From: Ian Darwin Date: Fri, 19 Feb 1993 14:36:15 +0000 (+0000) Subject: Guy Harris's Jan '93 megadeltas. X-Git-Tag: FILE3_27~173 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3390617b107e3b21bb3d5d7d38f1712109c34e04;p=file Guy Harris's Jan '93 megadeltas. --- diff --git a/magic/Magdir/alliant b/magic/Magdir/alliant index a2eaa2bb..52ed628d 100644 --- a/magic/Magdir/alliant +++ b/magic/Magdir/alliant @@ -1,5 +1,11 @@ # # Alliant FX series a.out files: +# If the FX series is the one that had a processor with a 68K-derived +# instruction set, the "short" should probably become "beshort" and the +# "long" should probably become "belong". +# If it's the i860-based one, they should probably become either the +# big-endian or little-endian versions, depending on the mode they ran +# the 860 in.... # 0 short 0420 0420 Alliant virtual executable >2 short &0x0020 common library diff --git a/magic/Magdir/audio b/magic/Magdir/audio index 75b8ac2a..743c4b65 100644 --- a/magic/Magdir/audio +++ b/magic/Magdir/audio @@ -1,4 +1,8 @@ # Sound formats, from Jan Nicolai Langfeldt +# +# XXX -what the hell is the "mips" stuff doing there? It looks like +# the archive stuff from "iris".... +# 0 string .snd audio data: >12 long 1 8-bit u-law, >12 long 2 8-bit linear PCM, diff --git a/magic/Magdir/blit b/magic/Magdir/blit index 4f6bb7e6..0f4804da 100644 --- a/magic/Magdir/blit +++ b/magic/Magdir/blit @@ -1,5 +1,10 @@ # 68K Blit stuff as seen from 680x0 machine # Note that this 0407 conflicts with several other a.out formats... +# +# XXX - should this be redone with "be" and "le", so that it works on +# little-endian machines as well? If so, what's the deal with +# "VAX-order" and "VAX-order2"? +# #0 long 0407 68K Blit (standalone) executable #0 short 0407 VAX-order2 68K Blit (standalone) executable 0 short 03401 VAX-order 68K Blit (standalone) executable diff --git a/magic/Magdir/clipper b/magic/Magdir/clipper index c9ad7c71..f4e9fa73 100644 --- a/magic/Magdir/clipper +++ b/magic/Magdir/clipper @@ -1,25 +1,52 @@ -# CLIPPER -0 short 0575 CLIPPER executable (VAX #) ->20 short 0407 (writable text) +# +# Intergraph, formerly Fairchild, Clipper. +# +# XXX - what byte order does the Clipper use? +# +# XXX - what's the "!" stuff: +# +# >18 short !074000,000000 C1 R1 +# >18 short !074000,004000 C2 R1 +# >18 short !074000,010000 C3 R1 +# >18 short !074000,074000 TEST +# +# I shall assume it's ANDing the field with the first value and +# comparing it with the second, and rewrite it as: +# +# >18 short&074000 000000 C1 R1 +# >18 short&074000 004000 C2 R1 +# >18 short&074000 010000 C3 R1 +# >18 short&074000 074000 TEST +# +# as SVR3.1's "file" doesn't support anything of the "!074000,000000" +# sort, nor does SunOS 4.x, so either it's something Intergraph added +# in CLIX, or something AT&T added in SVR3.2 or later, or something +# somebody else thought was a good idea; it's not documented in the +# man page for this version of "magic", nor does it appear to be +# implemented (at least not after I blew off the bogus code to turn +# old-style "&"s into new-style "&"s, which just didn't work at all). +# +0 short 0575 CLIPPER COFF executable (VAX #) +>20 short 0407 (impure) >20 short 0410 (5.2 compatible) ->20 short 0411 (swapped) ->20 short 0413 (paged) +>20 short 0411 (pure) +>20 short 0413 (demand paged) >20 short 0443 (target shared library) >12 long >0 not stripped >22 short >0 - version %ld -0 short 0577 CLIPPER executable ->18 short !074000,000000 C1 R1 ->18 short !074000,004000 C2 R1 ->18 short !074000,010000 C3 R1 ->18 short !074000,074000 TEST ->20 short 0407 (writable text) ->20 short 0410 (swapped) +0 short 0577 CLIPPER COFF executable +>18 short&074000 000000 C1 R1 +>18 short&074000 004000 C2 R1 +>18 short&074000 010000 C3 R1 +>18 short&074000 074000 TEST +>20 short 0407 (impure) +>20 short 0410 (pure) >20 short 0411 (separate I&D) >20 short 0413 (paged) >20 short 0443 (target shared library) >12 long >0 not stripped >22 short >0 - version %ld ->48 long !01,01 alignment trap enabled +>48 long&01 01 alignment trap enabled >52 byte 1 -Ctnc >52 byte 2 -Ctsw >52 byte 3 -Ctpw diff --git a/magic/Magdir/commands b/magic/Magdir/commands index dc47a49b..4431ff4f 100644 --- a/magic/Magdir/commands +++ b/magic/Magdir/commands @@ -2,6 +2,10 @@ # Magic.shell: Shell Scripts # "Commands": stuff for various shells and interpreters. # +# XXX - should "... script" have "text" appended to it? +# Or is there no guarantee that the script in question is, in fact, +# all text? +# 0 string :\ shell archive or commands for antique kernel text 0 string #!/bin/sh Bourne Shell script 0 string #!\ /bin/sh Bourne Shell script @@ -32,7 +36,12 @@ 0 string #!\ /bin/perl perl commands text 0 string eval\ "exec\ /bin/perl perl commands text +# # An "antique" kernel is either unmodified early V7, # without DMR's 1979 mod for #!, or any kernel -# derived from a pre-v7 kernel (i.e., System V) +# derived from a such a kernel (e.g., vanilla AT&T System V +# prior to SVR4) +# +# XXX - why is this here *twice*? +# 0 string :\ shell archive or commands for antique kernel text diff --git a/magic/Magdir/compress b/magic/Magdir/compress index 1f11f147..d4693476 100644 --- a/magic/Magdir/compress +++ b/magic/Magdir/compress @@ -1,8 +1,30 @@ -# Formats for "compress" proper have been moved into "compress.c". # -0 short 017037 packed data -# CPL - added pack to /etc/magic +# Formats for various forms of compressed data +# Formats for "compress" proper have been moved into "compress.c", +# because