+
+2005-10-20 11:15 Christos Zoulas <christos@zoulas.com>
+
+ * Middle Endian magic (Diomidis Spinellis)
+
2005-10-17 11:15 Christos Zoulas <christos@zoulas.com>
* Open with O_BINARY for CYGWIN (Corinna Vinschen)
A four-byte value (on most systems) in little-endian byte order,
interpreted as a UNIX-style date, but interpreted as local time rather
than UTC.
+.IP melong
+A four-byte value (on most systems) in middle-endian (PDP-11) byte order.
+.IP medate
+A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
+interpreted as a UNIX date.
+.IP meldate
+A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
+interpreted as a UNIX-style date, but interpreted as local time rather
+than UTC.
.IP regex
A regular expression match in extended POSIX regular expression syntax
(much like egrep).
.I x
is used as an offset in the file. A byte, short or long is read at that offset
depending on the
-.B [bslBSL]
+.B [bslBSLm]
type specifier.
The capitalized types interpret the number as a big endian
value, whereas the small letter versions interpret the number as a little
-endian value.
+endian value;
+the
+.B m
+type interprets the number as a middle endian (PDP-11) value.
To that number the value of
.I y
is added and the result is used as an offset in the file.
.IR long ,
.IR belong ,
.IR lelong ,
+.IR melong ,
.IR short ,
.IR beshort ,
.IR leshort ,
.IR date ,
.IR bedate ,
+.IR medate ,
+.IR ledate ,
+.IR beldate ,
+.IR leldate ,
and
-.I ledate
+.I meldate
are system-dependent; perhaps they should be specified as a number
of bytes (2B, 4B, etc),
since the files being recognized typically come from
.\" the changes I posted to the S5R2 version.
.\"
.\" Modified for Ian Darwin's version of the file command.
-.\" @(#)$Id: magic.man,v 1.28 2005/03/17 17:34:15 christos Exp $
+.\" @(#)$Id: magic.man,v 1.29 2005/10/20 14:59:01 christos Exp $
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 lelong >0 Flags %x
+
+18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
+>2 medate x Previous dump %s,
+>6 medate x This dump %s,
+>10 leshort >0 Volume %ld,
+>0 leshort 1 tape header.
+>0 leshort 2 beginning of file record.
+>0 leshort 3 map of inodes on tape.
+>0 leshort 4 continuation of file record.
+>0 leshort 5 end of volume.
+>0 leshort 6 map of inodes deleted.
+>0 leshort 7 end of medium (for floppy).
#endif
#ifndef lint
-FILE_RCSID("@(#)$Id: apprentice.c,v 1.85 2005/10/17 15:31:10 christos Exp $")
+FILE_RCSID("@(#)$Id: apprentice.c,v 1.86 2005/10/20 14:59:01 christos Exp $")
#endif /* lint */
#define EATAB {while (isascii((unsigned char) *l) && \
case FILE_DATE:
case FILE_BEDATE:
case FILE_LEDATE:
+ case FILE_MEDATE:
case FILE_LDATE:
case FILE_BELDATE:
case FILE_LELDATE:
+ case FILE_MELDATE:
case FILE_LONG:
case FILE_BELONG:
case FILE_LELONG:
+ case FILE_MELONG:
v = (int32_t) v;
break;
case FILE_STRING:
case 'L':
m->in_type = FILE_BELONG;
break;
+ case 'm':
+ m->in_type = FILE_MELONG;
+ break;
case 'h':
case 's':
