left
>194 ubyte &0x02 down
>194 ubyte ^0x02 top
>194 ubyte &0x04 horizontal
>194 ubyte ^0x04 vertical
# ScannableFlag; Scanline indexing method used
#>195 ubyte !0 \b, ScannableFlag %#x
# RotationAngle; Rotation angle of raster data
#>196 ubequad !0 \b, RotationAngle %#llx
# SkewAngle; Skew angle of raster data
#>204 ubequad !0 \b, SkewAngle %llx
# DataTypeModifier; Additional raster data format info
#>212 uleshort !0 \b, DataTypeModifier %#4.4x
# DesignFile[66]; Name of the design file
>214 string >\0 \b, DesignFile %-.66s
# DatabaseFile[66]; Name of the database file
>280 string >\0 \b, DatabaseFile %-.66s
# ParentGridFile[66]; Name of parent grid file
>346 string >\0 \b, ParentGridFile %-.66s
# FileDescription[80]; Text description of file and contents
>412 string >\0 \b, FileDescription %-.80s
# MinValue
#>492 ubequad !0 \b, MinValue %#llx
# MaxValue
#>500 ubequad !0 \b, MaxValue %#llx
# Reserved[3]; Unused (always 0)
#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x
# GridFileVersion; Grid File Version like 2 3
#>511 ubyte x \b, GridFileVersion %x
# AutoCAD
# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg
# and https://www.iana.org/assignments/media-types/image/vnd.dwg
0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0
!:mime image/vnd.dwg
0 string AC1.2 DWG AutoDesk AutoCAD Release 1.2
!:mime image/vnd.dwg
0 string AC1.3 DWG AutoDesk AutoCAD Release 1.3
!:mime image/vnd.dwg
0 string AC1.40 DWG AutoDesk AutoCAD Release 1.40
!:mime image/vnd.dwg
0 string AC1.50 DWG AutoDesk AutoCAD Release 2.05
!:mime image/vnd.dwg
0 string AC2.10 DWG AutoDesk AutoCAD Release 2.10
!:mime image/vnd.dwg
0 string AC2.21 DWG AutoDesk AutoCAD Release 2.21
!:mime image/vnd.dwg
0 string AC2.22 DWG AutoDesk AutoCAD Release 2.22
!:mime image/vnd.dwg
0 string AC1001 DWG AutoDesk AutoCAD Release 2.22
!:mime image/vnd.dwg
0 string AC1002 DWG AutoDesk AutoCAD Release 2.50
!:mime image/vnd.dwg
0 string AC1003 DWG AutoDesk AutoCAD Release 2.60
!:mime image/vnd.dwg
0 string AC1004 DWG AutoDesk AutoCAD Release 9
!:mime image/vnd.dwg
0 string AC1006 DWG AutoDesk AutoCAD Release 10
!:mime image/vnd.dwg
0 string AC1009 DWG AutoDesk AutoCAD Release 11/12
!:mime image/vnd.dwg
# AutoCAD DWG versions R13/R14 (www.autodesk.com)
# Written December 01, 2003 by Lester Hightower
# Based on the DWG File Format Specifications at http://www.opendwg.org/
# AutoCad, from Nahuel Greco
# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
0 string AC1012 DWG AutoDesk AutoCAD Release 13
!:mime image/vnd.dwg
0 string AC1013 DWG AutoDesk AutoCAD Release 13c3
!:mime image/vnd.dwg
0 string AC1014 DWG AutoDesk AutoCAD Release 14
!:mime image/vnd.dwg
0 string AC1015 DWG AutoDesk AutoCAD 2000
!:mime image/vnd.dwg
# A new version of AutoCAD DWG
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321)
# From various sources like:
# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html
0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006
!:mime image/vnd.dwg
0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009
!:mime image/vnd.dwg
0 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012
!:mime image/vnd.dwg
0 string AC1027 DWG AutoDesk AutoCAD 2013-2017
!:mime image/vnd.dwg
# From GNU LibreDWG
0 string AC1032 DWG AutoDesk AutoCAD 2018/2019/2020
!:mime image/vnd.dwg
0 string AC1035 DWG AutoDesk AutoCAD 2021
!:mime image/vnd.dwg
# KOMPAS 2D drawing from ASCON
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
# gathered nor specification
# ASCON https://ascon.net/main/ in English,
# https://ascon.ru/ main site in Russian
# Extension is CDW for drawing and FRW for fragment of drawing
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321, https://vkontakte.ru/id16076543)
# From:
# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
# (in russian) and my experiments
0 string KF
>2 belong 0x4E00000C Kompas drawing 12.0 SP1
>2 belong 0x4D00000C Kompas drawing 12.0
>2 belong 0x3200000B Kompas drawing 11.0 SP1
>2 belong 0x3100000B Kompas drawing 11.0
>2 belong 0x2310000A Kompas drawing 10.0 SP1
>2 belong 0x2110000A Kompas drawing 10.0
>2 belong 0x08000009 Kompas drawing 9.0 SP1
>2 belong 0x05000009 Kompas drawing 9.0
>2 belong 0x33010008 Kompas drawing 8+
>2 belong 0x1A000008 Kompas drawing 8.0
>2 belong 0x2C010107 Kompas drawing 7+
>2 belong 0x05000007 Kompas drawing 7.0
>2 belong 0x32000006 Kompas drawing 6+
>2 belong 0x09000006 Kompas drawing 6.0
>2 belong 0x5C009005 Kompas drawing 5.11R03
>2 belong 0x54009005 Kompas drawing 5.11R02
>2 belong 0x51009005 Kompas drawing 5.11R01
>2 belong 0x22009005 Kompas drawing 5.10R03
>2 belong 0x22009005 Kompas drawing 5.10R02 mar
>2 belong 0x21009005 Kompas drawing 5.10R02 febr
>2 belong 0x19009005 Kompas drawing 5.10R01
>2 belong 0xF4008005 Kompas drawing 5.9R01.003
>2 belong 0x1C008005 Kompas drawing 5.9R01.002
>2 belong 0x11008005 Kompas drawing 5.8R01.003
# CAD: file(1) magic for computer aided design files
# Phillip Griffith <phillip dot griffith at gmail dot com>
# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
#
# 3DS (3d Studio files)
0 leshort 0x4d4d
>6 leshort 0x2
>>8 lelong 0xa
>>>16 leshort 0x3d3d 3D Studio model
# Beat sgi MMV
!:strength +20
!:mime image/x-3ds
!:ext 3ds
# MegaCAD 2D/3D drawing (.prt)
# https://megacad.de/
# From: Markus Heidelberg <markus.heidelberg@web.de>
0 string MegaCad23\0 MegaCAD 2D/3D drawing
# Hoops CAD files
# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\
# HSF_architecture.html
# Stephane Charette <stephane.charette@gmail.com>
0 string ;;\040HSF\040V OpenHSF (Hoops Stream Format)
>7 regex/9 V[.0-9]{4,5}\040 %s
!:ext hsf
# AutoCAD Drawing Exchange Format
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/DXF
# https://en.wikipedia.org/wiki/AutoCAD_DXF
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/
# dxf-var0.trid.xml dxf-var0u.trid.xml dxf-var2.trid.xml dxf-var2u.trid.xml
# Note: called "AutoCAD Drawing eXchange Format" by TrID and
# "Drawing Interchange File Format (ASCII)" by DROID
# GRR: some samples does not match 1st test like: abydos.dxf
0 regex \^[\ \t]*0\r?\000$
>1 regex \^[\ \t]*SECTION\r?$
>>2 regex \^[\ \t]*2\r?$
# GRR: some samples without HEADER section like: airplan2.dxf
>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format
#!:mime application/x-dxf
!:mime image/vnd.dxf
!:ext dxf
# DROID PUID fmt/64 fmt-64-signature-id-99.dxf
>>>>&1 search/8192 MC0.0 \b, 1.0
# DROID PUID fmt/65 fmt-65-signature-id-100.dxf
>>>>&1 search/8192 AC1.2 \b, 1.2
# DROID PUID fmt/66 fmt-66-signature-id-101.dxf
>>>>&1 search/8192 AC1.3 \b, 1.3
# DROID PUID fmt/67 fmt-67-signature-id-102.dxf
>>>>&1 search/8192 AC1.40 \b, 1.4
# DROID PUID fmt/68 fmt-68-signature-id-103.dxf
>>>>&1 search/8192 AC1.50 \b, 2.0
# DROID PUID fmt/69 fmt-69-signature-id-104.dxf
>>>>&1 search/8192 AC2.10 \b, 2.1
# DROID PUID fmt/70 fmt-70-signature-id-105.dxf
>>>>&1 search/8192 AC2.21 \b, 2.2
# DROID PUID fmt/71 fmt-71-signature-id-106.dxf
>>>>&1 search/8192 AC1002 \b, 2.5
# DROID PUID fmt/72 fmt-72-signature-id-107.dxf
>>>>&1 search/8192 AC1003 \b, 2.6
# DROID PUID fmt/73 fmt-73-signature-id-108.dxf
>>>>&1 search/8192 AC1004 \b, R9
>>>>&1 search/8192 AC1006 \b, R10
# http://cd.textfiles.com/amigaenv/DXF/OBJEKTE/LASTMINUTE/apple.dxf
#>>>>&1 search/8192 AC1008 \b, Rfoo
>>>>&1 search/8192 AC1009 \b, R11/R12
>>>>&1 search/8192 AC1012 \b, R13
>>>>&1 search/8192 AC1013 \b, R13c3
>>>>&1 search/8192 AC1014 \b, R14
>>>>&1 search/8192 AC1015 \b, version 2000
>>>>&1 search/8192 AC1018 \b, version 2004
>>>>&1 search/8192 AC1021 \b, version 2007
>>>>&1 search/8192 AC1024 \b, version 2010
>>>>&1 search/8192 AC1027 \b, version 2013
>>>>&1 search/8192 AC1032 \b, version 2018
>>>>&1 search/8192 AC1035 \b, version 2021
# The Sketchup 3D model format https://www.sketchup.com/
0 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model
!:mime application/vnd.sketchup.skp
!:ext skp
4 regex/b P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9] NAXOS CAD System file from version %s
!:strength +40
# glTF (GL Transmission Format) - by the Khronos Group
# Reference: https://github.com/KhronosGroup/glTF/tree/master/specification/2.0#glb-file-format-specification
0 string glTF glTF binary model
>4 ulelong x \b, version %d
>8 ulelong x \b, length %d bytes
!:mime model/gltf-binary
!:ext glb
# FBX (FilmBoX) - by Kaydara/Autodesk
# Reference: https://code.blender.org/2013/08/fbx-binary-file-format-specification
0 string Kaydara\ FBX\ Binary\ \ \0 Kaydara FBX model,
>&2 ulelong x version %d
!:ext fbx
# PLY (Polygon File Format/Stanford Triangle Format) - by Greg Turk
# Reference: https://web.archive.org/web/20161204152348/http://www.dcs.ed.ac.uk/teaching/cs4/www/graphics/Web/ply.html
0 string ply\n PLY model,
!:ext ply
>4 string format\ ascii\ ASCII,
>>&0 regex/6 [0-9.]+ version %s
>4 string format\ binary binary,
>>&0 string _little_endian\ little endian,
>>>&0 regex/6 [0-9.]+ version %s
>>&0 string _big_endian\ big endian,
>>>&0 regex/6 [0-9.]+ version %s
# VRML (Virtual Reality Modeling Language) - by the Web3D Consortium
# From: Michel Briand <michelbriand@free.fr>
# Reference: https://www.web3d.org/standards
0 string/w #VRML\ V1.0\ ascii VRML 1 file
!:mime model/vrml
!:ext wrl
0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
!:mime model/vrml
!:ext wrl
# X3D, VRML encoded
0 string #X3D X3D (Extensible 3D) model, VRML format
>4 string V
>>5 regex/6 [0-9.]+ \b, version %s
!:mime model/x3d+vrml
!:ext x3dv
## XML-based 3D CAD Formats
# From: Michel Briand <michelbriand@free.fr>, Oliver Galvin <odg@riseup.net>
0 string/w \<?xml\ version=
!:strength + 5
# X3D (Extensible 3D)
# Schema: https://www.web3d.org/specifications/x3d-3.2.dtd
# MIME Type: https://www.iana.org/assignments/media-types/model/x3d+xml
# Example: https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model, XML document
!:mime model/x3d+xml
!:ext x3d
# COLLADA (COLLAborative Design Activity) - by the Khronos Group
# Schema: http://www.collada.org/2005/11/COLLADASchema
# Reference: https://www.khronos.org/collada
>20 search/1000/w \<COLLADA COLLADA model, XML document
!:mime model/vnd.collada+xml
!:ext dae
# 3MF (3D Manufacturing Format) - by the 3MF Consortium
# Schema: http://schemas.microsoft.com/3dmanufacturing/core/2015/02
# Reference: https://3mf.io/specification
>20 search/1000/w xmlns="http://schemas.microsoft.com/3dmanufacturing 3MF (3D Manufacturing Format) model, XML document
!:mime model/3mf
!:ext 3mf
# AMF (Additive Manufacturing File)
# Reference: https://www.astm.org/Standards/ISOASTM52915.htm
>20 search/1000/w \<amf AMF (Additive Manufacturing Format) model, XML document
!:mime application/x-amf
!:ext amf

107
magic/Magdir/cafebabe Normal file
View file

@ -0,0 +1,107 @@
#------------------------------------------------------------------------------
# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same "magic" sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
# version and the short at offset 6 is the JVM major version. Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack). Let's not use 18, because the Mach-O people
# might add another one or two as time goes by...
#
### JAVA START ###
# Reference: http://en.wikipedia.org/wiki/Java_class_file
# Update: Joerg Jenderek
0 belong 0xcafebabe
>4 ubelong >30 compiled Java class data,
!:mime application/x-java-applet
#!:mime application/java-byte-code
!:ext class
>>6 ubeshort x version %d.
>>4 ubeshort x \b%d
# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
#>>4 ubelong x (%#8.8x)
# Which is which?
# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
#>>4 belong 0x002b (Java 0.?)
#>>4 belong 0x032d (Java 1.0)
#>>4 belong 0x032d (Java 1.1)
>>4 belong 0x002e (Java 1.2)
>>4 belong 0x002f (Java 1.3)
>>4 belong 0x0030 (Java 1.4)
>>4 belong 0x0031 (Java 1.5)
>>4 belong 0x0032 (Java 1.6)
>>4 belong 0x0033 (Java 1.7)
>>4 belong 0x0034 (Java 1.8)
>>4 belong 0x0035 (Java SE 9)
>>4 belong 0x0036 (Java SE 10)
>>4 belong 0x0037 (Java SE 11)
>>4 belong 0x0038 (Java SE 12)
>>4 belong 0x0039 (Java SE 13)
>>4 belong 0x003A (Java SE 14)
>>4 belong 0x003B (Java SE 15)
>>4 belong 0x003C (Java SE 16)
>>4 belong 0x003D (Java SE 17)
>>4 belong 0x003E (Java SE 18)
>>4 belong 0x003F (Java SE 19)
>>4 belong 0x0040 (Java SE 20)
# pool count unequal zero
#>>8 beshort x \b, pool count %#x
# pool table
#>>10 ubequad x \b, pool %#16.16llx...
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
### JAVA END ###
### MACH-O START ###
# URL: https://en.wikipedia.org/wiki/Mach-O
0 name mach-o \b [
# for debugging purpose CPU type as hexadecimal
#>0 ubequad x CPU=%16.16llx
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
>0 use mach-o-cpu \b
# for debugging purpose print offset to 1st mach_header like:
# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
#>8 ubelong x at %#x offset
>(8.L) indirect x \b:
>0 belong x \b]
# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
# include/mach-o/fat.h
# include/mach/machine.h
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
>>8 use mach-o \b
# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
>4 ubelong >1
>>4 ubelong <20 Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8 use mach-o \b
>>>4 ubelong >1
>>>>28 use mach-o \b
>>>4 ubelong >2
>>>>48 use mach-o \b
>>>4 ubelong >3
>>>>68 use mach-o \b
>>>4 ubelong >4
>>>>88 use mach-o \b
>>>4 ubelong >5
>>>>108 use mach-o \b
### MACH-O END ###

21
magic/Magdir/cbor Normal file
View file

@ -0,0 +1,21 @@
#------------------------------------------------------------------------------
# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
# cbor: file(1) magic for CBOR files as defined in RFC 7049
0 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
!:mime application/cbor
>3 ubyte <0x20 (positive integer)
>3 ubyte <0x40
>>3 ubyte >0x1f (negative integer)
>3 ubyte <0x60
>>3 ubyte >0x3f (byte string)
>3 ubyte <0x80
>>3 ubyte >0x5f (text string)
>3 ubyte <0xa0
>3 ubyte >0x7f (array)
>3 ubyte <0xc0
>>3 ubyte >0x9f (map)
>3 ubyte <0xe0
>>3 ubyte >0xbf (tagged)
>3 ubyte >0xdf (other)

14
magic/Magdir/ccf Normal file
View file

@ -0,0 +1,14 @@
#------------------------------------------------------------------------------
# $File: ccf,v 1.1 2022/02/15 12:57:45 christos Exp $
# file(1) magic(5) data for Phillips remote controls
# Exchange format for Philips Pronto universal infrared remote controls
# A CCF file describes a learned/customized remote control,
# i.e. it contains button UI and infrared pulse code definitions
# (Georg Sauthoff)
# http://files.remotecentral.com/download/45/pan-air-csakr.zip.html
# https://github.com/gsauthof/pronto-ccf/blob/
8 string @\xa5Z@_CCF
>32 string CCF\x00 Philips Pronto IR remote control CCF

12
magic/Magdir/cddb Normal file
View file

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
# CDDB: file(1) magic for CDDB(tm) format CD text data files
#
# From <steve@gracenote.com>
#
# This is the /etc/magic entry to decode datafiles as used by
# CDDB-enabled CD player applications.
#
0 search/1/w #\040xmcd CDDB(tm) format CD text data

15
magic/Magdir/chord Normal file
View file

@ -0,0 +1,15 @@
#------------------------------------------------------------------------------
# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
# chord: file(1) magic for Chord music sheet typesetting utility input files
#
# From Philippe De Muyter <phdm@macqel.be>
# File format is actually free, but many distributed files begin with `{title'
#
0 string {title Chord text file
# Type: PowerTab file format
# URL: http://www.power-tab.net/
# From: Jelmer Vernooij <jelmer@samba.org>
0 string ptab\003\000 Power-Tab v3 Tablature File
0 string ptab\004\000 Power-Tab v4 Tablature File

