#
# Alliant FX series a.out files:
+# If the FX series is the one that had a processor with a 68K-derived
+# instruction set, the "short" should probably become "beshort" and the
+# "long" should probably become "belong".
+# If it's the i860-based one, they should probably become either the
+# big-endian or little-endian versions, depending on the mode they ran
+# the 860 in....
#
0 short 0420 0420 Alliant virtual executable
>2 short &0x0020 common library
# Sound formats, from Jan Nicolai Langfeldt <janl@ifi.uio.no>
+#
+# XXX -what the hell is the "mips" stuff doing there? It looks like
+# the archive stuff from "iris"....
+#
0 string .snd audio data:
>12 long 1 8-bit u-law,
>12 long 2 8-bit linear PCM,
# 68K Blit stuff as seen from 680x0 machine
# Note that this 0407 conflicts with several other a.out formats...
+#
+# XXX - should this be redone with "be" and "le", so that it works on
+# little-endian machines as well? If so, what's the deal with
+# "VAX-order" and "VAX-order2"?
+#
#0 long 0407 68K Blit (standalone) executable
#0 short 0407 VAX-order2 68K Blit (standalone) executable
0 short 03401 VAX-order 68K Blit (standalone) executable
-# CLIPPER
-0 short 0575 CLIPPER executable (VAX #)
->20 short 0407 (writable text)
+#
+# Intergraph, formerly Fairchild, Clipper.
+#
+# XXX - what byte order does the Clipper use?
+#
+# XXX - what's the "!" stuff:
+#
+# >18 short !074000,000000 C1 R1
+# >18 short !074000,004000 C2 R1
+# >18 short !074000,010000 C3 R1
+# >18 short !074000,074000 TEST
+#
+# I shall assume it's ANDing the field with the first value and
+# comparing it with the second, and rewrite it as:
+#
+# >18 short&074000 000000 C1 R1
+# >18 short&074000 004000 C2 R1
+# >18 short&074000 010000 C3 R1
+# >18 short&074000 074000 TEST
+#
+# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
+# sort, nor does SunOS 4.x, so either it's something Intergraph added
+# in CLIX, or something AT&T added in SVR3.2 or later, or something
+# somebody else thought was a good idea; it's not documented in the
+# man page for this version of "magic", nor does it appear to be
+# implemented (at least not after I blew off the bogus code to turn
+# old-style "&"s into new-style "&"s, which just didn't work at all).
+#
+0 short 0575 CLIPPER COFF executable (VAX #)
+>20 short 0407 (impure)
>20 short 0410 (5.2 compatible)
->20 short 0411 (swapped)
->20 short 0413 (paged)
+>20 short 0411 (pure)
+>20 short 0413 (demand paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
-0 short 0577 CLIPPER executable
->18 short !074000,000000 C1 R1
->18 short !074000,004000 C2 R1
->18 short !074000,010000 C3 R1
->18 short !074000,074000 TEST
->20 short 0407 (writable text)
->20 short 0410 (swapped)
+0 short 0577 CLIPPER COFF executable
+>18 short&074000 000000 C1 R1
+>18 short&074000 004000 C2 R1
+>18 short&074000 010000 C3 R1
+>18 short&074000 074000 TEST
+>20 short 0407 (impure)
+>20 short 0410 (pure)
>20 short 0411 (separate I&D)
>20 short 0413 (paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
->48 long !01,01 alignment trap enabled
+>48 long&01 01 alignment trap enabled
>52 byte 1 -Ctnc
>52 byte 2 -Ctsw
>52 byte 3 -Ctpw
# Magic.shell: Shell Scripts
# "Commands": stuff for various shells and interpreters.
#
+# XXX - should "... script" have "text" appended to it?
+# Or is there no guarantee that the script in question is, in fact,
+# all text?
+#
0 string :\ shell archive or commands for antique kernel text
0 string #!/bin/sh Bourne Shell script
0 string #!\ /bin/sh Bourne Shell script
0 string #!\ /bin/perl perl commands text
0 string eval\ "exec\ /bin/perl perl commands text
+#
# An "antique" kernel is either unmodified early V7,
# without DMR's 1979 mod for #!, or any kernel
-# derived from a pre-v7 kernel (i.e., System V)
+# derived from a such a kernel (e.g., vanilla AT&T System V
+# prior to SVR4)
+#
+# XXX - why is this here *twice*?
+#
0 string :\ shell archive or commands for antique kernel text
-# Formats for "compress" proper have been moved into "compress.c".
#
-0 short 017037 packed data
-# CPL - added pack to /etc/magic
+# Formats for various forms of compressed data
+# Formats for "compress" proper have been moved into "compress.c",
+# because it tries to uncompress it to figure out what's inside.
+#
+# XXX - the two "packed data" versions are byte-swapped versions of
+# one another; is that because the 2-byte magic number is written
+# out in native byte order, with "unpack" figuring out the byte order
+# from the magic number (in which case both can be left as is, or
+# changed to specify a byte order *and* to indicate the byte order of
+# the packing machine), or because the old "file" didn't have any way of
+# having "magic"-file entries that specified a particular byte order?
+#
0 short 017436 packed data
+0 short 017037 packed data
+
+#
+# This magic number is byte-order-independent.
+#
+0 short 017437 old packed data
+
+#
+# XXX - why *two* entries for "compacted data", one of which is
+# byte-order independent, and one of which is byte-order dependent?
+#
+0 short 0x1fff compacted data
+0 string \377\037 compacted data
0 short 0145405 huf output
#
# Squeeze and Crunch...
+#
+# XXX - what byte order does a Convex use?
+#
0 long 0513 Convex executable
+#
# ... diamond is a multi-media mail and electronic conferencing system....
#
+# XXX - I think it was either renamed Slate, or replaced by Slate....
