-# $Id: Localstuff,v 1.2 1993/01/05 13:22:25 ian Exp $
-# Add any locally-observed files here. Remember:
+
+#------------------------------------------------------------------------------
+# Localstuff: file(1) magic for locally observed files
+#
+# $Id: Localstuff,v 1.3 1995/01/21 21:09:00 christos Exp $
+# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.
+
+#------------------------------------------------------------------------------
+# alliant: file(1) magic for Alliant FX series a.out files
#
-# Alliant FX series a.out files:
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
+
+#------------------------------------------------------------------------------
+# animation: file(1) magic for animation/movie formats
#
# animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8)
-#
0 string \000\000\001\263 MPEG file
4 leshort 0xAF11 FLI file
>6 leshort x , %d frames
# This is total guesswork here.
# Based on empirical evidence, version 3's have several nulls following it.
# Most of them start with non-null values at hex offset 0x34 or so.
-0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL file version 3
+0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL file version 3
-#
-# magic.apl:
+
+#------------------------------------------------------------------------------
+# apl: file(1) magic for APL
#
0 long 0100554 APL workspace (Ken's original?)
-#
-# Apple II file formats
+
+#------------------------------------------------------------------------------
+# apple: file(1) magic for Apple II file formats
#
0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
0 string \x0aGL Binary II (apple ][) data
-# A collection of various "ar" and "cpio" archive formats.
-# "Tar" archives are handled in the C code.
+
+#------------------------------------------------------------------------------
+# archive: file(1) magic for archive formats (see also "ms-dos" for self-
+# extracting compressed archives)
+#
+# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
+# "tar" archives are handled in the C code.
+
+# cpio archives
+#
+# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
+# The idea is to indicate archives produced on machines with the same
+# byte order as the machine running "file" with "cpio archive", and
+# to indicate archives produced on machines with the opposite byte order
+# from the machine running "file" with "byte-swapped cpio archive".
+#
+# The SVR4 "cpio(4)" hints that there are additional formats, but they
+# are defined as "short"s; I think all the new formats are
+# character-header formats and thus are strings, not numbers.
0 short 070707 cpio archive
-0 string 070707 ASCII cpio archive
+0 short 0143561 byte-swapped cpio archive
+0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
+0 string 070701 ASCII cpio archive (SVR4 with no CRC)
+0 string 070702 ASCII cpio archive (SVR4 with CRC)
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0177545 old archive
0 string !<arch> archive
>8 string __.SYMDEF random library
0 string -h- Software Tools format archive text
+
+#
+# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
+# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
+#
+# 0 string !<arch> current ar archive
+# 0 long 0x213c6172 archive file
+#
+# and for SVR3.1 archives, we have:
+#
+# 0 string \<ar> System V Release 1 ar archive
+# 0 string =<ar> archive
+# 0 string =<ar> archive
+#
+# XXX - did Aegis really store shared libraries, breakpointed modules,
+# and absolute code program modules in the same format as new-style
+# "ar" archives?
+#
+0 string !<arch> current ar archive
+>8 string __.SYMDEF random library
+>0 belong =65538 - pre SR9.5
+>0 belong =65539 - post SR9.5
+>0 beshort 2 - object archive
+>0 beshort 3 - shared library module
+>0 beshort 4 - debug break-pointed module
+>0 beshort 5 - absolute code program module
+0 string \<ar> System V Release 1 ar archive
+0 string =<ar> archive
+#
+# XXX - from "vax", which appears to collect a bunch of byte-swapped
+# thingies, to help you recognize VAX files on big-endian machines;
+# with "leshort", "lelong", and "string", that's no longer necessary....
+#
+# 0 long 0x3c61723e VAX 5.0 archive
+#
+0 long 0x213c6172 archive file
+0 lelong 0177555 very old VAX archive
+0 leshort 0177555 very old PDP-11 archive
+#
+# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
+# be a random library (it said 0xff65 rather than 0177545).
