From: Christos Zoulas Date: Sat, 25 Mar 1995 22:04:56 +0000 (+0000) Subject: 3.16 X-Git-Tag: FILE3_27~104 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a378981e708247dccf257a8f429d0e1a428dd3f9;p=file 3.16 --- diff --git a/magic/Magdir/animation b/magic/Magdir/animation index 27a6324c..02b329e3 100644 --- a/magic/Magdir/animation +++ b/magic/Magdir/animation @@ -2,35 +2,53 @@ #------------------------------------------------------------------------------ # animation: file(1) magic for animation/movie formats # -# animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8) +# animation formats +# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) +# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) + +# MPEG animation format 0 string \000\000\001\263 MPEG file + +# FLI animation format 4 leshort 0xAF11 FLI file ->6 leshort x , %d frames ->8 leshort x , width=%d pixels ->10 leshort x , height=%d pixels ->12 leshort x , depth=%d ->16 leshort x , ticks/frame=%d +>6 leshort x - %d frames, +>8 leshort x width=%d pixels, +>10 leshort x height=%d pixels, +>12 leshort x depth=%d, +>16 leshort x ticks/frame=%d +# newer FLI or FLC format +4 leshort 0xAF12 newer FLI or FLC file +>6 leshort x - %d frames +>8 leshort x width=%d pixels, +>10 leshort x height=%d pixels, +>12 leshort x depth=%d, +>16 leshort x ticks/frame=%d + +# DL animation format +# XXX - collision with most `mips' magic # # I couldn't find a real magic number for these, however, this -# -appears- to work. Note that it might catch other files, too, -# so BE CAREFUL! +# -appears- to work. Note that it might catch other files, too, so be +# careful! # # Note that title and author appear in the two 20-byte chunks # at decimal offsets 2 and 22, respectively, but they are XOR'ed with -# 255 (hex FF)! DL format SUCKS BIG ROCKS. +# 255 (hex FF)! The DL format is really bad. # -# All this stuff is commented out because of many conflicts. -# -#0 byte 1 DL file version 1 , medium format (160x100, 4 images/screen) -#>42 byte x , %d screens -#>43 byte x , %d commands -#0 byte 2 DL file version 2 -#>1 byte 1 , large format (320x200,1 image/screen) -#>1 byte 2 , medium format (160x100,4 images/screen) -#>1 byte >2 , unknown format -#>42 byte x , %d screens -#>43 byte x , %d commands -# This is total guesswork here. -# Based on empirical evidence, version 3's have several nulls following it. -# Most of them start with non-null values at hex offset 0x34 or so. -#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL file version 3 +#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) +#>42 byte x - %d screens, +#>43 byte x %d commands +#0 byte 2 DL version 2 +#>1 byte 1 - large format (320x200,1 image/screen), +#>1 byte 2 - medium format (160x100,4 images/screen), +#>1 byte >2 - unknown format, +#>42 byte x %d screens, +#>43 byte x %d commands +# Based on empirical evidence, DL version 3 have several nulls following the +# \003. Most of them start with non-null values at hex offset 0x34 or so. +#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 + +# SGI and Apple formats +0 string MOVI Silicon Graphics movie file +4 string moov Apple QuickTime movie file (moov) +4 string mdat Apple QuickTime movie file (mdat) diff --git a/magic/Magdir/apl b/magic/Magdir/apl index 02360fce..04004319 100644 --- a/magic/Magdir/apl +++ b/magic/Magdir/apl @@ -1,5 +1,6 @@ #------------------------------------------------------------------------------ -# apl: file(1) magic for APL +# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL +# workspaces) # 0 long 0100554 APL workspace (Ken's original?) diff --git a/magic/Magdir/apple b/magic/Magdir/apple index 2b5a1938..a6492b74 100644 --- a/magic/Magdir/apple +++ b/magic/Magdir/apple @@ -8,4 +8,3 @@ 0 string SIT! StuffIt (macintosh) text 0 string NuFile NuFile archive (apple ][) data 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data - diff --git a/magic/Magdir/archive b/magic/Magdir/archive index d1da412c..674acf73 100644 --- a/magic/Magdir/archive +++ b/magic/Magdir/archive @@ -1,10 +1,14 @@ #------------------------------------------------------------------------------ -# archive: file(1) magic for archive formats (see also "ms-dos" for self- +# archive: file(1) magic for archive formats (see also "dos" for self- # extracting compressed archives) # # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. -# "tar" archives are handled in the C code. +# pre-POSIX "tar" archives are handled in the C code. + +# POSIX tar archives +257 string ustar\0 POSIX tar archive +257 string ustar\040\040\0 GNU tar archive # cpio archives # @@ -28,6 +32,17 @@ 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string = archive + +# MIPS archive (needs to go first) +# +0 string !\n__________E MIPS archive +>20 string U with MIPS Ucode members +>21 string L with MIPSEL members +>21 string B with MIPSEB members +>19 string L and an EL hash table +>19 string B and an EB hash table +>22 string X -- out of date + 0 string ! archive >8 string __.SYMDEF random library 0 string -h- Software Tools format archive text @@ -64,7 +79,8 @@ # thingies, to help you recognize VAX files on big-endian machines; # with "leshort", "lelong", and "string", that's no longer necessary.... # -# 0 long 0x3c61723e VAX 5.0 archive +0 belong 0x65ff0000 VAX 3.0 archive +0 belong 0x3c61723e VAX 5.0 archive # 0 long 0x213c6172 archive file 0 lelong 0177555 very old VAX archive @@ -87,12 +103,18 @@ # 0 string -h- Software Tools format archive text -# ARC archiver -0 byte 26 ARC archive data ->1 byte 0 (empty) ->1 byte 1 (old format) -# GRR: this is my empirical entry: -#0 string \032\010 ARC archive data +# ARC archiver (empirical entries), from Daniel Quinlan (quinlan@yggdrasil.com) +# +# Other entries seem likely, but single byte magic entries collide +# with many things. I think the real ARC magic is a single byte. +# +# the first entry covers about 84% of ARC files, the second 7%, the third 5% +0 string \032\010 ARC archive data +0 string \032\011 ARC archive data +0 string \032\002 ARC archive data +# these seem to be rather uncommon, at less than 3% and 2%, respectively +0 string \032\003 ARC archive data +0 string \032\004 ARC archive data # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff @@ -122,6 +144,15 @@ >7 byte 9 os: VAX/VMS >3 byte >0 %d] +# HA archiver (Greg Roelofs, newt@uchicago.edu) +0 string HA HA archive data, +>2 leshort x %u files, +>4 byte&0x0f =0 first is type CPY +>4 byte&0x0f =1 first is type ASC +>4 byte&0x0f =2 first is type HSC +>4 byte&0x0f =0x0e first is type DIR +>4 byte&0x0f =0x0f first is type SPECIAL + # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 0 string HPAK HPACK archive data @@ -155,10 +186,9 @@ # ZOO archiver (Greg Roelofs, newt@uchicago.edu) #0 string ZOO Zoo archive data -#20 belong 0xc4fddca7 Zoo archive data -# [above are alternate identifiers] -20 lelong 0xdca7c4fd Zoo archive data -# [don't know if all of these versions exist, or if some are missing...] +# above is an alternate identifier +20 string \xdc\xa7\xc4\xfd Zoo archive data +# I don't know if all of these versions exist, or if some are missing... >4 string 1.00 (v%4s) >4 string 1.10 (v%4s) >4 string 1.20 (v%4s) @@ -176,3 +206,15 @@ >32 string \002\000 (modify: v2.0+) >70 string \001\000 (extract: v1.0+) >70 string \002\001 (extract: v2.1+) + +# Shell archives +10 string #\ This\ is\ a\ shell\ archive shell archive text +>2 string >\0 (%s) + +# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net +0 string \351,\001JAM\ JAM archive, +>7 string >\0 version %.4s +>0x26 byte =0x27 - +>>0x2b string >\0 label %.11s, +>>0x27 lelong x serial %08x, +>>0x36 string >\0 fstype %.8s diff --git a/magic/Magdir/att3b b/magic/Magdir/att3b index f650e504..7723a7fb 100644 --- a/magic/Magdir/att3b +++ b/magic/Magdir/att3b @@ -22,7 +22,7 @@ >12 belong >0 not stripped >18 beshort ^00010000 N/A on 3b2/300 w/paging >18 beshort &00020000 32100 required ->18 beshort &00040000 and mau hardware required +>18 beshort &00040000 and MAU hardware required >20 beshort 0407 (impure) >20 beshort 0410 (pure) >20 beshort 0413 (demand paged) @@ -31,7 +31,7 @@ 0 beshort 0561 WE32000 COFF executable (TV) >12 belong >0 not stripped #>18 beshort &00020000 - 32100 required -#>18 beshort &00040000 and mau hardware required +#>18 beshort &00040000 and MAU hardware required #>22 beshort >0 - version %ld # # core file for 3b2 diff --git a/magic/Magdir/audio b/magic/Magdir/audio index a543e14f..30b48342 100644 --- a/magic/Magdir/audio +++ b/magic/Magdir/audio @@ -6,36 +6,35 @@ # # Sun/NeXT audio data -0 string .snd audio data: ->12 belong 1 8-bit u-law, ->12 belong 2 8-bit linear PCM, +0 string .snd Sun/NeXT audio data: +>12 belong 1 8-bit ISDN u-law, +>12 belong 2 8-bit linear PCM [REF-PCM], >12 belong 3 16-bit linear PCM, >12 belong 4 24-bit linear PCM, >12 belong 5 32-bit linear PCM, ->12 belong 6 32-bit floating point, ->12 belong 7 64-bit floating point, ->12 belong 23 compressed (G.721 ADPCM), +>12 belong 6 32-bit IEEE floating point, +>12 belong 7 64-bit IEEE floating point, +>12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), >20 belong 1 mono, >20 belong 2 stereo, >20 belong 4 quad, ->16 belong x %d Hz +>16 belong >0 %d Hz # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format # that uses little-endian encoding and has a different magic number -# (0x0064732E in little-endian encoding). 0 lelong 0x0064732E DEC audio data: ->12 lelong 1 8-bit u-law, ->12 lelong 2 8-bit linear PCM, +>12 lelong 1 8-bit ISDN u-law, +>12 lelong 2 8-bit linear PCM [REF-PCM], >12 lelong 3 16-bit linear PCM, >12 lelong 4 24-bit linear PCM, >12 lelong 5 32-bit linear PCM, ->12 lelong 6 32-bit floating point, ->12 lelong 7 64-bit floating point, ->12 lelong 23 compressed (G.721 ADPCM), +>12 lelong 6 32-bit IEEE floating point, +>12 lelong 7 64-bit IEEE floating point, +>12 lelong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), >20 lelong 1 mono, >20 lelong 2 stereo, >20 lelong 4 quad, ->16 lelong x %d Hz +>16 lelong >0 %d Hz # Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM" 8 string AIFF AIFF audio data @@ -54,11 +53,9 @@ >23 byte >0 - version %d >22 byte >0 \b.%d -# [GRR 950115: is this also Creative Labs? Guessing that first line -# should be string instead of unknown-endian long...] -#0 long 0x4e54524b MultiTrack sound data -0 string NTRK MultiTrack sound data ->4 long x - version %ld +# first entry is also the string "NTRK" +0 belong 0x4e54524b MultiTrack sound data +>4 belong x - version %ld # Microsoft WAVE format (*.wav) # [GRR 950115: probably all of the shorts and longs should be leshort/lelong] diff --git a/magic/Magdir/c-lang b/magic/Magdir/c-lang index 1c11efe9..f6234484 100644 --- a/magic/Magdir/c-lang +++ b/magic/Magdir/c-lang @@ -9,5 +9,5 @@ # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs -0 string /* C or REXX program text +#0 string /* C or REXX program text 0 string // C++ program text diff --git a/magic/Magdir/commands b/magic/Magdir/commands index 38c6f77b..b726b1b6 100644 --- a/magic/Magdir/commands +++ b/magic/Magdir/commands @@ -32,17 +32,15 @@ 0 string #!\ /usr/local/bin/nawk - New Awk script text 0 string #!/bin/gawk - GNU awk script text 0 string #!\ /bin/gawk - GNU awk script text +0 string #!/usr/bin/gawk - GNU awk script text +0 string #!\ /usr/bin/gawk - GNU awk script text 0 string #!/usr/local/bin/gawk - GNU awk script text 0 string #!\ /usr/local/bin/gawk - GNU awk script text # 0 string #!/bin/awk Awk Commands text 0 string #!\ /bin/awk Awk Commands text -0 string #!\ / a ->3 string >\0 %s script text -0 string #!/ a ->2 string >\0 %s script text -0 string #!\ commands text ->3 string >\0 for %s +0 string #!/usr/bin/awk Awk Commands text +0 string #!\ /usr/bin/awk Awk Commands text # For Larry Wall's perl language. The ``eval'' line recognizes an # outrageously clever hack for USG systems. @@ -64,3 +62,13 @@ # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 0 string #!/bin/bash Bourne-Again Shell script text 0 string #!\ /bin/bash Bourne-Again Shell script text +0 string #!/usr/local/bin/bash Bourne-Again Shell script text +0 string #!\ /usr/local/bin/bash Bourne-Again Shell script text + +# generic shell magic +0 string #!\ / a +>3 string >\0 %s script text +0 string #!/ a +>2 string >\0 %s script text +0 string #!