home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Amiga Plus 2004 #11
/
Amiga Plus CD - 2004 - No. 11.iso
/
AmiSoft
/
Dev
/
gg
/
file-3.20-morp.lha
/
lib
/
magic
Wrap
Text File
|
2004-07-26
|
107KB
|
3,094 lines
# Magic file created Mon Jul 26 01:14:57 GMT 2004 by anonymous
#! file
# Magic data for file(1) command.
# Machine-genererated from src/cmd/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
# $Id: Localstuff,v 1.3 1995/01/21 21:09:00 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.
#------------------------------------------------------------------------------
# alliant: file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0 short 0420 0420 Alliant virtual executable
>2 short &0x0020 common library
>16 long >0 not stripped
0 short 0421 0421 Alliant compact executable
>2 short &0x0020 common library
>16 long >0 not stripped
#------------------------------------------------------------------------------
# alpha architecture description
#
0 leshort 0603 COFF format alpha
>22 leshort&030000 !020000 executable
>24 leshort 0410 pure
>24 leshort 0413 paged
>22 leshort&020000 !0 dynamically linked
>16 lelong !0 not stripped
>16 lelong 0 stripped
>22 leshort&030000 020000 shared library
>24 leshort 0407 object
>27 byte x - version %d
>26 byte x .%d
>28 byte x -%d
#------------------------------------------------------------------------------
# amiga: file(1) magic for Amiga file formats
#
0 belong 0x000003f3 AmigaOS hunk format executable
#------------------------------------------------------------------------------
# animation: file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
# MPEG animation format
0 string \000\000\001\263 MPEG file
# FLI animation format
4 leshort 0xAF11 FLI file
>6 leshort x - %d frames,
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# FLC animation format
4 leshort 0xAF12 FLC file
>6 leshort x - %d frames
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work. Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)! The DL format is really bad.
#
#0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
#>42 byte x - %d screens,
#>43 byte x %d commands
#0 byte 2 DL version 2
#>1 byte 1 - large format (320x200,1 image/screen),
#>1 byte 2 - medium format (160x100,4 images/screen),
#>1 byte >2 - unknown format,
#>42 byte x %d screens,
#>43 byte x %d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003. Most of them start with non-null values at hex offset 0x34 or so.
#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
# SGI and Apple formats
0 string MOVI Silicon Graphics movie file
4 string moov Apple QuickTime movie file (moov)
4 string mdat Apple QuickTime movie file (mdat)
#------------------------------------------------------------------------------
# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
# workspaces)
#
0 long 0100554 APL workspace (Ken's original?)
#------------------------------------------------------------------------------
# apple: file(1) magic for Apple II file formats
#
0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
0 string \x0aGL Binary II (apple ][) data
0 string \x76\xff Squeezed (apple ][) data
0 string SIT! StuffIt (macintosh) text
0 string NuFile NuFile archive (apple ][) data
0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
# Other Apple formats.
# CodeWarrior object file
0 string MWOBPPC Metrowerks CodeWarrior object
# Apple PEF executable
0 string Joy\!peffpwpc PEF executable
#------------------------------------------------------------------------------
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.
