From 5b7e2a9a59a4c03a0bbf08f88146b525a56c7670 Mon Sep 17 00:00:00 2001
From: Christos Zoulas <christos@zoulas.com>
Date: Tue, 7 Feb 2017 23:25:26 +0000
Subject: [PATCH] Improve flash detection (Christoph Biedl)

---
 magic/Magdir/flash | 52 +++++++++++++++++++++++++++++++++-------------
 1 file changed, 37 insertions(+), 15 deletions(-)

diff --git a/magic/Magdir/flash b/magic/Magdir/flash
index b32962b5..ba5ed6a1 100644
--- a/magic/Magdir/flash
+++ b/magic/Magdir/flash
@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: flash,v 1.10 2014/03/06 16:07:24 christos Exp $
+# $File: flash,v 1.11 2014/05/02 00:26:49 christos Exp $
 # flash:	file(1) magic for Macromedia Flash file format
 #
 # See
@@ -11,22 +11,44 @@
 #
 
 0   name        swf-details
->0	string		F		Macromedia Flash data
-!:mime	application/x-shockwave-flash
->0	string		C		Macromedia Flash data (compressed)
-!:mime	application/x-shockwave-flash
->0	string		Z		Macromedia Flash data (lzma compressed)
-!:mime	application/x-shockwave-flash
->3   byte        x      \b, version %d
 
-1   string      WS
->4  lelong      !0
->>3 byte        255 Suspicious
->>>0    use     swf-details
+>0      string      F
+>>8     byte&0xfd   0x08    Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     byte&0xfe   0x10    Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     byte        0x18    Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     beshort&ff87 0x2000 Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     beshort&ffe0 0x3000 Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     byte&0x7    0
+>>>8    ubyte       >0x2f
+>>>>9   ubyte       <0x20   Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>>>3  byte        x       \b, version %d
+
+>0      string      C
+>>8     byte        0x78    Macromedia Flash data (compressed)
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+
+>0      string      Z
+>>8     byte        0x5d    Macromedia Flash data (lzma compressed)
+!:mime  application/x-shockwave-flash
+>>>3    byte        x      \b, version %d
 
->>3 ubyte       <32
->>>3 ubyte      !0
->>>>0   use     swf-details
+
+1   string      WS
+>4  ulelong     >14
+>>3 ubyte       !0
+>>>0   use      swf-details
 
 # From: Cal Peake <cp@absolutedigital.net>
 0	string		FLV\x01		Macromedia Flash Video
-- 
2.40.0