From: Christos Zoulas Date: Sun, 21 Nov 2004 05:20:30 +0000 (+0000) Subject: More magic X-Git-Tag: FILE5_05~848 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=177234a7e7caeb1e861639ae863c9daf121a2bad;p=file More magic --- diff --git a/ChangeLog b/ChangeLog index dbd0481d..e56d5d0c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ + +2004-11-20 18:50 Christos Zoulas + + * New FreeBSD version parsing code: + Jon Noack + + * Hackish support for ucs16 strings + 2004-11-13 03:07 Christos Zoulas * print the file name and line number in syntax errors. diff --git a/magic/Magdir/animation b/magic/Magdir/animation index 815a2088..08f92ae8 100644 --- a/magic/Magdir/animation +++ b/magic/Magdir/animation @@ -6,123 +6,524 @@ # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) -# MPEG animation format -0 belong 0x000001b3 MPEG video stream data -#>4 beshort&0xfff0 x (%d x -#>5 beshort&0x0fff x %d) -0 belong 0x000001ba MPEG system stream data +# MPEG sequences +# Scans for all common MPEG header start codes +0 belong&0xFFFFFF00 0x00000100 MPEG sequence +>3 byte 0xBA +>>4 byte &0x40 \b, v2, program multiplex +>>4 byte ^0x40 \b, v1, system multiplex +>3 byte 0xBB \b, v1/2, multiplex (missing pack header) +>3 byte 0xB0 \b, v4 +>>5 belong 0x000001B5 +>>>9 byte &0x80 +>>>>10 byte&0xF0 16 \b, video +>>>>10 byte&0xF0 32 \b, still texture +>>>>10 byte&0xF0 48 \b, mesh +>>>>10 byte&0xF0 64 \b, face +>>>9 byte ^0x80 +>>>>9 byte&0xF8 8 \b, video +>>>>9 byte&0xF8 16 \b, still texture +>>>>9 byte&0xF8 24 \b, mesh +>>>>9 byte&0xF8 32 \b, face +>>4 byte 1 \b, simple @ L1 +>>4 byte 2 \b, simple @ L2 +>>4 byte 3 \b, simple @ L3 +>>4 byte 4 \b, simple @ L0 +>>4 byte 17 \b, simple scalable @ L1 +>>4 byte 18 \b, simple scalable @ L2 +>>4 byte 33 \b, core @ L1 +>>4 byte 34 \b, core @ L2 +>>4 byte 50 \b, main @ L2 +>>4 byte 51 \b, main @ L3 +>>4 byte 53 \b, main @ L4 +>>4 byte 66 \b, n-bit @ L2 +>>4 byte 81 \b, scalable texture @ L1 +>>4 byte 97 \b, simple face animation @ L1 +>>4 byte 98 \b, simple face animation @ L2 +>>4 byte 99 \b, simple face basic animation @ L1 +>>4 byte 100 \b, simple face basic animation @ L2 +>>4 byte 113 \b, basic animation text @ L1 +>>4 byte 114 \b, basic animation text @ L2 +>>4 byte 129 \b, hybrid @ L1 +>>4 byte 130 \b, hybrid @ L2 +>>4 byte 145 \b, advanced RT simple @ L! +>>4 byte 146 \b, advanced RT simple @ L2 +>>4 byte 147 \b, advanced RT simple @ L3 +>>4 byte 148 \b, advanced RT simple @ L4 +>>4 byte 161 \b, core scalable @ L1 +>>4 byte 162 \b, core scalable @ L2 +>>4 byte 163 \b, core scalable @ L3 +>>4 byte 177 \b, advanced coding efficiency @ L1 +>>4 byte 178 \b, advanced coding efficiency @ L2 +>>4 byte 179 \b, advanced coding efficiency @ L3 +>>4 byte 180 \b, advanced coding efficiency @ L4 +>>4 byte 193 \b, advanced core @ L1 +>>4 byte 194 \b, advanced core @ L2 +>>4 byte 209 \b, advanced scalable texture @ L1 +>>4 byte 210 \b, advanced scalable texture @ L2 +>>4 byte 211 \b, advanced scalable texture @ L3 +>>4 byte 225 \b, simple studio @ L1 +>>4 byte 226 \b, simple studio @ L2 +>>4 byte 227 \b, simple studio @ L3 +>>4 byte 228 \b, simple studio @ L4 +>>4 byte 229 \b, core studio @ L1 +>>4 byte 230 \b, core studio @ L2 +>>4 byte 231 \b, core studio @ L3 +>>4 byte 232 \b, core studio @ L4 +>>4 byte 240 \b, advanced simple @ L0 +>>4 byte 241 \b, advanced simple @ L1 +>>4 byte 242 \b, advanced simple @ L2 +>>4 byte 243 \b, advanced simple @ L3 +>>4 byte 244 \b, advanced simple @ L4 +>>4 byte 245 \b, advanced simple @ L5 +>>4 byte 247 \b, advanced simple @ L3b +>>4 byte 248 \b, FGS @ L0 +>>4 byte 249 \b, FGS @ L1 +>>4 byte 250 \b, FGS @ L2 +>>4 byte 251 \b, FGS @ L3 +>>4 byte 252 \b, FGS @ L4 +>>4 byte 253 \b, FGS @ L5 +>3 byte 0xB5 \b, v4 +>>4 byte &0x80 +>>>5 byte&0xF0 16 \b, video (missing profile header) +>>>5 byte&0xF0 32 \b, still texture (missing profile header) +>>>5 byte&0xF0 48 \b, mesh (missing profile header) +>>>5 byte&0xF0 64 \b, face (missing profile header) +>>4 byte ^0x80 +>>>4 byte&0xF8 8 \b, video (missing profile header) +>>>4 byte&0xF8 16 \b, still texture (missing profile header) +>>>4 byte&0xF8 24 \b, mesh (missing profile header) +>>>4 byte&0xF8 32 \b, face (missing profile header) +>3 byte 0xB3 +>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>12 belong 0x000001B5 \b, v2, +>>>16 byte&0x0F 1 \b HP +>>>16 byte&0x0F 2 \b Spt +>>>16 byte&0x0F 3 \b SNR +>>>16 byte&0x0F 4 \b MP +>>>16 byte&0x0F 5 \b SP +>>>17 byte&0xF0 64 \b@HL +>>>17 byte&0xF0 96 \b@H-14 +>>>17 byte&0xF0 128 \b@ML +>>>17 byte&0xF0 160 \b@LL +>>>17 byte &0x08 \b progressive +>>>17 byte ^0x08 \b interlaced +>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>11 byte &0x02 +>>>75 byte &0x01 +>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>>>140 belong 0x000001B5 \b, v2, +>>>>>144 byte&0x0F 1 \b