#! file
# Magic data for file(1) command.
-# Machine-genererated from src/cmd/file/magdir/*; edit there only!
+# Machine-generated from src/cmd/file/magdir/*; edit there only!
# Format is described in magic(files), where:
-# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.
+# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID.
>26 byte x \b.%d
>28 byte x \b-%d
-# Basic recognition of OSF/1 core dumps - Mike Bremford <mike@opac.bl.uk>
+# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
-0 string Core\001 COFF format core dump (OSF/1)
->24 string >\0 generated by '%s'
+0 string Core\001 Alpha COFF format core dump (Digital UNIX)
+>24 string >\0 \b, from '%s'
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
# MPEG animation format
-0 string \000\000\001\263 MPEG file
+0 belong 0x000001b3 MPEG video stream data
+#>4 beshort&0xfff0 x (%d x
+#>5 beshort&0x0fff x %d)
+0 belong 0x000001ba MPEG system stream data
+0 beshort&0xfff0 0xfff0 MPEG audio stream data
# FLI animation format
4 leshort 0xAF11 FLI file
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
0 string 070702 ASCII cpio archive (SVR4 with CRC)
+# Debian package (needs to go before regular portable archives)
+#
+0 string !<arch>\ndebian
+>8 string debian-split part of multipart Debian package
+>8 string debian-binary Debian binary package
+>68 string >\n (format %s)
+>136 ledate x created: %s
+
# other archives
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0100554 apl workspace
0 string =<ar> archive
-# MIPS archive (needs to go first)
+# MIPS archive (needs to go before regular portable archives)
#
0 string !<arch>\n__________E MIPS archive
>20 string U with MIPS Ucode members
#
0 string !<arch> current ar archive
>8 string __.SYMDEF random library
->8 string debian-split part of multipart Debian package
->8 string debian-binary Debian binary package
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
>0 beshort 2 - object archive
#
# 3B20
#
-0 beshort 0550 3b20 COFF executable
->12 belong >0 not stripped
+# The 3B20 conflicts with SCCS.
+#0 beshort 0550 3b20 COFF executable
+#>12 belong >0 not stripped
#>22 beshort >0 - version %ld
-0 beshort 0551 3b20 COFF executable (TV)
->12 belong >0 not stripped
+#0 beshort 0551 3b20 COFF executable (TV)
+#>12 belong >0 not stripped
#>22 beshort >0 - version %ld
#
# WE32K
0 string MAS_U ULT(imate) Module sound data
0x2c string SCRM ScreamTracker III Module sound data
0 string Extended Module Extended Module sound data
+
+# Gravis UltraSound patches
+# From <ache@nagual.ru>
+
+0 string GF1PATCH110\0ID#000002\0 GUS patch
+0 string GF1PATCH100\0ID#000002\0 Old GUS patch
+
+#
+# Taken from loader code from mikmod version 2.14
+# by Steve McIntyre (stevem@chiark.greenend.org.uk)
+0 string JN extended 669 module data
+0 string MAS_UTrack_V00
+>14 string >/0 ultratracker V1.%.1s module sound data
+0 string UN05 MikMod UNI format module sound data
+0 string Extended\ Module: Fasttracker II module sound data
+21 string !SCREAM! Screamtracker 2 module sound data
+1080 string M.K. 4-channel Protracker module sound data
+1080 string M!K! 4-channel Protracker module sound data
+1080 string FLT4 4-channel Startracker module sound data
+1080 string 4CHN 4-channel Fasttracker module sound data
+1080 string 6CHN 6-channel Fasttracker module sound data
+1080 string 8CHN 8-channel Fasttracker module sound data
+1080 string CD81 8-channel Oktalyzer module sound data
+1080 string OKTA 8-channel Oktalyzer module sound data
+1082 string CH
+>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
+1080 string 16CN 16-channel Taketracker module sound data
+1080 string 32CN 32-channel Taketracker module sound data
+
+# TOC sound files -Trevor Johnson <trevor@jpj.net>
+#
+0 string TOC TOC sound file