+#
# The full deal is too long...
#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
#
# magic.dump, dump file format. For new and old dump filesystems
#
+# No, these shouldn't specify a specific byte order, because the byte
+# order is dependent on the machine that produced the dump.
+#
24 long 60012 new-fs dump file,
>4 date x Previous dump %s,
>8 date x This dump %s,
+#
# ELF
-0 string \7fELF ELF
+# Missing MIPS image type and flags
+#
+# Question marks on processor types flag "should not happen because the
+# byte order is wrong". We have to check the byte order flag to see what
+# byte order all the other stuff in the header is in.
+#
+0 string \177ELF ELF
+>4 byte 0 invalid class
>4 byte 1 32-bit
+>4 byte 2 64-bit
+>5 byte 0 invalid byte order
>5 byte 1 LSB
+>>16 leshort 0 unknown type
+>>16 leshort 1 relocatable
+>>16 leshort 2 executable
+>>16 leshort 3 dynamic lib
+>>16 leshort 4 core file
+>>18 leshort 0 unknown machine
+>>18 leshort 1 WE32100 and up
+>>18 leshort 2 SPARC?
+>>18 leshort 3 i386 (386 and up)
+>>18 leshort 4 M68000?
+>>18 leshort 5 M88000?
+>>18 leshort 7 i860
+>>20 lelong 1 Version 1
+>>36 lelong 1 MathCoPro/FPU/MAU Required
>5 byte 2 MSB
->16 short 0 unknown type
->16 short 1 relocatable
->16 short 2 executable
->16 short 3 dynamic lib
->16 short 4 core file
->18 short 0 unknown machine
->18 short 1 WE32100
->18 short 2 SPARC
->18 short 3 80386
->18 short 4 M68000
->18 short 5 M88000
->20 long 1 Version 1
->36 long 1 MathCoPro/FPU/MAU Required
+>>16 beshort 0 unknown type
+>>16 beshort 1 relocatable
+>>16 beshort 2 executable
+>>16 beshort 3 dynamic lib
+>>16 beshort 4 core file
+>>18 beshort 0 unknown machine
+>>18 beshort 1 WE32100 and up
+>>18 beshort 2 SPARC
+>>18 beshort 3 i386 (386 and up)?
+>>18 beshort 4 M68000
+>>18 beshort 5 M88000
+>>18 beshort 7 i860
+>>20 belong 1 Version 1
+>>36 belong 1 MathCoPro/FPU/MAU Required
+
#
# magic.encore: Recognize encore machines
#
+# XXX - needs to have the byte order specified (NS32K was little-endian,
+# dunno whether they run the 88K in little-endian mode or not).
+#
0 short 0x154 Encore
>20 short 0x107 executable
>20 short 0x108 pure executable
#
# magic.hp: Hewlett Packard Magic
#
+# XXX - somebody should figure out whether any byte order needs to be
+# applied to the "TML" stuff; I'm assuming the Apollo stuff is
+# big-endian as it was mostly 68K-based.
+#
+# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I
+# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first
+# showed up in the 700 series, although later 800 series machines are,
+# I think, based on the PA7100 which implements HP-PA 1.1) are flagged
+# as big-endian.
+#
+# I think the 500 series was the old stack-based machines, running a
+# UNIX environment atop the "SUN kernel"; dunno whether it was
+# big-endian or little-endian.
+#
+# I'm guessing that the 200 series was 68K-based; the 300 and 400 series
+# are.
+#
+# The "misc" stuff needs a byte order; the archives look suspiciously
+# like the old 177545 archives (0xff65 = 0177545).
+#
#### Old Apollo stuff
-0 short 0627 Apollo m68k COFF executable
->18 short ^040000 not stripped
->22 short >0 - version %ld
-0 short 0624 apollo a88k COFF executable
->18 short ^040000 not stripped
->22 short >0 - version %ld
+0 beshort 0627 Apollo m68k COFF executable
+>18 beshort ^040000 not stripped
+>22 beshort >0 - version %ld
+0 beshort 0624 apollo a88k COFF executable
+>18 beshort ^040000 not stripped
+>22 beshort >0 - version %ld
0 long 01203604016 TML 0123 byte-order format
0 long 01702407010 TML 1032 byte-order format
0 long 01003405017 TML 2301 byte-order format
0 long 01602007412 TML 3210 byte-order format
#### HPPA
-0 long 0x02100106 HPPA-RISC1.1 relocatable object
-0 long 0x02100107 HPPA-RISC1.1 executable
->(144) long 0x054ef630 dynamically linked
->96 long >0 -not stripped
+0 belong 0x02100106 HPPA-RISC1.1 relocatable object
+0 belong 0x02100107 HPPA-RISC1.1 executable
+>(144) belong 0x054ef630 dynamically linked
+>96 belong >0 -not stripped
-0 long 0x02100108 HPPA-RISC1.1 shared executable
->(144) long 0x054ef630 dynamically linked
->96 long >0 -not stripped
+0 belong 0x02100108 HPPA-RISC1.1 shared executable
+>(144) belong 0x054ef630 dynamically linked
+>96 belong >0 -not stripped
-0 long 0x0210010b HPPA-RISC1.1 demand-load executable
->(144) long 0x054ef630 dynamically linked
->96 long >0 -not stripped
+0 belong 0x0210010b HPPA-RISC1.1 demand-load executable
+>(144) belong 0x054ef630 dynamically linked
+>96 belong >0 -not stripped
