kgess-mirror/freebsd-src
1
0
Fork 0
mirror of https://git.freebsd.org/src.git synced 2026-01-16 23:02:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

MFV: file 5.46.

Browse source 
MFC after:	2 weeks
This commit is contained in:
Xin LI 2024-12-08 11:07:01 -08:00
commit ae316d1d1c
164 changed files with 9000 additions and 3942 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
contrib/file/ChangeLog
View file

@ -1,3 +1,35 @@
2024-11-27 14:44 Christos Zoulas <christos@zoulas.com>
* release 5.46
* Add OFFPOSITIVE
2024-11-25 13:56 Christos Zoulas <christos@zoulas.com>
* avoid leaking symbols in libmagic
2024-11-10 13:56 Christos Zoulas <christos@zoulas.com>
* PR/562: jsummers: Search/regex offsets are absolute to the
beginning of the file, so adjust them by subtracting the
offset that the "use" starts so that we don't double-count it.
2024-11-09 19:30 Christos Zoulas <christos@zoulas.com>
* PR/543: matshch: bump nbuf so we can get the flags into the buffer.
2024-11-02 14:34 Christos Zoulas <christos@zoulas.com>
* Add Android elf notes (enh)
2023-12-29 12:55 Christos Zoulas <christos@zoulas.com>
* Add limit for number of magic warnings allowed
2023-07-29 12:55 Christos Zoulas <christos@zoulas.com>
* check regex bounds (found by clusterfuzz)
2023-07-27 15:45 Christos Zoulas <christos@zoulas.com>
* release 5.45

1
contrib/file/Makefile.in
View file

@ -264,6 +264,7 @@ EGREP = @EGREP@
ETAGS = @ETAGS@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
FILECMD = @FILECMD@
GREP = @GREP@
HAVE_VISIBILITY = @HAVE_VISIBILITY@
INSTALL = @INSTALL@

4
contrib/file/aclocal.m4 vendored
View file

@ -14,8 +14,8 @@
m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
m4_ifndef([AC_AUTOCONF_VERSION],
[m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.71],,
[m4_warning([this file was generated for autoconf 2.71.
m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.72],,
[m4_warning([this file was generated for autoconf 2.72.
You have another version of autoconf. It may work, but is not guaranteed to.
If you have problems, you may need to regenerate the build system entirely.
To do so, use the procedure documented by the package, typically 'autoreconf'.])])

137
contrib/file/config.h.in
View file

@ -12,10 +12,10 @@
/* Define for ELF core file support */
#undef ELFCORE
/* Define to 1 if you have the `asctime_r' function. */
/* Define to 1 if you have the 'asctime_r' function. */
#undef HAVE_ASCTIME_R
/* Define to 1 if you have the `asprintf' function. */
/* Define to 1 if you have the 'asprintf' function. */
#undef HAVE_ASPRINTF
/* Define to 1 if you have the <byteswap.h> header file. */
@ -24,24 +24,24 @@
/* Define to 1 if you have the <bzlib.h> header file. */
#undef HAVE_BZLIB_H
/* Define to 1 if you have the `ctime_r' function. */
/* Define to 1 if you have the 'ctime_r' function. */
#undef HAVE_CTIME_R
/* HAVE_DAYLIGHT */
#undef HAVE_DAYLIGHT
/* Define to 1 if you have the declaration of `daylight', and to 0 if you
/* Define to 1 if you have the declaration of 'daylight', and to 0 if you
don't. */
#undef HAVE_DECL_DAYLIGHT
/* Define to 1 if you have the declaration of `tzname', and to 0 if you don't.
/* Define to 1 if you have the declaration of 'tzname', and to 0 if you don't.
*/
#undef HAVE_DECL_TZNAME
/* Define to 1 if you have the <dlfcn.h> header file. */
#undef HAVE_DLFCN_H
/* Define to 1 if you have the `dprintf' function. */
/* Define to 1 if you have the 'dprintf' function. */
#undef HAVE_DPRINTF
/* Define to 1 if you have the <err.h> header file. */
@ -50,63 +50,69 @@
/* Define to 1 if you have the <fcntl.h> header file. */
#undef HAVE_FCNTL_H
/* Define to 1 if you have the `fmtcheck' function. */
/* Define to 1 if you have the 'fmtcheck' function. */
#undef HAVE_FMTCHECK
/* Define to 1 if you have the `fork' function. */
/* Define to 1 if you have the 'fork' function. */
#undef HAVE_FORK
/* Define to 1 if you have the `freelocale' function. */
/* Define to 1 if you have the 'freelocale' function. */
#undef HAVE_FREELOCALE
/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
/* Define to 1 if fseeko (and ftello) are declared in stdio.h. */
#undef HAVE_FSEEKO
/* Define to 1 if you have the `getline' function. */
/* Define to 1 if you have the 'getline' function. */
#undef HAVE_GETLINE
/* Define to 1 if you have the <getopt.h> header file. */
#undef HAVE_GETOPT_H
/* Define to 1 if you have the `getopt_long' function. */
/* Define to 1 if you have the 'getopt_long' function. */
#undef HAVE_GETOPT_LONG
/* Define to 1 if you have the `getpagesize' function. */
/* Define to 1 if you have the 'getpagesize' function. */
#undef HAVE_GETPAGESIZE
/* Define to 1 if you have the `gmtime_r' function. */
/* Define to 1 if you have the 'gmtime_r' function. */
#undef HAVE_GMTIME_R
/* Define to 1 if the system has the type `intptr_t'. */
/* Define to 1 if the system has the type 'intptr_t'. */
#undef HAVE_INTPTR_T
/* Define to 1 if you have the <inttypes.h> header file. */
#undef HAVE_INTTYPES_H
/* Define to 1 if you have the `bz2' library (-lbz2). */
/* Define to 1 if you have the 'bz2' library (-lbz2). */
#undef HAVE_LIBBZ2
/* Define to 1 if you have the `gnurx' library (-lgnurx). */
/* Define to 1 if you have the 'gnurx' library (-lgnurx). */
#undef HAVE_LIBGNURX
/* Define to 1 if you have the `lz' library (-llz). */
/* Define to 1 if you have the 'lrzip' library (-llrzip). */
#undef HAVE_LIBLRZIP
/* Define to 1 if you have the 'lz' library (-llz). */
#undef HAVE_LIBLZ
/* Define to 1 if you have the `lzma' library (-llzma). */
/* Define to 1 if you have the 'lzma' library (-llzma). */
#undef HAVE_LIBLZMA
/* Define to 1 if you have the `seccomp' library (-lseccomp). */
/* Define to 1 if you have the 'seccomp' library (-lseccomp). */
#undef HAVE_LIBSECCOMP
/* Define to 1 if you have the `z' library (-lz). */
/* Define to 1 if you have the 'z' library (-lz). */
#undef HAVE_LIBZ
/* Define to 1 if you have the `zstd' library (-lzstd). */
/* Define to 1 if you have the 'zstd' library (-lzstd). */
#undef HAVE_LIBZSTD
/* Define to 1 if you have the `localtime_r' function. */
/* Define to 1 if you have the 'localtime_r' function. */
#undef HAVE_LOCALTIME_R
/* Define to 1 if you have the <Lrzip.h> header file. */
#undef HAVE_LRZIP_H
/* Define to 1 if you have the <lzlib.h> header file. */
#undef HAVE_LZLIB_H
@ -119,31 +125,31 @@
/* Define to 1 if <wchar.h> declares mbstate_t. */
#undef HAVE_MBSTATE_T
/* Define to 1 if you have the `memmem' function. */
/* Define to 1 if you have the 'memmem' function. */
#undef HAVE_MEMMEM
/* Define to 1 if you have the <minix/config.h> header file. */
#undef HAVE_MINIX_CONFIG_H
/* Define to 1 if you have the `mkostemp' function. */
/* Define to 1 if you have the 'mkostemp' function. */
#undef HAVE_MKOSTEMP
/* Define to 1 if you have the `mkstemp' function. */
/* Define to 1 if you have the 'mkstemp' function. */
#undef HAVE_MKSTEMP
/* Define to 1 if you have a working `mmap' system call. */
/* Define to 1 if you have a working 'mmap' system call. */
#undef HAVE_MMAP
/* Define to 1 if you have the `newlocale' function. */
/* Define to 1 if you have the 'newlocale' function. */
#undef HAVE_NEWLOCALE
/* Define to 1 if you have the `pipe2' function. */
/* Define to 1 if you have the 'pipe2' function. */
#undef HAVE_PIPE2
/* Define to 1 if you have the `posix_spawnp' function. */
/* Define to 1 if you have the 'posix_spawnp' function. */
#undef HAVE_POSIX_SPAWNP
/* Define to 1 if you have the `pread' function. */
/* Define to 1 if you have the 'pread' function. */
#undef HAVE_PREAD
/* Have sig_t type */
@ -161,7 +167,7 @@
/* Define to 1 if you have the <stdlib.h> header file. */
#undef HAVE_STDLIB_H
/* Define to 1 if you have the `strcasestr' function. */
/* Define to 1 if you have the 'strcasestr' function. */
#undef HAVE_STRCASESTR
/* Define to 1 if you have the <strings.h> header file. */
@ -170,28 +176,28 @@
/* Define to 1 if you have the <string.h> header file. */
#undef HAVE_STRING_H
/* Define to 1 if you have the `strlcat' function. */
/* Define to 1 if you have the 'strlcat' function. */
#undef HAVE_STRLCAT
/* Define to 1 if you have the `strlcpy' function. */
/* Define to 1 if you have the 'strlcpy' function. */
#undef HAVE_STRLCPY
/* Define to 1 if you have the `strndup' function. */
/* Define to 1 if you have the 'strndup' function. */
#undef HAVE_STRNDUP
/* Define to 1 if you have the `strtof' function. */
/* Define to 1 if you have the 'strtof' function. */
#undef HAVE_STRTOF
/* HAVE_STRUCT_OPTION */
#undef HAVE_STRUCT_OPTION
/* Define to 1 if `st_rdev' is a member of `struct stat'. */
/* Define to 1 if 'st_rdev' is a member of 'struct stat'. */
#undef HAVE_STRUCT_STAT_ST_RDEV
/* Define to 1 if `tm_gmtoff' is a member of `struct tm'. */
/* Define to 1 if 'tm_gmtoff' is a member of 'struct tm'. */
#undef HAVE_STRUCT_TM_TM_GMTOFF
/* Define to 1 if `tm_zone' is a member of `struct tm'. */
/* Define to 1 if 'tm_zone' is a member of 'struct tm'. */
#undef HAVE_STRUCT_TM_TM_ZONE
/* Define to 1 if you have the <sys/bswap.h> header file. */
@ -233,28 +239,28 @@
/* HAVE_TZNAME */
#undef HAVE_TZNAME
/* Define to 1 if the system has the type `uintptr_t'. */
/* Define to 1 if the system has the type 'uintptr_t'. */
#undef HAVE_UINTPTR_T
/* Define to 1 if you have the <unistd.h> header file. */
#undef HAVE_UNISTD_H
/* Define to 1 if you have the `uselocale' function. */
/* Define to 1 if you have the 'uselocale' function. */
#undef HAVE_USELOCALE
/* Define to 1 if you have the `utime' function. */
/* Define to 1 if you have the 'utime' function. */
#undef HAVE_UTIME
/* Define to 1 if you have the `utimes' function. */
/* Define to 1 if you have the 'utimes' function. */
#undef HAVE_UTIMES
/* Define to 1 if you have the <utime.h> header file. */
#undef HAVE_UTIME_H
/* Define to 1 if you have the `vasprintf' function. */
/* Define to 1 if you have the 'vasprintf' function. */
#undef HAVE_VASPRINTF
/* Define to 1 if you have the `vfork' function. */
/* Define to 1 if you have the 'vfork' function. */
#undef HAVE_VFORK
/* Define to 1 if you have the <vfork.h> header file. */
@ -270,13 +276,13 @@
/* Define to 1 if you have the <wctype.h> header file. */
#undef HAVE_WCTYPE_H
/* Define to 1 if you have the `wcwidth' function. */
/* Define to 1 if you have the 'wcwidth' function. */
#undef HAVE_WCWIDTH
/* Define to 1 if `fork' works. */
/* Define to 1 if 'fork' works. */
#undef HAVE_WORKING_FORK
/* Define to 1 if `vfork' works. */
/* Define to 1 if 'vfork' works. */
#undef HAVE_WORKING_VFORK
/* Define to 1 if you have the <xlocale.h> header file. */
@ -291,17 +297,20 @@
/* Define to 1 if you have the <zstd.h> header file. */
#undef HAVE_ZSTD_H
/* Enable lrziplib compression support */
#undef LRZIPLIBSUPPORT
/* Define to the sub-directory where libtool stores uninstalled libraries. */
#undef LT_OBJDIR
/* Enable lzlib compression support */
#undef LZLIBSUPPORT
/* Define to 1 if `major', `minor', and `makedev' are declared in <mkdev.h>.
/* Define to 1 if 'major', 'minor', and 'makedev' are declared in <mkdev.h>.
*/
#undef MAJOR_IN_MKDEV
/* Define to 1 if `major', `minor', and `makedev' are declared in
/* Define to 1 if 'major', 'minor', and 'makedev' are declared in
<sysmacros.h>. */
#undef MAJOR_IN_SYSMACROS
@ -326,15 +335,15 @@
/* Define to the version of this package. */
#undef PACKAGE_VERSION
/* Define to 1 if all of the C90 standard headers exist (not just the ones
/* Define to 1 if all of the C89 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
backward compatibility; new code need not use it. */
#undef STDC_HEADERS
/* Define to 1 if your <sys/time.h> declares `struct tm'. */
/* Define to 1 if your <sys/time.h> declares 'struct tm'. */
#undef TM_IN_SYS_TIME
/* Enable extensions on AIX 3, Interix. */
/* Enable extensions on AIX, Interix, z/OS. */
#ifndef _ALL_SOURCE
# undef _ALL_SOURCE
#endif
@ -395,11 +404,15 @@
#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
# undef __STDC_WANT_IEC_60559_DFP_EXT__
#endif
/* Enable extensions specified by C23 Annex F. */
#ifndef __STDC_WANT_IEC_60559_EXT__
# undef __STDC_WANT_IEC_60559_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-4:2015. */
#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
# undef __STDC_WANT_IEC_60559_FUNCS_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-3:2015. */
/* Enable extensions specified by C23 Annex H and ISO/IEC TS 18661-3:2015. */
#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
# undef __STDC_WANT_IEC_60559_TYPES_EXT__
#endif
@ -449,12 +462,15 @@
/* Number of bits in a file offset, on hosts where this is settable. */
#undef _FILE_OFFSET_BITS
/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
/* Define to 1 if necessary to make fseeko visible. */
#undef _LARGEFILE_SOURCE
/* Define for large files, on AIX-style hosts. */
/* Define to 1 on platforms where this makes off_t a 64-bit type. */
#undef _LARGE_FILES
/* Number of bits in time_t, on hosts where this is settable. */
#undef _TIME_BITS
/* Define for Solaris 2.5.1 so the uint32_t typedef from <sys/synch.h>,
<pthread.h>, or <semaphore.h> is not used. If the typedef were allowed, the
#define below would cause a syntax error. */
@ -470,6 +486,9 @@
#define below would cause a syntax error. */
#undef _UINT8_T
/* Define to 1 on platforms where this makes time_t a 64-bit type. */
#undef __MINGW_USE_VC2005_COMPAT
/* Define to the type of a signed integer type of width exactly 32 bits if
such a type exists and the standard includes do not define it. */
#undef int32_t
@ -485,13 +504,13 @@
/* Define to a type if <wchar.h> does not define. */
#undef mbstate_t
/* Define to `long int' if <sys/types.h> does not define. */
/* Define to 'long int' if <sys/types.h> does not define. */
#undef off_t
/* Define as a signed integer type capable of holding a process identifier. */
#undef pid_t
/* Define to `unsigned int' if <sys/types.h> does not define. */
/* Define as 'unsigned int' if <stddef.h> doesn't define. */
#undef size_t
/* Define to the type of an unsigned integer type of width exactly 16 bits if
@ -514,5 +533,5 @@
pointer, if such a type exists, and if the system does not define it. */
#undef uintptr_t
/* Define as `fork' if `vfork' does not work. */
/* Define as 'fork' if 'vfork' does not work. */
#undef vfork

3093
contrib/file/configure vendored
View file

File diff suppressed because it is too large Load diff

35
contrib/file/configure.ac
View file

@ -1,5 +1,5 @@
dnl Process this file with autoconf to produce a configure script.
AC_INIT([file],[5.45],[christos@astron.com])
AC_INIT([file],[5.46],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
@ -59,6 +59,11 @@ AC_ARG_ENABLE([lzlib],
[AS_HELP_STRING([--disable-lzlib], [disable liblz (lzip) compression support @<:@default=auto@:>@])])
AC_MSG_RESULT($enable_lzlib)
AC_MSG_CHECKING(for lrziplib support)
AC_ARG_ENABLE([lrziplib],
[AS_HELP_STRING([--disable-lrziplib], [disable liblrzip (lrzip) compression support @<:@default=auto@:>@])])
AC_MSG_RESULT($enable_lrziplib)
AC_MSG_CHECKING(for libseccomp support)
AC_ARG_ENABLE([libseccomp],
[AS_HELP_STRING([--disable-libseccomp], [disable libseccomp sandboxing @<:@default=auto@:>@])])
@ -128,6 +133,9 @@ fi
if test "$enable_lzlib" != "no"; then
AC_CHECK_HEADERS(lzlib.h)
fi
if test "$enable_lrziplib" != "no"; then
AC_CHECK_HEADERS(Lrzip.h)
fi
AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[#include <signal.h>])
dnl Checks for typedefs, structures, and compiler characteristics.
@ -152,6 +160,18 @@ AC_TYPE_UINT64_T
AC_TYPE_INT64_T
AC_TYPE_INTPTR_T
AC_TYPE_UINTPTR_T
m4_ifdef([AC_SYS_YEAR2038], [AC_SYS_YEAR2038], [
# GNU libc only allows setting _TIME_BITS when FILE_OFFSET_BITS is also set.
# GNU libc defines __TIMESIZE on systems where _TIME_BITS can be set.
AS_IF([test X"$ac_cv_sys_file_offset_bits" = X"64"], [
AC_CHECK_DECL(__TIMESIZE, [
AC_DEFINE([_TIME_BITS], [64], [Number of bits in a timestamp, on hosts where this is settable.])
], [], [
AC_INCLUDES_DEFAULT
#include <time.h>
])
])
])
AC_FUNC_MMAP
AC_FUNC_FORK
AC_FUNC_MBRTOWC
@ -202,6 +222,10 @@ fi
if test "$enable_lzlib" != "no"; then
AC_CHECK_LIB(lz, LZ_decompress_open)
fi
if test "$enable_lrziplib" != "no"; then
AC_CHECK_LIB(lrzip, lrzip_new)
fi
if test "$enable_libseccomp" != "no"; then
AC_CHECK_LIB(seccomp, seccomp_init)
fi
@ -254,5 +278,14 @@ if test "$ac_cv_header_lzlib_h$ac_cv_lib_lz_LZ_decompress_open" = "yesyes"; the
AC_DEFINE([LZLIBSUPPORT], 1, [Enable lzlib compression support])
fi
if test "$enable_lrziplib" = "yes"; then
if test "$ac_cv_header_Lrzip_h$ac_cv_lib_lrzip_lrzip_new" != "yesyes"; then
AC_MSG_ERROR([lrzip support requested but not found])
fi
fi
if test "$ac_cv_header_Lrzip_h$ac_cv_lib_lrzip_lrzip_new" = "yesyes"; then
AC_DEFINE([LRZIPLIBSUPPORT], 1, [Enable lrziplib compression support])
fi
AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile tests/Makefile doc/Makefile python/Makefile libmagic.pc])
AC_OUTPUT

1
contrib/file/doc/Makefile.in
View file

@ -186,6 +186,7 @@ EGREP = @EGREP@
ETAGS = @ETAGS@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
FILECMD = @FILECMD@
GREP = @GREP@
HAVE_VISIBILITY = @HAVE_VISIBILITY@
INSTALL = @INSTALL@

6
contrib/file/doc/file.man
View file

@ -1,5 +1,5 @@
.\" $File: file.man,v 1.150 2023/05/21 17:08:34 christos Exp $
.Dd May 21, 2023
.\" $File: file.man,v 1.151 2024/04/07 21:27:35 christos Exp $
.Dd April 7, 2024
.Dt FILE __CSECTION__
.Os
.Sh NAME
@ -348,7 +348,7 @@ Set various parameter limits.
.It Li elf_shsize Ta 128MB Ta max ELF section size processed
.It Li encoding Ta 65K Ta max number of bytes to determine encoding
.It Li indir Ta 50 Ta recursion limit for indirect magic
.It Li name Ta 50 Ta use count limit for name/use magic
.It Li name Ta 100 Ta use count limit for name/use magic
.It Li regex Ta 8K Ta length limit for regex searches
.El
.It Fl r , Fl Fl raw

29
contrib/file/doc/libmagic.man
View file

@ -1,4 +1,4 @@
.\" $File: libmagic.man,v 1.49 2023/07/20 14:32:07 christos Exp $
.\" $File: libmagic.man,v 1.50 2023/12/29 18:04:47 christos Exp $
.\"
.\" Copyright (c) Christos Zoulas 2003, 2018, 2022
.\" All Rights Reserved.
@ -25,7 +25,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd June 16, 2023
.Dd December 29, 2023
.Dt LIBMAGIC 3
.Os
.Sh NAME
@ -311,7 +311,10 @@ library.
.It Li MAGIC_PARAM_ELF_PHNUM_MAX Ta size_t Ta 128
.It Li MAGIC_PARAM_ELF_SHNUM_MAX Ta size_t Ta 32768
.It Li MAGIC_PARAM_REGEX_MAX Ta size_t Ta 8192
.It Li MAGIC_PARAM_BYTES_MAX Ta size_t Ta 1048576
.It Li MAGIC_PARAM_BYTES_MAX Ta size_t Ta 7340032
.It Li MAGIC_PARAM_ENCODING_MAX Ta size_t Ta 1048576
.It Li MAGIC_PARAM_ELF_SHSIZE_MAX Ta size_t Ta 134217728
.It Li MAGIC_PARAM_MAGWARN_MAX Ta size_t Ta 64
.El
.Pp
The
@ -341,6 +344,26 @@ The
parameter controls how many ELF sections will be processed.
.Pp
The
.Dv MAGIC_PARAM_REGEX_MAX
parameter controls the maximum length for regex searches.
.Pp
The
.Dv MAGIC_PARAM_BYTES_MAX
parameter controls the maximum number of bytes to look inside a file.
.Pp
The
.Dv MAGIC_PARAM_ENCODING_MAX
parameter controls the maximum number of bytes to scan for encoding detection.
.Pp
The
.Dv MAGIC_PARAM_ELF_SHSIZE_MAX
parameter controls the maximum number of bytes in an elf section.
.Pp
The
.Dv MAGIC_PARAM_MAGWARN_MAX
parameter controls the maximum number of warnings to tolerate in a magic file.
.Pp
The
.Fn magic_version
command returns the version number of this library which is compiled into
the shared library using the constant

112
contrib/file/doc/magic.man
View file

@ -1,5 +1,5 @@
.\" $File: magic.man,v 1.103 2023/07/20 14:32:07 christos Exp $
.Dd Arpil 18, 2023
.\" $File: magic.man,v 1.110 2024/11/27 15:37:00 christos Exp $
.Dd November 27, 2024
.Dt MAGIC __FSECTION__
.Os
.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
@ -50,6 +50,10 @@ is a regular file.
A continuation offset relative to the end of the last up-level field
.Dv ( \*[Am] ) .
.El
If the offset starts with the symbol
.Dq + ,
then all offsets are interpreted as from the beginning of the file (the
default).
.It Dv type
The type of the data to be tested.
The possible values are:
@ -146,6 +150,10 @@ An eight-byte value interpreted as a UNIX-style date, but interpreted as
local time rather than UTC.
.It Dv qwdate
An eight-byte value interpreted as a Windows-style date.
.It Dv msdosdate
A two-byte value interpreted as FAT/DOS-style date.
.It Dv msdostime
A two-byte value interpreted as FAT/DOS-style time.
.It Dv beid3
A 32-bit ID3 length in big-endian byte order.
.It Dv beshort
@ -175,6 +183,12 @@ than UTC.
.It Dv beqwdate
An eight-byte value in big-endian byte order,
interpreted as a Windows-style date.
.It Dv bemsdosdate
A two-byte value in big-endian byte order,
interpreted as FAT/DOS-style date.
.It Dv bemsdostime
A two-byte value in big-endian byte order,
interpreted as FAT/DOS-style time.
.It Dv bestring16
A two-byte unicode (UCS16) string in big-endian byte order.
.It Dv leid3
@ -206,6 +220,12 @@ than UTC.
.It Dv leqwdate
An eight-byte value in little-endian byte order,
interpreted as a Windows-style date.
.It Dv lemsdosdate
A two-byte value in big-endian byte order,
interpreted as FAT/DOS-style date.
.It Dv lemsdostime
A two-byte value in big-endian byte order,
interpreted as FAT/DOS-style time.
.It Dv lestring16
A two-byte unicode (UCS16) string in little-endian byte order.
.It Dv melong
@ -360,7 +380,6 @@ For example the magic entries:
.It Dv octal
A string representing an octal number.
.El
.El
.Pp
For compatibility with the Single
.Ux
@ -610,9 +629,9 @@ with level
For more complex files, one can use empty messages to get just the
"if/then" effect, in the following way:
.Bd -literal -offset indent
0 string MZ
\*[Gt]0x18 leshort \*[Lt]0x40 MS-DOS executable
\*[Gt]0x18 leshort \*[Gt]0x3f extended PC executable (e.g., MS Windows)
0 string MZ
\*[Gt]0x18 uleshort \*[Lt]0x40 MS-DOS executable
\*[Gt]0x18 uleshort \*[Gt]0x3f extended PC executable (e.g., MS Windows)
.Ed
.Pp
Offsets do not need to be constant, but can also be read from the file
@ -627,17 +646,17 @@ the file.
The value at that offset is read, and is used again as an offset
in the file.
Indirect offsets are of the form:
.Em (( x [[.,][bBcCeEfFgGhHiIlmsSqQ]][+\-][ y ]) .
.Em ( x [[.,][bBcCeEfFgGhHiIlmosSqQ]][+\-][ y ]) .
The value of
.Em x
is used as an offset in the file.
A byte, id3 length, short or long is read at that offset depending on the
.Em [bBcCeEfFgGhHiIlmsSqQ]
.Em [bBcCeEfFgGhHiIlLmsSqQ]
type specifier.
The value is treated as signed if
.Dq ,
.Dq \&,
is specified or unsigned if
.Dq .
.Dq \&.
is specified.
The capitalized types interpret the number as a big endian
value, whereas the small letter versions interpret the number as a little
@ -652,13 +671,15 @@ The default type if one is not specified is long.
The following types are recognized:
.Bl -column -offset indent "Type" "Half/Short" "Little" "Size"
.It Sy Type Sy Mnemonic Sy Endian Sy Size
.It bcBc Byte/Char N/A 1
.It bcBC Byte/Char N/A 1
.It efg Double Little 8
.It EFG Double Big 8
.It hs Half/Short Little 2
.It HS Half/Short Big 2
.It i ID3 Little 4
.It I ID3 Big 4
.It l Long Little 4
.It L Long Big 4
.It m Middle Middle 4
.It o Octal Textual Variable
.It q Quad Little 8
@ -668,12 +689,12 @@ The following types are recognized:
That way variable length structures can be examined:
.Bd -literal -offset indent
# MS Windows executables are also valid MS-DOS executables
0 string MZ
\*[Gt]0x18 leshort \*[Lt]0x40 MZ executable (MS-DOS)
0 string MZ
\*[Gt]0x18 uleshort \*[Lt]0x40 MZ executable (MS-DOS)
# skip the whole block below if it is not an extended executable
\*[Gt]0x18 leshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
\*[Gt]\*[Gt](0x3c.l) string LX\e0\e0 LX executable (OS/2)
\*[Gt]0x18 uleshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
\*[Gt]\*[Gt](0x3c.l) string LX\e0\e0 LX executable (OS/2)
.Ed
.Pp
This strategy of examining has a drawback: you must make sure that you
@ -687,12 +708,12 @@ inside parentheses allows one to modify
the value read from the file before it is used as an offset:
.Bd -literal -offset indent
# MS Windows executables are also valid MS-DOS executables
0 string MZ
0 string MZ
# sometimes, the value at 0x18 is less that 0x40 but there's still an
# extended executable, simply appended to the file
\*[Gt]0x18 leshort \*[Lt]0x40
\*[Gt]\*[Gt](4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)
\*[Gt]\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS)
\*[Gt]0x18 uleshort \*[Lt]0x40
\*[Gt]\*[Gt](4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)
\*[Gt]\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS)
.Ed
.Pp
Sometimes you do not know the exact offset as this depends on the length or
@ -702,44 +723,45 @@ field using
.Sq \*[Am]
as a prefix to the offset:
.Bd -literal -offset indent
0 string MZ
\*[Gt]0x18 leshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
0 string MZ
\*[Gt]0x18 uleshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
# immediately following the PE signature is the CPU type
\*[Gt]\*[Gt]\*[Gt]\*[Am]0 leshort 0x14c for Intel 80386
\*[Gt]\*[Gt]\*[Gt]\*[Am]0 leshort 0x184 for DEC Alpha
\*[Gt]\*[Gt]\*[Gt]\*[Am]0 leshort 0x14c for Intel 80386
\*[Gt]\*[Gt]\*[Gt]\*[Am]0 leshort 0x8664 for x86-64
\*[Gt]\*[Gt]\*[Gt]\*[Am]0 leshort 0x184 for DEC Alpha
.Ed
.Pp
Indirect and relative offsets can be combined:
.Bd -literal -offset indent
0 string MZ
\*[Gt]0x18 leshort \*[Lt]0x40
\*[Gt]\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS)
0 string MZ
\*[Gt]0x18 uleshort \*[Lt]0x40
\*[Gt]\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS)
# if it's not COFF, go back 512 bytes and add the offset taken
# from byte 2/3, which is yet another way of finding the start
# of the extended executable
\*[Gt]\*[Gt]\*[Gt]\*[Am](2.s-514) string LE LE executable (MS Windows VxD driver)
\*[Gt]\*[Gt]\*[Gt]\*[Am](2.s-514) string LE LE executable (MS Windows VxD driver)
.Ed
.Pp
Or the other way around:
.Bd -literal -offset indent
0 string MZ
\*[Gt]0x18 leshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
0 string MZ
\*[Gt]0x18 uleshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
# at offset 0x80 (-4, since relative offsets start at the end
# of the up-level match) inside the LE header, we find the absolute
# offset to the code area, where we look for a specific signature
\*[Gt]\*[Gt]\*[Gt](\*[Am]0x7c.l+0x26) string UPX \eb, UPX compressed
\*[Gt]\*[Gt]\*[Gt](\*[Am]0x7c.l+0x26) string UPX \eb, UPX compressed
.Ed
.Pp
Or even both!
.Bd -literal -offset indent
0 string MZ
\*[Gt]0x18 leshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
0 string MZ
\*[Gt]0x18 uleshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
# at offset 0x58 inside the LE header, we find the relative offset
# to a data area where we look for a specific signature
\*[Gt]\*[Gt]\*[Gt]\*[Am](\*[Am]0x54.l-3) string UNACE \eb, ACE self-extracting archive
\*[Gt]\*[Gt]\*[Gt]\*[Am](\*[Am]0x54.l-3) string UNACE \eb, ACE self-extracting archive
.Ed
.Pp
If you have to deal with offset/length pairs in your file, even the
@ -749,7 +771,7 @@ Note that this additional indirect offset is always relative to the
start of the main indirect offset.
.Bd -literal -offset indent
0 string MZ
\*[Gt]0x18 leshort \*[Gt]0x3f
\*[Gt]0x18 uleshort \*[Gt]0x3f
\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
# search for the PE section called ".idata"...
\*[Gt]\*[Gt]\*[Gt]\*[Am]0xf4 search/0x140 .idata
@ -762,7 +784,7 @@ If you have a list of known values at a particular continuation level,
and you want to provide a switch-like default case:
.Bd -literal -offset indent
# clear that continuation level match
\*[Gt]18 clear
\*[Gt]18 clear x
\*[Gt]18 lelong 1 one
\*[Gt]18 lelong 2 two
\*[Gt]18 default x
@ -828,3 +850,15 @@ to make it clearer that those types have specified widths.
.\" the changes I posted to the S5R2 version.
.\"
.\" Modified for Ian Darwin's version of the file command.
.\"
.\" For emacs editor
.\" Local Variables:
.\" eval: (add-hook 'before-save-hook 'time-stamp)
.\" time-stamp-start: ".Dd "
.\" time-stamp-end: "$"
.\" time-stamp-format: "%:B %02d, %:Y"
.\" time-stamp-time-zone: "UTC0"
.\" system-time-locale: "C"
.\" eval:(setq compile-command (concat "groff -Tlatin1 -m man " (buffer-file-name)) )
.\" End:
.\"

867
contrib/file/ltmain.sh
View file

File diff suppressed because it is too large Load diff

227
contrib/file/m4/libtool.m4 vendored
View file

@ -1,6 +1,7 @@
# libtool.m4 - Configure libtool for the host system. -*-Autoconf-*-
#
# Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc.
# Copyright (C) 1996-2001, 2003-2019, 2021-2022 Free Software
# Foundation, Inc.
# Written by Gordon Matzigkeit, 1996
#
# This file is free software; the Free Software Foundation gives
@ -31,7 +32,7 @@ m4_define([_LT_COPYING], [dnl
# along with this program. If not, see <http://www.gnu.org/licenses/>.
])
# serial 58 LT_INIT
# serial 59 LT_INIT
# LT_PREREQ(VERSION)
@ -181,6 +182,7 @@ m4_require([_LT_FILEUTILS_DEFAULTS])dnl
m4_require([_LT_CHECK_SHELL_FEATURES])dnl
m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl
m4_require([_LT_CMD_RELOAD])dnl
m4_require([_LT_DECL_FILECMD])dnl
m4_require([_LT_CHECK_MAGIC_METHOD])dnl
m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl
m4_require([_LT_CMD_OLD_ARCHIVE])dnl
@ -219,8 +221,8 @@ esac
ofile=libtool
can_build_shared=yes
# All known linkers require a '.a' archive for static linking (except MSVC,
# which needs '.lib').
# All known linkers require a '.a' archive for static linking (except MSVC and
# ICC, which need '.lib').
libext=a
with_gnu_ld=$lt_cv_prog_gnu_ld
@ -778,7 +780,7 @@ _LT_EOF
# if finds mixed CR/LF and LF-only lines. Since sed operates in
# text mode, it properly converts lines to CR/LF. This bash problem
# is reportedly fixed, but why not run on old versions too?
sed '$q' "$ltmain" >> "$cfgfile" \
$SED '$q' "$ltmain" >> "$cfgfile" \
|| (rm -f "$cfgfile"; exit 1)
mv -f "$cfgfile" "$ofile" ||
@ -1042,8 +1044,8 @@ int forced_loaded() { return 2;}
_LT_EOF
echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
$LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
$AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
echo "$AR $AR_FLAGS libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
$AR $AR_FLAGS libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
$RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
cat > conftest.c << _LT_EOF
@ -1067,17 +1069,12 @@ _LT_EOF
_lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
darwin1.*)
_lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
darwin*) # darwin 5.x on
# if running on 10.5 or later, the deployment target defaults
# to the OS version, if on x86, and 10.4, the deployment
# target defaults to 10.4. Don't you love it?
case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
_lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
10.[[012]][[,.]]*)
_lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
10.*)
_lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
darwin*)
case $MACOSX_DEPLOYMENT_TARGET,$host in
10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
_lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
*)
_lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
esac
;;
esac
@ -1126,12 +1123,12 @@ m4_defun([_LT_DARWIN_LINKER_FEATURES],
output_verbose_link_cmd=func_echo_all
_LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
_LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
_LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
_LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
_LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
_LT_TAGVAR(module_expsym_cmds, $1)="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
m4_if([$1], [CXX],
[ if test yes != "$lt_cv_apple_cc_single_mod"; then
_LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
_LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
_LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
fi
],[])
else
@ -1245,7 +1242,8 @@ _LT_DECL([], [ECHO], [1], [An echo program that protects backslashes])
# _LT_WITH_SYSROOT
# ----------------
AC_DEFUN([_LT_WITH_SYSROOT],
[AC_MSG_CHECKING([for sysroot])
[m4_require([_LT_DECL_SED])dnl
AC_MSG_CHECKING([for sysroot])
AC_ARG_WITH([sysroot],
[AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@],
[Search for dependent libraries within DIR (or the compiler's sysroot
@ -1262,7 +1260,7 @@ case $with_sysroot in #(
fi
;; #(
/*)
lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"`
lt_sysroot=`echo "$with_sysroot" | $SED -e "$sed_quote_subst"`
;; #(
no|'')
;; #(
@ -1292,7 +1290,7 @@ ia64-*-hpux*)
# options accordingly.
echo 'int i;' > conftest.$ac_ext
if AC_TRY_EVAL(ac_compile); then
case `/usr/bin/file conftest.$ac_objext` in
case `$FILECMD conftest.$ac_objext` in
*ELF-32*)
HPUX_IA64_MODE=32
;;
@ -1309,7 +1307,7 @@ ia64-*-hpux*)
echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
if AC_TRY_EVAL(ac_compile); then
if test yes = "$lt_cv_prog_gnu_ld"; then
case `/usr/bin/file conftest.$ac_objext` in
case `$FILECMD conftest.$ac_objext` in
*32-bit*)
LD="${LD-ld} -melf32bsmip"
;;
@ -1321,7 +1319,7 @@ ia64-*-hpux*)
;;
esac
else
case `/usr/bin/file conftest.$ac_objext` in
case `$FILECMD conftest.$ac_objext` in
*32-bit*)
LD="${LD-ld} -32"
;;
@ -1343,7 +1341,7 @@ mips64*-*linux*)
echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
if AC_TRY_EVAL(ac_compile); then
emul=elf
case `/usr/bin/file conftest.$ac_objext` in
case `$FILECMD conftest.$ac_objext` in
*32-bit*)
emul="${emul}32"
;;
@ -1351,7 +1349,7 @@ mips64*-*linux*)
emul="${emul}64"
;;
esac
case `/usr/bin/file conftest.$ac_objext` in
case `$FILECMD conftest.$ac_objext` in
*MSB*)
emul="${emul}btsmip"
;;
@ -1359,7 +1357,7 @@ mips64*-*linux*)
emul="${emul}ltsmip"
;;
esac
case `/usr/bin/file conftest.$ac_objext` in
case `$FILECMD conftest.$ac_objext` in
*N32*)
emul="${emul}n32"
;;
@ -1379,14 +1377,14 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
# not appear in the list.
echo 'int i;' > conftest.$ac_ext
if AC_TRY_EVAL(ac_compile); then
case `/usr/bin/file conftest.o` in
case `$FILECMD conftest.o` in
*32-bit*)
case $host in
x86_64-*kfreebsd*-gnu)
LD="${LD-ld} -m elf_i386_fbsd"
;;
x86_64-*linux*)
case `/usr/bin/file conftest.o` in
case `$FILECMD conftest.o` in
*x86-64*)
LD="${LD-ld} -m elf32_x86_64"
;;
@ -1454,7 +1452,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
# options accordingly.
echo 'int i;' > conftest.$ac_ext
if AC_TRY_EVAL(ac_compile); then
case `/usr/bin/file conftest.o` in
case `$FILECMD conftest.o` in
*64-bit*)
case $lt_cv_prog_gnu_ld in
yes*)
@ -1493,9 +1491,22 @@ need_locks=$enable_libtool_lock
m4_defun([_LT_PROG_AR],
[AC_CHECK_TOOLS(AR, [ar], false)
: ${AR=ar}
: ${AR_FLAGS=cru}
_LT_DECL([], [AR], [1], [The archiver])
_LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])
# Use ARFLAGS variable as AR's operation code to sync the variable naming with
# Automake. If both AR_FLAGS and ARFLAGS are specified, AR_FLAGS should have
# higher priority because thats what people were doing historically (setting
# ARFLAGS for automake and AR_FLAGS for libtool). FIXME: Make the AR_FLAGS
# variable obsoleted/removed.
test ${AR_FLAGS+y} || AR_FLAGS=${ARFLAGS-cr}
lt_ar_flags=$AR_FLAGS
_LT_DECL([], [lt_ar_flags], [0], [Flags to create an archive (by configure)])
# Make AR_FLAGS overridable by 'make ARFLAGS='. Don't try to run-time override
# by AR_FLAGS because that was never working and AR_FLAGS is about to die.
_LT_DECL([], [AR_FLAGS], [\@S|@{ARFLAGS-"\@S|@lt_ar_flags"}],
[Flags to create an archive])
AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file],
[lt_cv_ar_at_file=no
@ -1714,7 +1725,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
lt_cv_sys_max_cmd_len=8192;
;;
bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*)
bitrig* | darwin* | dragonfly* | freebsd* | midnightbsd* | netbsd* | openbsd*)
# This has been around since 386BSD, at least. Likely further.
if test -x /sbin/sysctl; then
lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
@ -1757,7 +1768,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
sysv5* | sco5v6* | sysv4.2uw2*)
kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
if test -n "$kargmax"; then
lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[[ ]]//'`
lt_cv_sys_max_cmd_len=`echo $kargmax | $SED 's/.*[[ ]]//'`
else
lt_cv_sys_max_cmd_len=32768
fi
@ -2207,26 +2218,35 @@ m4_defun([_LT_CMD_STRIPLIB],
striplib=
old_striplib=
AC_MSG_CHECKING([whether stripping libraries is possible])
if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
test -z "$striplib" && striplib="$STRIP --strip-unneeded"
AC_MSG_RESULT([yes])
if test -z "$STRIP"; then
AC_MSG_RESULT([no])
else
# FIXME - insert some real tests, host_os isn't really good enough
case $host_os in
darwin*)
if test -n "$STRIP"; then
if $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
old_striplib="$STRIP --strip-debug"
striplib="$STRIP --strip-unneeded"
AC_MSG_RESULT([yes])
else
case $host_os in
darwin*)
# FIXME - insert some real tests, host_os isn't really good enough
striplib="$STRIP -x"
old_striplib="$STRIP -S"
AC_MSG_RESULT([yes])
else
;;
freebsd*)
if $STRIP -V 2>&1 | $GREP "elftoolchain" >/dev/null; then
old_striplib="$STRIP --strip-debug"
striplib="$STRIP --strip-unneeded"
AC_MSG_RESULT([yes])
else
AC_MSG_RESULT([no])
fi
;;
*)
AC_MSG_RESULT([no])
fi
;;
*)
AC_MSG_RESULT([no])
;;
esac
;;
esac
fi
fi
_LT_DECL([], [old_striplib], [1], [Commands to strip libraries])
_LT_DECL([], [striplib], [1])
@ -2549,7 +2569,7 @@ cygwin* | mingw* | pw32* | cegcc*)
case $host_os in
cygwin*)
# Cygwin DLLs use 'cyg' prefix rather than 'lib'
soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
soname_spec='`echo $libname | $SED -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
m4_if([$1], [],[
sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"])
;;
@ -2559,14 +2579,14 @@ m4_if([$1], [],[
;;
pw32*)
# pw32 DLLs use 'pw' prefix rather than 'lib'
library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
library_names_spec='`echo $libname | $SED -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
;;
esac
dynamic_linker='Win32 ld.exe'
;;
*,cl*)
# Native MSVC
*,cl* | *,icl*)
# Native MSVC or ICC
libname_spec='$name'
soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
library_names_spec='$libname.dll.lib'
@ -2585,7 +2605,7 @@ m4_if([$1], [],[
done
IFS=$lt_save_ifs
# Convert to MSYS style.
sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
;;
cygwin*)
# Convert to unix form, then to dos form, then back to unix form
@ -2622,7 +2642,7 @@ m4_if([$1], [],[
;;
*)
# Assume MSVC wrapper
# Assume MSVC and ICC wrapper
library_names_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib'
dynamic_linker='Win32 ld.exe'
;;
@ -2655,7 +2675,7 @@ dgux*)
shlibpath_var=LD_LIBRARY_PATH
;;
freebsd* | dragonfly*)
freebsd* | dragonfly* | midnightbsd*)
# DragonFly does not have aout. When/if they implement a new
# versioning mechanism, adjust this.
if test -x /usr/bin/objformat; then
@ -3454,7 +3474,7 @@ beos*)
bsdi[[45]]*)
lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib)'
lt_cv_file_magic_cmd='/usr/bin/file -L'
lt_cv_file_magic_cmd='$FILECMD -L'
lt_cv_file_magic_test_file=/shlib/libc.so
;;
@ -3488,14 +3508,14 @@ darwin* | rhapsody*)
lt_cv_deplibs_check_method=pass_all
;;
freebsd* | dragonfly*)
freebsd* | dragonfly* | midnightbsd*)
if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
case $host_cpu in
i*86 )
# Not sure whether the presence of OpenBSD here was a mistake.
# Let's accept both of them until this is cleared up.
lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
lt_cv_file_magic_cmd=/usr/bin/file
lt_cv_file_magic_cmd=$FILECMD
lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
;;
esac
@ -3509,7 +3529,7 @@ haiku*)
;;
hpux10.20* | hpux11*)
lt_cv_file_magic_cmd=/usr/bin/file
lt_cv_file_magic_cmd=$FILECMD
case $host_cpu in
ia64*)
lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|ELF-[[0-9]][[0-9]]) shared object file - IA64'
@ -3556,7 +3576,7 @@ netbsd*)
newos6*)
lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable|dynamic lib)'
lt_cv_file_magic_cmd=/usr/bin/file
lt_cv_file_magic_cmd=$FILECMD
lt_cv_file_magic_test_file=/usr/lib/libnls.so
;;
@ -3683,13 +3703,13 @@ else
mingw*) lt_bad_file=conftest.nm/nofile ;;
*) lt_bad_file=/dev/null ;;
esac
case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in
case `"$tmp_nm" -B $lt_bad_file 2>&1 | $SED '1q'` in
*$lt_bad_file* | *'Invalid file or object type'*)
lt_cv_path_NM="$tmp_nm -B"
break 2
;;
*)
case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in
case `"$tmp_nm" -p /dev/null 2>&1 | $SED '1q'` in
*/dev/null*)
lt_cv_path_NM="$tmp_nm -p"
break 2
@ -3715,7 +3735,7 @@ else
# Let the user override the test.
else
AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :)
case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in
case `$DUMPBIN -symbols -headers /dev/null 2>&1 | $SED '1q'` in
*COFF*)
DUMPBIN="$DUMPBIN -symbols -headers"
;;
@ -3955,7 +3975,7 @@ esac
if test "$lt_cv_nm_interface" = "MS dumpbin"; then
# Gets list of data symbols to import.
lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'"
lt_cv_sys_global_symbol_to_import="$SED -n -e 's/^I .* \(.*\)$/\1/p'"
# Adjust the below global symbol transforms to fixup imported variables.
lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'"
lt_c_name_hook=" -e 's/^I .* \(.*\)$/ {\"\1\", (void *) 0},/p'"
@ -3973,20 +3993,20 @@ fi
# Transform an extracted symbol line into a proper C declaration.
# Some systems (esp. on ia64) link data and code symbols differently,
# so use this general approach.
lt_cv_sys_global_symbol_to_cdecl="sed -n"\
lt_cv_sys_global_symbol_to_cdecl="$SED -n"\
$lt_cdecl_hook\
" -e 's/^T .* \(.*\)$/extern int \1();/p'"\
" -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'"
# Transform an extracted symbol line into symbol name and symbol address
lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
lt_cv_sys_global_symbol_to_c_name_address="$SED -n"\
$lt_c_name_hook\
" -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\
" -e 's/^$symcode$symcode* .* \(.*\)$/ {\"\1\", (void *) \&\1},/p'"
# Transform an extracted symbol line into symbol name with lib prefix and
# symbol address.
lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="$SED -n"\
$lt_c_name_lib_hook\
" -e 's/^: \(.*\) .*$/ {\"\1\", (void *) 0},/p'"\
" -e 's/^$symcode$symcode* .* \(lib.*\)$/ {\"\1\", (void *) \&\1},/p'"\
@ -4010,7 +4030,7 @@ for ac_symprfx in "" "_"; do
if test "$lt_cv_nm_interface" = "MS dumpbin"; then
# Fake it for dumpbin and say T for any non-static function,
# D for any global variable and I for any imported variable.
# Also find C++ and __fastcall symbols from MSVC++,
# Also find C++ and __fastcall symbols from MSVC++ or ICC,
# which start with @ or ?.
lt_cv_sys_global_symbol_pipe="$AWK ['"\
" {last_section=section; section=\$ 3};"\
@ -4028,9 +4048,9 @@ for ac_symprfx in "" "_"; do
" s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
" ' prfx=^$ac_symprfx]"
else
lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[[ ]]\($symcode$symcode*\)[[ ]][[ ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
lt_cv_sys_global_symbol_pipe="$SED -n -e 's/^.*[[ ]]\($symcode$symcode*\)[[ ]][[ ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
fi
lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'"
lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | $SED '/ __gnu_lto/d'"
# Check to see that the pipe works correctly.
pipe_works=no
@ -4317,7 +4337,7 @@ m4_if([$1], [CXX], [
;;
esac
;;
freebsd* | dragonfly*)
freebsd* | dragonfly* | midnightbsd*)
# FreeBSD uses GNU C++
;;
hpux9* | hpux10* | hpux11*)
@ -4400,7 +4420,7 @@ m4_if([$1], [CXX], [
_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
;;
*)
case `$CC -V 2>&1 | sed 5q` in
case `$CC -V 2>&1 | $SED 5q` in
*Sun\ C*)
# Sun C++ 5.9
_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@ -4736,7 +4756,7 @@ m4_if([$1], [CXX], [
_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
;;
*)
case `$CC -V 2>&1 | sed 5q` in
case `$CC -V 2>&1 | $SED 5q` in
*Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [[1-7]].* | *Sun*Fortran*\ 8.[[0-3]]*)
# Sun Fortran 8.3 passes all unrecognized flags to the linker
_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@ -4919,7 +4939,7 @@ m4_if([$1], [CXX], [
if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
_LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
else
_LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
_LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
fi
;;
pw32*)
@ -4927,7 +4947,7 @@ m4_if([$1], [CXX], [
;;
cygwin* | mingw* | cegcc*)
case $cc_basename in
cl*)
cl* | icl*)
_LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*'
;;
*)
@ -4984,15 +5004,15 @@ dnl Note also adjust exclude_expsyms for C++ above.
case $host_os in
cygwin* | mingw* | pw32* | cegcc*)
# FIXME: the MSVC++ port hasn't been tested in a loooong time
# FIXME: the MSVC++ and ICC port hasn't been tested in a loooong time
# When not using gcc, we currently assume that we are using
# Microsoft Visual C++.
# Microsoft Visual C++ or Intel C++ Compiler.
if test yes != "$GCC"; then
with_gnu_ld=no
fi
;;
interix*)
# we just hope/assume this is gcc and not c89 (= MSVC++)
# we just hope/assume this is gcc and not c89 (= MSVC++ or ICC)
with_gnu_ld=yes
;;
openbsd* | bitrig*)
@ -5044,7 +5064,7 @@ dnl Note also adjust exclude_expsyms for C++ above.
_LT_TAGVAR(whole_archive_flag_spec, $1)=
fi
supports_anon_versioning=no
case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in
case `$LD -v | $SED -e 's/([[^)]]\+)\s\+//' 2>&1` in
*GNU\ gold*) supports_anon_versioning=yes ;;
*\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.10.*) ;; # catch versions < 2.11
*\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ...
@ -5156,6 +5176,7 @@ _LT_EOF
emximp -o $lib $output_objdir/$libname.def'
_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
_LT_TAGVAR(file_list_spec, $1)='@'
;;
interix[[3-9]]*)
@ -5170,7 +5191,7 @@ _LT_EOF
# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
# time. Moving up from 0x10000000 also allows more sbrk(2) space.
_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
_LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
;;
gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu)
@ -5213,7 +5234,7 @@ _LT_EOF
_LT_TAGVAR(compiler_needs_object, $1)=yes
;;
esac
case `$CC -V 2>&1 | sed 5q` in
case `$CC -V 2>&1 | $SED 5q` in
*Sun\ C*) # Sun C 5.9
_LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
_LT_TAGVAR(compiler_needs_object, $1)=yes
@ -5225,7 +5246,7 @@ _LT_EOF
if test yes = "$supports_anon_versioning"; then
_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
echo "local: *; };" >> $output_objdir/$libname.ver~
$CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
fi
@ -5241,7 +5262,7 @@ _LT_EOF
_LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
if test yes = "$supports_anon_versioning"; then
_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
echo "local: *; };" >> $output_objdir/$libname.ver~
$LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
fi
@ -5373,7 +5394,7 @@ _LT_EOF
if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
_LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
else
_LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
_LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
fi
aix_use_runtimelinking=no
@ -5556,12 +5577,12 @@ _LT_EOF
cygwin* | mingw* | pw32* | cegcc*)
# When not using gcc, we currently assume that we are using
# Microsoft Visual C++.
# Microsoft Visual C++ or Intel C++ Compiler.
# hardcode_libdir_flag_spec is actually meaningless, as there is
# no search path for DLLs.
case $cc_basename in
cl*)
# Native MSVC
cl* | icl*)
# Native MSVC or ICC
_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
_LT_TAGVAR(always_export_symbols, $1)=yes
@ -5602,7 +5623,7 @@ _LT_EOF
fi'
;;
*)
# Assume MSVC wrapper
# Assume MSVC and ICC wrapper
_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
# Tell ltmain to make .lib files, not .a files.
@ -5650,7 +5671,7 @@ _LT_EOF
;;
# FreeBSD 3 and greater uses gcc -shared to do shared libraries.
freebsd* | dragonfly*)
freebsd* | dragonfly* | midnightbsd*)
_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
_LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
_LT_TAGVAR(hardcode_direct, $1)=yes
@ -5861,6 +5882,7 @@ _LT_EOF
emximp -o $lib $output_objdir/$libname.def'
_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
_LT_TAGVAR(file_list_spec, $1)='@'
;;
osf3*)
@ -6631,8 +6653,8 @@ if test yes != "$_lt_caught_CXX_error"; then
cygwin* | mingw* | pw32* | cegcc*)
case $GXX,$cc_basename in
,cl* | no,cl*)
# Native MSVC
,cl* | no,cl* | ,icl* | no,icl*)
# Native MSVC or ICC
# hardcode_libdir_flag_spec is actually meaningless, as there is
# no search path for DLLs.
_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
@ -6730,6 +6752,7 @@ if test yes != "$_lt_caught_CXX_error"; then
emximp -o $lib $output_objdir/$libname.def'
_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
_LT_TAGVAR(file_list_spec, $1)='@'
;;
dgux*)
@ -6760,7 +6783,7 @@ if test yes != "$_lt_caught_CXX_error"; then
_LT_TAGVAR(archive_cmds_need_lc, $1)=no
;;
freebsd* | dragonfly*)
freebsd* | dragonfly* | midnightbsd*)
# FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF
# conventions
_LT_TAGVAR(ld_shlibs, $1)=yes
@ -6897,7 +6920,7 @@ if test yes != "$_lt_caught_CXX_error"; then
# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
# time. Moving up from 0x10000000 also allows more sbrk(2) space.
_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
_LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
;;
irix5* | irix6*)
case $cc_basename in
@ -7037,13 +7060,13 @@ if test yes != "$_lt_caught_CXX_error"; then
_LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
if test yes = "$supports_anon_versioning"; then
_LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
echo "local: *; };" >> $output_objdir/$libname.ver~
$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
fi
;;
*)
case `$CC -V 2>&1 | sed 5q` in
case `$CC -V 2>&1 | $SED 5q` in
*Sun\ C*)
# Sun C++ 5.9
_LT_TAGVAR(no_undefined_flag, $1)=' -zdefs'
@ -8189,6 +8212,14 @@ _LT_DECL([], [DLLTOOL], [1], [DLL creation program])
AC_SUBST([DLLTOOL])
])
# _LT_DECL_FILECMD
# ----------------
# Check for a file(cmd) program that can be used to detect file type and magic
m4_defun([_LT_DECL_FILECMD],
[AC_CHECK_TOOL([FILECMD], [file], [:])
_LT_DECL([], [FILECMD], [1], [A file(cmd) program that detects file types])
])# _LD_DECL_FILECMD
# _LT_DECL_SED
# ------------
# Check for a fully-functional sed program, that truncates