0 string :\ shell archive or commands for antique kernel text
0 string #!/bin/sh Bourne shell script text
0 string #!\ /bin/sh Bourne shell script text
+0 string #!\ /bin/sh Bourne shell script text
0 string #!/bin/csh C shell script text
0 string #!\ /bin/csh C shell script text
+0 string #!\ /bin/csh C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string #!/bin/ksh Korn shell script text
0 string #!\ /bin/ksh Korn shell script text
+0 string #!\ /bin/ksh Korn shell script text
0 string #!/bin/tcsh Tenex C shell script text
0 string #!\ /bin/tcsh Tenex C shell script text
+0 string #!\ /bin/tcsh Tenex C shell script text
0 string #!/usr/local/tcsh Tenex C shell script text
0 string #!\ /usr/local/tcsh Tenex C shell script text
0 string #!/usr/local/bin/tcsh Tenex C shell script text
0 string #!\ /usr/local/bin/tcsh Tenex C shell script text
+0 string #!\ /usr/local/bin/tcsh Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0 string #!/usr/local/bin/zsh Paul Falstad's zsh
0 string #!\ /usr/local/bin/zsh Paul Falstad's zsh
+0 string #!\ /usr/local/bin/zsh Paul Falstad's zsh
0 string #!/usr/local/bin/ash Neil Brown's ash
0 string #!\ /usr/local/bin/ash Neil Brown's ash
+0 string #!\ /usr/local/bin/ash Neil Brown's ash
0 string #!/usr/local/bin/ae Neil Brown's ae
0 string #!\ /usr/local/bin/ae Neil Brown's ae
+0 string #!\ /usr/local/bin/ae Neil Brown's ae
0 string #!/bin/nawk new awk script text
0 string #!\ /bin/nawk new awk script text
+0 string #!\ /bin/nawk new awk script text
0 string #!/usr/bin/nawk new awk script text
0 string #!\ /usr/bin/nawk new awk script text
+0 string #!\ /usr/bin/nawk new awk script text
0 string #!/usr/local/bin/nawk new awk script text
0 string #!\ /usr/local/bin/nawk new awk script text
+0 string #!\ /usr/local/bin/nawk new awk script text
0 string #!/bin/gawk GNU awk script text
0 string #!\ /bin/gawk GNU awk script text
+0 string #!\ /bin/gawk GNU awk script text
0 string #!/usr/bin/gawk GNU awk script text
0 string #!\ /usr/bin/gawk GNU awk script text
+0 string #!\ /usr/bin/gawk GNU awk script text
0 string #!/usr/local/bin/gawk GNU awk script text
0 string #!\ /usr/local/bin/gawk GNU awk script text
+0 string #!\ /usr/local/bin/gawk GNU awk script text
#
0 string #!/bin/awk awk commands text
0 string #!\ /bin/awk awk commands text
+0 string #!\ /bin/awk awk commands text
0 string #!/usr/bin/awk awk commands text
0 string #!\ /usr/bin/awk awk commands text
+0 string #!\ /usr/bin/awk awk commands text
0 string BEGIN awk commands text
# For Larry Wall's perl language. The ``eval'' line recognizes an
# Keith Waclena <keith@cerberus.uchicago.edu>
0 string #!/bin/perl perl commands text
0 string #!\ /bin/perl perl commands text
+0 string #!\ /bin/perl perl commands text
0 string eval\ "exec\ /bin/perl perl commands text
0 string #!/usr/bin/perl perl commands text
0 string #!\ /usr/bin/perl perl commands text
+0 string #!\ /usr/bin/perl perl commands text
0 string eval\ "exec\ /usr/bin/perl perl commands text
0 string #!/usr/local/bin/perl perl commands text
0 string #!\ /usr/local/bin/perl perl commands text
+0 string #!\ /usr/local/bin/perl perl commands text
0 string eval\ "exec\ /usr/local/bin/perl perl commands text
# AT&T Bell Labs' Plan 9 shell
0 string #!/bin/rc Plan 9 rc shell script text
0 string #!\ /bin/rc Plan 9 rc shell script text
+0 string #!\ /bin/rc Plan 9 rc shell script text
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string #!/bin/bash Bourne-Again shell script text
0 string #!\ /bin/bash Bourne-Again shell script text
+0 string #!\ /bin/bash Bourne-Again shell script text
0 string #!/usr/local/bin/bash Bourne-Again shell script text
0 string #!\ /usr/local/bin/bash Bourne-Again shell script text