-0 long 0x0210010e HPPA-RISC1.1 shared library
->96 long >0 -not stripped
+0 belong 0x0210010e HPPA-RISC1.1 shared library
+>96 belong >0 -not stripped
-0 long 0x0210010d HPPA-RISC1.1 dynamic load library
->96 long >0 -not stripped
+0 belong 0x0210010d HPPA-RISC1.1 dynamic load library
+>96 belong >0 -not stripped
#### 800
-0 long 0x020b0106 HP s800 relocatable object
+0 belong 0x020b0106 HP s800 relocatable object
-0 long 0x020b0107 HP s800 executable
->(144) long 0x054ef630 dynamically linked
->96 long >0 -not stripped
+0 belong 0x020b0107 HP s800 executable
+>(144) belong 0x054ef630 dynamically linked
+>96 belong >0 -not stripped
-0 long 0x020b0108 HP s800 shared executable
->(144) long 0x054ef630 dynamically linked
->96 long >0 -not stripped
+0 belong 0x020b0108 HP s800 shared executable
+>(144) belong 0x054ef630 dynamically linked
+>96 belong >0 -not stripped
-0 long 0x020b010b HP s800 demand-load executable
->(144) long 0x054ef630 dynamically linked
->96 long >0 -not stripped
+0 belong 0x020b010b HP s800 demand-load executable
+>(144) belong 0x054ef630 dynamically linked
+>96 belong >0 -not stripped
-0 long 0x020b010e HP s800 shared library
->96 long >0 -not stripped
+0 belong 0x020b010e HP s800 shared library
+>96 belong >0 -not stripped
-0 long 0x020b010d HP s800 dynamic load library
->96 long >0 -not stripped
+0 belong 0x020b010d HP s800 dynamic load library
+>96 belong >0 -not stripped
-0 long 0x213c6172 archive file
->68 long 0x020b0619 -HP s800 relocatable library
+0 belong 0x213c6172 archive file
+>68 belong 0x020b0619 -HP s800 relocatable library
#### 500
0 long 0x02080106 HP s500 relocatable executable
>16 long >0 -version %ld
#### 200
-0 long 0x020c0108 HP s200 pure executable
->4 short >0 -version %ld
->8 long &0x80000000 save fp regs
->8 long &0x40000000 dynamically linked
->8 long &0x20000000 debuggable
->36 long >0 not stripped
-
-0 long 0x020c0107 HP s200 executable
->4 short >0 -version %ld
->8 long &0x80000000 save fp regs
->8 long &0x40000000 dynamically linked
->8 long &0x20000000 debuggable
->36 long >0 not stripped
-
-0 long 0x020c010b HP s200 demand-load executable
->4 short >0 -version %ld
->8 long &0x80000000 save fp regs
->8 long &0x40000000 dynamically linked
->8 long &0x20000000 debuggable
->36 long >0 not stripped
-
-0 long 0x020c0106 HP s200 relocatable executable
->4 short >0 -version %ld
->6 short >0 -highwater %d
->8 long &0x80000000 save fp regs
->8 long &0x20000000 debuggable
->8 long &0x10000000 PIC
-
-0 long 0x020a0108 HP s200 (2.x release) pure executable
->4 short >0 -version %ld
->36 long >0 not stripped
-
-0 long 0x020a0107 HP s200 (2.x release) executable
->4 short >0 -version %ld
->36 long >0 not stripped
-
-0 long 0x020c010e HP s200 shared library
->4 short >0 -version %ld
->6 short >0 -highwater %d
->36 long >0 not stripped
-
-0 long 0x020c010d HP s200 dynamic load library
->4 short >0 -version %ld
->6 short >0 -highwater %d
->36 long >0 not stripped
+0 belong 0x020c0108 HP s200 pure executable
+>4 beshort >0 -version %ld
+>8 belong &0x80000000 save fp regs
+>8 belong &0x40000000 dynamically linked
+>8 belong &0x20000000 debuggable
+>36 belong >0 not stripped
+
+0 belong 0x020c0107 HP s200 executable
+>4 beshort >0 -version %ld
+>8 belong &0x80000000 save fp regs
+>8 belong &0x40000000 dynamically linked
+>8 belong &0x20000000 debuggable
+>36 belong >0 not stripped
+
+0 belong 0x020c010b HP s200 demand-load executable
+>4 beshort >0 -version %ld
+>8 belong &0x80000000 save fp regs
+>8 belong &0x40000000 dynamically linked
+>8 belong &0x20000000 debuggable
+>36 belong >0 not stripped
+
+0 belong 0x020c0106 HP s200 relocatable executable
+>4 beshort >0 -version %ld
+>6 beshort >0 -highwater %d
+>8 belong &0x80000000 save fp regs
+>8 belong &0x20000000 debuggable
+>8 belong &0x10000000 PIC
+
+0 belong 0x020a0108 HP s200 (2.x release) pure executable
+>4 beshort >0 -version %ld
+>36 belong >0 not stripped
+
+0 belong 0x020a0107 HP s200 (2.x release) executable
+>4 beshort >0 -version %ld
+>36 belong >0 not stripped
+
+0 belong 0x020c010e HP s200 shared library
+>4 beshort >0 -version %ld
+>6 beshort >0 -highwater %d
+>36 belong >0 not stripped
+
+0 belong 0x020c010d HP s200 dynamic load library
+>4 beshort >0 -version %ld
+>6 beshort >0 -highwater %d
+>36 belong >0 not stripped
#### MISC
0 long 0x0000ff65 HP old archive
#
-# magic.ibm370:
+# IBM 370 and compatibles.
#
-0 short 0x15d ibm 370 pure executable
->12 long >0 not stripped
+# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
+# What the heck *is* "USS/370"?
