From: Christos Zoulas Date: Wed, 7 May 2014 21:25:41 +0000 (+0000) Subject: merge dup VDI X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bde92e6820483bacda033c3fa429dca59c2088cc;p=file merge dup VDI move virtual images from msdos to virtual --- diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos index b28df692..49a7920b 100644 --- a/magic/Magdir/msdos +++ b/magic/Magdir/msdos @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: msdos,v 1.96 2014/04/30 21:41:02 christos Exp $ +# $File: msdos,v 1.97 2014/05/07 21:25:41 christos Exp $ # msdos: file(1) magic for MS-DOS files # @@ -794,105 +794,6 @@ >40 string \ EMF Windows Enhanced Metafile (EMF) image data >>44 ulelong x version 0x%x -# From: Alex Beregszaszi -0 string/b COWD VMWare3 ->4 byte 3 disk image ->>32 lelong x (%d/ ->>36 lelong x \b%d/ ->>40 lelong x \b%d) ->4 byte 2 undoable disk image ->>32 string >\0 (%s) - -0 string/b VMDK VMware4 disk image -0 string/b KDMV VMware4 disk image - -#-------------------------------------------------------------------- -# Qemu Emulator Images -# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) -# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) -# Made by reading sources, reading documentation, and doing trial and error -# on existing QCOW files -0 string/b QFI\xFB QEMU QCOW Image - -# Uncomment the following line to display Magic (only used for debugging -# this magic number) -#>0 string/b x , Magic: %s - -# There are currently 2 Versions: "1" and "2". -# http://www.gnome.org/~markmc/qcow-image-format-version-1.html ->4 belong 1 (v1) - -# Using the existence of the Backing File Offset to determine whether -# to read Backing File Information ->>12 belong >0 \b, has backing file ( -# Note that this isn't a null-terminated string; the length is actually -# (16.L). Assuming a null-terminated string happens to work usually, but it -# may spew junk until it reaches a \0 in some cases. ->>>(12.L) string >\0 \bpath %s - -# Modification time of the Backing File -# Really useful if you want to know if your backing -# file is still usable together with this image ->>>>20 bedate >0 \b, mtime %s) ->>>>20 default x \b) - -# Size is stored in bytes in a big-endian u64. ->>24 bequad x \b, %lld bytes - -# 1 for AES encryption, 0 for none. ->>36 belong 1 \b, AES-encrypted - -# http://www.gnome.org/~markmc/qcow-image-format.html ->4 belong 2 (v2) -# Using the existence of the Backing File Offset to determine whether -# to read Backing File Information ->>8 bequad >0 \b, has backing file -# Note that this isn't a null-terminated string; the length is actually -# (16.L). Assuming a null-terminated string happens to work usually, but it -# may spew junk until it reaches a \0 in some cases. Also, since there's no -# .Q modifier, we just use the bottom four bytes as an offset. Note that if -# the file is over 4G, and the backing file path is stored after the first 4G, -# the wrong filename will be printed. (This should be (8.Q), when that syntax -# is introduced.) ->>>(12.L) string >\0 (path %s) ->>24 bequad x \b, %lld bytes ->>32 belong 1 \b, AES-encrypted - ->4 belong 3 (v3) -# Using the existence of the Backing File Offset to determine whether -# to read Backing File Information ->>8 bequad >0 \b, has backing file -# Note that this isn't a null-terminated string; the length is actually -# (16.L). Assuming a null-terminated string happens to work usually, but it -# may spew junk until it reaches a \0 in some cases. Also, since there's no -# .Q modifier, we just use the bottom four bytes as an offset. Note that if -# the file is over 4G, and the backing file path is stored after the first 4G, -# the wrong filename will be printed. (This should be (8.Q), when that syntax -# is introduced.) ->>>(12.L) string >\0 (path %s) ->>24 bequad x \b, %lld bytes ->>32 belong 1 \b, AES-encrypted - ->4 default x (unknown version) - -0 string/b QEVM QEMU suspend to disk image - -# QEMU QED Image -# http://wiki.qemu.org/Features/QED/Specification -0 string/b QED\0 QEMU QED Image - -# VDI Image -64 string/b \x7f\x10\xda\xbe VDI Image ->68 string/b \x01\x00\x01\x00 version 1.1 ->0 string >\0 (%s) ->368 lequad x \b, %lld bytes - -0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, ->32 string x type %s, ->48 string x subtype %s - -0 lelong 0x02468ace Bochs Sparse disk image - # from http://filext.com by Derek M Jones # False positive with PPT (also currently this string is too long) #0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer diff --git a/magic/Magdir/virtual