+0 string #!\ /usr/local/bin/bash Bourne-Again shell script text
# generic shell magic
0 string #!\ / a
>3 string >\0 %s script text
+0 string #!\ / a
+>3 string >\0 %s script text
0 string #!/ a
>2 string >\0 %s script text
0 string #!\ commands text
0 string \377\037 compacted data
0 short 0145405 huf output
+# Bzip2 from marcsoft@magic.metawire.com
+0 string BZh bzip2 compressed data,
+>3 byte x format v. %c,
+>4 byte x block size indicator %c
+
# squeeze and crunch
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
0 leshort 0xFF76 squeezed data,
#>99 byte&0xF0 0xd0
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
-# Bzip from ulmo@Q.Net
-0 string BZ bzip compressed data,
->2 byte x format v. %c,
->3 byte x block size indicator %c
-
+# bzip a block-sorting file compressor
+# by Julian Seward <sewardj@cs.man.ac.uk> and others
+#
+0 string BZ bzip compressed data
+>2 byte x \b, version: %c
+>3 string =1 \b, compression block size 100k
+>3 string =2 \b, compression block size 200k
+>3 string =3 \b, compression block size 300k
+>3 string =4 \b, compression block size 400k
+>3 string =5 \b, compression block size 500k
+>3 string =6 \b, compression block size 600k
+>3 string =7 \b, compression block size 700k
+>3 string =8 \b, compression block size 800k
+>3 string =9 \b, compression block size 900k
# Digital UNIX - Info
#
-0 string ^!<arch>\n_______64E Alpha archive
+0 string !<arch>\n________64E Alpha archive
>22 string X -- out of date
#
# Alpha COFF Based Executables
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
-# MIPS R3000 may also be for MIPS RS2000.
+# MIPS R3000 may also be for MIPS R2000.
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
>>16 leshort 2 executable,
>>16 leshort 3 shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
++# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>16 leshort 4 core file
->>>400 lelong >0 (signal %d),
+>>>(0x38+0xcc) string >\0 of '%s'
+>>>(0x38+0x10) lelong >0 (signal %d),
>>16 leshort &0xff00 processor-specific,
>>18 leshort 0 no machine,
>>18 leshort 1 AT&T WE32100 - invalid byte order,
>>20 lelong 0 invalid version
>>20 lelong 1 version 1
>>36 lelong 1 MathCoPro/FPU/MAU Required
+>8 string >\0 (%s)
>5 byte 2 MSB
>>16 beshort 0 no file type,
>>16 beshort 1 relocatable,
>>16 beshort 2 executable,
>>16 beshort 3 shared object,
>>16 beshort 4 core file,
->>>400 lelong >0 (signal %d),
+>>>(0x38+0xcc) string >\0 of '%s'
+>>>(0x38+0x10) belong >0 (signal %d),
>>16 beshort &0xff00 processor-specific,
>>18 beshort 0 no machine,
>>18 beshort 1 AT&T WE32100,
>>18 beshort 16 nCUBE,
>>18 beshort 17 VPP500,
>>18 beshort 18 SPARC32PLUS,
->>18 beshort 20 PowerPC,
+>>18 beshort 20 PowerPC or cisco 4500,
+>>18 beshort 21 cisco 7500,
+>>18 beshort 25 cisco 7200,
>>18 beshort 0x9026 Alpha,
>>20 belong 0 invalid version
>>20 belong 1 version 1
#
0x438 leshort 0xEF53 Linux/i386 ext2 filesystem
0 string \366\366\366\366 PC formatted floppy with no filesystem
+0x1FE leshort 0xAA55 x86 boot sector
+>2 string OSBS \b, OS/BS MBR
+>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
+>0 string \0\0\0\0 \b, extended partition table
+>0 leshort 0x3CEB \b, system
+>>3 string >\0 %s
+>>0x36 string FAT \b, %s
+>>>0x39 string 12 (%s bit)
+>>>0x39 string 16 (%s bit)
+>0x200 lelong 0x82564557 \b, BSD disklabel
0 string flc FIGlet controlfile
>3 string >2a version %-2.2s
+# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
+# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
+0 belong 0x14025919 libGrx font data,
+>8 leshort x %dx
+>10 leshort x \b%d
+>40 string x %s
+# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
+0 belong 0xff464f4e DOS code page font data collection
+7 belong 0x00454741 DOS code page font data
+7 belong 0x00564944 DOS code page font data (from Linux?)