+#
+0 beshort 0531 SVR2 executable (Amdahl-UTS)
+>12 belong >0 not stripped
+>24 belong >0 - version %ld
+0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
+>12 belong >0 not stripped
+>24 belong >0 - version %ld
+0 beshort 0530 SVR2 pure executable (USS/370)
+>12 belong >0 not stripped
+>24 belong >0 - version %ld
+0 beshort 0535 SVR2 executable (USS/370)
+>12 belong >0 not stripped
+>24 belong >0 - version %ld
+
+#
# magic.rs6000:
-0 short 0x01df executable (RISC System/6000 V3.1) or obj module
->12 long >0 not stripped
+#
+# RS/6000 and the RT PC.
+#
+0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
+>12 belong >0 not stripped
# Breaks sun4 statically linked execs.
-#0 short 0x0103 executable (RT Version 2) or obj module
+#0 beshort 0x0103 executable (RT Version 2) or obj module
#>2 byte 0x50 pure
-#>28 long >0 not stripped
-#>6 short >0 - version %ld
-0 short 0x0104 shared library
-0 short 0x0105 ctab data
-0 short 0xfe04 structured file
+#>28 belong >0 not stripped
+#>6 beshort >0 - version %ld
+0 beshort 0x0104 shared library
+0 beshort 0x0105 ctab data
+0 beshort 0xfe04 structured file
0 string 0xabcdef message catalog
#0 string <aiaff> archive
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
+# XXX - byte order for GIF and TIFF fields?
+#
0 string xbtoa btoa'd file
# magic for InterLeaf TPS:
0 string =\210OPS Interleaf saved data
0 string =<!OPS Interleaf document text
+>5 string ,\ Version\ (version
+>>14 string >\0 %s)
+
#
# magic.ispell
#
+# XXX - byte order?
+#
0 short 0xffff9601 ispell hash file
>2 short 0x00 - 8-bit, no capitalization, 26 flags
>2 short 0x01 - 7-bit, no capitalization, 26 flags
#
# magic.lif:
#
+# XXX - byte order?
+#
0 short 0x8000 lif file
+#
+# XXX - byte order?
+#
0 long 31415 Mirage Assembler m.out executable
+#
# ID is the binary tags database produced by mkid(1).
+#
+# XXX - byte order?
+#
0 string \311\304 ID tags data
>2 short >0 version %d
+#
# Motorola
-0 short 0520 mc68k executable
->12 long >0 not stripped
-0 short 0521 mc68k executable (shared)
->12 long >0 not stripped
-0 short 0522 mc68k executable (shared demand paged)
->12 long >0 not stripped
-
+#
+# 68K
+#
+0 beshort 0520 mc68k COFF
+>18 beshort ^00000020 object
+>18 beshort &00000020 executable
+>12 belong >0 not stripped
+>168 string .lowmem Apple toolbox
+>20 beshort 0407 (impure)
+>20 beshort 0410 (pure)
+>20 beshort 0413 (demand paged)
+>20 beshort 0421 (standalone)
+0 beshort 0521 mc68k executable (shared)
+>12 belong >0 not stripped
+0 beshort 0522 mc68k executable (shared demand paged)
+>12 belong >0 not stripped
+#
+# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
+#
+0 beshort 0554 68K BCS executable
+#
+# 88K
+#
+# Motorola/88Open BCS
+#
+0 beshort 0555 88K BCS executable
-# various intel-CPU magic numbers
-0 short 01006 80286 executable (STL)
->31 byte <0x040 small model
->31 byte =0x048 large model
->31 byte =0x049 huge model
->16 long >0 not stripped
+#
+# Various MS-DOS magic numbers
+#
0 string MZ DOS executable (EXE)
0 string LZ DOS executable (built-in)
0 byte 0xe9 DOS executable (COM)
0 byte 0xeb DOS executable (COM)
0 byte 0xf0 MS-DOS program library
-0 short =0512 80286 executable small model (COFF)
->12 long >0 not stripped
->22 short >0 - version %ld
-0 short =0522 80286 executable large model (COFF)
->12 long >0 not stripped
->22 short >0 - version %ld
-0 short =0514 80386 executable
->12 long >0 not stripped
->22 short >0 - version %ld
-0 string PK zip archive file
->2 byte >0 - version [%d
->3 byte >0 %d]
# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
#
-0 short 000610 Tower/XP rel 2 object
->12 long >0 not stripped
->20 short 0407 executable
->20 short 0410 pure executable
->22 short >0 -version %ld
-0 short 000615 Tower/XP rel 2 object
->12 long >0 not stripped
->20 short 0407 executable
->20 short 0410 pure executable
->22 short >0 -version %ld
-0 short 000620 Tower/XP rel 3 object
->12 long >0 not stripped
->20 short 0407 executable
->20 short 0410 pure executable
->22 short >0 -version %ld
-0 short 000625 Tower/XP rel 3 object
->12 long >0 not stripped
->20 short 0407 executable
->20 short 0410 pure executable
->22 short >0 -version %ld
-0 short 000630 Tower32/600/400 68020 object
->12 long >0 not stripped
->20 short 0407 executable
->20 short 0410 pure executable
->22 short >0 -version %ld
-0 short 000640 Tower32/800 68020
->18 short &020000 w/68881 object
->18 short &040000 compatible object
->18 short &~060000 object
->20 short 0407 executable
->20 short 0413 pure executable
->12 long >0 not stripped
->22 short >0 -version %ld
-0 short 000645 Tower32/800 68010
->18 short &040000 compatible object
->18 short &~060000 object
->20 short 0407 executable
->20 short 0413 pure executable
->12 long >0 not stripped
->22 short >0 -version %ld
+0 beshort 000610 Tower/XP rel 2 object
+>12 belong >0 not stripped
+>20 beshort 0407 executable
+>20 beshort 0410 pure executable
+>22 beshort >0 - version %ld
+0 beshort 000615 Tower/XP rel 2 object
+>12 belong >0 not stripped
+>20 beshort 0407 executable
+>20 beshort 0410 pure executable
+>22 beshort >0 - version %ld
+0 beshort 000620 Tower/XP rel 3 object
+>12 belong >0 not stripped
+>20 beshort 0407 executable
+>20 beshort 0410 pure executable
+>22 beshort >0 - version %ld
+0 beshort 000625 Tower/XP rel 3 object
+>12 belong >0 not stripped
+>20 beshort 0407 executable
+>20 beshort 0410 pure executable
+>22 beshort >0 - version %ld
+0 beshort 000630 Tower32/600/400 68020 object
+>12 belong >0 not stripped
+>20 beshort 0407 executable
+>20 beshort 0410 pure executable
+>22 beshort >0 - version %ld
+0 beshort 000640 Tower32/800 68020
+>18 beshort &020000 w/68881 object
+>18 beshort &040000 compatible object
+>18 beshort &~060000 object
+>20 beshort 0407 executable
+>20 beshort 0413 pure executable
+>12 belong >0 not stripped
+>22 beshort >0 - version %ld
+0 beshort 000645 Tower32/800 68010
+>18 beshort &040000 compatible object
+>18 beshort &~060000 object
+>20 beshort 0407 executable
+>20 beshort 0413 pure executable
+>12 belong >0 not stripped
+>22 beshort >0 - version %ld
#
# "ar", for all kinds of archives.
+#
+# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
+# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
+#
+# 0 string !<arch> current ar archive
+# 0 long 0x213c6172 archive file
+#
+# and for SVR3.1 archives, we have:
+#
+# 0 string \<ar> System V Release 1 ar archive
+# 0 string =<ar> archive
+# 0 string =<ar> archive
+#
+# XXX - did Aegis really store shared libraries, breakpointed modules,
+# and absolute code program modules in the same format as new-style
+# "ar" archives?
+#
0 string !<arch> current ar archive
>8 string __.SYMDEF random library
->0 long =65538 - pre SR9.5
->0 long =65539 - post SR9.5
->0 short 2 - object archive
->0 short 3 - shared library module
->0 short 4 - debug break-pointed module
->0 short 5 - absolute code program module
+>0 belong =65538 - pre SR9.5
+>0 belong =65539 - post SR9.5
+>0 beshort 2 - object archive
+>0 beshort 3 - shared library module
+>0 beshort 4 - debug break-pointed module
+>0 beshort 5 - absolute code program module
0 string \<ar> System V Release 1 ar archive
0 string =<ar> archive
-0 long 0xff6d obsolete ar archive
+#
+# XXX - from "vax", which appears to collect a bunch of byte-swapped
+# thingies, to help you recognize VAX files on big-endian machines;
+# with "leshort", "lelong", and "string", that's no longer necessary....
+#
+# 0 long 0x3c61723e VAX 5.0 archive
+#
0 long 0x213c6172 archive file
-0 long 0177555 very old archive
-0 short 0177555 very old PDP-11 archive
-0 long 0177545 old archive
-0 short 0177545 old PDP-11 archive
+0 lelong 0177555 very old VAX archive
+0 leshort 0177555 very old PDP-11 archive
+#
+# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
+# be a random library (it said 0xff65 rather than 0177545).
+#
+0 lelong 0177545 old VAX archive
+>8 string __.SYMDEF random library
+0 leshort 0177545 old PDP-11 archive
+>8 string __.SYMDEF random library
+#
0 string =<ar> archive
+#
+# From "pdp":
+#
+0 lelong 0x39bed PDP-11 old archive
+0 lelong 0x39bee PDP-11 4.0 archive
+#
0 string -h- Software Tools format archive text
# "arc" archiver
0 byte 26 'arc' archive
>1 byte 1 (old format)
# Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu.
20 long 0xdca7c4fd Rahul Dhesi's "zoo" archive
+# ZIP archiver
+0 string PK zip archive file
+>2 byte >0 - version [%d
+>3 byte >0 %d]
#
# magic.iris: Magic for mips from an iris4d
#
+# Dunno what byte-order munging is needed; all of SGI's *current*
+# machines and OSes run in big-endian mode on the MIPS machines,
+# as far as I know, but they do have the MIPSEB and MIPSEL stuff
+# here....
+#
0 short 0x0160 mipseb
>20 short 0407 executable
>20 short 0410 pure
+#
# RISC MIPS decstation
+# Should this be "leshort", given that DEC ran the DECstations in
+# little-endian mode?
+#
+# Where is the non-SGI, non-DEC MIPS stuff?
+#
0 short 0x6201 MIPS executable
#
# magic.postscript: Magic for postscript files
#
+# XXX - should we match only versions 1.0 and 2.0, or should we wildcard
+# it?
+#
0 string %! PostScript document
>2 string PS-Adobe- conforming
->11 string 1.0 at level %s
->11 string 2.0 at level %s
+>>11 string 1.0 at level %s
+>>11 string 2.0 at level %s
+#
# Sun rasterfiles
+#
+# XXX - byte order? What about the 386i?
+#
0 string \x59\xa6\x6a\x95 rasterfile
>4 long >0 %d
>8 long >0 x %d
#
# magic.x11
#
+# I think this is byte-order-dependent; if so, it should become:
+#
+# 0 belong 00000004 X11 big-endian snf font
+# 0 lelong 00000004 X11 little-endian snf font
+#
0 long 00000004 X11 snf font
+#
+# XXX - byte order?