+#
+0 lelong 0177545 old VAX archive
+>8 string __.SYMDEF random library
+0 leshort 0177545 old PDP-11 archive
+>8 string __.SYMDEF random library
+#
+0 string =<ar> archive
+#
+# From "pdp":
+#
+0 lelong 0x39bed PDP-11 old archive
+0 lelong 0x39bee PDP-11 4.0 archive
+#
+0 string -h- Software Tools format archive text
+
+# ARC archiver
+0 byte 26 ARC archive data
+>1 byte 0 (empty)
+>1 byte 1 (old format)
+# GRR: this is my empirical entry:
+#0 string \032\010 ARC archive data
+
+# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
+# I can't create either SPARK or ArcFS archives so I have not tested this stuff
+# [GRR: the original entries collide with ARC, above; replaced with combined
+# version (not tested)]
+#0 byte 0x1a RISC OS archive
+#>1 string archive (ArcFS format)
+0 string \032archive RISC OS archive (ArcFS format)
+
+# ARJ archiver (jason@jarthur.Claremont.EDU)
+0 leshort 0xea60 ARJ archive data
+>5 byte x - version %d,
+>8 byte >0 flags:
+>>8 byte &0x04 multi-volume,
+>>8 byte &0x10 slash switched,
+>>8 byte &0x20 backup,
+>34 string x original name: %s,
+>7 byte 0 os: MS/DOS
+>7 byte 1 os: PRIMOS
+>7 byte 2 os: UNIX
+>7 byte 3 os: Amiga
+>7 byte 4 os: Macintosh
+>7 byte 5 os: OS/2
+>7 byte 6 os: Apple ][ GS
+>7 byte 7 os: Atari ST
+>7 byte 8 os: NeXT
+>7 byte 9 os: VAX/VMS
+>3 byte >0 %d]
+
+# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
+0 string HPAK HPACK archive data
+
+# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
+2 string -lh0- Lharc 1.x archive data [lh0]
+2 string -lh1- Lharc 1.x archive data [lh1]
+2 string -lz4- Lharc 1.x archive data [lz4]
+2 string -lz5- Lharc 1.x archive data [lz5]
+# [never seen any but the last; -lh4- reported in comp.compression:]
+2 string -lzs- LHa 2.x? archive data [lzs]
+2 string -lh - LHa 2.x? archive data [lh ]
+2 string -lhd- LHa 2.x? archive data [lhd]
+2 string -lh2- LHa 2.x? archive data [lh2]
+2 string -lh3- LHa 2.x? archive data [lh3]
+2 string -lh4- LHa (2.x) archive data [lh4]
+2 string -lh5- LHa (2.x) archive data [lh5]
+>20 byte x - header level %d
+
+# RAR archiver (Greg Roelofs, newt@uchicago.edu)
+0 string Rar! RAR archive data
+
+# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
+0 string SQSH squished archive data (Acorn RISCOS)
+
+# ZIP archiver (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
+0 string PK\003\004 Zip archive data
+>4 byte 0x09 (at least v0.9 to extract)
+>4 byte 0x0a (at least v1.0 to extract)
+>4 byte 0x0b (at least v1.1 to extract)
+>4 byte 0x14 (at least v2.0 to extract)
+
+# ZOO archiver (Greg Roelofs, newt@uchicago.edu)
+#0 string ZOO Zoo archive data
+#20 belong 0xc4fddca7 Zoo archive data
+# [above are alternate identifiers]
+20 lelong 0xdca7c4fd Zoo archive data
+# [don't know if all of these versions exist, or if some are missing...]
+>4 string 1.00 (v%4s)
+>4 string 1.10 (v%4s)
+>4 string 1.20 (v%4s)
+>4 string 1.30 (v%4s)
+>4 string 1.40 (v%4s)
+>4 string 1.50 (v%4s)
+>4 string 1.60 (v%4s)
+>4 string 1.70 (v%4s)
+>4 string 1.71 (v%4s)
+>4 string 2.00 (v%4s)
+>4 string 2.01 (v%4s)
+>4 string 2.10 (v%4s)
+>32 string \001\000 (modify: v1.0+)
+>32 string \001\004 (modify: v1.4+)
+>32 string \002\000 (modify: v2.0+)
+>70 string \001\000 (extract: v1.0+)
+>70 string \002\001 (extract: v2.1+)
-#
-# AT&T 3B machines
+
+#------------------------------------------------------------------------------
+# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
+
+#------------------------------------------------------------------------------
+# audio: file(1) magic for sound formats
#
-# Sound formats, from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
+# from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
#
# Sun/NeXT audio data
>20 belong 2 stereo,
>20 belong 4 quad,
>16 belong x %d Hz
+
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
# (0x0064732E in little-endian encoding).
>20 lelong 2 stereo,
>20 lelong 4 quad,
>16 lelong x %d Hz
+
# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
8 string AIFF AIFF audio data
8 string AIFC AIFF-C audio data
8 string 8SVX IFF/8SVX audio data
+
# Creative Labs AUDIO stuff
-0 string MThd Standard MIDI data
+0 string MThd Standard MIDI data
>9 byte >0 (format %d)
>11 byte >1 using %d channels
-0 string CTMF Creative Music (CMF) data
-0 string SBI SoundBlaster instrument data
+0 string CTMF Creative Music (CMF) data
+0 string SBI SoundBlaster instrument data
0 string Creative\ Voice\ File Creative Labs voice data
# is this next line right? it came this way...
>19 byte 0x1A
>23 byte >0 - version %d
>22 byte >0 \b.%d
-# Microsoft WAVE format
+
+# [GRR 950115: is this also Creative Labs? Guessing that first line
+# should be string instead of unknown-endian long...]
+#0 long 0x4e54524b MultiTrack sound data
+0 string NTRK MultiTrack sound data
+>4 long x - version %ld
+
+# Microsoft WAVE format (*.wav)
+# [GRR 950115: probably all of the shorts and longs should be leshort/lelong]
0 string RIFF Microsoft RIFF
>8 string WAVE - WAVE format
>34 short >0 %d bit
-# 68K Blit stuff as seen from 680x0 machine
+
+#------------------------------------------------------------------------------
+# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
+#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
-# this first will upset you if you're a PL/1 shop...