+4098 string DOSFONT DOSFONT2 encrypted font data
+
# copyright, but this file is "published" as witness the following:
#
0 string \<MakerFile FrameMaker document
+>11 string 5.0 (5.0
>11 string 4.0 (4.0
>11 string 3.0 (3.0
>11 string 2.0 (2.0
>2 beshort 0407 impure binary
>2 beshort 0410 read-only binary
>2 beshort 0413 demand paged binary
-
# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
+# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0 string \x89PNG PNG image data,
>4 belong !0x0d0a1a0a CORRUPTED,
->16 belong x %ld x
->20 belong x %ld,
->24 byte x %d-bit
->25 byte 0 grayscale,
->25 byte 2 \b/color RGB,
->25 byte 3 colormap,
->25 byte 4 gray+alpha,
->25 byte 6 \b/color RGBA,
-#>26 byte 0 deflate/32K,
->28 byte 0 non-interlaced
->28 byte 1 interlaced
+>4 belong 0x0d0a1a0a
+>>16 belong x %ld x
+>>20 belong x %ld,
+>>24 byte x %d-bit
+>>25 byte 0 grayscale,
+>>25 byte 2 \b/color RGB,
+>>25 byte 3 colormap,
+>>25 byte 4 gray+alpha,
+>>25 byte 6 \b/color RGBA,
+#>>26 byte 0 deflate/32K,
+>>28 byte 0 non-interlaced
+>>28 byte 1 interlaced
+1 string PNG PNG image data, CORRUPTED
# GIF
0 string GIF8 GIF image data
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
0 belong 0xcafebabe
->4 belong 0x0003002d Java bytecode
+>6 beshort x version %d.
+>4 beshort x \b%d
+#------------------------------------------------------------
+# Java serialization
+# From Martin Pool (m.pool@pharos.com.au)
+0 beshort 0xaced Java serialization data
+>2 beshort >0x0004 \b, version %d
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0 string 0.9
->8 byte 0x0a Debian Binary Package
+>8 byte 0x0a old Debian Binary Package
>>3 byte >0 \b, created by dpkg 0.9%c
>>4 byte >0 pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
>8 long >0 not stripped
>8 long 0 stripped
>23 leshort >0 - version %ld.
-# linux Kernel images version 1.3.80 - ?
-# from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
-0 belong 0xb8c0078e Linux/x86 kernel image,
->0x048c byte 0x31
->>0x048c string x version %s
->0x0493 byte 0x31
->>0x0493 string x version %s
#
+# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
+# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
+# and Nicol=E1s Lichtmaier <nick@debian.org>
+# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
+514 string HdrS Linux kernel
+>518 leshort >0
+>>529 byte 0 zImage data,
+>>529 byte 1 bzImage data,
+>0x048c byte 0x31
+>>0x048c string x version %s
+>0x0493 byte 0x31
+>>0x0493 string x version %s
+>0x048c byte 0x32
+>>0x048c string x version %s
+>0x0493 byte 0x32
+>>0x0493 string x version %s
+>0x04df byte 0x32
+>>0x04df string x version %s
+>0x04fb byte 0x32
+>>0x04fb string x version %s
+# This also matches new kernels, which were caught above by "HdrS".
+0 belong 0xb8c0078e Linux kernel
+>0x1e3 string Loading version 1.3.79 or older
+>0x1e9 string Loading from prehistoric times
+20
+# LSM entries - Nicolas Lichtmaier <nick@feedback.com.ar>
+0 string Begin3 Linux Software Map entry text
0 string \012( byte-compiled Emacs-Lisp program data
# Emacs 19
0 string ;ELC\023\000\000\000 byte-compiled Emacs-Lisp program data
+#
+# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
+0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text
+0 long 0x70768BD2 CLISP memory image data
+0 long 0xD28B7670 CLISP memory image data, other endian
+# Files produced by GNU gettext
+0 long 0xDE120495 GNU-format message catalog data
+0 long 0x950412DE GNU-format message catalog data
0 string BABYL Emacs RMAIL text
0 string Received: RFC 822 mail text
0 string MIME-Version: MIME entity text
-0 string Content- MIME entity text
+#0 string Content- MIME entity text
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0 string @echo\ off MS-DOS batch file text
+# XXX - according to Microsoft's spec, at an offset of 0x3c in a
+# PE-format executable is the offset in the file of the PE header;
+# unfortunately, that's a little-endian offset, and there's no way
+# to specify an indirect offset with a specified byte order.
+# So, for now, we assume the standard MS-DOS stub, which puts the
+# PE header at 0x80 = 128.
