file
11 years agoPR/298: Add CDR6 for Corel Draw 6.
Christos Zoulas [Tue, 19 Nov 2013 23:58:17 +0000 (23:58 +0000)]
PR/298: Add CDR6 for Corel Draw 6.

11 years agoPR/296: Add more BMP images
Christos Zoulas [Tue, 19 Nov 2013 23:56:04 +0000 (23:56 +0000)]
PR/296: Add more BMP images

11 years agoPR/295: Add EWF file format
Christos Zoulas [Tue, 19 Nov 2013 23:54:05 +0000 (23:54 +0000)]
PR/295: Add EWF file format

11 years agoPR/294: Fix file [--special-files]|[--mime-encoding] <one-byte-file>|<empty-file>
Christos Zoulas [Tue, 19 Nov 2013 23:49:44 +0000 (23:49 +0000)]
PR/294: Fix file [--special-files]|[--mime-encoding] <one-byte-file>|<empty-file>

11 years agoPR/293: Christian Hesse: Correct linux offset computation.
Christos Zoulas [Tue, 19 Nov 2013 23:18:15 +0000 (23:18 +0000)]
PR/293: Christian Hesse: Correct linux offset computation.

11 years agoPR/290: Rewrite xilinx to use pascal strings instead of hard-coded constants.
Christos Zoulas [Tue, 19 Nov 2013 23:15:13 +0000 (23:15 +0000)]
PR/290: Rewrite xilinx to use pascal strings instead of hard-coded constants.

11 years agoPR/289: Leave the database loaded in case of list, check, compile.
Christos Zoulas [Tue, 19 Nov 2013 21:01:12 +0000 (21:01 +0000)]
PR/289: Leave the database loaded in case of list, check, compile.

11 years agoPR/286: Default encoding is binary.
Christos Zoulas [Tue, 19 Nov 2013 20:45:50 +0000 (20:45 +0000)]
PR/286: Default encoding is binary.

11 years agoPR/287: Add another lzma case; there is no reliable way to check the format.
Christos Zoulas [Tue, 19 Nov 2013 20:38:57 +0000 (20:38 +0000)]
PR/287: Add another lzma case; there is no reliable way to check the format.

11 years agoPR/299: New fersion for SPSS.
Christos Zoulas [Tue, 19 Nov 2013 18:47:58 +0000 (18:47 +0000)]
PR/299: New fersion for SPSS.

11 years agodon't write a char to a pointer.
Christos Zoulas [Mon, 18 Nov 2013 17:54:58 +0000 (17:54 +0000)]
don't write a char to a pointer.

11 years agoadd the no encryption entry.
Christos Zoulas [Fri, 8 Nov 2013 01:24:22 +0000 (01:24 +0000)]
add the no encryption entry.

11 years agoexit code fix
Christos Zoulas [Wed, 6 Nov 2013 19:38:53 +0000 (19:38 +0000)]
exit code fix

11 years ago- since the name is printed alread in the message as <name>:<message> don't
Christos Zoulas [Wed, 6 Nov 2013 19:33:31 +0000 (19:33 +0000)]
- since the name is printed alread in the message as <name>:<message> don't
  repeat the name in the message
- if we could not stat, don't try to provide unreadable info
- if we could not stat, it is not an error, keep going.

11 years ago- split netbsd and freebsd version printing into separate functions
Christos Zoulas [Tue, 5 Nov 2013 15:44:01 +0000 (15:44 +0000)]
- split netbsd and freebsd version printing into separate functions
- don't let the NetBSD pax note end the search for notes
- add 2 more NetBSD notes

11 years agoadd android backup
Christos Zoulas [Tue, 5 Nov 2013 14:00:25 +0000 (14:00 +0000)]
add android backup

11 years agomove to more standard names.
Christos Zoulas [Tue, 29 Oct 2013 18:30:45 +0000 (18:30 +0000)]
move to more standard names.