-# in which case rm it; ascmagic will catch real C programs
-0 string /* c program text
+
+#------------------------------------------------------------------------------
+# c-lang: file(1) magic for C programs (or REXX)
+#
+
+# XPM icons (Greg Roelofs, newt@uchicago.edu)
+# ideally should go into "images", but entries below would tag XPM as C source
+0 string /*\ XPM X pixmap image data
+
+# this first will upset you if you're a PL/1 shop...
+# in which case rm it; ascmagic will catch real C programs
+0 string /* C or REXX program text
+0 string // C++ program text
-# ChiWriter files
+
+#------------------------------------------------------------------------------
+# chi: file(1) magic for ChiWriter files
+#
0 string \\1cw\ ChiWriter file
>5 string >\0 version %s
0 string \\1cw ChiWriter file
-#
-# Intergraph, formerly Fairchild, Clipper.
+
+#------------------------------------------------------------------------------
+# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
-#
-# "Commands": stuff for various shells and interpreters.
+
+#------------------------------------------------------------------------------
+# commands: file(1) magic for various shells and interpreters
#
0 string :\ shell archive or commands for antique kernel text
0 string #!/bin/sh Bourne Shell script text
0 string #!\ /usr/local/tcsh Tenex C Shell script text
0 string #!/usr/local/bin/tcsh Tenex C Shell script text
0 string #!\ /usr/local/bin/tcsh Tenex C Shell script text
+#
+# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
+0 string #!/usr/local/bin/zsh - Paul Falstad's zsh
+0 string #!\ /usr/local/bin/zsh - Paul Falstad's zsh
+0 string #!/usr/local/bin/ash - NeilBrown's ash
+0 string #!\ /usr/local/bin/ash - NeilBrown's ash
+0 string #!/usr/local/bin/ae - NeilBrown's ae
+0 string #!\ /usr/local/bin/ae - NeilBrown's ae
+0 string #!/bin/nawk - New Awk script text
+0 string #!\ /bin/nawk - New Awk script text
+0 string #!/usr/bin/nawk - New Awk script text
+0 string #!\ /usr/bin/nawk - New Awk script text
+0 string #!/usr/local/bin/nawk - New Awk script text
+0 string #!\ /usr/local/bin/nawk - New Awk script text
+0 string #!/bin/gawk - GNU awk script text
+0 string #!\ /bin/gawk - GNU awk script text
+0 string #!/usr/local/bin/gawk - GNU awk script text
+0 string #!\ /usr/local/bin/gawk - GNU awk script text
+#
0 string #!/bin/awk Awk Commands text
0 string #!\ /bin/awk Awk Commands text
0 string #!\ / a
# For Larry Wall's perl language. The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
# Keith Waclena <keith@cerberus.uchicago.edu>
-0 string #!/bin/perl perl commands text
-0 string #!\ /bin/perl perl commands text
-0 string eval\ "exec\ /bin/perl perl commands text
-0 string #!/usr/bin/perl perl commands text
-0 string #!\ /usr/bin/perl perl commands text
-0 string eval\ "exec\ /usr/bin/perl perl commands text
-0 string #!/usr/local/bin/perl perl commands text
-0 string #!\ /usr/local/bin/perl perl commands text
-0 string eval\ "exec\ /usr/local/bin/perl perl commands text
+0 string #!/bin/perl perl commands text
+0 string #!\ /bin/perl perl commands text
+0 string eval\ "exec\ /bin/perl perl commands text
+0 string #!/usr/bin/perl perl commands text
+0 string #!\ /usr/bin/perl perl commands text
+0 string eval\ "exec\ /usr/bin/perl perl commands text
+0 string #!/usr/local/bin/perl perl commands text
+0 string #!\ /usr/local/bin/perl perl commands text
+0 string eval\ "exec\ /usr/local/bin/perl perl commands text
+
+# AT&T Bell Labs' Plan 9 shell
0 string #!/bin/rc Plan 9 rc Shell script text
0 string #!\ /bin/rc Plan 9 rc Shell script text
+
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string #!/bin/bash Bourne-Again Shell script text
0 string #!\ /bin/bash Bourne-Again Shell script text
-0 string #!/usr/local/bin/bash Bourne-Again Shell script text
-0 string #!\ /usr/local/bin/bash Bourne-Again Shell script text
+
+#------------------------------------------------------------------------------
+# compress: file(1) magic for pure-compression formats (no archives)
+#
+# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.