+#
+# Required OS version and subsystem version were 4.0 on some NT 3.51
+# executables built with Visual C++ 4.0, so it's not clear that
+# they're interesting. The user version was 0.0, but there's
+# probably some linker directive to set it. The linker version was
+# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
+#
+128 string PE\0\0 MS Windows PE
+>150 leshort&0x0100 >0 32-bit
+>132 leshort 0x0 unknown processor
+>132 leshort 0x14c Intel 80386
+>132 leshort 0x166 MIPS R4000
+>132 leshort 0x184 Alpha
+>132 leshort 0x268 Motorola 68000
+>132 leshort 0x1f0 PowerPC
+>132 leshort 0x290 PA-RISC
+>148 leshort >27
+>>220 leshort 0 unknown subsystem
+>>220 leshort 1 native
+>>220 leshort 2 GUI
+>>220 leshort 3 console
+>>220 leshort 7 POSIX
+>150 leshort&0x2000 =0 executable
+#>>136 ledate x stamp %s,
+>>150 leshort&0x0001 >0 not relocatable
+#>>150 leshort&0x0004 =0 with line numbers,
+#>>150 leshort&0x0008 =0 with local symbols,
+#>>150 leshort&0x0200 =0 with debug symbols,
+>>150 leshort&0x1000 >0 system file
+#>>148 leshort >0
+#>>>154 byte x linker %d
+#>>>155 byte x \b.%d,
+#>>148 leshort >27
+#>>>192 leshort x requires OS %d
+#>>>194 leshort x \b.%d,
+#>>>196 leshort x user version %d
+#>>>198 leshort x \b.%d,
+#>>>200 leshort x subsystem version %d
+#>>>202 leshort x \b.%d,
+>150 leshort&0x2000 >0 DLL
+#>>136 ledate x stamp %s,
+>>150 leshort&0x0001 >0 not relocatable
+#>>150 leshort&0x0004 =0 with line numbers,
+#>>150 leshort&0x0008 =0 with local symbols,
+#>>150 leshort&0x0200 =0 with debug symbols,
+>>150 leshort&0x1000 >0 system file
+#>>148 leshort >0
+#>>>154 byte x linker %d
+#>>>155 byte x \b.%d,
+#>>148 leshort >27
+#>>>192 leshort x requires OS %d
+#>>>194 leshort x \b.%d,
+#>>>196 leshort x user version %d
+#>>>198 leshort x \b.%d,
+#>>>200 leshort x subsystem version %d
+#>>>202 leshort x \b.%d,
+0 leshort 0x14c MS Windows COFF Intel 80386 object file
+#>4 ledate x stamp %s
+0 leshort 0x166 MS Windows COFF MIPS R4000 object file
+#>4 ledate x stamp %s
+0 leshort 0x184 MS Windows COFF Alpha object file
+#>4 ledate x stamp %s
+0 leshort 0x268 MS Windows COFF Motorola 68000 object file
+#>4 ledate x stamp %s
+0 leshort 0x1f0 MS Windows COFF PowerPC object file
+#>4 ledate x stamp %s
+0 leshort 0x290 MS Windows COFF PA-RISC object file
+#>4 ledate x stamp %s
+
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0 string MZ MS-DOS executable (EXE)
->24 string @ \b, OS/2 or Windows
+>24 string @ \b, OS/2 or MS Windows
>1638 string -lh5- \b, LHa SFX archive v2.13S
>7195 string Rar! \b, RAR self-extracting archive
#
#0 byte 0xf0 MS-DOS program library data
#
+#
+# Windows NT Registry files.
