--- /dev/null
+
+#------------------------------------------------------------
+# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $
+# Various android related magic entries
+#------------------------------------------------------------
+
+# Dalvik .dex format. http://retrodev.com/android/dexformat.html
+# From <mkf@google.com> "Mike Fleming"
+# Fixed to avoid regexec 17 errors on some dex files
+# From <diff@lookout.com> "Tim Strazzere"
+0 string dex\n
+>0 regex dex\n[0-9]{2}\0 Dalvik dex file
+>4 string >000 version %s
+0 string dey\n
+>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host)
+>4 string >000 version %s
+
+# http://android.stackexchange.com/questions/23357/\
+# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
+# 23608#23608
+0 string ANDROID\040BACKUP\n Android Backup
+>15 string 1\n \b, version 1
+>17 string 0\n \b, uncompressed
+>17 string 1\n \b, compressed
+>19 string none\n \b, unencrypted
+>19 string AES-256\n \b, encrypted AES-256
+
+# Android bootimg format
+# From https://android.googlesource.com/\
+# platform/system/core/+/master/mkbootimg/bootimg.h
+0 string ANDROID! Android bootimg
+>8 lelong >0 \b, kernel
+>>12 lelong >0 \b (0x%x)
+>16 lelong >0 \b, ramdisk
+>>20 lelong >0 \b (0x%x)
+>24 lelong >0 \b, second stage
+>>28 lelong >0 \b (0x%x)
+>36 lelong >0 \b, page size: %d
+>38 string >0 \b, name: %s
+>64 string >0 \b, cmdline (%s)
+# Dalvik .dex format. http://retrodev.com/android/dexformat.html
+# From <mkf@google.com> "Mike Fleming"
+# Fixed to avoid regexec 17 errors on some dex files
+# From <diff@lookout.com> "Tim Strazzere"
+0 string dex\n
+>0 regex dex\n[0-9]{2}\0 Dalvik dex file
+>4 string >000 version %s
+0 string dey\n
+>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host)
+>4 string >000 version %s
+
+# http://android.stackexchange.com/questions/23357/\
+# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
+# 23608#23608
+0 string ANDROID\040BACKUP\n Android Backup
+>15 string 1\n \b, version 1
+>17 string 0\n \b, uncompressed
+>17 string 1\n \b, compressed
+>19 string none\n \b, unencrypted
+>19 string AES-256\n \b, encrypted AES-256
+
+# Android bootimg format
+# From https://android.googlesource.com/\
+# platform/system/core/+/master/mkbootimg/bootimg.h
+0 string ANDROID! Android bootimg
+>8 lelong >0 \b, kernel
+>>12 lelong >0 \b (0x%x)
+>16 lelong >0 \b, ramdisk
+>>20 lelong >0 \b (0x%x)
+>24 lelong >0 \b, second stage
+>>28 lelong >0 \b (0x%x)
+>36 lelong >0 \b, page size: %d
+>38 string >0 \b, name: %s
+>64 string >0 \b, cmdline (%s)
#------------------------------------------------------------
-# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $
+# $File: java,v 1.15 2013/08/14 09:10:36 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called "cafebabe".
0 belong 0xcececece Java JCE KeyStore
!:mime application/x-java-jce-keystore
-# Dalvik .dex format. http://retrodev.com/android/dexformat.html
-# From <mkf@google.com> "Mike Fleming"
-# Fixed to avoid regexec 17 errors on some dex files
-# From <diff@lookout.com> "Tim Strazzere"
-0 string dex\n
->0 regex dex\n[0-9]{2}\0 Dalvik dex file
->4 string >000 version %s
-0 string dey\n
->0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host)
->4 string >000 version %s
-
# Java source
0 regex ^import.*;$ Java source
!:mime text/x-java
-
-# http://android.stackexchange.com/questions/23357/\
-# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
-# 23608#23608
-0 string ANDROID\040BACKUP\n Android Backup
->15 string 1\n \b, version 1
->17 string 0\n \b, uncompressed
->17 string 1\n \b, compressed
->19 string none\n \b, unencrypted
->19 string AES-256\n \b, encrypted AES-256