11 years agoadd cdf improvements
Christos Zoulas [Tue, 29 Oct 2013 18:23:41 +0000 (18:23 +0000)]
add cdf improvements

11 years agoAdd microsoft installer files, improve the logic for handing mime and non-mime
Christos Zoulas [Tue, 29 Oct 2013 18:22:45 +0000 (18:22 +0000)]
Add microsoft installer files, improve the logic for handing mime and non-mime
on cdf. Parts from Guy Helmer

11 years agofix wrong offset for CDROM signature. (Anders Thulin)
Christos Zoulas [Thu, 24 Oct 2013 15:51:07 +0000 (15:51 +0000)]
fix wrong offset for CDROM signature. (Anders Thulin)

11 years agoadd bcache magic (Gabriel de Perthuis)
Christos Zoulas [Sun, 20 Oct 2013 17:41:05 +0000 (17:41 +0000)]
add bcache magic (Gabriel de Perthuis)

11 years agoPR/285: Fix netpbm P3 magic
Christos Zoulas [Fri, 27 Sep 2013 23:30:39 +0000 (23:30 +0000)]
PR/285: Fix netpbm P3 magic

11 years agoPR/284: ius: Merge and add various android magic entries
Christos Zoulas [Tue, 24 Sep 2013 20:22:03 +0000 (20:22 +0000)]
PR/284: ius: Merge and add various android magic entries

11 years agowelcome to file-5.15 FILE5_15
Christos Zoulas [Tue, 24 Sep 2013 15:21:44 +0000 (15:21 +0000)]
welcome to file-5.15

11 years agotry to avoid misidentifying boot records from partition entry records
Christos Zoulas [Tue, 24 Sep 2013 14:52:26 +0000 (14:52 +0000)]
try to avoid misidentifying boot records from partition entry records
(Joerg Jenderek)

11 years agorecognize custom user headers up to 4K for HDF files. (Tobias Richter)
Christos Zoulas [Mon, 23 Sep 2013 14:33:58 +0000 (14:33 +0000)]
recognize custom user headers up to 4K for HDF files. (Tobias Richter)

11 years agoadd PaX note
Christos Zoulas [Fri, 20 Sep 2013 00:39:43 +0000 (00:39 +0000)]
add PaX note

11 years agomove magic so that it works again. from joerg jenderek
Christos Zoulas [Thu, 19 Sep 2013 19:47:12 +0000 (19:47 +0000)]
move magic so that it works again. from joerg jenderek

11 years agoadd \\begin as a LaTeX keyword.
Christos Zoulas [Tue, 17 Sep 2013 17:39:16 +0000 (17:39 +0000)]
add \\begin as a LaTeX keyword.

11 years agoPR/281: Rainer Mueller: Fix DLE (020) meant to be space.
Christos Zoulas [Tue, 17 Sep 2013 17:33:36 +0000 (17:33 +0000)]
PR/281: Rainer Mueller: Fix DLE (020) meant to be space.

11 years agoPR/283: Tomas Siegl: Avoid SEGV on oomem.
Christos Zoulas [Tue, 17 Sep 2013 15:51:22 +0000 (15:51 +0000)]
PR/283: Tomas Siegl: Avoid SEGV on oomem.

11 years agoTry to make the magic more selective to avoid spurious matches. (Joerg Jenderek)
Christos Zoulas [Mon, 16 Sep 2013 15:12:42 +0000 (15:12 +0000)]
Try to make the magic more selective to avoid spurious matches. (Joerg Jenderek)

11 years agoPR/280: Add ECDSA and PEM EC private keys.
Christos Zoulas [Thu, 12 Sep 2013 16:23:56 +0000 (16:23 +0000)]
PR/280: Add ECDSA and PEM EC private keys.

11 years agoPR/269: Note that the MBR 0xAA55 signature that originated in 1983 with
Christos Zoulas [Thu, 12 Sep 2013 16:21:52 +0000 (16:21 +0000)]
PR/269: Note that the MBR 0xAA55 signature that originated in 1983 with
IBM PC DOS 2.0, is no more x86-specific (arm systems use it too). So call
the magic DOS/MBR as opposed to x86.

11 years agoPR/268: Account for different placement of [Content_types].xml by libreoffice.
Christos Zoulas [Thu, 12 Sep 2013 16:08:07 +0000 (16:08 +0000)]
PR/268: Account for different placement of [Content_types].xml by libreoffice.

11 years agocall file_reset() so that we don't accumulate errors from before.
Christos Zoulas [Thu, 12 Sep 2013 15:57:32 +0000 (15:57 +0000)]
call file_reset() so that we don't accumulate errors from before.

11 years agomore info about ctf.
Christos Zoulas [Sat, 7 Sep 2013 08:59:37 +0000 (08:59 +0000)]
more info about ctf.