b/magic/Magdir/virtual index 83b286be..26442bf9 100644 --- a/magic/Magdir/virtual +++ b/magic/Magdir/virtual @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: virtual,v 1.5 2014/04/30 21:41:02 christos Exp $ +# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ # From: James Nobis # Microsoft hard disk images for: # Virtual Server @@ -9,13 +9,6 @@ # .vhd 0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC -# Sun xVM VirtualBox Disk Image -# From: Richard W.M. Jones -# VirtualBox Disk Image -0x40 ulelong 0xbeda107f VirtualBox Disk Image ->0x44 uleshort >0 \b, major %u ->0x46 uleshort >0 \b, minor %u - # libvirt # From: Philipp Hahn 0 string LibvirtQemudSave Libvirt QEMU Suspend Image @@ -25,3 +18,106 @@ >0x1c lelong 1 \b, compressed 0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image +# From: Alex Beregszaszi +0 string/b COWD VMWare3 +>4 byte 3 disk image +>>32 lelong x (%d/ +>>36 lelong x \b%d/ +>>40 lelong x \b%d) +>4 byte 2 undoable disk image +>>32 string >\0 (%s) + +0 string/b VMDK VMware4 disk image +0 string/b KDMV VMware4 disk image + +#-------------------------------------------------------------------- +# Qemu Emulator Images +# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) +# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) +# Made by reading sources, reading documentation, and doing trial and error +# on existing QCOW files +0 string/b QFI\xFB QEMU QCOW Image + +# Uncomment the following line to display Magic (only used for debugging +# this magic number) +#>0 string/b x , Magic: %s + +# There are currently 2 Versions: "1" and "2". +# http://www.gnome.org/~markmc/qcow-image-format-version-1.html +>4 belong 1 (v1) + +# Using the existence of the Backing File Offset to determine whether +# to read Backing File Information +>>12 belong >0 \b, has backing file ( +# Note that this isn't a null-terminated string; the length is actually +# (16.L). Assuming a null-terminated string happens to work usually, but it +# may spew junk until it reaches a \0 in some cases. +>>>(12.L) string >\0 \bpath %s + +# Modification time of the Backing File +# Really useful if you want to know if your backing +# file is still usable together with this image +>>>>20 bedate >0 \b, mtime %s) +>>>>20 default x \b) + +# Size is stored in bytes in a big-endian u64. +>>24 bequad x \b, %lld bytes + +# 1 for AES encryption, 0 for none. +>>36 belong 1 \b, AES-encrypted + +# http://www.gnome.org/~markmc/qcow-image-format.html +>4 belong 2 (v2) +# Using the existence of the Backing File Offset to determine whether +# to read Backing File Information +>>8 bequad >0 \b, has backing file +# Note that this isn't a null-terminated string; the length is actually +# (16.L). Assuming a null-terminated string happens to work usually, but it +# may spew junk until it reaches a \0 in some cases. Also, since there's no +# .Q modifier, we just use the bottom four bytes as an offset. Note that if +# the file is over 4G, and the backing file path is stored after the first 4G, +# the wrong filename will be printed. (This should be (8.Q), when that syntax +# is introduced.) +>>>(12.L) string >\0 (path %s) +>>24 bequad x \b, %lld bytes +>>32 belong 1 \b, AES-encrypted + +>4 belong 3 (v3) +# Using the existence of the Backing File Offset to determine whether +# to read Backing File Information +>>8 bequad >0 \b, has backing file +# Note that this isn't a null-terminated string; the length is actually +# (16.L). Assuming a null-terminated string happens to work usually, but it +# may spew junk until it reaches a \0 in some cases. Also, since there's no +# .Q modifier, we just use the bottom four bytes as an offset. Note that if +# the file is over 4G, and the backing file path is stored after the first 4G, +# the wrong filename will be printed. (This should be (8.Q), when that syntax +# is introduced.) +>>>(12.L) string >\0 (path %s) +>>24 bequad x \b, %lld bytes +>>32 belong 1 \b, AES-encrypted + +>4 default x (unknown version) + +0 string/b QEVM QEMU suspend to disk image + +# QEMU QED Image +# http://wiki.qemu.org/Features/QED/Specification +0 string/b QED\0 QEMU QED Image + +# VDI Image +# Sun xVM VirtualBox Disk Image +# From: Richard W.M. Jones +# VirtualBox Disk Image +0x40 ulelong 0xbeda107f VirtualBox Disk Image +>0x44 uleshort >0 \b, major %u +>0x46 uleshort >0 \b, minor %u +>0 string >\0 (%s) +>368 lequad x \b, %lld bytes + +0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, +>32 string x type %s, +>48 string x subtype %s + +0 lelong 0x02468ace Bochs Sparse disk image +