\ commands text +>3 string >\0 for %s diff --git a/magic/Magdir/compress b/magic/Magdir/compress index 6a3245ad..0ebe7f18 100644 --- a/magic/Magdir/compress +++ b/magic/Magdir/compress @@ -15,17 +15,17 @@ # gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver) 0 string \037\213 gzip compressed data ->2 byte <8 - reserved method ->2 byte 8 - deflate method ->3 byte &0x01 , ascii ->3 byte &0x02 , continuation ->3 byte &0x04 , extra field ->3 byte &0x08 , original file name ->3 byte &0x10 , comment ->3 byte &0x20 , encrypted ->4 ledate x , last modified: %s ->8 byte 2 , max compression ->8 byte 4 , max speed +>2 byte <8 - reserved method, +>2 byte 8 - deflate method, +>3 byte &0x01 ascii, +>3 byte &0x02 continuation, +>3 byte &0x04 extra field, +>3 byte &0x08 original file name, +>3 byte &0x10 comment, +>3 byte &0x20 encrypted, +>4 ledate x last modified: %s, +>8 byte 2 max compression, +>8 byte 4 max speed, >9 byte =0x00 os: MS-DOS >9 byte =0x01 os: Amiga >9 byte =0x02 os: VMS @@ -39,6 +39,8 @@ # According to gzip.h, this is the correct byte order for packed data. # 0 string \037\036 packed data +>2 belong >1 %d characters originally +>2 belong =1 %d character originally # # This magic number is byte-order-independent. # @@ -65,3 +67,19 @@ # lzh? 0 string \037\240 LZH compressed data + +# European GSM 06.10 is a provisional standard for full-rate speech +# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse +# excitation/long term prediction) coding at 13 kbit/s. +# +# WEAK - There's only a magic nibble (4 bits); but that nibble repeats +# every 33 bytes. This magic is NOT suited for use, but maybe we can +# use it someday. +# +# This will cause very short GSM files to be declared as data and +# mismatches to be declared as data too! +#0 byte&0xF0 0xd0 data +#>33 byte&0xF0 0xd0 +#>66 byte&0xF0 0xd0 +#>99 byte&0xF0 0xd0 +#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio diff --git a/magic/Magdir/database b/magic/Magdir/database new file mode 100644 index 00000000..95c491bb --- /dev/null +++ b/magic/Magdir/database @@ -0,0 +1,15 @@ + +#------------------------------------------------------------------------------ +# database: file(1) magic for various databases +# +# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) +# +0 long 0x053162 Berkeley db BTREE database +>4 byte 1 (version 1) +>4 byte 2 (version 2) +>4 byte 3 (version 3) +0 long 0x061561 Berkeley db HASH database +>4 byte 1 (version 1) +>4 byte 2 (version 2) +>4 byte 3 (version 3) +0 long 0x13579ace GNU gdbm or ndbm database diff --git a/magic/Magdir/elf b/magic/Magdir/elf index c90dda6f..63527e66 100644 --- a/magic/Magdir/elf +++ b/magic/Magdir/elf @@ -2,12 +2,10 @@ #------------------------------------------------------------------------------ # elf: file(1) magic for ELF executables # -# Missing MIPS image type and flags -# -# Question marks on processor types flag "should not happen because the -# byte order is wrong". We have to check the byte order flag to see what -# byte order all the other stuff in the header is in. +# We have to check the byte order flag to see what byte order all the +# other stuff in the header is in. # +# MIPS, i486 added by Daniel Quinlan (quinlan@yggdrasil.com) 0 string \177ELF ELF >4 byte 0 invalid class >4 byte 1 32-bit @@ -21,11 +19,13 @@ >>16 leshort 4 core file >>18 leshort 0 unknown machine >>18 leshort 1 WE32100 and up ->>18 leshort 2 SPARC? +>>18 leshort 2 SPARC - invalid byte order >>18 leshort 3 i386 (386 and up) ->>18 leshort 4 M68000? ->>18 leshort 5 M88000? +>>18 leshort 4 M68000 - invalid byte order +>>18 leshort 5 M88000 - invalud byte order +>>18 leshort 6 i486 >>18 leshort 7 i860 +>>18 leshort 8 MIPS >>20 lelong 1 Version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB @@ -37,10 +37,11 @@ >>18 beshort 0 unknown machine >>18 beshort 1 WE32100 and up >>18 beshort 2 SPARC ->>18 beshort 3 i386 (386 and up)? +>>18 beshort 3 i386 (386 and up) - invalid byte order >>18 beshort 4 M68000 >>18 beshort 5 M88000 +>>18 beshort 6 i486 - invalid byte order >>18 beshort 7 i860 +>>18 beshort 8 MIPS >>20 belong 1 Version 1 >>36 belong 1 MathCoPro/FPU/MAU Required - diff --git a/magic/Magdir/fonts b/magic/Magdir/fonts index 3fe9d08e..a23fae7a 100644 --- a/magic/Magdir/fonts +++ b/magic/Magdir/fonts @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# fonts: file(1) magic for font data (see also "x11") +# fonts: file(1) magic for font data # 0 string FONT ASCII vfont text 0 short 0436 Berkeley vfont data @@ -10,3 +10,13 @@ 0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text >20 string >\0 (%s) 6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data + +# X11 font files in SNF (Server Natural Format) format +0 belong 00000004 X11 big-endian SNF font +0 lelong 00000004 X11 little-endian SNF font + +# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) +# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) +# (0x7063601 is "PCF" + \001 as a lelong) +0 lelong 0x70636601 X11 Portable Compiled Font data +0 string D1.0\015 X11 Speedo font data diff --git a/magic/Magdir/hp b/magic/Magdir/hp index 253df6a9..07a80acf 100644 --- a/magic/Magdir/hp +++ b/magic/Magdir/hp @@ -19,6 +19,15 @@ # I'm guessing that the 200 series was 68K-based; the 300 and 400 series # are. # +# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 +# based; hp300 are 68020+68881 based. I think the following "basic" +# magic should probably be integrated and the various flavors of +# binaries be implemented with ">2" in case some flavors have been missed. +# 0 beshort 200 hp200 (68010) BSD binary +# 0 beshort 300 hp300 (68020+68881) BSD binary +# 0 beshort 0x20c hp200/300 HP-UX binary +# 0 beshort 0x20b hp800 HP-UX binary +# # The "misc" stuff needs a byte order; the archives look suspiciously # like the old 177545 archives (0xff65 = 0177545). # @@ -29,10 +38,10 @@ 0 beshort 0624 apollo a88k COFF executable >18 beshort ^040000 not stripped >22 beshort >0 - version %ld -0 belong 01203604016 TML 0123 byte-order format -0 belong 01702407010 TML 1032 byte-order format -0 belong 01003405017 TML 2301 byte-order format -0 belong 01602007412 TML 3210 byte-order format +0 long 