+# standard unix compress
+0 string \037\235 compress'd data
+>2 byte&0x80 >0 block compressed
+>2 byte&0x1f x %d bits
+
+# gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
+0 string \037\213 gzip compressed data
+>2 byte <8 - reserved method
+>2 byte 8 - deflate method
+>3 byte &0x01 , ascii
+>3 byte &0x02 , continuation
+>3 byte &0x04 , extra field
+>3 byte &0x08 , original file name
+>3 byte &0x10 , comment
+>3 byte &0x20 , encrypted
+>4 ledate x , last modified: %s
+>8 byte 2 , max compression
+>8 byte 4 , max speed
+>9 byte =0x00 os: MS-DOS
+>9 byte =0x01 os: Amiga
+>9 byte =0x02 os: VMS
+>9 byte =0x03 os: Unix
+>9 byte =0x05 os: Atari
+>9 byte =0x06 os: OS/2
+>9 byte =0x07 os: MacOS
+>9 byte =0x0A os: Tops/20
+>9 byte =0x0B os: Win/32
+
# According to gzip.h, this is the correct byte order for packed data.
#
0 string \037\036 packed data
-
#
# This magic number is byte-order-independent.
#
0 short 017437 old packed data
-#
# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0 short 0x1fff compacted data
0 string \377\037 compacted data
0 short 0145405 huf output
-#
+
# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats. Note that I can only uncrunch, not crunch, and
# Keith Waclena <keith@cerberus.uchicago.edu>
0 leshort 0x76FF squeezed data (CP/M, DOS)
0 leshort 0x76FE crunched data (CP/M, DOS)
+
# Freeze
0 string \037\237 Frozen file 2.1
0 string \037\236 Frozen file 1.0 (or gzip 0.5)
-#
-# Standard unix compress
-#
-0 string \037\235 compressed data
->2 byte&0x80 >0 block compressed
->2 byte&0x1f x %d bits
+# lzh?
0 string \037\240 LZH compressed data
-
-# >>>>> HPACK <<<<< [from Peter Gutmann, pgut1@cs.aukuni.ac.nz]
-#
-0 string HPAK HPACK archive
+
+#------------------------------------------------------------------------------
+# convex: file(1) magic for Convex boxes
#
-# XXX - what byte order does a Convex use?
+# Convexes are big-endian.
#
0 long 0513 Convex executable
+
+#------------------------------------------------------------------------------
+# diamond: file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
+
+#------------------------------------------------------------------------------
+# diff: file(1) magic for diff(1) output
#
-# magic file lines for output from "diff"...
0 string diff\ 'diff' output text
0 string ***\ 'diff' output text
0 string Only\ in\ 'diff' output text
-#
-# magic.dump, dump file format. For new and old dump filesystems
+
+#------------------------------------------------------------------------------
+# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
+
+#------------------------------------------------------------------------------
+# elf: file(1) magic for ELF executables
#
-# ELF
# Missing MIPS image type and flags
#
# Question marks on processor types flag "should not happen because the
-#
-# magic.encore: Recognize encore machines
+
+#------------------------------------------------------------------------------
+# encore: file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
-0 string FONT ASCII vfont text
-0 short 0436 Berkeley vfont data
-0 short 017001 byte-swapped Berkeley vfont data
-# PostScript fonts (must precede PostScript entry), quinlan@yggdrasil.com
+
+#------------------------------------------------------------------------------
+# fonts: file(1) magic for font data (see also "x11")
+#
+0 string FONT ASCII vfont text
+0 short 0436 Berkeley vfont data
+0 short 017001 byte-swapped Berkeley vfont data
+
+# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data
+
+#------------------------------------------------------------------------------
+# frame: file(1) magic for FrameMaker files
#
-# Magic number for FrameMaker files
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0 string \<MakerFile FrameMaker document
+>11 string 4.0 (4.0
>11 string 3.0 (3.0
>11 string 2.0 (2.0
>11 string 1.0 (1.0
>14 byte x %c)
-0 string \<MIFFile FrameMaker MIF file
+0 string \<MIFFile FrameMaker MIF (ASCII) file
+>9 string 4.0 (4.0)
>9 string 3.0 (3.0)
>9 string 2.0 (2.0)
>9 string 1.0 (1.x)
-0 string \<MakerDictionary FraneMaker Dictionary text
+0 string \<MakerDictionary FrameMaker Dictionary text
>17 string 3.0 (3.0)
>17 string 2.0 (2.0)
>17 string 1.0 (1.x)
>10 string 1.0 (1.0
>13 byte x %c)
0 string \<Maker Intermediate Print File FrameMaker IPL file
-0 string \<MakerDictionary FraneMaker Dictionary text
-#
-# magic.hp: Hewlett Packard Magic
+
+#------------------------------------------------------------------------------
+# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
-#
-# IBM 370 and compatibles.
+
+#------------------------------------------------------------------------------
+# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
-#
-# magic.rs6000:
-#
-# RS/6000 and the RT PC.
+
+#------------------------------------------------------------------------------
+# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
>12 belong >0 not stripped
-# image formats, originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
+
+#------------------------------------------------------------------------------
+# images: file(1) magic for image formats (see also "c-lang" for XPM bitmaps)
+#
+# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# XXX - byte order for GIF and TIFF fields?
+# [GRR: TIFF allows both byte orders; GIF is probably little-endian]
#
-0 string xbtoa btoa'd file
+# [GRR: what the hell is this doing in here?]