+#
+0 string regf Windows NT Registry file
+
# Popular applications
2080 string Microsoft\ Word\ 6.0\ Document %s
+2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
+# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
+2112 string MSWordDoc Microsoft Word document data
#
0 belong 0x31be0000 Microsoft Word Document
#
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
#
+# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
+2114 string Biff5 Microsoft Excel 5.0 Worksheet
+#
0 belong 0x00001a00 Lotus 1-2-3
->4 belong 0x00100400 wk3 document
->4 belong 0x02100400 wk4 document
->4 belong 0x07800100 fm3 or fmb document
->4 belong 0x07800000 fm3 or fmb document
+>4 belong 0x00100400 wk3 document data
+>4 belong 0x02100400 wk4 document data
+>4 belong 0x07800100 fm3 or fmb document data
+>4 belong 0x07800000 fm3 or fmb document data
#
0 belong 0x00000200 Lotus 1-2-3
->4 belong 0x06040600 wk1 document
->4 belong 0x06800200 fmt document
+>4 belong 0x06040600 wk1 document data
+>4 belong 0x06800200 fmt document data
+
+# WordPerfect documents - Trevor Johnson <trevor@jpj.net>
+#
+1 string WPC WordPerfect document
# NetBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them. NetBSD/alpha ELF objects are
# dealt with in "elf".
-0 leshort 0x00070185 ECOFF NetBSD/alpha binary
+0 lelong 0x00070185 ECOFF NetBSD/alpha binary
>10 leshort 0x0001 not stripped
>10 leshort 0x0000 stripped
0 belong&0377777777 043200507 NetBSD/alpha core
# I386 magic number info
#
0 short 0565 i386 COFF object
-#
-0 string Core Alpha Digital UNIX core file
->24 string >\0 \b, generated from '%s'
>>>16 string Query - type %s
>>>16 string ExitServer - type %s
+# Adobe's PostScript Printer Description (PPD) files
+# Yves Arrouye <arrouye@marin.fdn.fr>
+#
+0 string *PPD-Adobe: PPD file
+>13 string x \b, ve
+
+# HP Printer Job Language
+0 string \033%-12345X@PJL HP Printer Job Language data
# HP Printer Job Language
+# The header found on Win95 HP plot files is the "Silliest Thing possible"
+# (TM)
+# Every driver puts the language at some random position, with random case
+# (LANGUAGE and Language)
+# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
+# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
+#
0 string \033%-12345X@PJL HP Printer Job Language data
->15 string \ ENTER\ LANGUAGE\ =
->31 string PostScript PostScript
+>&0 string >\0 %s
+>>&0 string >\0 %s
+>>>&0 string >\0 %s
+>>>>&0 string >\0 %s
+#>15 string \ ENTER\ LANGUAGE\ =
+#>31 string PostScript PostScript
# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0 string \033E\033 HP PCL printer data
0 string RTSS NetMon capture file
>4 byte x - version %d
>5 byte x \b.%d
+>6 leshort 0 (Unknown)
+>6 leshort 1 (Ethernet)
+>6 leshort 2 (Token Ring)
+>6 leshort 3 (FDDI)
+
#
-# Network General Sniffer capture files (the Sniffer software does,
-# after all, run under MS-DOS...).
+# Network General Sniffer capture files.
#
0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
>23 leshort x - version %d
>33 byte x (Format %d,
>32 byte 0 Token ring)
>32 byte 1 Ethernet)
->32 byte 2 ARCnet)
+>32 byte 2 ARCNET)
>32 byte 3 StarLAN)
>32 byte 4 PC Network broadband)
>32 byte 5 LocalTalk)
>32 byte 6 Znet)
#
+# Cinco Networks NetXRay capture files.
+#
+0 string XCP\0 NetXRay capture file
+>4 string >\0 - version %s
+#
+# "libpcap" capture files.
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
# the main program that uses that format, but there's also "tcpview",
# and there may be others in the future.)
>20 belong 1 (Ethernet
>20 belong 2 (3Mb Ethernet
>20 belong 3 (AX.25
->20 belong 4 (ProNet
->20 belong 5 (Chaos
+>20 belong 4 (ProNET
+>20 belong 5 (CHAOS
>20 belong 6 (IEEE 802.x network
->20 belong 7 (ARCnet
+>20 belong 7 (ARCNET
>20 belong 8 (SLIP
>20 belong 9 (PPP
>20 belong 10 (FDDI
>20 belong 11 (RFC 1483 ATM
+>20 belong 12 (raw IP
+>20 belong 13 (BSD/OS SLIP
+>20 belong 14 (BSD/OS PPP
>16 belong x \b, capture length %d)
0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
>4 leshort x - version %d
>20 lelong 1 (Ethernet
>20 lelong 2 (3Mb Ethernet
>20 lelong 3 (AX.25
->20 lelong 4 (ProNet
->20 lelong 5 (Chaos
+>20 lelong 4 (ProNET
+>20 lelong 5 (CHAOS
>20 lelong 6 (IEEE 802.x network
->20 lelong 7 (ARCnet
+>20 lelong 7 (ARCNET
>20 lelong 8 (SLIP
>20 lelong 9 (PPP
>20 lelong 10 (FDDI
>20 lelong 11 (RFC 1483 ATM
+>20 lelong 12 (raw IP
+>20 lelong 13 (BSD/OS SLIP
+>20 lelong 14 (BSD/OS PPP
>16 lelong x \b, capture length %d)
projects / file / commitdiff