Christos Zoulas [Mon, 18 Feb 2013 18:45:41 +0000 (18:45 +0000)]
more patches from Joerg Jenderek:
For some Microsoft initial program loaders (IPL) not only the locations
with the characteristic error messages changes.
But also the strings itself varies from "Invalid partition table"
to "Ungültige Partitionstabelle" or "Table de partition erronée"
depending on the language of the Microsoft operating system (for
english,german or french)
So for example file (wmbr-9m-fr.bin and mbr-win7.bin in sample directory
mbr_msdos ) are not characterized as "MBR" ( see output
mbr_msdos-5.12-old.txt )
So i removed the old tests for Microsoft DOS and Windows MBR and replaced
them by looking for \x33\xc0\x8e\xd0\xbc\x00\x7c , the characteristic
assembler instructions "xor ax,ax;mov ss,ax;mov sp,7c00" according to
information of http://thestarman.pcministry.com/asm/mbr/
By this test line all inspected examples are identified as MS-MBR except
for hdimage-msdos3.21-es.mbr. This seem to belongs to Spanish Microsoft
MS-DOS version 3.21 .
So i add additional magic test for that special assembler instructions. By
looking for characteristic assembler instructions at offset 8 i was able to
identify MBR for Microsoft version "DOS 2" until Windows 7 and display
this version information correctly.
For the old "DOS 2" only the Author name differs ("David Litton" , "A
Pehrsson" ; see samples hdimage-msdos2.11-sv.mbr and mbr-2.x.bin). So i
display this information too.
If available an non zero disk signature at offset 0x1B8 is displayed,
whereas in old version this was called unspecified by ", Serial" with
sometimes wrong typ ubelong (See also
http://en.wikipedia.org/wiki/MBR_disk_signature#ID)
According to http://mirror.href.com/thestarman/asm/mbr/mystery.htm
the physical drive number and a time stamp is stored in some MBR versions
during creation.So i display this information too like in mbr-3.3_myth.bin.
error messages inside mbr are printed for example by assembler
instructions: mov si,06nn;...;int 10
where nn is string offset varying for different languages.
So i use indirect offset to display this various messages like for german
"Ungültige Partitionstabelle"
"Fehler beim Laden des Betriebssystems"
"Betriebssystem fehlt"
or for english
"Invalid partition table"
"Error loading operating system"
"Missing operating system"
i also use this strings or different offset values to characterise the
different language variants.
After changing filesystems magic by file-5.12-filesystems-msdos-mbr.diff
these files are identified correctly as "MS-MBR" (see output
mbr_msdos-5.12-new.txt).
All diffs, output and sample files are stored under
http://mitglied.multimania.de/jenderek/file/
Christos Zoulas [Wed, 9 Jan 2013 22:37:23 +0000 (22:37 +0000)]
From Guy Harris:
There are several entries in the magic database for files that begin
with a 4-byte big-endian or little-endian octal 407, 410, and 413,
because several different flavors of UN*X used, at least in their
earliest days, the 32-bit a.out format with the standard magic numbers.
I've removed them and placed entries in a new "aout" file, and just
labeled them as "little-endian 32-bit" and "big-endian 32-bit"
executables, so that, for example, UNIX/32V VAX binaries aren't
misidentified as 386 binaries, or *vice versa*; unless we look at the
actual code, or find some other way of distinguishing between them,
there's no way to identify those as anything other than little-endian
32-bit binaries. I also commented out some entries in "unknown" that
would have matched the same files that other entries would also have
matched.
I've also added "a.out" to the description strings for several a.out
file formats.
As "mips" contained some of those entries, as a result of being a bit of
a mix between MIPS stuff and SGI stuff, I also moved all the stuff that
has nothing to do with the MIPS architecture into "sgi". (Yes, SGI did
own MIPS Technologies for a while, but it didn't do so originally and
doesn't do so now, and the stuff that got moved has nothing to do with
the MIPS architecture.)
In addition, I cleaned up the "ar" archive file entries, removing some
duplicates, fixing some "random" archive checks (they were using an
offset of 8 for older archive formats, but in those older archive
formats the archive entries start at an earlier offset, so the name of
the first entry is at an offset of 2 or 4), and adding an entry for the
entry Apple's ranlib adds (it has a longer name, and OS X uses the BSD
flavor of the "portable" archive format, so the name is at an offset of
68 rather than 8). I also added a comment to indicate what I suspect
"thin" archives are (a type of archive produced by GNU ar).
Christos Zoulas [Fri, 4 Jan 2013 16:37:54 +0000 (16:37 +0000)]
Need to pass the returnval that the child match determined in the use case.
This broke the elf mime printing, where softmagic returned a non-match although
the child match() actually printed something.
projects / file / log