+0 string xbtoa btoa'd file
# PBMPLUS
-0 string P1 PBM file
-0 string P2 PGM file
-0 string P3 PPM file
-0 string P4 PBM "rawbits" file
-0 string P5 PGM "rawbits" file
-0 string P6 PPM "rawbits" file
+0 string P1 PBM file
+0 string P2 PGM file
+0 string P3 PPM file
+0 string P4 PBM "rawbits" file
+0 string P5 PGM "rawbits" file
+0 string P6 PPM "rawbits" file
+
+# NIFF (Navy Interchange File Format, a modification of TIFF)
+# [GRR: this *must* go before TIFF]
+0 string IIN1 NIFF raster data
# TIFF and friends
-0 string \115\115 TIFF file, big-endian
->2 short >0 version %d
-0 string \111\111 TIFF file, little-endian
->2 short >0 version %d
+0 string MM TIFF file, big-endian
+>2 short >0 version %d
+0 string II TIFF file, little-endian
+>2 short >0 version %d
+
+# possible GIF replacements; none yet released!
+# (Greg Roelofs, newt@uchicago.edu)
#
-# NIFF (Navy Interchange File Format, a modification of TIFF)
-0 string IIN1 NIFF raster data
+# GRR 950115: this was mine ("Zip GIF"):
+0 string GIF94z ZIF image (GIF+deflate alpha)
+#
+# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
+0 string FGF95a FGF image (GIF+deflate beta)
+#
+# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
+# (best; not yet implemented):
+0 string PBF PBF image (deflate compression)
# GIF
-0 string GIF GIF picture
+0 string GIF GIF image
>3 string 87a - version %s
>3 string 89a - version %s
>6 leshort >0 %hd x
>10 byte&0x07 =0x07 256 colors
# Miscellany
-0 long 1123028772 Artisan image file
+0 long 1123028772 Artisan image file
>4 long 1 rectangular 24-bit image
>4 long 2 rectangular 8-bit image with colormap
->4 long 3 rectangular 32-bit image (24-bit with matte)
+>4 long 3 rectangular 32-bit image (24-bit with matte)
0 string \361\0\100\273 CMU window manager bitmap
0 string #FIG FIG graphics savefile text
->6 string 2.1 Version 2.1
->6 string 2.0 Version 2.0
+>6 string 2.1 Version 2.1
+>6 string 2.0 Version 2.0
0 string GKSM GKS Metafile
8 string ILBM IFF ILBM file
-0 string ARF_BEGARF PHIGS clear text archive
+0 string ARF_BEGARF PHIGS clear text archive
# From: <u31b3hs@pool.informatik.rwth-aachen.de> (Michael Haardt)
0 string yz MGR bitmap, modern format, 8 bit aligned
>29 byte 1 , fine resolution
>29 byte 0 , normal resolution
+# JPEG images
+0 beshort 0xffd8 JPEG image
+>6 string JFIF (JFIF standard)
+# from cameron@cs.unsw.oz.au (Cameron Simpson):
+0 string hsi1 HSI1 image (wrapper for JPEG?)
-0 beshort 0xffd8 JPEG picture
->6 string JFIF JFIF standard
+# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)
+0 string BM bitmap
+>14 byte 12 (OS/2 1.x format)
+>14 byte 64 (OS/2 2.x format)
+>14 byte 40 (Windows 3.x format)
+0 string IC icon
+0 string PI pointer
+0 string CI color icon
+0 string CP color pointer
+0 string BA bitmap array
+# Utah Raster Toolkit RLE images (two versions)
#
-# animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8)
+# From <janl@ifi.uio.no>
+# I made this with the help of the man page for rle(5). Ihey missing
+# from the magic numbers I have:
+0 beshort 0xcc52 Utah Raster Toolkit RLE
+>2 beshort >0 lower left corner: %d
+>4 beshort >0 lower right corner: %d
+>6 beshort >0 %d x
+>8 beshort >0 %d
+>10 byte&0x1 =0x1 CLEARFIRST
+>10 byte&0x2 =0x2 NO_BACKGROUND
+>10 byte&0x4 =0x4 ALPHA
+>10 byte&0x8 =0x8 COMMENT
+>11 byte >0 %d colour channels
+>12 byte >0 %d bits per pixel
+>13 byte >0 %d colour map channels
#
-0 belong 0x000001b3 MPEG file
-
-4 leshort 0xAF11 FLI file
->6 leshort x , %d frames
->8 leshort x , width=%d pixels
->10 leshort x , height=%d pixels
->12 leshort x , depth=%d
->16 leshort x , ticks/frame=%d
+# RLE images (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
+# Here's a magic file entry for rle images. 24-bit images tend to produce
+# foo.rle size 42x42, 3 comps each 8 bits
+# (for arbitary, prossibly different values of 42).
+# freely redistribuable under the GPL
+# [GRR: which endianness? big?]