12
magic/Magdir/cisco Normal file
View file

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
# cisco: file(1) magic for cisco Systems routers
#
# Most cisco file-formats are covered by the generic elf code
#
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
0 belong&0xffffff00 0x85011400 cisco IOS microcode
>7 string >\0 for '%s'
0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
>7 string >\0 for '%s'

12
magic/Magdir/citrus Normal file
View file

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $
# citrus locale declaration
#
0 string RuneCT Citrus locale declaration for LC_CTYPE
0 string CtrsME Citrus locale declaration for LC_MESSAGES
0 string CtrsMO Citrus locale declaration for LC_MONETARY
0 string CtrsNU Citrus locale declaration for LC_NUMERIC
0 string CtrsTI Citrus locale declaration for LC_TIME

27
magic/Magdir/clarion Normal file
View file

@ -0,0 +1,27 @@
#------------------------------------------------------------------------------
# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
# clarion: file(1) magic for # Clarion Personal/Professional Developer
# (v2 and above)
# From: Julien Blache <jb@jblache.org>
# Database files
# signature
0 leshort 0x3343 Clarion Developer (v2 and above) data file
# attributes
>2 leshort &0x0001 \b, locked
>2 leshort &0x0004 \b, encrypted
>2 leshort &0x0008 \b, memo file exists
>2 leshort &0x0010 \b, compressed
>2 leshort &0x0040 \b, read only
# number of records
>5 lelong x \b, %d records
# Memo files
0 leshort 0x334d Clarion Developer (v2 and above) memo data
# Key/Index files
# No magic? :(
# Help files
0 leshort 0x49e0 Clarion Developer (v2 and above) help data

48
magic/Magdir/claris Normal file
View file

@ -0,0 +1,48 @@
#------------------------------------------------------------------------------
# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
# claris: file(1) magic for claris
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Claris Works a word processor, etc.
# Version 3.0
# .pct claris works clip art files
#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
#*
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
#null to byte 1000 octal
514 string \377\377\377\377\000
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
514 string \377\377\377\377\001
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
# Claris works files
# .cwk
# Moved to Apple AppleWorks document
#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
# .plt
0 string \020\341\000\000\010\010 Claris Works palette files .plt
# .msp a dictionary file I am not sure about this I have only one .msp file
0 string \002\271\262\000\040\002\000\164 Claris works dictionary
# .usp are user dictionary bits
# I am not sure about a magic header:
#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
# soh S p f 8 U D sp ^ S cr nl p o d i
#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
# a t r i s t sp ^ S cr nl d i v sp #
# .mth Thesaurus
# starts with \0 but no magic header
# .chy Hyphenation file
# I am not sure: 000 210 034 000 000
# other claris files
#./windows/claris/useng.ndx: data
#./windows/claris/xtndtran.l32: data
#./windows/claris/xtndtran.lst: data
#./windows/claris/clworks.lbl: data
#./windows/claris/clworks.prf: data
#./windows/claris/userd.spl: data

65
magic/Magdir/clipper Normal file
View file

@ -0,0 +1,65 @@
#------------------------------------------------------------------------------
# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18 short !074000,000000 C1 R1
# >18 short !074000,004000 C2 R1
# >18 short !074000,010000 C3 R1
# >18 short !074000,074000 TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18 short&074000 000000 C1 R1
# >18 short&074000 004000 C2 R1
# >18 short&074000 010000 C3 R1
# >18 short&074000 074000 TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0 short 0575 CLIPPER COFF executable (VAX #)
>20 short 0407 (impure)
>20 short 0410 (5.2 compatible)
>20 short 0411 (pure)
>20 short 0413 (demand paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %d
0 short 0577 CLIPPER COFF executable
>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>18 short&074000 010000 C3 R1
>18 short&074000 074000 TEST
>20 short 0407 (impure)
>20 short 0410 (pure)
>20 short 0411 (separate I&D)
>20 short 0413 (paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %d
>48 long&01 01 alignment trap enabled
>52 byte 1 -Ctnc
>52 byte 2 -Ctsw
>52 byte 3 -Ctpw
>52 byte 4 -Ctcb
>53 byte 1 -Cdnc
>53 byte 2 -Cdsw
>53 byte 3 -Cdpw
>53 byte 4 -Cdcb
>54 byte 1 -Csnc
>54 byte 2 -Cssw
>54 byte 3 -Cspw
>54 byte 4 -Cscb
#4 string pipe CLIPPER instruction trace
#4 string prof CLIPPER instruction profile

30
magic/Magdir/clojure Normal file
View file

@ -0,0 +1,30 @@
#------------------------------------------------------------------------------
# file: file(1) magic for Clojure
# URL: https://clojure.org/
# From: Jason Felice <jason.m.felice@gmail.com>
0 string/w #!\ /usr/bin/clj Clojure script text executable
!:mime text/x-clojure
0 string/w #!\ /usr/local/bin/clj Clojure script text executable
!:mime text/x-clojure
0 string/w #!\ /usr/bin/clojure Clojure script text executable
!:mime text/x-clojure
0 string/w #!\ /usr/local/bin/clojure Clojure script text executable
!:mime text/x-clojure
0 string/W #!/usr/bin/env\ clj Clojure script text executable
!:mime text/x-clojure
0 string/W #!/usr/bin/env\ clojure Clojure script text executable
!:mime text/x-clojure
0 string/W #!\ /usr/bin/env\ clj Clojure script text executable
!:mime text/x-clojure
0 string/W #!\ /usr/bin/env\ clojure Clojure script text executable
!:mime text/x-clojure
0 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text
!:mime text/x-clojure
0 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text
!:mime text/x-clojure
0 regex \^\\\(defn-?[[:space:]] Clojure module source text
!:mime text/x-clojure

98
magic/Magdir/coff Normal file
View file

@ -0,0 +1,98 @@
#------------------------------------------------------------------------------
# $File: coff,v 1.7 2022/11/21 22:30:22 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
#
# by Joerg Jenderek at Oct 2015, Feb 2021
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
# display name+variables+flags of Common Object Files Format (32bit)
# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
# mips,motorola,msdos,osf1,sharc,varied.out,vax
0 name display-coff
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 uleshort&0x8E80 0
# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
>>2 uleshort >0
# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
>>>2 uleshort <4207
>>>>0 clear x
# f_magic - magic number
# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
>>>>0 uleshort 0x014C Intel 80386
# Hitachi SH big-endian COFF (./hitachi-sh)
>>>>0 uleshort 0x0500 Hitachi SH big-endian
# Hitachi SH little-endian COFF (./hitachi-sh)
>>>>0 uleshort 0x0550 Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
#>>>>0 uleshort 0x01DF
# MS Windows COFF Intel Itanium, AMD64
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
>>>>0 uleshort 0x0200 Intel ia64
>>>>0 uleshort 0x8664 Intel amd64
# ARM COFF (./arm)
>>>>0 uleshort 0xaa64 Aarch64
>>>>0 uleshort 0x01c0 ARM
>>>>0 uleshort 0xa641 ARM64EC
>>>>0 uleshort 0x01c2 ARM Thumb
>>>>0 uleshort 0x01c4 ARMv7 Thumb
# TODO for other COFFs
#>>>>0 uleshort 0xABCD COFF_TEMPLATE
>>>>0 default x
>>>>>0 uleshort x type %#04x
>>>>0 uleshort x COFF
# F_EXEC flag bit
>>>>18 leshort ^0x0002 object file
!:mime application/x-coff
!:ext o/obj/lib
# no cof sample found
#!:ext cof/o/obj/lib
>>>>18 leshort &0x0002 executable
#!:mime application/x-coffexec
# F_RELFLG flag bit,static object
>>>>18 leshort &0x0001 \b, no relocation info
# F_LNNO flag bit
>>>>18 leshort &0x0004 \b, no line number info
# F_LSYMS flag bit
>>>>18 leshort &0x0008 \b, stripped
>>>>18 leshort ^0x0008 \b, not stripped
# flags in other COFF versions
#0x0010 F_FDPR_PROF
#0x0020 F_FDPR_OPTI
#0x0040 F_DSA
# F_AR32WR flag bit
#>>>>18 leshort &0x0100 \b, 32 bit little endian
#0x1000 F_DYNLOAD
#0x2000 F_SHROBJ
#0x4000 F_LOADONLY
# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124
>>>>2 uleshort <2 \b, %u section
>>>>2 uleshort >1 \b, %u sections
# f_symptr - symbol table pointer, only for not stripped
# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0
>>>>8 ulelong >0 \b, symbol offset=%#x
# f_nsyms - number of symbols, only for not stripped
# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
>>>>12 ulelong >0 \b, %d symbols
# f_opthdr - optional header size. An object file should have a value of 0
>>>>16 uleshort >0 \b, optional header size %u
# f_timdat - file time & date stamp only for little endian
>>>>4 ledate >0 \b, created %s
# at offset 20 can be optional header, extra bytes FILHSZ-20 because
# do not rely on sizeof(FILHDR) to give the correct size for header.
# or first section header
# additional variables for other COFF files
>>>>16 uleshort =0
# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
>>>>>20 string x \b, 1st section name "%.8s"
# >20 beshort 0407 (impure)
# >20 beshort 0410 (pure)
# >20 beshort 0413 (demand paged)
# >20 beshort 0421 (standalone)
# >22 leshort >0 - version %d
# >168 string .lowmem Apple toolbox

201
magic/Magdir/commands Normal file
View file

@ -0,0 +1,201 @@
#------------------------------------------------------------------------------
# $File: commands,v 1.73 2022/11/06 18:39:23 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
0 string/fwt #!\ /bin/sh POSIX shell script text executable
!:mime text/x-shellscript
0 string/fwb #!\ /bin/sh POSIX shell script executable (binary data)
!:mime text/x-shellscript
>10 string #\040This\040script\040was\040generated\040using\040Makeself \b, self-executable archive
>>53 string x \b, Makeself %s
0 string/fwt #!\ /bin/csh C shell script text executable
!:mime text/x-shellscript
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string/fwt #!\ /bin/ksh Korn shell script text executable
!:mime text/x-shellscript
0 string/fwb #!\ /bin/ksh Korn shell script executable (binary data)
!:mime text/x-shellscript
0 string/fwt #!\ /bin/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bin/tcsh Tenex C shell script text executable
!:mime text/x-shellscript
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0 string/fwt #!\ /bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/env\ zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /bin/ash Neil Brown's ash script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/ash Neil Brown's ash script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bin/ash Neil Brown's ash script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bin/ae Neil Brown's ae script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /bin/nawk new awk script text executable
!:mime text/x-nawk
0 string/fwt #!\ /usr/bin/nawk new awk script text executable
!:mime text/x-nawk
0 string/fwt #!\ /usr/local/bin/nawk new awk script text executable
!:mime text/x-nawk
0 string/fwt #!\ /bin/gawk GNU awk script text executable
!:mime text/x-gawk
0 string/wt #!\ /usr/bin/gawk GNU awk script text executable
!:mime text/x-gawk
0 string/fwt #!\ /usr/local/bin/gawk GNU awk script text executable
!:mime text/x-gawk
#
0 string/fwt #!\ /bin/awk awk script text executable
!:mime text/x-awk
0 string/fwt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
0 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text
# AT&T Bell Labs' Plan 9 shell
0 string/fwt #!\ /bin/rc Plan 9 rc shell script text executable
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string/fwt #!\ /bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/fwb #!\ /bin/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/fwb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/fwb #!\ /usr/local/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/fwt #!\ /usr/local/bin/bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/fwb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data)
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable
!:mime text/x-shellscript
# Fish shell magic
# From: Benjamin Lowry <ben@ben.gmbh>
0 string/fwt #!\ /usr/local/bin/fish fish shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/fish fish shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/env\ fish fish shell script text executable
!:mime text/x-shellscript
0 search/1/fwt #!\ /usr/bin/tclsh Tcl/Tk script text executable
!:mime text/x-tcl
0 search/1/fwt #!\ /usr/bin/texlua LuaTex script text executable
!:mime text/x-luatex
0 search/1/fwt #!\ /usr/bin/luatex LuaTex script text executable
!:mime text/x-luatex
0 search/1/fwt #!\ /usr/bin/stap Systemtap script text executable
!:mime text/x-systemtap
# From: Kylie McClain <kylie@somas.is>
# Type: execline scripts
# URL: https://skarnet.org/software/execline/
0 string/fwt #!\ /command/execlineb execline script text executable
!:mime text/x-execline
0 string/fwt #!\ /bin/execlineb execline script text executable
!:mime text/x-execline
0 string/fwt #!\ /usr/bin/execlineb execline script text executable
!:mime text/x-execline
0 string/fwt #!\ /usr/bin/env\ execlineb execline script text executable
!:mime text/x-execline
0 string #!
>0 regex \^#!.*/bin/execlineb([[:space:]].*)*$ execline script text executable
!:mime text/x-execline
# PHP scripts
# Ulf Harnhammar <ulfh@update.uu.se>
0 search/1/c =<?php PHP script text
!:strength + 30
!:mime text/x-php
0 search/1 =<?\n PHP script text
!:mime text/x-php
0 search/1 =<?\r PHP script text
!:mime text/x-php
0 search/1/w #!\ /usr/local/bin/php PHP script text executable
!:strength + 10
!:mime text/x-php
0 search/1/w #!\ /usr/bin/php PHP script text executable
!:strength + 10
!:mime text/x-php
# Smarty compiled template, https://www.smarty.net/
# Elan Ruusamae <glen@delfi.ee>
0 string =<?php
>5 regex [\ \n]
>>6 string /*\ Smarty\ version Smarty compiled template
>>>24 regex [0-9.]+ \b, version %s
!:mime text/x-php
0 string Zend\x00 PHP script Zend Optimizer data
# From: Anatol Belski <ab@php.net>
0 string OPCACHE
>7 ubyte 0 PHP opcache filecache data
0 search/64 --TEST--
>16 search/64 --FILE--
>24 search/8192 --EXPECT PHP core test
!:ext phpt
# https://www.php.net/manual/en/phar.fileformat.signature.php
-4 string GBMB PHP phar archive
>-8 ubyte 0x1 with MD5 signature
!:ext phar
>-8 ubyte 0x2 with SHA1 signature
!:ext phar
>-8 ubyte 0x3 with SHA256 signature
!:ext phar
>-8 ubyte 0x4 with SHA512 signature
!:ext phar
>-8 ubyte 0x10 with OpenSSL signature
!:ext phar
>-8 ubyte 0x11 with OpenSSL SHA256 signature
!:ext phar
>-8 ubyte 0x12 with OpenSSL SHA512 signature
!:ext phar
0 string/t $! DCL command file
# Type: Pdmenu
# URL: https://packages.debian.org/pdmenu
# From: Edward Betts <edward@debian.org>
0 string #!/usr/bin/pdmenu Pdmenu configuration file text
# From Danny Weldon
0 string \x0b\x13\x08\x00
>0x04 uleshort <4 ksh byte-code version %d
# From: arno <arenevier@fdn.fr>
# mozilla xpconnect typelib
# see https://www.mozilla.org/scriptable/typelib_file.html
0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
>0x10 byte x version %d
>>0x11 byte x \b.%d
0 string/fwt #!\ /usr/bin/env\ runghc GHC script executable
0 string/fwt #!\ /usr/bin/env\ runhaskell Haskell script executable
0 string/fwt #!\ /usr/bin/env\ julia Julia script executable

22
magic/Magdir/communications Normal file
View file

@ -0,0 +1,22 @@
#----------------------------------------------------------------------------
# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
# communication
# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
# It is used for conformance testing of communication protocols.
# Added by W. Borgert <debacle@debian.org>.
0 string $Suite TTCN Abstract Test Suite
>&1 string $SuiteId
>>&1 string >\n %s
>&2 string $SuiteId
>>&1 string >\n %s
>&3 string $SuiteId
>>&1 string >\n %s
# MSC (message sequence charts) are a formal description technique,
# described in ITU-T Z.120, mainly used for communication protocols.
# Added by W. Borgert <debacle@debian.org>.
0 string mscdocument Message Sequence Chart (document)
0 string msc Message Sequence Chart (chart)
0 string submsc Message Sequence Chart (subchart)