+#
0 short 0x2a17 "compact bitmap" format (Poskanzer)
#
-# magic.pdp: PDP 11
+# magic.pdp: PDP-11 executable/object and APL workspace
#
-0 long 0x39bed PDP-11 old archive
-0 long 0x39bee PDP-11 4.0 archive
-0 long 0x836c PDP-11 double precision APL workspace
-0 long 0x836d PDP-11 single precision APL workspace
+0 lelong 0101555 PDP-11 single precision APL workspace
+0 lelong 0101554 PDP-11 double precision APL workspace
-0 short 0177555 very old PDP-11 archive
-0 short 0177545 old PDP-11 archive
-
-0 short 0407 PDP-11 executable
->8 short >0 not stripped
-
-0 short 0401 PDP-11 unix-rt ldp
-0 short 0405 PDP-11 old overlay
-
-0 short 0410 PDP-11 pure executable
->8 short >0 not stripped
-#>2 short >0 - version %ld
+#
+# PDP-11 a.out
+#
+0 leshort 0407 PDP-11 executable
+>8 leshort >0 not stripped
-0 short 0411 PDP-11 separate I&D executable
->8 short >0 not stripped
-#>2 short >0 - version %ld
+0 leshort 0401 PDP-11 UNIX/RT ldp
+0 leshort 0405 PDP-11 old overlay
-0 long 0413 PDP-11 demand paged pure executable
->16 long >0 not stripped
-#>2 short >0 - version %ld
+0 leshort 0410 PDP-11 pure executable
+>8 leshort >0 not stripped
-0 long 0420 PDP-11 demand paged (first page unmapped) pure executable
->16 long >0 not stripped
-#>2 short >0 - version %ld
-0 short 0437 PDP-11 kernel overlay
+0 leshort 0411 PDP-11 separate I&D executable
+>8 leshort >0 not stripped
-0 short 0xff65 PDP-11/pre System V/old Sun ar archive
->8 string __.SYMDEF random library
+0 leshort 0437 PDP-11 kernel overlay
+#
#/etc/magic entries for Plus Five's UNIX MUMPS
+#
+# XXX - byte order? Paging Hokey....
+#
0 short 0x259 mumps avl global
>2 byte >0 (V%d)
>6 byte >0 with %d byte name
#
# magic.pyramid: Magic for pyramids
#
+# XXX - byte order?
+#
0 long 0x50900107 Pyramid 90x family executable
0 long 0x50900108 Pyramid 90x family pure executable
>16 long >0 not stripped
#
# magic.sendmail:
#
+# XXX - byte order?
+#
0 byte 046 Sendmail frozen configuration
>16 string >\0 - version %s
0 short 0x271c Sendmail frozen configuration
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
-0 short 0x00ea BALANCE NS32000 .o
-0 short 0x10ea BALANCE NS32000 executable (0 @ 0)
->16 long >0 not stripped
-0 short 0x20ea BALANCE NS32000 executable (invalid @ 0)
->16 long >0 not stripped
-0 short 0x30ea BALANCE NS32000 standalone executable
->16 long >0 not stripped
-# The above seen byte-swapped, e.g. from a remote NFS mount
-0 short 0xea00 BALANCE NS32000 .o (byte-swapped)
-0 short 0xea10 BALANCE NS32000 executable (0 @ 0, byte-swapped)
->16 long >0 not stripped
-0 short 0xea20 BALANCE NS32000 executable (invalid @ 0, byte-swapped)
->16 long >0 not stripped
-0 short 0xea30 BALANCE NS32000 standalone executable (byte-swapped)
->16 long >0 not stripped
+0 leshort 0x00ea BALANCE NS32000 .o
+0 leshort 0x10ea BALANCE NS32000 executable (0 @ 0)
+>16 lelong >0 not stripped
+0 leshort 0x20ea BALANCE NS32000 executable (invalid @ 0)
+>16 lelong >0 not stripped
+0 leshort 0x30ea BALANCE NS32000 standalone executable
+>16 lelong >0 not stripped
# Also need info on Sequent "Symmetry" series...
# SoftQuad Publishing Software magic numbers
-# $Id: softquad,v 1.7 1993/01/05 12:51:54 ian Exp $
+# $Id: softquad,v 1.8 1993/02/19 14:36:43 ian Exp $
# Author/Editor and RulesBuilder
+#
+# XXX - byte order?
+#
0 string \<!SQ\ DTD> Compiled SGML rules file
>9 string >\0 Type %s
0 string \<!SQ\ A/E> A/E SGML Document binary
-# Values for big-endian Sun (MC680x0, SPARC) binaries
-1 byte 3 SPARC
->0 byte &0x80 dynamically linked
->2 short 0407 executable
->2 short 0410 pure executable
->2 short 0413 demand paged executable
->16 long >0 not stripped
-1 byte 2 mc68020
->0 byte &0x80 dynamically linked
->2 short 0407 executable
->2 short 0410 pure executable
->2 short 0413 demand paged executable
->16 long >0 not stripped
-1 byte 1 mc68010
->0 byte &0x80 dynamically linked
->2 short 0407 executable
->2 short 0410 pure executable
->2 short 0413 demand paged executable
->16 long >0 not stripped
+#
+# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
+# releases.
+# (5.x uses ELF.)