4
contrib/file/m4/ltoptions.m4 vendored
View file

@ -1,7 +1,7 @@
# Helper functions for option handling. -*- Autoconf -*-
#
# Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software
# Foundation, Inc.
# Copyright (C) 2004-2005, 2007-2009, 2011-2019, 2021-2022 Free
# Software Foundation, Inc.
# Written by Gary V. Vaughan, 2004
#
# This file is free software; the Free Software Foundation gives

2
contrib/file/m4/ltsugar.m4 vendored
View file

@ -1,6 +1,6 @@
# ltsugar.m4 -- libtool m4 base layer. -*-Autoconf-*-
#
# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software
# Copyright (C) 2004-2005, 2007-2008, 2011-2019, 2021-2022 Free Software
# Foundation, Inc.
# Written by Gary V. Vaughan, 2004
#

13
contrib/file/m4/ltversion.m4 vendored
View file

@ -1,6 +1,7 @@
# ltversion.m4 -- version numbers -*- Autoconf -*-
#
# Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc.
# Copyright (C) 2004, 2011-2019, 2021-2022 Free Software Foundation,
# Inc.
# Written by Scott James Remnant, 2004
#
# This file is free software; the Free Software Foundation gives
@ -9,15 +10,15 @@
# @configure_input@
# serial 4179 ltversion.m4
# serial 4245 ltversion.m4
# This file is part of GNU Libtool
m4_define([LT_PACKAGE_VERSION], [2.4.6])
m4_define([LT_PACKAGE_REVISION], [2.4.6])
m4_define([LT_PACKAGE_VERSION], [2.4.7])
m4_define([LT_PACKAGE_REVISION], [2.4.7])
AC_DEFUN([LTVERSION_VERSION],
[macro_version='2.4.6'
macro_revision='2.4.6'
[macro_version='2.4.7'
macro_revision='2.4.7'
_LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
_LT_DECL(, macro_revision, 0)
])

4
contrib/file/m4/lt~obsolete.m4 vendored
View file

@ -1,7 +1,7 @@
# lt~obsolete.m4 -- aclocal satisfying obsolete definitions. -*-Autoconf-*-
#
# Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software
# Foundation, Inc.
# Copyright (C) 2004-2005, 2007, 2009, 2011-2019, 2021-2022 Free
# Software Foundation, Inc.
# Written by Scott James Remnant, 2004.
#
# This file is free software; the Free Software Foundation gives

35
contrib/file/magic/Magdir/acorn
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: acorn,v 1.8 2021/04/26 15:56:00 christos Exp $
# $File: acorn,v 1.9 2024/08/30 17:29:28 christos Exp $
# acorn: file(1) magic for files found on Acorn systems
#
@ -67,36 +67,3 @@
>>8 byte x version %d,
>>10 leshort =1 1 pattern
>>10 leshort !1 %d patterns
# From: Joerg Jenderek
# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
# GRR: line below is too general as it matches also "Git pack" in ./revision
0 string PACK\0
# check for valid compression method 0-4
>5 ulelong <5
# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
# To skip "Git pack" version 0 test for root directory object like
# ADFS::RPC.$.websitezip.FONTFIX
>>9 string >ADFS\ PackDir archive (RISC OS)
# TrID labels above as "Acorn PackDir compressed Archive"
# compression mode y (0 - 4) for GIF LZW with a maximum n bits
# (y~n,0~12,1~13,2~14,3~15,4~16)
>>>5 ulelong+12 x \b, LZW %u-bits compression
# https://www.filebase.org.uk/filetypes
# !Packdir compressed archive has three hexadecimal digits code 68E
!:mime application/x-acorn-68E
!:ext pkd/bin
# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
>>>9 string x \b, root "%s"
# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
>>>>&1 ulelong x \b, load address %#x
# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
>>>>&5 ulelong x \b, exec address %#x
# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
>>>>&9 ulelong x \b, attributes %#x
# number of entries in this directory. for root dir 0
#>>>&13 ulelong x \b, entries %#x
# the entries start here with object name
>>>>&17 string x \b, 1st object "%s"

4
contrib/file/magic/Magdir/adventure
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
# $File: adventure,v 1.19 2023/12/02 13:48:56 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
@ -10,6 +10,8 @@
# ALAN
# I assume there are other, lower versions, but these are the only ones I
# saw in the archive.
#
# FIXME: Conflicts with Microsoft x.out big-endian and PDP-11 binaries (./xenix)
0 beshort 0x0206 ALAN game data
>2 byte <10 version 2.6%d

4
contrib/file/magic/Magdir/algol68
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: algol68,v 1.6 2022/11/06 18:36:55 christos Exp $
# $File: algol68,v 1.7 2024/08/27 18:50:56 christos Exp $
# algol68: file(1) magic for Algol 68 source
#
# URL: https://en.wikipedia.org/wiki/ALGOL_68
@ -13,8 +13,6 @@
>0 use algol_68
0 regex/1024 \bMODE[\t\ ]
>0 use algol_68
0 regex/1024 \bMODE[\t\ ]
>0 use algol_68
0 regex/1024 \bREF[\t\ ]
>0 use algol_68
0 regex/1024 \bFLEX[\t\ ]\*\\[

14
contrib/file/magic/Magdir/android
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------
# $File: android,v 1.24 2023/02/20 16:51:59 christos Exp $
# $File: android,v 1.26 2024/09/04 19:06:11 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
@ -9,11 +9,11 @@
# Fixed to avoid regexec 17 errors on some dex files
# From <diff@lookout.com> "Tim Strazzere"
0 string dex\n
>0 regex dex\n[0-9]{2}\0 Dalvik dex file
>4 string >000 version %s
>0 regex dex\n[0-9]{2} Dalvik dex file
>>4 string >000 version %s
0 string dey\n
>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host)
>4 string >000 version %s
>0 regex dey\n[0-9]{2} Dalvik dex file (optimized for host)
>>4 string >000 version %s
# Android bootimg format
# From https://android.googlesource.com/\
@ -223,7 +223,7 @@
# +/refs/heads/androidx-main/profileinstaller/profileinstaller/\
# src/main/java/androidx/profileinstaller/ProfileVersion.java
0 string pro\x00
>0 regex pro\x000[0-9][0-9]\x00 Android ART profile
>4 regex 0[0-9][0-9] Android ART profile
!:ext prof
>>4 string 001\x00 \b, version 001 N
>>4 string 005\x00 \b, version 005 O
@ -231,7 +231,7 @@
>>4 string 010\x00 \b, version 010 P
>>4 string 015\x00 \b, version 015 S
0 string prm\x00
>0 regex prm\x000[0-9][0-9]\x00 Android ART profile metadata
>0 regex 0[0-9][0-9] Android ART profile metadata
!:ext profm
>>4 string 001\x00 \b, version 001 N
>>4 string 002\x00 \b, version 002

126
contrib/file/magic/Magdir/animation
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: animation,v 1.94 2023/06/16 20:06:50 christos Exp $
# $File: animation,v 1.98 2024/09/01 15:51:51 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
@ -542,36 +542,36 @@
>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1
!:strength +20
!:mime audio/mpeg
>2 byte&0xF0 0x10 \b, 32 kbps
>2 byte&0xF0 0x20 \b, 40 kbps
>2 byte&0xF0 0x30 \b, 48 kbps
>2 byte&0xF0 0x40 \b, 56 kbps
>2 byte&0xF0 0x50 \b, 64 kbps
>2 byte&0xF0 0x60 \b, 80 kbps
>2 byte&0xF0 0x70 \b, 96 kbps
>2 byte&0xF0 0x80 \b, 112 kbps
>2 byte&0xF0 0x90 \b, 128 kbps
>2 byte&0xF0 0xA0 \b, 160 kbps
>2 byte&0xF0 0xB0 \b, 192 kbps
>2 byte&0xF0 0xC0 \b, 224 kbps
>2 byte&0xF0 0xD0 \b, 256 kbps
>2 byte&0xF0 0xE0 \b, 320 kbps
>>>2 byte&0xF0 0x10 \b, 32 kbps
>>>2 byte&0xF0 0x20 \b, 40 kbps
>>>2 byte&0xF0 0x30 \b, 48 kbps
>>>2 byte&0xF0 0x40 \b, 56 kbps
>>>2 byte&0xF0 0x50 \b, 64 kbps
>>>2 byte&0xF0 0x60 \b, 80 kbps
>>>2 byte&0xF0 0x70 \b, 96 kbps
>>>2 byte&0xF0 0x80 \b, 112 kbps
>>>2 byte&0xF0 0x90 \b, 128 kbps
>>>2 byte&0xF0 0xA0 \b, 160 kbps
>>>2 byte&0xF0 0xB0 \b, 192 kbps
>>>2 byte&0xF0 0xC0 \b, 224 kbps
>>>2 byte&0xF0 0xD0 \b, 256 kbps
>>>2 byte&0xF0 0xE0 \b, 320 kbps
# timing
>2 byte&0x0C 0x00 \b, 44.1 kHz
>2 byte&0x0C 0x04 \b, 48 kHz
>2 byte&0x0C 0x08 \b, 32 kHz
>>>2 byte&0x0C 0x00 \b, 44.1 kHz
>>>2 byte&0x0C 0x04 \b, 48 kHz
>>>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
>>>3 byte&0xC0 0x00 \b, Stereo
>>>3 byte&0xC0 0x40 \b, JntStereo
>>>3 byte&0xC0 0x80 \b, 2x Monaural
>>>3 byte&0xC0 0xC0 \b, Monaural
#>>>1 byte ^0x01 \b, Data Verify
#>>>2 byte &0x02 \b, Packet Pad
#>>>2 byte &0x01 \b, Custom Flag
#>>>3 byte &0x08 \b, Copyrighted
#>>>3 byte &0x04 \b, Original Source
#>>>3 byte&0x03 1 \b, NR: 50/15 ms
#>>>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M1A
0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
@ -855,7 +855,7 @@
# Live MPEG-4 audio streams (instead of RTP FlexMux)
0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
!:mime audio/x-mp4a-latm
#>1 beshort&0x1FFF x \b, %hu byte packet
#>1 beshort&0x1FFF x \b, %u byte packet
>3 byte&0xE0 0x40
>>4 byte&0x3C 0x04 \b, single stream
>>4 byte&0x3C 0x08 \b, 2 streams
@ -927,15 +927,12 @@
#
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
# syncbyte 8 bit 0x47
# error_ind 1 bit -
# payload_start 1 bit 1
# priority 1 bit -
# PID 13 bit 0x0000
# scrambling 2 bit -
# adaptfld_ctrl 2 bit 1 or 3
# conti_count 4 bit -
0 belong&0xFF5FFF10 0x47400010
>188 byte 0x47 MPEG transport stream data
# 188 bytes per packet
0 byte 0x47
>188 byte 0x47
>>376 byte 0x47
>>>564 byte 0x47
>>>>752 byte 0x47 MPEG transport stream data
!:mime video/MP2T
!:ext ts
@ -943,8 +940,11 @@
# From: Alexandre Iooss <erdnaxe@crans.org>
# URL: https://en.wikipedia.org/wiki/MPEG_transport_stream
# Note: similar to ISO 13818.1 but with 4 extra bytes per packets
4 belong&0xFF5FFF10 =0x47400010
>196 byte =0x47 BDAV MPEG-2 Transport Stream (M2TS)
4 byte 0x47
>196 byte 0x47
>>388 byte 0x47
>>>580 byte 0x47
>>>>772 byte 0x47 BDAV MPEG-2 Transport Stream (M2TS)
!:mime video/MP2T
!:ext m2ts/mts
@ -1204,3 +1204,47 @@
>12 leshort x \b, %d
>14 leshort x \bx%d
>24 lelong >0 \b, %d frames
# libplacebo cache file
# https://libplacebo.org
0 string pl_cache libplacebo cache
>8 ulelong x \b, version %u
>12 ulelong =0 \b, empty
>12 ulelong =1 \b, 1 entry
>12 ulelong >1 \b, %u entries
>4 byte 1 \b, version 3.00.00
>4 byte 2 \b, version 3.03.00
>4 byte 3 \b, version 4.00.00
>4 byte 4 \b, version 4.02.00
>4 byte 5 \b, version 5.00.00
# live2d: file(1) magic for Live2D Cubism file formats
# https://www.live2d.com/en/
0 string/4 MOC3 Live2D Cubism MOC3
>4 byte 0 \b, SDK version invalid/unknown (%d)
>4 byte 1 \b, SDK version 3.0.00 - 3.2.07 (%d)
>4 byte 2 \b, SDK version 3.3.00 - 3.3.03 (%d)
>4 byte 3 \b, SDK version 4.0.00 - 4.1.05 (%d)
>4 byte 4 \b, SDK version 4.2.00 - 4.2.02 (%d)
>4 byte 5 \b, SDK version 5.0.00 (%d)
>4 byte >5 \b, SDK version unknown (%d)
>5 byte 0 \b, little endian
>5 byte >0 \b, big endian
!:mime application/x-moc3-data
!:ext moc3
0 string/4 CAFF Live2D Cubism archive
>4 ubyte x version %d
>&0 ubyte x \b.%d
>&1 ubyte x \b.%d
>7 string/4 =---- \b, standard format
>7 string/4 !---- \b, unknown format (%.4s)
>11 ubyte x version %d
>&0 ubyte x \b.%d
>&1 ubyte x \b.%d
>14 belong =0 \b, no obfuscation
>14 belong !0 \b, XOR obfuscation key %d
!:mime application/x-cubism-archive
!:ext cmo3/can3

58
contrib/file/magic/Magdir/apple
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $
# $File: apple,v 1.51 2024/09/04 19:06:12 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
@ -17,8 +17,13 @@
# Ref: https://applesaucefdc.com/a2r/
0 string A2R
>3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image
>>0 use applesauce
>3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image
>>0 use applesauce
>3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image
>>0 use applesauce
0 name applesauce
>8 string INFO
>>49 byte 01 \b, 5.25″ SS 40trk
>>49 byte 02 \b, 3.5″ DS 80trk
@ -36,7 +41,11 @@
# Ref: https://applesaucefdc.com/woz/reference2/
0 string WOZ
>3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image
>>0 use applewoz
>3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image
>>0 use applewoz
0 name applewoz
>12 string INFO
>>21 byte 01 \b, 5.25 inch
>>21 byte 02 \b, 3.5 inch
@ -49,13 +58,13 @@
# Ref: https://applesaucefdc.com/moof-reference/
0 string MOOF
>4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image
>12 string INFO
>>21 byte 01 \b, SSDD GCR (400K)
>>21 byte 02 \b, DSDD GCR (800K)
>>21 byte 03 \b, DSHD MFM (1.44M)
>>22 byte 01 \b, write protected
>>23 byte 01 \b, cross track synchronized
>>25 string/T x \b, %.32s
>>12 string INFO
>>>21 byte 01 \b, SSDD GCR (400K)
>>>21 byte 02 \b, DSDD GCR (800K)
>>>21 byte 03 \b, DSHD MFM (1.44M)
>>>22 byte 01 \b, write protected
>>>23 byte 01 \b, cross track synchronized
>>>25 string/T x \b, %.32s
# Type: Apple Emulator disk images
# From: Greg Wildman <greg@apple2.org.za>
@ -192,11 +201,9 @@
# Ref: https://github.com/peterferrie/qboot
0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image
# Type: Peter Ferrie 0Boot
# From: Greg Wildman <greg@apple2.org.za>
# Ref: https://github.com/peterferrie/0boot
0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image
# Different proprietary boot sectors
@ -438,22 +445,22 @@
# object is the first object (true for CoreFoundation implementation).
# From: David Remahl <dremahl@apple.com>
0 string bplist
>6 byte x \bCoreFoundation binary property list data, version %#c
>6 byte x CoreFoundation binary property list data, version %#c
>>7 byte x \b%c
>6 string 00 \b
>>8 byte&0xF0 0x00 \b
>>>8 byte&0x0F 0x00 \b, root type: null
>>>8 byte&0x0F 0x08 \b, root type: false boolean
>>>8 byte&0x0F 0x09 \b, root type: true boolean
>>8 byte&0xF0 0x10 \b, root type: integer
>>8 byte&0xF0 0x20 \b, root type: real
>>8 byte&0xF0 0x30 \b, root type: date
>>8 byte&0xF0 0x40 \b, root type: data
>>8 byte&0xF0 0x50 \b, root type: ascii string
>>8 byte&0xF0 0x60 \b, root type: unicode string
>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
>>8 byte&0xF0 0xa0 \b, root type: array
>>8 byte&0xF0 0xd0 \b, root type: dictionary
>>6 string 00 \b
>>>8 byte&0xF0 0x00 \b
>>>>8 byte&0x0F 0x00 \b, root type: null
>>>>8 byte&0x0F 0x08 \b, root type: false boolean
>>>>8 byte&0x0F 0x09 \b, root type: true boolean
>>>8 byte&0xF0 0x10 \b, root type: integer
>>>8 byte&0xF0 0x20 \b, root type: real
>>>8 byte&0xF0 0x30 \b, root type: date
>>>8 byte&0xF0 0x40 \b, root type: data
>>>8 byte&0xF0 0x50 \b, root type: ascii string
>>>8 byte&0xF0 0x60 \b, root type: unicode string
>>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
>>>8 byte&0xF0 0xa0 \b, root type: array
>>>8 byte&0xF0 0xd0 \b, root type: dictionary
# Apple/NeXT typedstream data
# Serialization format used by NeXT and Apple for various
@ -478,7 +485,6 @@
#
0 string caff CoreAudio Format audio file
>4 beshort <10 version %d
>6 beshort x
#------------------------------------------------------------------------------

291
contrib/file/magic/Magdir/archive
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: archive,v 1.193 2023/07/27 17:55:58 christos Exp $
# $File: archive,v 1.207 2024/11/27 15:37:46 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
@ -25,6 +25,11 @@
>>>>>>155 ubyte&0xDF =0
# space or ascii digit 0 at start of check sum
>>>>>>>148 ubyte&0xEF =0x20
# check for specific 1st member name that indicates other mime type and file name suffix
>>>>>>>>0 string TpmEmuTpms/permall
# maybe also look for 2nd tar member efi/nvram containing UEFI variables part
#>>>>>>>>>512 search/0x1800 efi/nvram\0 EFI_PART_FOUND
>>>>>>>>>0 use tar-nvram
# FOR DEBUGGING:
#>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp) NAME "%s"
# check for 1st image main name with digits used for sorting
@ -34,9 +39,35 @@
# check for 1st member name with ovf suffix
>>>>>>>>0 regex \^.{1,96}[.](ovf)
>>>>>>>>>0 use tar-ova
# if 1st member name without digits and without used image suffix and without *.ovf then it is a TAR archive
# look for relative directory ./var/ or ./lte/ as 1st member name that indicates AVM firmware with other file name suffix
>>>>>>>>0 ubequad&0xFFffE5eaE8ffFFff 0x2e2f6460602f0000
>>>>>>>>>0 use tar-avm
# maybe look for AVM specific 2nd name entry
# >>>>>>>>>517 string /content\0 content~
# >>>>>>>>>>0 use tar-avm
# >>>>>>>>>517 string /install\0 install~
# >>>>>>>>>>0 use tar-avm
# >>>>>>>>>517 string /chksum\0 chksum~
# >>>>>>>>>>0 use tar-avm
# >>>>>>>>>517 string /modfw.nfo\0 modfw~
# >>>>>>>>>>0 use tar-avm
# most (419/429) *.WBM (71/71) *.WBT with user name jcameron of Webmin developer Jamie Cameron in first tar archive member
>>>>>>>>265 string jcameron
>>>>>>>>>0 use tar-webmin
# if 1st member name without digits and without used image suffix, without *.ovf,
# ./var/ , ./lte/ and TpmEmuTpms/ then it is a pure TAR archive or Webmin without jcameron user name
>>>>>>>>0 default x
>>>>>>>>>0 use tar-file
# few (10/429) *.WBM without user name jcameron in 1st tar member but with WBM module.info name like:
# apcupsd-0.81-2.wbm csavupdate.wbm cwmail.wbm dac960.wbm etcupdate.wbm logviewer.wbm memcached.wbm rinetd.wbm shoutcast.wbm vacationadmin-webmin-module-1.1.2.wbm
# few (10/95) *.WBT without user name jcameron in 1st tar member but with WBT theme.info name like:
# authentic-theme-21.09.5.wbt Mozilla-Modern.wbt virtual-server-theme-2.7.wbt fkn-webmintheme.0.6.0.wbt
>>>>>>>>>512 search/210965/s e.info\0
>>>>>>>>>>0 use tar-webmin
# pure TAR
>>>>>>>>>0 default x
>>>>>>>>>>0 use tar-file
# Note: called "TAR - Tape ARchive" by TrID, "Tape Archive Format" by DROID via PUID x-fmt/265
# and "Tar archive" by shared MIME-info database from freedesktop.org
# minimal check and then display tar archive information which can also be
# embedded inside others like Android Backup, Clam AntiVirus database
0 name tar-file
@ -86,7 +117,11 @@
>>261 default x tar archive (unknown ustar)
!:mime application/x-ustar
!:ext tar/ustar
# type flag of 1st tar archive member
# show information for 1st tar archive member
>0 use tar-entry
# display information of tar archive member (file type, name, permissions, user, group)
0 name tar-entry
# type flag of tar archive member
#>156 ubyte x \b, %c-type
>156 ubyte x
>>156 ubyte 0 \b, file
@ -142,7 +177,7 @@
>>265 string >\0 \b, user %-.32s
# group name null terminated
>>297 string >\0 \b, group %-.32s
# device major minor if not zero
# device major minor if not zero (binary or ASCII)
>>329 ubequad&0xCFCFCFCFcFcFcFdf !0
>>>329 string x \b, devmaj %-.7s
>>337 ubequad&0xCFCFCFCFcFcFcFdf !0
@ -157,6 +192,25 @@
>>508 default x
# padding[255] in old tar sometimes comment field
>>>257 string >\0 \b, comment: %-.40s
# Summary: VirtualBox NvramFile with UEFI variables packed inside TAR archive
# URL: hhttps://www.virtualbox.org/manual/ch08.html#vboxmanage-modifynvram
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/n/nvram-virtualbox-tar.trid.xml
# Note: called "VirtualBox saved (U)EFI BIOS settings (TAR) by TrID and
# verified by 7-Zip `7z l -ttar Mint-21.1.nvram` and
# VirtualBox `VBoxManage modifynvram "Mint-21.1" listvars`
0 name tar-nvram
#
>0 string x VirtualBox NVRAM file
#!:mime application/x-gtar
!:mime application/x-virtualbox-nvram
!:ext nvram
# first name[100] like: TpmEmuTpms/permall
>0 use tar-entry
# 2nd tar member efi/nvram contains UEFI variables part described by ./virtual
>512 search/0x1800/s efi/nvram\0
>>&0 use tar-entry
# 2nd tar member efi/nvram content could be described by ./virtual
#>>&512 indirect x
# Summary: Comic Book Archive *.CBT with TAR format
# URL: https://en.wikipedia.org/wiki/Comic_book_archive
# http://fileformats.archiveteam.org/wiki/Comic_Book_Archive
@ -169,7 +223,8 @@
!:ext cbt
# name[100] probably like: 19.jpg 0001.png 0002.png
# or maybe like ComicInfo.xml
>0 string >\0 \b, 1st image %-.60s
#>0 string >\0 \b, 1st image %-.60s
>0 use tar-entry
# Summary: Open Virtualization Format *.OVF with disk images and more packed as TAR archive *.OVA
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Open_Virtualization_Format
@ -184,7 +239,85 @@
!:mime application/x-virtualbox-ova
!:ext ova
# assuming name[100] like: DOS-0.9.ovf FreeDOS_1.ovf Win98SE_DE.ovf
>0 string >\0 \b, with %-.60s
#>0 string >\0 \b, with %-.60s
>0 use tar-entry
# Summary: AVM firmware (FRITZ!OS) for the FRITZ!Box (router)
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Fritz!Box
# https://www.redteam-pentesting.de/de/advisories/rt-sa-2014-010/-avm-fritz-box-firmware-signature-bypass
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/image-avm.trid.xml
# Note: verified by 7-Zip `7z l -ttar FRITZ.Box_4040-07.57.image`
0 name tar-avm
>0 string x AVM FRITZ!Box firmware
#!:mime application/x-gtar
!:mime application/x-avm-image
!:ext image
# tar member ./var/content starts with line like "Product=Fritz_Box_HW227 (FRITZ!Box 4040)"
>>1024 search/512 Product=Fritz_Box_
>>>&0 string x %s
# version string like: 07.57 07.58
>>>1044 search Version= \b, version
>>>>&0 string x %s
# product phrase too far behind (dozen MB) in many samples like: FRITZ.Box_4040-07.12.image FRITZ.Box_6820v3_LTE-07.57.image
# so try to look for other characteristic foo
# >>1024 default x OTHER_PATTERN!
# >>>1023 search AVM_PATTERN PATTERNfound
# first name[100] like: ./var/ ./lte/
>0 use tar-entry
# if 1st entry is directory then show 2nd entry
>156 ubyte 0x35
# 2nd tar member name like: ./var/content (often ) ./var/install ./var/chksum ./lte/modfw.nfo
>>512 use tar-entry
# Summary: Webmin Module or Theme
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Webmin
# https://webmin.com/docs/development/creating-modules/
# https://webmin.com/docs/development/creating-themes/
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/w/wbm.trid.xml
# http://mark0.net/download/triddefs_xml.7z/defs/w/wbt.trid.xml
# http://mark0.net/download/triddefs_xml.7z/defs/w/wbt-gif.trid.xml
# Note: called "Webmin Module" "Webmin Theme" by TrID
# most verfied by 7-Zip `7z l -ttar *.wbm | grep "\module.info"` and
# `7z l -ttar *.wbt | grep "\theme.info"`
0 name tar-webmin
>0 string x Webmin
# Webmin module or theme
>>512 search/1767941/s /module.info Module
!:mime application/x-webmin-module
!:ext wbm
# According to documentation module.info is mandatory but instead theme.info is found in
# old-blue-theme.wbm old-blue-theme-1.0.wbm old-mscstyle3.wbm virtual-server-mobile.wbm
# GRR: maybe here wrong file name suffix WBM instead of WBT
>>512 default x
>>>512 search/3149333/s /theme.info Theme
!:mime application/x-webmin-theme
!:ext wbt
# next 3 lines should not happen
>>>512 default x Module or Theme
!:mime application/x-webmin
!:ext wbm/wbt
# GNU or POSIX tar
>257 string =ustar (
# 2 space characters followed by a null for GNU variant for most (428/429) WBM samples
>>261 ubelong =0x72202000 \bGNU tar)
#!:mime application/x-gtar
# UStar version variant with ASCII "00" as in few (1/429) samples like cwmail.wbm
>>261 ubelong 0x72003030 \bPOSIX tar)
#!:mime application/x-ustar
#>>>156 ubyte x tar archive
# Apparently first archive member name[100] is directory like: dynbind/ ssh/ virtualmin-powerdns/ virtual-server-mobile/ vnc/
>>0 use tar-entry
# look for characteristic WBM module info name starting with "module.info" for language variant like in: ssh2.wbm
>>512 search/1767941/s /module.info
# look for TAR magic of WBM archive module info
>>>&0 search/257/s ustar
# show details for WBM archive member module info
>>>>&-257 use tar-entry
# look for characteristic WBT theme info name with "theme.info" like in: authentic-theme-21.09.5.wbt
>>512 search/3149333/s /theme.info\0
# look for TAR magic of WBT archive theme info
>>>&0 search/257/s ustar
>>>>&-257 use tar-entry
# Incremental snapshot gnu-tar format from:
# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
@ -765,7 +898,7 @@
>>>>>>>(16.s) uleshort x
>>>>>>>>&16 string x \b, %-.8s
>>>>>>12 uleshort &0x10
>>>>>>>(16.s) uleshort x
#>>>>>>>(16.s) uleshort x
>>>>>>>&16 string x %-.8s
>>>>>>>>&1 string x \b.%-.3s
>>>12 uleshort &0x01
@ -957,7 +1090,45 @@
# ZET
0 string OZ\xc3\x9d ZET archive data
# TSComp
0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
# Update: Joerg Jenderek 2023 Nov
# URL: http://fileformats.archiveteam.org/wiki/TSComp
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tscomp.trid.xml
# https://entropymine.com/deark/releases/deark-1.6.5.tar.gz
# deark-1.6.5/modules/installshld.c
# Note: called "TSComp compressed data" by TrID
# verified by command like `deark -m tscomp -l -d2 MAKERRES.DL$`
# The "13" might be a version number. The "8c" is a mystery
0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive
#!:mime application/octet-stream
!:mime application/x-tscomp-compressed
# filename style: 0~old version 1~without wildcard 2~with wildcard
#>0x08 ubyte x \b, filename style %u
>0x08 ubyte 0 data, filename style 0
# no example found
!:ext ??$
#>0x08 ubyte 1 data, without wildcard
>0x08 ubyte 1 data
# for single-file archives, often the last letter of the filename extension is changed to "$"; but also name like: BUILD3.BM!
!:ext ??$/??!
>0x08 ubyte 2 data, with wildcard
# for multi-file archives common extensions seem to be .lib and .cmp, but also names like: SAMPMIF$ OTDATA.$$$ TWOFILES.TSC WIN.PAK
!:ext /lib/cmp/$$$/tsc/pak
# fnlen; pascal string length; original 1st file name like: CHFORMAT.MML
>0x1c pstring x \b, %s
# md->fi->timestamp
>0x16 lemsdosdate x \b, modified %s
>0x18 lemsdostime x %s
# 1st compressed size: like 180 (SAMPMML$$)
>0x0E ulelong x \b, compressed size %u
# de_dbg_indent(c, 1): like: 12h
#>0x0d ubyte x b, at 0xD %#x
# like: 0
#>0x1A ubeshort x \b, at 0x1A %#x
# 2nd member offset
#>0x12 ulelong x \b, next offset %#x
>0x12 ulelong >0
# original 2nd archive member name like: FORMATS.MML
>>(0x12.l+15) pstring x \b, %s ...
# ARQ
0 string gW\4\1 ARQ archive data
# Squash
@ -1376,7 +1547,7 @@
# This is a really bad format. A file containing HAWAII will match this...
#0 string HA HA archive data,
#>2 leshort =1 1 file,
#>2 leshort >1 %hu files,
#>2 leshort >1 %u files,
#>4 byte&0x0f =0 first is type CPY
#>4 byte&0x0f =1 first is type ASC
#>4 byte&0x0f =2 first is type HSC
@ -1466,7 +1637,7 @@
# check and display information of lharc header
0 name lharc-header
# header size 0x4 , 0x1b-0x61
>0 ubyte x
#>0 ubyte x
# compressed data size != compressed file size
#>7 ulelong x \b, data size %d
# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
@ -1590,7 +1761,7 @@
# RAR (Roshal Archive) archive
0 string Rar!\x1a\7\0 RAR archive data
!:mime application/x-rar
!:mime application/vnd.rar
!:ext rar/cbr
# file header
>(0xc.l+9) byte 0x74
@ -1602,13 +1773,13 @@
>>7 use rar-archive-header
0 string Rar!\x1a\7\1\0 RAR archive data, v5
!:mime application/x-rar
!:mime application/vnd.rar
!:ext rar
# Very old RAR archive
# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
0 string RE\x7e\x5e RAR archive data (<v1.5)
!:mime application/x-rar
!:mime application/vnd.rar
!:ext rar/cbr
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
@ -1623,9 +1794,19 @@
!:mime application/zip
!:ext zip/cbz
# Android APK file (Zip archive)
0 string PK\003\004
!:strength +1
# IOS/IPadOS IPA file (Zip archive)
# Starts with Payload (file name length = 19)
>26 uleshort 8
>>30 string Payload IOS/iPadOS IPA file
>>>&26 search/6000 PK\003\004
>>>>&34 string x containing %s
!:mime application/x-ios-app
!:ext ipa
# Android APK file (Zip archive)
# Starts with AndroidManifest.xml (file name length = 19)
>26 uleshort 19
>>30 string AndroidManifest.xml Android package (APK), with AndroidManifest.xml
@ -1693,20 +1874,7 @@
!:ext apk
>>>>>-22 string PK\005\006
>>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 \b, with APK Signing Block
# APK Signing Block
>0 default x
>>-22 string PK\005\006
>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 Android package (APK), with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0 string PK\005\006 Zip archive data (empty)
!:mime application/zip
!:ext zip/cbz
!:strength +1
0 string PK\003\004
!:strength +1
# Specialised zip formats which start with a member named 'mimetype'
# (stored uncompressed, with no 'extra field') containing the file's MIME type.
@ -1946,18 +2114,41 @@
#>30 search/100/b application/epub+zip EPUB document
#!:mime application/epub+zip
# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
# Next line excludes specialized formats:
# APK Signing Block
>(26.s+30) leshort !0xcafe
>>30 search/100/b !application/epub+zip
>>>26 string !\x8\0\0\0mimetype Zip archive data
>>>26 string !\x8\0\0\0mimetype
>>>>-22 string PK\005\006
>>>>>(-6.l-16) string APK\x20Sig\x20Block\x2042 Android package (APK), with APK Signing Block
!:mime application/vnd.android.package-archive
!:ext apk
# Keyman Compiled Package File (keyman.com)
# https://help.keyman.com/developer/current-version/reference/file-types/kmp
# Find start of central directory
>>>>>(-6.l) string PK\001\002
# Scan central directory for string 'kmp.json', will suffice for a
# package containing about 150 files
>>>>>>(-6.l) search/9000 kmp.json Keyman Compiled Package File
!:mime application/vnd.keyman.kmp+zip
!:ext kmp
# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
# Next line excludes specialized formats:
>>>>+4 default x
>>>>>4 beshort x Zip archive data, at least
!:mime application/zip
>>>>4 beshort x \b, at least
>>>>4 use zipversion
>>>>4 beshort x to extract
>>>>8 beshort x \b, compression method=
>>>>8 use zipcompression
>>>>0x161 string WINZIP \b, WinZIP self-extracting
>>>>>4 use zipversion
>>>>>4 beshort x to extract
>>>>>8 beshort x \b, compression method=
>>>>>8 use zipcompression
>>>>>0x161 string WINZIP \b, WinZIP self-extracting
# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0 string PK\005\006 Zip archive data (empty)
!:mime application/zip
!:ext zip/cbz
!:strength +1
# StarView Metafile
# From Pierre Ducroquet <pinaraf@pinaraf.info>
@ -2252,12 +2443,6 @@
0 belong 0x1ee7ff00 EET archive
!:mime application/x-eet
# rzip archives
0 string RZIP rzip compressed data
>4 byte x - version %d
>5 byte x \b.%d
>6 belong x (%d bytes)
# From: Joerg Jenderek
# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php
# reference: http://mark0.net/download/triddefs_xml.7z/
@ -2605,3 +2790,23 @@
>>(12.l+12) string }}}} Electron ASAR archive
!:ext asar
>>>12 ulelong x \b, header length: %d bytes
# Wasay ImageIt DataPack
# From: Alexandre Iooss <erdnaxe@crans.org>
# URL: https://www.neowin.net/forum/topic/615151-anyone-know-what-program-opens-dsi-and-wsi-files/
# Note: Used in Acer eRecovery and Lenovo OneKey Recovery (OKR)
4 string WSVD
# bytes 3-4 are the checksum or the first 32 bytes of the file
>0 uleshort 0x40 Wasay ImageIt DataPack
>>8 uleshort x v%u
>>10 uleshort x \b.%u
>>16 lestring16/8 x \b, "%s"
>>12 uleshort x (%u)
>>32 byte x \b, created on %02d
>>33 byte x \b%02d
>>34 byte x \b/%02d
>>35 byte x \b/%02d
>>36 byte x %02d
>>37 byte x \b:%02d
>>38 byte x \b:%02d
>>56 ulelong x \b, size: %u bytes

2
contrib/file/magic/Magdir/aria
View file

@ -1,5 +1,7 @@
#------------------------------------------------------------------------------
# $File: aria,v 1.2 2024/06/10 23:09:52 christos Exp $
# aria: file(1) magic for download manager aria
# URL: https://de.wikipedia.org/wiki/Aria_(Software)
# Reference: https://github.com/aria2/aria2/blob/master/doc/manual-src/en/technical-notes.rst
# From: Joerg Jenderek

11
contrib/file/magic/Magdir/arm
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: arm,v 1.3 2022/10/31 14:35:39 christos Exp $
# $File: arm,v 1.4 2024/02/18 14:15:22 christos Exp $
# arm: file(1) magic for ARM COFF
#
# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
@ -40,6 +40,15 @@
>>0 use display-coff
!:strength -10
# ARM64 Compiled Hybrid PE X86
0 leshort 0x3a64
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
# ARM64EC
0 leshort 0xa641
# test for unused flag bits in f_flags

14
contrib/file/magic/Magdir/asf
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: asf,v 1.4 2022/10/31 13:22:26 christos Exp $
# $File: asf,v 1.5 2024/09/04 19:06:12 christos Exp $
# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files
# http://www.staroceans.org/e-book/ASF_Specification.pdf
@ -10,13 +10,13 @@
#>16 lequad >0
#>>(16.q) use asf-object
# ASF_Simple_Index_Object
>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB
#>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB
>0 guid D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object
>0 guid FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object
>0 guid 3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object
# ASF_File_Properties_Object
>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365
#>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365
# ASF_Stream_Properties_Object
>0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365
@ -52,15 +52,15 @@
>>40 use asf-name
>>0 lelong x \b)
#ASF_Header_Extension_Object
>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365
#>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365
# ASF_Codec_List_Object
>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6
#>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6
>0 guid 1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object
>0 guid F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object
>0 guid D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object
>0 guid 75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object
# ASF_Content_Description_Object
>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C
#>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C
#>>24 leshort title length %d
#>>26 leshort author length %d
#>>28 leshort copyright length %d
@ -73,7 +73,7 @@
>0 guid 298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object
>0 guid 2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object
# ASF_Padding_Object
>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8
#>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8
>0 guid 14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object
>0 guid A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object
>0 guid D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object