01203604016 TML 0123 byte-order format +0 long 01702407010 TML 1032 byte-order format +0 long 01003405017 TML 2301 byte-order format +0 long 01602007412 TML 3210 byte-order format #### HPPA 0 belong 0x02100106 HPPA-RISC1.1 relocatable object 0 belong 0x02100107 HPPA-RISC1.1 executable @@ -135,51 +144,52 @@ >36 belong >0 not stripped #### MISC -0 belong 0x0000ff65 HP old archive -0 belong 0x020aff65 HP s200 old archive -0 belong 0x020cff65 HP s200 old archive -0 belong 0x0208ff65 HP s500 old archive +0 long 0x0000ff65 HP old archive +0 long 0x020aff65 HP s200 old archive +0 long 0x020cff65 HP s200 old archive +0 long 0x0208ff65 HP s500 old archive -0 belong 0x015821a6 HP core file +0 long 0x015821a6 HP core file -0 belong 0x4da7eee8 HP-WINDOWS font +0 long 0x4da7eee8 HP-WINDOWS font >8 byte >0 -version %ld 0 string Bitmapfile HP Bitmapfile 0 string IMGfile CIS compimg HP Bitmapfile -0 beshort 0x8000 lif file -0 belong 0x020c010c compiled Lisp +# XXX - see "lif" +0 short 0x8000 lif file +0 long 0x020c010c compiled Lisp 0 string msgcat01 HP NLS message catalog, ->8 belong >0 %d messages +>8 long >0 %d messages # addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 0 string HPHP48- HP48 binary >7 byte >0 - Rev %c ->8 beshort 0x1129 (ADR) ->8 beshort 0x3329 (REAL) ->8 beshort 0x5529 (LREAL) ->8 beshort 0x7729 (COMPLX) ->8 beshort 0x9d29 (LCOMPLX) ->8 beshort 0xbf29 (CHAR) ->8 beshort 0xe829 (ARRAY) ->8 beshort 0x0a2a (LNKARRAY) ->8 beshort 0x2c2a (STRING) ->8 beshort 0x4e2a (HXS) ->8 beshort 0x742a (LIST) ->8 beshort 0x962a (DIR) ->8 beshort 0xb82a (ALG) ->8 beshort 0xda2a (UNIT) ->8 beshort 0xfc2a (TAGGED) ->8 beshort 0x1e2b (GROB) ->8 beshort 0x402b (LIB) ->8 beshort 0x622b (BACKUP) ->8 beshort 0x882b (LIBDATA) ->8 beshort 0x9d2d (PROG) ->8 beshort 0xcc2d (CODE) ->8 beshort 0x482e (GNAME) ->8 beshort 0x6d2e (LNAME) ->8 beshort 0x922e (XLIB) +>8 short 0x1129 (ADR) +>8 short 0x3329 (REAL) +>8 short 0x5529 (LREAL) +>8 short 0x7729 (COMPLX) +>8 short 0x9d29 (LCOMPLX) +>8 short 0xbf29 (CHAR) +>8 short 0xe829 (ARRAY) +>8 short 0x0a2a (LNKARRAY) +>8 short 0x2c2a (STRING) +>8 short 0x4e2a (HXS) +>8 short 0x742a (LIST) +>8 short 0x962a (DIR) +>8 short 0xb82a (ALG) +>8 short 0xda2a (UNIT) +>8 short 0xfc2a (TAGGED) +>8 short 0x1e2b (GROB) +>8 short 0x402b (LIB) +>8 short 0x622b (BACKUP) +>8 short 0x882b (LIBDATA) +>8 short 0x9d2d (PROG) +>8 short 0xcc2d (CODE) +>8 short 0x482e (GNAME) +>8 short 0x6d2e (LNAME) +>8 short 0x922e (XLIB) 0 string %%HP: HP48 text >6 string T(0) - T(0) >6 string T(1) - T(1) diff --git a/magic/Magdir/images b/magic/Magdir/images index 70bcc305..c9b0b1b0 100644 --- a/magic/Magdir/images +++ b/magic/Magdir/images @@ -42,15 +42,17 @@ # # GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal # (best; not yet implemented): -0 string PBF PBF image (deflate compression) +0 string .PBF PBF image (deflate compression) # GIF 0 string GIF GIF image ->3 string 87a - version %s ->3 string 89a - version %s +>3 string 87a - version %s, +>3 string 89a - version %s, >6 leshort >0 %hd x >8 leshort >0 %hd, ->10 byte &0x40 interlaced, +#>10 byte &0x80 color mapped, +# GRR 950118: the following is not accurate for xv-created GIFs: +#>10 byte &0x40 interlaced, >10 byte&0x07 =0x00 2 colors >10 byte&0x07 =0x01 4 colors >10 byte&0x07 =0x02 8 colors @@ -73,6 +75,19 @@ 8 string ILBM IFF ILBM file 0 string ARF_BEGARF PHIGS clear text archive +# More miscellany from Daniel Quinlan (quinlan@yggdrasil.com) +0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file +0 string !! Bennet Yee's "face" format +0 string @(#)SunPHIGS SunPHIGS +# version number follows, in the form m.n +>40 string SunBin binary +>32 string archive archive +0 string BEGMF clear text Computer Graphics Metafile +# these should be beshort, but not sure +0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile +0 beshort 0x3020 character Computer Graphics Metafile + + # From: (Michael Haardt) 0 string yz MGR bitmap, modern format, 8 bit aligned 0 string zz MGR bitmap, old format, 1 bit deep, 16 bit aligned @@ -89,9 +104,9 @@ # JPEG images 0 beshort 0xffd8 JPEG image ->6 string JFIF (JFIF standard) +>6 string JFIF - JFIF standard # from cameron@cs.unsw.oz.au (Cameron Simpson): -0 string hsi1 HSI1 image (wrapper for JPEG?) +0 string hsi1 JPEG image - HSI encoded (proprietary) # PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu) 0 string BM bitmap @@ -128,7 +143,7 @@ # (for arbitary, prossibly different values of 42). # freely redistribuable under the GPL # [GRR: which endianness? big?] -0 short 0xcc55 rle image data +0 short 0xcc55 RLE image data >6 short >0 %d x >8 short >0 %d, >2 short >0 x offset by %d, @@ -145,3 +160,51 @@ 0 string Imagefile\ version- iff image data # this adds the whole header (inc. version number), informative but longish >10 string >\0 %s + +# Sun rasterfiles, from Daniel Quinlan (quinlan@yggdrasil.com) +# +# XXX - Does the Sun 386i use the same byte order? +# +0 belong 0x59a66a95 Sun raster image +>4 belong >0 %d x +>8 belong >0 %d, +>12 belong >0 %d-bit, +# this is almost the same as the file length (what about compressed?) +#>16 belong >0 %d bytes long, +>20 belong 0 old format, +# no need to complain if it is standard +#>20 belong 1 standard, +>20 belong 2 compressed, +>20 belong 3 RGB, +>20 belong 4 TIFF, +>20 belong 5 IFF, +>20 belong 0xffff reserved for testing, +>24 belong 0 no colormap +>24 belong 1 RGB colormap +>24 belong 2 raw colormap +# this doesn't impart much useful information (or does it?) +#>28 belong >0 colormap is %d bytes long + +# Daniel Quinlan (quinlan@yggdrasil.com) -- from an SGI machine +0 string IT01 FIT image file +>4 belong x (%d x +>8 belong x %d x +>12 belong x %d) +# +0 string IT02 FIT image file +>4 belong x (%d x +>8 belong x %d x +>12 belong x %d) +# +2048 string PCD_IPI Kodak Photo CD image pack file +0 string PCD_OPA Kodak Photo CD overview pack file + +# Jeff Uphoff +# FITS is the Flexible Image Transport System, the de facto standard for +# data and image transfer, storage, etc., for the astronomical community. +# FITS format. +0 string SIMPLE\ \ = FITS +>107 string -32 32 bits per pixel, IEEE big endian float +>107 string \ 32 