11 years agoPR/278: Add PCO B16 images
Christos Zoulas [Tue, 3 Sep 2013 10:12:48 +0000 (10:12 +0000)]
PR/278: Add PCO B16 images

11 years agomention recent changes
Christos Zoulas [Tue, 3 Sep 2013 08:57:10 +0000 (08:57 +0000)]
mention recent changes

11 years agoIf we did not open the file, don't close it and try to restore its position.
Christos Zoulas [Tue, 3 Sep 2013 08:54:47 +0000 (08:54 +0000)]
If we did not open the file, don't close it and try to restore its position.

11 years agoIf we have an error, don't append anything to the buffer.
Christos Zoulas [Tue, 3 Sep 2013 08:31:48 +0000 (08:31 +0000)]
If we have an error, don't append anything to the buffer.

11 years agoSupport for sqlite application id (Jeff Smith)
Christos Zoulas [Tue, 27 Aug 2013 04:02:33 +0000 (04:02 +0000)]
Support for sqlite application id (Jeff Smith)

11 years agonew ctf magic.
Christos Zoulas [Mon, 26 Aug 2013 15:54:22 +0000 (15:54 +0000)]
new ctf magic.

11 years agosqllite log file additions (Jeff Smith)
Christos Zoulas [Mon, 26 Aug 2013 15:45:29 +0000 (15:45 +0000)]
sqllite log file additions (Jeff Smith)

11 years agoadd fdf mime from Joe Rayhawk
Christos Zoulas [Thu, 22 Aug 2013 07:47:26 +0000 (07:47 +0000)]
add fdf mime from Joe Rayhawk

11 years agoupdate
Christos Zoulas [Sun, 18 Aug 2013 06:24:40 +0000 (06:24 +0000)]
update

11 years agoPR/270: Krzysztof Wilczynski: Handle extra |
Christos Zoulas [Thu, 15 Aug 2013 13:43:09 +0000 (13:43 +0000)]
PR/270: Krzysztof Wilczynski: Handle extra |

11 years agoPR/260: Eric Buehl: Fix mpv mask
Christos Zoulas [Thu, 15 Aug 2013 13:15:11 +0000 (13:15 +0000)]
PR/260: Eric Buehl: Fix mpv mask

11 years agoPR/272: Daniel: Add Web/P images
Christos Zoulas [Thu, 15 Aug 2013 13:11:44 +0000 (13:11 +0000)]
PR/272: Daniel: Add Web/P images

11 years agoPR/273: oblomov: Add valve pack files.
Christos Zoulas [Thu, 15 Aug 2013 12:53:10 +0000 (12:53 +0000)]
PR/273: oblomov: Add valve pack files.

11 years agoRequire that the keywords have whitespace. Prevents ^char matching "charges"
Christos Zoulas [Wed, 14 Aug 2013 13:06:43 +0000 (13:06 +0000)]
Require that the keywords have whitespace. Prevents ^char matching "charges"
Too bad we cannot use word separator regex portably.

11 years agofixes to avoid a regex 17 error.
Christos Zoulas [Wed, 14 Aug 2013 09:10:36 +0000 (09:10 +0000)]
fixes to avoid a regex 17 error.

11 years agomore magic.
Christos Zoulas [Wed, 14 Aug 2013 09:01:45 +0000 (09:01 +0000)]
more magic.

11 years agoPrint LE/BE for arm elf, from Matt Thomas via NetBSD.
Christos Zoulas [Sun, 4 Aug 2013 09:31:47 +0000 (09:31 +0000)]
Print LE/BE for arm elf, from Matt Thomas via NetBSD.

11 years agoPrevent bogus extra encoding output.
Reuben Thomas [Sun, 21 Jul 2013 21:06:41 +0000 (21:06 +0000)]
Prevent bogus extra encoding output.

11 years agofile.man: add a comma for clarity
Reuben Thomas [Sun, 21 Jul 2013 19:52:55 +0000 (19:52 +0000)]
file.man: add a comma for clarity

11 years agomerge autocad definitions (Thomas Ledoux)
Christos Zoulas [Thu, 4 Jul 2013 15:24:37 +0000 (15:24 +0000)]
merge autocad definitions (Thomas Ledoux)

11 years agoasciicize.
Christos Zoulas [Wed, 26 Jun 2013 14:48:31 +0000 (14:48 +0000)]
asciicize.

