From: Christos Zoulas Date: Wed, 23 Apr 2008 03:50:55 +0000 (+0000) Subject: split windows and msdos entries from Abel Cheung X-Git-Tag: FILE4_25~38 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ac579268e3cf7ae6c0388b11d362bef4061deccf;p=file split windows and msdos entries from Abel Cheung --- diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos index 90bacb46..83533dc3 100644 --- a/magic/Magdir/msdos +++ b/magic/Magdir/msdos @@ -353,14 +353,6 @@ #0 byte 0xf0 MS-DOS program library data # -# -# Windows Registry files. -# updated by Joerg Jenderek -0 string regf Windows NT/XP registry file -0 string CREG Windows 95/98/ME registry file -0 string SHCC3 Windows 3.1 registry file - - # AAF files: # Stuart Cunningham 0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage @@ -424,9 +416,6 @@ !:mime application/vnd.lotus-wordpro -# Help files -0 string ?_\3\0 MS Windows Help Data - # DeIsL1.isu what this is I don't know 0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is @@ -434,10 +423,6 @@ #0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 0 string Nullsoft\ AVS\ Preset\ Winamp plug in -# Hyper terminal: -0 string HyperTerminal\ hyperterm ->15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal - # Windows Metafont .WMF 0 string \327\315\306\232 ms-windows metafont .wmf 0 string \002\000\011\000 ms-windows metafont .wmf @@ -461,16 +446,6 @@ 0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file -# Windows help file FTG FTS -0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache - -# grp old windows 3.1 group files -0 string \120\115\103\103 MS Windows 3.1 group files - - -# lnk files windows symlinks -0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut - #ico files 0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows @@ -600,24 +575,6 @@ >56 leshort 1 \b, 1 registry entry >56 leshort >1 \b, %u registry entries -# Outlook Personal Folders -0 lelong 0x4E444221 Microsoft Outlook binary email folder ->10 leshort 0x0e (Outlook <=2002) ->10 leshort 0x17 (Outlook >=2003) - - -# From: Dirk Jagdmann -0 lelong 0x00035f3f Windows 3.x help file - -# Christophe Monniez -0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File ->20 string >\0 Version %s -0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File ->4 byte =0xC5 Message database ->4 byte =0xC6 Folder database ->4 byte =0xC7 Accounts informations ->4 byte =0x30 Offline database - # Windows Enhanced Metafile (EMF) # See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp diff --git a/magic/Magdir/windows b/magic/Magdir/windows new file mode 100644 index 00000000..7abb8006 --- /dev/null +++ b/magic/Magdir/windows @@ -0,0 +1,109 @@ + +#------------------------------------------------------------------------------ +# windows: file(1) magic for Microsoft Windows +# +# This file is mainly reserved for files where programs +# using them are run almost always on MS Windows 3.x or +# above, or files only used exclusively in Windows OS, +# where there is no better category to allocate for. +# For example, even though WinZIP almost run on Windows +# only, it is better to treat them as "archive" instead. +# For format usable in DOS, such as generic executable +# format, please specify under "msdos" file. +# + + +# Summary: Outlook Express DBX file +# Extension: .dbx +# Created by: Christophe Monniez +0 string \xCF\xAD\x12\xFE MS Outlook Express DBX file +>4 byte =0xC5 \b, message database +>4 byte =0xC6 \b, folder database +>4 byte =0xC7 \b, account information +>4 byte =0x30 \b, offline database + + +# Summary: Windows crash dump +# Extension: .dmp +# Created by: Andreas Schuster (http://computer.forensikblog.de/) +# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html +# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) +0 string PAGE +>4 string DUMP MS Windows 32bit crash dump +>>0x05c byte 0 \b, no PAE +>>0x05c byte 1 \b, PAE +>>0xf88 lelong 1 \b, full dump +>>0xf88 lelong 2 \b, kernel dump +>>0xf88 lelong 3 \b, small dump +>>0x068 lelong x \b, %ld pages +>4 string DU64 MS Windows 64bit crash dump +>>0xf98 lelong 1 \b, full dump +>>0xf98 lelong 2 \b, kernel dump +>>0xf98 lelong 3 \b, small dump +>>0x090 lequad x \b, %lld pages + + +# Summary: Vista Event Log +# Extension: .evtx +# Created by: Andreas Schuster (http://computer.forensikblog.de/) +# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html +0 string ElfFile\0 MS Windows Vista Event Log +>0x2a leshort x \b, %d chunks +>>0x10 lelong x \b (no. %d in use) +>0x18 lelong >1 \b, next record no. %d +>0x18 lelong =1 \b, empty +>0x78 lelong &1 \b, DIRTY +>0x78 lelong &2 \b, FULL + + +# Summary: Windows 3.1 group files +# Extension: .grp +# Created by: unknown +0 string \120\115\103\103 MS Windows 3.1 group files + + +# Summary: Old format help files +# Extension: .hlp +# Created by: Dirk Jagdmann +0 lelong 0x00035f3f MS Windows 3.x help file + + +# Summary: Hyper terminal +# Extension: .ht +# Created by: unknown +0 string HyperTerminal\ +>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile + + +# Summary: Windows shortcut +# Extension: .lnk +# Created by: unknown +0 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut + + +# Summary: Outlook Personal Folders +# Created by: unknown +0 lelong 0x4E444221 Microsoft Outlook email folder +>10 leshort 0x0e (<=2002) +>10 leshort 0x17 (>=2003) + + +# Summary: Windows help cache +# Created by: unknown +0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache + + +# Summary: IE cache file +# Created by: Christophe Monniez +0 string Client\ UrlCache\ MMF Internet Explorer cache file +>20 string >\0 version %s + + +# Summary: Registry files +# Created by: unknown +# Modified by (1): Joerg Jenderek +0 string regf MS Windows registry file, NT/2000 or above +0 string CREG MS Windows 95/98/ME registry file +0 string SHCC3 MS Windows 3.1 registry file + +