461
magic/Magdir/compress Normal file
View file

@ -0,0 +1,461 @@
#------------------------------------------------------------------------------
# $File: compress,v 1.91 2023/06/16 19:37:47 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.
# standard unix compress
0 string \037\235 compress'd data
!:mime application/x-compress
!:apple LZIVZIVU
!:ext Z
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
# URL: https://en.wikipedia.org/wiki/Gzip
# Reference: https://tools.ietf.org/html/rfc1952
# Update: Joerg Jenderek, Apr 2019, Dec 2022
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
# * Original filename is only at offset 10 if "extra field" absent
# * Produce shorter output - notably, only report compression methods
# other than 8 ("deflate", the only method defined in RFC 1952).
# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls
# TODO:
# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/
# KPR KOffice/Calligra KPresenter application/x-kpresenter
# KPT KOffice/Calligra KPresenter template? application/x-kpresenter
# SAV Diggles Saved Game File http://www.innonics.com
# SAV FarCry (demo) saved game http://www.farcry-thegame.com
# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter
0 string \037\213
# to display gzip compressed (strength=100=2*50) before other (strength=50)?
#!:strength * 2
# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary
>3 byte&0x18 =0
# For binary gzipped no ASCII text should occur
# mcd-monu-cad.trid.xml
>>10 string MCD Monu-Cad Drawing, Component or Font
#>>36 string Created\ with\ MONU-CAD
#!:mime application/octet-stream
# http://fileformats.archiveteam.org/wiki/Monu-CAD
# http://www.monucad.com/downloads/FullDemo-2005.EXE
# /HANDS96.MCC Component
# /DEMO_DD01.MCD Drawing
# /MCALF020.FNT Font
!:ext mcc/mcd/fnt
# http://www.generalcadd.com
>>10 string GXD General CADD, Drawing or Component
#!:mime application/octet-stream
# /gxc/BUILDINGEDGE.gxc Component
# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing
# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06
!:ext gxc/gxd
#>>>13 ubyte 0 \b, version 0
>>>13 string 09 \b, version 9
# other gzipped binary like gzipped tar, VirtualBox extension package,...
>>10 default x gzip compressed data
!:mime application/gzip
>>>0 use gzip-info
# size of the original (uncompressed) input data modulo 2^32
# TODO: check for GXD MCD cad the reported size
>>>-4 ulelong x \b, original size modulo 2^32 %u
# gzipped TAR or VirtualBox extension package
#!:mime application/x-compressed-tar
#!:mime application/x-virtualbox-vbox-extpack
# https://www.w3.org/TR/SVG/mimereg.html
#!:mime image/svg+xml-compressed
# zlib.3.gz
# microcode-20180312.tgz
# tpz same as tgz
# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg
# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack
# trees.blend http://fileformats.archiveteam.org/wiki/BLEND
# 2020-07-19-Note-16-24.xoj https://xournal.sourceforge.net/manual.html
# MYgnucash-gz.gnucash https://wiki.gnucash.org/wiki/GnuCash_XML_format
# text-rotate.dia https://en.wikipedia.org/wiki/Dia_(software)
# MYrdata.RData https://en.wikipedia.org/wiki/R_(programming_language)
!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz/blend/dia/gnucash/rdata/xoj
# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text
>3 byte&0x18 >0 gzip compressed data
!:mime application/gzip
# gzipped tar, gzipped Abiword document
#!:mime application/x-compressed-tar
#!:mime application/x-abiword-compressed
#!:mime image/image/svg+xml-compressed
# kleopatra_splashscreen.svgz gzipped .svg
# RSI-Mega-Demo_Disk1.adz gzipped .adf http://fileformats.archiveteam.org/wiki/ADF_(Amiga)
# PostbankTest.kmy gzipped XML https://docs.kde.org/stable5/en/kmymoney/kmymoney/details.formats.compressed.html
# Logo.xcfgz gzipped .xcf http://fileformats.archiveteam.org/wiki/XCF
!:ext gz/tgz/tpz/zabw/svgz/adz/kmy/xcfgz
>>0 use gzip-info
# size of the original (uncompressed) input data modulo 2^32
>>-4 ulelong x \b, original size modulo 2^32 %u
# display information of gzip compressed files
0 name gzip-info
#>2 byte x THIS iS GZIP
>2 byte <8 \b, reserved method
>2 byte >8 \b, unknown method
>3 byte &0x01 \b, ASCII
>3 byte &0x02 \b, has CRC
>3 byte &0x04 \b, extra field
>3 byte&0xC =0x08
>>10 string x \b, was "%s"
>3 byte &0x10 \b, has comment
>3 byte &0x20 \b, encrypted
>4 ledate >0 \b, last modified: %s
>8 byte 2 \b, max compression
>8 byte 4 \b, max speed
>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
>9 byte =0x01 \b, from Amiga
>9 byte =0x02 \b, from VMS
>9 byte =0x03 \b, from Unix
>9 byte =0x04 \b, from VM/CMS
>9 byte =0x05 \b, from Atari
>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
>9 byte =0x07 \b, from MacOS
>9 byte =0x08 \b, from Z-System
>9 byte =0x09 \b, from CP/M
>9 byte =0x0A \b, from TOPS/20
>9 byte =0x0B \b, from NTFS filesystem (NT)
>9 byte =0x0C \b, from QDOS
>9 byte =0x0D \b, from Acorn RISCOS
# size of the original (uncompressed) input data modulo 2^32
#>-4 ulelong x \b, original size modulo 2^32 %u
#ERROR: line 114: non zero offset 1048572 at level 1
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0 string \037\036 packed data
!:mime application/octet-stream
!:ext z
>2 belong >1 \b, %d characters originally
>2 belong =1 \b, %d character originally
#
# This magic number is byte-order-independent.
0 short 0x1f1f old packed data
!:mime application/octet-stream
# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0 short 0x1fff compacted data
!:mime application/octet-stream
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0 string \377\037 compacted data
!:mime application/octet-stream
0 short 0145405 huf output
!:mime application/octet-stream
# bzip2
0 string BZh bzip2 compressed data
!:mime application/x-bzip2
!:ext bz2
>3 byte >47 \b, block size = %c00k
# bzip a block-sorting file compressor
# by Julian Seward <sewardj@cs.man.ac.uk> and others
0 string BZ0 bzip compressed data
!:mime application/x-bzip
>3 byte >47 \b, block size = %c00k
# lzip
0 string LZIP lzip compressed data
!:mime application/x-lzip
!:ext lz
>4 byte x \b, version: %d
# squeeze and crunch
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
0 beshort 0x76FF squeezed data,
>4 string x original name %s
0 beshort 0x76FE crunched data,
>2 string x original name %s
0 beshort 0x76FD LZH compressed data,
>2 string x original name %s
# Freeze
0 string \037\237 frozen file 2.1
0 string \037\236 frozen file 1.0 (or gzip 0.5)
# SCO compress -H (LZH)
0 string \037\240 SCO compress -H (LZH) data
# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes. This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0 byte&0xF0 0xd0 data
#>33 byte&0xF0 0xd0
#>66 byte&0xF0 0xd0
#>99 byte&0xF0 0xd0
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
!:ext lzo
>9 beshort <0x0940
>>9 byte&0xf0 =0x00 - version 0.
>>9 beshort&0x0fff x \b%03x,
>>13 byte 1 LZO1X-1,
>>13 byte 2 LZO1X-1(15),
>>13 byte 3 LZO1X-999,
## >>22 bedate >0 last modified: %s,
>>14 byte =0x00 os: MS-DOS
>>14 byte =0x01 os: Amiga
>>14 byte =0x02 os: VMS
>>14 byte =0x03 os: Unix
>>14 byte =0x05 os: Atari
>>14 byte =0x06 os: OS/2
>>14 byte =0x07 os: MacOS
>>14 byte =0x0A os: Tops/20
>>14 byte =0x0B os: WinNT
>>14 byte =0x0E os: Win32
>9 beshort >0x0939
>>9 byte&0xf0 =0x00 - version 0.
>>9 byte&0xf0 =0x10 - version 1.
>>9 byte&0xf0 =0x20 - version 2.
>>9 beshort&0x0fff x \b%03x,
>>15 byte 1 LZO1X-1,
>>15 byte 2 LZO1X-1(15),
>>15 byte 3 LZO1X-999,
## >>25 bedate >0 last modified: %s,
>>17 byte =0x00 os: MS-DOS
>>17 byte =0x01 os: Amiga
>>17 byte =0x02 os: VMS
>>17 byte =0x03 os: Unix
>>17 byte =0x05 os: Atari
>>17 byte =0x06 os: OS/2
>>17 byte =0x07 os: MacOS
>>17 byte =0x0A os: Tops/20
>>17 byte =0x0B os: WinNT
>>17 byte =0x0E os: Win32
# 4.3BSD-Quasijarus Strong Compression
# https://minnie.tuhs.org/Quasijarus/compress.html
0 string \037\241 Quasijarus strong compressed data
# From: Cory Dikkers <cdikkers@swbell.net>
0 string XPKF Amiga xpkf.library compressed data
0 string PP11 Power Packer 1.1 compressed data
0 string PP20 Power Packer 2.0 compressed data,
>4 belong 0x09090909 fast compression
>4 belong 0x090A0A0A mediocre compression
>4 belong 0x090A0B0B good compression
>4 belong 0x090A0C0C very good compression
>4 belong 0x090A0C0D best compression
# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# https://www.7-zip.org or DOC/7zFormat.txt
#
0 string 7z\274\257\047\034 7-zip archive data,
>6 byte x version %d
>7 byte x \b.%d
!:mime application/x-7z-compressed
!:ext 7z/cb7
0 name lzma LZMA compressed data,
!:mime application/x-lzma
!:ext lzma
>5 lequad =0xffffffffffffffff streamed
>5 lequad !0xffffffffffffffff non-streamed, size %lld
# Type: LZMA
0 lelong&0xffffff =0x5d
>12 leshort 0xff
>>0 use lzma
>12 leshort 0
>>0 use lzma
# http://tukaani.org/xz/xz-file-format.txt
0 ustring \xFD7zXZ\x00 XZ compressed data, checksum
!:strength * 2
!:mime application/x-xz
!:ext xz
>7 byte&0xf 0x0 NONE
>7 byte&0xf 0x1 CRC32
>7 byte&0xf 0x4 CRC64
>7 byte&0xf 0xa SHA-256
# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
0 string LRZI LRZIP compressed data
!:mime application/x-lrzip
>4 byte x - version %d
>5 byte x \b.%d
>22 byte 1 \b, encrypted
# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
0 lelong 0x184d2204 LZ4 compressed data (v1.4+)
!:mime application/x-lz4
!:ext lz4
# Added by osm0sis@xda-developers.com
0 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3)
!:mime application/x-lz4
0 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9)
!:mime application/x-lz4
# Zstandard/LZ4 skippable frames
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0 lelong&0xFFFFFFF0 0x184D2A50
>(4.l+8) indirect x
# Zstandard Dictionary ID subroutine
0 name zstd-dictionary-id
# Single Segment = True
>0 byte &0x20 \b, Dictionary ID:
>>0 byte&0x03 0 None
>>0 byte&0x03 1
>>>1 byte x %u
>>0 byte&0x03 2
>>>1 leshort x %u
>>0 byte&0x03 3
>>>1 lelong x %u
# Single Segment = False
>0 byte ^0x20 \b, Dictionary ID:
>>0 byte&0x03 0 None
>>0 byte&0x03 1
>>>2 byte x %u
>>0 byte&0x03 2
>>>2 leshort x %u
>>0 byte&0x03 3
>>>2 lelong x %u
# Zstandard compressed data
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0 lelong 0xFD2FB522 Zstandard compressed data (v0.2)
!:mime application/zstd
!:ext zst
0 lelong 0xFD2FB523 Zstandard compressed data (v0.3)
!:mime application/zstd
!:ext zst
0 lelong 0xFD2FB524 Zstandard compressed data (v0.4)
!:mime application/zstd
!:ext zst
0 lelong 0xFD2FB525 Zstandard compressed data (v0.5)
!:mime application/zstd
!:ext zst
0 lelong 0xFD2FB526 Zstandard compressed data (v0.6)
!:mime application/zstd
!:ext zst
0 lelong 0xFD2FB527 Zstandard compressed data (v0.7)
!:mime application/zstd
!:ext zst
>4 use zstd-dictionary-id
0 lelong 0xFD2FB528 Zstandard compressed data (v0.8+)
!:mime application/zstd
!:ext zst
>4 use zstd-dictionary-id
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0 lelong 0xEC30A437 Zstandard dictionary
!:mime application/x-std-dictionary
>4 lelong x (ID %u)
# AFX compressed files (Wolfram Kleff)
2 string -afx- AFX compressed file data
# Supplementary magic data for the file(1) command to support
# rzip(1). The format is described in magic(5).
#
# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
# this file.
#
0 string RZIP rzip compressed data
>4 byte x - version %d
>5 byte x \b.%d
>6 belong x (%d bytes)
0 string ArC\x01 FreeArc archive <http://freearc.org>
# Type: DACT compressed files
0 long 0x444354C3 DACT compressed data
>4 byte >-1 (version %i.
>5 byte >-1 %i.
>6 byte >-1 %i)
>7 long >0 , original size: %i bytes
>15 long >30 , block size: %i bytes
# Valve Pack (VPK) files
0 lelong 0x55aa1234 Valve Pak file
>0x4 lelong x \b, version %u
>0x8 lelong x \b, %u entries
# Snappy framing format
# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
0 string \377\006\0\0sNaPpY snappy framed data
!:mime application/x-snappy-framed
# qpress, https://www.quicklz.com/
0 string qpress10 qpress compressed data
!:mime application/x-qpress
# Zlib https://www.ietf.org/rfc/rfc6713.txt
0 string/b x
>0 beshort%31 =0
>>0 byte&0xf =8
>>>0 byte&0x80 =0 zlib compressed data
!:mime application/zlib
# BWC compression
0 string BWC
>3 byte 0 BWC compressed data
# UCL compression
0 bequad 0x00e955434cff011a UCL compressed data
# Softlib archive
0 string SLIB Softlib archive
>4 leshort x \b, version %d
>6 leshort x (contains %d files)
# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276
# From: Eric Hall <eric.hall@darkart.com>
0 string bvx- lzfse encoded, no compression
0 string bvx1 lzfse compressed, uncompressed tables
0 string bvx2 lzfse compressed, compressed tables
0 string bvxn lzfse encoded, lzvn compressed
# pcxLib.exe compression program
# http://www.shikadi.net/moddingwiki/PCX_Library
0 string/b pcxLib
>0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed
# https://support-docs.illumina.com/SW/ORA_Format_Specification/Content/SW/ORA/ORAFormatSpecification.htm
0 uleshort 0x7c49
>2 lelong 0x80 ORA FASTQ compressed file
>>6 ulelong x \b, DNA size %u
>>10 ulelong x \b, read names size %u
>>14 ulelong x \b, quality buffer 1 size %u
>>18 ulelong x \b, quality buffer 2 size %u
>>22 ulelong x \b, sequence buffer size %u
>>26 ulelong x \b, N-position buffer size %u
>>30 ulelong x \b, crypto buffer size %u
>>34 ulelong x \b, misc buffer 1 size %u
>>38 ulelong x \b, misc buffer 2 size %u
>>42 ulelong x \b, flags %#x
>>46 lelong x \b, read size %d
>>50 lelong x \b, number of reads %d
>>54 leshort x \b, version %d
# https://github.com/kspalaiologos/bzip3/blob/master/doc/file_format.md
0 string/b BZ3v1 bzip3 compressed data
>5 ulelong x \b, blocksize %u
# https://support-docs.illumina.com/SW/ORA_Format_Specification/Content/\
# SW/ORA/ORAFormatSpecification.htm
# From Guillaume Rizk
0 short =0x7C49 DRAGEN ORA file,
>-261 short =0x7C49 with metadata:
>-125 u8 x NB reads: %llu,
>-109 u8 x NB bases: %llu.
>-219 u4&0x02 2 File contains interleaved paired reads

1226
magic/Magdir/console Normal file
View file

File diff suppressed because it is too large Load diff

69
magic/Magdir/convex Normal file
View file

@ -0,0 +1,69 @@
#------------------------------------------------------------------------------
# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
# convex: file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
# * Below are the magic numbers and tests added for Convex.
# * Added at beginning, because they are expected to be used most.
# \*/
0 belong 0507 Convex old-style object
>16 belong >0 not stripped
0 belong 0513 Convex old-style demand paged executable
>16 belong >0 not stripped
0 belong 0515 Convex old-style pre-paged executable
>16 belong >0 not stripped
0 belong 0517 Convex old-style pre-paged, non-swapped executable
>16 belong >0 not stripped
0 belong 0x011257 Core file
#
# The following are a series of dump format magic numbers. Each one
# corresponds to a drastically different dump format. The first on is
# the original dump format on a 4.1 BSD or earlier file system. The
# second marks the change between the 4.1 file system and the 4.2 file
# system. The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system. The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
24 belong =60014 dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0 belong 0601 Convex SOFF
>88 belong&0x000f0000 =0x00000000 c1
>88 belong &0x00010000 c2
>88 belong &0x00020000 c2mp
>88 belong &0x00040000 parallel
>88 belong &0x00080000 intrinsic
>88 belong &0x00000001 demand paged
>88 belong &0x00000002 pre-paged
>88 belong &0x00000004 non-swapped
>88 belong &0x00000008 POSIX
#
>84 belong &0x80000000 executable
>84 belong &0x40000000 object
>84 belong&0x20000000 =0 not stripped
>84 belong&0x18000000 =0x00000000 native fpmode
>84 belong&0x18000000 =0x10000000 ieee fpmode
>84 belong&0x18000000 =0x18000000 undefined fpmode
#
0 belong 0605 Convex SOFF core
#
0 belong 0607 Convex SOFF checkpoint
>88 belong&0x000f0000 =0x00000000 c1
>88 belong &0x00010000 c2
>88 belong &0x00020000 c2mp
>88 belong &0x00040000 parallel
>88 belong &0x00080000 intrinsic
>88 belong &0x00000008 POSIX
#
>84 belong&0x18000000 =0x00000000 native fpmode
>84 belong&0x18000000 =0x10000000 ieee fpmode
>84 belong&0x18000000 =0x18000000 undefined fpmode

91
magic/Magdir/coverage Normal file
View file

@ -0,0 +1,91 @@
#------------------------------------------------------------------------------
# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $
# xoverage: file(1) magic for test coverage data
# File formats used to store test coverage data
# 2016-05-21, Georg Sauthoff <mail@georg.so>
# - GCC gcno - written by GCC at compile time when compiling with
# gcc -ftest-coverage
# - GCC gcda - written by a program that was compiled with
# gcc -fprofile-arcs
# - LLVM raw profiles - generated by a program compiled with
# clang -fprofile-instr-generate -fcoverage-mapping ...
# - LLVM indexed profiles - generated by
# llvm-profdata
# - GCOV reports, i.e. the annotated source code
# - LCOV trace files, i.e. aggregated GCC profiles
#
# GCC coverage tracefiles
# .gcno file are created during compile time,
# while data collected during runtime is stored in .gcda files
# cf. gcov-io.h
# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
# Examples:
# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a
0 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage),
>&3 byte x version %c.
>&1 byte x \b%c
# big endian
0 belong 0x67636e6f GCC gcno coverage (-ftest-coverage),
>&0 byte x version %c.
>&2 byte x \b%c (big-endian)
# Examples:
# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a
0 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs),
>&3 byte x version %c.
>&1 byte x \b%c
# big endian
0 belong 0x67636461 GCC gcda coverage (-fprofile-arcs),
>&0 byte x version %c.
>&2 byte x \b%c (big-endian)
# LCOV tracefiles
# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
0 string TN:
>&0 search/64 \nSF:/ LCOV coverage tracefile
# Coverage reports generated by gcov
# i.e. source code annotated with coverage information
0 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report
# LLVM coverage files
# raw data after running a program compiled with:
# `clang -fprofile-instr-generate -fcoverage-mapping ...`
# default name: default.profraw
# magic is: \xFF lprofr \x81
# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
0 lequad 0xff6c70726f667281 LLVM raw profile data,
>&0 byte x version %d
# big endian
0 bequad 0xff6c70726f667281 LLVM raw profile data,
>&7 byte x version %d (big-endian)
# LLVM indexed instruction profile (as generated by llvm-profdata)
# magic is: reverse(\xFF lprofi \x81)
# cf. https://llvm.org/docs/CoverageMappingFormat.html
# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
# https://llvm.org/docs/CommandGuide/llvm-cov.html
# https://llvm.org/docs/CommandGuide/llvm-profdata.html
0 lequad 0x8169666f72706cff LLVM indexed profile data,
>&0 byte x version %d
# big endian
0 bequad 0x8169666f72706cff LLVM indexed profile data,
>&7 byte x version %d (big-endian)