+0 short 0xcc55 rle image data
+>6 short >0 %d x
+>8 short >0 %d,
+>2 short >0 x offset by %d,
+>4 short >0 y offset by %d,
+>11 byte =0 colour map
+>11 byte >1 %d comps each
+>12 byte =1 1 bit
+>12 byte >1 %d bits
+
+# FBM images, culled from xli source (d. p. simpleton, m91dps@ecs.ox.ac.uk)
+0 string %bitmap fbm image data
+
+# image file format (Robert Potter, potter@cs.rochester.edu)
+0 string Imagefile\ version- iff image data
+# this adds the whole header (inc. version number), informative but longish
+>10 string >\0 %s
+
+#------------------------------------------------------------------------------
+# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft"). DOS is in "ms-dos"; the ambitious soul can do
+
+
+#------------------------------------------------------------------------------
+# interleaf: file(1) magic for InterLeaf TPS:
#
-# magic for InterLeaf TPS:
0 string =\210OPS Interleaf saved data
0 string =<!OPS Interleaf document text
>5 string ,\ Version\ (version
-#
-# magic.ispell
+
+#------------------------------------------------------------------------------
+# ispell: file(1) magic for ispell
#
# XXX - byte order?
#
+
+#------------------------------------------------------------------------------
+# lex: file(1) magic for lex
+#
# derived empirically, your offsets may vary!
53 string yyprevious c program text (from lex)
>3 string >\0 for %s
+# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
+21 string generated\ by\ flex C program text (from flex)
+# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
+0 string %{ lex description text
-#
-# magic.lif:
+
+#------------------------------------------------------------------------------
+# lif: file(1) magic for lif
#
# XXX - byte order?
#
-#
-# magic.linux
+
+#------------------------------------------------------------------------------
+# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Rik Faith <faith@cs.unc.edu>,
# Peter Tobias <tobias@server.et-inf.fho-emden.de>, and Daniel Quinlan
>220 string >\0 - core dump of '%s'
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
-# this can be overrided by the DOS executable (COM) entry
+# this can be overridden by the DOS executable (COM) entry
2 string LILO LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
+
+#------------------------------------------------------------------------------
+# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string ;; Lisp/Scheme program text
+
+#------------------------------------------------------------------------------
+# magic: file(1) magic for magic files
+#
0 string #\ Magic magic text file for file(1) cmd
+
+#------------------------------------------------------------------------------
+# mail.news: file(1) magic for mail and news
+#
# Unfortunately, saved netnews also has From line added in some news software.
#0 string From mail text
# There are tests to ascmagic.c to cope with mail and news.
+
+#------------------------------------------------------------------------------
+# mirage: file(1) magic for Mirage executables
#
# XXX - byte order?
#
+
+#------------------------------------------------------------------------------
+# mkid: file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
+
+#------------------------------------------------------------------------------
+# mmdf: file(1) magic for MMDF mail files
+#
0 string \001\001\001\001 MMDF mailbox
-#
-# Motorola
+
+#------------------------------------------------------------------------------
+# motorola: file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
+
+#------------------------------------------------------------------------------
+# ms-dos: file(1) magic for MS-DOS files
#
-# Various MS-DOS magic numbers
-#
-0 string MZ DOS executable (EXE)
-0 string LZ DOS executable (built-in)
-0 byte 0xe9 DOS executable (COM)
-0 byte 0xeb DOS executable (COM)
+
+# .EXE formats (Greg Roelofs, newt@uchicago.edu)
+# [GRR: some company sells a self-extractor/displayer for image data(!)]
+0 string MZ MS-DOS executable (EXE)
+>24 string @ (OS/2 or Windows format)
+>7195 string Rar! (RAR self-extracting archive)
+# [GRR 950115: file 3.14 apparently has a buffer-size limitation; offsets
+# bigger than 8161 bytes are ignored (sigh)]
+>13297 string PK\003\004 (PKZIP SFX archive v1.93a)
+>15770 string PK\003\004 (PKZIP SFX archive v2.04g)
+>25115 string PK\003\004 (Info-ZIP SFX archive v5.12)
+>26331 string PK\003\004 (Info-ZIP SFX archive v5.12 w/decryption)
+
+# miscellaneous formats
+0 string LZ MS-DOS executable (built-in)
+0 byte 0xe9 MS-DOS executable (COM)
+0 byte 0xeb MS-DOS executable (COM)
0 byte 0xf0 MS-DOS program library
+
+#------------------------------------------------------------------------------
+# ncr: file(1) magic for NCR Tower objects
#
-# magic.tower:
-#
-# NCR Tower objects, contributed by
+# contributed by
# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
#
-# NeWS, not "news" as in "netnews"
+
+#------------------------------------------------------------------------------
+# news: file(1) magic for Sun(?) NeWS fonts (not "news" as in "netnews")
+#
0 string StartFontMetrics ASCII font metrics
0 string StartFont ASCII font bits
0 long 0x137A2944 NeWS bitmap font
-# BSDI BSD/386
+
+#------------------------------------------------------------------------------
+# bsdi: file(1) magic for BSDI BSD/386
+#
0 long 0314 BSD/386 demand paged (first page unmapped) pure executable
+
+#------------------------------------------------------------------------------
+# floppy.raw: file(1) magic for raw floppies (whose format?)