11 years agomake this compile again.
Christos Zoulas [Wed, 26 Jun 2013 14:46:54 +0000 (14:46 +0000)]
make this compile again.

11 years agorecent change
Christos Zoulas [Wed, 26 Jun 2013 14:46:07 +0000 (14:46 +0000)]
recent change

11 years ago- Format the floppy code nicely, document where it comes from, and what the
Christos Zoulas [Mon, 17 Jun 2013 19:23:58 +0000 (19:23 +0000)]
- Format the floppy code nicely, document where it comes from, and what the
  binary strings mean
- Better FAT detection
- Add the ability to print DOS filenames.
Joerg Jenderek

11 years agoStrengthen the magic to avoid mis-detection (Joerg Jenderek)
Christos Zoulas [Mon, 17 Jun 2013 19:22:47 +0000 (19:22 +0000)]
Strengthen the magic to avoid mis-detection (Joerg Jenderek)

11 years agomake this compile again
Christos Zoulas [Sun, 9 Jun 2013 00:13:36 +0000 (00:13 +0000)]
make this compile again

11 years agoadd missing break.
Christos Zoulas [Sat, 8 Jun 2013 14:13:12 +0000 (14:13 +0000)]
add missing break.

11 years agoGeneralize a bit of wording to make more distro-friendly.
Ian Darwin [Tue, 4 Jun 2013 23:15:02 +0000 (23:15 +0000)]
Generalize a bit of wording to make more distro-friendly.

11 years agoAccount for wcwidth might return -1.
Ian Darwin [Tue, 4 Jun 2013 21:51:00 +0000 (21:51 +0000)]
Account for wcwidth might return -1.
|
| >From OpenBSD revision 1.23
| date: 2011/04/15 16:05:34;  author: stsp;  state: Exp;  lines: +7 -3   e!
| Make the file_mbswidth() function cope if wcwidth() returns -1.
| ok mikeb millert
Here, ok Christos.

11 years agoPR/250: add freeplane format which is a fork of freemind by Felix Natter
Christos Zoulas [Mon, 3 Jun 2013 19:07:29 +0000 (19:07 +0000)]
PR/250: add freeplane format which is a fork of freemind by Felix Natter

11 years agoPR/253: remove invalid byte order messages
Christos Zoulas [Mon, 3 Jun 2013 18:56:50 +0000 (18:56 +0000)]
PR/253: remove invalid byte order messages

11 years agodon't treat as an error if the magic offset was after the end of our sample.
Christos Zoulas [Thu, 30 May 2013 15:53:33 +0000 (15:53 +0000)]
don't treat as an error if the magic offset was after the end of our sample.
(Christoph Biedl)

11 years agomention spacing issue fixes.
Christos Zoulas [Tue, 28 May 2013 21:26:31 +0000 (21:26 +0000)]
mention spacing issue fixes.

11 years agokill extra spaces (Jan Kaluza)
Christos Zoulas [Tue, 28 May 2013 21:25:25 +0000 (21:25 +0000)]
kill extra spaces (Jan Kaluza)

11 years agodon't print a space if there was an error. (from Jan Kaluza)
Christos Zoulas [Tue, 28 May 2013 21:24:31 +0000 (21:24 +0000)]
don't print a space if there was an error. (from Jan Kaluza)

11 years agoAdd new microsoft filesystem (from Richard W.M. Jones)
Christos Zoulas [Tue, 14 May 2013 12:55:42 +0000 (12:55 +0000)]
Add new microsoft filesystem (from Richard W.M. Jones)
http://msdn.microsoft.com/en-us/library/windows/desktop/hh848060(v=vs.85).aspx

11 years agoadd partition id names; repair boot sector message
Christos Zoulas [Thu, 9 May 2013 01:21:51 +0000 (01:21 +0000)]
add partition id names; repair boot sector message

11 years agolatest fix
Christos Zoulas [Thu, 2 May 2013 21:59:22 +0000 (21:59 +0000)]
latest fix

11 years agoPR/248: Multiple magic_loads fail due to global address re-use. Add a struct
Christos Zoulas [Thu, 2 May 2013 21:58:20 +0000 (21:58 +0000)]
PR/248: Multiple magic_loads fail due to global address re-use. Add a struct
to describe the set entries eliminating the global variable.