14
magic/Magdir/cracklib Normal file
View file

@ -0,0 +1,14 @@
#------------------------------------------------------------------------------
# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
# cracklib: file (1) magic for cracklib v2.7
0 lelong 0x70775631 Cracklib password index, little endian
>4 long >0 (%i words)
>4 long 0 ("64-bit")
>>8 long >-1 (%i words)
0 belong 0x70775631 Cracklib password index, big endian
>4 belong >-1 (%i words)
# really bellong 0x0000000070775631
0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit")
>12 belong >0 (%i words)

49
magic/Magdir/crypto Normal file
View file

@ -0,0 +1,49 @@
#------------------------------------------------------------------------------
# $File: crypto,v 1.4 2023/07/17 16:41:48 christos Exp $
# crypto: file(1) magic for crypto formats
#
# Bitcoin block files
0 lelong 0xD9B4BEF9 Bitcoin
>(4.l+40) lelong 0xD9B4BEF9 reverse block
>>4 lelong x \b, size %u
# normal block below
>0 default x block
>>4 lelong x \b, size %u
>>8 lelong&0xE0000000 0x20000000
>>>8 lelong x \b, BIP9 0x%x
>>8 lelong&0xE0000000 !0x20000000
>>>8 lelong x \b, version 0x%x
>>76 ledate x \b, %s UTC
# VarInt counter
>>88 ubyte <0xfd \b, txcount %u
>>88 ubyte 0xfd
>>>89 leshort x \b, txcount %u
>>88 ubyte 0xfe
>>>89 lelong x \b, txcount %u
>>88 ubyte 0xff
>>>89 lequad x \b, txcount %llu
!:ext dat
# option to find more blocks in the file
#>>(4.l+8) indirect x ;
# LevelDB
-8 lequad 0xdb4775248b80fb57 LevelDB table data
# http://www.tarsnap.com/scrypt.html
# see scryptenc_setup() in lib/scryptenc/scryptenc.c
0 string scrypt\0 scrypt encrypted file
>7 byte x \b, N=2**%d
>8 belong x \b, r=%d
>12 belong x \b, p=%d
# https://age-encryption.org/
# Only the first recipient is printed in detail to prevent repetitive output
# in extreme cases ("ssh-rsa, ssh-rsa, ssh-rsa, ...").
0 string age-encryption.org/v1\n age encrypted file
>25 regex/128 \^[^\040]+ \b, %s recipient
>>25 string scrypt
>>>&0 regex/64 [0-9]+\$ (N=2**%s)
>>&0 search/256 \n->\040 \b, among others
0 string -----BEGIN\040AGE\040ENCRYPTED\040FILE----- age encrypted file, ASCII armored

6
magic/Magdir/ctags Normal file
View file

@ -0,0 +1,6 @@
# ----------------------------------------------------------------------------
# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
# ctags: file (1) magic for Exuberant Ctags files
# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
0 search/1 =!_TAG Exuberant Ctags tag file text

23
magic/Magdir/ctf Normal file
View file

@ -0,0 +1,23 @@
#--------------------------------------------------------------
# ctf: file(1) magic for CTF (Common Trace Format) trace files
#
# Specs. available here: <https://www.efficios.com/ctf>
#--------------------------------------------------------------
# CTF trace data
0 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE)
0 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE)
# CTF metadata (packetized)
0 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE)
>35 byte x \b, v%d
>36 byte x \b.%d
0 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE)
>35 byte x \b, v%d
>36 byte x \b.%d
# CTF metadata (plain text)
0 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata
!:strength + 5 # this is to make sure we beat C
>&0 regex [0-9]+\\.[0-9]+ \b, v%s

8
magic/Magdir/cubemap Normal file
View file

@ -0,0 +1,8 @@
#------------------------------------------------------------------------------
# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com>
#
0 string ACMP Map file for the AssaultCube FPS game
0 string CUBE Map file for cube and cube2 engine games
0 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games

56
magic/Magdir/cups Normal file
View file

@ -0,0 +1,56 @@
#------------------------------------------------------------------------------
# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $
# Cups: file(1) magic for the cups raster file format
# From: Laurent Martelli <martellilaurent@gmail.com>
# https://www.cups.org/documentation.php/spec-raster.html
#
0 name cups-le
>280 lelong x \b, %d
>284 lelong x \bx%d dpi
>376 lelong x \b, %dx
>380 lelong x \b%d pixels
>388 lelong x %d bits/color
>392 lelong x %d bits/pixel
>400 lelong 0 ColorOrder=Chunky
>400 lelong 1 ColorOrder=Banded
>400 lelong 2 ColorOrder=Planar
>404 lelong 0 ColorSpace=gray
>404 lelong 1 ColorSpace=RGB
>404 lelong 2 ColorSpace=RGBA
>404 lelong 3 ColorSpace=black
>404 lelong 4 ColorSpace=CMY
>404 lelong 5 ColorSpace=YMC
>404 lelong 6 ColorSpace=CMYK
>404 lelong 7 ColorSpace=YMCK
>404 lelong 8 ColorSpace=KCMY
>404 lelong 9 ColorSpace=KCMYcm
>404 lelong 10 ColorSpace=GMCK
>404 lelong 11 ColorSpace=GMCS
>404 lelong 12 ColorSpace=WHITE
>404 lelong 13 ColorSpace=GOLD
>404 lelong 14 ColorSpace=SILVER
>404 lelong 15 ColorSpace=CIE XYZ
>404 lelong 16 ColorSpace=CIE Lab
>404 lelong 17 ColorSpace=RGBW
>404 lelong 18 ColorSpace=sGray
>404 lelong 19 ColorSpace=sRGB
>404 lelong 20 ColorSpace=AdobeRGB
# Cups Raster image format, Big Endian
0 string RaS
>3 string t Cups Raster version 1, Big Endian
>3 string 2 Cups Raster version 2, Big Endian
>3 string 3 Cups Raster version 3, Big Endian
!:mime application/vnd.cups-raster
>0 use \^cups-le
# Cups Raster image format, Little Endian
1 string SaR
>0 string t Cups Raster version 1, Little Endian
>0 string 2 Cups Raster version 2, Little Endian
>0 string 3 Cups Raster version 3, Little Endian
!:mime application/vnd.cups-raster
>0 use cups-le

11
magic/Magdir/dact Normal file
View file

@ -0,0 +1,11 @@
#------------------------------------------------------------------------------
# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
# dact: file(1) magic for DACT compressed files
#
0 long 0x444354C3 DACT compressed data
>4 byte >-1 (version %i.
>5 byte >-1 $BS%i.
>6 byte >-1 $BS%i)
>7 long >0 $BS, original size: %i bytes
>15 long >30 $BS, block size: %i bytes