HP +>>>>>144 byte&0x0F 2 \b Spt +>>>>>144 byte&0x0F 3 \b SNR +>>>>>144 byte&0x0F 4 \b MP +>>>>>144 byte&0x0F 5 \b SP +>>>>>145 byte&0xF0 64 \b@HL +>>>>>145 byte&0xF0 96 \b@H-14 +>>>>>145 byte&0xF0 128 \b@ML +>>>>>145 byte&0xF0 160 \b@LL +>>>>>145 byte &0x08 \b progressive +>>>>>145 byte ^0x08 \b interlaced +>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>>76 belong 0x000001B5 \b, v2, +>>>80 byte&0x0F 1 \b HP +>>>80 byte&0x0F 2 \b Spt +>>>80 byte&0x0F 3 \b SNR +>>>80 byte&0x0F 4 \b MP +>>>80 byte&0x0F 5 \b SP +>>>81 byte&0xF0 64 \b@HL +>>>81 byte&0xF0 96 \b@H-14 +>>>81 byte&0xF0 128 \b@ML +>>>81 byte&0xF0 160 \b@LL +>>>81 byte &0x08 \b progressive +>>>81 byte ^0x08 \b interlaced +>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P +>>>7 byte&0xF0 0x10 \b, 16:9 +>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I +>>>7 byte&0xF0 0x10 \b, 16:9 +>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 beshort&0xFFF0 0x2C00 \b, 4CIF +>>>5 beshort&0x0FFF 0x01E0 \b NTSC +>>>5 beshort&0x0FFF 0x0240 \b PAL +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>>7 byte&0xF0 0x80 \b, PAL 4:3 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 +>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 beshort&0xFFF0 0x1600 \b, CIF +>>>5 beshort&0x0FFF 0x00F0 \b NTSC +>>>5 beshort&0x0FFF 0x0120 \b PAL +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>>7 byte&0xF0 0x80 \b, PAL 4:3 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>>7 byte&0xF0 0x20 \b, 4:3 +>>>>7 byte&0xF0 0x30 \b, 16:9 +>>>>7 byte&0xF0 0x40 \b, 11:5 +>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>4 beshort&0xFFF0 0x1E00 \b, SVCD +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>7 byte&0x0F 1 \b, 23.976 fps +>>7 byte&0x0F 2 \b, 24 fps +>>7 byte&0x0F 3 \b, 25 fps +>>7 byte&0x0F 4 \b, 29.97 fps +>>7 byte&0x0F 5 \b, 30 fps +>>7 byte&0x0F 6 \b, 50 fps +>>7 byte&0x0F 7 \b, 59.94 fps +>>7 byte&0x0F 8 \b, 60 fps +>>11 byte &0x04 \b, Constrained -# MPEG Audio (*.mpx) +# MPEG ADTS Audio (*.mpx/mxa/aac) # from dreesen@math.fu-berlin.de +# modified to fully support MPEG ADTS -# MPEG 1.0 Layer 3 -0 beshort&0xfffe =0xfffa \bMP3 ->2 byte&0xf0 =0x10 \b, 32 kBits ->2 byte&0xf0 =0x20 \b, 40 kBits ->2 byte&0xf0 =0x30 \b, 48 kBits ->2 byte&0xf0 =0x40 \b, 56 kBits ->2 byte&0xf0 =0x50 \b, 64 kBits ->2 byte&0xf0 =0x60 \b, 80 kBits ->2 byte&0xf0 =0x70 \b, 96 kBits ->2 byte&0xf0 =0x80 \b, 112 kBits ->2 byte&0xf0 =0x90 \b, 128 kBits ->2 byte&0xf0 =0xA0 \b, 160 kBits ->2 byte&0xf0 =0xB0 \b, 192 kBits ->2 byte&0xf0 =0xC0 \b, 224 kBits ->2 byte&0xf0 =0xD0 \b, 256 kBits ->2 byte&0xf0 =0xE0 \b, 320 kBits -# freq ->2 byte&0x0C =0x00 \b, 44.1 kHz ->2 byte&0x0C =0x04 \b, 48 kHz ->2 byte&0x0C =0x08 \b, 32 kHz -# misc ->3 byte&0xC0 =0x00 \b, Stereo ->3 byte&0xC0 =0x40 \b, JStereo ->3 byte&0xC0 =0x80 \b, Dual-Ch ->3 byte&0xC0 =0xC0 \b, Mono -#>1 byte&0x01 =0x00 \b, Error Protection -#>2 byte&0x02 =0x02 \b, Padding -#>2 byte&0x01 =0x01 \b, Private -#>3 byte&0x08 =0x08 \b, Copyright -#>3 byte&0x04 =0x04 \b, Original -#>3 byte&0x03 1 \b, Emphasis 5 -#>3 byte&0x03 3 \b, Emphasis c - -# MPEG 1.0 Layer 2 -0 beshort&0xfffe =0xfffc \bMP2 ->2 byte&0xf0 =0x10 \b, 32 kBits ->2 byte&0xf0 =0x20 \b, 48 kBits ->2 byte&0xf0 =0x30 \b, 56 kBits ->2 byte&0xf0 =0x40 \b, 64 kBits ->2 byte&0xf0 =0x50 \b, 80 kBits ->2 byte&0xf0 =0x60 \b, 96 kBits ->2 byte&0xf0 =0x70 \b, 112 kBits ->2 byte&0xf0 =0x80 \b, 128 kBits ->2 byte&0xf0 =0x90 \b, 160 kBits ->2 byte&0xf0 =0xA0 \b, 192 kBits ->2 byte&0xf0 =0xB0 \b, 224 kBits ->2 byte&0xf0 =0xC0 \b, 256 kBits ->2 byte&0xf0 =0xD0 \b, 320 kBits ->2 byte&0xf0 =0xE0 \b, 384 kBits -# freq ->2 byte&0x0C =0x00 \b, 44.1 kHz ->2 byte&0x0C =0x04 \b, 48 kHz ->2 byte&0x0C =0x08 \b, 32 kHz -# misc ->3 byte&0xC0 =0x00 \b, Stereo ->3 byte&0xC0 =0x40 \b, JStereo ->3 byte&0xC0 =0x80 \b, Dual-Ch ->3 byte&0xC0 =0xC0 \b, Mono -#>1 byte&0x01 =0x00 \b, Error Protection -#>2 byte&0x02 =0x02 \b, Padding -#>2 byte&0x01 =0x01 \b, Private -#>3 byte&0x08 =0x08 \b, Copyright -#>3 byte&0x04 =0x04 \b, Original -#>3 byte&0x03 1 \b, Emphasis 5 -#>3 byte&0x03 3 \b, Emphasis c - -# MPEG 2.0 -0 beshort&0xfff8 =0xfff0 MP -# Layer 3 ->1 byte &0x02 \b3 -# Layer 2 ->1 byte &0x04 \b2 ->2 byte&0xf0 =0x10 \b, 8 kBits ->2 byte&0xf0 =0x20 \b, 16 kBits ->2 byte&0xf0 =0x30 \b, 24 kBits ->2 byte&0xf0 =0x40 \b, 32 kBits ->2 byte&0xf0 =0x50 \b, 40 kBits ->2 byte&0xf0 =0x60 \b, 48 kBits ->2 byte&0xf0 =0x70 \b, 56 kBits ->2 byte&0xf0 =0x80 \b, 64 kBits ->2 byte&0xf0 =0x90 \b, 80 kBits ->2 byte&0xf0 =0xA0 \b, 96 kBits ->2 byte&0xf0 =0xB0 \b, 112 kBits ->2 byte&0xf0 =0xC0 \b, 128 kBits ->2 byte&0xf0 =0xD0 \b, 144 kBits ->2 byte&0xf0 =0xE0 \b, 160 kBits -# freq ->2 byte&0x0C =0x00 \b, 22.05 kHz ->2 byte&0x0C =0x04 \b, 24 kHz ->2 byte&0x0C =0x08 \b, 16 kHz -# misc ->3 byte&0xC0 =0x00 \b, Stereo ->3 