123
contrib/file/magic/Magdir/audio
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: audio,v 1.127 2023/03/05 20:15:49 christos Exp $
# $File: audio,v 1.133 2024/09/04 19:07:20 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
@ -99,8 +99,8 @@
!:mime audio/x-unknown
# is this next line right? it came this way...
>19 byte 0x1A
>23 byte >0 - version %d
>22 byte >0 \b.%d
>>23 byte >0 - version %d
>>22 byte >0 \b.%d
# first entry is also the string "NTRK"
0 belong 0x4e54524b MultiTrack sound data
@ -276,13 +276,12 @@
# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
0 belong 0x64a30100 IRCAM file (VAX little-endian)
0 belong 0x0001a364 IRCAM file (VAX big-endian)
0 belong 0x64a30200 IRCAM file (Sun big-endian)
0 belong 0x0002a364 IRCAM file (Sun little-endian)
0 belong 0x64a30200 IRCAM file (Sun big-endian)
0 belong 0x64a30300 IRCAM file (MIPS little-endian)
0 belong 0x0003a364 IRCAM file (MIPS big-endian)
0 belong 0x64a30400 IRCAM file (NeXT big-endian)
0 belong 0x64a30400 IRCAM file (NeXT big-endian)
0 belong 0x0004a364 IRCAM file (NeXT little-endian)
0 belong 0x64a30400 IRCAM file (NeXT big-endian)
# NIST SPHERE <mpruett@sgi.com>
0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
@ -487,7 +486,7 @@
# Sharp Jisaku Melody format for PDC
0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
>20 string Ver01.00 Ver. 1.00
>>32 byte x , %d tracks
>>32 byte x \b, %d tracks
# Free lossless audio codec <http://flac.sourceforge.net>
# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
@ -644,6 +643,7 @@
0 string [Equalizer\ preset] XMMS equalizer preset
# .m3u
0 search/1 #EXTM3U M3U playlist text
!:mime audio/x-mpegurl
# .pls
0 search/1 [playlist] PLS playlist text
# licq.conf
@ -713,10 +713,36 @@
# Type: Adaptive Multi-Rate Codec
# URL: http://filext.com/detaillist.php?extdetail=AMR
# http://fileformats.archiveteam.org/wiki/Adaptive_Multi-Rate_Audio
# Reference: https://datatracker.ietf.org/doc/html/rfc4867
# http://mark0.net/download/triddefs_xml.7z/defs/a/audio-amr.trid.xml
# Update: Joerg Jenderek
# From: Russell Coker <russell@coker.com.au>
0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony)
!:mime audio/amr
# Note: called "AMR (Adaptive Multi Rate) encoded audio" by TrID and
# "Adaptive Multi-Rate Audio" by DROID via PUID fmt/356 and
# "AMR" "AMR audio" or "Adaptive Multi-Rate" by shared MIME-info database from freedesktop.org
0 string #!AMR Adaptive Multi-Rate Codec
# Adaptive Multi-Rate Codec (strength=80) before wrong "a AMR script executable (binary data)" (strength=20=60/3) by ./varied.script
#!:strength +0
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/audio-awb.trid.xml
# Note: called "Adaptive Multi-Rate Wideband ACELP codec" by TrID and
# "Adaptive Multi-Rate Wideband Audio" bY DROID via PUID fmt/954 and
# "AMR-WB" "AMR-WB audio" or "Adaptive Multi-Rate Wideband" by shared MIME-info database from freedesktop.org
>5 string -WB (Wideband)
# https://www.iana.org/assignments/media-types/audio/AMR-WB
!:mime audio/AMR-WB
#!:mime audio/amr-wb-encrypted
!:apple ????amrw
!:ext awb
# variant without Wideband
>5 default x (GSM telephony)
# https://www.iana.org/assignments/media-types/audio/AMR
!:mime audio/AMR
# last character in type code is space
!:apple ????amr
!:ext amr
# GRR: maybe also 3ga suffix? https://telparia.com/fileFormatSamples/audio/amr/example.3ga
#!:ext amr/3ga
# Type: SuperCollider 3 Synth Definition File Format
# From: Mario Lang <mlang@debian.org>
@ -907,16 +933,16 @@
# From Martin Mueller Skarbiniks Pedersen
0 string GDM
>0x3 byte 0xFE General Digital Music.
>0x4 string >\0 title: "%s"
>0x24 string >\0 musician: "%s"
>>0x44 beshort 0x0D0A
>>>0x46 byte 0x1A
>>>>0x47 string GMFS Version
>>>>0x4B byte x %d.
>>>>0x4C byte x \b%02d
>>>>0x4D beshort 0x000 (2GDM v
>>>>0x4F byte x \b%d.
>>>>>0x50 byte x \b%d)
>>0x4 string >\0 title: "%s"
>>0x24 string >\0 musician: "%s"
>>>0x44 beshort 0x0D0A
>>>>0x46 byte 0x1A
>>>>>0x47 string GMFS Version
>>>>>0x4B byte x %d.
>>>>>0x4C byte x \b%02d
>>>>>0x4D beshort 0x000 (2GDM v
>>>>>0x4F byte x \b%d.
>>>>>>0x50 byte x \b%d)
0 string MTM Multitracker
>0x3 byte/16 x Version %d.
@ -939,18 +965,18 @@
>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)"
>0x2e string NAME Art of Noise Tracker Song
>3 string <9
>3 string 4 (4 voices)
>3 string 8 (8 voices)
>>3 string 4 (4 voices)
>>3 string 8 (8 voices)
>>0x36 string >\0 Title: "%s"
0 string FAR
>0x2c byte 0x0d
>0x2d byte 0x0a
>0x2e byte 0x1a
>>0x3 byte 0xFE Farandole Tracker Song
>>>0x31 byte/16 x Version %d.
>>>0x31 byte&0x0F x \b%02d
>>>>0x4 string >\0 \b, title: "%s"
>>0x2d byte 0x0a
>>>0x2e byte 0x1a
>>>>0x3 byte 0xFE Farandole Tracker Song
>>>>>0x31 byte/16 x Version %d.
>>>>>0x31 byte&0x0F x \b%02d
>>>>>0x4 string >\0 \b, title: "%s"
# magic for Klystrack, https://kometbomb.github.io/klystrack/
# from Alex Myczko <alex@aiei.ch>
@ -1034,25 +1060,37 @@
# Added by David Korth <gerbilsoft@gerbilsoft.com>
0 string PSF
>3 byte 0x01
>>0 use portable_sound_format
>3 byte 0x02
>>0 use portable_sound_format
>3 byte 0x11
>>0 use portable_sound_format
>3 byte 0x12
>>0 use portable_sound_format
>3 byte 0x13
>>0 use portable_sound_format
>3 byte 0x21
>>0 use portable_sound_format
>3 byte 0x22
>>0 use portable_sound_format
>3 byte 0x23
>>0 use portable_sound_format
>3 byte 0x41
>>0 string PSF Portable Sound Format
>>0 use portable_sound_format
0 name portable_sound_format
>0 string PSF Portable Sound Format
!:mime audio/x-psf
>>>3 byte 0x01 (Sony PlayStation)
>>>3 byte 0x02 (Sony PlayStation 2)
>>>3 byte 0x11 (Sega Saturn)
>>>3 byte 0x12 (Sega Dreamcast)
>>>3 byte 0x13 (Sega Mega Drive)
>>>3 byte 0x21 (Nintendo 64)
>>>3 byte 0x22 (Game Boy Advance)
>>>3 byte 0x23 (Super NES)
>>>3 byte 0x41 (Capcom QSound)
>>3 byte 0x01 (Sony PlayStation)
>>3 byte 0x02 (Sony PlayStation 2)
>>3 byte 0x11 (Sega Saturn)
>>3 byte 0x12 (Sega Dreamcast)
>>3 byte 0x13 (Sega Mega Drive)
>>3 byte 0x21 (Nintendo 64)
>>3 byte 0x22 (Game Boy Advance)
>>3 byte 0x23 (Super NES)
>>3 byte 0x41 (Capcom QSound)
# Atari 8-bit SAP audio format
# http://asap.sourceforge.net/sap-format.html
@ -1289,3 +1327,14 @@
# version > 1 or 0
>>&0 default x \b, unknown version
# https://moddingwiki.shikadi.net/wiki/ROL_Format
4 string \\roll\\default AdLib Visual Composer ROL file
>0 leshort x \b, version %d.
>2 leshort x \b%d
>44 leshort x \b, tickBeat %d
>46 leshort x \b, beatMeasure %d
>48 leshort x \b, scaleY %d
>50 leshort x \b, scaleX %d
>52 byte 0 \b, percussive
>52 byte 1 \b, melodic

3
contrib/file/magic/Magdir/ber
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
# $File: ber,v 1.3 2024/09/01 13:49:15 christos Exp $
# ber: file(1) magic for several BER formats used in the mobile
# telecommunications industry (Georg Sauthoff)
@ -41,7 +41,6 @@
# NRT Files
# NRT a.k.a. NRTRDE
0 byte 0x61
# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01
>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)

6
contrib/file/magic/Magdir/biosig
View file

@ -1,7 +1,7 @@
##############################################################################
#
# Magic ids for biomedical signal file formats
#------------------------------------------------------------------------------
# $File: biosig,v 1.4 2024/06/10 23:09:52 christos Exp $
# file(1) magic for biomedical signal file formats
# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
#
# The list has been derived from biosig projects

9
contrib/file/magic/Magdir/bsdi
View file

@ -1,21 +1,26 @@
#------------------------------------------------------------------------------
# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
# $File: bsdi,v 1.9 2024/03/31 15:06:56 christos Exp $
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
# Some object/executable formats use the same magic numbers as are used
# in other OSes; those are handled by entries in aout.
#
0 lelong 0314 386 compact demand paged pure executable
0 lelong 0314 i386 compact demand paged pure executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
# Update: Joerg Jenderek
# same as in SunOS 4.x, except for static shared libraries
# Note: was also called "a.out SunOS SPARC demand paged" by ./sun v 1.28
0 belong&077777777 0600413 SPARC demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
#!:mime application/x-foo-executable
# typically no file name suffix for executables
!:ext /
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)

158
contrib/file/magic/Magdir/c64
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: c64,v 1.14 2023/06/16 19:24:06 christos Exp $
# $File: c64,v 1.16 2024/03/07 22:30:21 christos Exp $
# c64: file(1) magic for various commodore 64 related files
#
# From: Dirk Jagdmann <doj@cubic.org>
@ -12,13 +12,32 @@
# C64 (and other CBM) cartridges
# Extended by David Korth <gerbilsoft@gerbilsoft.com>
# Update: Joerg Jenderek
# Reference: https://vice-emu.sourceforge.io/vice_17.html#SEC391
# http://ist.uwaterloo.ca/~schepers/formats/CRT.TTX
# http://mark0.net/download/triddefs_xml.7z/defs/c/crt-c64.trid.xml
# Note: called "C64 Cartridge image" by TrID and
# "CRT C64 Cartridge Image Format" by DROID via PUID fmt/822
0 string C64\40CARTRIDGE Commodore 64 cartridge
0 string C64\40CARTRIDGE
# skip DROID fmt-822-signature-id-1179.crt with missing packet length
>0x44 ubelong >0x10
>>0 use c64-crt
# display Commodore 64 cartridge information
0 name c64-crt
>0 string x Commodore 64 cartridge
#!:mime application/octet-stream
!:mime application/x-commodore-crt
!:ext crt
# http://mark0.net/download/triddefs_xml.7z/defs/c/car-ccs64.trid.xml
#!:ext crt/car
>0x20 ubyte 0 \b,
>0x20 ubyte !0
# 32-byte null padded cartridge name like: "BUGS BUNNY" "CART64" "EasyFlash" "FINAL CARTRIDGE" "Magic Desk" "VICE CART"
>>0x20 string/T x \b: "%.32s",
# cartridge hardware type
>0x16 beshort 0
# cartridge port EXROM line status
>>0x18 beshort 0x0000 16 KB game
>>0x18 beshort 0x0001 8 KB game
>>0x18 beshort 0x0100 UltiMax mode
@ -59,6 +78,7 @@
>0x16 beshort 34 Capture
>0x16 beshort 35 Action Replay 3
>0x16 beshort 36
# cartridge Hardware Revision/Subtype (usually 0) (added in v1.01)
>>0x1A ubyte 1 Nordic Replay
>>0x1A ubyte !1 Retro Replay
>0x16 beshort 37 MMC64
@ -104,6 +124,24 @@
>0x16 beshort 75 IEEE Flash! 64
>0x16 beshort 76 Turtle Graphics II
>0x16 beshort 77 Freeze Frame MK2
>0x16 beshort 78 Partner 64
# cartridge hardware type: (0-78)
>0x16 ubeshort >78 unknown type %#x
# Cartridge Hardware Revision/Subtype (usually 0 added in v1.01)
>>0x1A ubyte >0 revision %#x
# padded with 3 space characters for CRT but for CCS64 Cartridge (*.CAR) maybe different according to TrID
>14 ubeshort !0x2020 \b, at 14 %#x
# file header length like: 20h (reported wrong) 40h (default and minimum)
>0x10 ubelong !0x40 \b, header length %#x
# cartridge version like: 1.0 1.1 (adds CRT sub type/hardware revision) 2.0 (introduces VIC20, PLUS4, C128, CBM2)
>0x14 ubeshort !0x0100
>>0x14 ubyte x \b, version %u
>>0x15 ubyte x \b.%u
# cartridge content start with ROM signature which must be CHIP
>0x40 ubelong !0x43484950 \b, invalid ROM signature
>>0x40 string x "%0.4s"
# total packet length (length of ROM image size and header combined) like: 2010h 4010h
>0x44 ubelong x \b, packet length %#x
0 string C128\40CARTRIDGE Commodore 128 cartridge
>0x20 ubyte 0 \b,
@ -164,26 +202,112 @@
0 belong 0xFF424CFF WRAptor packer (c64)
0 string C64S\x20tape\x20file T64 tape Image
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
>32 leshort x Version:%#x
>36 leshort !0 Entries:%i
>40 string x Name:%.24s
# URL: http://fileformats.archiveteam.org/wiki/T64
# Reference: http://ist.uwaterloo.ca/~schepers/formats/T64.TXT
# https://vice-emu.sourceforge.io/vice_16.html#SEC394
# https://www.infinite-loop.at/Power64/Documentation/Power64-ReadMe/AE-File_Formats.html
# http://mark0.net/download/triddefs_xml.7z/defs/e/emu-t64.trid.xml
# Note: called "Commodore 64 Tape container" by TrID, "T64 Tape Image Format" by DROID via PUID fmt/820 and
# "T64 tape Image" by ./c64,v 1.14
# verified by command like `deark -m t64 -l -d2 Caitan_the_Demo.t64` and
# `cbmconvert -v2 -t -D4 ironmanoffroad.d64 ironmanoffroad.t64`
# 32 byte signature starting like C64S\x20tape\x20file
# C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0
# C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0
0 string/b C64
# skip raw Commodore TAPe by check for unsed areas (\0 filled) and valid low (40h+m*20h; m=0-FFffh) offset
>0x46 ubequad&0xFFff1F00C0ffFFff 0 Commodore Tape image
#!:mime application/octet-stream
#!:mime application/x-commodore-tape
!:ext t64
# version like: 0100h (examples found) 0101h 0200h (no examples)
>>32 leshort x Version:%#x
#>>32 leshort !0x0100 Version:%#x
# number of used directory entries like: 0 1 2 5
>>36 leshort !0 Entries:%i
# tape container name, 24 characters (padded with 20h but with A0h for DirMaster created samples) like:
# ->ZYRON'S PD<- IMAGETAPE MY-T64-TEST\240\240\240 OPERATIONWOLF+3-711.T64
>>40 string/24/Tb >\040 Name:%.24s
# MaxFiles; maximal directory entries like: 0 1 2 5 30 (=1Eh some emulators expect exactly this value) 31 32
>>34 uleshort x MaxFiles:%u
# 1st C64 filetype: 0~free 1~normal tape file 2~tape file with header 3~memory snapshot 4~tape block 5~digitized stream 6-255~reserved
>>0x40 ubyte !1 \b, C64 file type %#x
# 1st start address or load address of first entry like: 0000 (empty|snapshot) 04a0h (ironmanoffroad.t64) 0801h (typically) 1201h (3501_quizmaster_program_s1.t64)
>>0x42 uleshort !0x0801 \b, load address %#4.4x
# 1st actual end address in memory
>>0x44 uleshort x \b, end address %#4.4x
# reserved; must be 0
>>0x26 ubeshort !0 \b, at +0x26 %#x
# not used like: 0 (examples found and according to TrID)
>>0x46 ubeshort !0 \b, at 0x46 %#4.4x
# not used like: 0 (examples found and according to TrID)
>>0x4c ubelong !0 \b, at 0x4C %#8.8x
# offset (=64+32*m) into 1st container file like: 0 (empty) 60h 80h E0h 400h 440h ...
>>0x48 ulelong >0 \b, at %#x
# 1st filename (in PETASCII, padded with 20h, not A0h) like: "DRILLINSTR. /HTL" "WIZBALL+ " ...
>>>0x50 string/16/bT x "%0.16s"
# https://www.lyonlabs.org/commodore/onrequest/Inside_Commodore_Dos.pdf
# file type like: 0~Scratched 1~SEQunclosed 81h~SEQ 82h~PRG C2h~PRGlocked ...
>>>0x41 ubyte x
>>>>0x41 ubyte =0x00 Scratched type
>>>>0x41 ubyte =0x01 SEQ unclosed type
#>>>>0x41 ubyte =0x44 foo type
>>>>0x41 ubyte =0x80 DEL type
>>>>0x41 ubyte =0x81 SEQ type
>>>>0x41 ubyte =0x82 PRG type
>>>>0x41 ubyte =0x83 USR type
>>>>0x41 ubyte =0x84 REL type
>>>>0x41 ubyte =0xC2 PRG locked type
# other unusual file type
>>>>0x41 default x
>>>>>0x41 ubyte x %#2.2x type
# inspect 1st entry content (often Commodore C64 BASIC program *.PRG) without load adress
#>>(0x48.l) ubequad x \b, 1st data %16.16llx...
# Raw tape file format (.tap files)
# Esa Hyyti <esa@netlab.tkk.fi>
0 string C64-TAPE-RAW C64 Raw Tape File (.tap),
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Tap_file
# https://vice-emu.sourceforge.io/vice_16.html#SEC392
# Reference: http://ist.uwaterloo.ca/~schepers/formats/TAP.TXT
# Note: called "TAP (Commodore 64)" by DROID via PUID fmt/802
# a variant starting with C16-TAPE-RAW should exist, but no examples found
0 string/b C64-TAPE-RAW Commodore raw Tape image (platform
#0 string C64-TAPE-RAW C64 Raw Tape File (.tap),
#!:mime application/octet-stream
!:mime application/x-commodore-tape
!:ext tap
# According to TrID als raw suffix, but no such samples found
#!:ext tap/raw
# computer platform like: 0~C64 1~VIC-20 2~C16 Plus/4 3~PET 4~C5x0 5~C6x0 C7x0
>0xD ubyte 0 C64
>0xD ubyte 1 VIC-20
>0xD ubyte 2 C16 Plus/4
>0xD ubyte 3 PET
>0xD ubyte 4 C5x0
>0xD ubyte 5 C6x0 C7x0
# this should not happen!
>0xD ubyte >5 %#2.2x
>0xD ubyte x \b),
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tap.trid.xml
# http://mark0.net/download/triddefs_xml.7z/defs/t/tap-1.trid.xml
# Note: called "C64 Tape image format" (v0-original) (v1-updated)" by TrID
# TAP version like: 0~OriginalLayout 1~Updated (often)
>0x0c byte x Version:%u,
# file data size (not including header)
>0x10 lelong x Length:%u cycles
# video standard like: 0~PAL 1~NTSC 2~OLD NTSC 3~PALN
>0xE ubyte x \b, video
>0xE ubyte 0 PAL
>0xE ubyte 1 NTSC
>0xE ubyte 2 old NTSC
>0xE ubyte 3 PALN
# this should not happen!
>0xE ubyte >3 %#2.2x
# reserved for future expansion like: 0
>0xF ubyte !0 \b, at 0xF %#2.2x
# file data
#>014 ubequad x \b, data %16.16llx
# magic for Goattracker2, http://covertbitops.c64.org/
# from Alex Myczko <alex@aiei.ch>

91
contrib/file/magic/Magdir/cafebabe
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $
# $File: cafebabe,v 1.31 2024/08/30 16:53:22 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
@ -14,10 +14,47 @@
# (and use as a hack). Let's not use 18, because the Mach-O people
# might add another one or two as time goes by...
#
### MACH-O START ###
# URL: https://en.wikipedia.org/wiki/Mach-O
0 name mach-o \b [
# for debugging purpose CPU type as hexadecimal
#>0 ubequad x CPU=%16.16llx
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
>0 use mach-o-cpu \b
# for debugging purpose print offset to 1st mach_header like:
# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
#>8 ubelong x at %#x offset
>(8.L) indirect x \b:
>0 belong x \b]
# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
# include/mach-o/fat.h
# include/mach/machine.h
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
>>8 use mach-o \b
# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
>4 ubelong >1
>>4 ubelong <20 Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8 use mach-o \b
>>>4 ubelong >1
>>>>28 use mach-o \b
>>>4 ubelong >2
>>>>48 use mach-o \b
>>>4 ubelong >3
>>>>68 use mach-o \b
>>>4 ubelong >4
>>>>88 use mach-o \b
>>>4 ubelong >5
>>>>108 use mach-o \b
### MACH-O END ###
### JAVA START ###
# Reference: http://en.wikipedia.org/wiki/Java_class_file
# Update: Joerg Jenderek
0 belong 0xcafebabe
>4 ubelong >30 compiled Java class data,
!:mime application/x-java-applet
#!:mime application/java-byte-code
@ -50,58 +87,20 @@
>>4 belong 0x003E (Java SE 18)
>>4 belong 0x003F (Java SE 19)
>>4 belong 0x0040 (Java SE 20)
>>4 belong 0x0041 (Java SE 21)
>>4 belong 0x0042 (Java SE 22)
>>4 belong 0x0043 (Java SE 23)
>>4 belong 0x0044 (Java SE 24)
>>4 belong 0x0045 (Java SE 25)
>>4 belong 0x0046 (Java SE 26)
# pool count unequal zero
#>>8 beshort x \b, pool count %#x
# pool table
#>>10 ubequad x \b, pool %#16.16llx...
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
!:mime application/x-java-pack200
### JAVA END ###
### MACH-O START ###
# URL: https://en.wikipedia.org/wiki/Mach-O
0 name mach-o \b [
# for debugging purpose CPU type as hexadecimal
#>0 ubequad x CPU=%16.16llx
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
>0 use mach-o-cpu \b
# for debugging purpose print offset to 1st mach_header like:
# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
#>8 ubelong x at %#x offset
>(8.L) indirect x \b:
>0 belong x \b]
# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
# include/mach-o/fat.h
# include/mach/machine.h
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
>>8 use mach-o \b
# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
>4 ubelong >1
>>4 ubelong <20 Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8 use mach-o \b
>>>4 ubelong >1
>>>>28 use mach-o \b
>>>4 ubelong >2
>>>>48 use mach-o \b
>>>4 ubelong >3
>>>>68 use mach-o \b
>>>4 ubelong >4
>>>>88 use mach-o \b
>>>4 ubelong >5
>>>>108 use mach-o \b
### MACH-O END ###

4
contrib/file/magic/Magdir/cbor
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
# $File: cbor,v 1.2 2024/09/04 19:06:12 christos Exp $
# cbor: file(1) magic for CBOR files as defined in RFC 7049
0 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
@ -13,7 +13,7 @@
>3 ubyte <0x80
>>3 ubyte >0x5f (text string)
>3 ubyte <0xa0
>3 ubyte >0x7f (array)
>>3 ubyte >0x7f (array)
>3 ubyte <0xc0
>>3 ubyte >0x9f (map)
>3 ubyte <0xe0

10
contrib/file/magic/Magdir/claris
View file

@ -1,8 +1,10 @@
#------------------------------------------------------------------------------
# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
# $File: claris,v 1.9 2024/07/07 14:36:49 christos Exp $
# claris: file(1) magic for claris
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Update: Joerg Jenderek 2024 May
# URL: https://en.wikipedia.org/wiki/AppleWorks
# Claris Works a word processor, etc.
# Version 3.0
@ -12,8 +14,14 @@
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
#null to byte 1000 octal
514 string \377\377\377\377\000
# https://sembiance.com/fileFormatSamples/image/pict/
# Claris clip art (strength=80) after few Macintosh QuickDraw (strength=81=70+11 ./images) with corner coordinates -1/-1 and Y=0x00?? like PICT_2012.pict
#!:strength +0
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
514 string \377\377\377\377\001
# https://sembiance.com/fileFormatSamples/image/pict/
# Claris clip art (strength=80) after few Macintosh QuickDraw (strength=81=70+11 ./images) with corner coordinates -1/-1 and Y=0x01?? like PICT_129.pict
#!:strength +0
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art
# Claris works files

179
contrib/file/magic/Magdir/coff
View file

@ -1,49 +1,92 @@
#------------------------------------------------------------------------------
# $File: coff,v 1.7 2022/11/21 22:30:22 christos Exp $
# $File: coff,v 1.15 2024/11/10 18:54:33 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
#
# by Joerg Jenderek at Oct 2015, Feb 2021
# by Joerg Jenderek at Oct 2015, Feb 2021, Mar 2024
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
# https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-file-header-object-and-image
# https://formats.kaitai.io/uefi_te/index.html
# Display COFF processor type, including MS COFF and PE/COFF
0 name display-coff-processor
# PE/COFF, DJGPP, i386 COFF executable, MS Windows COFF Intel i386 object file (./intel)
>0 uleshort 0x014c Intel i386
>0 uleshort 0x014d Intel i860
>0 uleshort 0x0160 MIPS R3000 (big-endian)
>0 uleshort 0x0162 MIPS R3000
>0 uleshort 0x0166 MIPS R4000
>0 uleshort 0x0168 MIPS R10000
>0 uleshort 0x0169 MIPS WCE v2
>0 uleshort 0x0184 Alpha 32-bit
>0 uleshort 0x01a2 Hitachi SH3
>0 uleshort 0x01a3 Hitachi SH3 DSP
>0 uleshort 0x01a4 Hitachi SH4E
>0 uleshort 0x01a6 Hitachi SH4
>0 uleshort 0x01a8 Hitachi SH5
>0 uleshort 0x01c0 ARMv4
>0 uleshort 0x01c2 ARMv4T
>0 uleshort 0x01c4 ARMv7
>0 uleshort 0x01d3 Matsushita AM33
# executable (RISC System/6000 V3.1) or obj module (./ibm6000 v 1.15), not PE/COFF
>0 uleshort 0x01df RISC System/6000
>0 uleshort 0x01f0 PowerPC 32-bit (little-endian)
>0 uleshort 0x01f1 PowerPC 32-bit with FPU (little-endian)
>0 uleshort 0x01f2 PowerPC 64-bit (big-endian)
>0 uleshort 0x0200 Intel Itanium
>0 uleshort 0x0266 MIPS16
>0 uleshort 0x0268 Motorola 68000
>0 uleshort 0x0284 Alpha 64-bit
>0 uleshort 0x0290 PA-RISC
>0 uleshort 0x0366 MIPS with FPU
>0 uleshort 0x0466 MIPS16 with FPU
# Hitachi SH big-endian COFF (./hitachi-sh), not PE/COFF
>0 uleshort 0x0500 Hitachi SH (big-endian)
>0 uleshort 0x0520 Tricore
# Hitachi SH little-endian COFF (./hitachi-sh), not PE/COFF
>0 uleshort 0x0550 Hitachi SH (little-endian)
>0 uleshort 0x0601 PowerPC 32-bit (big-endian)
# Windows CE 3.0 Common Executable Format, created by linkcef.exe with /MACHINE:CEF flag
# https://web.archive.org/web/20000819035046/http://microsoft.com/windows/embedded/ce/downloads/cef.asp
# https://web.archive.org/web/20000914080342/http://microsoft.com/windows/embedded/ce/developer/applications/appdevelopment/cef2.asp
# https://web.archive.org/web/20021022055906/http://msdn.microsoft.com/library/en-us/dnce30/html/cef2.asp
>0 uleshort 0x0cef Common Executable Format
>0 uleshort 0x0ebc EFI byte code
>0 uleshort 0x3a64 ARM64 (i386 ABI)
>0 uleshort 0x5032 RISC-V 32-bit
>0 uleshort 0x5064 RISC-V 64-bit
>0 uleshort 0x5128 RISC-V 128-bit
>0 uleshort 0x6232 LoongArch 32-bit
>0 uleshort 0x6264 LoongArch 64-bit
>0 uleshort 0x8664 x86-64
>0 uleshort 0x9041 Mitsubishi M32R
>0 uleshort 0xa641 ARM64 (x86-64 ABI)
>0 uleshort 0xa64e ARM64 (classic + x86-64 ABI)
# PE/COFF ARM64 classic ABI, ARM COFF (./arm)
>0 uleshort 0xaa64 ARM64
>0 uleshort 0xace1 OMNI VM (omniprox.dll)
# Processor type CEE can be only in object files (created by older ilasm.exe with /OBJECT flag), not in PE executables
>0 uleshort 0xc0ee COM+ Execution Engine
>0 default x Unknown processor
>>0 uleshort x 0x%04x
# display name+variables+flags of Common Object Files Format (32bit)
# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
# mips,motorola,msdos,osf1,sharc,varied.out,vax
0 name display-coff
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 uleshort&0x8E80 0
# test for unused flag bits (0x8000,x0080) in f_flags
# flag bits (0x0800,0x0400,0x0200) now seems to be used in RISC System/6000 V3.1
>18 uleshort&0x8080 0
# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
>>2 uleshort >0
# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
>>>2 uleshort <4207
>>>>0 clear x
# f_magic - magic number
# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
>>>>0 uleshort 0x014C Intel 80386
# Hitachi SH big-endian COFF (./hitachi-sh)
>>>>0 uleshort 0x0500 Hitachi SH big-endian
# Hitachi SH little-endian COFF (./hitachi-sh)
>>>>0 uleshort 0x0550 Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
#>>>>0 uleshort 0x01DF
# MS Windows COFF Intel Itanium, AMD64
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
>>>>0 uleshort 0x0200 Intel ia64
>>>>0 uleshort 0x8664 Intel amd64
# ARM COFF (./arm)
>>>>0 uleshort 0xaa64 Aarch64
>>>>0 uleshort 0x01c0 ARM
>>>>0 uleshort 0xa641 ARM64EC
>>>>0 uleshort 0x01c2 ARM Thumb
>>>>0 uleshort 0x01c4 ARMv7 Thumb
# TODO for other COFFs
#>>>>0 uleshort 0xABCD COFF_TEMPLATE
>>>>0 default x
>>>>>0 uleshort x type %#04x
>>>>0 use display-coff-processor
>>>>0 uleshort x COFF
# F_EXEC flag bit
>>>>18 leshort ^0x0002 object file
@ -53,6 +96,9 @@
#!:ext cof/o/obj/lib
>>>>18 leshort &0x0002 executable
#!:mime application/x-coffexec
!:mime application/x-coff-executable
# typically no file name suffix for executables
!:ext /
# F_RELFLG flag bit,static object
>>>>18 leshort &0x0001 \b, no relocation info
# F_LNNO flag bit
@ -79,16 +125,39 @@
# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
>>>>12 ulelong >0 \b, %d symbols
# f_opthdr - optional header size. An object file should have a value of 0
# like: 72 (IBM\HH\HYPERHLP)
>>>>16 uleshort >0 \b, optional header size %u
# f_timdat - file time & date stamp only for little endian
# f_timdat - file time & date stamp
>>>>4 ledate >0 \b, created %s
# at offset 20 can be optional header, extra bytes FILHSZ-20 because
# do not rely on sizeof(FILHDR) to give the correct size for header.
# or first section header
# additional variables for other COFF files
>>>>16 uleshort =0
# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
>>>>>20 string x \b, 1st section name "%.8s"
# most section names start with point character except samples created by "exotic" compilers
# first section name s_name[8] like: .text .data .debug$S .drectve .testseg .rsrc .rsrc$01 .pad
>>>>>(16.s+20) string x \b, 1st section name "%.8s"
# physical address s_paddr like: 0
#>>>>>(16.s+28) lelong !0 \b, s_paddr %#8.8x
# virtual address s_vaddr like: 0
#>>>>>(16.s+32) lelong !0 \b, s_vaddr %#8.8x
# section size s_size
#>>>>>(16.s+36) lelong x \b, s_size %#8.8x
# file ptr to raw data for section s_scnpt
#>>>>>(16.s+40) lelong x \b, s_scnpt %#8.8x
# file ptr to relocation s_relptr like: 0
#>>>>>(16.s+44) lelong !0 \b, s_relptr %#8.8x
# file ptr to gp histogram s_lnnoptr like: 0
#>>>>>(16.s+48) lelong !0 \b, s_lnnoptr %#8.8x
# number of relocation entries s_nreloc like: 0 1 2 5 6 8 19h 26h 27h 38h 50h 5Fh 89h Dh 1Ch 69h A9h 1DCh 651h
#>>>>>(16.s+52) uleshort x \b, s_nreloc %#4.4x
# number of gp histogram entries s_nlnno like: 0
#>>>>>(16.s+54) uleshort !0 \b, s_nlnno %#4.4x
# flags s_flags
#>>>>>(16.s+56) lelong x \b, s_flags %#8.8x
# second section name s_name[8] like: .bss .data .debug$S .rsrc$01
>>>>2 uleshort >1
>>>>>(16.s+60) string x \b, 2nd section name "%.8s"
# >20 beshort 0407 (impure)
# >20 beshort 0410 (pure)
# >20 beshort 0413 (demand paged)
@ -96,3 +165,53 @@
# >22 leshort >0 - version %d
# >168 string .lowmem Apple toolbox
# PowerPC COFF object file or executable
0 leshort 0x01f0
>16 leshort 0
>>0 use display-coff
# can be created by: LINK.EXE /MACHINE:powerpc /ROM
>16 leshort !0
>>18 leshort &0x0002
>>>20 leshort 0x010b
>>>>0 use display-coff
0 leshort 0x01f1
>16 leshort 0
>>0 use display-coff
0 leshort 0x01f2
>16 leshort 0
>>0 use display-coff
0 leshort 0x0601
>16 leshort 0
>>0 use display-coff
# can be created by: LINK.EXE /MACHINE:MPPC /ROM
>16 leshort !0
>>18 leshort &0x0002
>>>20 leshort 0x010b
>>>>0 use display-coff
0 name display-subsystem
>0 ubyte 0 unknown
>0 ubyte 1 native
>0 ubyte 2 windows_gui
>0 ubyte 3 windows_cui
>0 ubyte 7 posix_cui
>0 ubyte 9 windows_ce_gui
>0 ubyte 10 efi_application
>0 ubyte 11 efi_boot_service_driver
>0 ubyte 12 efi_runtime_driver
>0 ubyte 13 efi_rom
>0 ubyte 14 xbox
>0 ubyte 16 windows_boot-application
>0 default x Unknown subsystem
>>0 ubyte x %#x
# https://formats.kaitai.io/uefi_te/index.html
0 string VZ TE (Terse Executable) file
>2 use display-coff-processor
>4 byte x \b, sections %d
>5 use display-subsystem
>6 uleshort x \b, stripped-size %u
>8 ulelong x \b, entry %#x
>12 ulelong x \b, base_of_code %#x
>16 ulequad x \b, image_base %#llx

14
contrib/file/magic/Magdir/commands
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: commands,v 1.73 2022/11/06 18:39:23 christos Exp $
# $File: commands,v 1.77 2024/11/10 16:55:15 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
@ -89,6 +89,13 @@
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /bin/env\ bash Bourne-Again shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /bin/dash Dash shell script text executable
!:mime text/x-shellscript
0 string/fwt #!\ /usr/bin/dash Dash shell script text executable
!:mime text/x-shellscript
# Fish shell magic
# From: Benjamin Lowry <ben@ben.gmbh>
@ -110,6 +117,8 @@
0 search/1/fwt #!\ /usr/bin/stap Systemtap script text executable
!:mime text/x-systemtap
0 search/1/fwt #!\ /sbin/openrc-run OpenRC script text executable
!:mime text/x-shellscript
# From: Kylie McClain <kylie@somas.is>
# Type: execline scripts
@ -127,6 +136,9 @@
>0 regex \^#!.*/bin/execlineb([[:space:]].*)*$ execline script text executable
!:mime text/x-execline
0 string #!/nix/store/
>&-11 string/T x a %s script text executable
# PHP scripts
# Ulf Harnhammar <ulfh@update.uu.se>
0 search/1/c =<?php PHP script text

27
contrib/file/magic/Magdir/compress
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: compress,v 1.91 2023/06/16 19:37:47 christos Exp $
# $File: compress,v 1.96 2024/11/09 23:47:04 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@ -203,6 +203,7 @@
# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
!:ext lzo
!:mime application/x-lzop
>9 beshort <0x0940
>>9 byte&0xf0 =0x00 - version 0.
>>9 beshort&0x0fff x \b%03x,
@ -376,18 +377,15 @@
0 string ArC\x01 FreeArc archive <http://freearc.org>
# Type: DACT compressed files
0 long 0x444354C3 DACT compressed data
>4 byte >-1 (version %i.
>5 byte >-1 %i.
>6 byte >-1 %i)
>7 long >0 , original size: %i bytes
>15 long >30 , block size: %i bytes
# Valve Pack (VPK) files
# https://developer.valvesoftware.com/wiki/VPK_(file_format)#File_Format
0 lelong 0x55aa1234 Valve Pak file
>0x4 lelong x \b, version %u
>0x8 lelong x \b, %u entries
>0x8 lelong x \b, tree size %u
>0x12 lelong x \b, file data size %u
>0x16 lelong x \b, archive MD5 size %u
>0x20 lelong x \b, other MD5 size %u
>0x24 lelong x \b, signature size %u
# Snappy framing format
# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
@ -424,11 +422,6 @@
0 string bvx2 lzfse compressed, compressed tables
0 string bvxn lzfse encoded, lzvn compressed
# pcxLib.exe compression program
# http://www.shikadi.net/moddingwiki/PCX_Library
0 string/b pcxLib
>0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed
# https://support-docs.illumina.com/SW/ORA_Format_Specification/Content/SW/ORA/ORAFormatSpecification.htm
0 uleshort 0x7c49
>2 lelong 0x80 ORA FASTQ compressed file
@ -459,3 +452,7 @@
>-125 u8 x NB reads: %llu,
>-109 u8 x NB bases: %llu.
>-219 u4&0x02 2 File contains interleaved paired reads
# https://github.com/xamarin/xamarin-android/pull/4686
0 string XALZ Xamarin LZ4-compressed assembly
>8 ulelong x \b, uncompressed size %u