m->in_type = FILE_LESHORT;
#define NBEDATE 6
#define NLESHORT 7
#define NLELONG 6
+#define NMELONG 6
#define NLEDATE 6
+#define NMEDATE 6
#define NPSTRING 7
#define NLDATE 5
#define NBELDATE 7
#define NLELDATE 7
+#define NMELDATE 7
#define NREGEX 5
#define NBESTRING16 10
#define NLESTRING16 10
} else if (strncmp(l, "lelong", NLELONG)==0) {
m->type = FILE_LELONG;
l += NLELONG;
+ } else if (strncmp(l, "melong", NMELONG)==0) {
+ m->type = FILE_MELONG;
+ l += NMELONG;
} else if (strncmp(l, "ledate", NLEDATE)==0) {
m->type = FILE_LEDATE;
l += NLEDATE;
+ } else if (strncmp(l, "medate", NMEDATE)==0) {
+ m->type = FILE_MEDATE;
+ l += NMEDATE;
} else if (strncmp(l, "pstring", NPSTRING)==0) {
m->type = FILE_PSTRING;
l += NPSTRING;
} else if (strncmp(l, "leldate", NLELDATE)==0) {
m->type = FILE_LELDATE;
l += NLELDATE;
+ } else if (strncmp(l, "meldate", NMELDATE)==0) {
+ m->type = FILE_MELDATE;
+ l += NMELDATE;
} else if (strncmp(l, "regex", NREGEX)==0) {
m->type = FILE_REGEX;
l += NREGEX;
*/
/*
* file.h - definitions for file(1) program
- * @(#)$Id: file.h,v 1.72 2005/10/17 15:36:22 christos Exp $
+ * @(#)$Id: file.h,v 1.73 2005/10/20 14:59:01 christos Exp $
*/
#ifndef __file_h__
#define FILE_BESTRING16 18
#define FILE_LESTRING16 19
#define FILE_SEARCH 20
+#define FILE_MEDATE 21
+#define FILE_MELDATE 22
+#define FILE_MELONG 23
#define FILE_FORMAT_NAME \
/* 0 */ "invalid 0", \
/* 17 */ "regex", \
/* 18 */ "bestring16", \
/* 19 */ "lestring16", \
-/* 20 */ "search",
+/* 20 */ "search", \
+/* 21 */ "medate", \
+/* 22 */ "meldate", \
+/* 23 */ "melong",
#define FILE_FMT_NUM "cduxXi"
#define FILE_FMT_STR "s"
/* 17 */ FILE_FMT_STR, \
/* 18 */ FILE_FMT_STR, \
/* 19 */ FILE_FMT_STR, \
-/* 20 */ FILE_FMT_STR,
+/* 20 */ FILE_FMT_STR, \
+/* 21 */ FILE_FMT_STR, \
+/* 22 */ FILE_FMT_STR, \
+/* 23 */ FILE_FMT_NUM,
/* Word 3 */
uint8_t in_op; /* operator for indirection */
#include <time.h>
#ifndef lint
-FILE_RCSID("@(#)$Id: print.c,v 1.48 2005/10/12 19:29:42 christos Exp $")
+FILE_RCSID("@(#)$Id: print.c,v 1.49 2005/10/20 14:59:01 christos Exp $")
#endif /* lint */
#define SZOF(a) (sizeof(a) / sizeof(a[0]))
case FILE_LONG:
case FILE_LESHORT:
case FILE_LELONG:
+ case FILE_MELONG:
case FILE_BESHORT:
case FILE_BELONG:
(void) fprintf(stderr, "%d", m->value.l);
case FILE_DATE:
case FILE_LEDATE:
case FILE_BEDATE:
+ case FILE_MEDATE:
(void)fprintf(stderr, "%s,",
file_fmttime(m->value.l, 1));
break;
case FILE_LDATE:
case FILE_LELDATE:
case FILE_BELDATE:
+ case FILE_MELDATE:
(void)fprintf(stderr, "%s,",
file_fmttime(m->value.l, 0));
break;
#ifndef lint
-FILE_RCSID("@(#)$Id: softmagic.c,v 1.76 2005/10/17 19:04:36 christos Exp $")
+FILE_RCSID("@(#)$Id: softmagic.c,v 1.77 2005/10/20 14:59:01 christos Exp $")
#endif /* lint */
private int match(struct magic_set *, struct magic *, uint32_t,
case FILE_LONG:
case FILE_BELONG:
case FILE_LELONG:
+ case FILE_MELONG:
v = file_signextend(ms, m, p->l);
if (file_printf(ms, m->desc, (uint32_t) v) == -1)