11 years agoAdd a note about Ragel
Reuben Thomas [Mon, 22 Apr 2013 22:59:46 +0000 (22:59 +0000)]
Add a note about Ragel

11 years agodon't ignore m4
Christos Zoulas [Mon, 22 Apr 2013 16:52:12 +0000 (16:52 +0000)]
don't ignore m4

11 years agonew clear keyword, change the way default works.
Christos Zoulas [Mon, 22 Apr 2013 15:30:10 +0000 (15:30 +0000)]
new clear keyword, change the way default works.

11 years agonew pgf magic
Christos Zoulas [Mon, 22 Apr 2013 15:19:49 +0000 (15:19 +0000)]
new pgf magic

11 years agoAdd c clear magic and a default that prints unknown arch
Christos Zoulas [Mon, 22 Apr 2013 15:19:12 +0000 (15:19 +0000)]
Add c clear magic and a default that prints unknown arch

11 years agobetter support for PNF files (Joerg Jenderek)
Christos Zoulas [Fri, 19 Apr 2013 20:12:29 +0000 (20:12 +0000)]
better support for PNF files (Joerg Jenderek)

11 years agospecialize the test to avoid clash with windows PNF files (Joerg Jenderek)
Christos Zoulas [Fri, 19 Apr 2013 20:11:43 +0000 (20:11 +0000)]
specialize the test to avoid clash with windows PNF files (Joerg Jenderek)

11 years agofix integer overflow preventing bounds check (Shane Huntley)
Christos Zoulas [Wed, 3 Apr 2013 14:38:29 +0000 (14:38 +0000)]
fix integer overflow preventing bounds check (Shane Huntley)

11 years agoallow list for long opts. it was erroneous ifdefed out by S_IFLNK. from
Christos Zoulas [Tue, 2 Apr 2013 16:26:24 +0000 (16:26 +0000)]
allow list for long opts. it was erroneous ifdefed out by S_IFLNK. from
joerg jenderek

11 years agoAdd EXEEXT, from joerg jenderek
Christos Zoulas [Tue, 2 Apr 2013 16:25:04 +0000 (16:25 +0000)]
Add EXEEXT, from joerg jenderek

11 years agofix wrong type, from joerg jenderek
Christos Zoulas [Tue, 2 Apr 2013 16:23:07 +0000 (16:23 +0000)]
fix wrong type, from joerg jenderek

11 years agobump the kernel again since bios and friends got bumped.
Christos Zoulas [Mon, 1 Apr 2013 16:58:45 +0000 (16:58 +0000)]
bump the kernel again since bios and friends got bumped.

11 years agodisallow strength in magic "name" entries
Christos Zoulas [Mon, 25 Mar 2013 17:20:43 +0000 (17:20 +0000)]
disallow strength in magic "name" entries

11 years agofix eicar
Christos Zoulas [Mon, 25 Mar 2013 17:18:47 +0000 (17:18 +0000)]
fix eicar

11 years agomention archives and use ascii only. (glensc)
Christos Zoulas [Mon, 25 Mar 2013 14:33:10 +0000 (14:33 +0000)]
mention archives and use ascii only. (glensc)

11 years agolimit to 100 repetitions to avoid excessive backtracking Carsten Wolff
Christos Zoulas [Mon, 25 Mar 2013 14:06:55 +0000 (14:06 +0000)]
limit to 100 repetitions to avoid excessive backtracking Carsten Wolff

11 years agoadd EICAR
Christos Zoulas [Sat, 23 Mar 2013 14:15:30 +0000 (14:15 +0000)]
add EICAR

11 years agowelcome to 5.14 FILE5_14
Christos Zoulas [Thu, 21 Mar 2013 17:50:51 +0000 (17:50 +0000)]
welcome to 5.14

11 years agoPR/242: Move strength to the parent pattern since setting them in "use"
Christos Zoulas [Thu, 21 Mar 2013 17:50:02 +0000 (17:50 +0000)]
PR/242: Move strength to the parent pattern since setting them in "use"
pattern does not affect the parent.

11 years agoPR/241: Jan Kaluza: Add python 3.3
Christos Zoulas [Mon, 18 Mar 2013 12:49:55 +0000 (12:49 +0000)]
PR/241: Jan Kaluza: Add python 3.3

11 years agowhen treating block and char files as regular, pretend we did not find
Christos Zoulas [Sun, 17 Mar 2013 15:43:20 +0000 (15:43 +0000)]
when treating block and char files as regular, pretend we did not find
anything in fsmagic.