32 bits per pixel, unsigned integer +>108 string 16 16 bits per pixel, unsigned integer +>109 string 8 8 bits per pixel, unsigned integer diff --git a/magic/Magdir/intel b/magic/Magdir/intel index 22d10ba0..ba3139dc 100644 --- a/magic/Magdir/intel +++ b/magic/Magdir/intel @@ -29,6 +29,7 @@ 0 leshort =0522 iAPX 286 executable large model (COFF) >12 lelong >0 not stripped #>22 leshort >0 - version %ld +# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 0 leshort =0514 80386 COFF executable >12 lelong >0 not stripped >22 leshort >0 - version %ld diff --git a/magic/Magdir/interleaf b/magic/Magdir/interleaf index bcaa36c4..d0a45145 100644 --- a/magic/Magdir/interleaf +++ b/magic/Magdir/interleaf @@ -1,5 +1,4 @@ - #------------------------------------------------------------------------------ # interleaf: file(1) magic for InterLeaf TPS: # diff --git a/magic/Magdir/karma b/magic/Magdir/karma new file mode 100644 index 00000000..4d0aacd6 --- /dev/null +++ b/magic/Magdir/karma @@ -0,0 +1,9 @@ + +#------------------------------------------------------------------------------ +# karma: file(1) magic for Karma data files +# +# From + +0 string KarmaRHD Version Karma Data Structure Version +>16 long x %lu + diff --git a/magic/Magdir/lif b/magic/Magdir/lif index 492cf926..f6d79018 100644 --- a/magic/Magdir/lif +++ b/magic/Magdir/lif @@ -2,6 +2,6 @@ #------------------------------------------------------------------------------ # lif: file(1) magic for lif # -# XXX - byte order? +# XXX - byte order? (Probably beshort, Daniel Quinlan ) # 0 short 0x8000 lif file diff --git a/magic/Magdir/linux b/magic/Magdir/linux index 4df557f7..7ce2d39b 100644 --- a/magic/Magdir/linux +++ b/magic/Magdir/linux @@ -5,27 +5,41 @@ # Values for Linux/i386 binaries, from Rik Faith , # Peter Tobias , and Daniel Quinlan # +# 2 leshort 100 Linux/i386 +>0 leshort 0407 impure executable (OMAGIC) >0 leshort 0410 pure executable (NMAGIC) >0 leshort 0413 demand-paged executable (ZMAGIC) >0 leshort 0314 demand-paged executable (QMAGIC) >16 lelong >0 not stripped +>16 lelong 0 stripped >0 string Jump jump -0 leshort 0407 object file or impure executable (OMAGIC) ->20 long >0x1020 DLL library +# object files +# first entry is absolutely correct, but may conflict with PDP-11 executable +#0 leshort 0407 Linux/i386 object file +0 string \007\001\000 Linux/i386 object file +>20 long >0x1020 - DLL library # message catalogs, from Mitchum DSouza 0 string *nazgul* compiled message catalog >8 long >0 - version %ld # core dump file, from Bill Reynolds -216 lelong 0421 core file (Linux) ->220 string >\0 - core dump of '%s' +216 lelong 0421 Linux/i386 core file +>220 string >\0 of '%s' # # LILO boot/chain loaders, from Daniel Quinlan # this can be overridden by the DOS executable (COM) entry -2 string LILO LILO boot/chain loader -# +# XXX - moved to "dos" # Debian Packages, from Peter Tobias 0 string 0.9 >8 byte 0x0a Debian Binary Package - >>3 byte >0 created by dpkg 0.9%c >>4 byte >0 pl%c +# PSF fonts, from H. Peter Anvin +0 leshort 0x0436 Pc Screen Font data +>2 byte 0 - 256 characters, no directory +>2 byte 1 - 512 characters, no directory +>2 byte 2 - 256 characters, Unicode directory +>2 byte 3 - 512 characters, Unicode directory +>3 byte >0 - 8x%d +# Linux swap file, from Daniel Quinlan +4086 string SWAP-SPACE Linux/i386 swap file diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos index 3943dc52..3d61e2e2 100644 --- a/magic/Magdir/msdos +++ b/magic/Magdir/msdos @@ -2,21 +2,37 @@ #------------------------------------------------------------------------------ # dos: file(1) magic for MS-DOS files (formerly "ms-dos") # -# These must come before the Linux/i386 entries. - +# These must come before the Linux/i386 entries, with the exception of +# Linux LILO images. +# +# LILO boot/chain loaders, from Daniel Quinlan +# this can be overridden by the DOS executable (COM) entry +# XXX - this was moved from "linux" +2 string LILO LILO boot/chain loader +# # .EXE formats (Greg Roelofs, newt@uchicago.edu) # [GRR: some company sells a self-extractor/displayer for image data(!)] -0 string MZ MS-DOS executable (EXE) ->24 string @ (OS/2 or Windows format) ->1638 string -lh5- (LHa SFX archive v2.13S) ->7195 string Rar! (RAR self-extracting archive) -# [GRR 950118: file 3.14 has a buffer-size limitation; offsets bigger than -# 8161 bytes are ignored. To make these work, increase HOWMANY in file.h -# to 32K or more.] ->13297 string PK\003\004 (PKZIP SFX archive v1.93a) ->15770 string PK\003\004 (PKZIP SFX archive v2.04g) ->25115 string PK\003\004 (Info-ZIP SFX archive v5.12) ->26331 string PK\003\004 (Info-ZIP SFX archive v5.12 w/decryption) +# +0 string MZ MS-DOS executable (EXE) +>24 string @ (OS/2 or Windows format) +>1638 string -lh5- (LHa SFX archive v2.13S) +>7195 string Rar! (RAR self-extracting archive) +# +# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than +# 8161 bytes are ignored. To make the following entries work, increase +# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2, +# NT/Win32 and VMS.] +# +>13297 string PK\003\004 (PKZIP SFX archive v1.93a) +>15770 string PK\003\004 (PKZIP SFX archive v2.04g) +# these are the DOS versions: +>25115 string PK\003\004 (Info-ZIP SFX archive v5.12) +>26331 string PK\003\004 (Info-ZIP SFX archive v5.12 w/decryption) +# these are the OS/2 versions (OS/2 is flagged above): +>47031 string PK\003\004 (Info-ZIP SFX archive v5.12) +>49845 string PK\003\004 (Info-ZIP SFX archive v5.12 w/decryption) +# this is the NT/Win32 version: +>69120 string PK\003\004 (Info-ZIP NT SFX archive v5.12 w/decryption) # miscellaneous formats 0 string LZ MS-DOS executable (built-in) diff --git a/magic/Magdir/netbsd b/magic/Magdir/netbsd new file mode 100644 index 00000000..d0f51e78 --- /dev/null +++ b/magic/Magdir/netbsd @@ -0,0 +1,182 @@ +#------------------------------------------------------------------------------ +# mirage: file(1) magic for NetBSD executables +# +# All new-style magic numbers are in network byte order. +# +0 lelong 000000413 386BSD demand paged executable +>16 lelong >0 not stripped +0 lelong 000000314 BSDI demand paged executable +>16 lelong >0 not