# POSIX tar archives
257 string ustar\0 POSIX tar archive
257 string ustar\040\040\0 GNU tar archive
# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0 short 070707 cpio archive
0 short 0143561 byte-swapped cpio archive
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
0 string 070702 ASCII cpio archive (SVR4 with CRC)
# other archives
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0177545 old archive
0 short 0177545 old PDP-11 archive
0 long 0100554 apl workspace
0 string =<ar> archive
# MIPS archive (needs to go first)
#
0 string !<arch>\n__________E MIPS archive
>20 string U with MIPS Ucode members
>21 string L with MIPSEL members
>21 string B with MIPSEB members
>19 string L and an EL hash table
>19 string B and an EB hash table
>22 string X -- out of date
0 string !<arch> archive
>8 string __.SYMDEF random library
0 string -h- Software Tools format archive text
#
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0 string !<arch> current ar archive
# 0 long 0x213c6172 archive file
#
# and for SVR3.1 archives, we have:
#
# 0 string \<ar> System V Release 1 ar archive
# 0 string =<ar> archive
# 0 string =<ar> archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0 string !<arch> current ar archive
>8 string __.SYMDEF random library
>8 string debian-split part of multipart Debian package
>8 string debian-binary Debian binary package
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
>0 beshort 2 - object archive
>0 beshort 3 - shared library module
>0 beshort 4 - debug break-pointed module
>0 beshort 5 - absolute code program module
0 string \<ar> System V Release 1 ar archive
0 string =<ar> archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0 belong 0x65ff0000 VAX 3.0 archive
0 belong 0x3c61723e VAX 5.0 archive
#
0 long 0x213c6172 archive file
0 lelong 0177555 very old VAX archive
0 leshort 0177555 very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0 lelong 0177545 old VAX archive
>8 string __.SYMDEF random library
0 leshort 0177545 old PDP-11 archive
>8 string __.SYMDEF random library
#
0 string =<ar> archive
#
# From "pdp":
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
#
0 string -h- Software Tools format archive text
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated). Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR: the original entries collide with ARC, above; replaced with combined
# version (not tested)]
#0 byte 0x1a RISC OS archive
#>1 string archive (ArcFS format)
0 string \032archive RISC OS archive (ArcFS format)
# ARJ archiver (jason@jarthur.Claremont.EDU)
0 leshort 0xea60 ARJ archive data
>5 byte x \b, v%d,
>8 byte &0x04 multi-volume,
>8 byte &0x10 slash-switched,
>8 byte &0x20 backup,
>34 string x original name: %s,
>7 byte 0 os: MS-DOS
>7 byte 1 os: PRIMOS
>7 byte 2 os: Unix
>7 byte 3 os: Amiga
>7 byte 4 os: Macintosh
>7 byte 5 os: OS/2
>7 byte 6 os: Apple ][ GS
>7 byte 7 os: Atari ST
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0 string HA HA archive data,
#>2 leshort =1 1 file,
#>2 leshort >1 %u files,
#>4 byte&0x0f =0 first is type CPY
#>4 byte&0x0f =1 first is type ASC
#>4 byte&0x0f =2 first is type HSC
#>4 byte&0x0f =0x0e first is type DIR
#>4 byte&0x0f =0x0f first is type SPECIAL
# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0 string HPAK HPACK archive data
# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0 string \351,\001JAM\ JAM archive,
>7 string >\0 version %.4s
>0x26 byte =0x27 -
>>0x2b string >\0 label %.11s,
>>0x27 lelong x serial %08x,
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2 string -lh0- LHarc 1.x archive data [lh0]
2 string -lh1- LHarc 1.x archive data [lh1]
2 string -lz4- LHarc 1.x archive data [lz4]
2 string -lz5- LHarc 1.x archive data [lz5]
# [never seen any but the last; -lh4- reported in comp.compression:]
2 string -lzs- LHa 2.x? archive data [lzs]
2 string -lh - LHa 2.x? archive data [lh ]
2 string -lhd- LHa 2.x? archive data [lhd]
2 string -lh2- LHa 2.x? archive data [lh2]
2 string -lh3- LHa 2.x? archive data [lh3]
2 string -lh4- LHa (2.x) archive data [lh4]
2 string -lh5- LHa (2.x) archive data [lh5]
>20 byte x - header level %d
# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0 string Rar! RAR archive data
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0 string SQSH squished archive data (Acorn RISCOS)
# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0 string UC2\x1a UC2 archive data
# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0 string PK\003\004 Zip archive data
>4 byte 0x09 \b, at least v0.9 to extract
>4 byte 0x0a \b, at least v1.0 to extract
>4 byte 0x0b \b, at least v1.1 to extract
>4 byte 0x14 \b, at least v2.0 to extract
# Zoo archiver
20 lelong 0xfdc4a7dc Zoo archive data
>4 byte >48 \b, v%c.