422
contrib/file/magic/Magdir/console
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: console,v 1.72 2023/06/16 19:24:06 christos Exp $
# $File: console,v 1.80 2024/11/09 23:55:02 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
@ -115,17 +115,18 @@
# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
#
0x104 bequad 0xCEED6666CC0D000B Game Boy ROM image
# TODO: application/x-gameboy-color-rom for GBC.
!:mime application/x-gameboy-rom
# Title (16 chars for GB; 15 chars for CGB)
0 name gameboy-title
>0x143 byte&0x80 0x80
>>0x134 string >\0 \b: "%.15s"
>0x143 byte&0x80 !0x80
>>0x134 string >\0 \b: "%.16s"
>0x14c byte x (Rev.%02u)
# Machine type. (SGB, CGB, SGB+CGB)
# Machine type (SGB, CGB, SGB+CGB)
# Old licensee code 0x33 is required for SGB, but not CGB.
0 name gameboy-machine-type
>0x14b byte 0x33
>>0x146 byte 0x03
>>>0x143 byte&0x80 0x80 [SGB+CGB]
@ -137,53 +138,78 @@
>>0x143 byte&0xC0 0x80 [CGB]
>>0x143 byte&0xC0 0xC0 [CGB ONLY]
# Mapper.
>0x147 byte 0x00 [ROM ONLY]
>0x147 byte 0x01 [MBC1]
>0x147 byte 0x02 [MBC1+RAM]
>0x147 byte 0x03 [MBC1+RAM+BATT]
>0x147 byte 0x05 [MBC2]
>0x147 byte 0x06 [MBC2+BATTERY]
>0x147 byte 0x08 [ROM+RAM]
>0x147 byte 0x09 [ROM+RAM+BATTERY]
>0x147 byte 0x0B [MMM01]
>0x147 byte 0x0C [MMM01+SRAM]
>0x147 byte 0x0D [MMM01+SRAM+BATT]
>0x147 byte 0x0F [MBC3+TIMER+BATT]
>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT]
>0x147 byte 0x11 [MBC3]
>0x147 byte 0x12 [MBC3+RAM]
>0x147 byte 0x13 [MBC3+RAM+BATT]
>0x147 byte 0x19 [MBC5]
>0x147 byte 0x1A [MBC5+RAM]
>0x147 byte 0x1B [MBC5+RAM+BATT]
>0x147 byte 0x1C [MBC5+RUMBLE]
>0x147 byte 0x1D [MBC5+RUMBLE+SRAM]
>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT]
>0x147 byte 0xFC [Pocket Camera]
>0x147 byte 0xFD [Bandai TAMA5]
>0x147 byte 0xFE [Hudson HuC-3]
>0x147 byte 0xFF [Hudson HuC-1]
# Mapper
0 name gameboy-mapper
>0 byte 0x00 [ROM ONLY]
>0 byte 0x01 [MBC1]
>0 byte 0x02 [MBC1+RAM]
>0 byte 0x03 [MBC1+RAM+BATT]
>0 byte 0x05 [MBC2]
>0 byte 0x06 [MBC2+BATTERY]
>0 byte 0x08 [ROM+RAM]
>0 byte 0x09 [ROM+RAM+BATTERY]
>0 byte 0x0B [MMM01]
>0 byte 0x0C [MMM01+SRAM]
>0 byte 0x0D [MMM01+SRAM+BATT]
>0 byte 0x0F [MBC3+TIMER+BATT]
>0 byte 0x10 [MBC3+TIMER+RAM+BATT]
>0 byte 0x11 [MBC3]
>0 byte 0x12 [MBC3+RAM]
>0 byte 0x13 [MBC3+RAM+BATT]
>0 byte 0x19 [MBC5]
>0 byte 0x1A [MBC5+RAM]
>0 byte 0x1B [MBC5+RAM+BATT]
>0 byte 0x1C [MBC5+RUMBLE]
>0 byte 0x1D [MBC5+RUMBLE+SRAM]
>0 byte 0x1E [MBC5+RUMBLE+SRAM+BATT]
>0 byte 0xFC [Pocket Camera]
>0 byte 0xFD [Bandai TAMA5]
>0 byte 0xFE [Hudson HuC-3]
>0 byte 0xFF [Hudson HuC-1]
# ROM size.
>0x148 byte 0 \b, ROM: 256Kbit
>0x148 byte 1 \b, ROM: 512Kbit
>0x148 byte 2 \b, ROM: 1Mbit
>0x148 byte 3 \b, ROM: 2Mbit
>0x148 byte 4 \b, ROM: 4Mbit
>0x148 byte 5 \b, ROM: 8Mbit
>0x148 byte 6 \b, ROM: 16Mbit
>0x148 byte 7 \b, ROM: 32Mbit
>0x148 byte 0x52 \b, ROM: 9Mbit
>0x148 byte 0x53 \b, ROM: 10Mbit
>0x148 byte 0x54 \b, ROM: 12Mbit
# ROM size
0 name gameboy-rom-size
>0 byte 0 \b, ROM: 256Kbit
>0 byte 1 \b, ROM: 512Kbit
>0 byte 2 \b, ROM: 1Mbit
>0 byte 3 \b, ROM: 2Mbit
>0 byte 4 \b, ROM: 4Mbit
>0 byte 5 \b, ROM: 8Mbit
>0 byte 6 \b, ROM: 16Mbit
>0 byte 7 \b, ROM: 32Mbit
>0 byte 0x52 \b, ROM: 9Mbit
>0 byte 0x53 \b, ROM: 10Mbit
>0 byte 0x54 \b, ROM: 12Mbit
# RAM size.
>0x149 byte 1 \b, RAM: 16Kbit
>0x149 byte 2 \b, RAM: 64Kbit
>0x149 byte 3 \b, RAM: 256Kbit
>0x149 byte 4 \b, RAM: 1Mbit
>0x149 byte 5 \b, RAM: 512Kbit
# RAM size
0 name gameboy-ram-size
>0 byte 1 \b, RAM: 16Kbit
>0 byte 2 \b, RAM: 64Kbit
>0 byte 3 \b, RAM: 256Kbit
>0 byte 4 \b, RAM: 1Mbit
>0 byte 5 \b, RAM: 512Kbit
# Game Boy (Color)
0x104 bequad 0xCEED6666CC0D000B
>0x143 byte&0x80 0x80 Game Boy Color ROM image
!:mime application/x-gameboy-color-rom
>0x143 byte&0x80 !0x80 Game Boy ROM image
!:mime application/x-gameboy-rom
>0 use gameboy-title
>0 use gameboy-machine-type
>0x147 use gameboy-mapper
>0x148 use gameboy-rom-size
>0x149 use gameboy-ram-size
# Analogue Pocket
0x104 bequad 0x0110CEEF000044AA
>0 byte x Analogue Pocket ROM image
!:mime application/x-analogue-pocket-rom
>0 use gameboy-title
>0 use gameboy-machine-type
>0x147 use gameboy-mapper
>0x148 use gameboy-rom-size
>0x149 use gameboy-ram-size
#------------------------------------------------------------------------------
# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
@ -210,45 +236,45 @@
# TODO: Check for 32X CD?
# Sega Mega CD disc images: 2048-byte sectors.
0 string SEGADISCSYSTEM\ \ Sega Mega CD disc image
0 string SEGADISCSYSTEM\040\040 Sega Mega CD disc image
!:mime application/x-sega-cd-rom
>0 use sega-mega-drive-header
>0 byte x \b, 2048-byte sectors
0 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image
0 string SEGABOOTDISC\040\040\040\040 Sega Mega CD disc image
!:mime application/x-sega-cd-rom
>0 use sega-mega-drive-header
>0 byte x \b, 2048-byte sectors
# Sega Mega CD disc images: 2352-byte sectors.
0x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image
0x10 string SEGADISCSYSTEM\040\040 Sega Mega CD disc image
!:mime application/x-sega-cd-rom
>0x10 use sega-mega-drive-header
>0 byte x \b, 2352-byte sectors
0x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image
0x10 string SEGABOOTDISC\040\040\040\040 Sega Mega CD disc image
!:mime application/x-sega-cd-rom
>0x10 use sega-mega-drive-header
>0 byte x \b, 2352-byte sectors
# Sega Mega Drive: Identify the system ID.
0x100 string SEGA
>0x3C0 string MARS\ CHECK\ MODE Sega 32X ROM image
>0x3C0 string MARS\040CHECK\040MODE Sega 32X ROM image
!:mime application/x-genesis-32x-rom
>>0 use sega-mega-drive-header
>0x104 string \ PICO Sega Pico ROM image
>0x104 string \040PICO Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>0 use sega-mega-drive-header
>0x104 string TOYS\ PICO Sega Pico ROM image
>0x104 string TOYS\040PICO Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>0 use sega-mega-drive-header
>0x104 string \ TOYS\ PICO Sega Pico ROM image
>0x104 string \040TOYS\040PICO Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>0 use sega-mega-drive-header
>0x104 string \ IAC Sega Pico ROM image
>0x104 string \040IAC Sega Pico ROM image
!:mime application/x-sega-pico-rom
>>0 use sega-mega-drive-header
>0x104 string \ TERA68K Sega Teradrive (68K) ROM image
>0x104 string \040TERA68K Sega Teradrive (68K) ROM image
!:mime application/x-sega-teradrive-rom
>>0 use sega-mega-drive-header
>0x104 string \ TERA286 Sega Teradrive (286) ROM image
>0x104 string \040TERA286 Sega Teradrive (286) ROM image
!:mime application/x-sega-teradrive-rom
>>0 use sega-mega-drive-header
>0x180 string BR Sega Mega CD Boot ROM image
@ -259,23 +285,23 @@
>>0 use sega-mega-drive-header
# Sega Mega Drive: Some ROMs have "SEGA" at 0x101, not 0x100.
0x100 string \ SEGA Sega Mega Drive / Genesis ROM image
0x100 string \040SEGA Sega Mega Drive / Genesis ROM image
>0 use sega-mega-drive-header
# Sega Pico ROMs that don't start with "SEGA".
0x100 string SAMSUNG\ PICO Samsung Pico ROM image
0x100 string SAMSUNG\040PICO Samsung Pico ROM image
!:mime application/x-sega-pico-rom
>0 use sega-mega-drive-header
0x100 string IMA\ IKUNOUJYUKU Samsung Pico ROM image
0x100 string IMA\040IKUNOUJYUKU Samsung Pico ROM image
!:mime application/x-sega-pico-rom
>0 use sega-mega-drive-header
0x100 string IMA IKUNOJYUKU Samsung Pico ROM image
0x100 string IMA\040IKUNOJYUKU Samsung Pico ROM image
!:mime application/x-sega-pico-rom
>0 use sega-mega-drive-header
# Sega Picture Magic (modified 32X)
0x100 string Picture\ Magic
>0x3C0 string PICTURE MAGIC-01 Sega 32X ROM image
0x100 string Picture\040Magic
>0x3C0 string PICTURE\040MAGIC-01 Sega 32X ROM image
!:mime application/x-genesis-32x-rom
>>0 use sega-mega-drive-header
@ -314,59 +340,59 @@
# The SMS boot ROM checks the header at three locations.
0 name sega-master-system-rom-header
# Machine type.
>0x0F byte&0xF0 0x30 Sega Master System
>0x0F ubyte&0xF0 0x30 Sega Master System
!:mime application/x-sms-rom
>0x0F byte&0xF0 0x40 Sega Master System
>0x0F ubyte&0xF0 0x40 Sega Master System
!:mime application/x-sms-rom
>0x0F byte&0xF0 0x50 Sega Game Gear
>0x0F ubyte&0xF0 0x50 Sega Game Gear
!:mime application/x-gamegear-rom
>0x0F byte&0xF0 0x60 Sega Game Gear
>0x0F ubyte&0xF0 0x60 Sega Game Gear
!:mime application/x-gamegear-rom
>0x0F byte&0xF0 0x70 Sega Game Gear
>0x0F ubyte&0xF0 0x70 Sega Game Gear
!:mime application/x-gamegear-rom
>0x0F default x Sega Master System / Game Gear
!:mime application/x-sms-rom
>0 byte x ROM image:
# Product code.
>0x0E byte&0xF0 0x10 1
>0x0E byte&0xF0 0x20 2
>0x0E byte&0xF0 0x30 3
>0x0E byte&0xF0 0x40 4
>0x0E byte&0xF0 0x50 5
>0x0E byte&0xF0 0x60 6
>0x0E byte&0xF0 0x70 7
>0x0E byte&0xF0 0x80 8
>0x0E byte&0xF0 0x90 9
>0x0E byte&0xF0 0xA0 10
>0x0E byte&0xF0 0xB0 11
>0x0E byte&0xF0 0xC0 12
>0x0E byte&0xF0 0xD0 13
>0x0E byte&0xF0 0xE0 14
>0x0E byte&0xF0 0xF0 15
>0x0E ubyte&0xF0 0x10 1
>0x0E ubyte&0xF0 0x20 2
>0x0E ubyte&0xF0 0x30 3
>0x0E ubyte&0xF0 0x40 4
>0x0E ubyte&0xF0 0x50 5
>0x0E ubyte&0xF0 0x60 6
>0x0E ubyte&0xF0 0x70 7
>0x0E ubyte&0xF0 0x80 8
>0x0E ubyte&0xF0 0x90 9
>0x0E ubyte&0xF0 0xA0 10
>0x0E ubyte&0xF0 0xB0 11
>0x0E ubyte&0xF0 0xC0 12
>0x0E ubyte&0xF0 0xD0 13
>0x0E ubyte&0xF0 0xE0 14
>0x0E ubyte&0xF0 0xF0 15
# If the product code is 5 digits, we'll need to backspace here.
>0x0E byte&0xF0 !0
>>0x0C leshort x \b%04x
>0x0E byte&0xF0 0
>>0x0C leshort x %04x
>0x0E ubyte&0xF0 !0
>>0x0C uleshort x \b%04x
>0x0E ubyte&0xF0 0
>>0x0C uleshort x %04x
# Revision.
>0x0E byte&0x0F x (Rev.%02d)
>0x0E ubyte&0x0F x (Rev.%02d)
# ROM size. (Used for the boot ROM checksum routine.)
>0x0F byte&0x0F 0x0A (8 KB)
>0x0F byte&0x0F 0x0B (16 KB)
>0x0F byte&0x0F 0x0C (32 KB)
>0x0F byte&0x0F 0x0D (48 KB)
>0x0F byte&0x0F 0x0E (64 KB)
>0x0F byte&0x0F 0x0F (128 KB)
>0x0F byte&0x0F 0x00 (256 KB)
>0x0F byte&0x0F 0x01 (512 KB)
>0x0F byte&0x0F 0x02 (1 MB)
>0x0F ubyte&0x0F 0x0A (8 KB)
>0x0F ubyte&0x0F 0x0B (16 KB)
>0x0F ubyte&0x0F 0x0C (32 KB)
>0x0F ubyte&0x0F 0x0D (48 KB)
>0x0F ubyte&0x0F 0x0E (64 KB)
>0x0F ubyte&0x0F 0x0F (128 KB)
>0x0F ubyte&0x0F 0x00 (256 KB)
>0x0F ubyte&0x0F 0x01 (512 KB)
>0x0F ubyte&0x0F 0x02 (1 MB)
# SMS/GG header locations.
0x7FF0 string TMR\ SEGA
0x7FF0 string TMR\040SEGA
>0x7FF0 use sega-master-system-rom-header
0x3FF0 string TMR\ SEGA
0x3FF0 string TMR\040SEGA
>0x3FF0 use sega-master-system-rom-header
0x1FF0 string TMR\ SEGA
0x1FF0 string TMR\040SEGA
>0x1FF0 use sega-master-system-rom-header
#------------------------------------------------------------------------------
@ -384,12 +410,12 @@
>>0x2A byte 0 \b)
# 2048-byte sector version.
0 string SEGA\ SEGASATURN\ Sega Saturn disc image
0 string SEGA\040SEGASATURN\040 Sega Saturn disc image
!:mime application/x-saturn-rom
>0 use sega-saturn-disc-header
>0 byte x (2048-byte sectors)
# 2352-byte sector version.
0x10 string SEGA\ SEGASATURN\ Sega Saturn disc image
0x10 string SEGA\040SEGASATURN\040 Sega Saturn disc image
!:mime application/x-saturn-rom
>0x10 use sega-saturn-disc-header
>0 byte x (2352-byte sectors)
@ -410,12 +436,12 @@
>>0x4A byte 0 \b)
# 2048-byte sector version.
0 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image
0 string SEGA\040SEGAKATANA\040 Sega Dreamcast disc image
!:mime application/x-dc-rom
>0 use sega-dreamcast-disc-header
>0 byte x (2048-byte sectors)
# 2352-byte sector version.
0x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image
0x10 string SEGA\040SEGAKATANA\040 Sega Dreamcast disc image
!:mime application/x-dc-rom
>0x10 use sega-dreamcast-disc-header
>0 byte x (2352-byte sectors)
@ -509,7 +535,7 @@
# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
# - https://www.devrs.com/ngp/files/ngpctech.txt
#
0x0A string BY\ SNK\ CORPORATION Neo Geo Pocket
0x0A string BY\040SNK\040CORPORATION Neo Geo Pocket
!:mime application/x-neo-geo-pocket-rom
>0x23 byte 0x10 Color
>0 byte x ROM image
@ -524,7 +550,7 @@
#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
0 string PS-X\ EXE Sony Playstation executable
0 string PS-X\040EXE Sony Playstation executable
>16 lelong x PC=%#08x,
>20 lelong !0 GP=%#08x,
>24 lelong !0 .text=[%#08x,
@ -723,17 +749,54 @@
# From: Alex Myczko <alex@aiei.ch>
# From: David Pflug <david@pflug.email>
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Game_Boy_Sound
# http://en.wikipedia.org/wiki/Game_Boy_Sound_System
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/g/gbs.trid.xml
# Note: called "GameBoy Sound System dump" by TrID,
# "Gameboy GBS rom image" by X11 Gameboy sound player xgbsplay and
# verified by gbsplay `LANG=C gbsinfo /usr/share/doc/gbsplay/examples/nightmode.gbs`
# is the offset 12 or the offset 16 correct?
# GBS (Game Boy Sound) magic
# ftp://ftp.modland.com/pub/documents/format_documentation/\
# http://ftp.modland.com/pub/documents/format_documentation/\
# Gameboy%20Sound%20System%20(.gbs).txt
0 string GBS Nintendo Gameboy Music/Audio Data
#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
# skip Grand Theft Auto 2 Style data (*.sty via sty-gta2.trid.xml) and Opera (*.patch) by check for valid "low" version
0 string GBS\001 Nintendo Gameboy Music/Audio Data
!:mime audio/x-nintendo-gbs
# by gbsplay or xgbsplay tools
#!:mime audio/gbs
#!:mime audio/prs.gbs
!:ext gbs
# fields are right null-filled; no terminating \0 if all bytes are used; if field unknown, should be set to a single ?
# title string like: "Blues Brothers" "Bugs Bunny Crazy Castle 3"
#12 string GameBoy\040Music\040Module Nintendo Gameboy Music Module
>16 string >\0 ("%.32s" by
# author string like: <?>, by Laxity, Justin Muir, 1993 Ocean
>48 string >\0 %.32s, copyright
>80 string >\0 %.32s),
>3 byte x version %u,
>4 byte x %u tracks
# copyright string like: empty "1991 Titus" "2001 Imagineer/KT.Kodansha/P&B" "2000 Newline, Ubisoft, D. Eclip."
>80 string >\0 %.32s
# GBSVersion; 1
#>3 byte !1 version %u,
# number of songs (1-255)
>4 ubyte x \b), %u track
# plural s
>4 ubyte >1 \bs
# default subsong; like: 1 (often) 2 29 60 79 82
>5 ubyte !1 \b, %u first
# load address (400h-7fffh)
>6 uleshort x \b, load address %#4.4x
# init address (400h-7fffh)
>8 uleshort x \b, init address %#4.4x
# play address (400-7fffh)
>10 uleshort x \b, play address %#4.4x
# stack pointer; like: FFFEh (default) CFFFh DCFEh DDFEh DDFFh DEFFh E000h FFF4h
>12 uleshort x \b, stack pointer %#4.4x
# timer modulo; often 0
>14 ubyte !0 \b, timer modulo %#x
# timer control; often 0
>15 ubyte !0 \b, timer control %#x
# code and Data (see RST VECTORS)
#>0x70 ubequad x \b, data %#16.16llx...
# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
# see https://zerosoft.zophar.net/ips.php
@ -807,6 +870,37 @@
!:ext ciso/cso
>>>>8 ulequad x \b, original size %llu bytes
>>>>16 ulelong x \b, datablock size %u bytes
# Type: Nintendo GameCube/Wii disc image (CISO format)
# NOTE: This is NOT the same as Compact ISO or PSP CISO,
# though it has the same magic number.
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - None of the above: Compact ISO.
>4 lelong 0x200000
>>8 byte 1
>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format):
!:mime application/x-wii-rom
>>>>0x8000 use nintendo-gcn-disc-common
>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format):
!:mime application/x-wii-rom
>>>>0x8000 use nintendo-gcn-disc-common
# .cso files
# Reference: https://pismotec.com/ciso/ciso.h
# NOTE: There are two other formats with the same magic but
# completely incompatible specifications:
# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - 0x10 == 0x00004000: For >2GB files using maxcso...
# https://github.com/unknownbrackets/maxcso/issues/26
# - None of the above: Compact ISO.
>4 lelong !0
>>4 lelong !0x200000
>>>16 lelong !0x800
>>>>16 lelong !0x4000 Compressed ISO CD image
# From: Daniel Dawson <ddawson@icehouse.net>
# SNES9x .smv "movie" file format.
@ -918,22 +1012,6 @@
!:mime application/x-wii-rom
>>0x200 use nintendo-gcn-disc-common
# Type: Nintendo GameCube/Wii disc image (CISO format)
# NOTE: This is NOT the same as Compact ISO or PSP CISO,
# though it has the same magic number.
0 string CISO
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - None of the above: Compact ISO.
>4 lelong 0x200000
>>8 byte 1
>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format):
!:mime application/x-wii-rom
>>>>0x8000 use nintendo-gcn-disc-common
>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format):
!:mime application/x-wii-rom
>>>>0x8000 use nintendo-gcn-disc-common
# Type: Nintendo GameCube/Wii disc image (GCZ format)
# Due to zlib compression, we can't get the actual disc information.
@ -1133,7 +1211,7 @@
# The header is terminated with a 0, so that will
# terminate the title as well.
#
0 string g\ GCE Vectrex ROM image
0 string g\040GCE Vectrex ROM image
>0x11 string >\0 \b: "%.16s"
#------------------------------------------------------------------------------
@ -1213,8 +1291,8 @@
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor
0 string BANDAI\ SFC-ADX
>0x10 string !SFC-ADX\ BACKUP Sufami Turbo ROM image:
0 string BANDAI\040SFC-ADX
>0x10 string !SFC-ADX\040BACKUP Sufami Turbo ROM image:
>>0x10 string/T x "%.14s"
>>0x30 byte x \b, ID %02X
>>0x31 byte x \b%02X
@ -1224,3 +1302,77 @@
>>0x34 ubyte 1 [FastROM]
>>0x35 ubyte 1 [SRAM]
>>0x35 ubyte 3 [Special]
#------------------------------------------------------------------------------
# Type: Super NES ROM image
# From: Alexandre Iooss <erdnaxe@crans.org>
# Reference: https://snes.nesdev.org/wiki/ROM_header
0 name snes-rom-hdr
# cartridge title is encoded in JIS X 0201, 21 chars padded with spaces
>0 ubyte-0x20 <0xC0
>>1 ubyte-0x20 <0xC0
>>>2 ubyte-0x20 <0xC0
>>>>3 ubyte-0x20 <0xC0
>>>>>4 ubyte-0x20 <0xC0
>>>>>>5 ubyte-0x20 <0xC0
>>>>>>>6 ubyte-0x20 <0xC0
>>>>>>>>7 ubyte-0x20 <0xC0
>>>>>>>>>8 ubyte-0x20 <0xC0
>>>>>>>>>>9 ubyte-0x20 <0xC0
>>>>>>>>>>>10 ubyte-0x20 <0xC0
>>>>>>>>>>>>21 ubyte-0x20 <0xC0 Super NES ROM image
>>>>>>>>>>>>>0 string/21/T x "%s"
>>>>>>>>>>>>>25 byte 0 (Japan)
>>>>>>>>>>>>>25 byte 1 (USA)
>>>>>>>>>>>>>25 byte 2 (Europe)
>>>>>>>>>>>>>25 byte 6 (France)
>>>>>>>>>>>>>25 byte 7 (Netherlands)
>>>>>>>>>>>>>25 byte 9 (Germany)
>>>>>>>>>>>>>25 byte 10 (Brazil)
>>>>>>>>>>>>>27 byte >0 (Rev.%02u)
>>>>>>>>>>>>>21 byte&0xF 0x0 \b, LoROM
>>>>>>>>>>>>>21 byte&0xF 0x1 \b, HiROM
>>>>>>>>>>>>>21 byte&0x10 0x10 \b, FastROM
>>>>>>>>>>>>>23 byte 8 \b, ROM size: 256KB
>>>>>>>>>>>>>23 byte 9 \b, ROM size: 512KB
>>>>>>>>>>>>>23 byte 10 \b, ROM size: 1024KB
>>>>>>>>>>>>>23 byte 11 \b, ROM size: 2048KB
>>>>>>>>>>>>>23 byte 12 \b, ROM size: 4096KB
>>>>>>>>>>>>>24 byte 0 \b, RAM size: 1KB
>>>>>>>>>>>>>24 byte 1 \b, RAM size: 2KB
>>>>>>>>>>>>>24 byte 2 \b, RAM size: 4KB
>>>>>>>>>>>>>24 byte 3 \b, RAM size: 8KB
>>>>>>>>>>>>>24 byte 4 \b, RAM size: 16KB
>>>>>>>>>>>>>24 byte 5 \b, RAM size: 32KB
>>>>>>>>>>>>>24 byte 6 \b, RAM size: 64KB
# header position for LoROM: $007FC0
32725 ubyte&0xEF 0x20
# ROM is <=4096KB, RAM is <=64KB and country<=10
>32727 ubyte <13
>>32728 ubyte <7
>>>32729 ubyte <11
>>>>32704 use snes-rom-hdr
# HiROM header at $00FFC0
65493 ubyte&0xEF 0x21
# ROM is <=4096KB, RAM is <=64KB and country<=10
>65495 ubyte <13
>>65496 ubyte <7
>>>65497 ubyte <11
>>>>65472 use snes-rom-hdr
#------------------------------------------------------------------------------
# ancast: file(1) magic for Wii U firmware images, aka "ancast" images.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# References:
# - https://wiiubrew.org/wiki/Ancast_image
0 ubelong 0xEFA282D9 Wii U firmware image:
>0x20 ubelong 2 ARM
>>0x1A4 ubelong 0x21 \b, NAND boot
>>0x1A4 ubelong 0x22 \b, SD boot
>>0x1A8 ubelong 1 \b, for devkits
>>0x1A8 ubelong 2 \b, for retail
>0x20 ubelong 1 PowerPC
>>0xA4 ubelong 0x11 \b, Wii U mode
>>0xA4 ubelong 0x12 \b, Wii mode

1
contrib/file/magic/Magdir/ctf
View file

@ -1,5 +1,6 @@
#--------------------------------------------------------------
# $File: ctf,v 1.5 2024/06/10 23:09:52 christos Exp $
# ctf: file(1) magic for CTF (Common Trace Format) trace files
#
# Specs. available here: <https://www.efficios.com/ctf>

41
contrib/file/magic/Magdir/database
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: database,v 1.69 2023/01/12 00:14:04 christos Exp $
# $File: database,v 1.73 2024/11/09 19:54:36 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@ -740,13 +740,6 @@
>32 lelong 0x2601196D version 6, little-endian
>>36 lelong x hash size %d bytes
# SE Linux policy database
0 lelong 0xf97cff8c SE Linux policy
>16 lelong x v%d
>20 lelong 1 MLS
>24 lelong x %d symbols
>28 lelong x %d ocons
# ICE authority file data (Wolfram Kleff)
2 string ICE ICE authority data
@ -820,7 +813,9 @@
0 string ZEC3 Zope Object Database Client Cache File (data)
# IDA (Interactive Disassembler) database
0 string IDA0 IDA (Interactive Disassembler) database
0 string IDA1 IDA (Interactive Disassembler) database
0 string IDA2 IDA (Interactive Disassembler) database
# Hopper (reverse engineering tool) https://www.hopperapp.com/
0 string hopperdb Hopper database
@ -871,8 +866,31 @@
# Used by older versions of Mozilla Suite and Firefox,
# and current versions of Thunderbird.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Mork
# https://en.wikipedia.org/wiki/Mork_(file_format)
# Note: called "Mork" by DROID via fmt/612
0 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database
# display Mozilla Mork database (strength=260=260+0) before "exported SGML document" (strength=28=38-10) via ./sgml
#!:strength +0
#!:mime text/plain
!:mime text/x-mozilla-mork
# version like 1.4
>23 string x \b, version %.3s
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/msf.trid.xml
# Note: called "Mozilla Mail Summary file" by TrID
>26 search/7516 mailboxName \b, Mail Summary file
# like: Archives.msf Drafts.msf INBOX.msf Junk.msf Sent.msf Templates.msf Trash.msf
!:ext msf
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mab.trid.xml
# Note: called "Mozilla Address Book" by TrID
>26 search/192 addrbk \b, Address Book
!:ext mab
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-mork.trid.xml
# Note: called "Mozilla Mail folder cache" by TrID
>26 search/210 indexingPriority \b, Mail folder cache
# panacea.dat
!:ext dat
# URL: https://en.wikipedia.org/wiki/Management_Information_Format
# Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
@ -884,3 +902,10 @@
!:mime text/x-dmtf-mif
!:ext mif
# https://github.com/boltdb/bolt
# https://github.com/etcd-io/bbolt
# See magic value here: https://github.com/boltdb/bolt/blob/fd01fc79c553a8e99d512a07e8e0c63d4a3ccfc5/db.go#L24
# The magic value is written according to endianess of the host,
# so we check both to detect them also on hosts with differnet endianess
16 lelong 0xED0CDAED BoltDB database
16 belong 0xED0CDAED BoltDB database, big-endian

13
contrib/file/magic/Magdir/dataone
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: dataone,v 1.3 2022/04/18 21:38:10 christos Exp $
# $File: dataone,v 1.4 2024/08/27 19:17:10 christos Exp $
#
# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
# Pratik Shrivastava <pratikshrivastava23@gmail.com>
@ -11,6 +11,11 @@
# EML (Ecological Metadata Language Format)
0 string \<?xml\ version=
>&0 regex/1024 eml-[0-9]\\.[0-9]\\.[0-9]+ eml://ecoinformatics.org/%s
# Object Reuse and Exchange Vocabulary
>&0 search/1024 rdf
>>&0 search/1024 openarchives https://www.openarchives.org/ore/terms
!:mime application/rdf+xml
# onedcx (DataONE Dublin Core Extended v1.0)
>&0 regex/1024 onedcx/v[0-9]\\.[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0
@ -34,12 +39,6 @@
!:mime text/xml
# Object Reuse and Exchange Vocabulary
0 string \<?xml\ version=
>&0 search/1024 rdf
>>&0 search/1024 openarchives https://www.openarchives.org/ore/terms
!:mime application/rdf+xml
# Dryad Metadata Application Profile Version 3.1
0 string <DryadData

125
contrib/file/magic/Magdir/diff
View file

@ -1,33 +1,142 @@
#------------------------------------------------------------------------------
# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $
# $File: diff,v 1.21 2024/07/13 14:47:09 christos Exp $
# diff: file(1) magic for diff(1) output
#
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Diff
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/diff.trid.xml
# Note: called "diff output text" by TrID and
# "Differences between files" by shared MIME-info database from freedesktop.org
# According to shared MIME-info database also tabulator character instead of space character and
# by TrID minus character after space character
0 search/1 diff\040 diff output text
# diff output text (strength=40=40+0) after unified diff output (strength=131=38+93)
#!:strength +0
!:mime text/x-diff
#!:mime text/x-patch
!:ext diff/patch
# no short named pch dif examples found
#!:ext diff/patch/dif/pch
# URL: https://en.wikipedia.org/wiki/Diff_utility#Context_format
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/diff-context.trid.xml
# Note: called "context diff output" by TrID
# and "Differences between files" by shared MIME-info database from freedesktop.org
0 search/1 ***\040
# context diff output text (strength=42=38+4) before
# C source (strength=41,39,37) exported SGML document (strength=39,28)
!:strength +4
>&0 search/1024 \n---\040 context diff output text
!:mime text/x-diff
#!:mime text/x-patch
!:ext diff/patch
# no short named pch dif examples found
#!:ext diff/patch/dif/pch
0 search/1 Only\040in\040 diff output text
# diff output text output text (strength=38=38+0) after unified diff output (strength=131=38+93)
#!:strength +0
!:mime text/x-diff
#!:mime text/x-patch
!:ext diff
0 search/1 Common\040subdirectories:\040 diff output text
!:mime text/x-diff
# URL: https://en.wikipedia.org/wiki/Diff#Extensions
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/diff-rcs.trid.xml
# Note: called "RCS/CVS diff output" by TrID
# and "Differences between files" by shared MIME-info database from freedesktop.org
0 search/1 Index: RCS/CVS diff output text
# RCS/CVS diff output text (strength=36=36+0) after unified diff output (strength=131=38+93)
#!:strength +0
!:mime text/x-diff
#!:mime text/x-patch
!:ext diff/patch
# bsdiff: file(1) magic for bsdiff(1) output
0 string/b BSDIFF40 bsdiff(1) patch file
# Update: Joerg Jenderek
# URL: http://www.daemonology.net/bsdiff/
# Reference: https://github.com/cperciva/bsdiff/blob/master/bsdiff-ra/FORMAT
# http://mark0.net/download/triddefs_xml.7z/defs/b/bsdiff.trid.xml
# Note: called "bsdiff patch" by TrID and and "BSDIFF" version 4.0 by DROID via PUID fmt/439 and
# "Binary differences between files" by shared MIME-info database from freedesktop.org
0 string/b BSDIFF40
# skip DROID fmt-439-signature-id-672.bsdiff with invalid new file segment length 0
>16 long !0 bsdiff(1) patch file
#!:mime application/octet-stream
!:mime application/x-bsdiff
!:ext bsdiff
# new file length
#>>8 lequad x \b, new length %lld
# new file segment length
#>>16 lelong x \b, new segment length %d
# compressed header block length
#>>20 lelong !0 \b, compressed header length %d
# patch data block length
#>>24 lequad x \b, data length %lld
# look for bzip data by ./compress after message with 1 space at end
>>0x20 indirect x \b, at 0x20
# From: Joerg Jenderek
# URL: https://www.chromium.org/developers/design-documents/software-updates-courgette/
# Reference: https://github.com/adobe/chromium/blob/master/courgette/third_party/bsdiff.h
# http://mark0.net/download/triddefs_xml.7z/defs/b/bsdiff-chrome.trid.xml
# Note: called "Courgette Binary Diff output" by TrID
# the Courgette bsdiff tool use a total different file format compared with BSD variant from Colin Percival
0 string/b GBSDIF42 Courgette binary diff output
#!:mime application/octet-stream
!:mime application/x-patch
!:ext patch/bsdiff
# slen; length of the file to be patched
#>8 ubelong x \b, source length %u
# scrc32; CRC32 of the file to be patched
>12 ubelong x \b, crc %#8.8x
# dlen; length of the result file
#>16 ubelong x \b, result length %u
# cblen; length of the control block
#>20 ubelong x \b, control length %u
# difflen; length of the diff block
#>24 ubelong x \b, patch length %u
# extralen; length of the extra block
#>28 ubelong x \b, extra length %u
# unified diff
0 search/4096 ---\040
>&0 search/1024 \n
>>&0 search/1 +++\040
>>>&0 search/1024 \n
>>>>&0 search/1 @@ unified diff output text
# URL: http://fileformats.archiveteam.org/wiki/Unified_diff
# https://en.wikipedia.org/wiki/Diff_utility#Unified_format
# Reference: https://www.artima.com/weblogs/viewpost.jsp?thread=164293
# http://mark0.net/download/triddefs_xml.7z/defs/d/diff-unified.trid.xml
# Note: called "unified diff output" by TrID and
# "Differences between files" by shared MIME-info database from freedesktop.org
# use b flag to forces the test to be done for binary files (non ASCII text like with Ctrl-D Ctrl-V Ctrl-Z)
0 search/4096/b ---\040
!:strength + 93
>0 use diff-unified
# most samples are just pure ASCII text like: ShellR64.patch
0 search/11054 ---\040
# unified diff (strength=131=38+93) before
# HTML document text (strength=170,90,71,53,52,51,49) POSIX shell script (fix-qt5.6-build.patch strength=130 ./commands)
# JavaScript source (strength=112,84,81,80,79,78,72,69) C++ source (strength=71,70,69,68,67,54),
# Python script (strength=69,67,63,60,58,57,56,54,52,37)LaTeX document text (strength=62,56,55,51,43)
# TeX document (strength=51,38) C source (strength=41,39,37)
# exported SGML document (strength=39,28) diff output text (strength=38=38+0)
# Pascal source (strength=37) RCS/CVS diff (strength=36=36+0),
# Algol 68 source (strength=?) CSV ASCII text (strength=?)
!:strength + 93
>0 use diff-unified
# check for 3 characteristic lines of unified diff
0 name diff-unified
>0 search/11084 +++\040
>>&0 search/1024 \n
# at signs line sometimes other (with 2 space chars before) like: indent-header.patch
>>>&0 search/2 @@\040- unified diff output text
!:mime text/x-diff
!:strength + 90
#!:mime text/x-patch
# https://file-extension.net/seeker/file_extension_dif file_extension_pch file_extension_rej
!:ext diff/patch/dif/pch/rej
# GRR: mainly for debugging purpose for variants with text before real diff output
>>>>0 string !---\040
>>>>>0 string x \b, 1st line "%s"
>>>>>>&1 string x \b, 2nd line "%s"
>>>>>>>&1 string x \b, 3rd line "%s"
# librsync -- the library for network deltas
#

20
contrib/file/magic/Magdir/digital
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: digital,v 1.12 2021/07/03 14:01:46 christos Exp $
# $File: digital,v 1.17 2024/08/30 16:53:22 christos Exp $
# Digital UNIX - Info
#
0 string =!<arch>\n________64E Alpha archive
@ -10,7 +10,12 @@
0 leshort 0603
>24 leshort 0410 COFF format alpha pure
>24 leshort 0413 COFF format alpha demand paged
# TODO: use other subroutine (./coff) to display name+flags+variables for common object formatted files
#>0 use display-coff-foo
>>22 leshort&030000 !020000 executable
#!:mime application/x-foo-executable
# typically no file name suffix for executables like \DEC\HH\HYPERHLP
!:ext /
>>22 leshort&020000 !0 dynamically linked
>>16 lelong !0 not stripped
>>16 lelong 0 stripped
@ -23,6 +28,19 @@
>>26 byte x \b.%d
>>28 byte x \b-%d
# Alpha COFF object file or executable
0 leshort 0x0184
>16 leshort 0
>>0 use display-coff
# can be created by LINK.EXE /MACHINE:ALPHA /ROM
>16 leshort !0
>>18 leshort &0x0002
>>>20 leshort 0x0107
>>>>0 use display-coff
0 leshort 0x0284
>16 leshort 0
>>0 use display-coff
# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
# The actual magic number is just "Core", followed by a 2-byte version

45
contrib/file/magic/Magdir/efi
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
# $File: efi,v 1.7 2024/02/18 14:15:22 christos Exp $
# efi: file(1) magic for Universal EFI binaries
0 lelong 0x0ef1fab9
@ -13,3 +13,46 @@
>>&20 lelong 7 \b, i386
>>&20 lelong 0x01000007 \b, x86_64
>4 lelong >2 Universal EFI binary with %d architectures
# EFI Signature List
# From: Alexandre Iooss <erdnaxe@crans.org>
# URL: https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git
0 name efi_sig_list
>0 guid D719B2CB-3D3A-4596-A3BC-DAD00E67656F EFI Signature List, SIG DB
>0 guid 4AAFD29D-68DF-49EE-8AA9-347D375665A7 EFI Signature List, PKCS7
>0 guid 3C5766E8-269C-4E34-AA14-ED776E85B3B6 EFI Signature List, RSA2048
>0 guid E2B36190-879B-4A3D-AD8D-F2E7BBA32784 EFI Signature List, RSA2048 SHA256
>0 guid 67F8444F-8743-48F1-A328-1EAAB8736080 EFI Signature List, RSA2048 SHA1
>0 guid A7717414-C616-4977-9420-844712A735BF EFI Signature List, RSA2048 SHA256 type
>0 guid 826CA512-CF10-4AC9-B187-BE01496631BD EFI Signature List, SHA1
>0 guid 0B6E5233-A65C-44C9-9407-D9AB83BFC8BD EFI Signature List, SHA224
>0 guid C1C41626-504C-4092-ACA9-41F936934328 EFI Signature List, SHA256
>0 guid FF3E5307-9FD0-48C9-85F1-8AD56C701E01 EFI Signature List, SHA384
>0 guid 093E0FAE-A6C4-4F50-9F1B-D41E2B89C19A EFI Signature List, SHA512
>0 guid A5C059A1-94E4-4AA7-87B5-AB155C2BF072 EFI Signature List, X509
>0 guid 3BD2A492-96C0-4079-B420-FCF98EF103ED EFI Signature List, X509 SHA256
>0 guid 7076876E-80C2-4EE6-AAD2-28B349A6865B EFI Signature List, X509 SHA384
>0 guid 446DBF63-2502-4CDA-BCFA-2465D2B0FE9D EFI Signature List, X509 SHA512
>0 guid 605DAB50-E046-4300-ABB6-3DD810DD8B23 EFI Signature List, MOK_OWNER
>0 guid A46423E3-4617-49F1-B9FF-D1BFA9115839 EFI Signature List, SECURITY PROTOCOL
>0 guid 94AB2F58-1438-4EF1-9152-18941A3A0E68 EFI Signature List, SECURITY2 PROTOCOL
>0 guid AAF32C78-947B-439A-A180-2E144EC37792 EFI Signature List, SECURE VARIABLE
# Hypothesis: EFI Signature List are smaller than 16MiB
19 byte =0
>23 byte =0
>>27 byte =0
>>>0 use efi_sig_list
>>>>16 ulelong x \b, total size: %d bytes
# Variant: EFI Signature List as an EFI variable
# See https://docs.kernel.org/filesystems/efivarfs.html
23 byte =0
>27 byte =0
>>31 byte =0
>>>4 use efi_sig_list
>>>>0 ulelong x \b, EFI variable %d
>>>>20 ulelong x \b, total size: %d bytes
# EFI byte code COFF object file
0 leshort 0x0ebc
>16 leshort 0
>>0 use display-coff

32
contrib/file/magic/Magdir/elf
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: elf,v 1.88 2023/01/08 17:09:18 christos Exp $
# $File: elf,v 1.91 2024/11/09 23:52:23 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
@ -82,15 +82,15 @@
>18 leshort 0 no machine,
>18 leshort 1 AT&T WE32100,
>18 leshort 2 SPARC,
>18 leshort 3 Intel 80386,
>18 leshort 3 Intel i386,
>18 leshort 4 Motorola m68k,
>>4 byte 1
>>>36 lelong &0x01000000 68000,
>>>36 lelong &0x00810000 CPU32,
>>>36 lelong 0 68020,
>18 leshort 5 Motorola m88k,
>18 leshort 6 Intel 80486,
>18 leshort 7 Intel 80860,
>18 leshort 6 Intel i486,
>18 leshort 7 Intel i860,
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
@ -375,5 +375,29 @@
>7 byte 16 (FenixOS)
>7 byte 17 (Nuxi CloudABI)
>7 byte 97 (ARM)
>7 byte 102 (Cell LV2)
>7 byte 202 (Cafe OS)
>7 byte 255 (embedded)
# SELF Signed ELF used on the playstation
# https://www.psdevwiki.com/ps4/SELF_File_Format#make_fself_by_flatz
# https://www.psdevwiki.com/ps3/SELF_-_SPRX
0 lelong 0x4F153D1D
>4 lelong 0x00010112 PS4 Signed ELF file
>8 byte 1 \b, SELF/SPRX signed-elf/prx
>8 byte 2 \b, SRVK signed-revoke-list
>8 byte 3 \b, SPKG signed-package
>8 byte 4 \b, SSPP signed-security-policy-profile
>8 byte 5 \b, SDIFF signed-diff
>8 byte 6 \b, SPSFO signed-param-sfo
>9 byte&0xf0 x \b, version %#x
>9 byte&0x0f 4 \b, game
>9 byte&0x0f 5 \b, module
>9 byte&0x0f 6 \b, video app
>9 byte&0x0f 8 \b, System/EX application
>9 byte&0x0f 9 \b, System/EX module/dll
#>12 leshort x \b, header size %d
#>14 leshort x \b, signature size %d
#>16 lelong x \b, file size %d
#>18 leshort x \b, number of segments %d
#>20 leshort 22

37
contrib/file/magic/Magdir/epoc
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
# $File: epoc,v 1.10 2024/02/14 23:51:54 rrt Exp $
# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
# Useful information for improving this file can be found at:
@ -8,55 +8,82 @@
#------------------------------------------------------------------------------
0 lelong 0x10000037 Psion Series 5
>4 lelong 0x10000039 font file
!:mime application/x-epoc-font
>4 lelong 0x1000003A printer driver
!:mime application/x-epoc-pdriver
>4 lelong 0x1000003B clipboard
!:mime application/x-epoc-clipboard
>4 lelong 0x10000042 multi-bitmap image
!:mime image/x-epoc-mbm
>4 lelong 0x1000006A application information file
>4 lelong 0x1000006D
>4 lelong 0x1000006D Record file
!:mime image/x-epoc-record
>>8 lelong 0x1000007D Sketch image
!:mime image/x-epoc-sketch
>>8 lelong 0x1000007E voice note
!:mime application/x-epoc-voice
>>8 lelong 0x1000007F Word file
!:mime application/x-epoc-word
>>8 lelong 0x10000085 OPL program (TextEd)
!:mime application/x-epoc-opl
>>8 lelong 0x10000086 Data file
!:mime application/x-epoc-data
>>8 lelong 0x10000087 Comms settings
>>8 lelong 0x10000088 Sheet file
!:mime application/x-epoc-sheet
>>8 lelong 0x100001C4 EasyFax initialisation file
!:mime application/x-epoc-eini
>4 lelong 0x10000073 OPO module
!:mime application/x-epoc-opo
>4 lelong 0x10000074 OPL application
!:mime application/x-epoc-app
>4 lelong 0x1000008A exported multi-bitmap image
!:mime image/x-epoc-xmbm
>4 lelong 0x1000016D
>>8 lelong 0x10000087 Comms names
0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
!:mime image/x-epoc-mbm
0 lelong 0x10000050 Psion Series 5
>4 lelong 0x1000006D database
>>8 lelong 0x10000084 Agenda file
!:mime application/x-epoc-agenda
>>8 lelong 0x10000086 Data file
!:mime application/x-epoc-data
>>8 lelong 0x10000086 Address book
!:mime application/x-epoc-addressbook
>>8 lelong 0x10000CEA Jotter file
!:mime application/x-epoc-jotter
>4 lelong 0x100000E4 ini file
!:mime application/x-epoc-ini
>4 lelong 0x10000075 Backlite file
!:mime application/x-epoc-backlite
0 lelong 0x10000079 Psion Series 5 binary:
>4 lelong 0x00000000 DLL
!:mime application/x-epoc-dll
>4 lelong 0x10000049 comms hardware library
!:mime application/x-epoc-chlib
>4 lelong 0x1000004A comms protocol library
!:mime application/x-epoc-cplib
>4 lelong 0x1000005D OPX
!:mime application/x-epoc-opx
>4 lelong 0x1000006C application
!:mime application/x-epoc-app
>4 lelong 0x1000008D DLL
!:mime application/x-epoc-dll
>4 lelong 0x100000AC logical device driver
!:mime application/x-epoc-ldd
>4 lelong 0x100000AD physical device driver
!:mime application/x-epoc-pdd
>4 lelong 0x100000E5 file transfer protocol
>4 lelong 0x100000E5 file transfer protocol
!:mime application/x-epoc-ftp
>4 lelong 0x10000140 printer definition
!:mime application/x-epoc-ppd
>4 lelong 0x10000141 printer definition
!:mime application/x-epoc-ppd
0 lelong 0x1000007A Psion Series 5 executable
4 lelong 0x1000006d
>8 lelong 0x10000419 Psion Series 5 Application Installer
!:mime application/x-epoc-sis

4
contrib/file/magic/Magdir/espressif
View file

@ -1,5 +1,7 @@
# $File: espressif,v 1.3 2021/04/26 15:56:00 christos Exp $
#------------------------------------------------------------------------------
# $File: espressif,v 1.4 2024/06/10 23:09:52 christos Exp $
# espressif: file(1) magic for ESP8266 based devices
# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
# URL: https://github.com/arendst/Sonoff-Tasmota/
# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/

179
contrib/file/magic/Magdir/filesystems
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: filesystems,v 1.158 2023/05/21 17:19:08 christos Exp $
# $File: filesystems,v 1.165 2024/09/01 15:51:51 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
@ -1282,7 +1282,7 @@
#>>>(0x1BC.s+11) ubyte x \b,cfg_def %#x
# for older versions
>>>(0x1BC.s+9) ubyte <2
#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+13) ubyte <2 \b,floppy %#x
@ -1401,14 +1401,14 @@
>>>>>16 ubyte =1 \b, FAT %u
>>>>>16 ubyte >0
>>>>>17 uleshort >0 \b, root entries %u
#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
>>>>>21 ubyte >0xF0 \b, Media descriptor %#x
#>>>>>21 ubyte =0xF0 \b, Media descriptor %#x (usual floppy)
>>>>>21 ubyte <0xF0 \b, Media descriptor %#x
>>>>>22 uleshort >0 \b, sectors/FAT %u
#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32)
#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
>>>>>24 uleshort x \b, sectors/track %u
>>>>>26 ubyte >2 \b, heads %u
#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
@ -1479,7 +1479,7 @@
>>>>>>36 ulelong x \b, sectors/FAT %u
# https://technet.microsoft.com/en-us/library/cc977221.aspx
>>>>>>40 uleshort >0 \b, extension flags %#x
#>>>>>>40 uleshort =0 \b, extension flags %hu
#>>>>>>40 uleshort =0 \b, extension flags %u
>>>>>>42 uleshort >0 \b, fsVersion %u
#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
>>>>>>44 ulelong >2 \b, rootdir cluster %u
@ -1938,26 +1938,29 @@
# defect IO.SYS+MSDOS.SYS ?
#>>>>>0x162 use 2xDOS-filename
0 name cdrom
>38913 string !NSR0 ISO 9660 CD-ROM filesystem data
0 name cdrom ISO 9660 CD-ROM filesystem data
!:mime application/x-iso9660-image
!:ext iso/iso9660
>38913 string NSR0 UDF filesystem data
!:mime application/x-iso9660-image
!:ext iso/udf
>>38917 string 1 (version 1.0)
>>38917 string 2 (version 1.5)
>>38917 string 3 (version 2.0)
>>38917 byte >0x33 (unknown version, ID %#X)
>>38917 byte <0x31 (unknown version, ID %#X)
# The next line is not necessary because the MBR staff is done looking for boot signature
>0x1FE leshort 0xAA55 (DOS/MBR boot sector)
# "application id" which appears to be used as a volume label
>32808 string/T >\0 '%.32s'
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
# check for extended area (combined ISO + UDF)
>36865 string BEA01 +
>>36864 use extendedarea
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
!:mime application/x-iso9660-image
# URL: http://fileformats.archiveteam.org/wiki/High_Sierra
# Update: Joerg Jenderek
32777 string CDROM High Sierra CD-ROM filesystem data
# https://www.unix.com/man-page/OpenSolaris/7fs/hsfs/
#!:mime application/octet-stream
#!:mime application/x-hsfs-image
# BOOKSHELF.ISO "Shareware Grab Bag.iso"
!:ext iso
# "application id" which appears to be used as a volume label
>32816 string/T >\0 '%.32s'
@ -1973,6 +1976,55 @@
!:strength +35
>0 use cdrom
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Universal_Disk_Format
# https://en.wikipedia.org/wiki/Universal_Disk_Format
# Reference: https://wiki.osdev.org/UDF
# Note: called "UDF Disc Image" by DROID via PUID fmt/1738
# verified by udftools `udfinfo nero-UDFv26.iso` and 7-Zip `7z l -tUdf nero-UDF1.iso`
#
# look for type descriptor at relative offset 1 of block 16 if it is an extended descriptor section
32769 string BEA01
>32768 use extendedarea
0 name extendedarea
# look for type descriptor at relative offset 1 of block 17 with size 2048 (valid for images with blocksize of 512, 1024 or 2048 bytes)
>2049 string NSR0
>>2048 use NSR0
>2049 default x
# look for type descriptor at relative offset 1 of block 17 with size 4096 (valid for images with blocksize of 4096 bytes)
>>4097 string NSR0
>>>4096 use NSR0
>>4097 default x
# look for type descriptor at relative offset 1 of block 17 with size 8192 (valid for images with blocksize of 8192 bytes)
>>>8193 string NSR0
>>>>8192 use NSR0
>>>8193 default x
# look for type descriptor at relative offset 1 of block 17 with size 16384 (valid for images with blocksize of 16384 bytes)
>>>>16385 string NSR0
>>>>>16384 use NSR0
>>>>16385 default x
# look for type descriptor at relative offset 1 of block 17 with size 32768 (valid for images with blocksize of 32768 bytes)
>>>>>32769 string NSR0
>>>>>>32768 use NSR0
>>>>>32769 default x
0 name NSR0
# NSR02 indicates ISO/IEC 13346 first edition, or ECMA-167 second edition
# OSTA UDF 1.x revisions are based on ISO/IEC 13346 first edition
# FIXME: This detection is incorrect as it does not detect UDF 1.x, but ECMA-167 2nd
>5 ubyte 0x32 UDF filesystem data (version 1.x)
#!:mime application/octet-stream
!:mime application/x-udf-image
!:ext iso/udf
# NSR03 indicates ISO/IEC 13346 second edition, or ECMA-167 third edition
# OSTA UDF 2.x revisions are based on ECMA-167 third edition
# FIXME: This detection is incorrect as it does not detect UDF 2.x, but ECMA-167 3rd
>5 ubyte 0x33 UDF filesystem data (version 2.x)
#!:mime application/octet-stream
!:mime application/x-udf-image
!:ext iso/udf
# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
# 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
@ -1983,24 +2035,6 @@
!:ext nrg
>307200 use cdrom
# .cso files
# Reference: https://pismotec.com/ciso/ciso.h
# NOTE: There are two other formats with the same magic but
# completely incompatible specifications:
# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
0 string CISO
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - 0x10 == 0x00004000: For >2GB files using maxcso...
# https://github.com/unknownbrackets/maxcso/issues/26
# - None of the above: Compact ISO.
>4 lelong !0
>>4 lelong !0x200000
>>>16 lelong !0x800
>>>>16 lelong !0x4000 Compressed ISO CD image
# cramfs filesystem - russell@coker.com.au
0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
>4 lelong x size %u
@ -2199,20 +2233,6 @@
>560 string x label: %.64s,
>136 string x mountpoint: %.128s
# Summary: Oracle ASM tagged volume
# Created by: Aaron Botsis <redhat@digitalmafia.org>
32 string ORCLDISK Oracle ASM Volume,
>40 string x Disk Name: %0.12s
32 string ORCLCLRD Oracle ASM Volume (cleared),
>40 string x Disk Name: %0.12s
# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
8 string OracleCFS Oracle Clustered Filesystem,
>4 long x rev %d
>0 long x \b.%d,
>560 string x label: %.64s,
>136 string x mountpoint: %.128s
# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
32 string ORCLDISK Oracle ASM Volume,
>40 string x Disk Name: %0.12s
@ -2278,12 +2298,6 @@
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
0 string *dvdisaster* dvdisaster error correction file
# xfs metadump image
# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
# but can we do the << ? For now it's always 512 (0x200) anyway.
0 string XFSM
>0x200 string XFSB XFS filesystem metadump image
# Type: CROM filesystem
# From: Werner Fink <werner@suse.de>
0 string CROMFS CROMFS
@ -2692,3 +2706,60 @@
>>0 ubelong >5
>>0 default x YAFFS filesystem root entry (big endian)
>>>0 use \^yaffs
# littlefs superblock
# From: Alexandre Iooss <erdnaxe@crans.org>
# URL: https://github.com/littlefs-project/littlefs/blob/v2.9.0/SPEC.md
# Match first commit tag, then "littlefs" magic
4 ulelong 0xf7ff0ff0
>8 string littlefs littlefs superblock
>>22 uleshort x \b, version %u
>>20 uleshort x \b.%u
>>24 ulelong x \b, block size: %u bytes
>>28 ulelong x \b, %u blocks
# EldOS Corporation SolidFS (aka SolFS)
# 256 bytes page size
0x0 string \x08\x00\x4e\x57\x20
>0x100 string \x4e\x57\x00\x00\x01
>0x1A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 256 bytes page size
# 512 bytes page size
0x0 string \x09\x00\x4e\x57\x20
>0x200 string \x4e\x57\x00\x00\x01
>0x2A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 512 bytes page size
# 1 kibibyte page size
0x0 string \x0A\x00\x4e\x57\x20
>0x400 string \x4e\x57\x00\x00\x01
>0x4A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 1KiB page size
# 2 kibibyte page size
0x0 string \x0B\x00\x4e\x57\x20
>0x800 string \x4e\x57\x00\x00\x01
>0x8A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 2KiB page size
# 4 kibibyte page size
0x0 string \x0C\x00\x4e\x57\x20
>0x1000 string \x4e\x57\x00\x00\x01
>0x10A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 4KiB page size
# 8 kibibyte page size
0x0 string \x0D\x00\x4e\x57\x20
>0x2000 string \x4e\x57\x00\x00\x01
>0x20A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 8KiB page size
# 16 kibibyte page size
0x0 string \x0E\x00\x4e\x57\x20
>0x4000 string \x4e\x57\x00\x00\x01
>0x40A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 16KiB page size
# 32 kibibyte page size
0x0 string \x0F\x00\x4e\x57\x20
>0x8000 string \x4e\x57\x00\x00\x01
>0x80A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 32KiB page size
# 64 kibibyte page size
0x0 string \x10\x00\x4e\x57\x20
>0x10000 string \x4e\x57\x00\x00\x01
>0x100A2 string \x4C\x00\x40 EldOS Corporation SolidFS, 64KiB page size

