From 28b62f334e82e1dc5de9267ad28b9b5acfa06454 Mon Sep 17 00:00:00 2001 From: Christos Zoulas Date: Thu, 8 Jun 2006 22:21:40 +0000 Subject: [PATCH] magic changes, update the magic list. --- magic/Magdir/archive | 9 +++++++++ magic/Magdir/audio | 38 ++++++++++++++++++++++++++++++++++++++ magic/Magdir/elf | 23 +++++++++++++---------- magic/Magdir/filesystems | 31 ++++++++++++++++++++++++++++--- magic/Magdir/images | 5 +++++ magic/Magdir/msdos | 2 ++ magic/Magdir/os400 | 32 ++++++++++++++++++++++++++++++++ magic/Makefile.am | 2 ++ 8 files changed, 129 insertions(+), 13 deletions(-) create mode 100644 magic/Magdir/os400 diff --git a/magic/Magdir/archive b/magic/Magdir/archive index f60731b8..8409e4c8 100644 --- a/magic/Magdir/archive +++ b/magic/Magdir/archive @@ -700,3 +700,12 @@ # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive + +# From: "Robert Dale" +0 belong 123 dar archive, +>4 belong x label "%.8x +>>8 belong x %.8x +>>>12 beshort x %.4x" +>14 byte 0x54 end slice +>14 beshort 0x4e4e multi-part +>14 beshort 0x4e53 multi-part, with -S diff --git a/magic/Magdir/audio b/magic/Magdir/audio index b74537bd..864aa01d 100644 --- a/magic/Magdir/audio +++ b/magic/Magdir/audio @@ -511,3 +511,41 @@ 0 string \[playlist\] PLS playlist # licq.conf 1 string \[licq\] LICQ configuration file + +# Atari ST audio files by Dirk Jagdmann +0 string ICE! SNDH Atari ST music +0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music + +# musepak support From: "Jiri Pejchal" +0 string MP+ Musepack audio +>3 byte 255 \b, SV pre8 +>3 byte&0xF 0x6 \b, SV 6 +>3 byte&0xF 0x8 \b, SV 8 +>3 byte&0xF 0x7 \b, SV 7 +>>3 byte&0xF0 0x0 \b.0 +>>3 byte&0xF0 0x10 \b.1 +>>3 byte&0xF0 240 \b.15 +>>10 byte&0xF0 0x0 \b, no profile +>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' +>>10 byte&0xF0 0x50 \b, quality 0 +>>10 byte&0xF0 0x60 \b, quality 1 +>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) +>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) +>>10 byte&0xF0 0x90 \b, quality 4 (Radio) +>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) +>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) +>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) +>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) +>>10 byte&0xF0 0xE0 \b, quality 9 +>>10 byte&0xF0 0xF0 \b, quality 10 +>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 +>>27 byte 102 \b, Beta 1.02 +>>27 byte 104 \b, Beta 1.04 +>>27 byte 105 \b, Alpha 1.05 +>>27 byte 106 \b, Beta 1.06 +>>27 byte 110 \b, Release 1.1 +>>27 byte 111 \b, Alpha 1.11 +>>27 byte 112 \b, Beta 1.12 +>>27 byte 113 \b, Alpha 1.13 +>>27 byte 114 \b, Beta 1.14 +>>27 byte 115 \b, Alpha 1.15 diff --git a/magic/Magdir/elf b/magic/Magdir/elf index 9b559b1e..b2eb2473 100644 --- a/magic/Magdir/elf +++ b/magic/Magdir/elf @@ -84,14 +84,14 @@ >>18 leshort 40 ARM, >>18 leshort 41 Alpha, >>18 leshort 0xa390 IBM S/390 (obsolete), ->>18 leshort 42 Hitachi SH, +>>18 leshort 42 Renesas SH, >>18 leshort 43 SPARC V9 - invalid byte order, >>18 leshort 44 Siemens Tricore Embedded Processor, >>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., ->>18 leshort 46 Hitachi H8/300, ->>18 