>>6 byte >47 \b%c
>>>7 byte >47 \b%c
>32 byte >0 \b, modify: v%d
>>33 byte x \b.%d+
>42 lelong 0xfdc4a7dc \b,
>>70 byte >0 extract: v%d
>>>71 byte x \b.%d+
# Shell archives
10 string #\ This\ is\ a\ shell\ archive shell archive text
#------------------------------------------------------------------------------
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
0 beshort 0550 3b20 COFF executable
>12 belong >0 not stripped
#>22 beshort >0 - version %ld
0 beshort 0551 3b20 COFF executable (TV)
>12 belong >0 not stripped
#>22 beshort >0 - version %ld
#
# WE32K
#
0 beshort 0560 WE32000 COFF
>18 beshort ^00000020 object
>18 beshort &00000020 executable
>12 belong >0 not stripped
>18 beshort ^00010000 N/A on 3b2/300 w/paging
>18 beshort &00020000 32100 required
>18 beshort &00040000 and MAU hardware required
>20 beshort 0407 (impure)
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0443 (target shared library)
>22 beshort >0 - version %ld
0 beshort 0561 WE32000 COFF executable (TV)
>12 belong >0 not stripped
#>18 beshort &00020000 - 32100 required
#>18 beshort &00040000 and MAU hardware required
#>22 beshort >0 - version %ld
#
# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
>364 string >\0 of '%s'
#------------------------------------------------------------------------------
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#
# Sun/NeXT audio data
0 string .snd Sun/NeXT audio data:
>12 belong 1 8-bit ISDN u-law,
>12 belong 2 8-bit linear PCM [REF-PCM],
>12 belong 3 16-bit linear PCM,
>12 belong 4 24-bit linear PCM,
>12 belong 5 32-bit linear PCM,
>12 belong 6 32-bit IEEE floating point,
>12 belong 7 64-bit IEEE floating point,
>12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20 belong 1 mono,
>20 belong 2 stereo,
>20 belong 4 quad,
>16 belong >0 %d Hz
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0 lelong 0x0064732E DEC audio data:
>12 lelong 1 8-bit ISDN u-law,
>12 lelong 2 8-bit linear PCM [REF-PCM],
>12 lelong 3 16-bit linear PCM,
>12 lelong 4 24-bit linear PCM,
>12 lelong 5 32-bit linear PCM,
>12 lelong 6 32-bit IEEE floating point,
>12 lelong 7 64-bit IEEE floating point,
>12 lelong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20 lelong 1 mono,
>20 lelong 2 stereo,
>20 lelong 4 quad,
>16 lelong >0 %d Hz
# Creative Labs AUDIO stuff
0 string MThd Standard MIDI data
>9 byte >0 (format %d)
