#------------------------------------------------------------------------------
-# $File: windows,v 1.5 2012/04/03 22:25:07 christos Exp $
+# $File: windows,v 1.6 2013/04/19 20:12:29 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
0 string Windows\ Registry\ Editor\
>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
-
+# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
+# emtpy ,comment , section , unicode line
+0 regex/s \\`(\r\n|;|[[]|\xFF\xFE)
+# left bracket in section line
+>&0 search/8192 [
+# http://en.wikipedia.org/wiki/Autorun.inf
+# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
+>>&0 regex/c \^(autorun)]\r\n
+>>>&0 ubyte =0x5b INItialization configuration
+!:mime application/x-wine-extension-ini
# From: Pal Tamas <folti@balabit.hu>
# Autorun File
-0 string/c [autorun]\r\n Microsoft Windows Autorun file.
-!:mime application/x-setupscript.
+>>>&0 ubyte !0x5b Microsoft Windows Autorun file
+!:mime application/x-setupscript
+# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
+# version strings ASCII coded case-independent for Windows setup information script file
+>>&0 regex/c \^(version|strings)] Windows setup INFormation
+!:mime application/x-setupscript
+#!:mime application/inf
+#!:mime application/x-wine-extension-inf
+>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation
+!:mime text/inf
+# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
+# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
+# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
+>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini
+!:mime application/x-wine-extension-ini
+#!:mime text/plain
+# http://support.microsoft.com/kb/84709/
+>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI
+!:mime application/x-wine-extension-ini
+>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI
+!:mime application/x-wine-extension-ini
+# http://technet.microsoft.com/en-us/library/cc722567.aspx
+# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
+>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI
+!:mime application/x-wine-extension-ini
+# http://en.wikipedia.org/wiki/SYSTEM.INI
+>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI
+!:mime application/x-wine-extension-ini
+# http://www.mdgx.com/newtip6.htm
+>>&0 regex/c \^(SafeList)] Windows IOS.INI
+!:mime application/x-wine-extension-ini
+# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information
+>>&0 regex/c \^(boot\x20loader)] Windows boot.ini
+!:mime application/x-wine-extension-ini
+>>>&0 ubyte x
+# http://en.wikipedia.org/wiki/CONFIG.SYS
+>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS
+# http://support.microsoft.com/kb/118579/
+>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS
+# VERS string unicoded case-independent
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+# ION] string unicoded case-independent
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+!:mime application/x-setupscript
+# STRI string unicoded case-independent
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049
+# NGS] string unicoded case-independent
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation
+!:mime application/x-setupscript
+# unknown keyword after opening bracket
+>>&0 default x
+>>>&0 search/8192 [
+# version Strings FileIdentification
+>>>>&0 string/c version Windows setup INFormation
+!:mime application/x-setupscript
+# VERS string unicoded case-independent
+>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+# ION] string unicoded case-independent
+>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+!:mime application/x-setupscript
+# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other
+#>>>>&0 default x Generic INItialization configuration
+#!:mime application/x-wine-extension-ini
+
+# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
+# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
+# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
+0 leshort&0xFeFe 0x0000
+# test for unused null bits in PNF_FLAGs
+>4 ulelong&0xFCffFe00 0x00000000
+# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
+>>68 ulelong >0x57
+# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
+# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
+>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF
+!:mime application/x-pnf
+# currently only found Major Version=1 and Minor Version=1
+#>>>>0 uleshort =0x0101
+#>>>>>1 ubyte x \b, version %u
+#>>>>>0 ubyte x \b.%u
+>>>>0 uleshort !0x0101
+>>>>>1 ubyte x \b, version %u
+>>>>>0 ubyte x \b.%u
+# 1 ,2 (windows 98 SE)
+#>>>>2 uleshort =2 \b, InfStyle %u
+>>>>2 uleshort !2 \b, InfStyle %u
+# PNF_FLAG_IS_UNICODE 0x00000001
+# PNF_FLAG_HAS_STRINGS 0x00000002
+# PNF_FLAG_SRCPATH_IS_URL 0x00000004
+# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008
+# PNF_FLAG_INF_VERIFIED 0x00000010
+# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020
+# ?? 0x00000100
+# ?? 0x01000000
+# ?? 0x02000000
+>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded
+>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed
+#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x
+# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
+#>>>>12 uleshort x \b, InfSubstValueCount 0x%x
+# only < 9 found
+#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x
+# only found values lower 0x0000ffff
+#>>>>16 ulelong x \b, InfVersionDataSize 0x%x
+# only found positive values lower 0x00ffFFff for InfVersionDataOffset
+>>>>20 ulelong x \b, at 0x%x
+>>>>4 ulelong&0x00000001 =0x00000001
+# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
+>>>>>(20.l) lestring16 x "%s"
+>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>(20.l) string x "%s"
+# FILETIME is number of 100-nanosecond intervals since 1 January 1601
+#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx
+# only found values lower 0x00ffFFff
+#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x
+#>>>>36 ulelong x \b, StringTableBlockSize 0x%x
+#>>>>40 ulelong x \b, InfSectionCount 0x%x
+#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x
+#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x
+#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x
+#>>>>56 ulelong x \b, InfLineBlockSize 0x%x
+#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x
+#>>>>64 ulelong x \b, InfValueBlockSize 0x%x
+# WinDirPathOffset
+#>>>>68 ulelong x \b, at 0x%x
+>>>>68 ulelong >0x57
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(68.l) ubequad =0x43003a005c005700
+# normally unicoded C:\Windows
+#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
+>>>>>>(68.l) ubequad !0x43003a005c005700
+>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+# normally ASCII C:\WINDOWS
+#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s"
+>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s"
+# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
+#>>>>72 ulelong >0 \b, at 0x%x
+>>>>72 ulelong >0 \b,
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(72.l) lestring16 x OsLoaderPath "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+# seldom C:\ instead empty
+>>>>>>(72.l) string x OsLoaderPath "%s"
+# 1fdh
+#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x
+>>>>78 uleshort !0x407 \b, LanguageId %x
+# only 407h found
+#>>>>78 uleshort =0x407 \b, LanguageId %x
+# InfSourcePathOffset often 0
+#>>>>80 ulelong >0 \b, at 0x%x
+>>>>80 ulelong >0 \b,
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(80.l) lestring16 x SourcePath "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>>(80.l) string >\0 SourcePath "%s"
+# OriginalInfNameOffset often 0
+#>>>>84 ulelong >0 \b, at 0x%x
+>>>>84 ulelong >0 \b,
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(84.l) lestring16 x InfName "%s"
+>>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>>(84.l) string >\0 InfName "%s"
+
projects / file / commitdiff