146
contrib/file/magic/Magdir/firmware
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: firmware,v 1.7 2023/03/11 18:52:03 christos Exp $
# $File: firmware,v 1.13 2024/09/04 19:04:03 christos Exp $
# firmware: file(1) magic for firmware files
#
@ -111,11 +111,20 @@
# ESP-IDF application image
# From: Alexandre Iooss <erdnaxe@crans.org>
# Update: Joerg Jenderek
# URL: https://github.com/espressif/esp-idf/blob/v5.0/components/bootloader_support/include/esp_app_format.h
# Reference: https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-reference/system/app_image_format.html
# Note: Concatenation of esp_image_header_t, esp_image_segment_header_t and esp_app_desc_t
# First segment contains esp_app_desc_t
# ESP_IMAGE_HEADER_MAGIC at the beginning of esp_image_header_t structure
0 ubyte 0xE9
# display ESP-IDF application image (strength=40=40+0) before DOS executable with 16bit JuMP (strength=40) handled by ./msdos
#!:strength +0
# ESP_APP_DESC_MAGIC_WORD; magic for the esp_app_desc_t structure
>32 ulelong 0xABCD5432 ESP-IDF application image
#!:mime application/octet-stream
!:mime application/x-espressif-bin
!:ext bin
>>12 uleshort 0x0000 for ESP32
>>12 uleshort 0x0002 for ESP32-S2
>>12 uleshort 0x0005 for ESP32-C3
@ -131,3 +140,138 @@
>>>112 string/16 x %s
>>144 string/32 x \b, IDF version: %s
>>4 ulelong x \b, entry address: 0x%08X
# AVR firmware
# From: Alexandre Iooss <erdnaxe@crans.org>
# URL: https://microchipdeveloper.com/8avr:int
# Match 4-byte JMP for Reset, Int0-2, PcInt0-3 and WDT
0 uleshort&0xFE0E 0x940C
>4 uleshort&0xFE0E 0x940C
>>8 uleshort&0XFE0E 0x940C
>>>12 uleshort&0XFE0E 0x940C
>>>>16 uleshort&0XFE0E 0x940C
>>>>>20 uleshort&0XFE0E 0x940C
>>>>>>24 uleshort&0XFE0E 0x940C
>>>>>>>28 uleshort&0XFE0E 0x940C
>>>>>>>>32 uleshort&0XFE0E 0x940C AVR firmware
# Handle only 16-bit addressing
>>>>>>>>>0 uleshort 0x940C
>>>>>>>>>>2 uleshort x \b, reset at 0x%04x
# Match 2-byte RJMP for Reset, Int0-2, PcInt0-3 and WDT for smaller AVR
1 byte&0xF0 0xC0
>3 byte&0xF0 0xC0
>>5 byte&0xF0 0xC0
>>>7 byte&0xF0 0xC0
>>>>9 byte&0xF0 0xC0
>>>>>11 byte&0xF0 0xC0
>>>>>>13 byte&0xF0 0xC0
>>>>>>>15 byte&0xF0 0xC0
>>>>>>>>17 byte&0xF0 0xC0 AVR firmware
>>>>>>>>>0 uleshort&0x0FFF x \b, reset at 0x%04x
# Summary: Intel HEXadecimal file format
# URL: https://en.wikipedia.org/wiki/Intel_HEX
# Reference: http://www.piclist.com/techref/fileext/hex/intel.htm
# http://mark0.net/download/triddefs_xml.7z/defs/h/hex-intel.trid.xml
# From: Joerg Jenderek
# Note: called "Intel Hexadecimal object format" by TrID, "Intel® hexadecimal object file" on Linux
# and "Intel HEX binary data" by Notepad++
# look for start code; 1 character, an ASCII colon ':'; all characters preceding this symbol should be ignored
0 ubyte 0x3A
# check for valid record type string with range 00 - 05 (3030h - 3035h)
>&6 ubeshort&0xFFf8 =0x3030
# check for valid record length string like: 02 04 08 10h 20h 03 (usbdload.hex usbdldv2.hex from Windows Vista)
#>>1 string x LENGTH_STRING=%0.2s
#>>1 ubeshort x LENGTH=%#4.4x
>>&-8 ubeshort&0xFCf0 =0x3030
>>>0 use intel-hex
# display information (offset, record length and type) of Intel HEX
0 name intel-hex
# RECORD MARK
>0 ubyte x Intel hexadecimal object
#!:mime text/plain
!:mime text/x-hex
!:ext hex
# no samples with other suffix found
# .hex .mcs .int .ihex .ihe .ihx .h80 .h86 .a43 .a90 .obj .obl .obh .rom .eep
# .hxl-.hxh .h00-.h15 .p00-.pff
# RECLEN; 2 hex digits for number of bytes in 1st data field; like 0x02 0x03 0x04 0x08 0x10 0x20; maximum 255
>1 string x \b, 0x%2.2s record length
# OFFSET; 4 hex digits for 1st 16-bit memory offset of data like: 0000 (often) 1C00h 1E00h 3800h 3E00h 76EDh 7800h 7E00h ...
>3 string x \b, 0x%4.4s offset
# RECTYP; 2 hex digits (00 - 05); meaning of 1st data field; 00~DataRecord (often) 0l~EndOfFileRecord 02~ExtendedSegmentAddressRecord 03~StartSegmentAddressRecord 04~ExtendedLinearAddressRecord 05~StartLinearAddressRecord
>7 string x \b, '%2.2s' type
# DATA; n bytes of 1st data represented by 2n hex digits followed by 1 byte checksum
>9 string x \b, data+checksum %s
# last record :00000001FF with RECLEN 0, OFFSET 0, record type 01 for EndOfFile and 1 checksum byte FF
# samples with CarriageReturnLineFeed terminator
>-2 ubeshort =0x0d0a
# This should not happen!
>>-13 string !:00000001FF \b, last line %s
>-2 ubeshort !0x0d0a
# samples with LineFeed terminator
>>-1 ubyte =0x0a
# This should not happen!
>>>-12 string !:00000001FF \b, last line %s
# Raspberry Pi RP2040 firmware
# From: Alexandre Iooss <erdnaxe@crans.org>
# Note: RP2040 flash image starts with stage2 bootloader, then a vector table.
# URL: https://github.com/raspberrypi/pico-sdk/tree/1.5.1/src/rp2_common/boot_stage2
# boot2_*.S code (_stage2_boot)
0 ulelong 0x4B32B500
>4 ulelong 0x60582021
>>8 ulelong 0x21026898
# exit_from_boot2.S code (check_return) `pop {r0}; cmp r0, #0`
>>>148 ulelong 0x2800bc01
# Cortex-M vector table with reserved section filled with a default interrupt address
>>>>259 byte 0x20
# make sure required vector table entries are ARM Thumb and in flash
>>>>>260 ulelong&0xE0000001 1
>>>>>>264 ulelong&0xE0000001 1
>>>>>>>268 ulelong&0xE0000001 1
>>>>>>>>300 ulelong&0xE0000001 1
>>>>>>>>>312 ulelong&0xE0000001 1 Raspberry Pi RP2040 firmware
>>>>>>>>>>256 ulelong >0 \b, initial SP at 0x%08x
>>>>>>>>>>260 ulelong^1 x \b, reset at 0x%08x
>>>>>>>>>>264 ulelong^1 x \b, NMI at 0x%08x
>>>>>>>>>>268 ulelong^1 x \b, HardFault at 0x%08x
>>>>>>>>>>300 ulelong^1 x \b, SVCall at 0x%08x
>>>>>>>>>>312 ulelong^1 x \b, PendSV at 0x%08x
# optional binary_info in the first 256 bytes, used by picotool
# https://github.com/raspberrypi/pico-sdk/blob/master/src/common/pico_binary_info/include/pico/binary_info/defs.h
>>>>>>>>>>256 search/256 \xf2\xeb\x88\x71 \b, with binary_info
# Silicon Labs Gecko Bootloader update image
# From: Alexandre Iooss <erdnaxe@crans.org>
# Reference: https://github.com/raboof/gbl
# https://github.com/dsyx/emberznet-doc
# Note: TLV always starting with tag 0x03A617EB of length 8
0 ulelong 0x03A617EB
>4 ulelong 8 Silicon Labs Gecko bootloader update image
!:ext gbl
>>12 byte 1 \b, encrypted (AES-CTR-128)
>>13 byte 1 \b, signed (ECDSA-P256)
# If not encrypted, indicate first image type
>>16 ulelong 0xF40A0AF4 \b, application image
>>16 ulelong 0xF50909F5 \b, bootloader image
# Silicon Labs Gecko Bootloader OTA update with Zigbee EmberZNet SDK
# URL: https://github.com/SiliconLabs/gecko_sdk
0 ulelong 0x0BEEF11E
>6 ulelong 0x38 Silicon Labs Gecko EmberZNet OTA image
!:ext ota/zigbee
>>4 ubeshort x v%d
# Device Firmware Upgrade with ST STMicroelectronics extensions
# From: Alexandre Iooss <erdnaxe@crans.org>
# Reference: STMicroelectronics note UM0391
# Reference: https://dfu-util.sourceforge.net/dfuse.html
# DFU prefix
0 string DfuSe\x01 DFU image (STM variant)
!:ext dfu
>6 ulelong x \b, size: %d bytes
# DFU suffix, specification 0x011A
>-10 string \x1A\x01UFD
>>-12 uleshort x \b, for device %04X:
>>-14 uleshort x \b%04X

36
contrib/file/magic/Magdir/fonts
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: fonts,v 1.51 2022/08/16 11:16:39 christos Exp $
# $File: fonts,v 1.52 2024/11/09 23:52:53 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
@ -447,3 +447,37 @@
#>20 belong x \b, totalCompressedSize %d
>24 beshort x \b, version %d
>26 beshort x \b.%d
### fontconfig cache files
# fontconfig cache files: little-endian
0 name fc-cache-le
# size is at offset 8, and is intptr_t
# hence, if offset 12 is zero, this is likely 64-bit
# NOTE: cannot determine double alignment here
>12 ulelong 0 le64
>12 ulelong !0 le32
# version number
>4 lelong x \b-%d
# fontconfig cache files: big-endian
0 name fc-cache-be
# size is at offset 8, and is intptr_t
# hence, if offset 12 is zero, this is likely 64-bit
# NOTE: cannot determine double alignment here
>12 ubelong 0 be64
>12 ubelong !0 be32
# version number
>4 belong x \b-%d
# fontconfig cache files
# https://gitlab.freedesktop.org/fontconfig/fontconfig
# https://www.microsoft.com/typography/otspec/otff.htm
0 ulelong 0xFC02FC04 fontconfig cache file:
>0 use fc-cache-le
0 ulelong 0xFC02FC05 fontconfig cache file (mmap):
>0 use fc-cache-le
0 ubelong 0xFC02FC04 fontconfig cache file:
>0 use fc-cache-be
0 ubelong 0xFC02FC05 fontconfig cache file (mmap):
>0 use fc-cache-be

120
contrib/file/magic/Magdir/frame
View file

@ -1,23 +1,53 @@
#------------------------------------------------------------------------------
# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $
# $File: frame,v 1.19 2024/03/04 00:34:31 christos Exp $
# frame: file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
# Note that this is the Framemaker Maker Interchange Format, not the
# Normal format which would be application/vnd.framemaker.
# URL: https://en.wikipedia.org/wiki/Adobe_FrameMaker
#
0 string \<MakerFile FrameMaker document
!:mime application/x-mif
>11 string 5.5 (5.5
>11 string 5.0 (5.0
>11 string 4.0 (4.0
>11 string 3.0 (3.0
>11 string 2.0 (2.0
>11 string 1.0 (1.0
>14 byte x %c)
# Update: Joerg Jenderek 2024 Mar
# URL: http://fileformats.archiveteam.org/wiki/FrameMaker
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fm.trid.xml
# Note: called "FrameMaker document" by TrID and "Adobe FrameMaker document" by shared MIME-info database
# skip "text" DROID samples like: fmt-190-signature-id-840.fm fmt-533-signature-id-837.fm fmt-534-signature-id-838.fm fmt-535-signature-id-839.fm fmt-536-signature-id-841.fm
# fmt-537-signature-id-842.fm fmt-538-signature-id-843.fm fmt-539-signature-id-844.fm x-fmt-302-signature-id-395.fm
0 string/b \<MakerFile FrameMaker document
#!:mime application/octet-stream
# https://www.iana.org/assignments/media-types/application/vnd.framemaker
!:mime application/vnd.framemaker
# version string like 1.0 2.0 3.0 4.0 5.0 5.5 6.0 7.0 8.0 9.0 10.0
>11 string x (%0.3s
# before closing directive ">" is appended version letter like: F H J K Q Y
>>14 ubyte >0x40 %c
# or last digit of 4 character version string
>>14 ubyte <0x41 \b%c
# test again so that next default clause works
>14 ubyte x
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hlp-fm.trid.xml
# Note: called "FrameMaker Help" by TrID
# look for reference to FrameMaker help name suffix like in: index1.hlp
>>18 search/9688/s .hlp: \b) help
# the internal FrameMaker help are just FrameMaker document with hlp suffix; XREF.HLP is same as Xref-hlp.fm
!:ext hlp
# For control reason show link name like:
# "Overview" "lastpage "firstpage "Add File" "Conditional Text" "Table Format" "Creating a reference frame" "firstpageCov" "Spot Colors" "Selecting text" "proceduresbl" "lastpageu" "Introducing HelpHe" "Menu of Syntax Descriptions" "Main FrameMaker window"
#>>>&5 string x LINK_NAME "%s"
>>>&5 string x
# look for gotolink or openlink keyword before help file name
>>>&-18 search/18/s link\040
# link construct with help name like: "gotolink xref.hlp:Overview" "openlink syntax1.hlp:firstpage"
>>>>&-4 regex/s =^\[A-Za-z0-9.:\040]{1,} with "%s"
# if not FrameMaker Help assume it is "normal" FrameMaker document
# shown with closing parenthesis to get look like in frame,v 1.18
>>18 default x \b)
# sometimes without suffix like: CHAPTER HARVARD LETTER MEMO1 NEWSLTR REPORT3
# no samples found with .bk or .book extension
# allchaps.ix (Framemaker Index) and others like:
# title.fm4 wp.filt textre1.htr pmscript.ind change.nbh books.prd executiv.sum Hyper.Template
!:ext /fm/doc/toc/ix
# URL: http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format
# Reference: https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf
# Update: Joerg Jenderek 2019 Nov
@ -36,22 +66,70 @@
# comment starting with # shows the name+version number of generating program
>13 search/3 #
>>&0 string x "%s"
# Update: Joerg Jenderek
# Note: called "Adobe FrameMaker document" by shared MIME-info database from freedesktop.org
0 search/1 \<MakerDictionary FrameMaker Dictionary text
!:mime application/x-mif
#!:mime text/plain
#!:mime application/x-mif
!:mime application/vnd.framemaker
# like site.dict but often extension is a 3 letters country code like in: hyphens.brt hyphens.eng
!:ext dict/eng/brt
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fm-hyph-dict-30.trid.xml
# Note: called "FrameMaker hyphens dictionary (v3.0)" by TrID
>17 string 3.0 (3.0)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fm-hyph-dict-20.trid.xml
# Note: called "FrameMaker hyphens dictionary (v2.0)" by TrID
>17 string 2.0 (2.0)
>17 string 1.0 (1.x)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bfont.trid.xml
# Update: Joerg Jenderek 2023
# Note: called "XFrameMaker Bitmapped screen Font" by TrID and
# "Adobe FrameMaker font" by shared MIME-info database from freedesktop.org
0 string \<MakerScreenFont FrameMaker Font file
!:mime application/x-mif
#!:mime application/octet-stream
#!:mime application/x-mif
!:mime application/x-font-framemaker
!:ext bfont
# Note: maybe also other version like: 1.x
>17 string !1.01
>>17 string x (%-0.4s)
>17 string 1.01 (%s)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mml-fm.trid.xml
# Update: Joerg Jenderek 2023 Nov
# Note: called "FrameMaker Maker Markup Language" by TrID and
# "Adobe FrameMaker document" by shared MIME-info database from freedesktop.org
0 string \<MML FrameMaker MML file
!:mime application/x-mif
0 string \<BookFile FrameMaker Book file
!:mime application/x-mif
>10 string 3.0 (3.0
>10 string 2.0 (2.0
>10 string 1.0 (1.0
>13 byte x %c)
#!:mime text/plain
#!:mime application/x-mif
!:mime application/vnd.framemaker
!:ext mml
# Note: sometimes followed by space and version like 1.00 (formats.mml sample.mml) and more text
>5 string >0 (%-0.4s)
# URL: http://fileformats.archiveteam.org/wiki/FrameMaker
# Reference: http://mark0.net/download/triddefs_xml.7z
# defs/b/book-fm.trid.xml
# defs/b/bk-fm.trid.xml
# Update: Joerg Jenderek 2023 Dez
# Note: called "FrameMaker book (binary)" by TrID and
# "Adobe FrameMaker document" by shared MIME-info database from freedesktop.org
# look for BookFile, Bookfile (capitalized) or BOOKFILE (upcased) directive
0 string/c \<Bookfile FrameMaker Book file
#!:mime application/octet-stream
#!:mime application/x-mif
!:mime application/vnd.framemaker
# http://extension.nirsoft.net/book
!:ext bk/book
# version like: 1.0 2.0 3.0 4.0 5.0 5.5 6.0 7.0 8.0 10.0
# 3 characters of version number string
>10 string x (%-0.3s
# if greater sign then exact 3 byte version string
>13 ubyte =0x3e \b)
# if digit then 4 byte version string
>13 ubyte <0x3A \b%c)
# if letter then this is appended sub level after 3 byte version string
>13 ubyte >0x3A %c)
# first directive typically is followed by one space character
>9 ubyte !0x20 \b, no space before version
# XXX - this book entry should be verified, if you find one, uncomment this
#0 string \<Book\040 FrameMaker Book (ASCII) file
#!:mime application/x-mif

78
contrib/file/magic/Magdir/games
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: games,v 1.31 2023/03/29 22:57:27 christos Exp $
# $File: games,v 1.35 2024/11/09 23:04:46 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
@ -32,53 +32,6 @@
>0 string x , name=%s
>44 string x , world=%s
# Quake
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/PAK
# reference: https://quakewiki.org/wiki/.pak
# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
# and Git pack ./revision
0 string PACK
# real Quake examples like pak0.pak have only some hundreds like 150 files
# So test for few files
>8 ulelong <0x01000000
# in file version 5.32 test for null terminator is only true for
# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h
# look for null terminator of 1st entry name
>>(4.l+55) ubyte 0 Quake I or II world or extension
!:mime application/x-dzip
!:ext pak
#>>>8 ulelong x \b, table size %u
# dividing this by entry size (64) gives number of files
>>>8 ulelong/64 x \b, %u files
# offset to the beginning of the file table
>>>4 ulelong x \b, offset %#x
# 1st file entry
>>>(4.l) use pak-entry
# 2nd file entry
#>>>4 ulelong+64 x \b, offset %#x
#>>>(4.l+64) use pak-entry
#
# display file table entry of Quake PAK archive
0 name pak-entry
# normally entry start after header which implies offset 12 or higher
>56 ulelong >11
# the offset from the beginning of pak to beginning of this entry file contents
>>56 ulelong x at %#x
# the size of file for this entry
>>60 ulelong x %u bytes
# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
>>0 string x '%-.56s'
# inspect entry content by jumping to entry offset
>>(56) indirect x \b:
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
#>61 string x level %s
#0 string 5\x0a Quake I save
# The levels
# Quake 1
@ -186,12 +139,12 @@
# MAME input recordings
0 string MAMEINP\0 MAME input recording
>8 leqdate x at %s,
>16 leshort x format version %d.
>18 leshort x \b%d,
>20 string x %s driver,
>32 string x %s
0 string MAMEINP\0 MAME input recording
>8 leqdate x at %s,
>16 leshort x format version %d.
>18 leshort x \b%d,
>20 string/12 x %s driver,
>32 string/32 x %s
# doom - submitted by Jon Dowland
@ -694,3 +647,20 @@
# Big-endian version (such as PS3)
>8 ubelong <0x100 Wwise Audio Package (big-endian)
!:ext pck
# RPG Maker MV/MZ encrypted assets. Version was only ever known to be 00030100.
0 string RPGMV\0\0\0
>12 string \0\0\0\0
>>8 belong x RPG Maker MV encrypted asset, version %08x
!:ext png_/ogg_/m4a_/rpgmvp/rpgmvo/rpgmvm
# https://arthran2.itch.io/encrypterator-3000
0 string ART\0ENCRYPTER100FREE\0VERSION\0\0\0\0 RPG Maker MV encrypted asset, Encrypterator 3000 variant.
!:ext png_/ogg_/m4a_/rpgmvp/rpgmvo/rpgmvm
# http://www.shikadi.net/moddingwiki/PCX_Library
0 string/b pcxLib\0
>122 ubyte 0x01 pcxLib archive
>>144 uleshort 0 \b, uncompressed
>>144 uleshort !0 \b, compressed

22
contrib/file/magic/Magdir/gentoo
View file

@ -1,34 +1,34 @@
#------------------------------------------------------------------------------
# $File: gentoo,v 1.5 2022/12/26 17:16:55 christos Exp $
# $File: gentoo,v 1.6 2024/02/11 15:39:59 christos Exp $
# gentoo: file(1) magic for gentoo specific formats
#
# Summary: Gentoo ebuild Manifest files (GLEP 74)
# Reference: https://www.gentoo.org/glep/glep-0074.html
# Submitted by: Michal Gorny <mgorny@gentoo.org>
# Start by doing a fast check for the most common tags.
0 string AUX
0 string AUX\040
>0 use gentoo-manifest
0 string DATA
0 string DATA\040
>0 use gentoo-manifest
0 string DIST
0 string DIST\040
>0 use gentoo-manifest
0 string EBUILD
0 string EBUILD\040
>0 use gentoo-manifest
0 string MANIFEST
0 string MANIFEST\040
>0 use gentoo-manifest
# Manifest can be PGP-signed.
0 string -----BEGIN\040PGP\040SIGNED\040MESSAGE-----
>34 search/32 \n\n
>>&0 string AUX
>>&0 string AUX\040
>>>&0 use gentoo-manifest
>>&0 string DATA
>>&0 string DATA\040
>>>&0 use gentoo-manifest
>>&0 string DIST
>>&0 string DIST\040
>>>&0 use gentoo-manifest
>>&0 string EBUILD
>>&0 string EBUILD\040
>>>&0 use gentoo-manifest
>>&0 string MANIFEST
>>&0 string MANIFEST\040
>>>&0 use gentoo-manifest
# Use a more detailed regex to verify that we were correct.

6
contrib/file/magic/Magdir/geo
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: geo,v 1.10 2022/10/31 13:22:26 christos Exp $
# $File: geo,v 1.11 2024/11/09 23:35:01 christos Exp $
# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
######################################################################
@ -164,3 +164,7 @@
# alex myczko <alex@aiei.ch>
# http://pointclouds.org/documentation/tutorials/pcd_file_format.php
0 string #\ .PCD Point Cloud Data
# FlatGeobuf is a GIS file format for encoding geographic data.
# https://flatgeobuf.org/#specification
0 bequad 0x6667620366676201 FlatGeobuf file

11
contrib/file/magic/Magdir/geos
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
# $File: geos,v 1.5 2024/04/07 17:56:40 christos Exp $
# GEOS files (Vidar Madsen, vidar@gimp.org)
# semi-commonly used in embedded and handheld systems.
0 belong 0xc745c153 GEOS
@ -18,3 +18,12 @@
#>52 short x \b, proto %d
#>54 short x \br%d
#>168 string >\0 \b, copyright "%s"
30 string PRG\ formatted\ GEOS\ file Formatted GEOS file
>22 byte 6 \b, APPLICATION
>22 byte 14 \b, AUTO_EXEC
>22 byte 5 \b, DESK_ACC
>22 byte 2 \b, ASSEMBLY
>22 byte 11 \b, DISK_DEVICE
>22 byte 9 \b, PRINTER
>22 byte 4 \b, SYSTEM

18
contrib/file/magic/Magdir/hitachi-sh
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $
# $File: hitachi-sh,v 1.11 2024/02/18 14:15:22 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
@ -28,3 +28,19 @@
>>0 use display-coff
!:strength -10
# Hitachi SH COFF object file
0 leshort 0x01a2
>16 leshort 0
>>0 use display-coff
0 leshort 0x01a3
>16 leshort 0
>>0 use display-coff
0 leshort 0x01a4
>16 leshort 0
>>0 use display-coff
0 leshort 0x01a6
>16 leshort 0
>>0 use display-coff
0 leshort 0x01a8
>16 leshort 0
>>0 use display-coff

25
contrib/file/magic/Magdir/hp
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $
# $File: hp,v 1.27 2024/08/27 18:50:57 christos Exp $
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
@ -242,25 +242,6 @@
>14 string F(,) F(,);
# Summary: HP-38/39 calculator
# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
0 string HP3
>3 string 8 HP 38
>3 string 9 HP 39
>4 string Bin binary
>4 string Asc ASCII
>7 string A (Directory List)
>7 string B (Zaplet)
>7 string C (Note)
>7 string D (Program)
>7 string E (Variable)
>7 string F (List)
>7 string G (Matrix)
>7 string H (Library)
>7 string I (Target List)
>7 string J (ASCII Vector specification)
>7 string K (wildcard)
# Summary: HP-38/39 calculator
# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
0 string HP3
@ -430,4 +411,8 @@
>>>>>>>>>0xC4 belong 33 - received SIGXCPU
>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
# PA-RISC COFF object file
0 leshort 0x0290
>16 leshort 0
>>0 use display-coff

14
contrib/file/magic/Magdir/ibm370
View file

@ -1,10 +1,10 @@
#------------------------------------------------------------------------------
# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $
# $File: ibm370,v 1.13 2024/06/19 16:52:57 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# "USS/370" is an old name for the z/OS Unix subsystem
# AIX 4.1's "/etc/magic" has
#
# 0 short 0535 370 sysV executable
@ -48,5 +48,11 @@
>24 belong >0 - version %d
# NETDATA (https://en.wikipedia.org/wiki/NETDATA)
# -\INMR01 In EBCDIC
0 string \x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1 IBM NETDATA file
# INMR01 In EBCDIC starting at offset 2
2 string \xc9\xd5\xd4\xd9\xf0\xf1 IBM NETDATA file
# z/OS Program Object executable
# Starts with "IEWPLMH" in EBCDIC, followed by a single EBCDIC space to pad
# to 8 bytes. According to https://www.ibm.com/support/pages/apar/PK91585
# IEWPLMH is eyecatcher for "Binder Program Load Module Header" control block
0 string \xc9\xc5\xe6\xd7\xd3\xd4\xc8\x40 z/OS Program Object executable

9
contrib/file/magic/Magdir/ibm6000
View file

@ -1,10 +1,13 @@
#------------------------------------------------------------------------------
# $File: ibm6000,v 1.15 2021/07/03 14:01:46 christos Exp $
# $File: ibm6000,v 1.16 2024/03/31 15:06:56 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
>12 belong >0 not stripped
# Update: Joerg Jenderek
#0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
0 beshort 0x01df
# use subroutine (./coff) to display name+flags+variables for common object formatted files
>0 use \^display-coff
# Breaks sun4 statically linked execs.
#0 beshort 0x0103 executable (RT Version 2) or obj module
#>2 byte 0x50 pure

23
contrib/file/magic/Magdir/iff
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: iff,v 1.18 2022/03/21 19:57:18 christos Exp $
# $File: iff,v 1.20 2024/02/09 00:44:31 christos Exp $
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
@ -10,11 +10,25 @@
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.
# URL: http://fileformats.archiveteam.org/wiki/IFF
# https://en.wikipedia.org/wiki/Interchange_File_Format
# Reference: https://wiki.amigaos.net/wiki/IFF_FORM_and_Chunk_Registry
# Note: called "Interchange File" by DROID via PUID x-fmt/157 and
# "IFF file" or as alias expanded "Interchange File Format" by shared MIME-info database from freedesktop.org
0 string FORM IFF data
#>4 belong x \b, FORM is %d bytes long
# audio formats
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/AIFF
# https://en.wikipedia.org/wiki/Audio_Interchange_File_Format
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/audio-aiff.trid.xml
# Note: called "AIFF Audio Interchange File Format" by TrID and
# "Audio Interchange File Format" by DROID via PUID fmt/414
>8 string AIFF \b, AIFF audio
!:mime audio/x-aiff
# not officially registered
#!:mime audio/aiff
!:ext aiff/aif/aff
>8 string AIFC \b, AIFF-C compressed audio
!:mime audio/x-aiff
>8 string 8SVX \b, 8SVX 8-bit sampled sound voice
@ -51,7 +65,14 @@
>8 string CTLG \b, CTLG message catalog
>8 string PREF \b, PREF preferences
>8 string DTYP \b, DTYP datatype description
# Update: Joerg Jenderek
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/iff-pch.trid.xml
# Note: called "IFF binary Patch" by TrID
>8 string PTCH \b, PTCH binary patch
#!:mime application/octet-stream
#!:mime application/x-iff
#!:mime application/x-amiga-patch
!:ext patch/pch
>8 string AMFF \b, AMFF AmigaMetaFile format
>8 string WZRD \b, WZRD StormWIZARD resource
>8 string DOC\040 \b, DOC desktop publishing document