886
magic/Magdir/database Normal file
View file

@ -0,0 +1,886 @@
#------------------------------------------------------------------------------
# $File: database,v 1.69 2023/01/12 00:14:04 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
# Will be maintained as part of the GDBM distribution in the future.
# <downsj@teeny.org>
0 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit
!:mime application/x-gdbm
0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old
!:mime application/x-gdbm
0 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit
!:mime application/x-gdbm
0 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit
!:mime application/x-gdbm
0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old
!:mime application/x-gdbm
0 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit
!:mime application/x-gdbm
0 string GDBM GNU dbm 2.x database
!:mime application/x-gdbm
#
# Berkeley DB
#
# Ian Darwin's file /etc/magic files: big/little-endian version.
#
# Hash 1.85/1.86 databases store metadata in network byte order.
# Btree 1.85/1.86 databases store the metadata in host byte order.
# Hash and Btree 2.X and later databases store the metadata in host byte order.
0 long 0x00061561 Berkeley DB
!:mime application/x-dbm
>8 belong 4321
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, native byte-order)
>8 belong 1234
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, little-endian)
0 belong 0x00061561 Berkeley DB
>8 belong 4321
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, big-endian)
>8 belong 1234
>>4 belong >2 1.86
>>4 belong <3 1.85
>>4 belong >0 (Hash, version %d, native byte-order)
0 long 0x00053162 Berkeley DB 1.85/1.86
>4 long >0 (Btree, version %d, native byte-order)
0 belong 0x00053162 Berkeley DB 1.85/1.86
>4 belong >0 (Btree, version %d, big-endian)
0 lelong 0x00053162 Berkeley DB 1.85/1.86
>4 lelong >0 (Btree, version %d, little-endian)
12 long 0x00061561 Berkeley DB
>16 long >0 (Hash, version %d, native byte-order)
12 belong 0x00061561 Berkeley DB
>16 belong >0 (Hash, version %d, big-endian)
12 lelong 0x00061561 Berkeley DB
>16 lelong >0 (Hash, version %d, little-endian)
12 long 0x00053162 Berkeley DB
>16 long >0 (Btree, version %d, native byte-order)
12 belong 0x00053162 Berkeley DB
>16 belong >0 (Btree, version %d, big-endian)
12 lelong 0x00053162 Berkeley DB
>16 lelong >0 (Btree, version %d, little-endian)
12 long 0x00042253 Berkeley DB
>16 long >0 (Queue, version %d, native byte-order)
12 belong 0x00042253 Berkeley DB
>16 belong >0 (Queue, version %d, big-endian)
12 lelong 0x00042253 Berkeley DB
>16 lelong >0 (Queue, version %d, little-endian)
# From Max Bowsher.
12 long 0x00040988 Berkeley DB
>16 long >0 (Log, version %d, native byte-order)
12 belong 0x00040988 Berkeley DB
>16 belong >0 (Log, version %d, big-endian)
12 lelong 0x00040988 Berkeley DB
>16 lelong >0 (Log, version %d, little-endian)
#
#
# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
0 string/b RRD\0 RRDTool DB
>4 string/b x version %s
>>10 short !0 16bit aligned
>>>10 bedouble 8.642135e+130 big-endian
>>>>18 short x 32bit long (m68k)
>>10 short 0
>>>12 long !0 32bit aligned
>>>>12 bedouble 8.642135e+130 big-endian
>>>>>20 long 0 64bit long
>>>>>20 long !0 32bit long
>>>>12 ledouble 8.642135e+130 little-endian
>>>>>24 long 0 64bit long
>>>>>24 long !0 32bit long (i386)
>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian
>>>>>24 short !0 32bit long (arm)
>>8 quad 0 64bit aligned
>>>16 bedouble 8.642135e+130 big-endian
>>>>24 long 0 64bit long (s390x)
>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC)
>>>16 ledouble 8.642135e+130 little-endian
>>>>28 long 0 64bit long (alpha/amd64/ia64)
>>>>28 long !0 32bit long (armel/mipsel)
#----------------------------------------------------------------------
# ROOT: file(1) magic for ROOT databases
#
0 string root\0 ROOT file
>4 belong x Version %d
>33 belong x (Compression: %d)
# XXX: Weak magic.
# Alex Ott <ott@jet.msk.su>
## Paradox file formats
#2 leshort 0x0800 Paradox
#>0x39 byte 3 v. 3.0
#>0x39 byte 4 v. 3.5
#>0x39 byte 9 v. 4.x
#>0x39 byte 10 v. 5.x
#>0x39 byte 11 v. 5.x
#>0x39 byte 12 v. 7.x
#>>0x04 byte 0 indexed .DB data file
#>>0x04 byte 1 primary index .PX file
#>>0x04 byte 2 non-indexed .DB data file
#>>0x04 byte 3 non-incrementing secondary index .Xnn file
#>>0x04 byte 4 secondary index .Ynn file
#>>0x04 byte 5 incrementing secondary index .Xnn file
#>>0x04 byte 6 non-incrementing secondary index .XGn file
#>>0x04 byte 7 secondary index .YGn file
#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
# updated by Joerg Jenderek at Feb 2013
# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
0 ubelong&0x0000FFFF <0x00000C20
!:strength +10
# skip Infocom game Z-machine
>2 ubyte >0
# skip Androids *.xml
>>3 ubyte >0
>>>3 ubyte <32
# 1 < version VV
>>>>0 ubyte >1
# skip HELP.CA3 by test for reserved byte ( NULL )
>>>>>27 ubyte 0
# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
#>>>>>30 ubeshort x 30NULL?%x
# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
>>>>>>24 ubelong&0xffFFFFff >0x01302000
# .DBF or .MDX
>>>>>>24 ubelong&0xffFFFFff <0x01302001
# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
>>>>>>>24 ubelong&0xffFFFFff =0
# test for 2 reserved NULL bytes,transaction and encryption byte flag
>>>>>>>>12 ubelong&0xFFFFfEfE 0
# test for MDX flag
>>>>>>>>>28 ubyte x
>>>>>>>>>28 ubyte&0xf8 0
# header size >= 32
>>>>>>>>>>8 uleshort >31
# skip PIC15736.PCX by test for language driver name or field name
>>>>>>>>>>>32 ubyte >0
#!:mime application/x-dbf; charset=unknown-8bit ??
#!:mime application/x-dbase
>>>>>>>>>>>>0 use xbase-type
# database file
>>>>>>>>>>>>28 ubyte&0x04 =0 \b DBF
!:ext dbf
>>>>>>>>>>>>28 ubyte&0x04 =4 \b DataBaseContainer
!:ext dbc
>>>>>>>>>>>>4 lelong 0 \b, no records
>>>>>>>>>>>>4 lelong >0 \b, %d record
# plural s appended
>>>>>>>>>>>>>4 lelong >1 \bs
# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
>>>>>>>>>>>>10 uleshort x * %d
# file size = records * record size + header size
>>>>>>>>>>>>1 ubyte x \b, update-date
>>>>>>>>>>>>1 use xbase-date
# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=%#x
# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=%#x
#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
# MDX or CDX index
>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
#>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
# 1st record offset + 1 = header size
>>>>>>>>>>>>8 uleshort >0
>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
>>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
>>>>>>>24 ubelong&0x0133f7ff >0
# test for reserved NULL byte
>>>>>>>>47 ubyte 0
# test for valid TAG key format (0x10 or 0)
>>>>>>>>>559 ubyte&0xeF 0
# test MM <= 12
>>>>>>>>>>45 ubeshort <0x0C20
>>>>>>>>>>>45 ubyte >0
>>>>>>>>>>>>46 ubyte <32
>>>>>>>>>>>>>46 ubyte >0
#!:mime application/x-mdx
>>>>>>>>>>>>>>0 use xbase-type
>>>>>>>>>>>>>>0 ubyte x \b MDX
>>>>>>>>>>>>>>1 ubyte x \b, creation-date
>>>>>>>>>>>>>>1 use xbase-date
>>>>>>>>>>>>>>44 ubyte x \b, update-date
>>>>>>>>>>>>>>44 use xbase-date
# No.of tags in use (1,2,5,12)
>>>>>>>>>>>>>>28 uleshort x \b, %d
# No. of entries in tag (0x30)
>>>>>>>>>>>>>>25 ubyte x \b/%d tags
# Length of tag
>>>>>>>>>>>>>>26 ubyte x * %d
# 1st tag name_
>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
# 2nd tag name
#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
#
# Print the xBase names of different version variants
0 name xbase-type
>0 ubyte <2
# 1 < version
>0 ubyte >1
>>0 ubyte 0x02 FoxBase
!:mime application/x-dbf
# like: ACCESS.DBF USER.DBF dbase3date.dbf mitarbei.dbf produkte.dbf umlaut-test-v2.dbf
# FoxBase+/dBaseIII+, no memo
>>0 ubyte 0x03 FoxBase+/dBase III
!:mime application/x-dbf
# like: 92DATA.DBF MSCATLOG.DBF SYLLABI2.DBF SYLLABUS.DBF T4.DBF Teleadr.dbf us_city.dbf
# dBASE IV no memo file
>>0 ubyte 0x04 dBase IV
!:mime application/x-dbf
# like: Quattro-test11.dbf umlaut-test-v4.dbf
# dBASE V no memo file
>>0 ubyte 0x05 dBase V
!:mime application/x-dbf
# like: dbase4double.dbf Quattro-test2.dbf umlaut-test7.dbf
!:ext dbf
# probably Apollo Database Server 9.7? xBase (0x6)
>>0 ubyte 0x06 Apollo
!:mime application/x-dbf
# like: ALIAS.DBF CRYPT.DBF PROCS.DBF USERS.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x2F FoxBase+/Dbase III plus, no memo
!:mime application/x-dbf
# no example
>>0 ubyte 0x30 Visual FoxPro
!:mime application/x-dbf
# like: 26FRX.DBF 30DBC.DBF 30DBCPRO.DBF BEHINDSC.DBF USER_LEV.DBF
# Microsoft Visual FoxPro Database Container File like: FOXPRO-DB-TEST.DBC TESTDATA.DBC TASTRADE.DBC
>>0 ubyte 0x31 Visual FoxPro, autoincrement
!:mime application/x-dbf
# like: AI_Table.DBF dbase_31.dbf w_cityFoxpro.dbf
# Visual FoxPro, with field type Varchar or Varbinary
>>0 ubyte 0x32 Visual FoxPro, with field type Varchar
!:mime application/x-dbf
# like: dbase_32.dbf
# dBASE IV SQL, no memo;dbv memo var size (Flagship)
>>0 ubyte 0x43 dBase IV, with SQL table
!:mime application/x-dbf
# like: ASSEMBLY.DBF INVENTRY.DBF STAFF.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x62 dBase IV, with SQL table
#!:mime application/x-dbf
# no example
# dBASE IV, with memo!!
>>0 ubyte 0x7b dBase IV, with memo
!:mime application/x-dbf
# like: test3memo.DBF dbase5.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x82 dBase IV, with SQL system
#!:mime application/x-dbf
# no example
# FoxBase+/dBaseIII+ with memo .DBT!
>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
!:mime application/x-dbf
# like: T2.DBF t3.DBF biblio.dbf dbase_83.dbf dbase3dbt0_4.dbf fsadress.dbf stop.dbf
# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
>>0 ubyte 0x87 VISUAL OBJECTS, with memo file
!:mime application/x-dbf
# like: ACCESS.DBF dbase3date.dbf dbase3float.dbf holdings.dbf mitarbei.dbf
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
#!:mime application/x-dbf
# no example
# dBASE IV with memo!
>>0 ubyte 0x8B dBase IV, with memo .DBT
!:mime application/x-dbf
# like: animals.dbf archive.dbf callin.dbf dbase_8b.dbf phnebook.dbf t6.dbf
# dBase IV with SQL Table,no memo?
>>0 ubyte 0x8E dBase IV, with SQL table
!:mime application/x-dbf
# like: dbase5.DBF test3memo.DBF test-memo.DBF
# .dbv and .dbt memo (Flagship)?
>>0 ubyte 0xB3 Flagship
!:mime application/x-dbf
# no example
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0xCA dBase IV with memo .DBT
#!:mime application/x-dbf
# no example
# dBASE IV with SQL table, with memo .DBT
>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
!:mime application/x-dbf
# like: dbase5.DBF test3memo.DBF test-memo.DBF
# HiPer-Six format;Clipper SIX, with SMT memo file
>>0 ubyte 0xE5 Clipper SIX with memo
!:mime application/x-dbf
# like: dbase5.DBF test3memo.DBF test-memo.DBF testClipper.dbf DATA.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
#!:mime application/x-dbf
# no example
>>0 ubyte 0xF5 FoxPro with memo
!:mime application/x-dbf
# like: CUSTOMER.DBF FOXUSER1.DBF Invoice.DBF NG.DBF OBJSAMP.DBF dbase_f5.dbf kunde.dbf
# probably Apollo Database Server 9.7 with SQL and memo mask? xBase (0xF6)
>>0 ubyte 0xF6 Apollo, with SQL table with memo
!:mime application/x-dbf
# like: SCRIPTS.DBF
# https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
#>>0 ubyte 0xFA FoxPro 2.x, with memo
#!:mime application/x-dbf
# no example
# unknown version (should not happen)
>>0 default x xBase
!:mime application/x-dbf
>>>0 ubyte x (%#x)
# flags in version byte
# DBT flag (with dBASE III memo .DBT)!!
# >>0 ubyte&0x80 >0 DBT_FLAG=%x
# memo flag ??
# >>0 ubyte&0x08 >0 MEMO_FLAG=%x
# SQL flag ??
# >>0 ubyte&0x70 >0 SQL_FLAG=%x
# test and print the date of xBase .DBF .MDX
0 name xbase-date
# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
>0 ubelong x
>1 ubyte <13
>>1 ubyte >0
>>>2 ubyte >0
>>>>2 ubyte <32
>>>>>0 ubyte x
# YY is interpreted as 20YY or 19YY
>>>>>>0 ubyte <100 \b %.2d
# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
>>>>>>0 ubyte >99 \b %d
>>>>>1 ubyte x \b-%d
>>>>>2 ubyte x \b-%d
# dBase memo files .DBT or .FPT
# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
16 ubyte <4
>16 ubyte !2
>>16 ubyte !1
# next free block index is positive
>>>0 ulelong >0
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
>>>>17 ubelong&0xFFfdFEff 0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
>>>>>20 ubelong&0xFF01209B 0x00000000
# dBASE III
>>>>>>16 ubyte 3
# skip with invalid "low" 1st item "\0\0\0\0" StateRepository-Deployment.srd-shm "\001\010\0\0" gcry_cast5.mod
>>>>>>>512 ubyte >040
# skip with valid 1st item "rintf" keylayouts.mod
# by looking for valid terminating character Ctrl-Z like in test.dbt
>>>>>>>>513 search/3308 \032
# skip GRUB plan9.mod with invalid second terminating character 007
# by checking second terminating character Ctrl-Z like in test.dbt
>>>>>>>>>&0 ubyte 032
# dBASE III DBT with two Ctr-Z terminating characters
>>>>>>>>>>0 use dbase3-memo-print
# second terminating character \0 like in dbase-memo.dbt or GRUB nativedisk.mod
>>>>>>>>>&0 ubyte 0
# skip GRUB nativedisk.mod with grub_mod_init\0grub_mod_fini\0grub_fs_autoload_hook\0
>>>>>>>>>>0x1ad string !grub_mod_init
# like dbase-memo.dbt
>>>>>>>>>>>0 use dbase3-memo-print
# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
>>>>>>16 ubyte 0
# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
>>>>>>>20 uleshort 0
# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
>>>>>>>>8 ulong =0
>>>>>>>>>6 ubeshort >0
# skip emacs.PIF
>>>>>>>>>>4 ushort 0
# check for valid FoxPro field type
>>>>>>>>>>>512 ubelong <3
# skip LXMDCLN4.OUT LXMDCLN6.OUT LXMDALG6.OUT with invalid blocksize 170=AAh
>>>>>>>>>>>>6 ubeshort&0x002f 0
>>>>>>>>>>>>>0 use foxpro-memo-print
# dBASE III DBT , garbage
# skip WORD1XW.DOC with improbably high free block index
>>>>>>>>>0 ulelong <0x400000
# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item
>>>>>>>>>>513 ubyte >037
# skip DOS executables CPQ0TD.DRV E30ODI.COM IBM0MONO.DRV by looking for printable 1st character of 1st memo item
>>>>>>>>>>>512 ubyte >037
# skip few (14/758) Microsoft Event Trace Logs (boot_BASE+CSWITCH_1.etl DlTel-Merge.etl UpdateUx.006.etl) with invalid "high" 1st item \377\377
>>>>>>>>>>>>512 ubyte <0377
# skip some Commodore 64 Art Studio (Deep_Strike.aas dragon's_lair_ii.aas), some Atari DEGAS Elite bitmap (ELEPHANT.PC3 ST.PC2)
# some probably old GRUB modules (part_sun.mod) and virtual-boy-wario-land.vb.
# by looking for valid terminating character Ctrl-Z
>>>>>>>>>>>>>513 search/523 \032
# Atari DEGAS bitmap ST.PC2 with 0370 as second terminating character
#>>>>>>>>>>>>>>&0 ubyte x 2ND_CHAR_IS=%o
# dBASE III DBT with two Ctr-Z terminating characters like dbase3dbt0_1.dbt dbase_83.dbt
>>>>>>>>>>>>>>&0 ubyte 032
>>>>>>>>>>>>>>>0 use dbase3-memo-print
# second terminating character \0 like in pcidump.mod or fsadress.dbt umlaut-dbf-cmd.dbt
>>>>>>>>>>>>>>&0 ubyte 0
# look for old GRUB module pcidump.mod with specific content "pcidump\0Show raw dump of the PCI configuration space"
>>>>>>>>>>>>>>>514 search/0x11E pcidump\0Show
# dBASE III DBT with Ctr-Z + \0 terminating characters like fsadress.dbt
>>>>>>>>>>>>>>>514 default x
# unusual dBASE III DBT like fsadress.dbt umlaut-dbf-cmd.dbt
>>>>>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE III DBT like angest.dbt, or garbage PCX DBF
>>>>>>>>8 ubelong !0
# skip PCX and some DBF by test for for reserved NULL bytes
>>>>>>>>>510 ubeshort 0
# skip bad symples with improbably high free block index above 2 GiB file limit
>>>>>>>>>>0 ulelong <0x400000
# skip AI070GEP.EPS by printable 1st character of 1st memo item
>>>>>>>>>>>512 ubyte >037
# skip some Microsoft Visual C, OMF library like: BZ2.LIB WATTCPWL.LIB ZLIB.LIB
>>>>>>>>>>>>512 ubyte <0200
# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
>>>>>>>>>>>>>513 ubyte >037
# skip few (8/758) Microsoft Event Trace Logs (WBEngine.3.etl Wifi.etl) with valid 1st item like
# "9600.20369.amd64fre.winblue_ltsb_escrow.220427-1727"
# "9600.19846.amd64fre.winblue_ltsb_escrow.200923-1735"
# "10586.494.amd64fre.th2_release_sec.160630-1736"
# by looking for valid terminating character Ctrl-Z
>>>>>>>>>>>>>>513 search/0x11E \032
# followed by second character Ctrl-Z implies typical DBT
>>>>>>>>>>>>>>>&0 ubyte 032
# examples like: angest.dbt
>>>>>>>>>>>>>>>>0 use dbase3-memo-print
>>>>>>>>>>>>>>>&0 ubyte 0
# no example found here with terminating sequence CTRL-Z + \0
>>>>>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE IV DBT with positive block size
>>>>>>>20 uleshort >0
# dBASE IV DBT with valid block length like 512, 1024
# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
# skip also 3600h 3E00h size
>>>>>>>>20 uleshort&0xE00f 0
>>>>>>>>>0 use dbase4-memo-print
# Print the information of dBase III DBT memo file
0 name dbase3-memo-print
>0 ubyte x dBase III DBT
!:mime application/x-dbt
!:ext dbt
# instead 3 as version number 0 for unusual examples like biblio.dbt
>16 ubyte !3 \b, version number %u
# Number of next available block for appending data
#>0 lelong =0 \b, next free block index %u
>0 lelong !0 \b, next free block index %u
# no positive block length
#>20 uleshort =0 \b, block length %u
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated often by \032\032
# like: "WHAT IS XBASE" test.dbt "Borges, Malte" biblio.dbt "First memo\032\032" T2.DBT
>512 string >\0 \b, 1st item "%s"
# For DEBUGGING
#>512 ubelong x \b, 1ST item %#8.8x
#>513 search/0x225 \032 FOUND_TERMINATOR
#>>&0 ubyte 032 2xCTRL_Z
# fsadress.dbt has 1 Ctrl-Z terminator followed by nil byte
#>>&0 ubyte 0 1xCTRL_Z
# https://www.clicketyclick.dk/databases/xbase/format/dbt.html
# Print the information of dBase IV DBT memo file
0 name dbase4-memo-print
>0 lelong x dBase IV DBT
!:mime application/x-dbt
!:ext dbt
# 8 character shorted main name of corresponding dBASE IV DBF file
>8 ubelong >0x20000000
# skip unusual like for angest.dbt
>>20 uleshort >0
>>>8 string >\0 \b of %-.8s.DBF
# value 0 implies 512 as size
#>4 ulelong =0 \b, blocks size %u
# size of blocks not reliable like 0x2020204C in angest.dbt
>4 ulelong !0
>>4 ulelong&0x0000003f 0 \b, blocks size %u
# dBase IV DBT with positive block length (found 512 , 1024)
>20 uleshort >0 \b, block length %u
# next available block
#>0 lelong =0 \b, next free block index %u
>0 lelong !0 \b, next free block index %u
>20 uleshort >0
>>(20.s) ubelong x
>>>&-4 use dbase4-memofield-print
# unusual dBase IV DBT without block length (implies 512 as length)
>20 uleshort =0
>>512 ubelong x
>>>&-4 use dbase4-memofield-print
# Print the information of dBase IV memo field
0 name dbase4-memofield-print
# free dBase IV memo field
>0 ubelong !0xFFFF0800
>>0 lelong x \b, next free block %u
>>4 lelong x \b, next used block %u
# used dBase IV memo field
>0 ubelong =0xFFFF0800
# length of memo field
>>4 lelong x \b, field length %d
>>>8 string >\0 \b, 1st used item "%s"
# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
# Print the information of FoxPro FPT memo file
0 name foxpro-memo-print
>0 belong x FoxPro FPT
!:mime application/x-fpt
!:ext fpt
# Size of blocks for FoxPro ( 64,256 ); probably a multiple of two
>6 ubeshort x \b, blocks size %u
# next available block
#>0 belong =0 \b, next free block index %u
>0 belong !0 \b, next free block index %u
# field type ( 0~picture, 1~memo, 2~object )
>512 ubelong <3 \b, field type %u
# length of memo field
>512 ubelong 1
>>516 belong >0 \b, field length %d
>>>520 string >\0 \b, 1st item "%s"
# Summary: DBASE Compound Index file *.CDX and FoxPro index *.IDX
# From: Joerg Jenderek
# URL: https://www.clicketyclick.dk/databases/xbase/format/cdx.html
# https://www.clicketyclick.dk/databases/xbase/format/idx.html
# https://www.clicketyclick.dk/databases/xbase/format/idx_comp.html
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/s/sybase-ianywhere-cdx.trid.xml
# https://mark0.net/download/triddefs_xml.7z/defs/c/cdx-vfp7.trid.xml
# like: kunde.cdx
0 ulelong 0x1C00
>0 use xbase-index
# like: SYLLABI2.CDX SYLLABUS.CDX
0 ulelong 0x0800
>0 use xbase-index
# often in xBase index pointer to root node 400h
0 ulelong 0x0400
# skip most Maple help database *.hdb with version tag handled by ./maple
>1028 string !version
# skip Maple help database hsum.hdb checking for valid reserved area
>>492 quad =0
# skip remaining Maple help database *.hdb by checking key length
#>>>12 uleshort !0x000F KEY_LENGTHVALID
>>>0 use xbase-index
# display information about dBase/FoxPro index
0 name xbase-index
>0 ulelong x xBase
!:mime application/x-dbase-index
>14 ubyte &0x40 compound index
# DCX for FoxPro database index like: TESTDATA.DCX
!:ext cdx/dcx
>14 ubyte ^0x40 index
# only 1 example like: TEST.IDX
!:ext idx
# pointer to root node like: 1C00h 800h often 400h
>0 ulelong !0x400 \b, root pointer %#x
# Pointer to free node list: often 0 but -1 if not present
>4 ulelong !0 \b, free node pointer %#x
# MAYBE number of pages in file (Foxbase, FoxPro 1.x) or
# http://www.foxpert.com/foxpro/knowlbits/files/knowlbits_200708_1.HTM
# Whenever Visual FoxPro updates the index file it increments this reserved field
# Reserved for internal use like: 02000000h 03000000h 460c0000h 780f0000h 89000000h 9fdc0100h often 0
>8 ulelong !0 \b, reserved counter %#x
# length of key like: mostly 000Ah 0028h (TEST.IDX)
>12 uleshort !0x000A \b, key length %#x
# index options like: 24h E0h E8h
# 1~a unique index 8~index has FOR clause 32~compact index format 64~compound index header
# 16~Bit vector (SoftC) 128~Structure index (FoxPro)
>14 ubyte x \b, index options (%#x
>14 ubyte &0x01 \b, unique
>14 ubyte &0x08 \b, has FOR clause
>14 ubyte &0x10 \b, bit vector (SoftC)
>14 ubyte &0x20 \b, compact format
#>14 ubyte &0x40 \b, compound header
>14 ubyte &0x80 \b, structure
>14 ubyte x \b)
# WHAT EXACTLY IS THAT? index signature like: 0 (sybase-ianywhere-cdx.trid.xml) 1 (cdx-vfp7.trid.xml)
>15 ubyte !0 \b, index signature %u
# reserved area (0-bytes) til about 500, but not for uncompressed Index files *.idx
>16 quad !0 \b, at 16 reserved %#llx
>492 quad !0 \b, at 492 reserved %#llx
# for IDX variant
#>14 ubyte ^0x40 IDX
# for CDX variant
>14 ubyte &0x40
# Ascending or descending: 0~ascending 1~descending
>>502 uleshort x \b, sort order %u
# Total expression length (FoxPro 2) like: 0 1
>>504 uleshort !0 \b, expression length %u
# FOR expression pool length like: 1
>>506 uleshort !1 \b, FOR expression pool length %#x
# reserved for internal use like: 0
>>508 uleshort !0 \b, at 0x508 reserved %#x
# Key expression pool length like: 1
>>510 uleshort !1 \b, key expression pool length %#x
# 512 - 1023 Key & FOR expression pool (uncompiled)
>>512 quad !0 \b, key expression pool %#llx
#>>520 quad !0 \b, key expression pool %#llx
# Summary: dBASE IV Printer Form *.PRF
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/.dbf#Other_file_types_found_in_dBASE
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/p/prf-dbase.trid.xml
0 ubeshort 0x0400
# skip some Xbase Index files *.ndx and Infocom (Z-machine 4) *.z4 handled by ./adventure
# by looking for valid printer driver name extension
>0x58 search/8 .PR2
>>0 use xbase-prf
# display information of dbase print form like printer driver *.PR2
0 name xbase-prf dBase Printer Form
!:mime application/x-dbase-prf
!:ext prf
# MAYBE version? like: 4~DBASE IV
#>0 ubyte x \b, version %u
# MAYBE flag like: 1~with output file name 0~not
#>2 ubyte !0 \b, flag %u
# optional printer text output file name like E:\DBASE\IV\T6.txt
>3 string >\0 \b, output file %s
# probably padding with nils til 0x53
#>0x48 uquad !0 \b, at 0x48 padding %#llx
# dBASE IV printer driver name like: Generic.PR2 ASCII.PR2
>0x56 string >\0 \b, using printer driver %s
# 2 is probably last character of previous dBASE printer driver name
#>0x60 ubyte !0x32 \b, at 0x60 %#x
# probably padding with nils til 0xa8
#>0x61 uquad !0 \b, at 0x61 padding %#llx
# unknown 0x03020300 0x03020100 at 0xa8
>0xa8 ubelong x \b, at 0xa8 unknown %#8.8x
# probably padding with nils til 0x2aa
#>0x2a0 uquad !0 \b, at 0x2a0 padding %#llx
# unknown 0x100ff7f01000001 at 0x2AB
>0x2ab ubequad !0x100ff7f01000001 \b, at 0x2ab unknown %#llx
# unknown 0x0042 at 0x2b3
>0x2b3 ubeshort !0x0042 \b, at 0x2b3 unknown %#4.4x
# unknown last 4 bytes at 0x2b6 like: 0 0x23
>0x2b6 ubelong !0 \b, at 0x2b6 unknown %#8.8x
# TODO:
# DBASE index file *.NDX
# dBASE compiled Format *.FMO
# FoxPro Database memo file *.DCT
# FoxPro Forms Memo *.SCT
# FoxPro Generated Menu Program *.MPR
# FoxPro Report *.FRX
# FoxPro Report Memo *.FRT
# Foxpro Generated Screen Program *.SPR
# Foxpro memo *.PJT
## End of XBase database stuff
# MS Access database
4 string Standard\ Jet\ DB Microsoft Access Database
!:mime application/x-msaccess
4 string Standard\ ACE\ DB Microsoft Access Database
!:mime application/x-msaccess
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
# Reference: https://github.com/libyal/libesedb/archive/master.zip
# libesedb-master/documentation/
# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
# Note: also known as "JET Blue". Used by numerous Windows components such as
# Windows Search, Mail, Exchange and Active Directory.
4 ubelong 0xefcdab89
# unknown1
>132 ubelong 0 Extensible storage engine
!:mime application/x-ms-ese
# file_type 0~database 1~stream
>>12 ulelong 0 DataBase
# Security DataBase (sdb)
!:ext edb/sdb
>>12 ulelong 1 STreaMing
!:ext stm
# format_version 620h
>>8 uleshort x \b, version %#x
>>10 uleshort >0 revision %#4.4x
>>0 ubelong x \b, checksum %#8.8x
# Page size 4096 8192 32768
>>236 ulequad x \b, page size %lld
# database_state
>>52 ulelong 1 \b, JustCreated
>>52 ulelong 2 \b, DirtyShutdown
#>>52 ulelong 3 \b, CleanShutdown
>>52 ulelong 4 \b, BeingConverted
>>52 ulelong 5 \b, ForceDetach
# Windows NT major version when the databases indexes were updated.
>>216 ulelong x \b, Windows version %d
# Windows NT minor version
>>220 ulelong x \b.%d
# From: Joerg Jenderek
# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
8 string sdbf
>7 ubyte 0
# TAG_TYPE_LIST+TAG_INDEXES
>>12 uleshort 0x7802 Windows application compatibility Shim DataBase
# version? 2 3
#>>>0 ulelong x \b, version %d
!:mime application/x-ms-sdb
!:ext sdb
# TDB database from Samba et al - Martin Pool <mbp@samba.org>
0 string TDB\ file TDB database
>32 lelong 0x2601196D version 6, little-endian
>>36 lelong x hash size %d bytes
# SE Linux policy database
0 lelong 0xf97cff8c SE Linux policy
>16 lelong x v%d
>20 lelong 1 MLS
>24 lelong x %d symbols
>28 lelong x %d ocons
# ICE authority file data (Wolfram Kleff)
2 string ICE ICE authority data
# X11 Xauthority file (Wolfram Kleff)
10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
# From: Maxime Henrion <mux@FreeBSD.org>
# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
0 string PGDMP PostgreSQL custom database dump
>5 byte x - v%d
>6 byte x \b.%d
>5 beshort <0x101 \b-0
>5 beshort >0x100
>>7 byte x \b-%d
# Type: Advanced Data Format (ADF) database
# URL: https://www.grc.nasa.gov/WWW/cgns/adf/
# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
0 string @(#)ADF\ Database CGNS Advanced Data Format
# Tokyo Cabinet magic data
# http://tokyocabinet.sourceforge.net/index.html
0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
>14 string x \b (%s)
>32 byte 0 \b, Hash
!:mime application/x-tokyocabinet-hash
>32 byte 1 \b, B+ tree
!:mime application/x-tokyocabinet-btree
>32 byte 2 \b, Fixed-length
!:mime application/x-tokyocabinet-fixed
>32 byte 3 \b, Table
!:mime application/x-tokyocabinet-table
>33 byte &1 \b, [open]
>33 byte &2 \b, [fatal]
>34 byte x \b, apow=%d
>35 byte x \b, fpow=%d
>36 byte &0x01 \b, [large]
>36 byte &0x02 \b, [deflate]
>36 byte &0x04 \b, [bzip]
>36 byte &0x08 \b, [tcbs]
>36 byte &0x10 \b, [excodec]
>40 lequad x \b, bnum=%lld
>48 lequad x \b, rnum=%lld
>56 lequad x \b, fsiz=%lld
# Type: QDBM Quick Database Manager
# From: Benoit Sibaud <bsibaud@april.org>
0 string \\[depot\\]\n\f Quick Database Manager, little endian
0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
# Type: TokyoCabinet database
# URL: http://tokyocabinet.sourceforge.net/
# From: Benoit Sibaud <bsibaud@april.org>
0 string ToKyO\ CaBiNeT\n TokyoCabinet database
>14 string x (version %s)
# From: Stephane Blondon https://www.yaal.fr
# Database file for Zope (done by FileStorage)
0 string FS21 Zope Object Database File Storage v3 (data)
0 string FS30 Zope Object Database File Storage v4 (data)
# Cache file for the database of Zope (done by ClientStorage)
0 string ZEC3 Zope Object Database Client Cache File (data)
# IDA (Interactive Disassembler) database
0 string IDA1 IDA (Interactive Disassembler) database
# Hopper (reverse engineering tool) https://www.hopperapp.com/
0 string hopperdb Hopper database
# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
# Reference: http://www.provue.com/Panorama/
# From: Joerg Jenderek
# NOTE: test only versions 4 and 6.0 with Windows
# length of Panorama database name
5 ubyte >0
# look after database name for "some" null bits
>(5.B+7) ubelong&0xF3ffF000 0
# look for first keyword
>>&1 search/2 DESIGN Panorama database
#!:mime application/x-panorama-database
!:apple KASXZEPD
!:ext pan
# database name
>>>5 pstring x \b, "%s"
#
#
# askSam Database by Stefan A. Haubenthal <polluks@web.de>
0 string askw40\0 askSam DB
#
#
# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
0 string MBSTV\040 MUIbase DB
>6 string x version %s
#
# CDB database
0 string NBCDB\012 NetBSD Constant Database
>7 byte x \b, version %d
>8 string x \b, for '%s'
>24 lelong x \b, datasize %d
>28 lelong x \b, entries %d
>32 lelong x \b, index %d
>36 lelong x \b, seed %#x
#
# Redis RDB - https://redis.io/topics/persistence
0 string REDIS Redis RDB file,
>5 regex [0-9][0-9][0-9][0-9] version %s
# Mork database.
# Used by older versions of Mozilla Suite and Firefox,
# and current versions of Thunderbird.
# From: David Korth <gerbilsoft@gerbilsoft.com>
0 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database
>23 string x \b, version %.3s
# URL: https://en.wikipedia.org/wiki/Management_Information_Format
# Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
# From: Joerg Jenderek
# Note: only tested with monitor asset reports of Dell Display Manager
# skip start like Language=fr|CA|iso8859-1
0 search/27/C Start\040Component DMI Management Information Format
#!:mime text/plain
!:mime text/x-dmtf-mif
!:ext mif