it tries to uncompress it to figure out what's inside. +# +# XXX - the two "packed data" versions are byte-swapped versions of +# one another; is that because the 2-byte magic number is written +# out in native byte order, with "unpack" figuring out the byte order +# from the magic number (in which case both can be left as is, or +# changed to specify a byte order *and* to indicate the byte order of +# the packing machine), or because the old "file" didn't have any way of +# having "magic"-file entries that specified a particular byte order? +# 0 short 017436 packed data +0 short 017037 packed data + +# +# This magic number is byte-order-independent. +# +0 short 017437 old packed data + +# +# XXX - why *two* entries for "compacted data", one of which is +# byte-order independent, and one of which is byte-order dependent? +# +0 short 0x1fff compacted data +0 string \377\037 compacted data 0 short 0145405 huf output # # Squeeze and Crunch... diff --git a/magic/Magdir/convex b/magic/Magdir/convex index 560fd485..0220a814 100644 --- a/magic/Magdir/convex +++ b/magic/Magdir/convex @@ -1 +1,4 @@ +# +# XXX - what byte order does a Convex use? +# 0 long 0513 Convex executable diff --git a/magic/Magdir/diamond b/magic/Magdir/diamond index abf712da..d515d61f 100644 --- a/magic/Magdir/diamond +++ b/magic/Magdir/diamond @@ -1,5 +1,8 @@ +# # ... diamond is a multi-media mail and electronic conferencing system.... # +# XXX - I think it was either renamed Slate, or replaced by Slate.... +# # The full deal is too long... #0 string \n Diamond Multimedia Document 0 string =\n4 date x Previous dump %s, >8 date x This dump %s, diff --git a/magic/Magdir/elf b/magic/Magdir/elf index fb47f213..e34332dc 100644 --- a/magic/Magdir/elf +++ b/magic/Magdir/elf @@ -1,18 +1,44 @@ +# # ELF -0 string ELF ELF +# Missing MIPS image type and flags +# +# Question marks on processor types flag "should not happen because the +# byte order is wrong". We have to check the byte order flag to see what +# byte order all the other stuff in the header is in. +# +0 string \177ELF ELF +>4 byte 0 invalid class >4 byte 1 32-bit +>4 byte 2 64-bit +>5 byte 0 invalid byte order >5 byte 1 LSB +>>16 leshort 0 unknown type +>>16 leshort 1 relocatable +>>16 leshort 2 executable +>>16 leshort 3 dynamic lib +>>16 leshort 4 core file +>>18 leshort 0 unknown machine +>>18 leshort 1 WE32100 and up +>>18 leshort 2 SPARC? +>>18 leshort 3 i386 (386 and up) +>>18 leshort 4 M68000? +>>18 leshort 5 M88000? +>>18 leshort 7 i860 +>>20 lelong 1 Version 1 +>>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB ->16 short 0 unknown type ->16 short 1 relocatable ->16 short 2 executable ->16 short 3 dynamic lib ->16 short 4 core file ->18 short 0 unknown machine ->18 short 1 WE32100 ->18 short 2 SPARC ->18 short 3 80386 ->18 short 4 M68000 ->18 short 5 M88000 ->20 long 1 Version 1 ->36 long 1 MathCoPro/FPU/MAU Required +>>16 beshort 0 unknown type +>>16 beshort 1 relocatable +>>16 beshort 2 executable +>>16 beshort 3 dynamic lib +>>16 beshort 4 core file +>>18 beshort 0 unknown machine +>>18 beshort 1 WE32100 and up +>>18 beshort 2 SPARC +>>18 beshort 3 i386 (386 and up)? +>>18 beshort 4 M68000 +>>18 beshort 5 M88000 +>>18 beshort 7 i860 +>>20 belong 1 Version 1 +>>36 belong 1 MathCoPro/FPU/MAU Required + diff --git a/magic/Magdir/encore b/magic/Magdir/encore index 276db51d..7244f87a 100644 --- a/magic/Magdir/encore +++ b/magic/Magdir/encore @@ -1,6 +1,9 @@ # # magic.encore: Recognize encore machines # +# XXX - needs to have the byte order specified (NS32K was little-endian, +# dunno whether they run the 88K in little-endian mode or not). +# 0 short 0x154 Encore >20 short 0x107 executable >20 short 0x108 pure executable diff --git a/magic/Magdir/hp b/magic/Magdir/hp index 78db1c0a..1353d8c1 100644 --- a/magic/Magdir/hp +++ b/magic/Magdir/hp @@ -1,60 +1,80 @@ # # magic.hp: Hewlett Packard Magic # +# XXX - somebody should figure out whether any byte order needs to be +# applied to the "TML" stuff; I'm assuming the Apollo stuff is +# big-endian as it was mostly 68K-based. +# +# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I +# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first +# showed up in the 700 series, although later 800 series machines are, +# I think, based on the PA7100 which implements HP-PA 1.1) are flagged +# as big-endian. +# +# I think the 500 series was the old stack-based machines, running a +# UNIX environment atop the "SUN kernel"; dunno whether it was +# big-endian or little-endian. +# +# I'm guessing that the 200 series was 68K-based; the 300 and 400 series +# are. +# +# The "misc" stuff needs a byte order; the archives look suspiciously +# like the old 177545 archives (0xff65 = 0177545). +# #### Old Apollo stuff -0 short 0627 Apollo m68k COFF executable ->18 short ^040000 not stripped ->22 short >0 - version %ld -0 short 0624 apollo a88k COFF executable ->18 short ^040000 not stripped ->22 short >0 - version %ld +0 beshort 0627 Apollo m68k COFF executable +>18 beshort ^040000 not stripped +>22 beshort >0 - version %ld +0 beshort 0624 apollo a88k COFF executable +>18 beshort ^040000 not stripped +>22 beshort >0 - version %ld 0 long 01203604016 TML 0123 byte-order format 0 long 01702407010 TML 1032 byte-order format 0 long 01003405017 TML 2301 byte-order format 0 long 01602007412 TML 3210 byte-order format #### HPPA -0 long 0x02100106 HPPA-RISC1.1 relocatable object -0 long 0x02100107 HPPA-RISC1.1 executable ->(144) long 0x054ef630 dynamically linked ->96 long >0 -not stripped +0 belong 0x02100106 HPPA-RISC1.1 relocatable object +0 belong 0x02100107 HPPA-RISC1.1 executable +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 -not stripped -0 long 0x02100108 HPPA-RISC1.1 shared executable ->(144) long 0x054ef630 dynamically linked ->96 long >0 -not stripped +0 belong 0x02100108 HPPA-RISC1.1 shared executable +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 -not stripped -0 long 0x0210010b HPPA-RISC1.1 demand-load executable ->(144) long 0x054ef630 dynamically linked ->96 long >0 -not stripped +0 belong 0x0210010b HPPA-RISC1.1 demand-load executable +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 -not stripped -0 long 0x0210010e HPPA-RISC1.1 shared library ->96 long >0 -not stripped +0 belong 0x0210010e HPPA-RISC1.1 shared library +>96 belong >0 -not stripped -0 long 0x0210010d HPPA-RISC1.1 dynamic load library ->96 long >0 -not stripped +0 belong 0x0210010d HPPA-RISC1.1 dynamic load library +>96 belong >0 -not stripped #### 800 -0 long 0x020b0106 HP s800 relocatable object +0 belong 0x020b0106 HP s800 relocatable object -0 long 0x020b0107 HP s800 executable ->(144) long 0x054ef630 dynamically linked ->96 long >0 -not stripped +0 belong 0x020b0107 HP s800 executable +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 -not stripped -0 long 0x020b0108 HP s800 shared executable ->(144) long 0x054ef630 dynamically linked ->96 long >0 -not stripped +0 belong 0x020b0108 HP s800 shared executable +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 -not stripped -0 long 0x020b010b HP s800 demand-load executable ->(144) long 0x054ef630 dynamically linked ->96 long >0 -not stripped +0 belong 0x020b010b HP s800 demand-load executable +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 -not stripped -0 long 0x020b010e HP s800 shared library ->96 long >0 -not stripped +0 belong 0x020b010e HP s800 shared library +>96 belong >0 -not stripped -0 long 0x020b010d HP s800 dynamic load library ->96 long >0 -not stripped +0 belong 0x020b010d HP s800 dynamic load library +>96 belong >0 -not stripped -0 long 0x213c6172 archive file ->68 long 0x020b0619 -HP s800 relocatable library +0 belong 0x213c6172 archive file +>68 belong 0x020b0619 -HP s800 relocatable library #### 500 0 long 0x02080106 HP s500 relocatable executable @@ -67,51 +87,51 @@ >16 long >0 -version %ld #### 200 -0 long 0x020c0108 HP s200 pure executable ->4 short >0 -version %ld ->8 long &0x80000000 save fp regs ->8 long &0x40000000 dynamically linked ->8 long &0x20000000 debuggable ->36 long >0 not stripped - -0 long 0x020c0107 HP s200 executable ->4 short >0 -version %ld ->8 long &0x80000000 save fp regs ->8 long &0x40000000 dynamically linked ->8 long &0x20000000 debuggable ->36 long >0 not stripped - -0 long 0x020c010b HP s200 demand-load executable ->4 short >0 -version %ld ->8 long &0x80000000 save fp regs ->8 long &0x40000000 dynamically linked ->8 long &0x20000000 debuggable ->36 long >0 not stripped - -0 long 0x020c0106 HP s200 relocatable executable ->4 short >0 -version %ld ->6 short >0 -highwater %d ->8 long &0x80000000 save fp regs ->8 long &0x20000000 debuggable ->8 long &0x10000000 PIC - -0 long 0x020a0108 HP s200 (2.x release) pure executable ->4 short >0 -version %ld ->36 long >0 not stripped - -0 long 0x020a0107 HP s200 (2.x release) executable ->4 short >0 -version %ld ->36 long >0 not stripped - -0 long 0x020c010e HP s200 shared library ->4 short >0 -version %ld ->6 short >0 -highwater %d ->36 long >0 not stripped - -0 long 0x020c010d HP s200 dynamic load library ->4 short >0 -version %ld ->6 short >0 -highwater %d ->36 long >0 not stripped +0 belong 0x020c0108 HP s200 pure executable +>4 beshort >0 -version %ld +>8 belong &0x80000000 save fp regs +>8 belong &0x40000000 dynamically linked +>8 belong &0x20000000 debuggable +>36 belong >0 not stripped + +0 belong 0x020c0107 HP s200 executable +>4 beshort >0 -version %ld +>8 belong &0x80000000 save fp regs +>8 belong &0x40000000 dynamically linked +>8 belong &0x20000000 debuggable +>36 belong >0 not stripped + +0 belong 0x020c010b HP s200 demand-load executable +>4 beshort >0 -version %ld +>8 belong &0x80000000 save fp regs +>8 belong &0x40000000 dynamically linked +>8 belong &0x20000000 debuggable +>36 belong >0 not stripped + +0 belong 0x020c0106 HP s200 relocatable executable +>4 beshort >0 -version %ld +>6 beshort >0 -highwater %d +>8 belong &0x80000000 save fp regs +>8 belong &0x20000000 debuggable +>8 belong &0x10000000 PIC + +0 belong 0x020a0108 HP s200 (2.x release) pure executable +>4 beshort >0 -version %ld +>36 belong >0 not stripped + +0 belong 0x020a0107 HP s200 (2.x release) executable +>4 beshort >0 -version %ld +>36 belong >0 not stripped + +0 belong 0x020c010e HP s200 shared library +>4 beshort >0 -version %ld +>6 beshort >0 -highwater %d +>36 belong >0 not stripped + +0 belong 0x020c010d HP s200 dynamic load library +>4 beshort >0 -version %ld +>6 beshort >0 -highwater %d +>36 belong >0 not stripped #### MISC 0 long 0x0000ff65 HP old archive diff --git a/magic/Magdir/ibm370 b/magic/Magdir/ibm370 index 6f3da142..b40fbf42 100644 --- a/magic/Magdir/ibm370 +++ b/magic/Magdir/ibm370 @@ -1,5 +1,19 @@ # -# magic.ibm370: +# IBM 370 and compatibles. # -0 short 0x15d ibm 370 pure executable ->12 long >0 not stripped +# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". +# What the heck *is* "USS/370"? +# +0 beshort 0531 SVR2 executable (Amdahl-UTS) +>12 belong >0 not stripped +>24 belong >0 - version %ld +0 beshort 0534 SVR2 