+#
+0 belong&0777777 0600413 sparc demand paged
+>0 byte &0x80
+>>20 belong <4096 shared library
+>>20 belong =4096 dynamically linked executable
+>>20 belong >4096 dynamically linked executable
+>16 belong >0 not stripped
+0 belong&0777777 0600410 sparc pure
+>0 byte &0x80 dynamically linked executable
+>0 byte ^0x80 executable
+>16 belong >0 not stripped
+0 belong&0777777 0600407 sparc
+>0 byte &0x80 dynamically linked executable
+>0 byte ^0x80 executable
+>16 belong >0 not stripped
+
+0 belong&0777777 0400413 mc68020 demand paged
+>0 byte &0x80
+>>20 belong <4096 shared library
+>>20 belong =4096 dynamically linked executable
+>>20 belong >4096 dynamically linked executable
+>16 belong >0 not stripped
+0 belong&0777777 0400410 mc68020 pure
+>0 byte &0x80 dynamically linked executable
+>0 byte ^0x80 executable
+>16 belong >0 not stripped
+0 belong&0777777 0400407 mc68020
+>0 byte &0x80 dynamically linked executable
+>0 byte ^0x80 executable
+>16 belong >0 not stripped
+
+0 belong&0777777 0200413 mc68010 demand paged
+>0 byte &0x80
+>>20 belong <4096 shared library
+>>20 belong =4096 dynamically linked executable
+>>20 belong >4096 dynamically linked executable
+>16 belong >0 not stripped
+0 belong&0777777 0200410 mc68010 pure
+>0 byte &0x80 dynamically linked executable
+>0 byte ^0x80 executable
+>16 belong >0 not stripped
+0 belong&0777777 0200407 mc68010
+>0 byte &0x80 dynamically linked executable
+>0 byte ^0x80 executable
+>16 belong >0 not stripped
+
# reworked these to avoid anything beginning with zero becoming "old sun-2"
-0 long 0407 old sun-2 executable
->16 long >0 not stripped
-0 long 0410 old sun-2 pure executable
->16 long >0 not stripped
-0 long 0413 old sun-2 demand paged executable
->16 long >0 not stripped
+0 belong 0407 old sun-2 executable
+>16 belong >0 not stripped
+0 belong 0410 old sun-2 pure executable
+>16 belong >0 not stripped
+0 belong 0413 old sun-2 demand paged executable
+>16 belong >0 not stripped
+
#
-0 long 0x080456 core file
->128 string >0 from '%s'
+# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
+# binary executed in compatibility mode under SunOS 5.x".
#
-0 short 05401 byte-swapped demand paged executable
-0 short 010001 byte-swapped demand paged executable
+0 belong 0x080456 SunOS core file
+>4 belong 432 (SPARC)
+>>132 string >\0 from '%s'
+>4 belong 826 (68K)
+>>128 string >\0 from '%s'
+>4 belong 456 (SPARC 4.x BCP)
+>>152 string >\0 from '%s'
+#
# Terminfo
+#
+# XXX - byte order for screen images?
+#
0 string \032\001 Compiled terminfo entry
0 short 0433 Curses screen image
0 short 0434 Curses screen image
#
# magic.tex:
#
+# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
+#
0 short 0173402 DVI File
>16 string >\0 (%s)
0 short 0173531 Packed TeX Font
# other typesetting magic
0 string \100\357 very old (C/A/T) troff output data
0 string Interpress/Xerox Xerox InterPress data
+>16 string / (version
+>>17 string >\0 %s)
#
# magic.unknown: Unknown machine magic
#
+# XXX - this probably should be pruned, as it'll match PDP-11 and
+# VAX image formats.
+#
+# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
+# respectively).
+#
+# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
+# have the "version %ld", which may be a bogus COFFism (I don't think
+# there ever was COFF for the PDP-11).
+#
+# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
+# long, as it would be on a VAX.
+#
+# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown.
+#
0 short 0x107 unknown machine executable
>8 short >0 not stripped
>15 byte >0 - version %ld
# Herewith many of the object file formats used by USG systems.
-# The `versions' should be un-commented if they work for you.
-0 short 0570 SysV executable
->12 long >0 not stripped
-#>22 short >0 - version %ld
-0 short 0575 SysV pure executable
->12 long >0 not stripped
-#>22 short >0 - version %ld
-0 short 0502 basic-16 executable
->12 long >0 not stripped
-0 short 0503 basic-16 executable (TV)
->12 long >0 not stripped
-0 short 0510 x86 executable
->12 long >0 not stripped
-0 short 0511 x86 executable (TV)
->12 long >0 not stripped
-0 short 0550 3b20 executable
->12 long >0 not stripped
-0 short 0551 3b20 executable (TV)
->12 long >0 not stripped
-0 short 0560 WE32000 executable
->12 long >0 not stripped
->18 short ^00010000 - N/A on 3b2/300 w/paging
->18 short &00020000 - 32100 required
->18 short &00040000 and mau hardware required
->20 short 0443 (target shared library)
->20 short 0410 (swapped)
->20 short 0413 (paged)
->22 short >0 - version %ld
-0 short 0561 WE32000 executable (TV)
->12 long >0 not stripped
+# Most have been moved to files for a particular processor,
+# and deleted if they duplicate other entries.
#
0 short 0610 Perkin-Elmer executable
-#
-# Motorola/UniSoft Application Binary Interface (ABI)
-0 short 0554 68K BCS executable
-# Motorola/88Open ABI
-0 short 0555 88K BCS executable
#
-# magic.vax: Vax magic...
+# magic.pdp: VAX executable/object and APL workspace
#
-0 long 0x3c61723e VAX 5.0 archive
-0 long 0x65ff0000 VAX 3.0 archive
-0 long 0x836e VAX double precision APL workspace
-0 long 0x836f VAX single precision APL workspace
-0 short 0x178 vax executable
-0 short 0x17d vax pure executable
-# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
-# From: dupuy@amsterdam.columbia.edu (Alexander Dupuy)
-# Byte-swapped VAXen
-# Here are a few lines you can add to /etc/magic on your sun workstations in
-# order to recognize VAX executables and objects.... you could do something
-# similar (in reverse) for your vaxen, but since 4.3+NFS' file(1) doesn't look
-# for /etc/magic, I've never bothered. It really should be built in to file(1)
-# so you would see the state of setuid/setgid/sticky bits. Or actually, there
-# should be support for checking that sort of thing in /etc/magic.