11 years agofilesystems detail patch from joerg jenderek
Christos Zoulas [Thu, 14 Mar 2013 01:38:30 +0000 (01:38 +0000)]
filesystems detail patch from joerg jenderek

11 years agoNot all files in directory sample/dbase are identified
Christos Zoulas [Sat, 9 Mar 2013 22:36:00 +0000 (22:36 +0000)]
Not all files in directory sample/dbase are identified
alright (see output file dbase-5.13-old.txt and dbase-mime-5.13-old.txt)

HELP.CA1 is misidentified as "DBase 3 index file" and HELP.CA3 is
misidentified as "DBase 3 data file" because the magic line for DBase 3
inside msdos magic are too weak. In reality these files are the split files
of HELP.zip , a zip file with 12 extra Bytes of Turbo C.
For the example z-machine.bin i got beside the right message
"Infocom (Z-machine 3, Release 9 / Serial 123456)" also a wrong
identification as "DBase 3 data file (no records)".
Also all Android files (all *.xml except sybase-ianywhere-cdx.trid.xml) are
misidentified as "DBase 3 data file".
The two files umlaut-test-v2.dbf and umlaut-test-v4.dbf are not recognized
as DBase , because the magic lines test only for version 3 of dbase. And so
other versions are not found.
The first programs to create DBase files run under DOS, but nowadays such
xBase files can be created by Libre Office for example running under Linux.
So i removed test lines in msdos ( see file-5.13-msdos-xBase.diff ) and add
right test lines in database magic.
Using information from
http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
http://www.clicketyclick.dk/databases/xbase/format/dbf.html
http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
i inspect at offset zero 4 byte sequence VVYYMMDD ,where month (MM) must be
in the range from 1 to 12, days (DD) in the range from 1 to 31. The lowest
DBase version (VV) is two.  By these tests Infocom game Z-machine and  the
Androids *.xml files are skipped.
Then i tried to test some reserved fields , which should be 0 . But this
does not work for offset 30 , where i found 0x3901 for T4.DBF or 0x710 for
T5.DBF andT6.DBF. So i use byte at offset 27, which was 0 for all inspected
Dbase files. This is reserved for multi-user dBASE. So i do not know if my
test is reliable for such exotic cases. After this test HELP.CA3 is
skipped.
Further long zero found at offset 24 is the result for .DBF files whereas
for.MDX files this is a low positive number , because it expresses
production flag, tag numbers(<=0x30), tag length(<=0x20), reserved byte
(NULL) . After some additional tests i display version info (VV byte) for
MDX and DBF files by subroutine xbase-type
For my examples VV is in the set (2,3,4,0x30,0x83). So i do not know if all
exotic xBase variants are described right, especially by information in
http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
Then i use the subroutine xbase-date to test and print the
creation-date and update-date (YY-DD-MM). The date information is only
stored as byte. Values below 100 should be 19YY, but i found samples were
correct interpretation is 20YY (for example umlaut-LibreOffice3.6.3.dbf)
not corresponding with information. Values equal or greater hundred should
be interpreted as 1900+VV, but at the moment they are displayed ugly as
1yy. So may be somebody can fix this problem. I also display number and
sizes
of records or tags and the name of the first item.

No xBase memo file (*.dbt *.DBT *.FPT) is identified correctly ( see output
dbt-5.13-old.txt ). This files have few characteristic sequences ( 0 or 3
at offset 16) . So i test values of some reserved bytes for the existence
of 0 or low values. For my inspected examples this works, but there may be
exist samples which contain garbage values at that points. Furthermore i
has to use some "if -else-if" constructs to match all memo file variants,
for which type and additional information is displayed by subroutine
xbase-memo-print.
After these test all memo files are identified correctly ( see output
dbt-5.13-new.txt ) except test-FoxPro_Enc.FPT, because it is an encrypted
file.

The dbase memo file adressen.dbt is is not misidentified as
"DBase 3 data file (no records)", but also characterised wrong as
"VMS Alpha executable". According to comments in vms magic files
real VMS files should look like examples vms-test6.bin or vms-test7.bin.
So i put the additional the following magic test line inside vms file.
>8 ubelong 0xec020000
After applying file-5.13-vms_dbt.diff only  vms-test*.bin are identified
correct as "VMS Alpha executable". Because i have no knowledge about VMS
an expert has to check my diff file for correctness.