>11 byte >1 using %d channels
0 string CTMF Creative Music (CMF) data
0 string SBI SoundBlaster instrument data
0 string Creative\ Voice\ File Creative Labs voice data
# is this next line right? it came this way...
>19 byte 0x1A
>23 byte >0 - version %d
>22 byte >0 \b.%d
# first entry is also the string "NTRK"
0 belong 0x4e54524b MultiTrack sound data
>4 belong x - version %ld
# Microsoft WAVE format (*.wav)
# [GRR 950115: probably all of the shorts and longs should be leshort/lelong]
0 string RIFF Microsoft RIFF
>8 string WAVE \b, WAVE audio data
>>34 short >0 \b, %d bit
>>22 short =1 \b, mono
>>22 short =2 \b, stereo
>>22 short >2 \b, %d channels
>>24 long >0 %d Hz
# AVI == Audio Video Interleave
>8 string AVI\ \b, AVI data
# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0 string EMOD Extended MOD sound data,
>4 byte&0xf0 x version %d
>4 byte&0x0f x \b.%d,
>45 byte x %d instruments
>83 byte 0 (module)
>83 byte 1 (song)
# Real Audio (Magic .ra\0375)
0 belong 0x2e7261fd realaudio sound file
# Real Audio (Magic .ra\0375)
0 belong 0x2e7261fd realaudio sound file
# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
0 string MTM MultiTracker Module sound file
0 string if Composer 669 Module sound data
0 string FAR Module sound data
0 string MAS_U ULT(imate) Module sound data
0x2c string SCRM ScreamTracker III Module sound data
0 string Extended Module Extended Module sound data
#------------------------------------------------------------------------------
# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well? If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0 long 0407 68K Blit (standalone) executable
#0 short 0407 VAX-order2 68K Blit (standalone) executable
0 short 03401 VAX-order 68K Blit (standalone) executable
0 long 0406 68k Blit mpx/mux executable
0 short 0406 VAX-order2 68k Blit mpx/mux executable
0 short 03001 VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0 short 0520 tty630 layers executable
#------------------------------------------------------------------------------
# c-lang: file(1) magic for C programs (or REXX)
#
# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0 string /*\ XPM\ */ X pixmap image data
# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0 string /* C or REXX program text
0 string // C++ program text
#------------------------------------------------------------------------------
# chi: file(1) magic for ChiWriter files
#
0 string \\1cw\ ChiWriter file
>5 string >\0 version %s
0 string \\1cw ChiWriter file
#------------------------------------------------------------------------------
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18 short !074000,000000 C1 R1
# >18 short !074000,004000 C2 R1
# >18 short !074000,010000 C3 R1
# >18 short !074000,074000 TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18 short&074000 000000 C1 R1
# >18 short&074000 004000 C2 R1
# >18 short&074000 010000 C3 R1
# >18 short&074000 074000 TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0 short 0575 CLIPPER COFF executable (VAX #)
>20 short 0407 (impure)
>20 short 0410 (5.2 compatible)
>20 short 0411 (pure)
>20 short 0413 (demand paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0577 CLIPPER COFF executable
>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>18 short&074000 010000 C3 R1
>18 short&074000 074000 TEST
>20 short 0407 (impure)
>20 short 0410 (pure)
>20 short 0411 (separate I&D)
>20 short 0413 (paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
>48 long&01 01 alignment trap enabled
>52 byte 1 -Ctnc
>52 byte 2 -Ctsw
>52 byte 3 -Ctpw
>52 byte 4 -Ctcb
>53 byte 1 -Cdnc
>53 byte 2 -Cdsw
>53 byte 3 -Cdpw
>53 byte 4 -Cdcb
>54 byte 1 -Csnc
>54 byte 2 -Cssw
>54 byte 3 -Cspw
>54 byte 4 -Cscb
4 string pipe CLIPPER instruction trace
4 string prof CLIPPER instruction profile
#------------------------------------------------------------------------------
# commands: file(1) magic for various shells and interpreters
#
0 string :\ shell archive or commands for antique kernel text
0 string #!/bin/sh Bourne shell script text
0 string #!\ /bin/sh Bourne shell script text
0 string #!/bin/csh C shell script text
0 string #!\ /bin/csh C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string #!/bin/ksh Korn shell script text
0 string #!\ /bin/ksh Korn shell script text
0 string #!/bin/tcsh Tenex C shell script text
0 string #!\ /bin/tcsh Tenex C shell script text