+0 lelong 0101557 VAX single precision APL workspace
+0 lelong 0101556 VAX double precision APL workspace
+
#
-0 long 00700200000 VAX executable
->16 long &0x7fffffff not stripped
-0 long 01000200000 VAX pure executable
->16 long &0x7fffffff not stripped
-0 long 01300200000 VAX demand-paged pure executable
->16 long &0x7fffffff not stripped
-0 long 0101557 VAX single precision APL workspace
-0 long 0101556 VAX double precision APL workspace
+# VAX a.out (32V, BSD)
+#
+0 lelong 0407 VAX executable
+>16 lelong >0 not stripped
+
+0 lelong 0410 VAX pure executable
+>16 lelong >0 not stripped
+
+0 lelong 0413 VAX demand paged pure executable
+>16 lelong >0 not stripped
+
+0 lelong 0420 VAX demand paged (first page unmapped) pure executable
+>16 lelong >0 not stripped
+
+#
+# VAX COFF
+#
+# The `versions' should be un-commented if they work for you.
+# (Was the problem just one of endianness?)
+#
+0 leshort 0570 VAX COFF executable
+>12 lelong >0 not stripped
+#>22 leshort >0 - version %ld
+0 leshort 0575 VAX COFF pure executable
+>12 lelong >0 not stripped
+#>22 leshort >0 - version %ld
-# Microsoft
+#
+# Microsoft (Xenix, not DOS)
+#
+# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
+# model" lifted from "magic.xenix", with comment "derived empirically;
+# treat as folklore until proven"
+#
+# "small model", "large model", "huge model" stuff lifted from XXX
+#
+# XXX - "x.out" collides with PDP-11 archives....
+#
0 string core core file (Xenix)
0 byte 0x80 8086 relocatable (Microsoft)
-0 byte 0xf0 MS-DOS library
-0 short 0xff65 x.out
+0 leshort 0xff65 x.out
>2 string __.SYMDEF randomized
>0 byte x archive
-0 short 0x206 Microsoft a.out
->0x1e short &0x10 overlay
->0x1e short &0x2 separate
->0x1e short &0x4 pure
->0x1e short &0x800 segmented
->0x1e short &0x400 standalone
->0x1e short &0x8 fixed-stack
+0 leshort 0x206 Microsoft a.out
+>8 leshort 1 Middle model
+>0x1e leshort &0x10 overlay
+>0x1e leshort &0x2 separate
+>0x1e leshort &0x4 pure
+>0x1e leshort &0x800 segmented
+>0x1e leshort &0x400 standalone
+>0x1e leshort &0x8 fixed-stack
>0x1c byte &0x80 byte-swapped
>0x1c byte &0x40 word-swapped
->0x10 long >0 not-stripped
->0x1e short ^0xc000 pre-SysV
+>0x10 lelong >0 not-stripped
+>0x1e leshort ^0xc000 pre-SysV
>0x1c byte &0x4 86
>0x1c byte &0x9 286
>0x1c byte &0xa 386
->0x1e short &0x1 executable
->0x1e short ^0x1 object file
->0x1e short &0x40 Large Text
->0x1e short &0x20 Large Data
->0x1e short &0x120 Huge Objects Enabled
+>0x1f byte <0x040 small model
+>0x1f byte =0x048 large model
+>0x1f byte =0x049 huge model
+>0x1e leshort &0x1 executable
+>0x1e leshort ^0x1 object file
+>0x1e leshort &0x40 Large Text
+>0x1e leshort &0x20 Large Data
+>0x1e leshort &0x120 Huge Objects Enabled
+>0x10 lelong >0 not stripped
-0 short 0x140 old Microsoft 8086 x.out
+0 leshort 0x140 old Microsoft 8086 x.out
>0x3 byte &0x4 separate
>0x3 byte &0x2 pure
>0 byte &0x1 executable
>0 byte ^0x1 relocatable
->0x14 long >0 not stripped
+>0x14 lelong >0 not stripped
-0 long 0x206 b.out
->0x1e short &0x10 overlay
->0x1e short &0x2 separate
->0x1e short &0x4 pure
->0x1e short &0x800 segmented
->0x1e short &0x400 standalone
->0x1e short &0x1 executable
->0x1e short ^0x1 object file
->0x1e short &0x4000 V2.3
->0x1e short &0x8000 V3.0
+0 lelong 0x206 b.out
+>0x1e leshort &0x10 overlay
+>0x1e leshort &0x2 separate
+>0x1e leshort &0x4 pure
+>0x1e leshort &0x800 segmented
+>0x1e leshort &0x400 standalone
+>0x1e leshort &0x1 executable
+>0x1e leshort ^0x1 object file
+>0x1e leshort &0x4000 V2.3
+>0x1e leshort &0x8000 V3.0
>0x1c byte &0x4 86
>0x1c byte &0xb 186
>0x1c byte &0x9 286
>0x1c byte &0x29 286
>0x1c byte &0xa 386
->0x1e short &0x4 Large Text
->0x1e short &0x2 Large Data
->0x1e short &0x102 Huge Objects Enabled
+>0x1e leshort &0x4 Large Text
+>0x1e leshort &0x2 Large Data
+>0x1e leshort &0x102 Huge Objects Enabled
+0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
-# Zilog
+#
+# Zilog Z8000.
+#
+# Was it big-endian or little-endian? My Product Specification doesn't
+# say.
+#
0 long 0xe807 object file (z8000 a.out)
0 long 0xe808 pure object file (z8000 a.out)
0 long 0xe809 separate object file (z8000 a.out)
projects / file / commitdiff