pure executable (Amdahl-UTS) +>12 belong >0 not stripped +>24 belong >0 - version %ld +0 beshort 0530 SVR2 pure executable (USS/370) +>12 belong >0 not stripped +>24 belong >0 - version %ld +0 beshort 0535 SVR2 executable (USS/370) +>12 belong >0 not stripped +>24 belong >0 - version %ld + diff --git a/magic/Magdir/ibm6000 b/magic/Magdir/ibm6000 index 79f348aa..e4d73df4 100644 --- a/magic/Magdir/ibm6000 +++ b/magic/Magdir/ibm6000 @@ -1,13 +1,17 @@ +# # magic.rs6000: -0 short 0x01df executable (RISC System/6000 V3.1) or obj module ->12 long >0 not stripped +# +# RS/6000 and the RT PC. +# +0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module +>12 belong >0 not stripped # Breaks sun4 statically linked execs. -#0 short 0x0103 executable (RT Version 2) or obj module +#0 beshort 0x0103 executable (RT Version 2) or obj module #>2 byte 0x50 pure -#>28 long >0 not stripped -#>6 short >0 - version %ld -0 short 0x0104 shared library -0 short 0x0105 ctab data -0 short 0xfe04 structured file +#>28 belong >0 not stripped +#>6 beshort >0 - version %ld +0 beshort 0x0104 shared library +0 beshort 0x0105 ctab data +0 beshort 0xfe04 structured file 0 string 0xabcdef message catalog #0 string archive diff --git a/magic/Magdir/images b/magic/Magdir/images index cd027986..39970d27 100644 --- a/magic/Magdir/images +++ b/magic/Magdir/images @@ -2,6 +2,8 @@ # additions by janl@ifi.uio.no as well as others. Jan also suggested # merging several one- and two-line files into here. # +# XXX - byte order for GIF and TIFF fields? +# 0 string xbtoa btoa'd file diff --git a/magic/Magdir/interleaf b/magic/Magdir/interleaf index af726b05..ab5f3c65 100644 --- a/magic/Magdir/interleaf +++ b/magic/Magdir/interleaf @@ -2,3 +2,6 @@ # magic for InterLeaf TPS: 0 string =\210OPS Interleaf saved data 0 string =5 string ,\ Version\ (version +>>14 string >\0 %s) + diff --git a/magic/Magdir/ispell b/magic/Magdir/ispell index d226ce9d..04814b8f 100644 --- a/magic/Magdir/ispell +++ b/magic/Magdir/ispell @@ -1,6 +1,8 @@ # # magic.ispell # +# XXX - byte order? +# 0 short 0xffff9601 ispell hash file >2 short 0x00 - 8-bit, no capitalization, 26 flags >2 short 0x01 - 7-bit, no capitalization, 26 flags diff --git a/magic/Magdir/lif b/magic/Magdir/lif index b1037f16..9ac80b9c 100644 --- a/magic/Magdir/lif +++ b/magic/Magdir/lif @@ -1,4 +1,6 @@ # # magic.lif: # +# XXX - byte order? +# 0 short 0x8000 lif file diff --git a/magic/Magdir/mirage b/magic/Magdir/mirage index 28ee7786..8a2dbcbe 100644 --- a/magic/Magdir/mirage +++ b/magic/Magdir/mirage @@ -1 +1,4 @@ +# +# XXX - byte order? +# 0 long 31415 Mirage Assembler m.out executable diff --git a/magic/Magdir/mkid b/magic/Magdir/mkid index 8480bc33..cd2cf864 100644 --- a/magic/Magdir/mkid +++ b/magic/Magdir/mkid @@ -1,3 +1,7 @@ +# # ID is the binary tags database produced by mkid(1). +# +# XXX - byte order? +# 0 string \311\304 ID tags data >2 short >0 version %d diff --git a/magic/Magdir/motorola b/magic/Magdir/motorola index 0733b653..b8927946 100644 --- a/magic/Magdir/motorola +++ b/magic/Magdir/motorola @@ -1,8 +1,28 @@ +# # Motorola -0 short 0520 mc68k executable ->12 long >0 not stripped -0 short 0521 mc68k executable (shared) ->12 long >0 not stripped -0 short 0522 mc68k executable (shared demand paged) ->12 long >0 not stripped - +# +# 68K +# +0 beshort 0520 mc68k COFF +>18 beshort ^00000020 object +>18 beshort &00000020 executable +>12 belong >0 not stripped +>168 string .lowmem Apple toolbox +>20 beshort 0407 (impure) +>20 beshort 0410 (pure) +>20 beshort 0413 (demand paged) +>20 beshort 0421 (standalone) +0 beshort 0521 mc68k executable (shared) +>12 belong >0 not stripped +0 beshort 0522 mc68k executable (shared demand paged) +>12 belong >0 not stripped +# +# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) +# +0 beshort 0554 68K BCS executable +# +# 88K +# +# Motorola/88Open BCS +# +0 beshort 0555 88K BCS executable diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos index 8e8841b6..830493ae 100644 --- a/magic/Magdir/msdos +++ b/magic/Magdir/msdos @@ -1,23 +1,8 @@ -# various intel-CPU magic numbers -0 short 01006 80286 executable (STL) ->31 byte <0x040 small model ->31 byte =0x048 large model ->31 byte =0x049 huge model ->16 long >0 not stripped +# +# Various MS-DOS magic numbers +# 0 string MZ DOS executable (EXE) 0 string LZ DOS executable (built-in) 0 byte 0xe9 DOS executable (COM) 0 byte 0xeb DOS executable (COM) 0 byte 0xf0 MS-DOS program library -0 short =0512 80286 executable small model (COFF) ->12 long >0 not stripped ->22 short >0 - version %ld -0 short =0522 80286 executable large model (COFF) ->12 long >0 not stripped ->22 short >0 - version %ld -0 short =0514 80386 executable ->12 long >0 not stripped ->22 short >0 - version %ld -0 string PK zip archive file ->2 byte >0 - version [%d ->3 byte >0 %d] diff --git a/magic/Magdir/ncr b/magic/Magdir/ncr index 10f63ef9..89df7505 100644 --- a/magic/Magdir/ncr +++ b/magic/Magdir/ncr @@ -5,43 +5,43 @@ # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP # -0 short 000610 Tower/XP rel 2 object ->12 long >0 not stripped ->20 short 0407 executable ->20 short 0410 pure executable ->22 short >0 -version %ld -0 short 000615 Tower/XP rel 2 object ->12 long >0 not stripped ->20 short 0407 executable ->20 short 0410 pure executable ->22 short >0 -version %ld -0 short 000620 Tower/XP rel 3 object ->12 long >0 not stripped ->20 short 0407 executable ->20 short 0410 pure executable ->22 short >0 -version %ld -0 short 000625 Tower/XP rel 3 object ->12 