629
contrib/file/magic/Magdir/images
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: images,v 1.243 2023/07/17 16:49:09 christos Exp $
# $File: images,v 1.263 2024/11/10 20:44:30 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
@ -13,8 +13,10 @@
# Targa - matches `povray', `ppmtotga' and `xv' outputs
# by Philippe De Muyter <phdm@macqel.be>
# URL: http://justsolve.archiveteam.org/wiki/TGA
# https://en.wikipedia.org/wiki/Truevision_TGA
# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
# Update: Joerg Jenderek
# Update: Joerg Jenderek February 2024
# Note: called by DROID "Truevision TGA Bitmap" version 1.0 via PUID x-fmt/367
# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
# ,32 or 33 (both not observed)
# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
@ -27,6 +29,8 @@
# and Image Type 1 2 3 9 10 11 32 33
# and Color Map Entry Size 0 15 16 24 32
0 ubequad&0x00FeC400000000C0 0
# Targa image data (strength=70=110-40) before some Commodore disc image (strength=70=70+0 ./c64) like Cabal+2-MarioSoft(1).d64
# and some MMDF mailbox (strength=70=70+0 ./mmdf) like uupc.input.1
# Conflict with MPEG sequences.
!:strength -40
# Prevent conflicts with CRI ADX.
@ -42,7 +46,10 @@
>>>>17 ubyte&0x0F !11
# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
>>>>>16 ubyte 1
>>>>>>0 use tga-image
# skip few Commodore D64 disc image like "The Great Gianna Sisters.d64" and
# few MMDF mailbox like uupc.input.1 with unlikely black&white, dimension 0101h x 0101h (257x257) and +0101h origin (+257 +257)
>>>>>>8 quad !0x0101010101010101
>>>>>>>0 use tga-image
>>>>>16 ubyte 8
>>>>>>0 use tga-image
>>>>>16 ubyte 15
@ -57,9 +64,11 @@
0 name tga-image
>2 ubyte <34 Targa image data
!:mime image/x-tga
# Apple Uniform Type Identifier: com.truevision.tga-image
!:apple ????TPIC
# normal extension .tga but some Truevision products used others:
# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
# afi bpx
!:ext tga/tpic/icb/vda/vst
# image type 1 2 3 9 10 11 32 33
>2 ubyte&0xF7 1 - Map
@ -110,6 +119,7 @@
# positive length implies identification field
>0 ubyte >0
>>18 string x "%s"
# Note: called by DROID "Truevision TGA Bitmap" version 2.0 via fmt/402
# last 18 bytes of newer tga file footer signature
>18 search/4261301/s TRUEVISION-XFILE.\0
# extension area offset if not 0
@ -327,17 +337,21 @@
# NewSubFileType
>0 uleshort 0xfe
>>12 use tiff_entry
# Width
>0 uleshort 0x100
>>4 ulelong 1
>>>12 use tiff_entry
>>>8 uleshort x \b, width=%d
>>>12 use tiff_entry
# Height
>0 uleshort 0x101
>>4 ulelong 1
>>>8 uleshort x \b, height=%d
>>>12 use tiff_entry
# BPS
>0 uleshort 0x102
>>8 uleshort x \b, bps=%d
>>12 use tiff_entry
# Compression
>0 uleshort 0x103
>>4 ulelong 1 \b, compression=
>>>8 uleshort 1 \bnone
@ -365,6 +379,7 @@
>>>8 default x
>>>>8 uleshort x \b(unknown %#x)
>>>12 use tiff_entry
# Photometric Interpretation
>0 uleshort 0x106 \b, PhotometricInterpretation=
>>8 clear x
>>8 uleshort 0 \bWhiteIsZero
@ -460,10 +475,8 @@
# GPS IFD
>0 uleshort 0x8825 \b, GPS-Data
>>12 use tiff_entry
#>0 uleshort x \b, unknown=%#x
#>>12 use tiff_entry
0 string MM\x00\x2b Big TIFF image data, big-endian
!:mime image/tiff
0 string II\x2b\x00 Big TIFF image data, little-endian
@ -496,6 +509,12 @@
!:ext png
!:strength +10
>16 use png-ihdr
>33 string \x00\x00\x00\x08acTL \b, animated
>>41 ubelong 1 (%d frame
>>41 ubelong >1 (%d frames
>>45 ubelong 0 \b, infinite repetitions)
>>45 ubelong 1 \b, %d repetition)
>>45 ubelong >1 \b, %d repetitions)
# Apple CgBI PNG image.
0 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
@ -544,6 +563,23 @@
#>10 ubyte&0x07 =0x06 128 colors
#>10 ubyte&0x07 =0x07 256 colors
# URL: http://fileformats.archiveteam.org/wiki/Jeff%27s_Image_Format
# http://web.archive.org/web/20010603113404/http://jeff.cafe.net/jif
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jif.trid.xml
# https://www.nationalarchives.gov.uk/PRONOM/fmt/994
# From: Joerg Jenderek
# Note: nearly identical to GIF, except that it uses zlib compression instead of LZW
# called by TrID "Jeff's Image Format bitmap" and "Jeffs Image Format" by DROID via fmt/994
# verfied by XnView `nconvert -fullinfo *.jif` as "Jeff's Image Format"
0 string JIF99a Jeffs Image Format data
!:mime image/x-jif
# http://extension.nirsoft.net/jif
#!:mime image/jif
!:apple ????JIFf
!:ext jif
>6 uleshort x %u x
>8 uleshort x %u
# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0 string \361\0\100\273 CMU window manager raster image data
@ -1171,6 +1207,22 @@
#>>(10.l) ubequad !0 \b, bits %#16.16llx
# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
#>>14 ulelong x \b, dib header size %u
# Type: Vision Research Phantom CINE Format
# URL: https://www.phantomhighspeed.com/
# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
# From: Harry Mallon <hjmallon at gmail.com>
#
# This has a short "CI" code but the 44 is the size of the struct which is
# stable
>2 uleshort 44 Vision Research CINE Video,
>>4 uleshort 0 Grayscale,
>>4 uleshort 1 JPEG Compressed,
>>4 uleshort 2 RAW,
>>6 uleshort x version %d,
>>20 ulelong x %d frames,
>>48 ulelong x %dx
>>52 ulelong x \b%d
# Conflicts with other entries [BABYL]
# URL: http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array
# Note: container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM"
@ -1296,20 +1348,75 @@
# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# See
# http://reality.sgi.com/grafica/sgiimage.html
#
0 ubeshort 474 SGI image data
#>2 ubyte 0 \b, verbatim
>2 ubyte 1 \b, RLE
#>3 ubyte 1 \b, normal precision
>3 ubyte 2 \b, high precision
>4 ubeshort x \b, %d-D
>6 ubeshort x \b, %d x
>8 ubeshort x %d
>10 ubeshort x \b, %d channel
>10 ubeshort !1 \bs
>80 string >0 \b, "%s"
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/SGI_(image_file_format)
# https://en.wikipedia.org/wiki/Silicon_Graphics_Image
# Reference: https://paulbourke.net/dataformats/sgirgb/sgiversion.html
# http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-sgi.trid.xml
# Note: called "Silicon Graphics bitmap (generic)" by TrID,
# "Silicon Graphics Image" by DROID via PUID x-fmt/140 and shared MIME-info database from freedesktop.org,
# verfied by ImageMagick `identify -verbose *.sgi` as SGI (Irix RGB image) and
# verfied by XnView `nconvert -in sgi -info *.sgi` as SGI RGB
# look for magic number (integer 474=0x01DA) + storage format (0 or 1) + number of bytes per pixel channel (1 or 2)
# to skip few TeX font metric data (like pxmi.tfm pxmi1.tfm eksfi8a.tfm ./tex) with invalid "high" bytes/pixel (11 12)
0 ubelong&0xFFffFEfc 0x01da0000
# skip DROID x-fmt-140-signature-id-623.bw with invalid "low" dimensions "0 x 0"
>6 long !0 SGI image data
#!:mime image/sgi
!:mime image/x-sgi
!:apple ????.SGI
# STORAGE format; allowed values 0~VERBATIM 1~RLE
#>>2 ubyte 0 \b, verbatim
>>2 ubyte 1 \b, RLE
#>>2 ubyte >1 STORAGE=%#x
# BPC; number of bytes per pixel component; allowed values 1 2
#>>3 ubyte 1 \b, normal precision
>>3 ubyte 2 \b, high precision
#>>3 ubyte x BPC=%#x
# DIMENSION; allowed values are 1~scanline 2~XSIZExYSIZE 3~XSIZExYSIZExZSIZE
>>4 ubeshort x \b, %d-D
# XSIZE; width of image in pixels
>>6 ubeshort x \b, %d x
# YSIZE; height of image in pixels
>>8 ubeshort x %d
# ZSIZE; number of channels in image; 1~B/W (greyscale) 3~RGB 4~RGB+ALPHA channel
>>10 ubeshort x \b, %d
# GRR: avoid
# Magdir\images, 1347: Warning: Current entry does not yet have a description for adding a EXTENSION type
>>>10 ubeshort 1 channel
# GRR: exception https://sembiance.com/fileFormatSamples/image/sgi/greytest.rgb
!:ext bw
# no examples found with .int suffix
#!:ext bw/int
# no examples found with .inta suffix for black/white+ALPHA channel
# no examples found with 2 channels
#>>>10 ubeshort 2 channels
#!:ext sgi
>>>10 ubeshort 3 channels
!:ext rgb/sgi
>>>10 ubeshort 4 channels
!:ext rgba/sgi
>>>10 default x channels
# no examples found with 5 and more channels
!:ext sgi
# IMAGENAME; null terminated ascii string of up to 79 characters
>>24 string >\0 \b, "%0.80s"
# PINMIN; minimum pixel value in the image; often 0
>>12 ubelong !0 \b, %u PINMIN
# PINMAX; maximum pixel value in the image; often 255
>>16 ubelong !255 \b, %u PINMAX
# DUMMY; 4 bytes of data should be set to 0
>>20 ubelong !0 \b, at 20 %#x
# COLORMAP; 0~normal 1~DITHEREDobsolete 2~SCREENobsolete 3~COLORMAP
>>104 ubelong !0 \b, %u COLORMAP
# DUMMY; 404 bytes should be set to 0 but not always true; makes header exactly 512 bytes
>>111 ubyte !0 \b, at 111 %#x
>>113 ubyte !0 \b, at 113 %#x
>>118 ubeshort !0 \b, at 118 %#4.4x
>>121 ubyte !0 \b, at 121 %#x
>>132 ubelong !0 \b, at 132 %#8.8x
>>135 ubyte !0 \b, at 135 %#x
>>137 ubequad !0 \b, at 137 %#16.16llx
0 string IT01 FIT image data
>4 ubelong x \b, %d x
@ -1329,17 +1436,95 @@
0 string PCD_OPA Kodak Photo CD overview pack file
# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Flexible_Image_Transport_System
# https://en.wikipedia.org/wiki/FITS
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-fts.trid.xml
# Note: called "Flexible Image Transport System bitmap" by TrID, GIMP and DROID via PUID x-fmt/383
# "FITS document" with expanded acronym "Flexible Image Transport System" by shared MIME-info database from freedesktop.org
# verified as "Flexible Image Transport System" by XnView `nconvert -fullinfo M57.FIT MOON.FTS` ,
# as "FTS (Flexible Image Transport System)" by ImageMagick command `identify MOON.FTS` ,
# by NetPBM `fitstopnm M57.FIT | file` ,
# falsified by `fitsverify M57.FIT MOON.FTS`
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0 string SIMPLE\ \ = FITS image data
# keyword is a 1- to 8-character, left-justified ASCII string; columns that do not contain data are filled with spaces
# The assignment indicator (=) always occupies columns nine and ten in the card
0 string SIMPLE\ \ =
# skip DROID x-fmt-383-signature-id-57.fits by check for left padding spaces of 2nd card value
>89 ubeshort =0x2020 FITS image
# URL: https://heasarc.gsfc.nasa.gov/fitsio/fpack/
# Reference: https://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-fz.trid.xml
# https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/docs/fpackguide.pdf
# Note: called "Flexible Image Transport System bitmap (compressed)" by TrID
>>240 search/0x4790/b ZCMPTYPE= data, compression type
# fz suffix for compressed fits
!:ext fz
# Flexible Image Transport System compression value (followed by optional FITS comment) like: NOCOMPRESS GZIP_1 GZIP_2 HCOMPRESS_1 PLIO_1 RICE_1
#>>>&0 string x COMPRESSION=%0.13s
>>>&0 regex [A-Z_1-2]{4,11} %s
# not compressed Flexible Image Transport System with other filename suffix
>>240 default x data
!:ext fits/fit/fts
# five keywords that are required in every FITS file: SIMPLE, BITPIX, NAXIS, NAXISn, and END. EXTEND is also a required keyword if extensions are present in the file
# required keyword in standard on 3rd card contains integer number of bits used to represent each data value but in 2nd card for M57.FIT
>>80 search/81/b BITPIX\040\040=
#>>>&11 string x BIT=%-0.18s
# this is the number of bits per pixel for image data
>>>&20 string 8 \b, 8-bit, character or unsigned binary integer
# few samples with more right positioned values like: M57.FIT
# GRR: avoid warning: Magdir\images, 1380: Warning: description `, 8-bit, character or unsigned binary integer (too right positioned)' truncated
>>>&28 string 8 \b, 8-bit, character or unsigned binary integer
>>>>0 string x (too right positioned)
# few samples not right justified positioned like: MOON.FTS
>>>&11 string 8 \b, 8-bit, character or unsigned binary integer
>>>>0 string x (too left positioned)
# according to DROID but no examples found
#>>>&19 string 08 \b, 8-bit, character or unsigned binary integer
#>>>&19 string +8 \b, 8-bit, character or unsigned binary integer
>>>&19 string 16 \b, 16-bit, two's complement binary integer
>>>&18 string \04032 \b, 32-bit, two's complement binary integer
>>>&18 string -32 \b, 32-bit, floating point, single precision
>>>&18 string -64 \b, 64-bit, floating point, double precision
# second 64-bit variant like: blank.fits
>>>&18 string \04064 \b, 64-bit, two's complement binary integer
# in standard number of dimensions by keyword NAXIS on 3rd card image but in few cases on 2nd card like: M57.FIT
>>80 search/81/b NAXIS\040\040\040= \b,
# before optional comment 31 ASCII charactes left padded with spaces for integer (0-999) of data axis like: 0 (extension no data) 1 (spectrum) 2 (conventional bitmap) 3 (animated bitmap example.fit test.fits) 6 (DDTSUVDATA.fits)
#>>>>&0 string x NAXIS=%-0.31s
# single digit 0 implies no data or similar
>>>&0 search/31/b \0400\040 0 axes
!:mime application/fits
# single digit 1 implies one-dimensional entity such as a spectrum or a time series (no example found)
>>>&-1 search/31/b \0401\040 1 axis
!:mime application/fits
#!:mime image/fits
# single digit 2 implies conventional bitmap
>>>&0 search/31/b \0402\040 2 axes
!:mime image/fits
!:ext fits/fts
>109 string 8 \b, 8-bit, character or unsigned binary integer
>108 string 16 \b, 16-bit, two's complement binary integer
>107 string \ 32 \b, 32-bit, two's complement binary integer
>107 string -32 \b, 32-bit, floating point, single precision
>107 string -64 \b, 64-bit, floating point, double precision
# single digit 3 implies data cubes of three dimensions (animated bitmap or similar)
>>>&0 search/31/b \0403\040 3 axes
!:mime image/fits
# data cubes more dimensions like: 5 (group.fits) 6 (DDTSUVDATA.fits)
>>>&0 default x
>>>>&0 regex/31/s =[0-9]{1,3} %s axis
!:mime application/fits
# often NAXIS1 as 4th card but sometimes at higher offset like: 29400 (IUElwp25637mxlo.fits) 20400 (NICMOSn4hk12010_mos.fits)
>>240 search/29400/bs NAXIS1\040\040= \b,
# before optional comment 31 ASCII charactes left padded with spaces for first axis like: 192 512 1024 1200 2000 2064 3600 ...
>>>&9 regex =[0-9]{1,31} %s
# often NAXIS2 as 5th card but sometimes not existent or at higher offset like: 29120 (IUElwp25637mxlo.fits) 20480 (NICMOSn4hk12010_mos.fits)
>>>320 search/29120/bs NAXIS2\040\040= x
# before optional comment 31 ASCII charactes left padded with spaces for second axis like: 2 4 165 512 800 1024 3600 ...
>>>>&9 regex =[0-9]{1,31} %s
# not standard cards
>>80 string !BITPIX\040\040= \b, at 80
# in M57.FIT like: "NAXIS ="
>>>80 string x "%-0.9s"
>>160 string !NAXIS\040\040\040= \b, at 160
# in M57.FIT like: "BITPIX ="
>>>160 string x "%-0.9s"
# other images
0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
@ -1573,6 +1758,35 @@
>>-0 offset =32066
# (2/41) like: medres.pi2
>>>0 use degas-bitmap
# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
# Update: Joerg Jenderek
# See http://fileformats.archiveteam.org/wiki/GEM_Raster
# For variations, also see:
# https://www.seasip.info/Gem/ff_img.html (Ventura)
# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
# header_size
>2 beshort 0x0008
>>0 use gem_info
>2 beshort 0x0009
>>0 use gem_info
# no example for NOSIG
>2 beshort 24
>>0 use gem_info
# no example for HYPERPAINT
>2 beshort 25
>>0 use gem_info
16 string XIMG\0
>0 use gem_info
# no example
16 string STTT\0\x10
>0 use gem_info
# no example or description
16 string TIMG\0
>0 use gem_info
# DEGAS high-res uncompressed bitmap *.pi3
0 beshort 0x0002
# skip Intel ia64 COFF msvcrt.lib by test for unused bits of 1st atari color palette entry
@ -1763,8 +1977,12 @@
# PCX image files
# From: Dan Fandrich <dan@coneharvesters.com>
# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX
# updated by Joerg Jenderek at Feb 2013, Nov 2023 by https://en.wikipedia.org/wiki/PCX
# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# URL: http://fileformats.archiveteam.org/wiki/PCX
# Note: called "PCX image" with acronym "PiCture eXchange" by shared MIME-info database from freedesktop.org
# verfied partly as pcx "Zsoft Paintbrush" format by XnView `nconvert -in pcx -fullinfo *.pcx` and
# by ImageMagick version 7.1.1-21 command `identify *.pcx`
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
0 ubelong&0xffF8fe00 0x0a000000
@ -1772,28 +1990,39 @@
>3 ubyte >0
# test for valid versions
>>1 ubyte <6
>>>1 ubyte !1 PCX
!:mime image/x-pcx
#!:mime image/pcx
>>>>1 ubyte 0 ver. 2.5 image data
>>>>1 ubyte 2 ver. 2.8 image data, with palette
>>>>1 ubyte 3 ver. 2.8 image data, without palette
>>>>1 ubyte 4 for Windows image data
>>>>1 ubyte 5 ver. 3.0 image data
>>>>4 uleshort x bounding box [%d,
>>>>6 uleshort x %d] -
>>>>8 uleshort x [%d,
>>>>10 uleshort x %d],
>>>>65 ubyte >1 %d planes each of
>>>>3 ubyte x %d-bit
>>>>68 ubyte 1 colour,
>>>>68 ubyte 2 grayscale,
>>>1 ubyte !1
# skip DROID fmt-89-signature-id-62.pcx fmt-88-signature-id-63.pcx fmt-87-signature-id-64.pcx fmt-86-signature-id-65.pcx with invalid dimensions
>>>>8 long !0 PCX
!:mime image/vnd.zbrush.pcx
# deprecated
#!:mime image/x-pcx
!:ext pcx/pcc
# also examples like: abydos.st E-DIODE.ST MUSIC-13.ST ROSE.ST
#!:ext pcx/pcc/st
# Note: called as "PCX bitmap (v2.5)" by TrID via bitmap-pcx.trid.xml and "PCX" version 0 by DROID via PUID fmt/86
>>>>>1 ubyte 0 ver. 2.5 image data
# Note: called as "PCX bitmap (v2.8, palette)" by TrID via bitmap-pcx-v28p.trid.xml and "PCX" version 2 by DROID via PUID fmt/87
>>>>>1 ubyte 2 ver. 2.8 image data, with palette
# Note: called as "PCX bitmap (v2.8)" by TrID via bitmap-pcx-v28.trid.xml and "PCX" version 3 by DROID via PUID fmt/88
>>>>>1 ubyte 3 ver. 2.8 image data, without palette
# Note: called as "PCX bitmap (Win)" by TrID via bitmap-pcx-win.trid.xml and "PCX" version 4 by DROID via PUID fmt/89
>>>>>1 ubyte 4 for Windows image data
# Note: called as "PCX bitmap (v3.0) by TrID via bitmap-pcx-v30.trid.xml and "PCX" version 5 by DROID via PUID fmt/90
>>>>>1 ubyte 5 ver. 3.0 image data
>>>>>4 uleshort x bounding box [%d,
>>>>>6 uleshort x %d] -
>>>>>8 uleshort x [%d,
>>>>>10 uleshort x %d],
>>>>>65 ubyte >1 %d planes each of
>>>>>3 ubyte x %d-bit
>>>>>68 ubyte 1 colour,
>>>>>68 ubyte 2 grayscale,
# this should not happen
>>>>68 default x image,
>>>>12 uleshort >0 %d x
>>>>>14 uleshort x %d dpi,
>>>>2 ubyte 0 uncompressed
>>>>2 ubyte 1 RLE compressed
>>>>>68 default x image,
>>>>>12 uleshort >0 %d x
>>>>>>14 uleshort x %d dpi,
>>>>>2 ubyte 0 uncompressed
>>>>>2 ubyte 1 RLE compressed
# Adobe Photoshop
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
@ -1966,35 +2195,6 @@
0 string NITF National Imagery Transmission Format
>25 string >\0 dated %.14s
# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
# Update: Joerg Jenderek
# See http://fileformats.archiveteam.org/wiki/GEM_Raster
# For variations, also see:
# https://www.seasip.info/Gem/ff_img.html (Ventura)
# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
0 beshort 0x0001
# header_size
>2 beshort 0x0008
>>0 use gem_info
>2 beshort 0x0009
>>0 use gem_info
# no example for NOSIG
>2 beshort 24
>>0 use gem_info
# no example for HYPERPAINT
>2 beshort 25
>>0 use gem_info
16 string XIMG\0
>0 use gem_info
# no example
16 string STTT\0\x10
>0 use gem_info
# no example or description
16 string TIMG\0
>0 use gem_info
0 name gem_info
# version is 2 for some XIMG and 1 for all others
@ -2085,43 +2285,41 @@
# Hercules DASD image files
# From Jan Jaeger <jj@septa.nl> and Jay Maynard <jaymaynard@gmail.com>
# Common Hercules CKD image files
0 name HercCKD
>0 lelong x \b, %d heads per cylinder
>4 lelong x \b, track size %d bytes
>8 ubyte >0x2F
>>8 ubyte 0x45 \b, device type 9345
>>8 ubyte !0x45 \b, device type 33%2.2X
>8 ubyte <0x30 \b, device type 23%2.2X
0 string CKD_P370 Hercules CKD DASD image file
>8 lelong x \b, %d heads per cylinder
>12 lelong x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
>8 use HercCKD
0 string CKD_C370 Hercules compressed CKD DASD image file
>8 lelong x \b, %d heads per cylinder
>12 lelong x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
>8 use HercCKD
>552 lelong x \b, %d total cylinders
>>557 byte 0 \b, no compression
>>557 byte 1 \b, ZLIB compression
>>557 byte 2 \b, BZ2 compression
0 string CKD_S370 Hercules CKD DASD shadow file
>8 lelong x \b, %d heads per cylinder
>12 lelong x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
>8 use HercCKD
0 string CKD_P064 Hercules CKD64 DASD image file
>8 lelong x \b, %d heads per cylinder
>12 lelong x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
>8 use HercCKD
0 string CKD_C064 Hercules compressed CKD64 DASD image file
>8 lelong x \b, %d heads per cylinder
>12 lelong x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
>8 use HercCKD
>524 lelong x \b, %d total cylinders
>>585 byte 0 \b, no compression
>>585 byte 1 \b, ZLIB compression
>>585 byte 2 \b, BZ2 compression
0 string CKD_S064 Hercules CKD64 DASD shadow file
>8 lelong x \b, %d heads per cylinder
>12 lelong x \b, track size %d bytes
>16 byte x \b, device type 33%2.2X
>8 use HercCKD
# Squeak images and programs - etoffi@softhome.net
0 string \146\031\0\0 Squeak image data
@ -2481,7 +2679,6 @@
>>0 use ulead-imaginfo
# From: Joerg Jenderek
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe4-imaginfo.trid.xml
11 string \001\0\0\0\0
# check for version 4 part
>19 string \0\0\0\004\0
>>0 use ulead-imaginfo
@ -2954,7 +3151,8 @@
# FIXME: Handle DX10 and XBOX formats.
>>0x54 string DX10
>>>0x80 use ms-directdraw-dx10
>>0x54 string !DX10 \b, compressed using %.4s
>>0x54 string !DX10
>>>0x54 string x \b, compressed using %.4s
>0x50 ulelong&0x2 0x2 \b, alpha only
>0x50 ulelong&0x200 0x200 \b, YUV
>0x50 ulelong&0x20000 0x20000 \b, luminance
@ -3101,6 +3299,10 @@
>>0x10 ubelong !0x44445320 Sega PVR image:
>>>0x10 use sega-pvr-image-header
>>0x08 ulelong x \b, global index = %u
# Sega GVR image with GBIX.
>0x10 string GVRT Sega GVR image:
>>0x10 use sega-gvr-image-header
>>0x08 ubelong x \b, global index = %u
# Sega GVR header.
0 name sega-gvr-image-header
@ -3122,12 +3324,6 @@
0 string GVRT Sega GVR image:
>0x10 use sega-gvr-image-header
# Sega GVR image with GBIX.
0 string GBIX
>0x10 string GVRT Sega GVR image:
>>0x10 use sega-gvr-image-header
>>0x08 ubelong x \b, global index = %u
# Sega GVR image with GCIX. (Wii)
0 string GCIX
>0x10 string GVRT Sega GVR image:
@ -3137,28 +3333,9 @@
# Light Field Picture
# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
# Typical file extensions: .lfp .lfr .lfx
0 ubelong 0x894C4650
>4 ubelong 0x0D0A1A0A
>12 ubelong 0x00000000 Lytro Light Field Picture
>8 ubelong x \b, version %d
# Type: Vision Research Phantom CINE Format
# URL: https://www.phantomhighspeed.com/
# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
# From: Harry Mallon <hjmallon at gmail.com>
#
# This has a short "CI" code but the 44 is the size of the struct which is
# stable
0 string CI
>2 uleshort 44 Vision Research CINE Video,
>>4 uleshort 0 Grayscale,
>>4 uleshort 1 JPEG Compressed,
>>4 uleshort 2 RAW,
>>6 uleshort x version %d,
>>20 ulelong x %d frames,
>>48 ulelong x %dx
>>52 ulelong x \b%d
>4 ubelong 0x0D0A1A0A Lytro Light Field Picture
>>8 ubelong x \b, version %u
# Type: ARRI Raw Image
# Info: SMPTE RDD30:2014
@ -3173,6 +3350,7 @@
# Type: Khronos KTX texture.
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/
# https://www.iana.org/assignments/media-types/image/ktx
# glEnum decoding.
# NOTE: Only the most common formats are listed here.
@ -3247,6 +3425,8 @@
# Main KTX header.
# Determine endianness, then check the rest of the header.
0 string \xABKTX\ 11\xBB\r\n\x1A\n Khronos KTX texture
!:mime image/ktx
!:ext ktx
>12 ulelong 0x04030201 (little-endian)
>>16 use khronos-ktx-endian-header
>12 ubelong 0x04030201 (big-endian)
@ -3256,6 +3436,7 @@
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Based on draft19.
# Reference: http://github.khronos.org/KTX-Specification/
# https://www.iana.org/assignments/media-types/image/ktx2
# Supercompression enum.
0 name khronos-ktx2-supercompression
@ -3517,6 +3698,8 @@
# Main KTX2 header.
0 string \xABKTX\ 20\xBB\r\n\x1A\n Khronos KTX2 texture
!:mime image/ktx2
!:ext ktx2
>20 ulelong x \b, %u
>24 ulelong >1 x %u
>28 ulelong >1 x %u
@ -3610,7 +3793,7 @@
# Microsoft Paint graphic
# http://www.fileformat.info/format/mspaint/egff.htm
0 string DanM icrosoft Paint image data (version 1.x)
0 string DanM Microsoft Paint image data (version 1.x)
>4 uleshort x (%d
>>6 uleshort x x %d)
0 string LinS Microsoft Paint image data (version 2.0)
@ -3629,9 +3812,7 @@
>>>>33 string and
>>>>>37 string layers
>>>>>>43 ulelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s)
# newer per-page files for the reMarkable
0 string reMarkable
>11 string .lines
>>18 string file,
>>>24 string version=
@ -4026,9 +4207,9 @@
>>>13 ubyte x *bad colorspace %u*
# Type: Godot 3, 4 texture (pixel format)
# Type: Godot 3 texture (pixel format)
# From: David Korth <gerbilsoft@gerbilsoft.com>
0 name godot-pixel-format
0 name godot-pixel-format-v3
>0 ulelong&0xFFFFF 0 L8
>0 ulelong&0xFFFFF 1 LA8
>0 ulelong&0xFFFFF 2 R8
@ -4066,8 +4247,55 @@
>0 ulelong&0xFFFFF 34 ETC2_RGB8
>0 ulelong&0xFFFFF 35 ETC2_RGBA8
>0 ulelong&0xFFFFF 36 ETC2_RGB8A1
# NOTE: This is a custom pixel format used by Sonic Colors Ultimate.
# Godot 4 later added its own ASTC format values.
>0 ulelong&0xFFFFF 37 ASTC_8x8
# Type: Godot 4 texture (pixel format)
# From: David Korth <gerbilsoft@gerbilsoft.com>
# NOTE: This is a custom pixel format used by Sonic Colors Ultimate.
# Godot 4 later added its own ASTC format values.
0 name godot-pixel-format-v4
>0 ulelong&0xFFFFF 0 L8
>0 ulelong&0xFFFFF 1 LA8
>0 ulelong&0xFFFFF 2 R8
>0 ulelong&0xFFFFF 3 RG8
>0 ulelong&0xFFFFF 4 RGB8
>0 ulelong&0xFFFFF 5 RGBA8
>0 ulelong&0xFFFFF 6 RGBA4444
>0 ulelong&0xFFFFF 7 RGB565
>0 ulelong&0xFFFFF 8 RF
>0 ulelong&0xFFFFF 9 RGF
>0 ulelong&0xFFFFF 10 RGBF
>0 ulelong&0xFFFFF 11 RGBAF
>0 ulelong&0xFFFFF 12 RH
>0 ulelong&0xFFFFF 13 RGH
>0 ulelong&0xFFFFF 14 RGBH
>0 ulelong&0xFFFFF 15 RGBAH
>0 ulelong&0xFFFFF 16 RGBE9995
>0 ulelong&0xFFFFF 17 DXT1
>0 ulelong&0xFFFFF 18 DXT3
>0 ulelong&0xFFFFF 19 DXT5
>0 ulelong&0xFFFFF 20 RGTC_R
>0 ulelong&0xFFFFF 21 RGTC_RG
>0 ulelong&0xFFFFF 22 BPTC_RGBA
>0 ulelong&0xFFFFF 23 BPTC_RGBF
>0 ulelong&0xFFFFF 24 BPTC_RGBFU
>0 ulelong&0xFFFFF 25 ETC
>0 ulelong&0xFFFFF 36 ETC2_R11
>0 ulelong&0xFFFFF 27 ETC2_R11S
>0 ulelong&0xFFFFF 28 ETC2_RG11
>0 ulelong&0xFFFFF 29 ETC2_RG11S
>0 ulelong&0xFFFFF 30 ETC2_RGB8
>0 ulelong&0xFFFFF 31 ETC2_RGBA8
>0 ulelong&0xFFFFF 32 ETC2_RGB8A1
>0 ulelong&0xFFFFF 33 ETC2_RA_AS_RG
>0 ulelong&0xFFFFF 34 DXT5_RA_AS_RG
>0 ulelong&0xFFFFF 35 ASTC_4x4
>0 ulelong&0xFFFFF 36 ASTC_4x4_HDR
>0 ulelong&0xFFFFF 37 ASTC_8x8
>0 ulelong&0xFFFFF 38 ASTC_8x8_HDR
# Type: Godot 3, 4 texture (rescale display, width)
# From: David Korth <gerbilsoft@gerbilsoft.com>
# Shows rescale value if it's not a power of 2.
@ -4138,7 +4366,7 @@
>16 ulelong&0x100000 0x100000 lossless encoding
>16 ulelong&0x200000 0x200000 lossy encoding
>16 ulelong&0x300000 0
>>16 use godot-pixel-format
>>16 use godot-pixel-format-v3
# Type: Godot 4 texture
# From: David Korth <gerbilsoft@gerbilsoft.com>
@ -4157,7 +4385,7 @@
>12 use godot-rescale-display-h
>12 uleshort x \b,
>0x2C ulelong >1 %u mipmaps,
>0x30 use godot-pixel-format
>0x30 use godot-pixel-format-v4
>0x24 ulelong 1 \b, embedded PNG image
>0x24 ulelong 2 \b, embedded WebP image
>0x24 ulelong 3 \b, Basis Universal
@ -4217,3 +4445,140 @@
>3 string Em 5-7
>3 string Fk 8-12
>3 default x MAX
# https://teem.sourceforge.net/nrrd/index.html
# From: Quasar Jarosz <quasar@uams.edu>, 2023
0 string NRRD000 NRRD imaging data
!:mime image/x.nrrd
!:ext nrrd
>7 string x \b, version %s
>0 search type:
>>&1 string x \b, type: %s
>0 search dimension:
>>&1 string x \b, dimensions: %s
>0 search sizes:
>>&1 string x \b, sizes: %s
>0 search encoding:
>>&1 string x \b, encoding: %s
# From: Joerg Jenderek
# URL: http://justsolve.archiveteam.org/wiki/PICT
# https://en.wikipedia.org/wiki/PICT
# Reference: https://www.fileformat.info/format/macpict/egff.htm
# http://mark0.net/download/triddefs_xml.7z/defs/p/pict-v2.trid.xml
# Note: called "Macintosh Quickdraw/PICT drawing" by shared MIME-info database from freedesktop.org,
# "QuickDraw/PICT bitmap (v2)" by TrID and "Macintosh PICT Image" version 2.0 by DROID via PUID via fmt/341
# verified by command like `deark -m pict -l -d2 flag_b24.pct` as PICT v2,
# partly by NetPBM `picttoppm venus.pct | file` as "Macintosh PICT",
# partly by ImageMagick `identify -verbose flag_b24.pct` as (Apple Macintosh QuickDraw/PICT) and
# partly by XnView `nconvert -fullinfo *.pict *.pic *.pct` as "Macintosh PICT 2"
# look for version operator (0011h) and version number (02FFh)
522 ubelong 0x001102ff
# few Macintosh QuickDraw with one corner at -1/-1 coordinates like PICT_129.pict PICT_2012.pict (strength=81=70+11) before Claris clip art (strength=80 ./claris)
!:strength +11
# look for Version operator (0C00h)
>526 ubeshort 0x0c00
# skip DROID fmt-341-signature-id-468.pct with invalid dimension x=0
>>520 ubeshort !0
# skip DROID variant fmt-341-signature-id-468.pct using 0xAB instead 0x0
>>>0 long !0xABABABAB Macintosh QuickDraw PICT, version 2
#!:mime application/octet-stream
!:mime image/x-pict
!:apple ????PICT
!:ext pict/pic/pct
# maybe also suffix pict2 https://www.xnview.com/de/image_formats/
#!:ext pict2/pict/pic/pct
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pict.trid.xml
# Note: called "Macintosh Quickdraw/PICT Drawing" by TrID
# "real" content stored by opcode 0x8200 (CompressedQuickTime *.qtif) with none, cvid or JPEG compression
# look for LongText QuickTime followed by trademark character
>>>>554 search/691976/b QuickTime\252 \b, QuickTime
# look for LongText afterwards like "and a/None|Cinepak|Photo - JPEG decompressor/are needed to see this picture"
>>>>>&0 search/28/bs \040decompressor with decompressor
>>>>>>&-4 string None None
# Cinepak and "Compact Video decompressor" seems to be cvid
>>>>>>&-7 string Cinepak Cinepak
>>>>>>&-12 string Photo\040-\040JPEG JPEG
>>>>>>&-13 string Compact\040Video cvid
# case where decompression is not like: Cinepak None "Photo - JPEG" "Compact Video decompressor"
>>>>>>&-6 default x
>>>>>>>&0 string x "%0.6s"
# file size in bytes; not reliable sometimes 0 or little smaller than real size
#>>>>512 ubeshort x \b, size %u
# 8 bytes picFrame (rectangle); for most examples one corner is located at coordinates 0/0; except deark other tools fail when negative values
# GRR: samples with coordinates -1/-1 and Y=0x01??|0x00?? are interpreted as "Claris clip art" (strength=80 ./claris)
#>>>>518 ubeshort x Y=%#4.4x
>>>>520 ubeshort x \b, %u
>>>>>516 beshort !0 \b-%d
>>>>518 ubeshort x x %u
>>>>>514 beshort !0 \b-%d
# Note: at the beginning all zeros or information about the particular software like: PICT
>>>>0 long !0 \b, at 0
>>>>>0 string x %.4s
# version 2.0 files also have a 26-byte header following the version information
# like: 0 FFFEh (freedesktop egff~Encyclopedia of Graphics File Formats) FFFFh (egff)
>>>>528 ubeshort x \b, at 528 %#4.4x
# 2nd opcode like: 0x0000~NOP 0x0001~Clip 0x00a0~ShortComment 0x00a1~LongComment 0x001e~DefHilite 0x001f~OpColor
>>>>552 ubeshort x \b, at 552 second opcode %#4.4x
# last opcode if not opEndPic (00FFh)
>>>>-2 ubeshort !0x00FF \b, at the end %#4.4x opcode
# Reference: http://web.archive.org/web/20010703041301/http://developer.apple.com/technotes/qd/qd_14.html
# http://mark0.net/download/triddefs_xml.7z/defs/p/pict-v1.trid.xml
# Note: called "QuickDraw/PICT bitmap (v1)" by TrID and "Macintosh PICT Image" version 1.0 by DROID via PUID via x-fmt/80
# verified by command like `deark -m pict -l -d2 FC9.PCT` as PICT v1,
# by ImageMagick `identify -verbose *.pict` as PICT (Apple Macintosh QuickDraw/PICT) and
# by XnView `nconvert -fullinfo *.pict *.pct` as "Macintosh PICT"
# 1 byte opcode for picversion (11h); next byte version number (1)
522 ubeshort 0x1101
# skip DROID x-fmt-80-signature-id-859.pct x-fmt-80-signature-id-860.pct without next opcode usually clipRgn (1h)
>524 ubyte =0x01
>>0 use mac-pict1
# display Macintosh PICT drawing version 1 information
0 name mac-pict1
>520 ubeshort x Macintosh QuickDraw PICT, version 1
#!:mime application/octet-stream
!:mime image/x-pict
!:apple ????PICT
!:ext pict/pct
# maybe also suffix pict1 and pic
#!:ext pict1/pict/pic/pct
# file size in bytes; not reliable sometimes 0 or smaller than real size
#>512 ubeshort x \b, size %u
# 8 bytes picFrame (rectangle)
>520 ubeshort x \b, %u
>516 ubeshort !0 \b-%u
>518 ubeshort x x %u
>514 ubeshort !0 \b-%u
# Note: According to DROID at the beginning all zeros or information about the particular software like DRWG(MD|D2)
>0 long !0 \b, at 0
>>0 string x %.6s
>>0 ubelong x %#8.8x
>>4 ubeshort x \b%4.4x
# 2nd opcode if not clipRgn (1h)
>524 ubyte !0x01 \b, at 524 %#2.2x opcode
# last opcode if not opEndPic (FFh)
>-1 ubyte !0xFF \b, at the end %#2.2x opcode
# https://github.com/aseprite/aseprite/blob/main/docs/ase-file-specs.md
20 ulelong 0
>24 ulelong 0
>>4 uleshort 0xA5E0 Aseprite asset file
!:ext aseprite
>>>0 ulelong x \b, size %u
>>>6 uleshort x \b, frames %u
>>>8 uleshort x \b, size %ux
>>>10 uleshort x \b%u
>>>12 uleshort 32 \b, RGBA
>>>12 uleshort 16 \b, Grayscale
>>>12 uleshort 8 \b, Indexed
>>>14 ulelong x \b, flags %#x
#>>>18 uleshort x \b, speed %u
>>>28 ubyte x \b, transparency index %u
>>>32 uleshort x \b, number of colors %u
>>>34 ubyte >0 \b, pixel ratio %u:
>>>>35 ubyte x \b%u
>>>36 leshort x \b, grid position (%d,
>>>38 leshort x \b%d)
>>>40 uleshort x \b, grid size %dx
>>>42 uleshort x \b%d

190
contrib/file/magic/Magdir/ispell
View file

@ -1,7 +1,7 @@
#------------------------------------------------------------------------------
# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
# ispell: file(1) magic for ispell
# $File: ispell,v 1.10 2023/10/23 19:49:58 christos Exp $
# ispell: file(1) magic for ispell, MySpell, Hunspell and aspell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
@ -61,3 +61,189 @@
>12 long x lexsize %d,
>16 long x hashsize %d,
>20 long x stblsize %d
# Summary: affixes defition text files for Ispell/MySpell/Hunspell
# From: Joerg Jenderek
# URL: https://www.openoffice.org/lingucomponent/affix.readme
# https://man.archlinux.org/man/hunspell.5.en
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/affix.trid.xml
# Note: called "Affix file" by TrID
# variant starting with comment character
0 ubyte 0x23
# look for SET character command followed by whitespace (seems to be often 1 space character) like in:
# /usr/share/calibre/dictionaries/en-GB/en-GB.aff
>0 search/60459 SET\040
# skip scripts like /bin/affixcompress /bin/setupcon /bin/imdbpy2sql.py by checking for valid character SET argument
# character SET argument like: UTF-8
>>&0 string UTF-8
>>>0 use spell-aff
# character SET argument like: ISO8859-1 - ISO8859-10 ISO8859-13 - ISO8859-15
>>&0 string ISO8859-
>>>0 use spell-aff
# character SET argument for Russian with Cyrillic alphabet like: KOI8-R KOI8-U
# no russian support until war against ukraine
>>&0 string KOI8-
#>>>0 use spell-aff
# character SET argument for languages with Cyrillic alphabet like: cp1251
# no cyrillic support until russia war against ukraine
>>&0 string cp1251
#>>>0 use spell-aff
# character SET argument for Indian Script Code for Information Interchange (ISCII) like: ISCII-DEVANAGARI
>>&0 string ISCII-
# no example found
>>>0 use spell-aff
# not "real" affix rule files but found as tests unit inside thunderbird sources like:
# 1463589.aff 1695964.aff 2970240.aff
>0 default x
# look for suffix SFX command followed by whitespace like in:
# 1695964.aff
>>0 search/164 SFX\040
>>>0 use spell-aff
# if not real Hunspell/MySpell affix look for ispell variant
>>0 default x
# URL: https://manpages.debian.org/testing/ispell/ispell.5.en.html
# look for ispell declaration like in: /usr/lib/ispell/espanol.aff
>>>0 search/8251 defstringtype
# defstringtype declaration start with unique name (like "list" "lat" "utf8" "iso" "nroff" often like formatter name)
# followed by formatter name (like "nroff" "tex")
# followed by suffix list (like ".mm" ".ms" ".me" ".man" ".NeXT" ".txt" ".list")
#>>>>&1 string x DECLARATION=%s
>>>>0 use spell-aff
# ispell variant without declaration like in: /usr/lib/ispell/bulgarian.aff /usr/lib/ispell/russian.aff
>>>0 default x
# skip /etc/nilfs_cleanerd.conf by looking for ispell suffix section
>>>>0 search/3233 suffixes\n
>>>>>0 use spell-aff
# variant starting with empty line and comment character at the beginning of 2nd line like in: /usr/lib/ispell/polish.aff
0 ubeshort 0x0a23
# skip /etc/discover-modprobe.conf by looking for ispell declaration
>2 search/3118 defstringtype
>>0 use spell-aff
# starting with UTF-8 Byte Order Mark (BOM) https://en.wikipedia.org/wiki/Byte_order_mark
0 string \xEF\xBB\xBF
# starting with UTF-8 Byte Order Mark (BOM) followed by comment starting character
>3 string \x23
# starting with UTF-8 BOM and with SET character command followed by whitespace
# like in: /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/lt.aff
# look for character SET command used in MySpell and Hunspell
>3 search/9883 SET\040
>>0 use spell-aff
# look for FLAG type command used in MySpell and Hunspell
0 string FLAG
# followed by space character like in
# /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/en_US.aff
>4 ubyte 0x20
>>0 use spell-aff
# or followed by tabulator character like in
# /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/ar.aff
>4 ubyte 0x09
>>0 use spell-aff
# starting with character SET command used in MySpell and Hunspell like in: org/languagetool/resource/sv/hunspell/sv_SE.aff
0 string SET\040
>0 use spell-aff
# starting with language code LANG used in MySpell and Hunspell like in: /usr/share/hunspell/tr_TR.aff
0 string LANG\040
>0 use spell-aff
# starting with affix flag command AF used in MySpell and Hunspell like in: /usr/lib/thunderbird/extensions/langpack-hu@thunderbird.mozilla.org/dictionaries/hu.aff
0 string AF\040
# look for number of flag vector aliases
>3 regex [0-9]{1,4}
>>0 use spell-aff
# display information (encoding,language,...) about affixes rules text for Ispell/MySpell/Hunspell
0 name spell-aff
>1 ubeshort x affix definition
#!:mime text/plain
!:mime text/x-affix
!:ext aff
# GRR: need extra test so that default clause works
>0 ubyte x
# look for ispell declaration
>>0 search/8251 defstringtype for Ispell
# ispell variant without declaration
>>0 default x
# look for ispell suffixes command
>>>0 search/3233 suffixes
# skip "suffixes used to create first part of a compound" by checking for flag argument like in: languagetool\resource\sv\hunspell\sv_SE.aff
>>>>&0 search/2 flag for Ispell
>>>>&0 default x for MySpell/Hunspell
# without suffixes keyword
>>>0 default x for MySpell/Hunspell
# look for language code command used in MySpell and Hunspell
# like in: /usr/share/hunspell/de_AT.aff /usr/share/hunspell/it_IT.aff /usr/share/hunspell/tr_TR.aff /usr/lib/firefox/browser/extensions/langpack-hu@firefox.mozilla.org/dictionaries/hu.aff
>>0 search/1117643 LANG\040 \b, language
# language code argument like: de_DE hu_HU it_IT mn_MN tr_TR
>>>&0 string x %s
# look for character SET command used in MySpell and Hunspell
>>0 search/1117729 SET
# skip SETTINGS like in /usr/lib/ispell/ngerman.aff
# SET command followed often by space character (0x20) or tabulator (0x09) like in
# /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/ar.aff
>>>&0 ubyte&0xD6 =0x00
# skip SSET # schosS in /usr/lib/ispell/ogerman.aff
>>>>&0 ubyte >0x48 \b,
# character SET argument like: cp1251 ISCII-DEVANAGAR ISO8859-1 - ISO8859-10 ISO8859-13 - ISO8859-15 KOI8-R KOI8-U UTF-8
>>>>>&-1 string x "%s" encoded
# for control reasons show first non empty lines for ASCII or ISO-8859 text variant
>1 ubeshort !0xBBBF
# 1st line starting with 0x0A like in /usr/src/dicts/sjp-ispell-pl-20140213/polish.aff
>>0 ubyte =0x0A
>>>1 ubyte !0x0A \b, 2nd line
>>>>&-1 string x "%s"
# 3rd line starting with 0x0A like in polish.aff
>>>>>&1 ubyte =0x0A
>>>>>>&0 string x \b, 4th line "%s"
# 1st line starting with ASCII text like:
# this is the affix file of the de_DE Hunspell dictionary
>>0 ubyte !0x0A
>>>0 string x \b, 1st line "%s"
>>>>&1 ubyte >0x1F \b, 2nd line
>>>>>&-1 string x "%s"
# 2nd line starting with 0x0A like in /usr/lib/ispell/bulgarian.aff
>>>>&1 ubyte =0x0A \b, 3rd line
>>>>>&0 string x "%s"
# for control reasons show first lines for variant starting with ByteOrderMark (BOM=\xEF\xBB\xBF)
>1 ubeshort =0xBBBF \b, with BOM
>>3 string x \b, 1st line "%s"
>>>&1 ubyte >0x1F \b, 2nd line
>>>>&-1 string x "%s"
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/GNU_Aspell
# https://manpages.ubuntu.com/manpages/trusty/en/man8/aspell-autobuildhash.8.html
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/r/rws-aspell.trid.xml
# https://ftp.gnu.org/gnu/aspell/aspell-0.60.8.tar.gz
# aspell-0.60.8/modules/speller/default/data.cpp
# aspell-0.60.8/modules/speller/default/readonly_ws.cpp
# Note: called "aspell dictionary" by TrID
0 string aspell\040default\040speller\040rowl aspell dictionary
#!:mime application/octet-stream
!:mime application/x-aspell-dictionary
!:ext rws
# version like: 1.10 1.4
>28 string x \b, version %s
# u32int endian_check; 12345678=00BC614Eh
#>64 ulelong x \b, endian_check=%u
>>64 ulelong 12345678 \b, little endian
# not tested
>>64 ubelong 12345678 \b, big endian
# older aspell version not like 0.60.8
>>64 default x \b, old
# URL: https://en.wikipedia.org/wiki/GNU_Aspell
# Reference http://aspell.net/man-html/Format-of-the-Personal-and-Replacement-Dictionaries.html
# personal_ws-1.1 lang num [encoding]
0 string personal_ aspell personal
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pws-aspell.trid.xml
# Note: called "aspell Personal dictionary" by TrID
>9 string ws- dictionary
#!:mime text/plain
!:mime text/x-aspell-dictionary
# like: ~/.aspell.en.pws ~/.aspell.de_DE.pws ~/.aspell.it.pws
!:ext pws
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prepl-aspell.trid.xml
# Note: called "aspell Personal Replacement dictionary" by TrID
# personal_repl-1.1 lang num [encoding]
>9 string repl- replacement dictionary
#!:mime text/plain
!:mime text/x-aspell-dictionary
# like: ~/.aspell.en.prepl ~/.aspell.de_DE.prepl ~/.aspell.it.prepl
!:ext prepl

29
contrib/file/magic/Magdir/javascript
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: javascript,v 1.5 2023/01/12 00:02:16 christos Exp $
# $File: javascript,v 1.7 2024/11/10 14:48:55 christos Exp $
# javascript: magic for javascript and node.js scripts.
#
0 string/tw #!/bin/node Node.js script executable
@ -17,51 +17,48 @@
!:mime application/javascript
# JavaScript
# The strength is increased to beat the C++ & HTML rules
# The strength is increased to beat the C++ but lose to HTML rules,
# because javascript is embedded in hmtl files typically
0 search "use\x20strict" JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 search 'use\x20strict' JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 regex module(\\.|\\[["'])exports.*= JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 regex \^(const|var|let).*=.*require\\( JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 regex \^export\x20(function|class|default|const|var|let|async)\x20 JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 regex \\((async\x20)?function[(\x20] JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 regex \^(import|export).*\x20from\x20 JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 regex \^(import|export)\x20["']\\./ JavaScript source
!:strength +30
!:mime application/javascript
!:ext js
0 regex \^require\\(["'] JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
0 regex typeof.*[!=]== JavaScript source
!:strength +30
!:strength +20
!:mime application/javascript
!:ext js
# React Native minified JavaScript
0 search/128 __BUNDLE_START_TIME__= React Native minified JavaScript
!:strength +30
!:strength +20
!:mime application/javascript
!:ext bundle/jsbundle

55
contrib/file/magic/Magdir/jpeg
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: jpeg,v 1.38 2022/12/02 17:42:04 christos Exp $
# $File: jpeg,v 1.40 2024/11/10 00:26:35 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
@ -34,12 +34,12 @@
>>13 byte 0 \b, aspect ratio
>>13 byte 1 \b, resolution (DPI)
>>13 byte 2 \b, resolution (DPCM)
>>14 beshort x \b, density %dx
>>16 beshort x \b%d
>>4 beshort x \b, segment length %d
>>14 ubeshort x \b, density %ux
>>16 ubeshort x \b%u
>>4 ubeshort x \b, segment length %u
# Next, show thumbnail info, if it exists:
>>18 byte !0 \b, thumbnail %dx
>>>19 byte x \b%d
>>18 byte !0 \b, thumbnail %ux
>>>19 byte x \b%u
>6 string Exif \b, Exif standard: [
>>12 indirect/r x
>>12 string x \b]
@ -57,22 +57,22 @@
>0 beshort 0xFFC0
>>(2.S+2) use jpeg_segment
>>4 byte x \b, baseline, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>7 ubeshort x \b, %ux
>>5 ubeshort x \b%u
>>9 byte x \b, components %d
>0 beshort 0xFFC1
>>(2.S+2) use jpeg_segment
>>4 byte x \b, extended sequential, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>7 ubeshort x \b, %ux
>>5 ubeshort x \b%u
>>9 byte x \b, components %d
>0 beshort 0xFFC2
>>(2.S+2) use jpeg_segment
>>4 byte x \b, progressive, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>7 ubeshort x \b, %ux
>>5 ubeshort x \b%u
>>9 byte x \b, components %d
# Define Huffman Tables
@ -165,25 +165,40 @@
#45 beshort 0xff52
# JPEG extended range
# Update: Joerg Jenderek 2023
# URL: http://fileformats.archiveteam.org/wiki/JPEG_XR
# Reference: https://www.itu.int/rec/T-REC-T.832
# http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-wmp.trid.xml
# Note: called by TrID "JPEG XR bitmap"
# http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxr.trid.xml
# Note: called by TrID "JPEG XR bitmap" and "JPEG XR bitmap (WMPHOTO)"
# verified as "JPEG XR" by XnView `nconvert -fullinfo *.jxr *.wdp`
# partly by ImageMagick command `identify -verbose *.wdp`
# and libjxr-tools `JxrDecApp -v -i example.wdp -o example.tif`
0 string \x49\x49\xbc
# FILE_VERSION_ID; shall be equal to 1; other values are reserved for future use
# FILE_VERSION_ID; shall be equal to 1; other values are reserved for future use and are unlike to appear
>3 byte 1
# FIRST_IFD_OFFSET; shall be an integer multiple of 2; so skip DROID fmt-590-signature-id-931.wdp
>>4 lelong%2 0 JPEG-XR
>>4 lelong%2 0 JPEG-XR Image
#!:mime image/vnd.ms-photo
!:mime image/jxr
# NO example for HDP !
!:ext jxr/wdp/hdp
# MAYBE also WMP ?
#!:ext jxr/wdp/hdp/wmp
# moved from ./images (version 1.205 ), merged and
# partly verified by XnView `nconvert -info abydos.jxr FLOWER.wdp`
# example: https://web.archive.org/web/20160403012904/
# moved from ./images (version 1.243 ) and merged
# example:
# http://shikino.co.jp/solution/upfile/FLOWER.wdp.zip
# often GDI_SIGNATURE "WMPHOTO\0" at offset 90 like: FLOWER.wdp abydos.jxr SMALLTOMATO.wdp
>90 bequad 0x574D50484F544F00
>>0 use jxr-info
# seldom no GDI_SIGNATURE WMPHOTO\0 at offset 90 like: example.wdp MARKET-3361-ipm-bg-DE-treat[1].wdp
>90 bequad !0x574D50484F544F00
# look for GDI_SIGNATURE WMPHOTO\0 at other offset
>>4 search/3267/sb WMPHOTO\0
>>>&-90 use jxr-info
#
0 name jxr-info
# check for GDI_SIGNATURE that corresponds to "WMPHOTO\0"
>90 bequad 0x574D50484F544F00
>>98 byte&0x08 =0x08 \b, hard tiling
>>99 byte&0x80 =0x80 \b, tiling present
@ -198,8 +213,8 @@
>>99 byte&0x38 0x30 \bLT
>>99 byte&0x38 0x38 \bLB
>>100 byte&0x80 =0x80 \b, short header
>>>102 beshort+1 x \b, %d
>>>104 beshort+1 x \bx%d
>>>102 beshort+1 x \b, %u
>>>104 beshort+1 x \bx%u
>>100 byte&0x80 =0x00 \b, long header
>>>102 belong+1 x \b, %x
>>>106 belong+1 x \bx%x

14
contrib/file/magic/Magdir/keyman Normal file
View file

@ -0,0 +1,14 @@
#------------------------------------------------------------------------------
# $File: keyman,v 1.2 2024/10/17 19:23:07 christos Exp $
#
# Keyman support for .kmx and .kmp files (kmp support is in archive)
#
# https://help.keyman.com/developer/current-version/reference/file-types/kmx
# https://help.keyman.com/developer/current-version/reference/file-types/kmp
0 string/b KXTS Keyman Compiled Keyboard File
!:ext kmx
!:mime application/vnd.keyman.kmx
>4 lelong x version 0x%x
>>48 lelong &32 KMX+ Data

5
contrib/file/magic/Magdir/lammps
View file

@ -1,7 +1,6 @@
#------------------------------------------------------------------------------
# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $
#
#------------------------------------------------------------------------------
# $File: lammps,v 1.2 2024/06/10 23:09:52 christos Exp $
# Magic file patterns for use with file(1) for the
# LAMMPS molecular dynamics simulation software.
# https://lammps.sandia.gov

7
contrib/file/magic/Magdir/lauterbach Normal file
View file

@ -0,0 +1,7 @@
#------------------------------------------------------------------------------
# $File: lauterbach,v 1.1 2024/10/02 01:45:32 christos Exp $
# Lauterbach GmbH file formats
#
0 string trace32\x20analyzer\x20data Lauterbach T32 trace data
!:ext ad