byte&0xC0 =0x40 \b, JStereo ->3 byte&0xC0 =0x80 \b, Dual-Ch ->3 byte&0xC0 =0xC0 \b, Mono -#>1 byte&0x01 =0x00 \b, Error Protection -#>2 byte&0x02 =0x02 \b, Padding -#>2 byte&0x01 =0x01 \b, Private -#>3 byte&0x08 =0x08 \b, Copyright -#>3 byte&0x04 =0x04 \b, Original -#>3 byte&0x03 1 \b, Emphasis 5 -#>3 byte&0x03 3 \b, Emphasis c - -#From: Johan Gade - -# MPEG-4 Advanced Audio Coding (AAC) file (perhaps also MPEG-2 ACC?) -16 string M4A MPEG-4 Advanced Audio Coding file (AAC) +# MP3, M1A +0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1 +# rates +>2 byte&0xF0 0x10 \b, 32 kBits +>2 byte&0xF0 0x20 \b, 40 kBits +>2 byte&0xF0 0x30 \b, 48 kBits +>2 byte&0xF0 0x40 \b, 56 kBits +>2 byte&0xF0 0x50 \b, 64 kBits +>2 byte&0xF0 0x60 \b, 80 kBits +>2 byte&0xF0 0x70 \b, 96 kBits +>2 byte&0xF0 0x80 \b, 112 kBits +>2 byte&0xF0 0x90 \b, 128 kBits +>2 byte&0xF0 0xA0 \b, 160 kBits +>2 byte&0xF0 0xB0 \b, 192 kBits +>2 byte&0xF0 0xC0 \b, 224 kBits +>2 byte&0xF0 0xD0 \b, 256 kBits +>2 byte&0xF0 0xE0 \b, 320 kBits +# timing +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 +# MP2, M1A +0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 +# rates +>2 byte&0xF0 0x10 \b, 32 kBits +>2 byte&0xF0 0x20 \b, 48 kBits +>2 byte&0xF0 0x30 \b, 56 kBits +>2 byte&0xF0 0x40 \b, 64 kBits +>2 byte&0xF0 0x50 \b, 80 kBits +>2 byte&0xF0 0x60 \b, 96 kBits +>2 byte&0xF0 0x70 \b, 112 kBits +>2 byte&0xF0 0x80 \b, 128 kBits +>2 byte&0xF0 0x90 \b, 160 kBits +>2 byte&0xF0 0xA0 \b, 192 kBits +>2 byte&0xF0 0xB0 \b, 224 kBits +>2 byte&0xF0 0xC0 \b, 256 kBits +>2 byte&0xF0 0xD0 \b, 320 kBits +>2 byte&0xF0 0xE0 \b, 384 kBits +# timing +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MPA, M1A +0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1 +# rate +>2 byte&0xF0 0x10 \b, 32 kBits +>2 byte&0xF0 0x20 \b, 64 kBits +>2 byte&0xF0 0x30 \b, 96 kBits +>2 byte&0xF0 0x40 \b, 128 kBits +>2 byte&0xF0 0x50 \b, 160 kBits +>2 byte&0xF0 0x60 \b, 192 kBits +>2 byte&0xF0 0x70 \b, 224 kBits +>2 byte&0xF0 0x80 \b, 256 kBits +>2 byte&0xF0 0x90 \b, 288 kBits +>2 byte&0xF0 0xA0 \b, 320 kBits +>2 byte&0xF0 0xB0 \b, 352 kBits +>2 byte&0xF0 0xC0 \b, 384 kBits +>2 byte&0xF0 0xD0 \b, 416 kBits +>2 byte&0xF0 0xE0 \b, 448 kBits +# timing +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP3, M2A +0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 +# rate +>2 byte&0xF0 0x10 \b, 8 kBits +>2 byte&0xF0 0x20 \b, 16 kBits +>2 byte&0xF0 0x30 \b, 24 kBits +>2 byte&0xF0 0x40 \b, 32 kBits +>2 byte&0xF0 0x50 \b, 40 kBits +>2 byte&0xF0 0x60 \b, 48 kBits +>2 byte&0xF0 0x70 \b, 56 kBits +>2 byte&0xF0 0x80 \b, 64 kBits +>2 byte&0xF0 0x90 \b, 80 kBits +>2 byte&0xF0 0xA0 \b, 96 kBits +>2 byte&0xF0 0xB0 \b, 112 kBits +>2 byte&0xF0 0xC0 \b, 128 kBits +>2 byte&0xF0 0xD0 \b, 144 kBits +>2 byte&0xF0 0xE0 \b, 160 kBits +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP2, M2A +0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 +# rate +>2 byte&0xF0 0x10 \b, 8 kBits +>2 byte&0xF0 0x20 \b, 16 kBits +>2 byte&0xF0 0x30 \b, 24 kBits +>2 byte&0xF0 0x40 \b, 32 kBits +>2 byte&0xF0 0x50 \b, 40 kBits +>2 byte&0xF0 0x60 \b, 48 kBits +>2 byte&0xF0 0x70 \b, 56 kBits +>2 byte&0xF0 0x80 \b, 64 kBits +>2 byte&0xF0 0x90 \b, 80 kBits +>2 byte&0xF0 0xA0 \b, 96 kBits +>2 byte&0xF0 0xB0 \b, 112 kBits +>2 byte&0xF0 0xC0 \b, 128 kBits +>2 byte&0xF0 0xD0 \b, 144 kBits +>2 byte&0xF0 0xE0 \b, 160 kBits +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MPA, M2A +0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 +# rate +>2 byte&0xF0 0x10 \b, 32 kBits +>2 byte&0xF0 0x20 \b, 48 kBits +>2 byte&0xF0 0x30 \b, 56 kBits +>2 byte&0xF0 0x40 \b, 64 kBits +>2 byte&0xF0 0x50 \b, 80 kBits +>2 byte&0xF0 0x60 \b, 96 kBits +>2 byte&0xF0 0x70 \b, 112 kBits +>2 byte&0xF0 0x80 \b, 128 kBits +>2 byte&0xF0 0x90 \b, 144 kBits +>2 byte&0xF0 0xA0 \b, 160 kBits +>2 byte&0xF0 0xB0 \b, 176 kBits +>2 byte&0xF0 0xC0 \b, 192 kBits +>2 byte&0xF0 0xD0 \b, 224 kBits +>2 byte&0xF0 0xE0 \b, 256 kBits +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP3, M25A +0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 +# rate +>2 byte&0xF0 0x10 \b, 8 kBits +>2 byte&0xF0 0x20 \b, 16 kBits +>2 byte&0xF0 0x30 \b, 24 kBits +>2 byte&0xF0 0x40 \b, 32 kBits +>2 byte&0xF0 0x50 \b, 40 kBits +>2 byte&0xF0 0x60 \b, 48 kBits +>2 byte&0xF0 0x70 \b, 56 kBits +>2 byte&0xF0 0x80 \b, 64 kBits +>2 byte&0xF0 0x90 \b, 80 kBits +>2 byte&0xF0 0xA0 \b, 96 kBits +>2 byte&0xF0 0xB0 \b, 112 kBits +>2 byte&0xF0 0xC0 \b, 128 kBits +>2 byte&0xF0 0xD0 \b, 144 kBits +>2 byte&0xF0 0xE0 \b, 160 kBits +# timing +>2 byte&0x0C 0x00 \b, 11.025 kHz +>2 byte&0x0C 0x04 \b, 12 kHz +>2 byte&0x0C 0x08 \b, 8 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio + +# Stored AAC streams (instead of the MP4 format) +0 string ADIF MPEG ADIF, AAC +>4 byte &0x80 +>>13 byte &0x10 \b, VBR +>>13 byte ^0x10 \b, CBR +>>16 byte&0x1E 0x02 \b, single stream +>>16 byte&0x1E 0x04 \b, 2 streams +>>16 byte&0x1E 0x06 \b, 3 streams +>>16 byte &0x08 \b, 4 or more streams +>>16 byte &0x10 \b, 8 or more streams +>>4 byte &0x80 \b, Copyrighted +>>13 byte &0x40 \b, Original Source +>>13 byte &0x20 \b, Home Flag +>4 byte ^0x80 +>>4 byte &0x10 \b, VBR +>>4 byte ^0x10 \b, CBR +>>7 byte&0x1E 0x02 \b, single stream +>>7 byte&0x1E 0x04 \b, 2 streams +>>7 byte&0x1E 0x06 \b, 3 streams +>>7 byte &0x08 \b, 4 or more streams +>>7 byte &0x10 \b, 8 or more streams +>>4 byte &0x40 \b, Original Stream(s) +>>4 byte &0x20 \b, Home Source + +# Live or stored single AAC stream (used with MPEG-2 systems) +0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC +>1 byte ^0x08 \b, v2 +>1 byte &0x08 \b, v4 +# profile +>>2 byte &0xC0 \b LTP +>2 byte&0xc0 0x00 \b, Main +>2 byte&0xc0 0x40 \b, LC +>2 byte&0xc0 0x80 \b, SSR +# timing +>2 byte&0x3c 0x00 \b, 96 kHz +>2 byte&0x3c 0x04 \b, 88.2 kHz +>2 byte&0x3c 0x08 \b, 64 kHz +>2 byte&0x3c 0x0c \b, 48 kHz +>2 byte&0x3c 0x10 \b, 44.1 kHz +>2 byte&0x3c 0x14 \b, 32 kHz +>2 byte&0x3c 0x18 \b, 24 kHz +>2 byte&0x3c 0x1c \b, 22.05 kHz +>2 byte&0x3c 0x20 \b, 16 kHz +>2 byte&0x3c 0x24 \b, 12 kHz +>2 byte&0x3c 0x28 \b, 11.025 kHz +>2 byte&0x3c 0x2c \b, 8 kHz +# channels/options +>2 beshort&0x01c0 0x0040 \b, monaural +>2 beshort&0x01c0 0x0080 \b, stereo +>2 beshort&0x01c0 0x00c0 \b, stereo + center +>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE +>2 beshort&0x01c0 0x0140 \b, surround +>2 beshort&0x01c0 0x0180 \b, surround + LFE +>2 beshort &0x01C0 \b, surround + side +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Custom Flag +#>3 byte &0x20 \b, Original Stream +#>3 byte &0x10 \b, Home Source +#>3 byte &0x08 \b, Copyrighted + +# Live MPEG-4 audio streams (instead of RTP FlexMux) +0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS +#>1 beshort&0x1FFF x \b, %u byte packet +>3 byte&0xE0 0x40 +>>4 byte&0x3C 0x04 \b, single stream +>>4 byte&0x3C 0x08 \b, 2 streams +>>4 byte&0x3C 0x0C \b, 3 streams +>>4 byte &0x08 \b, 4 or more streams +>>4 byte &0x20 \b, 8 or more streams +>3 byte&0xC0 0 +>>4 byte&0x78 0x08 \b, single stream +>>4 byte&0x78 0x10 \b, 2 streams +>>4 byte&0x78 0x18 \b, 3 streams +>>4 byte &0x20 \b, 4 or more streams +>>4 byte &0x40 \b, 8 or more streams +0 beshort 0x4DE1 MPEG-4 LO-EP audio stream # FLI animation format 4 leshort 0xAF11 FLI file @@ -166,16 +567,31 @@ # SGI formats 0 string MOVI Silicon Graphics movie file -# Apple Quicktime: Scan for all known top-level QT atom markers -4 string moov Apple QuickTime movie file (moov) -4 string mdat Apple QuickTime movie file (mdat) -4 string ftyp Apple QuickTime movie file (ftyp) -4 string free Apple QuickTime movie file (free) -4 string junk Apple QuickTime movie file (junk) -4 string pnot Apple QuickTime movie file (pnot) -4 string skip Apple QuickTime movie file (skip) -4 string wide Apple QuickTime movie file (wide) -4 string pict Apple QuickTime movie file (pict) +# Apple Quicktime and ISO types +4 string moov Apple QuickTime +>12 string mvhd \b movie (fast start) +>12 string mdra \b URL +>12 string cmov \b movie (fast start, compressed header) +>12 string rmra \b multiple URLs +4 string mdat Apple QuickTime movie (unoptimized) +4 string wide Apple QuickTime movie (unoptimized) +4 string skip Apple QuickTime movie (modified) +4 string free Apple QuickTime movie (modified) +4 string idsc Apple QuickTime image (fast start) +4 string idat Apple QuickTime image (unoptimized) +4 string pckg Apple QuickTime compressed archive +4 string/B jP JPEG 2000 image +4 string ftyp ISO Media +>8 string isom \b, MPEG v4 system +>8 string mp41 \b, MPEG v4 system, version 1 +>8 string mp42 \b, MPEG v4 system, version 2 +>8 string/B jp2 \b, JPEG 2000 image +>8 string 3gp \b, MPEG v4 system, 3GPP (H.263/AMR) +>8 string mmp4 \b, MPEG v4 system, Mobile +>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC +>8 string/B M4P \b, MPEG v4 system, ISMA encrypted AAC-LC +>8 string/B M4B \b, MPEG v4 system, iTunes AAC-LC/AMR +>8 string/B qt \b, Apple QuickTime movie # iso 13818 transport stream # diff --git a/magic/Magdir/archive b/magic/Magdir/archive index 070feab6..84a55a3e 100644 --- a/magic/Magdir/archive +++ b/magic/Magdir/archive @@ -128,7 +128,9 @@ # version (not tested)] #0 byte 0x1a RISC OS archive #>1 string archive (ArcFS format) -0 string \032archive RISC OS archive (ArcFS format) +#0 string \032archive RISC OS archive (ArcFS format) +0 string \032 RISC OS archive (spark format) +0 string Archive\000 RISC OS archive (ArcFS format) # ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data diff --git a/magic/Magdir/audio b/magic/Magdir/audio index 6a4ef95a..ccdf14cc 100644 --- a/magic/Magdir/audio +++ b/magic/Magdir/audio @@ -398,3 +398,14 @@ # From "Simon Hosie 0 string TFMX-SONG TFMX module sound data + +# From danny.milo@gmx.net (Danny Milosavljevic) +# monkeysaudio for magic.mime +0 string MAC\ X/Monkey audio, +>4 leshort >0 version %d, +>6 leshort >0 compression level %d, +>8 leshort >0 flags %x, +>10 leshort >0 channels %d, +>12 lelong >0 samplerate %d, +>24 lelong >0 frames %d + diff --git a/magic/Magdir/console b/magic/Magdir/console index ff5a1526..fdad7c4e 100644 --- a/magic/Magdir/console +++ b/magic/Magdir/console @@ -153,3 +153,45 @@ # Microsoft Xbox data file formats 0 string XIP0 XIP, Microsoft Xbox data 0 string XTF0 XTF, Microsoft Xbox data + +# Atari Lynx cartridge dump (EXE/BLL header) +# From: "Stefan A. Haubenthal" + +0 beshort 0x8008 Lynx cartridge, +>2 beshort x RAM start $%04x +>6 string BS93 + +#------------------------------------------------------------------------------ +# Z-machine: file(1) magic for Z-machine binaries. +# +# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which +# appears to be a version-0 Z-machine binary. +# +# The (false match) message is to correct that behavior. Perhaps it is +# not needed. +# +>16 belong&0xfe00f0f0 0x3030 Infocom game data +>0 ubyte 0 (false match) +>0 ubyte >0 (Z-machine %d, +>>2 ubeshort x Release %d / +>>18 string >\0 Serial %.6s) + +#------------------------------------------------------------------------------ +# Glulx: file(1) magic for Glulx binaries. +# +# I haven't checked for false matches yet. +# +0 string Glul Glulx game data + + + +# These go at the end of the iff rules +# +# I don't see why these might collide with anything else. +# +# Interactive Fiction related formats +# +>8 string IFRS \b, Blorb Interactive Fiction +>>24 string Exec with executable chunk +>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) + diff --git a/magic/Magdir/elf b/magic/Magdir/elf index 10aac069..1dee0bd8 100644 --- a/magic/Magdir/elf +++ b/magic/Magdir/elf @@ -104,6 +104,7 @@ >>18 leshort 53 Motorola M68HC12, >>18 leshort 62 AMD x86-64, >>18 leshort 75 Digital VAX, +>>18 leshort 88 Renesas M32R, >>18 leshort 97 NatSemi 32k, >>18 leshort 0x9026 Alpha (unofficial), >>20 lelong 0 invalid version @@ -192,6 +193,7 @@ >>18 beshort 53 Motorola M68HC12, >>18 beshort 73 Cray NV1, >>18 beshort 75 Digital VAX, +>>18 beshort 88 Renesas M32R, >>18 beshort 97 NatSemi 32k, >>18 beshort 0x9026 Alpha (unofficial), >>18 beshort 0xa390 IBM S/390 (obsolete), diff --git a/magic/Magdir/esri b/magic/Magdir/esri new file mode 100644 index 00000000..35c34923 --- /dev/null +++ b/magic/Magdir/esri @@ -0,0 +1,27 @@ + +#------------------------------------------------------------------------------ +# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) +# Based on info from +# +0 belong 9994 ESRI Shapefile +>4 belong =0 +>8 belong =0 +>12 belong =0 +>16 belong =0 +>20 belong =0 +>28 lelong x version %d +>24 belong x length %d +>32 lelong =0 type Null Shape +>32 lelong =1 type Point +>32 lelong =3 type PolyLine +>32 lelong =5 type Polygon +>32 lelong =8 type MultiPoint +>32 lelong =11 type PointZ +>32 lelong =13 type PolyLineZ +>32 lelong =15 type PolygonZ +>32 lelong =18 type MultiPointZ +>32 lelong =21 type PointM +>32 lelong =23 type PolyLineM +>32 lelong =25 type PolygonM +>32 lelong =28 type MultiPointM +>32 lelong =31 type MultiPatch diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems index c7985258..5a4ac236 100644 --- a/magic/Magdir/filesystems +++ b/magic/Magdir/filesystems @@ -126,6 +126,9 @@ >>>>>>71 string =NO\ NAME \b, unlabeled ### FATs end >0x200 lelong 0x82564557 \b, BSD disklabel +# FATX +0 string FATX FATX filesystem data + # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f Minix filesystem diff --git a/magic/Magdir/linux b/magic/Magdir/linux index 1b8961c2..37c41bb4 100644 --- a/magic/Magdir/linux +++ b/magic/Magdir/linux @@ -172,3 +172,9 @@ # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable +# SYSLINUX boot logo files (from 'ppmtolss16' sources) +# http://syslinux.zytor.com/ +# +0 lelong =0x1413f33d SYSLINUX' LSS16 image data +>4 leshort x \b, width %d +>6 leshort x \b, height %d diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos index 1c707d46..3c230b74 100644 --- a/magic/Magdir/msdos +++ b/magic/Magdir/msdos @@ -149,6 +149,16 @@ 0 string regf Windows NT registry file 0 string CREG Windows 95 registry file + +# AAF files: +# Stuart Cunningham +0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage +>30 byte 9 (512B sectors) +>30 byte 12 (4kB sectors) +0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage +>30 byte 9 (512B sectors) +>30 byte 12 (4kB sectors) + # Popular applications 2080 string Microsoft\ Word\ 6.0\ Document %s 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data @@ -374,3 +384,23 @@ >4 byte =0xC6 Folder database >4 