return -1;
case FILE_DATE:
case FILE_BEDATE:
case FILE_LEDATE:
+ case FILE_MEDATE:
if (file_printf(ms, m->desc, file_fmttime(p->l, 1)) == -1)
return -1;
t = m->offset + sizeof(time_t);
case FILE_LDATE:
case FILE_BELDATE:
case FILE_LELDATE:
+ case FILE_MELDATE:
if (file_printf(ms, m->desc, file_fmttime(p->l, 0)) == -1)
return -1;
t = m->offset + sizeof(time_t);
if (m->mask_op & FILE_OPINVERSE)
p->l = ~p->l;
return 1;
+ case FILE_MELONG:
+ case FILE_MEDATE:
+ case FILE_MELDATE:
+ p->l = (int32_t)
+ ((p->hl[1]<<24)|(p->hl[0]<<16)|(p->hl[3]<<8)|(p->hl[2]));
+ if (m->mask)
+ switch (m->mask_op&0x7F) {
+ case FILE_OPAND:
+ p->l &= m->mask;
+ break;
+ case FILE_OPOR:
+ p->l |= m->mask;
+ break;
+ case FILE_OPXOR:
+ p->l ^= m->mask;
+ break;
+ case FILE_OPADD:
+ p->l += m->mask;
+ break;
+ case FILE_OPMINUS:
+ p->l -= m->mask;
+ break;
+ case FILE_OPMULTIPLY:
+ p->l *= m->mask;
+ break;
+ case FILE_OPDIVIDE:
+ p->l /= m->mask;
+ break;
+ case FILE_OPMODULO:
+ p->l %= m->mask;
+ break;
+ }
+ if (m->mask_op & FILE_OPINVERSE)
+ p->l = ~p->l;
+ return 1;
case FILE_REGEX:
case FILE_SEARCH:
return 1;
off = (int32_t)((q->hl[3]<<24)|(q->hl[2]<<16)|
(q->hl[1]<<8)|(q->hl[0]));
break;
+ case FILE_MELONG:
+ off = (int32_t)((q->hl[1]<<24)|(q->hl[0]<<16)|
+ (q->hl[3]<<8)|(q->hl[2]));
+ break;
}
}
switch (m->in_type) {
if (m->in_op & FILE_OPINVERSE)
offset = ~offset;
break;
+ case FILE_MELONG:
+ if (nbytes < (offset + 4))
+ return 0;
+ if (off) {
+ switch (m->in_op & 0x7F) {
+ case FILE_OPAND:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) &
+ off;
+ break;
+ case FILE_OPOR:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) |
+ off;
+ break;
+ case FILE_OPXOR:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) ^
+ off;
+ break;
+ case FILE_OPADD:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) +
+ off;
+ break;
+ case FILE_OPMINUS:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) -
+ off;
+ break;
+ case FILE_OPMULTIPLY:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) *
+ off;
+ break;
+ case FILE_OPDIVIDE:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) /
+ off;
+ break;
+ case FILE_OPMODULO:
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2])) %
+ off;
+ break;
+ }
+ } else
+ offset = (int32_t)((p->hl[1]<<24)|
+ (p->hl[0]<<16)|
+ (p->hl[3]<<8)|
+ (p->hl[2]));
+ if (m->in_op & FILE_OPINVERSE)
+ offset = ~offset;
+ break;
case FILE_LONG:
if (nbytes < (offset + 4))
return 0;
case FILE_LONG:
case FILE_BELONG:
case FILE_LELONG:
+ case FILE_MELONG:
case FILE_DATE:
case FILE_BEDATE:
case FILE_LEDATE:
+ case FILE_MEDATE:
case FILE_LDATE:
case FILE_BELDATE:
case FILE_LELDATE:
+ case FILE_MELDATE:
if (nbytes < (offset + 4))
return 0;
break;
case FILE_LONG:
case FILE_BELONG:
case FILE_LELONG:
+ case FILE_MELONG:
case FILE_DATE:
case FILE_BEDATE:
case FILE_LEDATE:
+ case FILE_MEDATE:
case FILE_LDATE:
case FILE_BELDATE:
case FILE_LELDATE:
+ case FILE_MELDATE:
v = p->l;
break;