stripped + +0 lelong 000000407 NetBSD little-endian object file +>16 lelong >0 not stripped +0 belong 000000407 NetBSD big-endian object file +>16 belong >0 not stripped + +0 belong&0377777777 041400413 NetBSD/i386 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 041400410 NetBSD/i386 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 041400407 NetBSD/i386 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 041400507 NetBSD/i386 core +>12 string >\0 from '%s' + +0 belong&0377777777 041600413 NetBSD/m68k demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 041600410 NetBSD/m68k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 041600407 NetBSD/m68k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 041600507 NetBSD/m68k core +>12 string >\0 from '%s' + +0 belong&0377777777 042000413 NetBSD/m68k4k demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042000410 NetBSD/m68k4k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042000407 NetBSD/m68k4k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 042000507 NetBSD/m68k4k core +>12 string >\0 from '%s' + +0 belong&0377777777 042200413 NetBSD/ns32532 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042200410 NetBSD/ns32532 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042200407 NetBSD/ns32532 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 042200507 NetBSD/ns32532 core +>12 string >\0 from '%s' + +0 belong&0377777777 042400413 NetBSD/sparc demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042400410 NetBSD/sparc pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042400407 NetBSD/sparc +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 042400507 NetBSD/sparc core +>12 string >\0 from '%s' + +0 belong&0377777777 042600413 NetBSD/pmax demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042600410 NetBSD/pmax pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042600407 NetBSD/pmax +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 042600507 NetBSD/pmax core +>12 string >\0 from '%s' + +0 belong&0377777777 043000413 NetBSD/vax demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043000410 NetBSD/vax pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043000407 NetBSD/vax +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 043000507 NetBSD/vax core +>12 string >\0 from '%s' + +0 belong&0377777777 043400413 NetBSD/mips demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 043400410 NetBSD/mips pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 043400407 NetBSD/mips +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 043400507 NetBSD/mips core +>12 string >\0 from '%s' diff --git a/magic/Magdir/news b/magic/Magdir/news index 0bc5bd01..0ac4fa26 100644 --- a/magic/Magdir/news +++ b/magic/Magdir/news @@ -1,8 +1,12 @@ #------------------------------------------------------------------------------ -# news: file(1) magic for Sun(?) NeWS fonts (not "news" as in "netnews") +# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") # 0 string StartFontMetrics ASCII font metrics 0 string StartFont ASCII font bits -0 long 0x137A2944 NeWS bitmap font -0 long 0x137A2947 NeWS font family +0 belong 0x137A2944 NeWS bitmap font +0 belong 0x137A2947 NeWS font family +0 belong 0x137A2950 scalable OpenFont binary +0 belong 0x137A2951 encrypted scalable OpenFont binary +8 belong 0x137A2B45 X11/NeWS bitmap font +8 belong 0x137A2B48 X11/NeWS font family diff --git a/magic/Magdir/pdp b/magic/Magdir/pdp index ba6e7292..201dede3 100644 --- a/magic/Magdir/pdp +++ b/magic/Magdir/pdp @@ -9,14 +9,17 @@ # 0 leshort 0407 PDP-11 executable >8 leshort >0 not stripped +>15 byte >0 - version %ld 0 leshort 0401 PDP-11 UNIX/RT ldp 0 leshort 0405 PDP-11 old overlay 0 leshort 0410 PDP-11 pure executable >8 leshort >0 not stripped +>15 byte >0 - version %ld 0 leshort 0411 PDP-11 separate I&D executable >8 leshort >0 not stripped +>15 byte >0 - version %ld 0 leshort 0437 PDP-11 kernel overlay diff --git a/magic/Magdir/printer b/magic/Magdir/printer index ee9728dd..39f78f88 100644 --- a/magic/Magdir/printer +++ b/magic/Magdir/printer @@ -3,18 +3,38 @@ # printer: file(1) magic for printer-formatted files # -# PostScript +# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 0 string %! PostScript document >2 string PS-Adobe- conforming ->>11 string >\0 at level %s -# Some pc's have the annoying habit of adding a ^D as a document separator +>>11 string >\0 at level %.3s +>>>15 string EPS - type %s +>>>15 string Query - type %s +>>>15 string ExitServer - type %s +# Some PCs have the annoying habit of adding a ^D as a document separator 0 string \004%! PostScript document >3 string PS-Adobe- conforming ->>12 string >\0 at level %s +>>12 string >\0 at level %.3s +>>>16 string EPS - type %s +>>>16 string Query - type %s +>>>16 string ExitServer - type %s -# PCL (HP print format followed by DeskJets and LaserJets) -# from Daniel Quinlan (quinlan@yggdrasil.com) -0 string \033E\033 PCL (LaserJet) printer data +# HP Printer Job Language +0 string \033%-12345X@PJL HP Printer Job Language data + +# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) +0 string \033E\033 HP PCL printer data +>3 string \&l0A - default page size +>3 string \&l1A - US executive page size +>3 string \&l2A - US letter page size +>3 string \&l3A - US legal page size +>3 string \&l26A - A4 page size +>3 string \&l80A - Monarch envelope size +>3 string \&l81A - No. 10 envelope size +>3 string \&l90A - Intl. DL envelope size +>3 string \&l91A - Intl. C5 envelope size +>3 string \&l100A - Intl. B5 envelope size +>3 string \&l-81A - No. 10 envelope size (landscape) +>3 string \&l-90A - Intl. DL envelope size (landscape) # IMAGEN printer-ready files: 0 string @document( Imagen printer diff --git a/magic/Magdir/rtf b/magic/Magdir/rtf new file mode 100644 index 00000000..e21019b5 --- /dev/null +++ b/magic/Magdir/rtf @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# rtf: file(1) magic for RTF (Rich text format) +# +# This information was gleaned from the version 1 documentation by +# D.P.Simpson@dcs.warwick.ac.uk (Duncan P Simpson) +# +0 string {\\rtf Rich Text Format data (version +>5 byte x %c, +>6 string \\mac