byte =0xC7 Accounts informations >4 byte =0x30 Offline database + + +# Windows Enhanced Metafile (EMF) +# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp +# for further information. Note that "0 lelong 1" should be true i.e. +# the first double word in the file should be 1. With the extended +# syntax available by some file commands you could write: +# 0 lelong 1 +# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data +40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data +>44 ulelong x version 0x%x. +# If the description has a length greater than zero, it exists and is +# found at offset (*64). +>64 ulelong >0 Description available at offset 0x%x +>>60 ulelong >0 (length 0x%x) +# Note it would be better to print out the description, which is found +# as below. Unfortunately the following only prints out the first couple +# of characters instead of all the "description length" +# number of characters -- indicated by the ulelong at offset 60. +>>(64.l) lestring16 >0 Description: %15.15s diff --git a/magic/Magdir/os9 b/magic/Magdir/os9 index df3bd1d8..ed2ed2ca 100644 --- a/magic/Magdir/os9 +++ b/magic/Magdir/os9 @@ -37,10 +37,10 @@ >6 byte&0x0f 0x00 non-executable >6 byte&0x0f 0x01 machine language >6 byte&0x0f 0x02 BASIC I-code ->6 byte&0x0f 0x03 P-code +>6 byte&0x0f 0x03 Pascal P-code >6 byte&0x0f 0x04 C I-code >6 byte&0x0f 0x05 COBOL I-code ->6 byte&0x0f 0x06 FORTRAN I-code +>6 byte&0x0f 0x06 Fortran I-code # >6 byte&0xf0 0x10 program executable >6 byte&0xf0 0x20 subroutine @@ -57,28 +57,28 @@ 0 beshort 0x4AFC OS9/68K module: # # attr ->14 byte&0x80 0x80 re-entrant ->14 byte&0x40 0x40 ghost ->14 byte&0x20 0x20 system-state +>0x14 byte&0x80 0x80 re-entrant +>0x14 byte&0x40 0x40 ghost +>0x14 byte&0x20 0x20 system-state # # lang: # ->13 byte 1 machine language ->13 byte 2 BASIC I-code ->13 byte 3 P-code ->13 byte 4 C I-code ->13 byte 5 COBOL I-code ->13 byte 6 Fortran I-code +>0x13 byte 1 machine language +>0x13 byte 2 BASIC I-code +>0x13 byte 3 Pascal P-code +>0x13 byte 4 C I-code +>0x13 byte 5 COBOL I-code +>0x13 byte 6 Fortran I-code # # # type: # ->12 byte 1 program executable ->12 byte 2 subroutine ->12 byte 3 multi-module ->12 byte 4 data module ->12 byte 11 trap library ->12 byte 12 system module ->12 byte 13 file manager ->12 byte 14 device driver ->12 byte 15 device descriptor +>0x12 byte 1 program executable +>0x12 byte 2 subroutine +>0x12 byte 3 multi-module +>0x12 byte 4 data module +>0x12 byte 11 trap library +>0x12 byte 12 system module +>0x12 byte 13 file manager +>0x12 byte 14 device driver +>0x12 byte 15 device descriptor diff --git a/magic/Magdir/perl b/magic/Magdir/perl index f70b8dcc..417220e8 100644 --- a/magic/Magdir/perl +++ b/magic/Magdir/perl @@ -17,3 +17,17 @@ # XXX: christos matches #0 regex package Perl5 module source text (via regex) 0 string package Perl5 module source text + +# Perl Storable data files. +0 string perl-store perl Storable(v0.6) data +>4 byte >0 (net-order %d) +>>4 byte &01 (network-ordered) +>>4 byte =3 (major 1) +>>4 byte =2 (major 1) + +0 string pst0 perl Storable(v0.7) data +>4 byte >0 +>>4 byte &01 (network-ordered) +>>4 byte =5 (major 2) +>>4 byte =4 (major 2) +>>5 byte >0 (minor %d) diff --git a/magic/Magdir/sniffer b/magic/Magdir/sniffer index b45b63e9..282c44fe 100644 --- a/magic/Magdir/sniffer +++ b/magic/Magdir/sniffer @@ -32,6 +32,7 @@ # # Network General Sniffer capture files. # Sorry, make that "Network Associates Sniffer capture files." +# Sorry, make that "Network General old DOS Sniffer capture files." # 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file >33 byte 2 (compressed) @@ -54,6 +55,7 @@ # Sorry, make that "Network Associates Sniffer Basic capture files." # Sorry, make that "Network Associates Sniffer Basic, and Windows # Sniffer Pro", capture files." +# Sorry, make that "Network General Sniffer capture files." # 0 string XCP\0 NetXRay capture file >4 string >\0 - version %s @@ -88,8 +90,10 @@ >20 belong 12 (raw IP >20 belong 13 (BSD/OS SLIP >20 belong 14 (BSD/OS PPP +>20 belong 19 (Linux ATM Classical IP >20 belong 50 (PPP or Cisco HDLC >20 belong 51 (PPP-over-Ethernet +>20 belong 99 (Symantec Enterprise Firewall >20 belong 100 (RFC 1483 ATM >20 belong 101 (raw IP >20 belong 102 (BSD/OS SLIP @@ -105,13 +109,32 @@ >20 belong 114 (LocalTalk >20 belong 117 (OpenBSD PFLOG >20 belong 119 (802.11 with Prism header +>20 belong 122 (RFC 2625 IP over Fibre Channel >20 belong 123 (SunATM >20 belong 127 (802.11 with radiotap header >20 belong 129 (Linux ARCNET +>20 belong 138 (Apple IP over IEEE 1394 >20 belong 140 (MTP2 >20 belong 141 (MTP3 >20 belong 143 (DOCSIS >20 belong 144 (IrDA +>20 belong 147 (Private use 0 +>20 belong 148 (Private use 1 +>20 belong 149 (Private use 2 +>20 belong 150 (Private use 3 +>20 belong 151 (Private