415
contrib/file/magic/Magdir/linux
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: linux,v 1.85 2023/07/17 14:40:09 christos Exp $
# $File: linux,v 1.91 2024/11/09 21:15:48 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@ -137,34 +137,230 @@
# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
# and Nicolas Lichtmaier <nick@debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# and Joerg Jenderek [unifying + more kernel info]
# many start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# by assembler instructions like: movw $0x07c0,%ax; movw %ax,%ds; movw $0x9000,%ax; movw %ax,%es; movw $0x0001,%cx; subw %si,%si; subw
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
514 string HdrS Linux kernel
# to display Linux kernel (strength=125=70+55) after VBR boot sector (130=70+60) but before DOS/MBR IPL (115=50+65), MBR boot sector (105=40+65) via ./filesystem
# before MZ PE32 executable (EFI application) (strength=50) and before DOS executable (COM) (strength=40) with start instruction 0xe9 via ./msdos
!:strength + 55
# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
# DamnSmallLinux 1.5 damnsmll.lnx
#!:mime application/octet-stream
!:mime application/x-linux-kernel
!:ext /dat/bin/lnx
# GRR: does there exist here samples without 55AA boot signature? I believe NO (Joerg Jenderek)
>510 leshort 0xAA55 x86 boot executable
>>0 use kernel-info
# show information about Linux kernel (root, swap device, vga modus, boot protocol, setup size, init_size, EFI entry point)
0 name kernel-info
# like: plpbtrom.bin
# After 16 bit jump instruction Hi, are you searching something? This is the Plop Boot Manager written by Elmar Hanlhofer http?://www.plop.at
>48 string Plop\040Boot\040Manager from PLOP Boot Manager
# dummy test below 512 limit (for LILO 24.2 bootsect.b) to get same magic indention level like in v 1.85
# and display comma before zImage/bzImage or version
>498 leshort x \b,
# boot protocol option flags valid since boot protocol >= 2.00
>>518 leshort >0x1ff
>>>529 byte 0 zImage,
>>>529 byte 1 bzImage,
>>>526 lelong >0
# loadflags bit 0 (read); LOADED_HIGH; if 0, the protected-mode code is loaded at 0x10000
>>>529 ubyte&0x01 0 zImage,
# loadflags bit 0 (read); LOADED_HIGH; if 1, the protected-mode code is loaded at 0x100000; that implies is_bzImage
>>>529 ubyte&0x01 1 bzImage,
# kernel_version; since protocol 2.00 if not zero 2 byte pointer to kernel version string -200h; should be < 200h*setup_sects
# 0h (ldntldr.bin plpbtrom.bin) 260h (memtest32.bin memtest64.bin) 3b0h (memdisk16.bin) 890h (damnsmll.lnx) 3400h (linux64) 3640h (linux)
#>>>526 uleshort x kernel_version=%#4.4x
>>>526 uleshort >0
# GRR: \353fHdrS\003\002 wrong shown if kernel_version=0 like in ldntldr.bin (GRUB for DOS)
>>>>(526.s+0x200) string >\0 version %s,
# 498 MasterBootRecord 4th partition entry partition type (0~empty 1~FAT12) done by ./filesystems
# 499 MasterBootRecord 4th partition entry end heads done by ./filesystems
# root_flags; if set (=1), the root is mounted readonly; deprecated, use the "ro" or "rw" option on the command line instead
#>>498 uleshort >1 root_flags=%u
>>498 leshort 1 RO-rootFS,
>>498 leshort 0 RW-rootFS,
# root_dev; default root device number like 0 301h (/dev/hda1 damnsmll.lnx) 380h (/dev/hd?? linux-elks); deprecated and replaced by command line option root=
>>508 leshort >0 root_dev %#X,
>>502 leshort >0 swap_dev %#X,
# since protocol 2.04 the 2 upper bytes of long syssize and not swap_dev any more
>>518 uleshort <0x204
# 502-505 MasterBootRecord 4th partition entry 1st LBA sector done by ./filesystems
>>>502 leshort >0 swap_dev %#X,
>>504 leshort >0 RAMdisksize %u KB,
# 506-509 MasterBootRecord 4th partition entry sectors in partition done by ./filesystems
>>506 leshort 0xFFFF Normal VGA
>>506 leshort 0xFFFE Extended VGA
>>506 leshort 0xFFFD Prompt for Videomode
>>506 leshort >0 Video mode %d
# more kernel information added by Joerg Jenderek 2023
# if needed display comma after video mode and before setup_sects
>>506 leshort >-4
>>>506 leshort !0 \b,
# setup_sects; if field contains 0, the real value is 4; size of the setup in sectors like:
# 0 (memdisk16.bin) 1 (ldntldr.bin) 2 (memtest32.bin memtest64.bin) 4 (plpbtrom.bin linux-elks) 8 (bootsect.b) 10 (damnsmll.lnx) 25 27 (linux64) 29 30 31 33 (linux)
# MasterBootRecord 4th partition entry start cylinder bits 0-7 done by ./filesystems
>>497 ubyte !0 setup size 512*%u
>>497 ubyte =0 setup size 512*4 (not 0)
# 500 MasterBootRecord 4th partition entry end sectors+cylinder bits 8-9 done by ./filesystems
# 501 MasterBootRecord 4th partition entry end cylinder bits 0-7 done by ./filesystems
# syssize; 32-bit code size in 16-byte paragraphs; since protocol 2.04 long before unreliable short
>>518 uleshort <0x204 \b,
# 0 (ldntldr.bin) 0 (memdisk16.bin) f180h (damnsmll.lnx)
>>>500 uleshort x syssize %#x
>>518 uleshort >0x203 \b,
# 0 (plpbtrom.bin) 1270h (linux-elks) 217eh (memtest32.bin) 22deh (memtest64.bin) 2c01h (memtest86+.bin) 459c6h (linux misinterpreted as swap_dev 0X4) 70c32h (linux64 misinterpreted as swap_dev 0X7)
>>>500 ulelong x syssize %#x
# jump; jump instruction relative to byte 0x202
>>512 ubyte =0xEB \b, jump
# jump adress like: 0x230 (damnsmll.lnx) 0x240 (memdisk16.bin) 0x268 (memtest32.bin memtest64.bin ldntldr.bin linux AFTER handover offset) 0x26c (linux64)
>>>513 byte+2 x 0x2%2.2x
# next instruction like:
# b800088ec00fb60e mov ax,0x0800; mov es,ax; movzx cx,byte [] memdisk16.bin
# 8cc88ed88ec0e88b00 movw %cs,%ax; movw %ax,%ds; movw %ax,%es; call get_mem_info memtest32.bin
# 8cc88ed88ec0e88b00 movw %cs,%ax; movw %ax,%ds; movw %ax,%es; call get_mem_info memtest64.bin
>>>(513.b+514) ubequad x %#16.16llx instruction
# without jump instruction like: 0 (bootsect-lilo-24.2.b EOF!) 0xb8 (mov linux-elks) 0xfa (cli memtest86+.bin)
>>512 ubyte !0xEB \b, at 0x200 %#x instruction
# boot protocol version field valid since version >= 2.00 which is indicated by HdrS magic
# so skip memtest86+.bin with misinterpreted protocol 144.0 (0x9000)
>>514 string HdrS \b,
# Boot protocol version; 2.3 (ldntldr.bin damnsmll.lnx) 2.6 (plpbtrom.bin) 2.10 2.11 (linux) 2.12 (memtest32.bin) 2.13 2.15 (linux64)
>>>519 ubyte x protocol %u
>>>518 ubyte x \b.%u
# boot protocol in hexadecimal needed for addtional tests
#>>>518 uleshort x (%#4.4x)
# type_of_loader; Boot loader identifier; filled out by the bootloader
>>>528 ubyte >0 \b, loader %#x
# loadflags; boot protocol option flags
#>>>529 ubyte x loadflags=%#x
# loadflags bit 1 (kernel internal); KASLR_FLAG KASLR status to kernel
>>>529 ubyte&0x02 !0 \b, KASLR enabled
# loadflags bit 5 (write); QUIET_FLAG
>>>529 ubyte&0x20 !0 \b, quiet
# loadflags bit 6 (write) since boot protocal version >= 2.07; KEEP_SEGMENTS
>>>518 uleshort >0x206
>>>>529 ubyte&0x40 !0 \b, keep segments
# loadflags bit 7 (write); CAN_USE_HEAP
>>>529 ubyte&0x80 !0 \b, can use heap
# payload_offset; since boot protocol 2.08 if non-zero contains offset of the protected-mode code to the payload like: cdh (linux) 40dh (linux64)
>>>518 uleshort >0x207
>>>>584 ulelong >0 \b, from protected-mode code at offset %#x
# payload_length; since boot protocol 2.08 the length of the payload like: 452c41h (linux) 6fb644h (linux64)
>>>>>588 ulelong x %#x bytes
# jump setup size sectors a 512 bytes from kernel beginning
>>>>>(497.b*512) ubequad x
#>>>>>(497.b*512) ubequad x 512BYTES_BEFORE_PROTECTED-MODE_CODE=%#16.16llx
# jump payload_offset bytes + 512 bytes (for boot sector) - 8 (ubequad length) to payload start
#>>>>>>&(584.l+504) ubeshort x PAYLOAD=%#4.4x
# supported compression formats are gzip (magic numbers 1F8B or 1F9E linux) bzip2 (425A), LZMA (5D00 linux64), XZ (FD37) LZ4 (0221) ZST v0.8+ (28B5)
>>>>>>&(584.l+504) ubeshort =0x1F8B gzip compressed
>>>>>>&(584.l+504) ubeshort =0x1F9E gzip compressed
>>>>>>&(584.l+504) ubeshort =0x425A bzip2 compressed
>>>>>>&(584.l+504) ubeshort =0x5D00 LZMA compressed
>>>>>>&(584.l+504) ubeshort =0xFD37 XZ compressed
>>>>>>&(584.l+504) ubeshort =0x0221 LZ4 compressed
>>>>>>&(584.l+504) ubeshort =0x28B5 ZST compressed
# TODO: handle compressed data by ./compress; difficulties with leading space and duplicate gzip compressed
#>>>>>>&(584.l+504) indirect x COMPRESS_NOT_WORKING
# setup_move_size; for protocol 2.00-2.01; bytes starting with the beginning of the boot sector
# like: 0 (ldntldr.bin memdisk16.bin memtest32.bin memtest64.bin plpbtrom.bin) 8000h (damnsmll.lnx linux linux64)
>>>518 uleshort <0x202
>>>>518 uleshort >0x1FF
>>>>530 uleshort x \b, setup_move_size %#4.4x
# code32_start; address to jump to in protected mode like: 100000h (linux linux64 memtest32.bin memtest64.bin)
#>>>>532 ulelong >0 \b, code32_start %#x
# kernel_alignment; since boot protocol 2.05 alignment unit required by the kernel (if relocatable_kernel is true) like: 0 (plptrom.bin) 1000h (memtest32.bin memtest64.bin) 200000h (linux) 1000000h (linux64)
#>>>518 uleshort >0x204
#>>>>560 ulelong x \b, kernel_alignment %#x
# relocatable_kernel; since boot protocol 2.05 the protected-mode part of the kernel can be loaded at any address if this field is nonzero
>>>518 uleshort >0x204
>>>>564 ubyte =1 \b, relocatable
#>>>>564 ubyte x \b, relocatable_kernel=%u
# min_alignment; since boot protocol 2.10 if nonzero, indicates as a power of two the minimum alignment required like: 12 (4 KB memtest32.bin memtest64.bin) 13 (8 KB linux) 21 (2 MB linux64)
#>>>518 uleshort >0x209
#>>>>565 ubyte >0 \b, min_alignment %u
# xloadflags; since boot protocol 2.12 like: 3fh (linux64 unexpected value) 4h(memtest32.bin) 9h(memtest64.bin)
>>>518 uleshort >0x20B
#>>>>566 uleshort x \b, xloadflags=%#4.4x
# handover_offset; offset from beginning of kernel image to EFI handover protocol entry point like:
# 0 (damnsmll.lnx ldntldr.bin) 10h (memtest32.bin memtest64.bin) 30h (linux) 190h (linux64) 8e9000b8h (plpbtrom.bin INVALID!)
# this value makes only sense when 32 or 64-bit EFI handoff entry point
>>>>566 uleshort&0x000C !0 \b, handover offset
>>>>>612 ulelong x %#x
# Bit 0 XLF_KERNEL_64; if 1, this kernel has the legacy 64-bit entry point at 0x200
>>>>566 uleshort&0x0001 !0 \b, legacy 64-bit entry point
# Bit 1 XLF_CAN_BE_LOADED_ABOVE_4G; if 1, kernel/boot_params/cmdline/ramdisk can be above 4G
>>>>566 uleshort&0x0002 !0 \b, can be above 4G
# Bit 2 XLF_EFI_HANDOVER_32; if 1, the kernel supports the 32-bit EFI handoff entry point
>>>>566 uleshort&0x0004 !0 \b, 32-bit EFI handoff entry point
# Bit 3 XLF_EFI_HANDOVER_64; if 1, the kernel supports the 64-bit EFI handoff entry point
>>>>566 uleshort&0x0008 !0 \b, 64-bit EFI handoff entry point
# Bit 4 EFI_KEXEC; if 1, the kernel supports kexec EFI boot with EFI runtime support
>>>>566 uleshort&0x0010 !0 \b, EFI kexec boot support
# GRR: What does bit 5 mean?
>>>>566 uleshort&0x0020 !0 \b, xloadflags bit 5
# cmdline_size; since boot protocol 2.06 maximum size of the kernel command line like: 255 (memtest32.bin memtest64.bin) 2047 (linux linux64 plpbtrom); version <= 2.06 maximum was 255
>>>518 uleshort >0x205
>>>>568 ulelong x \b, max cmdline size %u
# hardware_subarch; since boot protocol 2.07 hardware subarchtecture like: 0~default x86 1~lguest 2~Xen 3~Moorestown 4~CE4100 TV
>>>518 uleshort >0x206
>>>>572 ulelong >0 \b, hardware_subarch %u
# hardware_subarch_data; since boot protocol 2.07 pointer to data specific for hardware subarch; unused for default x86
>>>>>576 ulequad >0 \b, hardware_subarch_data %#llx
# setup_data; since boot protocol 2.09 64-bit physical pointer to NULL terminated single linked list of struct setup_data
>>>518 uleshort >0x208
>>>>592 ulequad >0 \b, setup_data %16.16llx
# pref_address; since boot protocol 2.10 if nonzero preferred load address for kernel like: 100000h (memtest32.bin memtest64.bin) 200000h (linux) 1000000h (linux64)
#>>>518 uleshort >0x209
#>>>>600 ulequad >0 \b, pref_address %#llx
# init_size; since boot protocol 2.10 indicates amount of contiguous memory kernel needs before it is capable of examining its memory map
# like: 0h (damnsmll.lnx) 687f8h (memtest32.bin) 6acf8h (memtest64.bin) aa3000h (linux) 2514000h (linux64) 67ea0000h (memdisk16.bin INVALID) a4f3f2ffh (plpbtrom.bin INVALID) ffffff80h (ldntldr.bin INVALID)
>>>518 uleshort >0x209
>>>>608 ulelong x \b, init_size %#x
# This also matches new kernels, which were caught above by "HdrS".
0 belong 0xb8c0078e Linux kernel
# but also few samples without "HdrS" magic like: bootsect-lilo-24.2.b linux-elks memtest86+.bin
# URL: https://tldp.org/HOWTO/Linux-i386-Boot-Code-HOWTO/bootsect.html
#0 belong 0xb8c0078e Linux kernel
0 belong 0xb8c0078e
# to display Linux x86 kernel or Linux ELKS Kernel (strength=70=70+0) after VBR boot sector (130=70+60) DOS/MBR IPL (115=50+65), MBR boot sector (105=40+65) via ./filesystem
#!:strength +0
# "newer" kernel (with HdrS magic) already done before
>514 string HdrS
# so handle "old" kernel variant (without HdrS magic)
>514 default x Linux
#!:mime application/octet-stream
!:mime application/x-linux-kernel
# GRR: in file 5.45 remaining default clause not working for samples with size = 512 like LILO 24.2 bootsect.b
>>0 belong x
# ELKS kernel variant is now unified with other "old" kernel variant (without HdrS magic)
>>0x1e6 belong =0x454c4b53 ELKS Kernel
!:ext /
# "old" kernel variant and not ELKS
>>0x1e6 belong !0x454c4b53 x86 kernel
!:ext /b/bin
# show kernel version information based on "Loading" message offset
>>0 use kernel-version-old1
# unified "old" variant with start instruction \xb8\xc0\x07\x8e\xd8\xb8\x00\x90
>>4 string \xd8\xb8\x00\x90
# show kernel version information part 2 for "old" kernel variant (without HdrS magic) based on new HdrS field
>>>0 use kernel-version-old2
# show kernel version information part 3 for "old" kernel variant (without HdrS magic) based on new HdrS field
>>>0 use kernel-version-old3
# show common kernel information
>>0 use kernel-info
# show kernel version information part 1 for "old" kernel variant (without HdrS magic) based on "Loading" message offset
0 name kernel-version-old1
>0x1e3 string Loading version 1.3.79 or older
>0x1e9 string Loading from prehistoric times
# LILO 24.2-5.1 bootsect.b
>0x1c5 string Loading from LILO 24.2
# Memtest86 5.31b memtest86+.bin
>0x1d2 string Loading from Memtest86 5.31b
# DamnSmallLinux kernel version 2.4.26 damnsmll.lnx not needed because done by kernel_version pointer
#>0x1cb string Loading damnsmll.lnx 2.4.26~
# Memtest86+ v6.20 memtest32.bin not needed because done by kernel_version pointer
#>0x1c6 string Loading\040Memtest86+ from Memtest86+ v6.20
# System.map files - Nicolas Lichtmaier <nick@debian.org>
8 search/1 \ A\ _text Linux kernel symbol map text
@ -183,13 +379,37 @@
############################################################################
# Linux kernel versions
0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
# apply only to "old" kernel variant (without HdrS magic) like damnsmll.lnx memtest86+.bin
# wrong (497 setup_sects 498 root_flags) and now already done by 1st unified "old" kernel variant
#0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90foo OLD_VARIANT Linux
>497 leshort 0 x86 boot sector
>>0 use kernel-version-old2
>497 leshort !0 x86 kernel
# not needed any more because information is now shown by common kernel-info with other phrases
>>0 use kernel-info-old
# kernel version information part 3 for "old" kernel variant (without HdrS magic) based on HdrS field
>>0 use kernel-version-old3
>>0 use kernel-version-4
# version information part 2 for "old" kernel variant (without HdrS magic) based on new HdrS field
0 name kernel-version-old2
# dummy test to get same magic indention level like in v 1.85
>518 leshort x
>>514 belong 0x8e of a kernel from the dawn of time!
>>514 belong 0x908ed8b4 version 0.99-1.1.42
>>514 belong 0x908ed8b8 for memtest86
# dummy test function to get same magic indention level like in v 1.85
0 name kernel-version-dummy
>497 leshort !0 x86 kernel
# not needed any more because information is now shown by kernel-info
#>0 use kernel-info-old
>>0 use kernel-info
# kernel version information part 3 for "old" kernel variant (without HdrS magic) based on HdrS field
>0 use kernel-version-old3
# deprecated because same information is shown by kernel-info with other phrases
0 name kernel-info-old
# dummy test to get same magic indention level like in v 1.85
>504 leshort x
>>504 leshort >0 RAMdisksize=%u KB
>>502 leshort >0 swap=%#X
>>508 leshort >0 root=%#X
@ -199,6 +419,10 @@
>>506 leshort 0xFFFE vga=extended
>>506 leshort 0xFFFD vga=ask
>>506 leshort >0 vga=%d
# kernel version information part 3 for "old" kernel variant (without HdrS magic) based on HdrS field
0 name kernel-version-old3
# dummy test to get same magic indention level like in v 1.85
>514 belong x
>>514 belong 0x908ed881 version 1.1.43-1.1.45
>>514 belong 0x15b281cd
>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
@ -207,16 +431,27 @@
>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
# show kernel version information part 4 for kernel variant (with HdrS magic) based on "HdrS" field
# not needed any more because information is now shown by common kernel-info
0 name kernel-version-4
# dummy test to get same magic indention level like in v 1.85
>518 leshort x
>>514 string HdrS
>>>518 leshort >0x1FF
>>>>529 byte 0 \b, zImage
>>>>529 byte 1 \b, bzImage
# GRR: Not valid if kernel_version=0
>>>>(526.s+0x200) string >\0 \b, version %s
# Linux boot sector thefts.
0 belong 0xb8c0078e Linux
>0x1e6 belong 0x454c4b53 ELKS Kernel
>0x1e6 belong !0x454c4b53 style boot sector
# ELKS kernel variant is now unified with above "old" kernel variant (without HdrS magic)
#0 belong 0xb8c0078e Linux
# display "Linux ELKS Kernel" or "Linux style boot sector" (strength=70) after DOS/MBR IPL (115=50+65) and MBR boot sector (105=40+65) via ./filesystem
#!:strength +0
# https://en.wikipedia.org/wiki/Embeddable_Linux_Kernel_Subset
# https://github.com/jbruchon/elks/releases/download/v0.6.0/fd2880-fat.img/linux
#>0x1e6 belong 0x454c4b53 ELKS Kernel
#>0x1e6 belong !0x454c4b53 style boot sector
############################################################################
# Linux S390 kernel image
@ -238,16 +473,44 @@
# Linux ARM compressed kernel image
# From: Kevin Cernekee <cernekee@gmail.com>
# Update: Joerg Jenderek
# Update: Luke T. Shumaker
0 name arm-zimage
# Version indicators
>0x34 lelong 0x45454545 (kernel >=v4.15)
>0x34 lelong !0x45454545
>>0x30 clear x
>>0x30 belong 0x04030201 (kernel >=v3.17, <v4.15)
>>0x30 lelong 0x04030201 (kernel >=v3.17, <v4.15)
>>0x30 default x (kernel <v3.17)
# Endianness indicators
#
# The kernel has 3 endianness modes: little-endian, and 2 variants of
# big-endian: BE-32 (ARMv5) and BE-8 (ARMv6+).
#
# In kernels <v3.17:
# - the 0x016f2818 @ 0x24 magic number indicates big-endian or
# little-endian (can't distinguish between BE-8 and BE-32)
# In kernels >=v3.17:
# - a new 0x04030201 @ 0x30 magic number indicates big-endian or
# little-endian, but doesn't distinguish between BE-8 and BE-32
# - the old 0x016f2818 @ 0x24 magic number is little-endian for
# LE *and* BE-8, or big-endian for BE-32
#
# >=v3.17
>0x30 clear x
>0x30 belong 0x04030201 (big-endian,
>>0x24 belong 0x016f2818 BE-32, ARMv5)
>>0x24 lelong 0x016f2818 BE-8, ARMv6+)
>0x30 lelong 0x04030201 (little-endian)
# <v3.17
>0x30 default x
>>0x24 lelong 0x016f2818 (little-endian)
>>0x24 belong 0x016f2818 (big-endian)
0x24 lelong 0x016f2818 Linux kernel ARM boot executable zImage
# There are three possible situations: LE, BE with LE bootloader and pure BE.
# In order to aid telling these apart a new endian flag was added. In order
# to support kernels before the flag and BE with LE bootloader was added we'll
# do a negative check against the BE variant of the flag when we see a LE magic.
>0x30 belong !0x04030201 (little-endian)
# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
!:ext img/bin
>0x30 belong 0x04030201 (big-endian)
0x24 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
>0 use arm-zimage
0x24 belong 0x016f2818 Linux kernel ARM boot executable zImage
>0 use arm-zimage
############################################################################
# Linux AARCH64 kernel image
@ -258,6 +521,12 @@
>0x18 lelong &4 \b, 16K pages
>0x18 lelong &6 \b, 32K pages
############################################################################
# Linux RISC-V kernel image
0x38 string RSC\05 Linux kernel RISC-V boot executable Image
>0x18 lelong ^1 \b, little-endian
>0x18 lelong &1 \b, big-endian
############################################################################
# Linux 8086 executable
0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
@ -357,26 +626,12 @@
>8 lelong x version %d,
>12 lelong x chunk_size %d
# SE Linux policy database
0 lelong 0xf97cff8c SE Linux policy
>16 lelong x v%d
>20 lelong 1 MLS
>24 lelong x %d symbols
>28 lelong x %d ocons
# Summary: Xen saved domain file
# Created by: Radek Vokal <rvokal@redhat.com>
0 string LinuxGuestRecord Xen saved domain
>20 search/256 (name
>>&1 string x (name %s)
# Type: Xen, the virtual machine monitor
# From: Radek Vokal <rvokal@redhat.com>
0 string LinuxGuestRecord Xen saved domain
#>2 regex \(name\ [^)]*\) %s
>20 search/256 (name (name
>>&1 string x %s...)
# Systemd journald files
# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
@ -541,12 +796,90 @@
# Site: https://fedorahosted.org/mlocate/
# Format docs: https://linux.die.net/man/5/mlocate.db
# Type: mlocate database file
# URL: https://en.wikipedia.org/wiki/Locate_(Unix)
# URL: https://fedorahosted.org/mlocate/
# From: Wander Nauta <info@wandernauta.nl>
# Update: Joerg Jenderek
0 string \0mlocate mlocate database
>12 byte x \b, version %d
#!:mime application/octet-stream
!:mime application/x-mlocate
# default mlocate.db if not overriden with --output option of updatedb
!:ext db
# at the moment value is 0; a higher version will probably not occur, because mlocate is now often replaced by plocate
>12 byte !0 \b, version %d
# configured with -l option of updatedb
>13 byte 1 \b, require visibility
# 2 byte pad for 32-bit total alignment
#>14 short !0 \b, padding %#x
# standard is 1 byte / if not overriden with --database-root option of updatedb
>16 string x \b, root %s
# 1st variable name nil terminated like: prune_bind_mounts
>>&1 string x \b, 1st variable %s
# 1st variable value like: 0 1
>>>&1 string x \b=%s
# configuration block size in big endian like: 82 85 174 181 185 483 491 496 497 556 600
>8 ubelong x \b, configuration size %u
# URL: https://plocate.sesse.net/
# Reference: https://plocate.sesse.net/download/plocate-1.1.19.tar.gz
# plocate-1.1.19/db.h
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/db-plocate.trid.xml
# Note: called "plocate database" by TrID
# magic[8]
0 string \0plocate plocate database
#!:mime application/octet-stream
!:mime application/x-plocate
# default /var/lib/plocate/plocate.db if not overriden with --output option of updatedb.plocate
!:ext db
# version; 2 is the current version
>8 ulelong !1 \b, version %u
# hashtable_size; like 1 (for "empty" samples) 1b5c3h
#>12 ulelong >1 \b, hash table size %#x
# extra_ht_slots; like: 10h
>16 ulelong !0x10 \b, extra_ht_slots %#x
# num_docids; like 0 (for "empty" samples) a132h
>20 ulelong >0 \b, num_docids %u
# hash_table_offset_bytes; 78h (for "empty" samples) afdf99h
#>24 ulequad !0x78 \b, hash table offset %#llx
# filename_index_offset_bytes; 70h (for "empty" samples) aad571h
#>32 ulequad !0x70 \b, filename index offset %#llx
# version 1 and up only
>8 ulelong >0
# max_version; nominally 1 or 2 but can be increased if more features are added in a backward-compatible way
>>40 ulelong !2 \b, max version %u
# zstd_dictionary_length_bytes; 0 (for "empty" samples) 400h
>>44 ulelong !0 \b, at %#x
# zstd_dictionary_offset_bytes; 0 (for "empty" samples) 70h
>>48 ulequad >0 \b+%#llx
# jump to beginning of zstd dictionary
>>>(48.q) ubequad x
# jump realative zstd dictionary length bytes - 8 (quad length) forward to ZST data beginning
#>>>>&(44.l-8) ubelong x ZST=%8.8x
>>>>&(44.l-8) ubelong x
# print 1 space char after zstd_dictionary_offset and then handles Zstandard compressed data by ./compress
# to get phrase like "at 0x400+0x70 Zstandard compressed data (v0.8+)"
>>>>>&-4 indirect x \b
# only if max_version >= 2 and only relevant for updatedb
>40 ulelong >1
# directory_data_length_byte
#>>56 ulequad x \b, directory data length %#llx
# directory_data_offset_bytes;
#>>64 ulequad x offset %#llx
# next_zstd_dictionary_length_bytes; 0 (for "empty" samples) 400h
>>72 ulequad >0 \b, next zstd dictionary length %#llx
# next_zstd_dictionary_offset_bytes; 0 (for "empty" samples) 14b9cb8h
>>>80 ulequad >0 offset %#llx
# conf_block_length_bytes like; 65 147 148 151 152 452 537 540 543
>>88 ulequad x \b, configuration size %llu
# conf_block_offset_bytes; 1a1h (for "empty" samples) 14ba0b8h
>>96 ulequad >0 \b, at %#llx 1st variable
# 1st variable name nil terminated like: prune_bind_mounts
>>>(96.q) string x %s
# 1st variable value nil terminated like: 0 1
>>>>&1 string x \b=%s
# bool check_visibility; 0 or 1 configured with -l option of updatedb.plocate
>>104 ubyte 1 \b, require visibility
#>>104 ubyte x \b, check_visibility %#x
# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
@ -625,3 +958,13 @@
>124 ubyte !0x79
>>124 ubyte >0x40 \b, english y is %c
#>764 ubyte x \b, english Y is %c
# From: Ben Dooks <ben.dooks@codethink.co.uk>
# URL: https://github.com/torvalds/linux/blob/master/tools/perf/util/header.c
# perf files for v1 and v2
0 string PERFFILE Linux perf recording, version 1
0 lequad 0x32454c4946524550 Linux perf recording, version 2. little endian
0 bequad 0x32454c4946524550 Linux perf recording, version 2. big endian

12
contrib/file/magic/Magdir/lisp
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $
# $File: lisp,v 1.28 2024/05/30 15:32:20 christos Exp $
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
@ -76,3 +76,13 @@
# From: David Allouche <david@allouche.net>
0 search/1 \<TeXmacs| TeXmacs document text
!:mime text/texmacs
# Chibi-Scheme
0 string \a\achibi\n Chibi-Scheme memory image data
>8 ubyte =0 \b, big-endian
>>9 ubyte x \b, format version %d
>>11 ubyte x \b.%d
>8 ubyte >0 \b, little-endian
>>8 ubyte x \b, format version %d
>>10 ubyte x \b.%d
>12 string x \b, ABI %s

47
contrib/file/magic/Magdir/magic
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: magic,v 1.11 2023/06/27 13:42:49 christos Exp $
# $File: magic,v 1.12 2024/06/10 23:09:52 christos Exp $
# magic: file(1) magic for magic files
#
# Update: Joerg Jenderek
@ -10,13 +10,19 @@
!:mime text/x-file
# no suffix in ../Header
!:ext /
#
# some samples start with a comment line
#
# some (34/339) samples start with a comment line
0 ubyte =0x23
# many samples start with separator line
# some (28/339) samples start with separator line (about 78 minus characters) like:
# archive arm assembler beetle c-lang clojure compress der filesystems firmware gentoo lammps
# m4 mail.news make marc21 music parrot pascal pc88 pc98 perl ringdove tcl varied.script webassembly x68000 zfs
>4 string --------
>>0 use magic-fragment
# few samples with 1st comment line and without seperator comment line
# skip scripts fse.sed stage1.sed constants.pxi gotmail.awk from fetchmail package by
# searching for reference to man page file(1) {lammps v 1.1} or file (1) {muscic v 1.1}
>>12 search/180 (1)
>>>0 use magic-fragment
# few (6/339) samples with 1st comment line and without separator comment line
# like: blcr bsi selinux sisu ssh svf
>4 default x
# few sample with 1st comment line and without seperator comment line and regular expression like: sisu
>>1 search/112 regex\x09
@ -33,10 +39,22 @@
>>>>>0 use magic-fragment
# but many samples start with an empty first line
0 ubyte =0x0A
# many samples sttart with separator comment line
# many samples start with separator comment line
>4 string --------
>>0 use magic-fragment
# few samples with 1st empty line and without seperator comment line like: biosig espressif
# skip some MS-DOS C source text {EMSINIT.INC MEM.C RESTPARS.C RTDO.C RTDO1.C RTFILE.C RTFILE1.C RTNEW.C RTNEW1.C RTOLD.C RTOLD1.C RTT1.C RTT3.C}
# and match many fragments by looking for Revision Control System keyword near the beginning
>>1 search/128 $File
>>>0 use magic-fragment
# few samples {ctf (2022-03-26) msx (2021-06-30) nasa (2021-02-23) symbos (2021-02-23) weak (2021-02-23)}
# with 1st empty line, separator comment line and without Revision Control System keyword but with reference to man page file(1)
>>1 default x
>>>1 search/180 file(1)
>>>>0 use magic-fragment
>>>1 default x
# sample aria (2021-12-24) with 1st empty line, separator comment line and without Revision Control System keyword and without reference to man page file(1)
>>>>1 search/1024 \041:mime
>>>>>0 use magic-fragment
# few samples with 1st empty line and without separator comment line like: biosig (2021-02-23) espressif (v 1.3)
>4 default x
>>1 search/581 \041:mime
>>>0 use magic-fragment
@ -47,14 +65,21 @@
# most without suffix but mail.news varied.out varied.script
!:ext /news/out/script
# next lines are mainly for control reasons
# some (34/339) samples start comment line
# some (34/339) samples start with comment line
>0 ubyte !0x0A
>>0 string x \b, 1st line "%s"
>>>&1 string x \b, 2nd line "%s"
# show more information to see difference between fragments and misidentfied scripts
>>>>&1 string x \b, 3rd line "%s"
>>>>>&1 string x \b, 4th line "%s"
>>>>>>&1 string x \b, 5th line "%s"
# but most (305/339) samples start with an empty first line
>0 ubyte =0x0A
>>1 string x \b, 2nd line "%s"
>>>&1 string x \b, 3rd line "%s"
# show more information to see difference between fragments and misidentfied scripts
>>>>&1 string x \b, 4th line "%s"
>>>>>&1 string x \b, 5th line "%s"
#
# URL: http://en.wikipedia.org/wiki/File_(command)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mgc.trid.xml
@ -64,6 +89,8 @@
!:mime application/x-file
!:ext mgc
>4 lelong x (version %d) (little endian)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mgc-be.trid.xml
# Note: called "magic compiled data (BE)" by TrID
0 belong 0xF11E041C magic binary file for file(1) cmd
#!:mime application/octet-stream
!:mime application/x-file

22
contrib/file/magic/Magdir/mail.news
View file

@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: mail.news,v 1.30 2022/10/31 13:22:26 christos Exp $
# $File: mail.news,v 1.32 2024/11/10 16:59:38 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
@ -26,6 +26,12 @@
!:mime message/rfc822
0 string/t Date: news or mail text
!:mime message/rfc822
0 string/t Subject: news or mail text
!:mime message/rfc822
0 string/t Cc: news or mail text
!:mime message/rfc822
0 string/t To: news or mail text
!:mime message/rfc822
0 string/t Article saved news text
!:mime message/news
# Reference: http://quimby.gnus.org/notes/BABYL
@ -43,6 +49,20 @@
0 string/t MIME-Version: MIME entity text
#0 string/t Content- MIME entity text
# From: Joerg Jenderek
# URL: https://tools.ietf.org/rfc/rfc4155.txt
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mbox.trid.xml
# Note: called "Standard Unix Mailbox" by TrID and
# "mailbox file" by shared MIME-info database
#https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in?ref_type=heads
0 string From\040 Mailbox text
#!:mime text/plain
!:mime application/mbox
# like: INBOX 1.mbox
!:ext /mbox
# For control reasons show first line like: "From - Tue May 30 21:55:54 2023" "From noreply@unitymedia.info Thu Oct 13 17:23:38 2016"
>0 string x \b, 1st line "%s"
# TNEF files...
# URL: http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format
# https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format

3
contrib/file/magic/Magdir/map
View file

@ -1,7 +1,6 @@
#------------------------------------------------------------------------------
# $File: map,v 1.10 2023/02/03 20:41:57 christos Exp $
# $File: map,v 1.11 2024/06/10 23:09:52 christos Exp $
# map: file(1) magic for Map data
#

17
contrib/file/magic/Magdir/meteorological
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: meteorological,v 1.4 2022/12/09 18:02:09 christos Exp $
# $File: meteorological,v 1.6 2024/11/10 17:05:08 christos Exp $
# rinex: file(1) magic for RINEX files
# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
@ -44,10 +44,21 @@
!:mime rinex/observation
# https://en.wikipedia.org/wiki/GRIB
# https://www.iana.org/assignments/media-types/application/grib
0 string GRIB
>7 byte =1 Gridded binary (GRIB) version 1
!:mime application/x-grib
!:mime application/grib;edition=1
!:ext grb/grib
>7 byte =2 Gridded binary (GRIB) version 2
!:mime application/x-grib2
!:mime application/grib;edition=2
!:ext grb2/grib2
# BUFR is a meteorological data format for storing point or time series data.
# https://www.iana.org/assignments/media-types/application/bufr
0 string BUFR
>7 byte =3 Binary Universal Form data (BUFR) Edition 3
!:mime application/bufr
!:ext bufr
>7 byte =4 Binary Universal Form data (BUFR) Edition 4
!:mime application/bufr
!:ext bufr

172
contrib/file/magic/Magdir/mips
View file

@ -1,120 +1,102 @@
#------------------------------------------------------------------------------
# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
# $File: mips,v 1.15 2024/09/01 13:49:15 christos Exp $
# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
# and DEC Ultrix
#
0 beshort 0x0160 MIPSEB ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
0 name display-mips-ecoff
>20 leshort 0407 (impure)
>20 leshort 0410 (swapped)
>20 leshort 0413 (paged)
>8 lelong !0 not stripped
>8 lelong 0 stripped
>22 byte x - version %d
>23 byte x \b.%d
#
0 beshort 0x0162 MIPSEL-BE ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x \b.%d
# MIPS 1
#
0 beshort 0x6001 MIPSEB-LE ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x \b.%d
0 beshort 0x0160
>16 beshort 56 MIPSEB ECOFF executable
>>0 use \^display-mips-ecoff
>16 leshort 0
>>0 use display-coff
#
0 beshort 0x6201 MIPSEL ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x \b.%d
0 beshort 0x0162
>16 beshort 56 MIPSEL-BE ECOFF executable
>>0 use \^display-mips-ecoff
#
0 leshort 0x0160
>16 leshort 56 MIPSEB-LE ECOFF executable
>>0 use display-mips-ecoff
>16 leshort 0
>>0 use display-coff
#
0 leshort 0x0162
>16 leshort 56 MIPSEL ECOFF executable
>>0 use display-mips-ecoff
#
# MIPS 2 additions
#
0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %d
>23 byte x \b.%d
0 beshort 0x0163
>16 beshort 56 MIPSEB MIPS-II ECOFF executable
>>0 use \^display-mips-ecoff
#
0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %d
>23 byte x \b.%d
0 beshort 0x0166
>16 beshort 56 MIPSEL-BE MIPS-II ECOFF executable
>>0 use \^display-mips-ecoff
>16 leshort 0
>>0 use display-coff
#
0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x \b.%d
0 leshort 0x0163
>16 leshort 56 MIPSEB-LE MIPS-II ECOFF executable
>>0 use display-mips-ecoff
#
0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x \b.%d
0 leshort 0x0166
>16 leshort 56 MIPSEL MIPS-II ECOFF executable
>>0 use display-mips-ecoff
#
# MIPS 3 additions
#
0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %d
>23 byte x \b.%d
0 beshort 0x0140
>16 beshort 56 MIPSEB MIPS-III ECOFF executable
>>0 use \^display-mips-ecoff
#
0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %d
>23 byte x \b.%d
0 beshort 0x0142
>16 beshort 56 MIPSEL-BE MIPS-III ECOFF executable
>>0 use \^display-mips-ecoff
#
0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x \b.%d
0 leshort 0x0140
>16 leshort 56 MIPSEB-LE MIPS-III ECOFF executable
>>0 use display-mips-ecoff
#
0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x \b.%d
0 leshort 0x0142
>16 leshort 56 MIPSEL MIPS-III ECOFF executable
>>0 use display-mips-ecoff
#
# MIPS Ucode additions
#
0 beshort 0x180 MIPSEB Ucode
0 beshort 0x182 MIPSEL-BE Ucode
#
# MIPS COFF object file (have zero length optional header)
#
0 leshort 0x0168
>16 leshort 0
>>0 use display-coff
# can be created by LINK.EXE /MACHINE:MIPSR10 /ROM
>16 leshort !0
>>18 leshort &0x0002
>>>20 leshort 0x0107
>>>>0 use display-coff
0 leshort 0x0169
>16 leshort 0
>>0 use display-coff
0 leshort 0x0266
>16 leshort 0
>>0 use display-coff
0 leshort 0x0366
>16 leshort 0
>>0 use display-coff
0 leshort 0x0466
>16 leshort 0
>>0 use display-coff

23
contrib/file/magic/Magdir/mmdf
View file

@ -1,6 +1,25 @@
#------------------------------------------------------------------------------
# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
# $File: mmdf,v 1.7 2024/02/29 03:40:37 christos Exp $
# mmdf: file(1) magic for MMDF mail files
# Update: Joerg Jenderek Feb 2024
# URL: https://en.wikipedia.org/wiki/MMDF
# Reference: https://docs.oracle.com/cd/E88353_01/html/E37852/mmdf-5.html
# Note: Multi-channel Memorandum Distribution Facility (MMDF) mailbox format is a legacy variant of mbox format
# (handled by ./mail.news); each message is surrounded by lines containing 4 control-A
#
0 string \001\001\001\001 MMDF mailbox
0 string \001\001\001\001
# GRR: MMDF mailbox (strength=70=70+0 ./mmdf) after D64 Image (strength=70=70+0 ./c64) Targa image data (strength=70=110-40 ./images)
# and before "PDP-11 UNIX/RT ldp" (strength=50=50+0 ./pdp)
#!:strength +0
# skip few Commodore disc Image where first content are initialized with ^A like "The Great Gianna Sisters.d64"
# by looking for following valid line terminator (10=0Ah~LineFeed or 13=0Dh~CarriageReturn)
#>4 ubyte&0xF8 =0x08 MMDF mailbox
# or by looking for MBOX Mailbox (/mail.news) characteristic like:
# https://github.com/dfandrich/oldmailconvert/blob/master/testdata/uupc.input.1
>5 search/610/b From\ MMDF mailbox
#!:mime application/octet-stream
!:mime message/x-mmdf
# https://github.com/dfandrich/oldmailconvert/blob/master/testdata/maillog.expected.2
# but default mailbox name is like /usr/spool/mail/username
!:ext /mmdf

8
contrib/file/magic/Magdir/motorola
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: motorola,v 1.12 2021/04/26 15:56:00 christos Exp $
# $File: motorola,v 1.13 2024/02/11 21:25:17 christos Exp $
# motorola: file(1) magic for Motorola 68K and 88K binaries
#
# 68K
@ -18,6 +18,12 @@
>12 belong >0 not stripped
0 beshort 0522 mc68k executable (shared demand paged)
>12 belong >0 not stripped
# Motorola 68000 COFF object file
0 leshort 0x0268
>16 leshort 0
>>0 use display-coff
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#

1315
contrib/file/magic/Magdir/msdos
View file

File diff suppressed because it is too large Load diff

37
contrib/file/magic/Magdir/msooxml
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msooxml,v 1.19 2023/03/14 19:46:15 christos Exp $
# $File: msooxml,v 1.23 2024/07/19 18:48:23 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
@ -38,31 +38,40 @@
# since some documents include a 520-byte extra field following the file
# header, we need to scan for the next header
>>>(18.l+49) search/6000 PK\003\004
>>>>&26 use msooxml
>>>>&26 default x
# now skip to the *third* local file header; again, we need to scan due to a
# 520-byte extra field following the file header
>>>>&26 search/6000 PK\003\004
>>>>>&26 search/6000 PK\003\004
# and check the subdirectory name to determine which type of OOXML
# file we have. Correct the mimetype with the registered ones:
# file we have. Correct the mimetype with the registered ones:
# https://technet.microsoft.com/en-us/library/cc179224.aspx
>>>>>&26 use msooxml
>>>>>&26 default x
>>>>>>&26 use msooxml
>>>>>>&26 default x
# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
>>>>>>&26 search/6000 PK\003\004
>>>>>>>&26 use msooxml
>>>>>>>&26 search/6000 PK\003\004
>>>>>>>>&26 use msooxml
# Some OOXML generators add an extra customXml directory. Check another file.
>>>>>>>&26 default x
>>>>>>>>&26 search/6000 PK\003\004
>>>>>>>>>&26 use msooxml
>>>>>>>>&26 default x
>>>>>>>>>&26 search/6000 PK\003\004
>>>>>>>>>>&26 use msooxml
>>>>>>>>>>&26 default x
>>>>>>>>>>>&26 search/6000 PK\003\004
>>>>>>>>>>>>&26 use msooxml
>>>>>>>>>>>>&26 default x Microsoft OOXML
>>>>>>>>>>>&26 default x Microsoft OOXML
>>>>>>>>>>&26 default x Microsoft OOXML
>>>>>>>>>&26 default x Microsoft OOXML
>>>>>>>>&26 default x Microsoft OOXML
>>>>>>>&26 default x Microsoft OOXML
>>>>>&26 default x Microsoft OOXML
>>>>>>&26 default x Microsoft OOXML
>>0x1E regex \\[trash\\]
>>>&26 search/6000 PK\003\004
>>>>&26 search/6000 PK\003\004
>>>>>&26 use msooxml
>>>>>&26 default x
>>>>>&26 use msooxml
>>>>>&26 default x
>>>>>>&26 search/6000 PK\003\004
>>>>>>>&26 use msooxml
>>>>>>>&26 use msooxml
>>>>>>>&26 default x Microsoft OOXML
>>>>>>&26 default x Microsoft OOXML
>>>>>&26 default x Microsoft OOXML

13
contrib/file/magic/Magdir/msvc
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: msvc,v 1.11 2022/01/17 17:17:30 christos Exp $
# $File: msvc,v 1.12 2024/03/31 15:08:13 christos Exp $
# msvc: file(1) magic for msvc
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Microsoft visual C
@ -15,9 +15,14 @@
0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
# .res
0 string \000\000\000\000\040\000\000\000\377 MSVC .res
0 string \377\003\000\377\001\000\020\020\350 MSVC .res
0 string \377\003\000\377\001\000\060\020\350 MSVC .res
# https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats
# https://learn.microsoft.com/en-us/windows/win32/menurc/resourceheader
# A binary resource file consists of a number of concatenated resource entries.
# Each entry consists of a resource header and the data for that resource.
# Resource file starts with an empty resource entry with 32-byte long header in
# which is stored ordinal type 0 and ordinal name 0.
0 string \000\000\000\000\040\000\000\000\377\377\000\000\377\377\000\000 Microsoft Visual C binary resource file
!:ext res
#.lib
# URL: https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B

31
contrib/file/magic/Magdir/msx
View file

@ -1,5 +1,6 @@
#------------------------------------------------------------------------------
# $File: msx,v 1.12 2024/08/30 17:29:28 christos Exp $
# msx: file(1) magic for the MSX Home Computer
# v1.3
# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
@ -202,21 +203,6 @@
>>4 uleshort >0 \b, stahdl=%#04x
>>6 uleshort >0 \b, devhdl=%#04x
>>8 uleshort >0 \b, bas=%#04x
0 string/b AB\0\0
>6 uleshort 0
>>4 uleshort >0x400F MSX-BASIC extension ROM
>>>4 uleshort >0 \b, stahdl=%#04x
>>>6 uleshort >0 \b, devhdl=%#04x
>>>0x1C string OPLL \b, MSX-Music
>>>>0x18 string PAC2 \b (external)
>>>>0x18 string APRL \b (internal)
0 string/b AB\0\0\0\0
>6 uleshort >0x400F MSX device BIOS
>>6 uleshort >0 \b, devhdl=%#04x
0 string/b AB
#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM
#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM
#>3 string @3\x80IA862 Golvellius MSX1 ROM
@ -242,6 +228,21 @@
>>>>>6 uleshort 0
>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=%#04x
0 string/b AB\0\0
>6 uleshort 0
>>4 uleshort >0x400F MSX-BASIC extension ROM
>>>4 uleshort >0 \b, stahdl=%#04x
>>>6 uleshort >0 \b, devhdl=%#04x
>>>0x1C string OPLL \b, MSX-Music
>>>>0x18 string PAC2 \b (external)
>>>>0x18 string APRL \b (internal)
0 string/b AB\0\0\0\0
>6 uleshort >0x400F MSX device BIOS
>>6 uleshort >0 \b, devhdl=%#04x
0x4000 string/b AB
>0x4002 uleshort >0x400F
>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order

4
contrib/file/magic/Magdir/music
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
# music: file (1) magic for music formats
# $File: music,v 1.2 2024/06/10 23:09:52 christos Exp $
# music: file(1) magic for music formats
# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
# and Bagpipe Writer by Doug Wickstrom

3
contrib/file/magic/Magdir/nasa
View file

@ -1,6 +1,7 @@
#------------------------------------------------------------------------------
# nasa: file(1) magic
# $File: nasa,v 1.3 2024/06/10 23:09:52 christos Exp $
# nasa: file(1) magic for NASA SPICE file
# From: Barry Carter <carter.barry@gmail.com>
0 string DAF/SPK NASA SPICE file (binary format)