leshort 47 Hitachi H8/300H, ->>18 leshort 48 Hitachi H8S, ->>18 leshort 49 Hitachi H8/500, +>>18 leshort 46 Renesas H8/300, +>>18 leshort 47 Renesas H8/300H, +>>18 leshort 48 Renesas H8S, +>>18 leshort 49 Renesas H8/500, >>18 leshort 50 IA-64, >>18 leshort 51 Stanford MIPS-X, >>18 leshort 52 Motorola Coldfire, @@ -176,14 +176,14 @@ >>18 beshort 39 Motorola RCE, >>18 beshort 40 ARM, >>18 beshort 41 Alpha, ->>18 beshort 42 Hitachi SH, +>>18 beshort 42 Renesas SH, >>18 beshort 43 SPARC V9, >>18 beshort 44 Siemens Tricore Embedded Processor, >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., ->>18 beshort 46 Hitachi H8/300, ->>18 beshort 47 Hitachi H8/300H, ->>18 beshort 48 Hitachi H8S, ->>18 beshort 49 Hitachi H8/500, +>>18 beshort 46 Renesas H8/300, +>>18 beshort 47 Renesas H8/300H, +>>18 beshort 48 Renesas H8S, +>>18 beshort 49 Renesas H8/500, >>18 beshort 50 IA-64, >>18 beshort 51 Stanford MIPS-X, >>18 beshort 52 Motorola Coldfire, @@ -215,5 +215,8 @@ >>7 byte 10 (Tru64) >>7 byte 11 (Novell Modesto) >>7 byte 12 (OpenBSD) +# VMS Itanium added by gerardo.cacciari@gmail.com +>8 string \2 +>>7 byte 13 (OpenVMS) >>7 byte 97 (ARM) >>7 byte 255 (embedded) diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems index a2c960a7..27976da1 100644 --- a/magic/Magdir/filesystems +++ b/magic/Magdir/filesystems @@ -783,7 +783,16 @@ # # CDROM Filesystems -32769 string CD001 ISO 9660 CD-ROM filesystem data +# Modified for UDF by gerardo.cacciari@gmail.com +32769 string CD001 +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data +>38913 string NSR01 UDF filesystem data (version 1.0) +>38913 string NSR02 UDF filesystem data (version 1.5) +>38913 string NSR03 UDF filesystem data (version 2.0) +>38913 string >NSR03 UDF filesystem data (unknown version, +>>38917 byte x id 'NSR0%c') +>38913 string >38917 byte x id 'NSR0%c') # "application id" which appears to be used as a volume label >32808 string >\0 '%s' >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) @@ -848,7 +857,11 @@ 0 string sqsh Squashfs filesystem, big endian, >28 beshort x version %d. >30 beshort x \b%d, ->8 belong x %d bytes, +>28 beshort <3 +>>8 belong x %d bytes, +>28 beshort >2 +>>63 bequad x %d bytes, +#>>67 belong x %d bytes, >4 belong x %d inodes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, @@ -858,7 +871,11 @@ 0 string hsqs Squashfs filesystem, little endian, >28 leshort x version %d. >30 leshort x \b%d, ->8 lelong x %d bytes, +>28 leshort <3 +>>8 lelong x %d bytes, +>28 leshort >2 +>>63 lequad x %d bytes, +#>>63 lelong x %d bytes, >4 lelong x %d inodes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, @@ -879,3 +896,11 @@ >>>>>>>>&4 bedate x on: %s >>>>>>>>&0 bedate =0 full dump >>>>>>>>&0 bedate !0 incremental since: %s + +# VMS backup savesets - gerardo.cacciari@gmail.com +# had to comment out GEM Image and G3 raw data entries due to conflict +0 byte x +>(0.s+16) string \x01\x01 +>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data +>>>40 lelong x (block size %d +>>>49 string >\0 original name '%s') diff --git a/magic/Magdir/images b/magic/Magdir/images index 70fd84c2..3a1a56c2 100644 --- a/magic/Magdir/images +++ b/magic/Magdir/images @@ -526,3 +526,8 @@ # specifications at http://hdf.ncsa.uiuc.edu/ 0 belong 0x0e031301 Hierarchical Data Format (version 4) data 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data + +# From: Tobias Burnus +# Xara (for a while: Corel Xara) is a graphic package, see +# http://www.xara.com/ for Windows and as GPL application for +0 string XARA\243\243 Xara graphics file diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos index c6425f33..27b531bd 100644 --- a/magic/Magdir/msdos +++ b/magic/Magdir/msdos @@ -86,6 +86,7 @@ >>>>(0x3c.l+4) leshort 0x290 PA-RISC >>>>(0x3c.l+22) leshort&0x0100 >0 32-bit >>>>(0x3c.l+22) leshort&0x1000 >0 system file +>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed @@ -358,6 +359,7 @@ >30 byte 12 (4kB sectors) # Popular applications +0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer 2080 string Microsoft\ Word\ 6.0\ Document %s 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data # Pawel Wiecek (for polish Word) diff --git a/magic/Magdir/os400 b/magic/Magdir/os400 new file mode 100644 index 00000000..bee36606 --- /dev/null +++ b/magic/Magdir/os400 @@ -0,0 +1,32 @@ +#------------------------------------------------------------------------------ +# os400: file(1) magic for IBM OS/400 files + +# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com +# In spite of its quite variable format (due to internal memory page +# length differences between CISC and RISC versions of the OS) the +# SAVF structure hasn't suitable offsets to identify the catalog +# header in the first descriptor where there are some useful infos, +# so we must search in a somewhat large area for a particular string +# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore +# descriptor space) preceded by a two byte constant. +40 string @@@@@@@@ +>1089 search/7394 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data +>>&212 byte 0x01 \b, created with SAVOBJ +>>&212 byte 0x02 \b, created with SAVLIB +>>&212 byte 0x07 \b, created with SAVCFG +>>&212 byte 0x0B \b, created with SAVDLO +>>&213 byte 0x43 \b, at least V5R3 to open +>>&213 byte 0x42 \b, at least V5R2 to open +>>&213 byte 0x41 \b, at least V5R1 to open +>>&213 byte 0x40 \b, at least V4R5 to open +>>&213 byte 0x3F \b, at least V4R4 to open +>>&213 byte 0x3E \b, at least V4R3 to open +>>&213 byte 0x3C \b, at least V4R2 to open +>>&213 byte 0x3D \b, at least V4R1M4 to open +>>&213 byte 0x3B \b, at least V4R1 to open +>>&213 byte 0x3A \b, at least V3R7 to open +>>&213 byte 0x35 \b, at least V3R6 to open +>>&213 byte 0x36 \b, at least V3R2 to open +>>&213 byte 0x34 \b, at least V3R1 to open +>>&213 byte 0x31 \b, at least V3R0M5 to open +>>&213 byte 0x30 \b, at least V2R3 to open diff --git a/magic/Makefile.am b/magic/Makefile.am index 7b6c73a0..8e904e6d 100644 --- a/magic/Makefile.am +++ b/magic/Makefile.am @@ -52,6 +52,7 @@ Magdir/bout \ Magdir/bsdi \ Magdir/btsnoop \ Magdir/cad \ +Magdir/cafebabe \ Magdir/c-lang \ Magdir/c64 \ Magdir/cddb \ @@ -143,6 +144,7 @@ Magdir/ocaml \ Magdir/octave \ Magdir/olf \ Magdir/os2 \ +Magdir/os400 \ Magdir/os9 \ Magdir/osf1 \ Magdir/palm \ -- 2.40.0