# 0 string !<arch> current ar archive
# 0 long 0x213c6172 archive file
#
-# and for SVR3.1 archives, we have:
+# and for SVR1 archives, we have:
#
# 0 string \<ar> System V Release 1 ar archive
# 0 string =<ar> archive
-# 0 string =<ar> archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
0 leshort 0177545 old PDP-11 archive
>8 string __.SYMDEF random library
#
-0 string =<ar> archive
-#
-# From "pdp":
+# From "pdp" (but why a 4-byte quantity?)
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
-#
-0 string -h- Software Tools format archive text
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
0 string IMGfile CIS compimg HP Bitmapfile
# XXX - see "lif"
-0 short 0x8000 lif file
+#0 short 0x8000 lif file
0 long 0x020c010c compiled Lisp
0 string msgcat01 HP NLS message catalog,
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
+# AIX 4.1's "/etc/magic" has
#
+# 0 short 0535 370 sysV executable
+# >12 long >0 not stripped
+# >22 short >0 - version %d
+# >30 long >0 - 5.2 format
+# 0 short 0530 370 sysV pure executable
+# >12 long >0 not stripped
+# >22 short >0 - version %d
+# >30 long >0 - 5.2 format
+#
+# instead of the "USS/370" versions of the same magic numbers.
+#
+0 beshort 0537 370 XA sysV executable
+>12 belong >0 not stripped
+>22 beshort >0 - version %d
+>30 belong >0 - 5.2 format
+0 beshort 0532 370 XA sysV pure executable
+>12 belong >0 not stripped
+>22 beshort >0 - version %d
+>30 belong >0 - 5.2 format
+0 beshort 054001 370 sysV pure executable
+>12 belong >0 not stripped
+0 beshort 055001 370 XA sysV pure executable
+>12 belong >0 not stripped
+0 beshort 056401 370 sysV executable
+>12 belong >0 not stripped
+0 beshort 057401 370 XA sysV executable
+>12 belong >0 not stripped
0 beshort 0531 SVR2 executable (Amdahl-UTS)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0x0104 shared library
0 beshort 0x0105 ctab data
0 beshort 0xfe04 structured file
-0 string 0xabcdef message catalog
+0 string 0xabcdef AIX message catalog
+0 belong 0x000001f9 AIX compiled message catalog
0 string \<aiaff> archive
0 string \007\001\000 Linux/i386 object file
>20 lelong >0x1020 \b, DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
-0 string *nazgul* compiled message catalog
+0 string *nazgul* Linux compiled message catalog
>8 lelong >0 \b, version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216 lelong 0421 Linux/i386 core file
#
# All new-style magic numbers are in network byte order.
#
-0 lelong 000000413 386BSD demand paged executable
->16 lelong >0 not stripped
-0 lelong 000000314 BSDI demand paged executable
->16 lelong >0 not stripped
->32 byte 0x6a (uses shared libs)
-
-0 lelong&077777777 041400314 FreeBSD/i386 demand paged
->3 byte &0x80
->>20 lelong <4096 shared library
->>20 lelong =4096 dynamically linked executable
->>20 lelong >4096 dynamically linked executable
->3 byte ^0x80 executable
->16 lelong >0 not stripped
-0 string \0\0\0\0\0\0\300\357\020\0 FreeBSD core
->1075 string >\0 from '%s'
0 lelong 000000407 NetBSD little-endian object file
>16 lelong >0 not stripped
0 long 0xfa33c08e SunPC 4.0 Hard Disk
0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
# Sun snoop
+#
+# XXX - are numbers stored in big-endian format, or in host byte order?
+# They're the same on SPARC, but not the same on x86.
+#
0 string snoop Snoop capture file
>8 long >0 - version %ld
+>12 long 0 (IEEE 802.3)
+>12 long 1 (IEEE 802.4)
+>12 long 2 (IEEE 802.5)
+>12 long 3 (IEEE 802.6)
+>12 long 4 (Ethernet)
+>12 long 5 (HDLC)
+>12 long 6 (Character synchronous)
+>12 long 7 (IBM channel-to-channel adapter)
+>12 long 8 (FDDI)
+>12 long 9 (Unknown)
# Sun KCMS
36 string acsp Kodak Color Management System, ICC Profile