47
magic/Magdir/dataone Normal file
View file

@ -0,0 +1,47 @@
#------------------------------------------------------------------------------
# $File: dataone,v 1.3 2022/04/18 21:38:10 christos Exp $
#
# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
# Pratik Shrivastava <pratikshrivastava23@gmail.com>
#
# file formats: https://cn.dataone.org/cn/v2/formats
#------------------------------------------------------------------------------
# EML (Ecological Metadata Language Format)
0 string \<?xml\ version=
>&0 regex/1024 eml-[0-9]\\.[0-9]\\.[0-9]+ eml://ecoinformatics.org/%s
# onedcx (DataONE Dublin Core Extended v1.0)
>&0 regex/1024 onedcx/v[0-9]\\.[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0
# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
# version 001-1998)
>&0 search/1024 fgdc FGDC-STD-001-1998
# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
>&0 regex/1024 mercury/terms/v[0-9]\\.[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0
# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
>&0 search/1024 isotc211
>>&0 search/1024 eng;USA https://www.isotc211.org/2005/gmd
# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
>>&0 regex/1024 gov\\.noaa\\.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa
# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
>>&0 regex/1024 pangaea\\.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea
!:mime text/xml
# Object Reuse and Exchange Vocabulary
0 string \<?xml\ version=
>&0 search/1024 rdf
>>&0 search/1024 openarchives https://www.openarchives.org/ore/terms
!:mime application/rdf+xml
# Dryad Metadata Application Profile Version 3.1
0 string <DryadData
>&0 regex/1024 dryad-bibo/v[0-9]\\.[0-9] https://datadryad.org/profile/v3.1
!:mime text/xml

15
magic/Magdir/dbpf Normal file
View file

@ -0,0 +1,15 @@
#------------------------------------------------------------------------------
# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $
# dppf: Maxis Database Packed Files, the stored data file format used by all
# Maxis games after the Sims: http://wiki.niotso.org/DBPF
# https://www.wiki.sc4devotion.com/index.php?title=DBPF
# 13 Oct 2017, Kip Warner <kip at thevertigo dot com>
0 string DBPF Maxis Database Packed File
>4 ulelong x \b, version: %u.
>>8 ulelong x \b%u
>>>36 ulelong x \b, files: %u
>>24 ledate !0 \b, created: %s
>>28 ledate !0 \b, modified: %s
!:ext dbpf/package/dat/sc4
!:mime application/x-maxis-dbpf

146
magic/Magdir/der Normal file
View file

@ -0,0 +1,146 @@
#------------------------------------------------------------------------------
# $File: der,v 1.6 2023/01/11 23:59:49 christos Exp $
# der: file(1) magic for DER encoded files
#
# Certificate information piece
0 name certinfo
>0 der seq
>>&0 der set
>>>&0 der seq
>>>>&0 der obj_id3=550406
>>>>&0 der prt_str=x \b, countryName=%s
>>&0 der set
>>>&0 der seq
>>>>&0 der obj_id3=550408
>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s
>>&0 der set
>>>&0 der seq
>>>>&0 der obj_id3=55040a
>>>>&0 der utf8_str=x \b, organizationName=%s
>>&0 der set
>>>&0 der seq
>>>>&0 der obj_id3=550403
>>>>&0 der utf8_str=x \b, commonName=%s
>>&0 der seq
# Certificate requests
0 der seq
>&0 der seq
>>&0 der int1=00 DER Encoded Certificate request
>>&0 use certinfo
# Key Pairs
0 der seq
>&0 der int1=00
>&0 der int65=x
>&0 der int3=010001 DER Encoded Key Pair, 512 bits
0 der seq
>&0 der int1=00
>&0 der int129=x
>&0 der int3=010001 DER Encoded Key Pair, 1024 bits
0 der seq
>&0 der int1=00
>&0 der int257=x
>&0 der int3=010001 DER Encoded Key Pair, 2048 bits
0 der seq
>&0 der int1=00
>&0 der int513=x
>&0 der int3=010001 DER Encoded Key Pair, 4096 bits
0 der seq
>&0 der int1=00
>&0 der int1025=x
>&0 der int3=010001 DER Encoded Key Pair, 8192 bits
0 der seq
>&0 der int1=00
>&0 der int2049=x
>&0 der int3=010001 DER Encoded Key Pair, 16k bits
0 der seq
>&0 der int1=00
>&0 der int4097=x
>&0 der int3=010001 DER Encoded Key Pair, 32k bits
# Certificates
0 der seq
>&0 der seq
>>&0 der int2=0dfa DER Encoded Certificate, 512 bits
>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits
>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits
>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits
>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits
>>&0 der int2=0dff DER Encoded Certificate, 16k bits
>>&0 der int2=0e04 DER Encoded Certificate, 32k bits
>>&0 der int2=x DER Encoded Certificate, ? bits (%s)
>>&0 der seq
>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption
>>>&0 der obj_id9=x \b, ? Encryption (%s)
>>>&0 der null
>>&0 der seq
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=550406
>>>>>&0 der prt_str=x \b, countryName=%s
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=550408
>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=550407
>>>>>&0 der prt_str=x \b, localityName=%s
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=55040a
>>>>>&0 der prt_str=x \b, organizationName=%s
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=55040b
>>>>>&0 der prt_str=x \b, organizationUnitName=%s
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=550403
>>>>>&0 der prt_str=x \b, commonName=%s
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id9=2a864886f70d010901
>>>>>&0 der ia5_str=x \b, emailAddress=%s
#>>&0 der seq
#>>>&0 der utc_time=x \b, utcTime=%s
#>>>&0 der utc_time=x \b, utcTime=%s
>>&0 use certinfo
0 der seq
>&0 der seq
>>&0 der eoc
>>>&0 der int1=02 Certificate, Version=3
>>>&0 der int1=x Certificate, Version=%s
>>&0 der int9=x \b, Serial=%s
>>&0 der seq
>>>&0 der obj_id9=2a864886f70d01010b
>>>&0 der null
>>&0 der seq
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=550403
>>>>>&0 der utf8_str=x \b, Issuer=%s
#>>&0 der seq
#>>>&0 der utc_time=x \b, not-valid-before=%s
#>>>&0 der utc_time=x \b, not-valid-after=%s
>>&0 der seq
>>>&0 der set
>>>>&0 der seq
>>>>>&0 der obj_id3=550403
>>>>>&0 der utf8_str=x \b, Subject=%s
# PKCS#7 Signed Data (e.g. JAR Signature Block File)
# OID 1.2.840.113549.1.7.2 (2a864886f70d010702)
# Reference: https://www.rfc-editor.org/rfc/rfc2315
0 der seq
>&0 der obj_id9=2a864886f70d010702 DER Encoded PKCS#7 Signed Data
!:ext RSA/DSA/EC

12
magic/Magdir/diamond Normal file
View file

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
# diamond: file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
# The full deal is too long...
#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document

33
magic/Magdir/dif Normal file
View file

@ -0,0 +1,33 @@
#------------------------------------------------------------------------------
# $File: dif,v 1.1 2020/04/09 19:14:01 christos Exp $
# dif: file(1) magic for DIF text files
#------------------------------------------------------------------------------
# From: Joerg Jenderek
# URL: http://en.wikipedia.org/wiki/Data_Interchange_Format
# http://fileformats.archiveteam.org/wiki/Data_Interchange_Format
# Note: called by TrID "Data Interchange Format",
# by DROID x-fmt/368 "VisiCalc Database"
0 string TABLE
# skip text starting with TABLE by looking for numeric version on 2nd line
>6 search/2 0,
# skip DROID x-fmt-41-signature-id-380.dif by looking for key word TUPLES at the beginning
>>27 search/128 TUPLES Data Interchange Format
# https://www.pcmatic.com/company/libraries/fileextension/detail.asp?ext=dif.html
#!:mime application/x-dif-spreadsheet Gnumeric
# https://github.com/LibreOffice/online/blob/master/discovery.xml
#!:mime application/x-dif-document LibreOffice
# https://www.wikidata.org/wiki/Wikidata:WikiProject_Informatics/File_formats/Lists/File_formats
!:mime application/x-dif
# https://extension.nirsoft.net/dif
#!:mime application/vnd.ms-excel
#!:mime text/plain
!:ext dif
# look for double quote 0x22 on 3rd line
>>>10 search/3 "
# skip if next character also double quote
>>>>&0 ubyte !0x22 \b, generator or table name
# comment like EXCEL, pwm enclosed in double quotes
>>>>>&-2 string x %s

41
magic/Magdir/diff Normal file
View file

@ -0,0 +1,41 @@
#------------------------------------------------------------------------------
# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $
# diff: file(1) magic for diff(1) output
#
0 search/1 diff\040 diff output text
!:mime text/x-diff
0 search/1 ***\040
>&0 search/1024 \n---\040 context diff output text
!:mime text/x-diff
0 search/1 Only\040in\040 diff output text
!:mime text/x-diff
0 search/1 Common\040subdirectories:\040 diff output text
!:mime text/x-diff
0 search/1 Index: RCS/CVS diff output text
!:mime text/x-diff
# bsdiff: file(1) magic for bsdiff(1) output
0 string/b BSDIFF40 bsdiff(1) patch file
# unified diff
0 search/4096 ---\040
>&0 search/1024 \n
>>&0 search/1 +++\040
>>>&0 search/1024 \n
>>>>&0 search/1 @@ unified diff output text
!:mime text/x-diff
!:strength + 90
# librsync -- the library for network deltas
#
# Copyright (C) 2001 by Martin Pool. You may do whatever you want with
# this file.
#
0 belong 0x72730236 rdiff network-delta data
0 belong 0x72730136 rdiff network-delta signature data
>4 belong x (block length=%d,
>8 belong x signature strength=%d)

59
magic/Magdir/digital Normal file
View file

@ -0,0 +1,59 @@
#------------------------------------------------------------------------------
# $File: digital,v 1.12 2021/07/03 14:01:46 christos Exp $
# Digital UNIX - Info
#
0 string =!<arch>\n________64E Alpha archive
>22 string X -- out of date
#
0 leshort 0603
>24 leshort 0410 COFF format alpha pure
>24 leshort 0413 COFF format alpha demand paged
>>22 leshort&030000 !020000 executable
>>22 leshort&020000 !0 dynamically linked
>>16 lelong !0 not stripped
>>16 lelong 0 stripped
>>27 byte x - version %d
>>26 byte x \b.%d
>>28 byte x \b-%d
>24 leshort 0407 COFF format alpha object
>>22 leshort&030000 020000 shared library
>>27 byte x - version %d
>>26 byte x \b.%d
>>28 byte x \b-%d
# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
# The actual magic number is just "Core", followed by a 2-byte version
# number; however, treating any file that begins with "Core" as a Digital
# UNIX core dump file may produce too many false hits, so we include one
# byte of the version number as well; DU 5.0 appears only to be up to
# version 2.
#
0 string Core\001 Alpha COFF format core dump (Digital UNIX)
>24 string >\0 \b, from '%s'
0 string Core\002 Alpha COFF format core dump (Digital UNIX)
>24 string >\0 \b, from '%s'
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0 leshort 0x188 Alpha compressed COFF
0 leshort 0x18f Alpha u-code object
#
#
# Some other interesting Digital formats,
0 string \377\377\177 ddis/ddif
0 string \377\377\174 ddis/dots archive
0 string \377\377\176 ddis/dtif table data
0 string \033c\033 LN03 output
0 long 04553207 X image
#
0 string =!<PDF>!\n profiling data file
#
# Locale data tables (MIPS and Alpha).
#
# GRR: line below is too general as it matches also TTComp archive, ASCII, 2K handled by ./archive
0 short 0x0501 locale data table
>6 short 0x24 for MIPS
>6 short 0x40 for Alpha