long >0 not stripped ->20 short 0407 executable ->20 short 0410 pure executable ->22 short >0 -version %ld -0 short 000630 Tower32/600/400 68020 object ->12 long >0 not stripped ->20 short 0407 executable ->20 short 0410 pure executable ->22 short >0 -version %ld -0 short 000640 Tower32/800 68020 ->18 short &020000 w/68881 object ->18 short &040000 compatible object ->18 short &~060000 object ->20 short 0407 executable ->20 short 0413 pure executable ->12 long >0 not stripped ->22 short >0 -version %ld -0 short 000645 Tower32/800 68010 ->18 short &040000 compatible object ->18 short &~060000 object ->20 short 0407 executable ->20 short 0413 pure executable ->12 long >0 not stripped ->22 short >0 -version %ld +0 beshort 000610 Tower/XP rel 2 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000615 Tower/XP rel 2 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000620 Tower/XP rel 3 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000625 Tower/XP rel 3 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000630 Tower32/600/400 68020 object +>12 belong >0 not stripped +>20 beshort 0407 executable +>20 beshort 0410 pure executable +>22 beshort >0 - version %ld +0 beshort 000640 Tower32/800 68020 +>18 beshort &020000 w/68881 object +>18 beshort &040000 compatible object +>18 beshort &~060000 object +>20 beshort 0407 executable +>20 beshort 0413 pure executable +>12 belong >0 not stripped +>22 beshort >0 - version %ld +0 beshort 000645 Tower32/800 68010 +>18 beshort &040000 compatible object +>18 beshort &~060000 object +>20 beshort 0407 executable +>20 beshort 0413 pure executable +>12 belong >0 not stripped +>22 beshort >0 - version %ld diff --git a/magic/Magdir/old/ar b/magic/Magdir/old/ar index 1c567494..5ab63aea 100644 --- a/magic/Magdir/old/ar +++ b/magic/Magdir/old/ar @@ -1,22 +1,58 @@ # # "ar", for all kinds of archives. +# +# XXX - why are there multiple thingies? Note that 0x213c6172 is +# "! current ar archive +# 0 long 0x213c6172 archive file +# +# and for SVR3.1 archives, we have: +# +# 0 string \ System V Release 1 ar archive +# 0 string = archive +# 0 string = archive +# +# XXX - did Aegis really store shared libraries, breakpointed modules, +# and absolute code program modules in the same format as new-style +# "ar" archives? +# 0 string ! current ar archive >8 string __.SYMDEF random library ->0 long =65538 - pre SR9.5 ->0 long =65539 - post SR9.5 ->0 short 2 - object archive ->0 short 3 - shared library module ->0 short 4 - debug break-pointed module ->0 short 5 - absolute code program module +>0 belong =65538 - pre SR9.5 +>0 belong =65539 - post SR9.5 +>0 beshort 2 - object archive +>0 beshort 3 - shared library module +>0 beshort 4 - debug break-pointed module +>0 beshort 5 - absolute code program module 0 string \ System V Release 1 ar archive 0 string = archive -0 long 0xff6d obsolete ar archive +# +# XXX - from "vax", which appears to collect a bunch of byte-swapped +# thingies, to help you recognize VAX files on big-endian machines; +# with "leshort", "lelong", and "string", that's no longer necessary.... +# +# 0 long 0x3c61723e VAX 5.0 archive +# 0 long 0x213c6172 archive file -0 long 0177555 very old archive -0 short 0177555 very old PDP-11 archive -0 long 0177545 old archive -0 short 0177545 old PDP-11 archive +0 lelong 0177555 very old VAX archive +0 leshort 0177555 very old PDP-11 archive +# +# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus +# be a random library (it said 0xff65 rather than 0177545). +# +0 lelong 0177545 old VAX archive +>8 string __.SYMDEF random library +0 leshort 0177545 old PDP-11 archive +>8 string __.SYMDEF random library +# 0 string = archive +# +# From "pdp": +# +0 lelong 0x39bed PDP-11 old archive +0 lelong 0x39bee PDP-11 4.0 archive +# 0 string -h- Software Tools format archive text # "arc" archiver 0 byte 26 'arc' archive @@ -24,3 +60,7 @@ >1 byte 1 (old format) # Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu. 20 long 0xdca7c4fd Rahul Dhesi's "zoo" archive +# ZIP archiver +0 string PK zip archive file +>2 byte >0 - version [%d +>3 byte >0 %d] diff --git a/magic/Magdir/old/iris b/magic/Magdir/old/iris index cbb07aba..952a5f19 100644 --- a/magic/Magdir/old/iris +++ b/magic/Magdir/old/iris @@ -1,6 +1,11 @@ # # magic.iris: Magic for mips from an iris4d # +# Dunno what byte-order munging is needed; all of SGI's *current* +# machines and OSes run in big-endian mode on the MIPS machines, +# as far as I know, but they do have the MIPSEB and MIPSEL stuff +# here.... +# 0 short 0x0160 mipseb >20 short 0407 executable >20 short 0410 pure diff --git a/magic/Magdir/old/mips b/magic/Magdir/old/mips index e20492e8..ae17cbda 100644 --- a/magic/Magdir/old/mips +++ b/magic/Magdir/old/mips @@ -1,2 +1,8 @@ +# # RISC MIPS decstation +# Should this be "leshort", given that DEC ran the DECstations in +# little-endian mode? +# +# Where is the non-SGI, non-DEC MIPS stuff? +# 0 short 0x6201 MIPS executable diff --git a/magic/Magdir/old/postscript b/magic/Magdir/old/postscript index 494b478e..f367d290 100644 --- a/magic/Magdir/old/postscript +++ b/magic/Magdir/old/postscript @@ -1,7 +1,10 @@ # # magic.postscript: Magic for postscript files # +# XXX - should we match only versions 1.0 and 2.0, or should we wildcard +# it? +# 0 string %! PostScript document >2 string PS-Adobe- conforming ->11 string 1.0 at level %s ->11 string 2.0 at level %s +>>11 string 1.0 at level %s +>>11 string 2.0 at level %s diff --git a/magic/Magdir/old/sunraster b/magic/Magdir/old/sunraster index 