+#
0 string \366\366\366\366 Formatted floppy w/ no filesystem data
+
+#------------------------------------------------------------------------------
+# html: file(1) magic for HTML (HyperText Markup Language) docs
#
-# HTML magic, from Daniel Quinlan <quinlan@yggdrasil.com>
+# from Daniel Quinlan <quinlan@yggdrasil.com>
#
0 string \<HEAD HTML document text (old type)
0 string \<head HTML document text (old type)
-#
-# magic.iris: Magic for mips from an iris4d
+
+#------------------------------------------------------------------------------
+# iris: file(1) magic for mips from an iris4d
#
# Dunno what byte-order munging is needed; all of SGI's *current*
# machines and OSes run in big-endian mode on the MIPS machines,
+
+#------------------------------------------------------------------------------
+# mips: file(1) magic for RISC (MIPS) DECstation
#
-# RISC MIPS decstation
# Should this be "leshort", given that DEC ran the DECstations in
# little-endian mode?
#
+
+#------------------------------------------------------------------------------
+# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
#
-#
-# Sun rasterfiles
+
+#------------------------------------------------------------------------------
+# sunraster: file(1) magic for Sun rasterfiles
#
# XXX - byte order? What about the 386i?
#
-#
-# magic.x11
+
+#------------------------------------------------------------------------------
+# x11: file(1) magic for X11 fonts
#
# I think this is byte-order-dependent; if so, it should become:
#
-# 0 belong 00000004 X11 big-endian snf font
-# 0 lelong 00000004 X11 little-endian snf font
+# 0 belong 00000004 X11 big-endian snf font
+# 0 lelong 00000004 X11 little-endian snf font
#
-0 long 00000004 X11 snf font
+0 long 00000004 X11 snf font
+
# some X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
-0 string \001fcp X11 font data
-0 string D1.0\015\012\000\000 X11 Speedo font data
+0 string \001fcp X11 font data
+0 string D1.0\015\012\000\000 X11 Speedo font data
+
+#------------------------------------------------------------------------------
+# pbm: file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
-#
-# magic.pdp: PDP-11 executable/object and APL workspace
+
+#------------------------------------------------------------------------------
+# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
0 lelong 0101554 PDP-11 double precision APL workspace
-
#
# PDP-11 a.out
#
+
+#------------------------------------------------------------------------------
+# pgp: file(1) magic for Pretty Good Privacy
#
-# pgp (pretty good protection)
0 beshort 0x9900 pgp key public ring
0 beshort 0x9501 pgp key security ring
0 beshort 0x9500 pgp key security ring
-#
-# SysV R4 PKG Datastreams:
+
+#------------------------------------------------------------------------------
+# pkgadd: file(1) magic for SysV R4 PKG Datastreams
#
0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
-#
-#/etc/magic entries for Plus Five's UNIX MUMPS
+
+#------------------------------------------------------------------------------
+# plus5: file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order? Paging Hokey....
#
-# PostScript
-0 string %! PostScript document
->2 string PS-Adobe- conforming
->>11 string >\0 at level %s
-# Some pc's have the annoying habit of adding a ^D
-0 string \004%! PostScript document
->3 string PS-Adobe- conforming
->>12 string >\0 at level %s
-# PCL (HP print format followed by DeskJets and LaserJets)
-# from Daniel Quinlan (quinlan@yggdrasil.com)
-0 string \033E\033 PCL (LaserJet) printer data
-# Tell file about magic for IMAGEN printer-ready files:
-0 string @document( Imagen printer
-# this only works if "language xxx" is first item in Imagen header.
->10 string language\ impress (imPRESS data)
->10 string language\ daisy (daisywheel text)
->10 string language\ diablo (daisywheel text)
->10 string language\ printer (line printer emulation)
->10 string language\ tektronix (Tektronix 4014 emulation)
-# Add any other languages that your Imagen uses - remember
-# to keep the word `text' if the file is human-readable.
+
+#------------------------------------------------------------------------------
+# printer: file(1) magic for printer-formatted files
#
-# Now magic for IMAGEN font files...
-0 string Rast RST-format raster font data
->45 string >0 face %
+
# PostScript
0 string %! PostScript document
>2 string PS-Adobe- conforming
>>11 string >\0 at level %s
-# Some pc's have the annoying habit of adding a ^D
+# Some pc's have the annoying habit of adding a ^D as a document separator
0 string \004%! PostScript document
>3 string PS-Adobe- conforming
>>12 string >\0 at level %s
+
# PCL (HP print format followed by DeskJets and LaserJets)
# from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \033E\033 PCL (LaserJet) printer data
-# Tell file about magic for IMAGEN printer-ready files:
+
+# IMAGEN printer-ready files:
0 string @document( Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10 string language\ impress (imPRESS data)
>10 string language\ daisy (daisywheel text)
->10 string language\ diablo (daisywheel text)
+>10 string language\ diablo (daisywheel text)
>10 string language\ printer (line printer emulation)
>10 string language\ tektronix (Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
+# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0 string Rast RST-format raster font data
-#
-# magic.ps: psdatabase magic
+
+#------------------------------------------------------------------------------
+# psdbms: file(1) magic for psdatabase
#
0 belong&0xff00ffff 0x56000000 ps database
>1 string >\0 version %s
-#
-# magic.pyramid: Magic for pyramids
+
+#------------------------------------------------------------------------------
+# compress: file(1) magic for Pyramids
#
# XXX - byte order?
#
-# for SC
-38 string Spreadsheet sc file
+
+#------------------------------------------------------------------------------
+# sc: file(1) magic for "sc" spreadsheet
+#
+38 string Spreadsheet sc spreadsheet file
+
+#------------------------------------------------------------------------------
+# sccs: file(1) magic for SCCS archives
+#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
-#
-# magic.sendmail:
+
+#------------------------------------------------------------------------------
+# sendmail: file(1) magic for sendmail config files
#
# XXX - byte order?
#
+
+#------------------------------------------------------------------------------
+# sequent: file(1) magic for Sequent machines
+#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0 lelong 0x00ea BALANCE NS32000 .o
-# $Id: sgml,v 1.3 1993/01/05 12:52:44 ian Exp $
+
+#------------------------------------------------------------------------------
+# sgml: file(1) magic for Standard(?) Generalized Mark-up Language
+#
+# $Id: sgml,v 1.4 1995/01/21 21:09:00 christos Exp $
# SGML goop, mostly from rph@sq.
0 string \<!DOCTYPE Exported SGML document
0 string \<!doctype Exported SGML document
-# SoftQuad Publishing Software magic numbers
-# $Id: softquad,v 1.8 1993/02/19 14:36:43 ian Exp $
+
+#------------------------------------------------------------------------------
+# softquad: file(1) magic for SoftQuad Publishing Software
+#
+# $Id: softquad,v 1.9 1995/01/21 21:09:00 christos Exp $
# Author/Editor and RulesBuilder
#
# XXX - byte order?
+
+#------------------------------------------------------------------------------
+# sun: file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
-# releases.
-# (5.x uses ELF.)
+# releases. (5.x uses ELF.)
#
0 belong&077777777 0600413 sparc demand paged
>0 byte &0x80
-#
-# Terminfo
+
+#------------------------------------------------------------------------------
+# terminfo: file(1) magic for terminfo
#
# XXX - byte order for screen images?
#
-#
-# magic.tex:
+
+#------------------------------------------------------------------------------
+# tex: file(1) magic for TeX files
#
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
#
>16 string >\0 (%s)
0 string \367\203 TeX generic font data
0 string \367\131 TeX packed font data
->4 string >\0 (%s)
+>3 string >\0 (%s)
0 string \367\312 TeX virtual font data
0 string This\ is\ TeX, TeX transcript text
0 string This\ is\ METAFONT, METAFONT transcript text
# match most *.tfm files generated by METAFONT or afm2tfm.
2 string \000\021 TeX font metric data
2 string \000\022 TeX font metric data
->34 string >\0 (%s)
+>34 string >\0 (%s)
+
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input\ texinfo Texinfo source text
0 string This\ is\ Info\ file GNU Info text
-#
+
# correct TeX magic for Linux (and maybe more)
# from Peter Tobias (tobias@server.et-inf.fho-emden.de)
#
+
+#------------------------------------------------------------------------------
+# timezone: file(1) magic for timezone data
#
-# time zone data, from Daniel Quinlan (quinlan@yggdrasil.com)
+# from Daniel Quinlan (quinlan@yggdrasil.com)
# this will work on Linux, SunOS, and others
-27 byte 1 time zone data
-27 byte 2 time zone data
+27 byte 1 timezone data
+27 byte 2 timezone data
+# [GRR 950115: these will catch a fair number of random binary files, too...]
+
+#------------------------------------------------------------------------------
+# troff: file(1) magic for *roff
#
-# magic.troff
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
+
# troff input
0 string .\\" troff or preprocessor input text
0 string '\\" troff or preprocessor input text
>>7 string -12 (12pt)
>4 string X100 for xditview at 100dpi
>>8 string -12 (12pt)
+
# output data formats
0 string \100\357 very old (C/A/T) troff output data
-# other typesetting magic
+
+#------------------------------------------------------------------------------
+# typeset: file(1) magic for other typesetting
+#
0 string Interpress/Xerox Xerox InterPress data
>16 string / (version
>>17 string >\0 %s)
-#
-# magic.unknown: Unknown machine magic
+
+#------------------------------------------------------------------------------
+# unknown: file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
+
+#------------------------------------------------------------------------------
+# uuencoded: file(1) magic for ASCII-encoded files
+#
0 string begin uuencoded mail text
# Btoa(1) is an alternative to uuencode that requires less space.
0 string xbtoa\ Begin btoa'd text
+
+#------------------------------------------------------------------------------
+# varied.out: file(1) magic for various USG systems
+#
# Herewith many of the object file formats used by USG systems.
# Most have been moved to files for a particular processor,
# and deleted if they duplicate other entries.
-#
-# magic.pdp: VAX executable/object and APL workspace
+
+#------------------------------------------------------------------------------
+# vax: file(1) magic for VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
0 lelong 0101556 VAX double precision APL workspace
-#
-# magic.visx: Visx format file
+
+#------------------------------------------------------------------------------
+# visx: file(1) magic for Visx format files
#
0 short 0x5555 VISX image file
>2 byte 0 (zero)
-#
-# Microsoft (Xenix, not DOS)
+
+#------------------------------------------------------------------------------
+# microsoft: file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
-#
-# Zilog Z8000.
+
+#------------------------------------------------------------------------------
+# zilog: file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian? My Product Specification doesn't
# say.
+
+#------------------------------------------------------------------------------
+# zyxel: file(1) magic for ZyXEL modems
+#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
projects / file / commitdiff