Apple Macintosh characters) +>6 string \\ansi ANSI characters) +>6 string \\pc IBM PC characters) +>6 string \\pca IBM PS/2 characters) diff --git a/magic/Magdir/sgi b/magic/Magdir/sgi new file mode 100644 index 00000000..31f5f497 --- /dev/null +++ b/magic/Magdir/sgi @@ -0,0 +1,172 @@ + +#------------------------------------------------------------------------------ +# sgi: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) +# +# all of SGI's *current* machines and OSes run in big-endian mode on the +# MIPS machines, as far as I know. +# +# XXX - what is the blank "-" line? +# +0 belong 0407 old SGI 68020 executable +0 belong 0410 old SGI 68020 pure executable +0 beshort 0x8765 disk quotas file +0 beshort 0x0506 IRIS Showcase file +>2 byte 0x49 - +>3 byte x - version %ld +0 beshort 0x0226 IRIS Showcase template +>2 byte 0x63 - +>3 byte x - version %ld +0 belong 0x5343464d IRIS Showcase file +>4 byte x - version %ld +0 belong 0x5443464d IRIS Showcase template +>4 byte x - version %ld +0 belong 0xdeadbabe IRIX Parallel Arena +>8 belong >0 - version %ld +# +0 beshort 0x0160 MIPSEB COFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x0162 MIPSEL COFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %d +>22 byte x .%ld +# +0 beshort 0x6001 MIPSEB-LE COFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %d +>23 byte x .%ld +# +0 beshort 0x6201 MIPSEL-LE COFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +# MIPS 2 additions +# +0 beshort 0x0163 MIPSEB MIPS-II COFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x0166 MIPSEL MIPS-II COFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x6301 MIPSEB-LE MIPS-II COFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x6601 MIPSEL-LE MIPS-II COFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>23 byte x .%ld +# +# MIPS 3 additions +# +0 beshort 0x0140 MIPSEB MIPS-III COFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x0142 MIPSEL MIPS-III COFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x4001 MIPSEB-LE MIPS-III COFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x4201 MIPSEL-LE MIPS-III COFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x180 MIPSEB Ucode +0 beshort 0x182 MIPSEL Ucode +# 32bit core file +0 belong 0xdeadadb0 IRIX core dump +>4 belong 1 of +>16 string >\0 '%s' +# 64bit core file +0 belong 0xdeadad40 IRIX 64-bit core dump +>4 belong 1 of +>16 string >\0 '%s' +# New style crash dump file +0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of +>36 string >\0 '%s' +# Trusted IRIX info +0 string SGIAUDIT SGI Audit file +>8 byte x - version %d +>9 byte x .%ld +# +0 beshort 000732 SGI imagelib image +>6 beshort x (%d x +>8 beshort x %d) +0 beshort 0155001 SGI imagelib image byte-swapped +0 beshort 017436 packed data +0 beshort 017037 packed data (byte swapped) +# Are these three SGI-based file types or general ones? +0 string WNGZWZSC Wingz compiled script +0 string WNGZWZSS Wingz spreadsheet +0 string WNGZWZHP Wingz help file +# +0 string \#Inventor V IRIS Inventor file +# XXX - I don't know what next thing is! It is likely to be an image +# (or movie) format +0 string glfHeadMagic(); GLF_TEXT +4 belong 0x41010000 GLF_BINARY_LSB_FIRST +4 belong 0x00000141 GLF_BINARY_MSB_FIRST diff --git a/magic/Magdir/sgml b/magic/Magdir/sgml index ffbba53a..bd66b5b9 100644 --- a/magic/Magdir/sgml +++ b/magic/Magdir/sgml @@ -2,9 +2,10 @@ #------------------------------------------------------------------------------ # sgml: file(1) magic for Standard(?) Generalized Mark-up Language # -# $Id: sgml,v 1.4 1995/01/21 21:09:00 christos Exp $ +# $Id: sgml,v 1.5 1995/03/25 22:04:56 christos Exp $ # SGML goop, mostly from rph@sq. 0 string \ # Although we may know the offset of certain text fields in TeX DVI # and font files, we can't use them reliably because they are not # zero terminated. [but we do anyway, christos] 0 string \367\002 TeX DVI file ->16 string >\0 (%s) +>16 string >\0 (%s) 0 string \367\203 TeX generic font data 0 string \367\131 TeX packed font data ->3 string >\0 (%s) +>3 string >\0 (%s) 0 string \367\312 TeX virtual font data -0 string This\ is\ TeX, TeX transcript text +0 string This\ is\ TeX, TeX transcript text 0 string This\ is\ METAFONT, METAFONT transcript text # There is no way to detect TeX Font Metric (*.tfm) files without @@ -23,18 +21,15 @@ # match most *.tfm files generated by METAFONT or afm2tfm. 2 string \000\021 TeX font metric data 2 string \000\022 TeX font metric data ->34 string >\0 (%s) +>33 string >\0 (%s) # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 0 string \\input\ texinfo Texinfo source text 0 string This\ is\ Info\ file GNU Info text -# correct TeX magic for Linux (and maybe more) -# from Peter Tobias (tobias@server.et-inf.fho-emden.de) -# -0 leshort 0x02f7 TeX DVI File ->16 string >\0 (%s) -0 leshort 0x59f7 TeX packed font data ->3 string >\0 (%s) -2 string \000\022 TeX font metric data ->33 string >\0 (%s) +# TeX document additions from Daniel Quinlan, quinlan@yggdrasil.com +0 string \\input TeX or TeX-derivative document text +0 string \\chapter TeX or TeX-derivative document text +0 string \\documentstyle TeX or TeX-derivative document text +0 string \\section TeX or TeX-derivative document text +0 string \\setlength TeX or TeX-derivative document text diff --git a/magic/Magdir/timezone b/magic/Magdir/timezone index cb8e5904..795c0719 100644 --- a/magic/Magdir/timezone +++ b/magic/Magdir/timezone @@ -3,7 +3,9 @@ # timezone: file(1) magic for timezone data # # from Daniel Quinlan (quinlan@yggdrasil.com) -# this will work on Linux, SunOS, and others -27 byte 1 timezone data -27 byte 2 timezone data -# [GRR 950115: these will catch a fair number of random binary files, too...] +# this should work on Linux, SunOS, and maybe others +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 timezone data +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 timezone data diff --git a/magic/Magdir/varied.out b/magic/Magdir/varied.out index 5662625e..e7c75c99 100644 --- a/magic/Magdir/varied.out +++ b/magic/Magdir/varied.out @@ -7,8 +7,3 @@ # and deleted if they duplicate other entries. # 0 short 0610 Perkin-Elmer executable -# Cray -6 beshort 0407 unicos (cray) executable -# AMD 29K -0 beshort 0572 amd 29k coff executable -0 beshort 0160007 amd 29k coff archive diff --git a/magic/Magdir/vms b/magic/Magdir/vms index 26071dc7..8a8ed455 100644 --- a/magic/Magdir/vms +++ b/magic/Magdir/vms @@ -3,6 +3,7 @@ # vms: file(1) magic for VMS executables (experimental) # # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) +# This file should be renamed to "vms" eventually... # GRR 950122: I'm just guessing on these, based on inspection of the headers # of three executables each for Alpha and VAX architectures. The VAX files diff --git a/magic/Magdir/xenix b/magic/Magdir/xenix index 8c4f33d2..74d1daf9 100644 --- a/magic/Magdir/xenix +++ b/magic/Magdir/xenix @@ -8,12 +8,10 @@ # # "small model", "large model", "huge model" stuff lifted from XXX # -# XXX - "x.out" collides with PDP-11 archives.... +# XXX - "x.out" collides with PDP-11 archives # 0 string core core file (Xenix) -# The following entry is really not specific enough and conflicts with -# many others -#0 byte 0x80 8086 relocatable (Microsoft) +0 byte 0x80 8086 relocatable (Microsoft) 0 leshort 0xff65 x.out >2 string __.SYMDEF randomized >0 byte x archive @@ -29,7 +27,10 @@ >0x1c byte &0x40 word-swapped >0x10 lelong >0 not-stripped >0x1e leshort ^0xc000 pre-SysV +>0x1e leshort &0x4000 V2.3 +>0x1e leshort &0x8000 V3.0 >0x1c byte &0x4 86 +>0x1c byte &0xb 186 >0x1c byte &0x9 286 >0x1c byte &0xa 386 >0x1f byte <0x040 small model diff --git a/src/apprentice.c b/src/apprentice.c index e1b4f455..a82d7249 100644 --- a/src/apprentice.c +++ b/src/apprentice.c @@ -33,7 +33,7 @@ #ifndef lint static char *moduleid = - "@(#)$Id: apprentice.c,v 1.19 1994/05/03 17:58:23 christos Exp $"; + "@(#)$Id: apprentice.c,v 1.20 1995/03/25 22:08:07 christos Exp $"; #endif /* lint */ #define EATAB {while (isascii((unsigned char) *l) && \ @@ -174,7 +174,7 @@ int *ndx, check; } /* get offset, then skip over it */ - m->offset = (int) strtol(l,&t,0); + m->offset = (int) strtoul(l,&t,0); if (l == t) magwarn("offset %s invalid", l); l = t; @@ -205,7 +205,7 @@ int *ndx, check; s = l; if (*l == '+' || *l == '-') l++; if (isdigit((unsigned char)*l)) { - m->in.offset = strtol(l, &t, 0); + m->in.offset = strtoul(l, &t, 0); if (*s == '-') m->in.offset = - m->in.offset; } else @@ -278,7 +278,7 @@ int *ndx, check; /* New-style anding: "0 byte&0x80 =0x80 dynamically linked" */ if (*l == '&') { ++l; - m->mask = signextend(m, strtol(l, &l, 0)); + m->mask = signextend(m, strtoul(l, &l, 0)); } else m->mask = ~0L; EATAB; @@ -361,7 +361,7 @@ char **p; m->vallen = slen; } else if (m->reln != 'x') - m->value.l = signextend(m, strtol(*p, p, 0)); + m->value.l = signextend(m, strtoul(*p, p, 0)); return 0; } diff --git a/src/ascmagic.c b/src/ascmagic.c index 600b0ab9..9f95402a 100644 --- a/src/ascmagic.c +++ b/src/ascmagic.c @@ -36,7 +36,7 @@ #ifndef lint static char *moduleid = - "@(#)$Id: ascmagic.c,v 1.17 1994/01/21 01:25:30 christos Exp $"; + "@(#)$Id: ascmagic.c,v 1.18 1995/03/25 22:08:07 christos Exp $"; #endif /* lint */ /* an optimisation over plain strcmp() */ @@ -53,7 +53,18 @@ int nbytes; /* size actually read */ char *token; register struct names *p; - /* these are easy, do them first */ + /* + * Do the tar test first, because if the first file in the tar + * archive starts with a dot, we can confuse it with an nroff file. + */ + switch (is_tar(buf, nbytes)) { + case 1: + ckfputs("tar archive", stdout); + return 1; + case 2: + ckfputs("POSIX tar archive", stdout); + return 1; + } /* * for troff, look for . + letter + letter or .\"; @@ -95,14 +106,6 @@ int nbytes; /* size actually read */ } } - switch (is_tar(buf, nbytes)) { - case 1: - ckfputs("tar archive", stdout); - return 1; - case 2: - ckfputs("POSIX tar archive", stdout); - return 1; - } for (i = 0; i < nbytes; i++) { if (!isascii(*(buf+i))) diff --git a/src/file.c b/src/file.c index 4fafe9a6..5078b8b4 100644 --- a/src/file.c +++ b/src/file.c @@ -26,7 +26,7 @@ */ #ifndef lint static char *moduleid = - "@(#)$Id: file.c,v 1.30 1995/01/21 21:03:35 christos Exp $"; + "@(#)$Id: file.c,v 1.31 1995/03/25 22:08:07 christos Exp $"; #endif /* lint */ #include @@ -254,7 +254,12 @@ int wid; if (nbytes == 0) ckfputs("empty", stdout); else { - buf[nbytes++] = '\0'; /* null-terminate it */ + buf[nbytes++] = '\0'; /* NULL terminate */ + if (nbytes < sizeof(union VALUETYPE)) { + /* The following is to handle *very* short files */ + memset(buf + nbytes, 0, sizeof(union VALUETYPE) - nbytes); + nbytes = sizeof(union VALUETYPE); + } tryit(buf, nbytes, zflag); } diff --git a/src/file.h b/src/file.h index 12d5c6f9..721d0b97 100644 --- a/src/file.h +++ b/src/file.h @@ -1,6 +1,6 @@ /* * file.h - definitions for file(1) program - * @(#)$Id: file.h,v 1.19 1994/05/03 17:58:23 christos Exp $ + * @(#)$Id: file.h,v 1.20 1995/03/25 22:08:07 christos Exp $ * * Copyright (c) Ian F. Darwin, 1987. * Written by Ian F. Darwin. @@ -121,6 +121,7 @@ extern int sys_nerr; extern char *sys_errlist[]; #define strerror(e) \ (((e) >= 0 && (e) < sys_nerr) ? sys_errlist[(e)] : "Unknown error") +#define strtoul(a, b, c) strtol(a, b, c) #endif #ifndef MAXPATHLEN diff --git a/src/softmagic.c b/src/softmagic.c index 17840966..d469b14a 100644 --- a/src/softmagic.c +++ b/src/softmagic.c @@ -34,7 +34,7 @@ #ifndef lint static char *moduleid = - "@(#)$Id: softmagic.c,v 1.26 1994/06/06 05:27:29 christos Exp $"; + "@(#)$Id: softmagic.c,v 1.27 1995/03/25 22:08:07 christos Exp $"; #endif /* lint */ static int match __P((unsigned char *, int)); @@ -179,18 +179,24 @@ struct magic *m; switch (m->type) { case BYTE: v = p->b; + v = signextend(m, v) & m->mask; + (void) printf(m->desc, (unsigned char) v); break; case SHORT: case BESHORT: case LESHORT: v = p->h; + v = signextend(m, v) & m->mask; + (void) printf(m->desc, (unsigned short) v); break; case LONG: case BELONG: case LELONG: v = p->l; + v = signextend(m, v) & m->mask; + (void) printf(m->desc, (unsigned long) v); break; case STRING: @@ -214,9 +220,6 @@ struct magic *m; error("invalid m->type (%d) in mprint().\n", m->type); /*NOTREACHED*/ } - - v = signextend(m, v) & m->mask; - (void) printf(m->desc, (unsigned char) v); } /*