10c297b1..864055c1 100644 --- a/magic/Magdir/old/sunraster +++ b/magic/Magdir/old/sunraster @@ -1,4 +1,8 @@ +# # Sun rasterfiles +# +# XXX - byte order? What about the 386i? +# 0 string \x59\xa6\x6a\x95 rasterfile >4 long >0 %d >8 long >0 x %d diff --git a/magic/Magdir/old/x11 b/magic/Magdir/old/x11 index d725027a..ed0ff440 100644 --- a/magic/Magdir/old/x11 +++ b/magic/Magdir/old/x11 @@ -1,4 +1,9 @@ # # magic.x11 # +# I think this is byte-order-dependent; if so, it should become: +# +# 0 belong 00000004 X11 big-endian snf font +# 0 lelong 00000004 X11 little-endian snf font +# 0 long 00000004 X11 snf font diff --git a/magic/Magdir/pbm b/magic/Magdir/pbm index db6eca1a..bed702e6 100644 --- a/magic/Magdir/pbm +++ b/magic/Magdir/pbm @@ -1 +1,4 @@ +# +# XXX - byte order? +# 0 short 0x2a17 "compact bitmap" format (Poskanzer) diff --git a/magic/Magdir/pdp b/magic/Magdir/pdp index 8eeda5d2..cf1129db 100644 --- a/magic/Magdir/pdp +++ b/magic/Magdir/pdp @@ -1,36 +1,22 @@ # -# magic.pdp: PDP 11 +# magic.pdp: PDP-11 executable/object and APL workspace # -0 long 0x39bed PDP-11 old archive -0 long 0x39bee PDP-11 4.0 archive -0 long 0x836c PDP-11 double precision APL workspace -0 long 0x836d PDP-11 single precision APL workspace +0 lelong 0101555 PDP-11 single precision APL workspace +0 lelong 0101554 PDP-11 double precision APL workspace -0 short 0177555 very old PDP-11 archive -0 short 0177545 old PDP-11 archive - -0 short 0407 PDP-11 executable ->8 short >0 not stripped - -0 short 0401 PDP-11 unix-rt ldp -0 short 0405 PDP-11 old overlay - -0 short 0410 PDP-11 pure executable ->8 short >0 not stripped -#>2 short >0 - version %ld +# +# PDP-11 a.out +# +0 leshort 0407 PDP-11 executable +>8 leshort >0 not stripped -0 short 0411 PDP-11 separate I&D executable ->8 short >0 not stripped -#>2 short >0 - version %ld +0 leshort 0401 PDP-11 UNIX/RT ldp +0 leshort 0405 PDP-11 old overlay -0 long 0413 PDP-11 demand paged pure executable ->16 long >0 not stripped -#>2 short >0 - version %ld +0 leshort 0410 PDP-11 pure executable +>8 leshort >0 not stripped -0 long 0420 PDP-11 demand paged (first page unmapped) pure executable ->16 long >0 not stripped -#>2 short >0 - version %ld -0 short 0437 PDP-11 kernel overlay +0 leshort 0411 PDP-11 separate I&D executable +>8 leshort >0 not stripped -0 short 0xff65 PDP-11/pre System V/old Sun ar archive ->8 string __.SYMDEF random library +0 leshort 0437 PDP-11 kernel overlay diff --git a/magic/Magdir/plus5 b/magic/Magdir/plus5 index 432e6482..a5fa4e7d 100644 --- a/magic/Magdir/plus5 +++ b/magic/Magdir/plus5 @@ -1,4 +1,8 @@ +# #/etc/magic entries for Plus Five's UNIX MUMPS +# +# XXX - byte order? Paging Hokey.... +# 0 short 0x259 mumps avl global >2 byte >0 (V%d) >6 byte >0 with %d byte name diff --git a/magic/Magdir/pyramid b/magic/Magdir/pyramid index c87175f2..b9c9e56c 100644 --- a/magic/Magdir/pyramid +++ b/magic/Magdir/pyramid @@ -1,6 +1,8 @@ # # magic.pyramid: Magic for pyramids # +# XXX - byte order? +# 0 long 0x50900107 Pyramid 90x family executable 0 long 0x50900108 Pyramid 90x family pure executable >16 long >0 not stripped diff --git a/magic/Magdir/sendmail b/magic/Magdir/sendmail index 07c167ab..7eea31d2 100644 --- a/magic/Magdir/sendmail +++ b/magic/Magdir/sendmail @@ -1,6 +1,8 @@ # # magic.sendmail: # +# XXX - byte order? +# 0 byte 046 Sendmail frozen configuration >16 string >\0 - version %s 0 short 0x271c Sendmail frozen configuration diff --git a/magic/Magdir/sequent b/magic/Magdir/sequent index 33e9e8e7..24e317b0 100644 --- a/magic/Magdir/sequent +++ b/magic/Magdir/sequent @@ -1,18 +1,10 @@ # Sequent information updated by Don Dwiggins . # For Sequent's multiprocessor systems (incomplete). -0 short 0x00ea BALANCE NS32000 .o -0 short 0x10ea BALANCE NS32000 executable (0 @ 0) ->16 long >0 not stripped -0 short 0x20ea BALANCE NS32000 executable (invalid @ 0) ->16 long >0 not stripped -0 short 0x30ea BALANCE NS32000 standalone executable ->16 long >0 not stripped -# The above seen byte-swapped, e.g. from a remote NFS mount -0 short 0xea00 BALANCE NS32000 .o (byte-swapped) -0 short 0xea10 BALANCE NS32000 executable (0 @ 0, byte-swapped) ->16 long >0 not stripped -0 short 0xea20 BALANCE NS32000 executable (invalid @ 0, byte-swapped) ->16 long >0 not stripped -0 short 0xea30 BALANCE NS32000 standalone executable (byte-swapped) ->16 long >0 not stripped +0 leshort 0x00ea BALANCE NS32000 .o +0 leshort 0x10ea BALANCE NS32000 executable (0 @ 0) +>16 lelong >0 not stripped +0 leshort 0x20ea BALANCE NS32000 executable (invalid @ 0) +>16 lelong >0 not stripped +0 leshort 0x30ea BALANCE NS32000 standalone executable +>16 lelong >0 not stripped # Also need info on Sequent "Symmetry" series... diff --git a/magic/Magdir/softquad b/magic/Magdir/softquad index 9e603720..e49d052e 100644 --- a/magic/Magdir/softquad +++ b/magic/Magdir/softquad @@ -1,6 +1,9 @@ # SoftQuad Publishing Software magic numbers -# $Id: softquad,v 1.7 1993/01/05 12:51:54 ian Exp $ +# $Id: softquad,v 1.8 1993/02/19 14:36:43 ian Exp $ # Author/Editor and RulesBuilder +# +# XXX - byte order? +# 0 string \ Compiled SGML rules file >9 string >\0 Type %s 0 string \ A/E SGML Document binary diff --git a/magic/Magdir/sun b/magic/Magdir/sun index fcc99a43..5891e441 100644 --- a/magic/Magdir/sun +++ b/magic/Magdir/sun @@ -1,32 +1,69 @@ -# Values for big-endian Sun (MC680x0, SPARC) binaries -1 byte 3 SPARC ->0 byte &0x80 dynamically linked ->2 short 0407 executable ->2 short 0410 pure executable ->2 short 0413 demand paged executable ->16 long >0 not stripped -1 byte 2 mc68020 ->0 byte &0x80 dynamically linked ->2 short 0407 executable ->2 short 0410 pure executable ->2 short 0413 demand paged executable ->16 long >0 not stripped -1 byte 1 mc68010 ->0 byte &0x80 dynamically linked ->2 short 0407 executable ->2 short 0410 pure executable ->2 short 0413 demand paged executable ->16 long >0 not stripped +# +# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x +# releases. +# (5.x uses ELF.) +# +0 belong&0777777 0600413 sparc demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>16 belong >0 not stripped +0 belong&0777777 0600410 sparc pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0777777 0600407 sparc +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&0777777 0400413 mc68020 demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>16 belong >0 not stripped +0 belong&0777777 0400410 mc68020 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0777777 0400407 mc68020 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + +0 belong&0777777 0200413 mc68010 demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>16 belong >0 not stripped +0 belong&0777777 0200410 mc68010 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0777777 0200407 mc68010 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped + # reworked these to avoid anything beginning with zero becoming "old sun-2" -0 long 0407 old sun-2 executable ->16 long >0 not stripped -0 long 0410 old sun-2 pure executable ->16 long >0 not stripped -0 long 0413 old sun-2 demand paged executable ->16 long >0 not stripped +0 belong 0407 old sun-2 executable +>16 belong >0 not stripped +0 belong 0410 old sun-2 pure executable +>16 belong >0 not stripped +0 belong 0413 old sun-2 demand paged executable +>16 belong >0 not stripped + # -0 long 0x080456 core file ->128 string >0 from '%s' +# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC +# binary executed in compatibility mode under SunOS 5.x". # -0 short 05401 byte-swapped demand paged executable -0 short 010001 byte-swapped demand paged executable +0 belong 0x080456 SunOS core file +>4 belong 432 (SPARC) +>>132 string >\0 from '%s' +>4 belong 826 (68K) +>>128 string >\0 from '%s' +>4 belong 456 (SPARC 4.x BCP) +>>152 string >\0 from '%s' diff --git a/magic/Magdir/terminfo b/magic/Magdir/terminfo index bceab950..76e171d8 100644 --- a/magic/Magdir/terminfo +++ b/magic/Magdir/terminfo @@ -1,4 +1,8 @@ +# # Terminfo +# +# XXX - byte order for screen images? +# 0 string \032\001 Compiled terminfo entry 0 short 0433 Curses screen image 0 short 0434 Curses screen image diff --git a/magic/Magdir/tex b/magic/Magdir/tex index bb564d84..20ee02b8 100644 --- a/magic/Magdir/tex +++ b/magic/Magdir/tex @@ -1,6 +1,8 @@ # # magic.tex: # +# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) +# 0 short 0173402 DVI File >16 string >\0 (%s) 0 short 0173531 Packed TeX Font diff --git a/magic/Magdir/typeset b/magic/Magdir/typeset index dbb07334..50645635 100644 --- a/magic/Magdir/typeset +++ b/magic/Magdir/typeset @@ -1,3 +1,5 @@ # other typesetting magic 0 string \100\357 very old (C/A/T) troff output data 0 string Interpress/Xerox Xerox InterPress data +>16 string / (version +>>17 string >\0 %s) diff --git a/magic/Magdir/unknown b/magic/Magdir/unknown index adddbd6c..1ea5f066 100644 --- a/magic/Magdir/unknown +++ b/magic/Magdir/unknown @@ -1,6 +1,21 @@ # # magic.unknown: Unknown machine magic # +# XXX - this probably should be pruned, as it'll match PDP-11 and +# VAX image formats. +# +# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, +# respectively). +# +# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't +# have the "version %ld", which may be a bogus COFFism (I don't think +# there ever was COFF for the PDP-11). +# +# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a +# long, as it would be on a VAX. +# +# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown. +# 0 short 0x107 unknown machine executable >8 short >0 not stripped >15 byte >0 - version %ld diff --git a/magic/Magdir/varied.out b/magic/Magdir/varied.out index b05cad9a..3a997d1c 100644 --- a/magic/Magdir/varied.out +++ b/magic/Magdir/varied.out @@ -1,38 +1,5 @@ # Herewith many of the object file formats used by USG systems. -# The `versions' should be un-commented if they work for you. -0 short 0570 SysV executable ->12 long >0 not stripped -#>22 short >0 - version %ld -0 short 0575 SysV pure executable ->12 long >0 not stripped -#>22 short >0 - version %ld -0 short 0502 basic-16 executable ->12 long >0 not stripped -0 short 0503 basic-16 executable (TV) ->12 long >0 not stripped -0 short 0510 x86 executable ->12 long >0 not stripped -0 short 0511 x86 executable (TV) ->12 long >0 not stripped -0 short 0550 3b20 executable ->12 long >0 not stripped -0 short 0551 3b20 executable (TV) ->12 long >0 not stripped -0 short 0560 WE32000 executable ->12 long >0 not stripped ->18 short ^00010000 - N/A on 3b2/300 w/paging ->18 short &00020000 - 32100 required ->18 short &00040000 and mau hardware required ->20 short 0443 (target shared library) ->20 short 0410 (swapped) ->20 short 0413 (paged) ->22 short >0 - version %ld -0 short 0561 WE32000 executable (TV) ->12 long >0 not stripped +# Most have been moved to files for a particular processor, +# and deleted if they duplicate other entries. # 0 short 0610 Perkin-Elmer executable -# -# Motorola/UniSoft Application Binary Interface (ABI) -0 short 0554 68K BCS executable -# Motorola/88Open ABI -0 short 0555 88K BCS executable diff --git