use 4 +>20 belong 152 (Private use 5 +>20 belong 153 (Private use 6 +>20 belong 154 (Private use 7 +>20 belong 155 (Private use 8 +>20 belong 156 (Private use 9 +>20 belong 157 (Private use 10 +>20 belong 158 (Private use 11 +>20 belong 159 (Private use 12 +>20 belong 160 (Private use 13 +>20 belong 161 (Private use 14 +>20 belong 162 (Private use 15 +>20 belong 163 (802.11 with AVS header >16 belong x \b, capture length %d) 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) >4 leshort x - version %d @@ -131,8 +154,10 @@ >20 lelong 12 (raw IP >20 lelong 13 (BSD/OS SLIP >20 lelong 14 (BSD/OS PPP +>20 lelong 19 (Linux ATM Classical IP >20 lelong 50 (PPP or Cisco HDLC >20 lelong 51 (PPP-over-Ethernet +>20 lelong 99 (Symantec Enterprise Firewall >20 lelong 100 (RFC 1483 ATM >20 lelong 101 (raw IP >20 lelong 102 (BSD/OS SLIP @@ -142,19 +167,38 @@ >20 lelong 106 (Linux Classical IP over ATM >20 lelong 107 (Frame Relay >20 lelong 108 (OpenBSD loopback ->20 lelong 109 (OpenBSD IPSEC encrypted +>20 lelong 109 (OpenBSD IPsec encrypted >20 lelong 112 (Cisco HDLC >20 lelong 113 (Linux "cooked" >20 lelong 114 (LocalTalk >20 lelong 117 (OpenBSD PFLOG >20 lelong 119 (802.11 with Prism header +>20 lelong 122 (RFC 2625 IP over Fibre Channel >20 lelong 123 (SunATM >20 lelong 127 (802.11 with radiotap header >20 lelong 129 (Linux ARCNET +>20 lelong 138 (Apple IP over IEEE 1394 >20 lelong 140 (MTP2 >20 lelong 141 (MTP3 >20 lelong 143 (DOCSIS >20 lelong 144 (IrDA +>20 lelong 147 (Private use 0 +>20 lelong 148 (Private use 1 +>20 lelong 149 (Private use 2 +>20 lelong 150 (Private use 3 +>20 lelong 151 (Private use 4 +>20 lelong 152 (Private use 5 +>20 lelong 153 (Private use 6 +>20 lelong 154 (Private use 7 +>20 lelong 155 (Private use 8 +>20 lelong 156 (Private use 9 +>20 lelong 157 (Private use 10 +>20 lelong 158 (Private use 11 +>20 lelong 159 (Private use 12 +>20 lelong 160 (Private use 13 +>20 lelong 161 (Private use 14 +>20 lelong 162 (Private use 15 +>20 lelong 163 (802.11 with AVS header >16 lelong x \b, capture length %d) # @@ -231,3 +275,23 @@ # 0 string NetS NetStumbler log file >8 lelong x \b, %d stations found + +# +# EtherPeek/AiroPeek "version 9" capture files. +# +0 string \177ver EtherPeek/AiroPeek capture file + +# +# Visual Networks traffic capture files. +# +0 string \x05VNF Visual Networks traffic capture file + +# +# Network Instruments Observer capture files. +# +0 string ObserverPktBuffe Network Instruments Observer capture file + +# +# Files from Accellent Group's 5View products. +# +0 string \xaa\xaa\xaa\xaa 5View capture file diff --git a/magic/Magdir/virtutech b/magic/Magdir/virtutech new file mode 100644 index 00000000..cea8443b --- /dev/null +++ b/magic/Magdir/virtutech @@ -0,0 +1,10 @@ +#------------------------------------------------------------------------------ +# Virtutech Compressed Random Access File Format +# +# From +0 string \211\277\036\203 Virtutech CRAFF +>4 belong x v%d +>20 belong 0 uncompressed +>20 belong 1 bzipp2ed +>20 belong 2 gzipped +>24 belong 0 not clean diff --git a/magic/Makefile.am b/magic/Makefile.am index 0c716df5..8c46869f 100644 --- a/magic/Makefile.am +++ b/magic/Makefile.am @@ -67,11 +67,11 @@ Magdir/diff \ Magdir/digital \ Magdir/dolby \ Magdir/dump \ -Magdir/dyadic \ Magdir/editors \ Magdir/elf \ Magdir/encore \ Magdir/epoc \ +Magdir/esri \ Magdir/fcs \ Magdir/filesystems \ Magdir/flash \ @@ -169,6 +169,7 @@ Magdir/sinclair \ Magdir/sketch \ Magdir/smalltalk \ Magdir/sniffer \ +Magdir/dyadic \ Magdir/softquad \ Magdir/spectrum \ Magdir/sql \ @@ -189,6 +190,7 @@ Magdir/varied.out \ Magdir/varied.script \ Magdir/vax \ Magdir/vicar \ +Magdir/virtutech \ Magdir/visx \ Magdir/vms \ Magdir/vmware \ diff --git a/magic/magic.mime b/magic/magic.mime index d314c4f4..0f9dcd71 100644 --- a/magic/magic.mime +++ b/magic/magic.mime @@ -184,9 +184,8 @@ 0 string RIFF # - WAVE format >8 string WAVE audio/x-wav ->8 string AVI video/x-msvideo +>8 string/B AVI video/x-msvideo # -0 belong 0x2e7261fd application/x-realaudio >8 string CDRA image/x-coreldraw @@ -588,20 +587,40 @@ # # animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8) # MPEG file -0 belong 0x000001b3 video/mpeg -0 belong 0x000001ba video/mpeg +# MPEG sequences +0 belong 0x000001BA video/mpeg +0 belong 0x000001BB video/mpeg +0 belong 0x000001B0 video/mp4v-es +0 belong 0x000001B5 video/mp4v-es +0 belong 0x000001B3 video/mpv +0 belong&0xFF5FFF1F 0x47400010 video/mp2t # FLI animation format 0 leshort 0xAF11 video/fli # FLC animation format 0 leshort 0xAF12 video/flc -# AVI ->8 string AVI\ video/avi # # SGI and Apple formats -# -0 string MOVI video/sgi -4 string moov video/quicktime moov -4 string mdat video/quicktime mdat +# Added ISO mimes +# Added ISO mimes +0 string MOVI video/sgi +4 string moov video/quicktime +4 string mdat video/quicktime +4 string wide video/quicktime +4 string skip video/quicktime +4 string free video/quicktime +4 string idsc image/x-quicktime +4 string idat image/x-quicktime +4 string pckg application/x-quicktime +4 string/B jP image/jp2 +4 string ftyp application/octet-stream +>8 string isom video/mp4 +>8 string mp41 video/mp4 +>8 string mp42 video/mp4 +>8 string/B jp2 image/jp2 +>8 string 3gp video/3gpp +>8 string mmp4 video/mp4 +>8 string/B M4A audio/mp4 +>8 string/B qt video/quicktime # The contributor claims: # I couldn't find a real magic number for these, however, this # -appears- to work. Note that it might catch other files, too, @@ -868,30 +887,6 @@ # Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 0 lelong 0x223e9f78 application/ms-tnef - -# -# QuickTime format -# Contributer: Peter Breton -# - -0 string MOVI video/quicktime -4 string moov video/quicktime -4 string mdat video/quicktime - -# Video Formate -0 string RIFF -# AVI == Audio Video Interleave ->8 string AVI\ -#>0xbc string >\0 video/x-%s - ->>0xbc string DIV3 video/x-DivX-3 ->>0xbc string div3 video/x-divX-3 ->>0xbc string DIV4 video/x-DivX-4 ->>0x70 string DX50 video/x-DIVX-5 ->>0x70 string MP4 video/x-MPEG-4 ->>0xbc string DIVX video/x-DivX ->8 string WAVE audio/x-wav - # From: stephane.loeuillet@tiscali.f # http://www.djvuzone.org/ 0 string AT&TFORM image/x.djvu @@ -903,5 +898,11 @@ # 0x9445366139FA (V 3.80) # this is from source (http://www.adrift.org.uk/) and I have some taf # files, and checked them. -#0 belong 0x3C423FC9 -#>4 belong 0x6A87C2CF application/x-adrift +#0 belong 0x3C423FC9 +#>4 belong 0x6A87C2CF application/x-adrift +#0 string \000\000\001\000 image/x-ico + +# Quark Xpress 3 Files: +# (made the mimetype up) +0 string \0\0MMXPR3\0 application/x-quark-xpress-3 + diff --git a/src/readelf.c b/src/readelf.c index e92843f8..e9fc0e74 100644 --- a/src/readelf.c +++ b/src/readelf.c @@ -37,7 +37,7 @@ #include "readelf.h" #ifndef lint -FILE_RCSID("@(#)$Id: readelf.c,v 1.43 2004/09/11 19:15:57 christos Exp $") +FILE_RCSID("@(#)$Id: readelf.c,v 1.44 2004/11/21 05:20:31 christos Exp $") #endif #ifdef ELFCORE @@ -411,48 +411,67 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, /* * Contents is __FreeBSD_version, whose relation to OS - * versions is defined by a huge table in the Porters' - * Handbook. For up to 5.x, the first three digits are - * the version number. For 5.x and higher, the scheme - * is: <0 if release branch, - * otherwise 1>xx + * versions is defined by a huge table in the Porter's + * Handbook. This is the general scheme: + * + * Releases: + * Mmp000 (before 4.10) + * Mmi0p0 (before 5.0) + * Mmm0p0 + * + * Development branches: + * Mmpxxx (before 4.6) + * Mmp1xx (before 4.10) + * Mmi1xx (before 5.0) + * M000xx (pre-M.0) + * Mmm1xx + * + * M = major version + * m = minor version + * i = minor version increment (491000 -> 4.10) + * p = patchlevel + * x = revision + * + * The first release of FreeBSD to use ELF by default + * was version 3.0. */ - if (desc / 100000 < 5) { - if (desc / 10000 % 10 == 9) { - if (file_printf(ms, " %d.%d", desc / 100000, - 9 + desc / 1000 % 10) == -1) + if (desc == 460002) { + if (file_printf(ms, " 4.6.2") == -1) + return size; + } else if (desc < 460100) { + if (file_printf(ms, " %d.%d", desc / 100000, + desc / 10000 % 10) == -1) + return size; + if (desc / 1000 % 10 > 0) + if (file_printf(ms, ".%d", desc / 1000 % 10) + == -1) return size; - } else { - if (file_printf(ms, " %d.%d", desc / 100000, - desc / 10000 % 10) == -1) + if ((desc % 1000 > 0) || (desc % 100000 == 0)) + if (file_printf(ms, " (%d)", desc) == -1) + return size; + } else if (desc < 500000) { + if (file_printf(ms, " %d.%d", desc / 100000, + desc / 10000 % 10 + desc / 1000 % 10) == -1) + return size; + if (desc / 100 % 10 > 0) { + if (file_printf(ms, " (%d)", desc) == -1) + return size; + } else if (desc / 10 % 10 > 0) { + if (file_printf(ms, ".%d", desc / 10 % 10) + == -1) return size; - if (desc / 1000 % 10 > 0) - if (file_printf(ms, ".%d", desc / 1000 % 10) - == -1) - return size; - } - if (desc / 10000 % 10 > 5) { - desc %= 1000; - if (desc >= 100) { - if (file_printf(ms, "-STABLE (rev %d)", - desc % 100) == -1) - return size; - } else if (desc != 0) { - if (file_printf(ms, ".%d", desc) == -1) - return size; - } } } else { if (file_printf(ms, " %d.%d", desc / 100000, desc / 1000 % 100) == -1) return size; - desc %= 1000; - if (desc >= 100) { - if (file_printf(ms, "-CURRENT (rev %d)", - desc % 100) == -1) + if ((desc / 100 % 10 > 0) || + (desc % 100000 / 100 == 0)) { + if (file_printf(ms, " (%d)", desc) == -1) return size; - } else if (desc != 0) { - if (file_printf(ms, ".%d", desc / 10) == -1) + } else if (desc / 10 % 10 > 0) { + if (file_printf(ms, ".%d", desc / 10 % 10) + == -1) return size; } }