69
magic/Magdir/dolby Normal file
View file

@ -0,0 +1,69 @@
#------------------------------------------------------------------------------
# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
# from https://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
#
# syncword
0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
# Proposed audio/ac3 RFC/4184
!:mime audio/vnd.dolby.dd-raw
# fscod
>4 byte&0xc0 = 0x00 48 kHz,
>4 byte&0xc0 = 0x40 44.1 kHz,
>4 byte&0xc0 = 0x80 32 kHz,
# is this one used for 96 kHz?
>4 byte&0xc0 = 0xc0 reserved frequency,
#
>5 byte&0x07 = 0x00 \b, complete main (CM)
>5 byte&0x07 = 0x01 \b, music and effects (ME)
>5 byte&0x07 = 0x02 \b, visually impaired (VI)
>5 byte&0x07 = 0x03 \b, hearing impaired (HI)
>5 byte&0x07 = 0x04 \b, dialogue (D)
>5 byte&0x07 = 0x05 \b, commentary (C)
>5 byte&0x07 = 0x06 \b, emergency (E)
>5 beshort&0x07e0 0x0720 \b, voiceover (VO)
>5 beshort&0x07e0 >0x0720 \b, karaoke
# acmod
>6 byte&0xe0 = 0x00 1+1 front,
>>6 byte&0x10 = 0x10 LFE on,
>6 byte&0xe0 = 0x20 1 front/0 rear,
>>6 byte&0x10 = 0x10 LFE on,
>6 byte&0xe0 = 0x40 2 front/0 rear,
# dsurmod (for stereo only)
>>6 byte&0x18 = 0x00 Dolby Surround not indicated
>>6 byte&0x18 = 0x08 not Dolby Surround encoded
>>6 byte&0x18 = 0x10 Dolby Surround encoded
>>6 byte&0x18 = 0x18 reserved Dolby Surround mode
>>6 byte&0x04 = 0x04 LFE on,
>6 byte&0xe0 = 0x60 3 front/0 rear,
>>6 byte&0x04 = 0x04 LFE on,
>6 byte&0xe0 = 0x80 2 front/1 rear,
>>6 byte&0x04 = 0x04 LFE on,
>6 byte&0xe0 = 0xa0 3 front/1 rear,
>>6 byte&0x01 = 0x01 LFE on,
>6 byte&0xe0 = 0xc0 2 front/2 rear,
>>6 byte&0x04 = 0x04 LFE on,
>6 byte&0xe0 = 0xe0 3 front/2 rear,
>>6 byte&0x01 = 0x01 LFE on,
#
>4 byte&0x3e = 0x00 \b, 32 kbit/s
>4 byte&0x3e = 0x02 \b, 40 kbit/s
>4 byte&0x3e = 0x04 \b, 48 kbit/s
>4 byte&0x3e = 0x06 \b, 56 kbit/s
>4 byte&0x3e = 0x08 \b, 64 kbit/s
>4 byte&0x3e = 0x0a \b, 80 kbit/s
>4 byte&0x3e = 0x0c \b, 96 kbit/s
>4 byte&0x3e = 0x0e \b, 112 kbit/s
>4 byte&0x3e = 0x10 \b, 128 kbit/s
>4 byte&0x3e = 0x12 \b, 160 kbit/s
>4 byte&0x3e = 0x14 \b, 192 kbit/s
>4 byte&0x3e = 0x16 \b, 224 kbit/s
>4 byte&0x3e = 0x18 \b, 256 kbit/s
>4 byte&0x3e = 0x1a \b, 320 kbit/s
>4 byte&0x3e = 0x1c \b, 384 kbit/s
>4 byte&0x3e = 0x1e \b, 448 kbit/s
>4 byte&0x3e = 0x20 \b, 512 kbit/s
>4 byte&0x3e = 0x22 \b, 576 kbit/s
>4 byte&0x3e = 0x24 \b, 640 kbit/s

96
magic/Magdir/dump Normal file
View file

@ -0,0 +1,96 @@
#------------------------------------------------------------------------------
# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
0 name new-dump-be
>4 bedate x This dump %s,
>8 bedate x Previous dump %s,
>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
0 name old-dump-be
#>4 bedate x This dump %s,
#>8 bedate x Previous dump %s,
>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
0 name ufs2-dump-be
>896 beqdate x This dump %s,
>904 beqdate x Previous dump %s,
>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 belong 60012 new-fs dump file (big endian),
>0 use new-dump-be
24 belong 60011 old-fs dump file (big endian),
>0 use old-dump-be
24 lelong 60012 new-fs dump file (little endian),
# to correctly recognize '*.mo' GNU message catalog (little endian)
!:strength - 15
>0 use \^new-dump-be
24 lelong 60011 old-fs dump file (little endian),
>0 use \^old-dump-be
24 belong 0x19540119 new-fs dump file (ufs2, big endian),
>0 use ufs2-dump-be
24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
>0 use \^ufs2-dump-be
18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
>2 medate x Previous dump %s,
>6 medate x This dump %s,
>10 leshort >0 Volume %d,
>0 leshort 1 tape header.
>0 leshort 2 beginning of file record.
>0 leshort 3 map of inodes on tape.
>0 leshort 4 continuation of file record.
>0 leshort 5 end of volume.
>0 leshort 6 map of inodes deleted.
>0 leshort 7 end of medium (for floppy).

45
magic/Magdir/dwarfs Normal file
View file

@ -0,0 +1,45 @@
#------------------------------------------------------------------------------
# $File: dwarfs,v 1.2 2023/05/23 13:37:32 christos Exp $
# dwarfs: file(1) magic for DwarFS File System Image files
# URL: https://github.com/mhx/dwarfs for details about DwarFS
# From: Marcus Holland-Moritz <github@mhxnet.de>
#### DwarFS Version Macro
0 name dwarfsversion
>&0 byte x \b, version %d
>&1 byte x \b.%d
#### DwarFS Compression Macro
0 name dwarfscompression
>&0 leshort =0 \b, uncompressed
>&0 leshort =1 \b, LZMA compression
>&0 leshort =2 \b, ZSTD compression
>&0 leshort =3 \b, LZ4 compression
>&0 leshort =4 \b, LZ4HC compression
>&0 leshort =5 \b, BROTLI compression
#### DwarFS files without header
## We first check against a DWARFS magic at the start of the file, then
## validate by checking the block count / section type to be all zeros
## for the first block. Finally, we check that the *next* block also
## has the correct DWARFS magic.
0 string DWARFS
>&0x2A string/b \0\0\0\0\0\0
>>&(&0x02.q+0x0A) string DWARFS DwarFS File System Image
>>>&0 use dwarfsversion
>>&0 use dwarfscompression
#### DwarFS files with header
## We search for a DWARFS magic in the first 64k of the file (images with
## headers longer than 64k won't be recognized), then validate by checking
## the block count / section type to be all zeros for the first block.
## Finally, we check that the *next* block also has the correct DWARFS magic.
## If we find a DWARFS magic that doesn't pass validation, we continue with
## an indirect match recursively.
1 search/65536/b DWARFS
>&0x2A string/b \0\0\0\0\0\0
>>&(&0x02.q+0x0A) string DWARFS DwarFS File System Image (with header)
>>>&0 use dwarfsversion
>>&0 use dwarfscompression
>&-1 indirect x

61
magic/Magdir/dyadic Normal file
View file

@ -0,0 +1,61 @@
#------------------------------------------------------------------------------
# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
# updated by Joerg Jenderek at Oct 2013
# https://en.wikipedia.org/wiki/Dyalog_APL
# https://www.dyalog.com/
# .DXV Dyalog APL External Variable
# .DIN Dyalog APL Input Table
# .DOT Dyalog APL Output Table
# .DFT Dyalog APL Format File
0 ubeshort&0xFF60 0xaa00
# skip biblio.dbt
>1 byte !4
# real Dyalog APL have non zero version numbers like 7.3 or 13.4
>>2 ubeshort >0x0000 Dyalog APL
>>>1 byte 0x00 aplcore
#>>>1 byte 0x00 incomplete workspace
# *.DCF Dyalog APL Component File
>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed
#>>>1 byte 0x01 component file
>>>1 byte 0x02 external variable exclusive
#>>>1 byte 0x02 external variable
# *.DWS Dyalog APL Workspace
>>>1 byte 0x03 workspace
>>>>7 byte&0x28 0x00 32-bit
>>>>7 byte&0x28 0x20 64-bit
>>>>7 byte&0x0c 0x00 classic
>>>>7 byte&0x0c 0x04 unicode
>>>>7 byte&0x88 0x00 big-endian
>>>>7 byte&0x88 0x80 little-endian
>>>1 byte 0x06 external variable shared
# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
>>>1 byte 0x07 session
>>>1 byte 0x08 mapped file 32-bit
>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed
>>>1 byte 0x0a mapped file 64-bit
>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed
>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed
>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed
>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed
>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed
>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed
>>>1 byte 0x13 component file 32-bit non-journaled checksummed
>>>1 byte 0x14 component file 64-bit non-journaled checksummed
>>>1 byte 0x15 component file under construction
>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed
>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed
>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed
>>>1 byte 0x19 external workspace
>>>1 byte 0x80 DDB
>>>2 byte x version %d
>>>3 byte x \b.%d
#>>>2 byte x type %d
#>>>3 byte x subtype %d
# *.DXF Dyalog APL Transfer File
0 short 0x6060 Dyalog APL transfer

8
magic/Magdir/ebml Normal file
View file

@ -0,0 +1,8 @@
#------------------------------------------------------------------------------
# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $
# ebml: file(1) magic for various Extensible Binary Meta Language
# https://www.matroska.org/technical/specs/index.html#track
0 belong 0x1a45dfa3 EBML file
>4 search/b/100 \102\202
>>&1 string x \b, creator %.8s

11
magic/Magdir/edid Normal file
View file

@ -0,0 +1,11 @@
#------------------------------------------------------------------------------
# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $
# edid: file(1) magic for EDID dump files
0 quad 0x00ffffffffffff00 Extended display identification data dump
!:mime application/x-edid-dump
>18 byte 0x01 Version 1
>>19 byte <0x04 \b.%d
>18 byte 0x02 Version 2
>>19 byte 0x00 \b.0

43
magic/Magdir/editors Normal file
View file

@ -0,0 +1,43 @@
#------------------------------------------------------------------------------
# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $
# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
>4 string 0 Kamenicky
>4 string 1 CP 852
>4 string 2 KOI8-CS
>4 string >2 unknown encoding
# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
# updated by Osman Surkatty
0 string VimCrypt~ Vim encrypted file data
>9 string 01! with zip cryptmethod
>9 string 02! with blowfish cryptmethod
>9 string 03! with blowfish2 cryptmethod
0 name vimnanoswap
>67 byte 0
>>107 byte 0
#>>>2 string x %s swap file
>>>24 ulelong x \b, pid %d
>>>28 string >\0 \b, user %s
>>>68 string >\0 \b, host %s
>>>108 string >\0 \b, file %s
>>>1007 byte 0x55 \b, modified
# Vi IMproved Swap file
# by Sven Wegener <swegener@gentoo.org>
0 string b0VIM\ Vim swap file
>&0 string >\0 \b, version %s
>0 use vimnanoswap
# Lock/swap file for several editors, at least
# Vi IMproved and nano
0 string b0nano Nano swap file
>0 use vimnanoswap
# kate (K Advanced Text Editor)
0 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file

53
magic/Magdir/efi Normal file
View file

@ -0,0 +1,53 @@
#------------------------------------------------------------------------------
# $File: efi,v 1.6 2023/08/05 13:41:26 christos Exp $
# efi: file(1) magic for Universal EFI binaries
0 lelong 0x0ef1fab9
>4 lelong 1 Universal EFI binary with 1 architecture
>>&0 lelong 7 \b, i386
>>&0 lelong 0x01000007 \b, x86_64
>4 lelong 2 Universal EFI binary with 2 architectures
>>&0 lelong 7 \b, i386
>>&0 lelong 0x01000007 \b, x86_64
>>&20 lelong 7 \b, i386
>>&20 lelong 0x01000007 \b, x86_64
>4 lelong >2 Universal EFI binary with %d architectures
# EFI Signature List
# From: Alexandre Iooss <erdnaxe@crans.org>
# URL: https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git
0 name efi_sig_list
>0 guid D719B2CB-3D3A-4596-A3BC-DAD00E67656F EFI Signature List, SIG DB
>0 guid 4AAFD29D-68DF-49EE-8AA9-347D375665A7 EFI Signature List, PKCS7
>0 guid 3C5766E8-269C-4E34-AA14-ED776E85B3B6 EFI Signature List, RSA2048
>0 guid E2B36190-879B-4A3D-AD8D-F2E7BBA32784 EFI Signature List, RSA2048 SHA256
>0 guid 67F8444F-8743-48F1-A328-1EAAB8736080 EFI Signature List, RSA2048 SHA1
>0 guid A7717414-C616-4977-9420-844712A735BF EFI Signature List, RSA2048 SHA256 type
>0 guid 826CA512-CF10-4AC9-B187-BE01496631BD EFI Signature List, SHA1
>0 guid 0B6E5233-A65C-44C9-9407-D9AB83BFC8BD EFI Signature List, SHA224
>0 guid C1C41626-504C-4092-ACA9-41F936934328 EFI Signature List, SHA256
>0 guid FF3E5307-9FD0-48C9-85F1-8AD56C701E01 EFI Signature List, SHA384
>0 guid 093E0FAE-A6C4-4F50-9F1B-D41E2B89C19A EFI Signature List, SHA512
>0 guid A5C059A1-94E4-4AA7-87B5-AB155C2BF072 EFI Signature List, X509
>0 guid 3BD2A492-96C0-4079-B420-FCF98EF103ED EFI Signature List, X509 SHA256
>0 guid 7076876E-80C2-4EE6-AAD2-28B349A6865B EFI Signature List, X509 SHA384
>0 guid 446DBF63-2502-4CDA-BCFA-2465D2B0FE9D EFI Signature List, X509 SHA512
>0 guid 605DAB50-E046-4300-ABB6-3DD810DD8B23 EFI Signature List, MOK_OWNER
>0 guid A46423E3-4617-49F1-B9FF-D1BFA9115839 EFI Signature List, SECURITY PROTOCOL
>0 guid 94AB2F58-1438-4EF1-9152-18941A3A0E68 EFI Signature List, SECURITY2 PROTOCOL
>0 guid AAF32C78-947B-439A-A180-2E144EC37792 EFI Signature List, SECURE VARIABLE
# Hypothesis: EFI Signature List are smaller than 16MiB
19 byte =0
>23 byte =0
>>27 byte =0
>>>0 use efi_sig_list
>>>>16 ulelong x \b, total size: %d bytes
# Variant: EFI Signature List as an EFI variable
# See https://docs.kernel.org/filesystems/efivarfs.html
23 byte =0
>27 byte =0
>>31 byte =0
>>>4 use efi_sig_list
>>>>0 ulelong x \b, EFI variable %d
>>>>20 ulelong x \b, total size: %d bytes