a/magic/Magdir/vax b/magic/Magdir/vax index 0fa8962f..f45080c3 100644 --- a/magic/Magdir/vax +++ b/magic/Magdir/vax @@ -1,27 +1,33 @@ # -# magic.vax: Vax magic... +# magic.pdp: VAX executable/object and APL workspace # -0 long 0x3c61723e VAX 5.0 archive -0 long 0x65ff0000 VAX 3.0 archive -0 long 0x836e VAX double precision APL workspace -0 long 0x836f VAX single precision APL workspace -0 short 0x178 vax executable -0 short 0x17d vax pure executable -# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa -# From: dupuy@amsterdam.columbia.edu (Alexander Dupuy) -# Byte-swapped VAXen -# Here are a few lines you can add to /etc/magic on your sun workstations in -# order to recognize VAX executables and objects.... you could do something -# similar (in reverse) for your vaxen, but since 4.3+NFS' file(1) doesn't look -# for /etc/magic, I've never bothered. It really should be built in to file(1) -# so you would see the state of setuid/setgid/sticky bits. Or actually, there -# should be support for checking that sort of thing in /etc/magic. +0 lelong 0101557 VAX single precision APL workspace +0 lelong 0101556 VAX double precision APL workspace + # -0 long 00700200000 VAX executable ->16 long &0x7fffffff not stripped -0 long 01000200000 VAX pure executable ->16 long &0x7fffffff not stripped -0 long 01300200000 VAX demand-paged pure executable ->16 long &0x7fffffff not stripped -0 long 0101557 VAX single precision APL workspace -0 long 0101556 VAX double precision APL workspace +# VAX a.out (32V, BSD) +# +0 lelong 0407 VAX executable +>16 lelong >0 not stripped + +0 lelong 0410 VAX pure executable +>16 lelong >0 not stripped + +0 lelong 0413 VAX demand paged pure executable +>16 lelong >0 not stripped + +0 lelong 0420 VAX demand paged (first page unmapped) pure executable +>16 lelong >0 not stripped + +# +# VAX COFF +# +# The `versions' should be un-commented if they work for you. +# (Was the problem just one of endianness?) +# +0 leshort 0570 VAX COFF executable +>12 lelong >0 not stripped +#>22 leshort >0 - version %ld +0 leshort 0575 VAX COFF pure executable +>12 lelong >0 not stripped +#>22 leshort >0 - version %ld diff --git a/magic/Magdir/xenix b/magic/Magdir/xenix index 66370c82..72bb0df4 100644 --- a/magic/Magdir/xenix +++ b/magic/Magdir/xenix @@ -1,53 +1,68 @@ -# Microsoft +# +# Microsoft (Xenix, not DOS) +# +# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small +# model" lifted from "magic.xenix", with comment "derived empirically; +# treat as folklore until proven" +# +# "small model", "large model", "huge model" stuff lifted from XXX +# +# XXX - "x.out" collides with PDP-11 archives.... +# 0 string core core file (Xenix) 0 byte 0x80 8086 relocatable (Microsoft) -0 byte 0xf0 MS-DOS library -0 short 0xff65 x.out +0 leshort 0xff65 x.out >2 string __.SYMDEF randomized >0 byte x archive -0 short 0x206 Microsoft a.out ->0x1e short &0x10 overlay ->0x1e short &0x2 separate ->0x1e short &0x4 pure ->0x1e short &0x800 segmented ->0x1e short &0x400 standalone ->0x1e short &0x8 fixed-stack +0 leshort 0x206 Microsoft a.out +>8 leshort 1 Middle model +>0x1e leshort &0x10 overlay +>0x1e leshort &0x2 separate +>0x1e leshort &0x4 pure +>0x1e leshort &0x800 segmented +>0x1e leshort &0x400 standalone +>0x1e leshort &0x8 fixed-stack >0x1c byte &0x80 byte-swapped >0x1c byte &0x40 word-swapped ->0x10 long >0 not-stripped ->0x1e short ^0xc000 pre-SysV +>0x10 lelong >0 not-stripped +>0x1e leshort ^0xc000 pre-SysV >0x1c byte &0x4 86 >0x1c byte &0x9 286 >0x1c byte &0xa 386 ->0x1e short &0x1 executable ->0x1e short ^0x1 object file ->0x1e short &0x40 Large Text ->0x1e short &0x20 Large Data ->0x1e short &0x120 Huge Objects Enabled +>0x1f byte <0x040 small model +>0x1f byte =0x048 large model +>0x1f byte =0x049 huge model +>0x1e leshort &0x1 executable +>0x1e leshort ^0x1 object file +>0x1e leshort &0x40 Large Text +>0x1e leshort &0x20 Large Data +>0x1e leshort &0x120 Huge Objects Enabled +>0x10 lelong >0 not stripped -0 short 0x140 old Microsoft 8086 x.out +0 leshort 0x140 old Microsoft 8086 x.out >0x3 byte &0x4 separate >0x3 byte &0x2 pure >0 byte &0x1 executable >0 byte ^0x1 relocatable ->0x14 long >0 not stripped +>0x14 lelong >0 not stripped -0 long 0x206 b.out ->0x1e short &0x10 overlay ->0x1e short &0x2 separate ->0x1e short &0x4 pure ->0x1e short &0x800 segmented ->0x1e short &0x400 standalone ->0x1e short &0x1 executable ->0x1e short ^0x1 object file ->0x1e short &0x4000 V2.3 ->0x1e short &0x8000 V3.0 +0 lelong 0x206 b.out +>0x1e leshort &0x10 overlay +>0x1e leshort &0x2 separate +>0x1e leshort &0x4 pure +>0x1e leshort &0x800 segmented +>0x1e leshort &0x400 standalone +>0x1e leshort &0x1 executable +>0x1e leshort ^0x1 object file +>0x1e leshort &0x4000 V2.3 +>0x1e leshort &0x8000 V3.0 >0x1c byte &0x4 86 >0x1c byte &0xb 186 >0x1c byte &0x9 286 >0x1c byte &0x29 286 >0x1c byte &0xa 386 ->0x1e short &0x4 Large Text ->0x1e short &0x2 Large Data ->0x1e short &0x102 Huge Objects Enabled +>0x1e leshort &0x4 Large Text +>0x1e leshort &0x2 Large Data +>0x1e leshort &0x102 Huge Objects Enabled +0 leshort 0x580 XENIX 8086 relocatable or 80286 small model diff --git a/magic/Magdir/zilog b/magic/Magdir/zilog index ce8560ae..c7503cdd 100644 --- a/magic/Magdir/zilog +++ b/magic/Magdir/zilog @@ -1,4 +1,9 @@ -# Zilog +# +# Zilog Z8000. +# +# Was it big-endian or little-endian? My Product Specification doesn't +# say. +# 0 long 0xe807 object file (z8000 a.out) 0 long 0xe808 pure object file (z8000 a.out) 0 long 0xe809 separate object file (z8000 a.out)