The  Xbase index files t3-CHAR.NDX is misidentified as "X11 SNF font data,
LSB first". According to information found at
http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
the same 4 byte version info at offset zero should also occur at offset 104
So i add  additional test line
>104 lelong 00000004 X11 SNF font data, LSB first
to fonts magic.
Because i found no Server Natural Font (.SNF) and had no tool bdftosnf,
i could not verify these fixes made by my patch
file-5.13-fonts-X11-SNF_NDX.diff

The 2 dbase memo files T5.DBT and T6.DBT are misidentified
(see output file pcx-5.13-old.txt ) as " PCX ver. 2.5 image data" without
geometry information because these files with 0xa000000 at offset 0 match
these magic line:
0 beshort 0x0a00 PCX ver. 2.5 image data
So i patch images magic files.
According to http://de.wikipedia.org/wiki/PCX and
http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
i test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1)
and bit depth by line
0 ubelong&0xffF8fe00 0x0a000000
For real PCX files bit depth at offset 3 is greater 0. So sample DBT files
are excluded by additional test line
>3 ubyte >0
By further inspection i saw that signed values are used ,especially for
dpi, planes, coordinates, which should be always positive and not negative.
Converting 65432x10-xab.png (right identified as
PNG image data, 65432 x 10) by xnview to 65432x10-xab.pcx
gives wrong "PCX ver. 3.0 image data bounding box [0, 0] - [-105, 9], 3
planes each of 8-bit colour, 72 x 72 dpi, uncompressed"
So i replaced signed pattern by unsigned for such values.
Furthermore 60x20-v4-graytext.pcx is identified OK as "PCX for Windows
image data", but no geometry information is displayed, because original
magic does this only for PCX files with version "ver. 3.0 image data"
After applying file-5.13-images_pcx.diff test files for PCX  are identified
all right (see output file pcx-5.13-new.txt )

Unfortunately SYLLABI2.CDX and SYLLABUS.CDX are identified wrong as
"Applesoft BASIC program data" because magic test in apple magic file was
to general:
0       belong&0xff00ff 0x80000 Applesoft BASIC program data
If i understood the magic fragment right first line number is  stored
at offset 2 as leshort. For both files this value is zero, where
for real Applesoft BASIC that value should be positive in my opinion.
So with my patch file file-5.13-apple-basic.diff sent to mailing list
at 3.February 2013 these 2 examples are not misidentified any more.
But an expert for Applesoft BASIC should double check my diff file.
In reality these files are indices of the dBase databases with same main
name and extension dbf.

The FoxPro memo file NG.FPT is misidentifies as "MPEG sequence, v4"
because this file start with byte sequence "000001b0 00000100 00000000"
and in animation the 2 following test lines are too general:
0        belong&0xFFFFFF00  0x00000100
>3       byte               0xB0           MPEG sequence, v4
For me it seems that non zero byte at offset 4 describes the variant like
for example "simple @ L1". If this is a true NG.FPT could be differed from
MGEP by the following additional  line
>>4      byte               !0             MPEG sequence, v4
Because i have no knowledge for MEG files i add this line only as comment
line (file-5.13-animation-NG_FPT.diff). So an expert has to revise this
things.

The dBASE memo file biblio.dbt is misidentified as "Dyalog APL"
because "0 byte 0xaa" is a too weak magic pattern.
 Also Dyalog-test3.bin is characterised as "Dyalog APL workspace type 0
subtype 0 32-bit classic big-endian Dyalog APL workspace version 0 .0\012-
Dyalog APL". Three "Dyalog APL" entries does not make sense in my opinion.
Also the version format "0 .0" should appear as "n.m". Unfortunately i do
not have knowledge about  Dyalog APL. So an expert has to revise the
dyadic magic file and fix this very erroneous file.

After changing database magic by file-5.13-database-xBase.diff
and applying the other patches i got finally a much more correcter
classification (see output  dbase-5.13-new.txt and
dbase-mime-5.13-new.txt ).
There are still some files that are not identified. So to do is DBASE index
file *.NDX, DBASE Compound Index file *.CDX, dBASE IV Printer Driver *.PRF.
Maybe i will do it in the future

All diffs, output and sample files are stored under
http://mitglied.multimania.de/jenderek/file/

11 years agotoday's changes
Christos Zoulas [Thu, 7 Mar 2013 02:24:23 +0000 (02:24 +0000)]
today's changes