379
magic/Magdir/elf Normal file
View file

@ -0,0 +1,379 @@
#------------------------------------------------------------------------------
# $File: elf,v 1.88 2023/01/08 17:09:18 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# https://www.sco.com/developers/gabi/latest/ch4.eheader.html
#
# Created by: unknown
# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
0 name elf-mips
>0 lelong&0xf0000000 0x00000000 MIPS-I
>0 lelong&0xf0000000 0x10000000 MIPS-II
>0 lelong&0xf0000000 0x20000000 MIPS-III
>0 lelong&0xf0000000 0x30000000 MIPS-IV
>0 lelong&0xf0000000 0x40000000 MIPS-V
>0 lelong&0xf0000000 0x50000000 MIPS32
>0 lelong&0xf0000000 0x60000000 MIPS64
>0 lelong&0xf0000000 0x70000000 MIPS32 rel2
>0 lelong&0xf0000000 0x80000000 MIPS64 rel2
>0 lelong&0xf0000000 0x90000000 MIPS32 rel6
>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6
0 name elf-sparc
>0 lelong&0x00ffff00 0x00000100 V8+ Required,
>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required,
>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required,
>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required,
>0 lelong&0x3 0 total store ordering,
>0 lelong&0x3 1 partial store ordering,
>0 lelong&0x3 2 relaxed memory ordering,
0 name elf-pa-risc
>2 leshort 0x020b 1.0
>2 leshort 0x0210 1.1
>2 leshort 0x0214 2.0
>0 leshort &0x0008 (LP64)
0 name elf-riscv
>0 lelong&0x00000001 0x00000001 RVC,
>0 lelong&0x00000008 0x00000008 RVE,
>0 lelong&0x00000006 0x00000000 soft-float ABI,
>0 lelong&0x00000006 0x00000002 single-float ABI,
>0 lelong&0x00000006 0x00000004 double-float ABI,
>0 lelong&0x00000006 0x00000006 quad-float ABI,
0 name elf-le
>16 leshort 0 no file type,
!:mime application/octet-stream
>16 leshort 1 relocatable,
!:mime application/x-object
>16 leshort 2 executable,
!:mime application/x-executable
>16 leshort 3 ${x?pie executable:shared object},
!:mime application/x-${x?pie-executable:sharedlib}
>16 leshort 4 core file,
!:mime application/x-coredump
# OS-specific
>7 byte 202
>>16 leshort 0xFE01 executable,
!:mime application/x-executable
# Core file detection is not reliable.
#>>>(0x38+0xcc) string >\0 of '%s'
#>>>(0x38+0x10) lelong >0 (signal %d),
>16 leshort &0xff00
>>18 leshort !8 processor-specific,
>>18 leshort 8
>>>16 leshort 0xFF80 PlayStation 2 IOP module,
!:mime application/x-sharedlib
>>>16 leshort !0xFF80 processor-specific,
>18 clear x
>18 leshort 0 no machine,
>18 leshort 1 AT&T WE32100,
>18 leshort 2 SPARC,
>18 leshort 3 Intel 80386,
>18 leshort 4 Motorola m68k,
>>4 byte 1
>>>36 lelong &0x01000000 68000,
>>>36 lelong &0x00810000 CPU32,
>>>36 lelong 0 68020,
>18 leshort 5 Motorola m88k,
>18 leshort 6 Intel 80486,
>18 leshort 7 Intel 80860,
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
>18 leshort 8 MIPS,
>>4 byte 1
>>>36 lelong &0x20 N32
>18 leshort 10 MIPS,
>>4 byte 1
>>>36 lelong &0x20 N32
>18 leshort 8
# only for 32-bit
>>4 byte 1
>>>36 use elf-mips
# only for 64-bit
>>4 byte 2
>>>48 use elf-mips
>18 leshort 9 Amdahl,
>18 leshort 10 MIPS (deprecated),
>18 leshort 11 RS6000,
>18 leshort 15 PA-RISC,
# only for 32-bit
>>4 byte 1
>>>36 use elf-pa-risc
# only for 64-bit
>>4 byte 2
>>>48 use elf-pa-risc
>18 leshort 16 nCUBE,
>18 leshort 17 Fujitsu VPP500,
>18 leshort 18 SPARC32PLUS,
# only for 32-bit
>>4 byte 1
>>>36 use elf-sparc
>18 leshort 19 Intel 80960,
>18 leshort 20 PowerPC or cisco 4500,
>18 leshort 21 64-bit PowerPC or cisco 7500,
>>48 lelong 0 Unspecified or Power ELF V1 ABI,
>>48 lelong 1 Power ELF V1 ABI,
>>48 lelong 2 OpenPOWER ELF V2 ABI,
>18 leshort 22 IBM S/390,
>18 leshort 23 Cell SPU,
>18 leshort 24 cisco SVIP,
>18 leshort 25 cisco 7200,
>18 leshort 36 NEC V800 or cisco 12000,
>18 leshort 37 Fujitsu FR20,
>18 leshort 38 TRW RH-32,
>18 leshort 39 Motorola RCE,
>18 leshort 40 ARM,
>>4 byte 1
>>>36 lelong&0xff000000 0x04000000 EABI4
>>>36 lelong&0xff000000 0x05000000 EABI5
>>>36 lelong &0x00800000 BE8
>>>36 lelong &0x00400000 LE8
>18 leshort 41 Alpha,
>18 leshort 42 Renesas SH,
>18 leshort 43 SPARC V9,
>>4 byte 2
>>>48 use elf-sparc
>18 leshort 44 Siemens Tricore Embedded Processor,
>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
>18 leshort 46 Renesas H8/300,
>18 leshort 47 Renesas H8/300H,
>18 leshort 48 Renesas H8S,
>18 leshort 49 Renesas H8/500,
>18 leshort 50 IA-64,
>18 leshort 51 Stanford MIPS-X,
>18 leshort 52 Motorola Coldfire,
>18 leshort 53 Motorola M68HC12,
>18 leshort 54 Fujitsu MMA,
>18 leshort 55 Siemens PCP,
>18 leshort 56 Sony nCPU,
>18 leshort 57 Denso NDR1,
>18 leshort 58 Start*Core,
>18 leshort 59 Toyota ME16,
>18 leshort 60 ST100,
>18 leshort 61 Tinyj emb.,
>18 leshort 62 x86-64,
>18 leshort 63 Sony DSP,
>18 leshort 64 DEC PDP-10,
>18 leshort 65 DEC PDP-11,
>18 leshort 66 FX66,
>18 leshort 67 ST9+ 8/16 bit,
>18 leshort 68 ST7 8 bit,
>18 leshort 69 MC68HC16,
>18 leshort 70 MC68HC11,
>18 leshort 71 MC68HC08,
>18 leshort 72 MC68HC05,
>18 leshort 73 SGI SVx or Cray NV1,
>18 leshort 74 ST19 8 bit,
>18 leshort 75 Digital VAX,
>18 leshort 76 Axis cris,
>18 leshort 77 Infineon 32-bit embedded,
>18 leshort 78 Element 14 64-bit DSP,
>18 leshort 79 LSI Logic 16-bit DSP,
>18 leshort 80 MMIX,
>18 leshort 81 Harvard machine-independent,
>18 leshort 82 SiTera Prism,
>18 leshort 83 Atmel AVR 8-bit,
>18 leshort 84 Fujitsu FR30,
>18 leshort 85 Mitsubishi D10V,
>18 leshort 86 Mitsubishi D30V,
>18 leshort 87 NEC v850,
>18 leshort 88 Renesas M32R,
>18 leshort 89 Matsushita MN10300,
>18 leshort 90 Matsushita MN10200,
>18 leshort 91 picoJava,
>18 leshort 92 OpenRISC,
>18 leshort 93 Synopsys ARCompact ARC700 cores,
>18 leshort 94 Tensilica Xtensa,
>18 leshort 95 Alphamosaic VideoCore,
>18 leshort 96 Thompson Multimedia,
>18 leshort 97 NatSemi 32k,
>18 leshort 98 Tenor Network TPC,
>18 leshort 99 Trebia SNP 1000,
>18 leshort 100 STMicroelectronics ST200,
>18 leshort 101 Ubicom IP2022,
>18 leshort 102 MAX Processor,
>18 leshort 103 NatSemi CompactRISC,
>18 leshort 104 Fujitsu F2MC16,
>18 leshort 105 TI msp430,
>18 leshort 106 Analog Devices Blackfin,
>18 leshort 107 S1C33 Family of Seiko Epson,
>18 leshort 108 Sharp embedded,
>18 leshort 109 Arca RISC,
>18 leshort 110 PKU-Unity Ltd.,
>18 leshort 111 eXcess: 16/32/64-bit,
>18 leshort 112 Icera Deep Execution Processor,
>18 leshort 113 Altera Nios II,
>18 leshort 114 NatSemi CRX,
>18 leshort 115 Motorola XGATE,
>18 leshort 116 Infineon C16x/XC16x,
>18 leshort 117 Renesas M16C series,
>18 leshort 118 Microchip dsPIC30F,
>18 leshort 119 Freescale RISC core,
>18 leshort 120 Renesas M32C series,
>18 leshort 131 Altium TSK3000 core,
>18 leshort 132 Freescale RS08,
>18 leshort 134 Cyan Technology eCOG2,
>18 leshort 135 Sunplus S+core7 RISC,
>18 leshort 136 New Japan Radio (NJR) 24-bit DSP,
>18 leshort 137 Broadcom VideoCore III,
>18 leshort 138 LatticeMico32,
>18 leshort 139 Seiko Epson C17 family,
>18 leshort 140 TI TMS320C6000 DSP family,
>18 leshort 141 TI TMS320C2000 DSP family,
>18 leshort 142 TI TMS320C55x DSP family,
>18 leshort 144 TI Programmable Realtime Unit
>18 leshort 160 STMicroelectronics 64bit VLIW DSP,
>18 leshort 161 Cypress M8C,
>18 leshort 162 Renesas R32C series,
>18 leshort 163 NXP TriMedia family,
>18 leshort 164 QUALCOMM DSP6,
>18 leshort 165 Intel 8051 and variants,
>18 leshort 166 STMicroelectronics STxP7x family,
>18 leshort 167 Andes embedded RISC,
>18 leshort 168 Cyan eCOG1X family,
>18 leshort 169 Dallas MAXQ30,
>18 leshort 170 New Japan Radio (NJR) 16-bit DSP,
>18 leshort 171 M2000 Reconfigurable RISC,
>18 leshort 172 Cray NV2 vector architecture,
>18 leshort 173 Renesas RX family,
>18 leshort 174 META,
>18 leshort 175 MCST Elbrus,
>18 leshort 176 Cyan Technology eCOG16 family,
>18 leshort 177 NatSemi CompactRISC,
>18 leshort 178 Freescale Extended Time Processing Unit,
>18 leshort 179 Infineon SLE9X,
>18 leshort 180 Intel L1OM,
>18 leshort 181 Intel K1OM,
>18 leshort 183 ARM aarch64,
>18 leshort 185 Atmel 32-bit family,
>18 leshort 186 STMicroeletronics STM8 8-bit,
>18 leshort 187 Tilera TILE64,
>18 leshort 188 Tilera TILEPro,
>18 leshort 189 Xilinx MicroBlaze 32-bit RISC,
>18 leshort 190 NVIDIA CUDA architecture,
>18 leshort 191 Tilera TILE-Gx,
>18 leshort 195 Synopsys ARCv2/HS3x/HS4x cores,
>18 leshort 197 Renesas RL78 family,
>18 leshort 199 Renesas 78K0R,
>18 leshort 200 Freescale 56800EX,
>18 leshort 201 Beyond BA1,
>18 leshort 202 Beyond BA2,
>18 leshort 203 XMOS xCORE,
>18 leshort 204 Microchip 8-bit PIC(r),
>18 leshort 210 KM211 KM32,
>18 leshort 211 KM211 KMX32,
>18 leshort 212 KM211 KMX16,
>18 leshort 213 KM211 KMX8,
>18 leshort 214 KM211 KVARC,
>18 leshort 215 Paneve CDP,
>18 leshort 216 Cognitive Smart Memory,
>18 leshort 217 iCelero CoolEngine,
>18 leshort 218 Nanoradio Optimized RISC,
>18 leshort 219 CSR Kalimba architecture family
>18 leshort 220 Zilog Z80
>18 leshort 221 Controls and Data Services VISIUMcore processor
>18 leshort 222 FTDI Chip FT32 high performance 32-bit RISC architecture
>18 leshort 223 Moxie processor family
>18 leshort 224 AMD GPU architecture
>18 leshort 243 UCB RISC-V,
# only for 32-bit
>>4 byte 1
>>>36 use elf-riscv
# only for 64-bit
>>4 byte 2
>>>48 use elf-riscv
>18 leshort 244 Lanai 32-bit processor,
>18 leshort 245 CEVA Processor Architecture Family,
>18 leshort 246 CEVA X2 Processor Family,
>18 leshort 247 eBPF,
>18 leshort 248 Graphcore Intelligent Processing Unit,
>18 leshort 249 Imagination Technologies,
>18 leshort 250 Netronome Flow Processor,
>18 leshort 251 NEC Vector Engine,
>18 leshort 252 C-SKY processor family,
>18 leshort 253 Synopsys ARCv3 64-bit ISA/HS6x cores,
>18 leshort 254 MOS Technology MCS 6502 processor,
>18 leshort 255 Synopsys ARCv3 32-bit,
>18 leshort 256 Kalray VLIW core of the MPPA family,
>18 leshort 257 WDC 65816/65C816,
>18 leshort 258 LoongArch,
>18 leshort 259 ChipON KungFu32,
>18 leshort 0x1057 AVR (unofficial),
>18 leshort 0x1059 MSP430 (unofficial),
>18 leshort 0x1223 Adapteva Epiphany (unofficial),
>18 leshort 0x2530 Morpho MT (unofficial),
>18 leshort 0x3330 FR30 (unofficial),
>18 leshort 0x3426 OpenRISC (obsolete),
>18 leshort 0x4688 Infineon C166 (unofficial),
>18 leshort 0x5441 Cygnus FRV (unofficial),
>18 leshort 0x5aa5 DLX (unofficial),
>18 leshort 0x7650 Cygnus D10V (unofficial),
>18 leshort 0x7676 Cygnus D30V (unofficial),
>18 leshort 0x8217 Ubicom IP2xxx (unofficial),
>18 leshort 0x8472 OpenRISC (obsolete),
>18 leshort 0x9025 Cygnus PowerPC (unofficial),
>18 leshort 0x9026 Alpha (unofficial),
>18 leshort 0x9041 Cygnus M32R (unofficial),
>18 leshort 0x9080 Cygnus V850 (unofficial),
>18 leshort 0xa390 IBM S/390 (obsolete),
>18 leshort 0xabc7 Old Xtensa (unofficial),
>18 leshort 0xad45 xstormy16 (unofficial),
>18 leshort 0xbaab Old MicroBlaze (unofficial),,
>18 leshort 0xbeef Cygnus MN10300 (unofficial),
>18 leshort 0xdead Cygnus MN10200 (unofficial),
>18 leshort 0xf00d Toshiba MeP (unofficial),
>18 leshort 0xfeb0 Renesas M32C (unofficial),
>18 leshort 0xfeba Vitesse IQ2000 (unofficial),
>18 leshort 0xfebb NIOS (unofficial),
>18 leshort 0xfeed Moxie (unofficial),
>18 default x
>>18 leshort x *unknown arch %#x*
>20 lelong 0 invalid version
>20 lelong 1 version 1
0 string \177ELF ELF
!:strength *2
>4 byte 0 invalid class
>4 byte 1 32-bit
>4 byte 2 64-bit
>5 byte 0 invalid byte order
>5 byte 1 LSB
>>0 use elf-le
>5 byte 2 MSB
>>0 use \^elf-le
>7 byte 0 (SYSV)
>7 byte 1 (HP-UX)
>7 byte 2 (NetBSD)
>7 byte 3 (GNU/Linux)
>7 byte 4 (GNU/Hurd)
>7 byte 5 (86Open)
>7 byte 6 (Solaris)
>7 byte 7 (Monterey)
>7 byte 8 (IRIX)
>7 byte 9 (FreeBSD)
>7 byte 10 (Tru64)
>7 byte 11 (Novell Modesto)
>7 byte 12 (OpenBSD)
>7 byte 13 (OpenVMS)
>7 byte 14 (HP NonStop Kernel)
>7 byte 15 (AROS Research Operating System)
>7 byte 16 (FenixOS)
>7 byte 17 (Nuxi CloudABI)
>7 byte 97 (ARM)
>7 byte 202 (Cafe OS)
>7 byte 255 (embedded)

22
magic/Magdir/encore Normal file
View file

@ -0,0 +1,22 @@
#------------------------------------------------------------------------------
# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
# encore: file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0 short 0x154 Encore
>20 short 0x107 executable
>20 short 0x108 pure executable
>20 short 0x10b demand-paged executable
>20 short 0x10f unsupported executable
>12 long >0 not stripped
>22 short >0 - version %d
>22 short 0 -
#>4 date x stamp %s
0 short 0x155 Encore unsupported executable
>12 long >0 not stripped
>22 short >0 - version %d
>22 short 0 -
#>4 date x stamp %s

62
magic/Magdir/epoc Normal file
View file

@ -0,0 +1,62 @@
#------------------------------------------------------------------------------
# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
# Useful information for improving this file can be found at:
# http://software.frodo.looijaard.name/psiconv/formats/Index.html
#------------------------------------------------------------------------------
0 lelong 0x10000037 Psion Series 5
>4 lelong 0x10000039 font file
>4 lelong 0x1000003A printer driver
>4 lelong 0x1000003B clipboard
>4 lelong 0x10000042 multi-bitmap image
!:mime image/x-epoc-mbm
>4 lelong 0x1000006A application information file
>4 lelong 0x1000006D
>>8 lelong 0x1000007D Sketch image
!:mime image/x-epoc-sketch
>>8 lelong 0x1000007E voice note
>>8 lelong 0x1000007F Word file
!:mime application/x-epoc-word
>>8 lelong 0x10000085 OPL program (TextEd)
!:mime application/x-epoc-opl
>>8 lelong 0x10000087 Comms settings
>>8 lelong 0x10000088 Sheet file
!:mime application/x-epoc-sheet
>>8 lelong 0x100001C4 EasyFax initialisation file
>4 lelong 0x10000073 OPO module
!:mime application/x-epoc-opo
>4 lelong 0x10000074 OPL application
!:mime application/x-epoc-app
>4 lelong 0x1000008A exported multi-bitmap image
>4 lelong 0x1000016D
>>8 lelong 0x10000087 Comms names
0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
0 lelong 0x10000050 Psion Series 5
>4 lelong 0x1000006D database
>>8 lelong 0x10000084 Agenda file
!:mime application/x-epoc-agenda
>>8 lelong 0x10000086 Data file
!:mime application/x-epoc-data
>>8 lelong 0x10000CEA Jotter file
!:mime application/x-epoc-jotter
>4 lelong 0x100000E4 ini file
0 lelong 0x10000079 Psion Series 5 binary:
>4 lelong 0x00000000 DLL
>4 lelong 0x10000049 comms hardware library
>4 lelong 0x1000004A comms protocol library
>4 lelong 0x1000005D OPX
>4 lelong 0x1000006C application
>4 lelong 0x1000008D DLL
>4 lelong 0x100000AC logical device driver
>4 lelong 0x100000AD physical device driver
>4 lelong 0x100000E5 file transfer protocol
>4 lelong 0x100000E5 file transfer protocol
>4 lelong 0x10000140 printer definition
>4 lelong 0x10000141 printer definition
0 lelong 0x1000007A Psion Series 5 executable

21
magic/Magdir/erlang Normal file
View file

@ -0,0 +1,21 @@
#------------------------------------------------------------------------------
# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $
# erlang: file(1) magic for Erlang JAM and BEAM files
# URL: https://www.erlang.org/faq/x779.html#AEN812
# OTP R3-R4
0 string \0177BEAM! Old Erlang BEAM file
>6 short >0 - version %d
# OTP R5 and onwards
0 string FOR1
>8 string BEAM Erlang BEAM file
# 4.2 version may have a copyright notice!
4 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
79 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2
4 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3
0 bequad 0x0000000000ABCDEF Erlang DETS file

57
magic/Magdir/espressif Normal file
View file

@ -0,0 +1,57 @@
# $File: espressif,v 1.3 2021/04/26 15:56:00 christos Exp $
# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
# URL: https://github.com/arendst/Sonoff-Tasmota/
# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h
# From: Joerg Jenderek
#
# cfg_holder=4617=0x1209
0 uleshort 4617
# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266)
!:mime application/x-tasmota-dmp
!:ext dmp
# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262
>>11 ubyte^0x65 x \b, version %u
>>10 ubyte^0x64 x \b.%u
>>9 ubyte^0x63 x \b.%u
>>8 ubyte^0x62 x \b.%u
#>8 ubelong x (%#x)
# hostname[33] XORed
>>0x165 ubyte^0x1BF x \b, hostname %c
>>0x166 ubyte^0x1C0 >037 \b%c
>>0x167 ubyte^0x1C1 >037 \b%c
>>0x168 ubyte^0x1C2 >037 \b%c
>>0x169 ubyte^0x1C3 >037 \b%c
>>0x16A ubyte^0x1C4 >037 \b%c
>>0x16B ubyte^0x1C5 >037 \b%c
>>0x16C ubyte^0x1C6 >037 \b%c
>>0x16D ubyte^0x1C7 >037 \b%c
>>0x16E ubyte^0x1C8 >037 \b%c
>>0x16F ubyte^0x1C9 >037 \b%c
>>0x170 ubyte^0x1CA >037 \b%c
>>0x171 ubyte^0x1CB >037 \b%c
>>0x172 ubyte^0x1CC >037 \b%c
>>0x173 ubyte^0x1CD >037 \b%c
>>0x174 ubyte^0x1CE >037 \b%c
>>0x175 ubyte^0x1CF >037 \b%c
>>0x176 ubyte^0x1D0 >037 \b%c
>>0x177 ubyte^0x1D1 >037 \b%c
>>0x178 ubyte^0x1D2 >037 \b%c
>>0x179 ubyte^0x1D3 >037 \b%c
>>0x17A ubyte^0x1D4 >037 \b%c
>>0x17B ubyte^0x1D5 >037 \b%c
>>0x17C ubyte^0x1D6 >037 \b%c
>>0x17D ubyte^0x1D7 >037 \b%c
>>0x17E ubyte^0x1D8 >037 \b%c
>>0x17F ubyte^0x1D9 >037 \b%c
>>0x180 ubyte^0x1DA >037 \b%c
>>0x181 ubyte^0x1DB >037 \b%c
>>0x182 ubyte^0x1DC >037 \b%c
>>0x183 ubyte^0x1DD >037 \b%c
>>0x184 ubyte^0x1DE >037 \b%c
>>0x185 ubyte^0x1DF >037 \b%c
#>>0x165 string x (%.33s)

Some files were not shown because too many files have changed in this diff Show more