54
contrib/file/magic/Magdir/ole2compounddocs
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: ole2compounddocs,v 1.26 2023/05/15 16:46:12 christos Exp $
# $File: ole2compounddocs,v 1.29 2024/06/18 17:07:48 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.
@ -319,6 +319,18 @@
#>>>>>>&0 use PageMaker
# THIS WORKS PARTLY!
>>>>>>&0 indirect x
#
# URL: http://fileformats.archiveteam.org/wiki/Easy_CD_Creator
# From: Joerg Jenderek
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cl4.trid.xml
# Note: called "Easy CD Creator Layout" by TrID
# "newer" version 4 contain a clsid
# Second directory entry name Contents
>>>>128 lestring16 Contents : Easy CD Creator 2 Layout
# contains also 3 strings SesnDescriptor CD_PLUS 0090
#!:mime application/x-ole-storage
!:mime application/x-corel-cl2
!:ext cl2
# remaining null clsid
>>>>128 default x
>>>>>0 use ole2-unknown
@ -503,10 +515,17 @@
# https://extension.nirsoft.net/wsb
# like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
!:ext wsb
#??
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
#
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pub.trid.xml
# Note: called like "Microsoft Publisher document" by TrID
# "version" string MSPublisher.2 inside CompObj stream
>>88 ubequad 0x00c0000000000046 : Microsoft
>>>80 ubequad 0x0112020000000000 Publisher
>>>80 ubequad 0x0012020000000000 Publisher 95 (2.0)
!:mime application/vnd.ms-publisher
!:ext pub
>>>80 ubequad 0x0112020000000000 Publisher 97-2013 (3.0-11.0)
!:mime application/vnd.ms-publisher
!:ext pub
#
@ -731,6 +750,33 @@
!:ext max
# also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
#!:ext max/chr
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/IPT
# https://en.wikipedia.org/wiki/Autodesk_Inventor
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/ipt.trid.xml
# Note: called "Autodesk Inventor Part" by TrID
# second, third, fifth and seventh directory entry name like RSeStorage RSeEmbeddings RefdFiles RSeDb
>>88 ubequad 0x93c37e0706000000 : Autodesk
>>>80 ubequad 0x90b4294db249d011 Inventor Part
#!:mime application/x-ole-storage
!:mime model/x-autodesk-ipt
!:ext ipt
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Easy_CD_Creator
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cl4.trid.xml
# Note: called "Easy CD Creator Layout" by TrID,
# "Easy CD Creator 4" by CREATR32.exe and "Easy CD Creator Document" on Windows
# verified by Michal Mutl Structured Storage Viewer `SSView.exe MY_CD3.cl4`
# verified partly by libolecf-utils `olecfinfo -v MY_CD4.cl4`
# created by Adaptec Easy CD Creator 4.02b
# "older" version 2 contain no clsid
>>88 ubequad 0x893f00802964b632 : Easy
>>>80 ubequad 0x0293c3a90a77d111 CD Creator 4 Layout
#!:mime application/x-ole-storage
!:mime application/x-corel-cl4
!:ext cl4
# maybe also suffix cl3
#!:ext cl3/cl4
# remaining non null clsid
>>88 default x
>>>0 use ole2-unknown

14
contrib/file/magic/Magdir/olf
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
# $File: olf,v 1.5 2024/02/29 03:42:40 christos Exp $
# olf: file(1) magic for OLF executables
#
# We have to check the byte order flag to see what byte order all the
@ -43,11 +43,11 @@
>>18 leshort 0 no machine,
>>18 leshort 1 AT&T WE32100 - invalid byte order,
>>18 leshort 2 SPARC - invalid byte order,
>>18 leshort 3 Intel 80386,
>>18 leshort 3 Intel i386,
>>18 leshort 4 Motorola 68000 - invalid byte order,
>>18 leshort 5 Motorola 88000 - invalid byte order,
>>18 leshort 6 Intel 80486,
>>18 leshort 7 Intel 80860,
>>18 leshort 6 Intel i486,
>>18 leshort 7 Intel i860,
>>18 leshort 8 MIPS R3000_BE - invalid byte order,
>>18 leshort 9 Amdahl - invalid byte order,
>>18 leshort 10 MIPS R3000_LE,
@ -74,11 +74,11 @@
>>18 beshort 0 no machine,
>>18 beshort 1 AT&T WE32100,
>>18 beshort 2 SPARC,
>>18 beshort 3 Intel 80386 - invalid byte order,
>>18 beshort 3 Intel i386 - invalid byte order,
>>18 beshort 4 Motorola 68000,
>>18 beshort 5 Motorola 88000,
>>18 beshort 6 Intel 80486 - invalid byte order,
>>18 beshort 7 Intel 80860,
>>18 beshort 6 Intel i486 - invalid byte order,
>>18 beshort 7 Intel i860,
>>18 beshort 8 MIPS R3000_BE,
>>18 beshort 9 Amdahl,
>>18 beshort 10 MIPS R3000_LE - invalid byte order,

101
contrib/file/magic/Magdir/pack Normal file
View file

@ -0,0 +1,101 @@
#------------------------------------------------------------------------------
# $File: pack,v 1.1 2024/08/30 17:29:28 christos Exp $
# file(1) magic for things that have PACK as magic
0 string PACK
# Type: Git pack
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Git
# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
# those have a little-endian offset immediately following the magic 'PACK',
# the first byte of which is never 0, while the first byte of the Git pack
# version, since it's a tiny number stored in big-endian format, is always 0.
# GRR: line above is too general as it matches also PackDir archive ./acorn
# test for major version. Git 2017 accepts version number 2 or 3
>4 ubelong <9
# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
# or SystemDevice::foobar
>>9 search/13 ::
# but in git binary
>>9 default x Git pack
!:mime application/x-git
!:ext pack
# 4 GB limit implies unsigned integer
>>>4 ubelong x \b, version %u
>>>8 ubelong x \b, %u objects
# From: Joerg Jenderek
# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
# GRR: line below is too general as it matches also "Git pack" in ./revision
# check for valid compression method 0-4
>5 ulelong <5
# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
# To skip "Git pack" version 0 test for root directory object like
# ADFS::RPC.$.websitezip.FONTFIX
>>9 string >ADFS\ PackDir archive (RISC OS)
# TrID labels above as "Acorn PackDir compressed Archive"
# compression mode y (0 - 4) for GIF LZW with a maximum n bits
# (y~n,0~12,1~13,2~14,3~15,4~16)
>>>5 ulelong+12 x \b, LZW %u-bits compression
# https://www.filebase.org.uk/filetypes
# !Packdir compressed archive has three hexadecimal digits code 68E
!:mime application/x-acorn-68E
!:ext pkd/bin
# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
>>>9 string x \b, root "%s"
# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
>>>>&1 ulelong x \b, load address %#x
# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
>>>>&5 ulelong x \b, exec address %#x
# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
>>>>&9 ulelong x \b, attributes %#x
# number of entries in this directory. for root dir 0
#>>>&13 ulelong x \b, entries %#x
# the entries start here with object name
>>>>&17 string x \b, 1st object "%s"
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/PAK
# reference: https://quakewiki.org/wiki/.pak
# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
# real Quake examples like pak0.pak have only some hundreds like 150 files
# So test for few files
>8 ulelong <0x01000000
# in file version 5.32 test for null terminator is only true for
# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h
# look for null terminator of 1st entry name
>>(4.l+55) ubyte 0 Quake I or II world or extension
!:mime application/x-dzip
!:ext pak
#>>>8 ulelong x \b, table size %u
# dividing this by entry size (64) gives number of files
>>>8 ulelong/64 x \b, %u files
# offset to the beginning of the file table
>>>4 ulelong x \b, offset %#x
# 1st file entry
>>>(4.l) use pak-entry
# 2nd file entry
#>>>4 ulelong+64 x \b, offset %#x
#>>>(4.l+64) use pak-entry
#
# display file table entry of Quake PAK archive
0 name pak-entry
# normally entry start after header which implies offset 12 or higher
>56 ulelong >11
# the offset from the beginning of pak to beginning of this entry file contents
>>56 ulelong x at %#x
# the size of file for this entry
>>60 ulelong x %u bytes
# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
>>0 string x '%-.56s'
# inspect entry content by jumping to entry offset
>>(56) indirect x \b:
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
#>61 string x level %s
#0 string 5\x0a Quake I save

24
contrib/file/magic/Magdir/pc88
View file

@ -1,24 +0,0 @@
#------------------------------------------------------------------------------
# pc88: file(1) magic for the NEC Home Computer
# v1.0
# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
# PC88 2D disk image
0x20 ulelong&0xFFFFFEFF 0x2A0
>0x10 string \0\0\0\0\0\0\0\0\0\0
>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>>>0x1A ubyte&0xEF 0
>>>>0x1B ubyte&0x8F 0
>>>>>0x1B ubyte&70 <0x40
>>>>>>0x1C ulelong >0x21
>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
>>>>>>>>0x1B ubyte 0 \b, media=2D
>>>>>>>>0x1B ubyte 0x10 \b, media=2DD
>>>>>>>>0x1B ubyte 0x20 \b, media=2HD
>>>>>>>>0x1B ubyte 0x30 \b, media=1D
>>>>>>>>0x1B ubyte 0x40 \b, media=1DD
>>>>>>>>0x1A ubyte 0x10 \b, write-protected

16
contrib/file/magic/Magdir/pdp
View file

@ -1,7 +1,8 @@
#------------------------------------------------------------------------------
# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
# $File: pdp,v 1.12 2024/02/29 03:40:37 christos Exp $
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
# URL: https://en.wikipedia.org/wiki/PDP-11
#
0 lelong 0101555 PDP-11 single precision APL workspace
0 lelong 0101554 PDP-11 double precision APL workspace
@ -12,13 +13,22 @@
>8 leshort >0 not stripped
>15 byte >0 - version %d
# updated by Joerg Jenderek at Mar 2013
# updated by Joerg Jenderek at Mar 2013, Feb 2024
# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
0 leshort 0401
# PDP-11 UNIX/RT ldp (strength=50=50+0) after D64 Image (strength=70=70+0 ./c64) and MMDF mailbox (strength=70=70+0 ./mmdf)
#!:strength +0
# skip *.PNF with WinDirPathOffset 58h
>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp
>68 ulelong !0x00000058
# skip *.PNF with high byte of InfVersionDatumCount zero
#>>15 byte !0 PDP-11 UNIX/RT ldp
# skip few Commodore D64 disc image like "The Great Gianna Sisters.d64" initialized with ^A and handled by ./c64
>>8 quad !0x0101010101010101
# skip MMDF mailbox like maillog.expected.2 with MBOX characteristic near the beginning handled by ./mmdf
>>>5 search/610/b From\
>>>5 default x PDP-11 UNIX/RT ldp
#!:mime application/octet-stream
#!:ext foo
0 leshort 0405 PDP-11 old overlay
0 leshort 0410 PDP-11 pure executable

140
contrib/file/magic/Magdir/pgp
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: pgp,v 1.25 2021/04/26 15:56:00 christos Exp $
# $File: pgp,v 1.26 2024/09/01 15:51:51 christos Exp $
# pgp: file(1) magic for Pretty Good Privacy
# Handling of binary PGP keys is in pgp-binary-keys.
@ -108,15 +108,15 @@
>7 belong x %08X
>11 byte 0x01 RSA (Encrypt or Sign) 1024b
>11 byte 0x02 RSA Encrypt-Only 1024b
>12 string \x04\x00
>12 string \x03\xff
>12 string \x03\xfe
>12 string \x03\xfd
>12 string \x03\xfc
>12 string \x03\xfb
>12 string \x03\xfa
>12 string \x03\xf9
>142 byte 0xd2 .
#>12 string \x04\x00
#>12 string \x03\xff
#>12 string \x03\xfe
#>12 string \x03\xfd
#>12 string \x03\xfc
#>12 string \x03\xfb
#>12 string \x03\xfa
#>12 string \x03\xf9
#>142 byte 0xd2 .
# 2048b RSA encrypted data
@ -125,15 +125,15 @@
>8 belong x %08X
>12 byte 0x01 RSA (Encrypt or Sign) 2048b
>12 byte 0x02 RSA Encrypt-Only 2048b
>13 string \x08\x00
>13 string \x07\xff
>13 string \x07\xfe
>13 string \x07\xfd
>13 string \x07\xfc
>13 string \x07\xfb
>13 string \x07\xfa
>13 string \x07\xf9
>271 byte 0xd2 .
#>13 string \x08\x00
#>13 string \x07\xff
#>13 string \x07\xfe
#>13 string \x07\xfd
#>13 string \x07\xfc
#>13 string \x07\xfb
#>13 string \x07\xfa
#>13 string \x07\xf9
#>271 byte 0xd2 .
# 3072b RSA encrypted data
@ -142,15 +142,15 @@
>8 belong x %08X
>12 byte 0x01 RSA (Encrypt or Sign) 3072b
>12 byte 0x02 RSA Encrypt-Only 3072b
>13 string \x0c\x00
>13 string \x0b\xff
>13 string \x0b\xfe
>13 string \x0b\xfd
>13 string \x0b\xfc
>13 string \x0b\xfb
>13 string \x0b\xfa
>13 string \x0b\xf9
>399 byte 0xd2 .
#>13 string \x0c\x00
#>13 string \x0b\xff
#>13 string \x0b\xfe
#>13 string \x0b\xfd
#>13 string \x0b\xfc
#>13 string \x0b\xfb
#>13 string \x0b\xfa
#>13 string \x0b\xf9
#>399 byte 0xd2 .
# 4096b RSA encrypted data
@ -159,15 +159,15 @@
>8 belong x %08X
>12 byte 0x01 RSA (Encrypt or Sign) 4096b
>12 byte 0x02 RSA Encrypt-Only 4096b
>13 string \x10\x00
>13 string \x0f\xff
>13 string \x0f\xfe
>13 string \x0f\xfd
>13 string \x0f\xfc
>13 string \x0f\xfb
>13 string \x0f\xfa
>13 string \x0f\xf9
>527 byte 0xd2 .
#>13 string \x10\x00
#>13 string \x0f\xff
#>13 string \x0f\xfe
#>13 string \x0f\xfd
#>13 string \x0f\xfc
#>13 string \x0f\xfb
#>13 string \x0f\xfa
#>13 string \x0f\xf9
#>527 byte 0xd2 .
# 8192b RSA encrypted data
@ -176,15 +176,15 @@
>8 belong x %08X
>12 byte 0x01 RSA (Encrypt or Sign) 8192b
>12 byte 0x02 RSA Encrypt-Only 8192b
>13 string \x20\x00
>13 string \x1f\xff
>13 string \x1f\xfe
>13 string \x1f\xfd
>13 string \x1f\xfc
>13 string \x1f\xfb
>13 string \x1f\xfa
>13 string \x1f\xf9
>1039 byte 0xd2 .
#>13 string \x20\x00
#>13 string \x1f\xff
#>13 string \x1f\xfe
#>13 string \x1f\xfd
#>13 string \x1f\xfc
#>13 string \x1f\xfb
#>13 string \x1f\xfa
#>13 string \x1f\xf9
#>1039 byte 0xd2 .
# 1024b Elgamal encrypted data
@ -192,14 +192,14 @@
>4 belong x keyid: %08X
>8 belong x %08X
>12 byte 0x10 Elgamal Encrypt-Only 1024b.
>13 string \x04\x00
>13 string \x03\xff
>13 string \x03\xfe
>13 string \x03\xfd
>13 string \x03\xfc
>13 string \x03\xfb
>13 string \x03\xfa
>13 string \x03\xf9
#>13 string \x04\x00
#>13 string \x03\xff
#>13 string \x03\xfe
#>13 string \x03\xfd
#>13 string \x03\xfc
#>13 string \x03\xfb
#>13 string \x03\xfa
#>13 string \x03\xf9
# 2048b Elgamal encrypted data
@ -207,14 +207,14 @@
>4 belong x keyid: %08X
>8 belong x %08X
>12 byte 0x10 Elgamal Encrypt-Only 2048b.
>13 string \x08\x00
>13 string \x07\xff
>13 string \x07\xfe
>13 string \x07\xfd
>13 string \x07\xfc
>13 string \x07\xfb
>13 string \x07\xfa
>13 string \x07\xf9
#>13 string \x08\x00
#>13 string \x07\xff
#>13 string \x07\xfe
#>13 string \x07\xfd
#>13 string \x07\xfc
#>13 string \x07\xfb
#>13 string \x07\xfa
#>13 string \x07\xf9
# 3072b Elgamal encrypted data
@ -222,14 +222,14 @@
>4 belong x keyid: %08X
>8 belong x %08X
>12 byte 0x10 Elgamal Encrypt-Only 3072b.
>13 string \x0c\x00
>13 string \x0b\xff
>13 string \x0b\xfe
>13 string \x0b\xfd
>13 string \x0b\xfc
>13 string \x0b\xfb
>13 string \x0b\xfa
>13 string \x0b\xf9
#>13 string \x0c\x00
#>13 string \x0b\xff
#>13 string \x0b\xfe
#>13 string \x0b\xfd
#>13 string \x0b\xfc
#>13 string \x0b\xfb
#>13 string \x0b\xfa
#>13 string \x0b\xf9
# crypto algo mapper

8
contrib/file/magic/Magdir/plan9
View file

@ -1,13 +1,13 @@
#------------------------------------------------------------------------------
# $File: plan9,v 1.6 2021/07/30 12:25:13 christos Exp $
# $File: plan9,v 1.7 2024/02/29 03:42:40 christos Exp $
# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables and object files
# From: "Stefan A. Haubenthal" <polluks@web.de>
#
0 belong 0x00000107 Plan 9 executable, Motorola 68k
0 belong 0x00000197 Plan 9 executable, AT&T Hobbit
0 belong 0x000001EB Plan 9 executable, Intel 386
0 belong 0x00000247 Plan 9 executable, Intel 960
0 belong 0x000001EB Plan 9 executable, Intel i386
0 belong 0x00000247 Plan 9 executable, Intel i960
0 belong 0x000002AB Plan 9 executable, SPARC
0 belong 0x00000407 Plan 9 executable, MIPS R3000
0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
@ -22,4 +22,4 @@
0 belong 0x430D013C Plan 9 object file, AT&T Hobbit
0 belong 0x4D013201 Plan 9 object file, Motorola 68k
0 belong 0x7410013C Plan 9 object file, SPARC
0 belong 0x7E004501 Plan 9 object file, Intel 386
0 belong 0x7E004501 Plan 9 object file, Intel i386

28
contrib/file/magic/Magdir/printer
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: printer,v 1.34 2023/06/16 19:27:12 christos Exp $
# $File: printer,v 1.36 2024/08/27 18:50:57 christos Exp $
# printer: file(1) magic for printer-formatted files
#
@ -86,19 +86,6 @@
# (LANGUAGE and Language)
# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
#
0 string \033%-12345X@PJL HP Printer Job Language data
>&0 string >\0 %s
>>&0 string >\0 %s
>>>&0 string >\0 %s
>>>>&0 string >\0 %s
#>15 string \ ENTER\ LANGUAGE\ =
#>31 string PostScript PostScript
# From: Stefan Thurner <thurners@nicsys.de>
0 string \033%-12345X@PJL
>&0 search/10000 %! PJL encapsulated PostScript document text
# Rick Richardson <rickrich@gmail.com>
# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
@ -106,13 +93,14 @@
# For Konica Minolta Printers - LAVAFLOW
# For Samsung Printers - QPDL
# For HP Printers - ZJS stands for Zenographics ZJStream
0 string \033%-12345X@PJL HP Printer Job Language data
>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL
>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC
>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW
>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL
>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL
>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS
# From: Stefan Thurner <thurners@nicsys.de>
>&0 search/10000 %! PJL encapsulated PostScript document text
# Summary: Hewlett-Packard printer firmware update
# From: Joerg Jenderek
# URL: https://support.hp.com/us-en/drivers/selfservice/hp-envy-6000e-all-in-one-printer-series/2100187505/model/2100187513
@ -230,8 +218,9 @@
0 string PS4
>0 use hpgl
# la.hp
0 string BP
>0 use hpgl
# Too weak
#0 string BP
#>0 use hpgl
# miter.hp
# Plot Absolute x,y{,x,y{...}}; x and y in range between -32767 and 32768 like: PA4000,3000;
0 string PA
@ -241,8 +230,9 @@
#>2 regex \^([-]{0,1}[0-9]{1,5}) COORDINATE=%s
>>0 use hpgl
# pw.hpg number of pens x
0 string NP
>0 use hpgl
# Too weak
#0 string NP
#>0 use hpgl
# win_1.hp
#0 string \003INCA WHAT_IS_THAT
#>0 use hpgl

33
contrib/file/magic/Magdir/python
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: python,v 1.45 2022/07/24 23:59:37 christos Exp $
# $File: python,v 1.47 2024/08/27 18:50:57 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
@ -191,6 +191,7 @@
# magic 3392+ implements PEP 552: Deterministic pycs
0 name pyc-pep552
>0 uleshort x (magic: %04d),
# the flag field determines how .pyc validity is checked
>4 ulelong&1 0 timestamp-based,
>>8 uledate x .py timestamp: %s UTC,
@ -208,24 +209,28 @@
>>1 ubyte 0x0d Byte-compiled Python module for
!:mime application/x-bytecode.python
# now look at the magic number to determine the version
>>>0 uleshort <3400 CPython 3.7,
>>>0 uleshort <3400 CPython 3.7
>>>0 default x
>>>>0 uleshort <3420 CPython 3.8,
>>>>0 uleshort <3420 CPython 3.8
>>>>0 default x
>>>>>0 uleshort <3430 CPython 3.9,
>>>>>0 uleshort <3430 CPython 3.9
>>>>>0 default x
>>>>>>0 uleshort <3450 CPython 3.10,
>>>>>>0 uleshort <3450 CPython 3.10
>>>>>>0 default x
>>>>>>>0 uleshort <3500 CPython 3.11,
>>>>>>>0 default x CPython 3.12 or newer,
>>>>>>>0 uleshort <3500 CPython 3.11
>>>>>>>0 default x
>>>>>>>>0 uleshort <3550 CPython 3.12
>>>>>>>>0 default x
>>>>>>>>>0 uleshort <3600 CPython 3.13
>>>>>>>>>0 default x CPython 3.14 or newer
>>>0 use pyc-pep552
>>0 uleshort 240 Byte-compiled Python module for PyPy3.7,
>>0 uleshort 240 Byte-compiled Python module for PyPy3.7
!:mime application/x-bytecode.python
>>>0 use pyc-pep552
>>0 uleshort 256 Byte-compiled Python module for PyPy3.8,
>>0 uleshort 256 Byte-compiled Python module for PyPy3.8
!:mime application/x-bytecode.python
>>>0 use pyc-pep552
>>0 uleshort 336 Byte-compiled Python module for PyPy3.9,
>>0 uleshort 336 Byte-compiled Python module for PyPy3.9
!:mime application/x-bytecode.python
>>>0 use pyc-pep552
@ -245,6 +250,9 @@
>0 regex \^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$ Python script text executable
!:strength + 15
!:mime text/x-script.python
>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
!:mime text/x-script.python
# def __init__ (self, ...):
0 search/4096 def\ __init__
@ -259,11 +267,6 @@
!:strength + 15
!:mime text/x-script.python
# import module [as abrev]
0 search/8192 import
>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
!:mime text/x-script.python
# comments
#0 search/4096 '''
#>&0 regex .*'''$ Python script text executable

27
contrib/file/magic/Magdir/revision
View file

@ -1,7 +1,8 @@
#------------------------------------------------------------------------------
# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $
# $File: revision,v 1.12 2024/08/30 17:29:28 christos Exp $
# file(1) magic for revision control files
# From Hendrik Scholz <hendrik@scholz.net>
0 string/t /1\ :pserver: cvs password text file
@ -13,30 +14,6 @@
# From: Josh Triplett <josh@freedesktop.org>
0 string #\ v2\ git\ bundle\n Git bundle
# Type: Git pack
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Git
# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
# those have a little-endian offset immediately following the magic 'PACK',
# the first byte of which is never 0, while the first byte of the Git pack
# version, since it's a tiny number stored in big-endian format, is always 0.
0 string PACK
# GRR: line above is too general as it matches also PackDir archive ./acorn
# test for major version. Git 2017 accepts version number 2 or 3
>4 ubelong <9
# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
# or SystemDevice::foobar
>>9 search/13 ::
# but in git binary
>>9 default x Git pack
!:mime application/x-git
!:ext pack
# 4 GB limit implies unsigned integer
>>>4 ubelong x \b, version %u
>>>8 ubelong x \b, %u objects
# Type: Git pack index
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
0 string \377tOc Git pack index

89
contrib/file/magic/Magdir/riff
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: riff,v 1.45 2022/07/24 23:47:49 christos Exp $
# $File: riff,v 1.50 2024/04/13 16:40:48 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
@ -140,24 +140,39 @@
>>&(4.l+4) use riff-walk
>0 string fact
>>&(4.l+4) use riff-walk
>0 string VP8
# https://developers.google.com/speed/webp/docs/riff_container
>0 string VP8\x20
>>11 byte 0x9d
>>>12 byte 0x01
>>>>13 byte 0x2a \b, VP8 encoding
>>>>>14 leshort&0x3fff x \b, %d
>>>>>16 leshort&0x3fff x \bx%d, Scaling:
>>>>>14 leshort&0xc000 0x0000 \b [none]
>>>>>14 leshort&0xc000 0x1000 \b [5/4]
>>>>>14 leshort&0xc000 0x2000 \b [5/3]
>>>>>14 leshort&0xc000 0x3000 \b [2]
>>>>>14 leshort&0xc000 0x0000 \bx[none]
>>>>>14 leshort&0xc000 0x1000 \bx[5/4]
>>>>>14 leshort&0xc000 0x2000 \bx[5/3]
>>>>>14 leshort&0xc000 0x3000 \bx[2]
>>>>>14 leshort&0xc000 0x4000 \b [5/4]
>>>>>14 leshort&0xc000 0x8000 \b [5/3]
>>>>>14 leshort&0xc000 0xc000 \b [2]
>>>>>16 leshort&0xc000 0x0000 \bx[none]
>>>>>16 leshort&0xc000 0x4000 \bx[5/4]
>>>>>16 leshort&0xc000 0x8000 \bx[5/3]
>>>>>16 leshort&0xc000 0xc000 \bx[2]
>>>>>15 byte&0x80 =0x00 \b, YUV color
>>>>>15 byte&0x80 =0x80 \b, bad color specification
>>>>>15 byte&0x40 =0x40 \b, no clamping required
>>>>>15 byte&0x40 =0x00 \b, decoders should clamp
>0 string VP8L
>>8 byte 0x2f \b, lossless
>>>11 byte &0x01 \b, with alpha
>0 string VP8X
>>4 lelong 0x0a
>>>8 byte &0x02 \b, animated
>>>8 byte &0x04 \b, XMP metadata
>>>8 byte &0x08 \b, EXIF metadata
>>>8 byte &0x10 \b, with alpha
>>>8 byte &0x20 \b, ICC profile
# TODO: These two values are off-by-one, for a 64x64 WebP they contain
# 63x63 as there can be no 0x0 file.
>>>12 lelong&0xffffff x \b, %d+1
>>>15 lelong&0xffffff x \bx%d+1
#>0 string x we got %s
#>>&(4.l+4) use riff-walk
@ -332,6 +347,35 @@
# MORE TESTS NEEDED HERE!
#>>>0 use corel-des
#>>>0 use corel-draw
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel)
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/shw-corel.trid.xml
# Note: called "CorelSHOW presentation (v4)" by TrID
# and "Corel Presentation" by DROID via PUID fmt/877
>8 string shw4 \b, CorelSHOW presentation, version 4
#!:mime application/octet-stream
!:mime application/x-corel-shw
!:ext shw
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/shw-corel-5.trid.xml
# Note: called "CorelSHOW presentation (v5)" by TrID
>8 string shw5 \b, CorelSHOW presentation, version 5
#!:mime application/octet-stream
!:mime application/x-corel-shw
!:ext shw
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/shb-corel.trid.xml
# Note: called "CorelSHOW Background (v5)" by TrID
>8 string shl5 \b, CorelSHOW Background, version 5
#!:mime application/octet-stream
!:mime application/x-corel-shb
# GRR: no example
!:ext shb
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/shr-corel.trid.xml
# Note: called "CorelSHOW player data (v5)" by TrID
>8 string shr5 \b, CorelSHOW player data, version 5
#!:mime application/octet-stream
!:mime application/x-corel-shr
# GRR: no example
!:ext shr
>8 string NUNDROOT \b, Steinberg CuBase
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/MIDI_Instrument_Definition_File
@ -354,6 +398,17 @@
>>0x31 search/256 inst by
# probably manufacture name like: "Unspecified Company" "NVidia Corporation"
>>>&0x24 string x "%s"
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Microsoft_Flight_Simulator
# Reference: https://www.fsdeveloper.com/wiki/index.php?title=MDL_file_format_(FSX)
# http://mark0.net/download/triddefs_xml.7z/defs/m/mdl-fs-gen.trid.xml
# Note: called "Microsoft Flight Simulator 3D model (generic)" by TrID
>8 string MDL
>>12 string MDLH \b, Microsoft Flight Simulator 3D model
#!:mime application/x-riff
!:mime application/x-ms-mdl
!:ext mdl
#>>>8 string MDL8 \b, version 8?
# AVI == Audio Video Interleave
# Reference: http://fileformats.archiveteam.org/wiki/AVI
>8 string AVI\040 \b, AVI
@ -650,6 +705,22 @@
!:mime application/x-trid-trd
!:ext trd
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Easy_CD_Creator
# https://en.wikipedia.org/wiki/Roxio
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/img-cif.trid.xml
# Note: called "Easy CD Creator disk image" by TrID,
# "Adaptec CD Image File" by Adaptec CD Creator 2.1.082 1995-1996 and
# "Easy CD/DVD Creator image" by PowerISO 8.5
>8 string imag \b, Easy CD Creator disk image
#!:mime application/octet-stream
#!:mime application/x-riff
!:mime application/x-corel-cif
!:ext cif
# contains also 2 strings disc info
# look for ISO 9660 CD-ROM tag handled by ./filesystems
>>32769 search/4565/s CD001 \b; with
>>>&-32769 use cdrom
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/CorelDRAW
# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW
# Note: Since version 3 CorelDraw Pictures are RIFF based

12
contrib/file/magic/Magdir/rpm
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
# $File: rpm,v 1.13 2023/10/31 21:46:28 christos Exp $
#
# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
#
@ -28,6 +28,11 @@
>>8 beshort 16 PowerPC64
>>8 beshort 17 SuperH
>>8 beshort 18 Xtensa
>>8 beshort 19 AArch64
>>8 beshort 20 MIPSr6
>>8 beshort 21 MIPS64r6
>>8 beshort 22 RISC-V64
>>8 beshort 23 LoongArch64
>>8 beshort 255 noarch
#delta RPM Daniel Novotny (dnovotny@redhat.com)
@ -42,4 +47,9 @@
>>8 beshort 16 PowerPC64
>>8 beshort 17 SuperH
>>8 beshort 18 Xtensa
>>8 beshort 19 AArch64
>>8 beshort 20 MIPSr6
>>8 beshort 21 MIPS64r6
>>8 beshort 22 RISC-V64
>>8 beshort 23 LoongArch64
>>10 string x %s

98
contrib/file/magic/Magdir/sgml
View file

@ -1,45 +1,49 @@
#------------------------------------------------------------------------------
# $File: sgml,v 1.48 2023/01/18 16:10:21 christos Exp $
# $File: sgml,v 1.53 2024/11/10 14:48:55 christos Exp $
# Type: SVG Vectorial Graphics
# From: Noel Torres <tecnico@ejerciciosresueltos.com>
0 string \<?xml\ version=
0 string/bt \<?xml\ version=
>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<svg SVG Scalable Vector Graphics image
!:strength +50
!:mime image/svg+xml
!:ext svg
>>19 search/4096 \<gnc-v2 GnuCash file
!:mime application/x-gnucash
0 string \<svg SVG Scalable Vector Graphics image
0 string/bt \<svg SVG Scalable Vector Graphics image
!:mime image/svg+xml
!:ext svg
# Sitemap file
0 string/t \<?xml\ version=
>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
# Sitemap file
>>19 search/4096 \<urlset XML Sitemap document text
!:mime application/xml-sitemap
# XML-based format representing braille pages in a digital format.
#
# Specification:
# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
#
# Simon Aittamaa <simon.aittamaa@gmail.com>
>>19 search/4096 \<pef Portable Embosser Format
!:mime application/x-pef+xml
# OpenStreetMap XML (.osm)
# https://wiki.openstreetmap.org/wiki/OSM_XML
# From: Markus Heidelberg <markus.heidelberg@web.de>
0 string \<?xml\ version=
>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<osm OpenStreetMap XML data
# xhtml
0 string/t \<?xml\ version="
>19 search/4096/cWbt \<!doctype\ html XHTML document text
>>15 string >\0 (version %.3s)
!:mime text/html
0 string/t \<?xml\ version='
>19 search/4096/cWbt \<!doctype\ html XHTML document text
!:strength + 15
!:mime application/xhtml+xml
>19 search/4096/cWbt \<html\ xmlns= XHTML document text
>>15 string >\0 (version %.3s)
!:mime text/html
0 string/t \<?xml\ version="
>19 search/4096/cWbt \<html broken XHTML document text
>>15 string >\0 (version %.3s)
!:mime text/html
!:mime application/xhtml+xml
#------------------------------------------------------------------------------
# sgml: file(1) magic for Standard Generalized Markup Language
@ -53,11 +57,14 @@
# avoid misdetection as JavaScript
0 string/cWt \<!doctype\ html HTML document text
!:mime text/html
!:strength + 30
0 string/ct \<html> HTML document text
!:mime text/html
!:strength + 30
0 string/ct \<!--
>&0 search/4096/cWt \<!doctype\ html HTML document text
!:mime text/html
!:strength + 30
>&0 search/4096/ct \<html> HTML document text
!:mime text/html
@ -65,69 +72,68 @@
# https://www.w3.org/TR/SVG/single-page.html
0 search/4096/cWbt \<!doctype\ svg SVG XML document
!:mime image/svg+xml
!:strength + 15
!:strength + 30
0 search/4096/cwt \<head\> HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cWt \<head\ HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cwt \<title\> HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cWt \<title\ HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cwt \<html\> HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cWt \<html\ HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cwt \<script\> HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cWt \<script\ HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cwt \<style\> HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cWt \<style\ HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cwt \<table\> HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cWt \<table\ HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
0 search/4096/cwt \<a\ href= HTML document text
!:mime text/html
!:strength + 15
!:strength + 30
# Microsoft HTML Application (HTA)
# https://learn.microsoft.com/en-us/previous-versions//ms536496(v=vs.85)
0 search/4096/cWt \<hta:application\ Microsoft HTML Application (HTA)
!:mime application/hta
!:ext hta
!:strength + 50
# Extensible markup language (XML), a subset of SGML
# from Marc Prud'hommeaux (marc@apocalypse.org)
0 search/1/cwt \<?xml XML document text
!:mime text/xml
!:strength + 15
0 string/t \<?xml\ version\ " XML
!:mime text/xml
!:strength + 15
!:strength + 30
0 string/t \<?xml\ version=" XML
!:mime text/xml
!:strength + 15
>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
0 string/t \<?xml\ version=' XML
!:mime text/xml
!:strength + 15
!:strength + 30
>15 string/t >\0 %.3s document text
>>23 search/1 \<xsl:stylesheet (XSL stylesheet)
>>24 search/1 \<xsl:stylesheet (XSL stylesheet)
0 search/1/wt \<?XML broken XML document text
!:mime text/xml
!:strength - 10
@ -146,16 +152,6 @@
0 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
0 search/1 #\ KDE\ Cookie\ File Konqueror cookie text
# XML-based format representing braille pages in a digital format.
#
# Specification:
# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
#
# Simon Aittamaa <simon.aittamaa@gmail.com>
0 string \<?xml\ version=
>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<pef Portable Embosser Format
!:mime application/x-pef+xml
# https://www.qgis.org/en/site/
0 string \<!DOCTYPE\040qgis QGIS XML document

6
contrib/file/magic/Magdir/sharc
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------
# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
# $File: sharc,v 1.9 2024/09/04 19:06:12 christos Exp $
# file(1) magic for sharc files
#
# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
@ -19,5 +19,5 @@
0 string .system SHARC architecture file
0 leshort 0x521C SHARC COFF binary
>2 leshort >1 , %d sections
>>12 lelong >0 , not stripped
>2 leshort >1 \b, %d sections
>>12 lelong >0 \b, not stripped

8
contrib/file/magic/Magdir/sniffer
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: sniffer,v 1.34 2022/12/14 18:27:36 christos Exp $
# $File: sniffer,v 1.36 2024/06/16 15:09:26 christos Exp $
# sniffer: file(1) magic for packet capture files
#
# From: guy@alum.mit.edu (Guy Harris)
@ -78,8 +78,8 @@
#
# "libpcap" capture files.
# https://www.tcpdump.org/manpages/pcap-savefile.5.html
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
# the main program that uses that format, but there are other programs
# (We call them "libpcap capture file(s)", as "libpcap" is
# the first library that uses that format, but there are other programs
# that use "libpcap", or that use the same capture file format.)
#
0 name pcap-be
@ -198,7 +198,7 @@
>20 belong&0x03FFFFFF 204 (PPP with direction pseudo-header
>20 belong&0x03FFFFFF 205 (Cisco HDLC with direction pseudo-header
>20 belong&0x03FFFFFF 206 (Frame Relay with direction pseudo-header
>20 belong&0x03FFFFFF 209 (Linux IPMB
>20 belong&0x03FFFFFF 209 (Linux I2C
>20 belong&0x03FFFFFF 215 (802.15.4 with non-ASK PHY header
>20 belong&0x03FFFFFF 216 (Linux evdev events
>20 belong&0x03FFFFFF 219 (MPLS with label as link-layer header

95
contrib/file/magic/Magdir/sql
View file

@ -1,6 +1,6 @@
#------------------------------------------------------------------------------
# $File: sql,v 1.26 2023/04/29 17:26:58 christos Exp $
# $File: sql,v 1.27 2023/08/19 15:33:04 christos Exp $
# sql: file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
@ -100,6 +100,7 @@
# URL: https://en.wikipedia.org/wiki/SQLite
# Reference: https://www.sqlite.org/fileformat.html
# Update: Joerg Jenderek
# TODO: missing extensions for Bentley Systems and Esri Spatially-Enabled Database
# Version 3 of SQLite allows applications to embed their own "user version"
# number in the database at offset 60. Later, SQLite added an "application id"
# at offset 68 that is preferred over "user version" for indicating the
@ -110,7 +111,6 @@
>16 ubeshort >0 SQLite 3.x
# deprecated
#!:mime application/x-sqlite3
!:mime application/vnd.sqlite3
# seldom found extension sqlite3 like in SyncData.sqlite3
# db
# db3 like: AddrBook.db3 cgipcrvp.db3
@ -119,14 +119,88 @@
# SQLite database weewx.sdb used by weather software weewx
# https://www.weewx.com/docs/usersguide.htm
# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
# ide is used in storage.ide
# localstorage like in Enigma2 http_itv.ard.de_0.localstorage
# xowa like in home-html.user.xowa http://fileformats.archiveteam.org/wiki/XOWA
# sqlar like in sqlar-src-4824e73896.sqlar http://fileformats.archiveteam.org/wiki/SQLite_Archive
# sketch http://fileformats.archiveteam.org/wiki/Sketch
# ftb http://fileformats.archiveteam.org/wiki/MyHeritage_Family_Tree_Builder
# lrcat http://fileformats.archiveteam.org/wiki/Lightroom_catalog
# without suffix like in "Diagnostic Data"
# Unfortunately extension sqlite also used for other databases starting with string
# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
# and with string "ZV-zlib" in like extra.sqlite
>>68 belong !0x5CDE09EF database
!:ext sqlite/sqlite3/db/db3/dbe/sdb/help
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/maple-sqlite.trid.xml
>>68 belong =0x5CDE09EF database
# maple is used for Maple Workbook
!:ext maple
# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Audacity_(audio_editor)
# http://fileformats.archiveteam.org/wiki/Audacity_Project_Format
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/aup3.trid.xml
# Note: called "Audacity 3 Project" by TrID and "Audacity Project File" version 3.x by DROID via PUID fmt/1826
# with user version 03000000h whereas older versions *.AUP are not SQLite based
>>68 belong =0x41554459 database
!:mime application/x-audacity-project+sqlite3
!:ext aup3
# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/TeXnicard
# Reference: http://fileformats.archiveteam.org/wiki/TeXnicard_card_database
# Note: no examples found
>>68 belong =0x6A035744 database
!:mime application/vnd.sqlite3
!:ext db
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Fossil_repository_database
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fossil.trid.xml
# Note: called "Fossil repository data base" by TrID
>>68 belong =0x0F055111 database
!:mime application/vnd.sqlite3
!:ext fossil/fsl
# URL: http://fileformats.archiveteam.org/wiki/Fossil_checkout_database
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fossil-checkout.trid.xml
# Note: called "Fossil checkout data base" by TrID
>>68 belong =0x0F055112 database
!:mime application/vnd.sqlite3
# name _FOSSIL_ on Windows or .fslckout else
!:ext /fslckout
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Fossil_configuration_database
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/f/fossil-config.trid.xml
# Note: called "Fossil configuration data base" by TrID
>>68 belong =0x0F055113 database
!:mime application/vnd.sqlite3
# %LOCALAPPDATA%\_fossil on Windows and ~/.fossil or fossil.db else
!:ext /fossil/db
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/GeoPackage
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/g/gpkg-v1.trid.xml
# Note: called "GeoPackage (v1)" by TrID and "OGC GeoPackage" version 1.0-1.31 by DROID via PUID fmt/1700
# with GP10 application id
>>68 belong =0x47503130 database
# https://www.iana.org/assignments/media-types/application/geopackage+sqlite3
!:mime application/geopackage+sqlite3
# https://github.com/opengeospatial/ets-gpkg12/blob/master/src/test/resources/gpkg/bluemarble.gpkg
!:ext gpkg
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/g/gpkg-v12.trid.xml
# Note: called "GeoPackage (v1.2)" by TrID and "OGC GeoPackage" version 1.0-1.31 by DROID via PUID fmt/1700
# with GPKG application id
>>68 belong =0x47504B47 database
!:mime application/geopackage+sqlite3
!:ext gpkg
# Update: Joerg Jenderek
# URL: https://github.com/mapbox/mbtiles-spec/tree/master
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mbtiles-MPBX.trid.xml
# Note: called "MBTiles tileset (MPBX)" by TrID and many samples without application id MPBX like
# https://ftp.gwdg.de/pub/misc/openstreetmap/openseamap/charts/mbtiles/OSM-OpenCPN2-MagellanStrait.mbtiles
>>68 belong =0x4D504258 database
!:mime application/vnd.sqlite3
!:ext mbtiles
>>68 default x database
!:mime application/vnd.sqlite3
# no examples found with s3db sl3 suffix
!:ext /sqlite/sqlite3/db/db3/dbe/sdb/help/ide/localstorage/sqlar/xowa/mbtiles
# GRR: the line above only works if in ../../src/file.h FILE_MAGICSIZE ext[] are raised or you get
>>60 belong =0x5f4d544e (Monotone source repository)
# if no known user version then check for Application IDs with default clause
>>60 belong !0x5f4d544e
@ -143,17 +217,24 @@
>>>68 belong =0x4d504258 (MBTiles tileset)
# https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple
>>>68 belong =0x5CDE09EF (Maple Workbook)
# AUDY Audacity Project File
>>>68 belong =0x41554459 (Audacity Project)
>>>68 belong =0x6A035744 (TeXnicard card database)
# unknown application ID
>>>68 default x
>>>>68 belong !0 \b, application id %u
# The "user version" as read and set by the user_version pragma like:
# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075
# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075 50331648
>>60 belong !0 \b, user version %d
# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001
# expressed as hexadecimal because some people mention version number in hexadecimal with marking that item
>>>60 belong x (%#x)
# SQLITE_VERSION_NUMBER like: 0 3007014 3008011 3016002 3017000 3022000 3028000 3031001 3032003 3035005
>>96 belong x \b, last written using SQLite version %d
# database page size in bytes; a power of two between 512 and 32768, or 1 for 65536
# like: 512 1024 often 4096 32768
>>16 ubeshort !4096 \b, page size %u
>>16 ubeshort !4096 \b, page size
>>>16 ubeshort !1 %u
>>>16 ubeshort =1 65536
# File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite
>>18 ubyte !1 \b, writer version %u
# File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite

45
contrib/file/magic/Magdir/ssh
View file

@ -1,19 +1,64 @@
# Type: OpenSSH key files
# From: Nicolas Collignon <tsointsoin@gmail.com>
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Secure_Shell_Protocol
0 string SSH\040PRIVATE\040KEY OpenSSH RSA1 private key,
>28 string >\0 version %s
0 string -----BEGIN\040OPENSSH\040PRIVATE\040KEY----- OpenSSH private key
!:mime application/x-pem-file
# https://www.rfc-editor.org/rfc/rfc5958
0 string -----BEGIN\040PRIVATE\040KEY----- OpenSSH private key (no password)
#!:mime text/plain
!:mime text/x-ssh-private-key
!:ext key
0 string -----BEGIN\040ENCRYPTED\040PRIVATE\040KEY----- OpenSSH private key (with password)
# https://download.qemu.org/qemu-9.0.0.tar.xz
# qemu-9.0.0/roms/skiboot/libstb/crypto/mbedtls/tests/data_files/format_gen.pub
0 string -----BEGIN\040PUBLIC\040KEY----- OpenSSH public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pub-ssh-dss.trid.xml
# Note: called "SSH-DSS Public key" by TrID
0 string ssh-dss\040 OpenSSH DSA public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pub-ssh-rsa.trid.xml
# Note: called "SSH-RSA Public key" by TrID
0 string ssh-rsa\040 OpenSSH RSA public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
0 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
# https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.u2f?annotate=HEAD
0 string sk-ecdsa-sha2-nistp256@openssh.com OpenSSH U2F ECDSA public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
0 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
0 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
0 string ssh-ed25519 OpenSSH ED25519 public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
0 string sk-ssh-ed25519@openssh.com OpenSSH U2F ED25519 public key
#!:mime text/plain
!:mime text/x-ssh-public-key
!:ext pub
0 string SSHKRL\n\0
>8 ubelong 1 OpenSSH key/certificate revocation list, format %u

22
contrib/file/magic/Magdir/ssl
View file

@ -1,17 +1,37 @@
#------------------------------------------------------------------------------
# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $
# $File: ssl,v 1.7 2024/06/10 23:23:55 christos Exp $
# ssl: file(1) magic for SSL file formats
# Type: OpenSSL certificates/key files
# From: Nicolas Collignon <tsointsoin@gmail.com>
0 string -----BEGIN\040CERTIFICATE----- PEM certificate
!:mime application/x-pem-file
0 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request
!:mime application/x-pem-file
# Update: Joerg Jenderek
# Reference: https://github.com/openssl/openssl/blob/master/include/openssl/pem.h
# http://mark0.net/download/triddefs_xml.7z/defs/k/key-rsa-pvt.trid.xml
# Note: called "ASCII armored RSA Private Key" by TrID
0 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key
#!:mime text/plain
!:mime text/x-ssl-private-key
!:ext key/priv
0 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key
!:mime application/x-pem-file
0 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key
!:mime application/x-pem-file
0 string -----BEGIN\040EC\040PRIVATE PEM EC private key
!:mime application/x-pem-file
0 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key
!:mime application/x-pem-file
# From: Joerg Jenderek
# Reference: https://github.com/openssl/openssl/blob/master/include/openssl/pem.h
0 string -----BEGIN\040RSA\040PUBLIC\040KEY----- PEM RSA public key
#!:mime text/plain
!:mime text/x-ssl-public-key
!:ext pub
# From Luc Gommans
# OpenSSL enc file (recognized by a magic string preceding the password's salt)

Some files were not shown because too many files have changed in this diff Show more