0 string #!/usr/local/tcsh Tenex C shell script text
0 string #!\ /usr/local/tcsh Tenex C shell script text
0 string #!/usr/local/bin/tcsh Tenex C shell script text
0 string #!\ /usr/local/bin/tcsh Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0 string #!/usr/local/bin/zsh Paul Falstad's zsh
0 string #!\ /usr/local/bin/zsh Paul Falstad's zsh
0 string #!/usr/local/bin/ash Neil Brown's ash
0 string #!\ /usr/local/bin/ash Neil Brown's ash
0 string #!/usr/local/bin/ae Neil Brown's ae
0 string #!\ /usr/local/bin/ae Neil Brown's ae
0 string #!/bin/nawk new awk script text
0 string #!\ /bin/nawk new awk script text
0 string #!/usr/bin/nawk new awk script text
0 string #!\ /usr/bin/nawk new awk script text
0 string #!/usr/local/bin/nawk new awk script text
0 string #!\ /usr/local/bin/nawk new awk script text
0 string #!/bin/gawk GNU awk script text
0 string #!\ /bin/gawk GNU awk script text
0 string #!/usr/bin/gawk GNU awk script text
0 string #!\ /usr/bin/gawk GNU awk script text
0 string #!/usr/local/bin/gawk GNU awk script text
0 string #!\ /usr/local/bin/gawk GNU awk script text
#
0 string #!/bin/awk awk commands text
0 string #!\ /bin/awk awk commands text
0 string #!/usr/bin/awk awk commands text
0 string #!\ /usr/bin/awk awk commands text
0 string BEGIN awk commands text
# For Larry Wall's perl language. The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
# Keith Waclena <keith@cerberus.uchicago.edu>
0 string #!/bin/perl perl commands text
0 string #!\ /bin/perl perl commands text
0 string eval\ "exec\ /bin/perl perl commands text
0 string #!/usr/bin/perl perl commands text
0 string #!\ /usr/bin/perl perl commands text
0 string eval\ "exec\ /usr/bin/perl perl commands text
0 string #!/usr/local/bin/perl perl commands text
0 string #!\ /usr/local/bin/perl perl commands text
0 string eval\ "exec\ /usr/local/bin/perl perl commands text
# AT&T Bell Labs' Plan 9 shell
0 string #!/bin/rc Plan 9 rc shell script text
0 string #!\ /bin/rc Plan 9 rc shell script text
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string #!/bin/bash Bourne-Again shell script text
0 string #!\ /bin/bash Bourne-Again shell script text
0 string #!/usr/local/bin/bash Bourne-Again shell script text
0 string #!\ /usr/local/bin/bash Bourne-Again shell script text
# generic shell magic
0 string #!\ / a
>3 string >\0 %s script text
0 string #!/ a
>2 string >\0 %s script text
0 string #!\ commands text
>3 string >\0 for %s
#------------------------------------------------------------------------------
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.
# standard unix compress
0 string \037\235 compress'd data
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
0 string \037\213 gzip compressed data
>2 byte <8 \b, reserved method,
>2 byte 8 \b, deflated,
>3 byte &0x01 ASCII,
>3 byte &0x02 continuation,
>3 byte &0x04 extra field,
>3 byte &0x08 original filename,
>3 byte &0x10 comment,
>3 byte &0x20 encrypted,
>4 ledate x last modified: %s,
>8 byte 2 max compression,
>8 byte 4 max speed,
>9 byte =0x00 os: MS-DOS
>9 byte =0x01 os: Amiga
>9 byte =0x02 os: VMS
>9 byte =0x03 os: Unix
>9 byte =0x05 os: Atari
>9 byte =0x06 os: OS/2
>9 byte =0x07 os: MacOS
>9 byte =0x0A os: Tops/20
>9 byte =0x0B os: Win/32
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0 string \037\036 packed data
>2 belong >1 \b, %d characters originally
>2 belong =1 \b, %d character originally
#
# This magic number is byte-order-independent. XXX - Does that mean this
# is big-endian, little-endian, either, or that you can't tell?
# this short is valid for SunOS
0 short 017437 old packed data
# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0 short 0x1fff compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0 string \377\037 compacted data
0 short 0145405 huf output
# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats. Note that I can only uncrunch, not crunch, and
# I didn't have a crunched file handy, so the crunch number is untested.
# Keith Waclena <keith@cerberus.uchicago.edu>
0 leshort 0x76FF squeezed data (CP/M, DOS)
0 leshort 0x76FE crunched data (CP/M, DOS)
# Freeze
0 string \037\237 frozen file 2.1
0 string \037\236 frozen file 1.0 (or gzip 0.5)
# SCO compress -H (LZH)
0 string \037\240 SCO compress -H (LZH) data
# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes. This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0 byte&0xF0 0xd0 data
#>33 byte&0xF0 0xd0
#>66 byte&0xF0 0xd0
#>99 byte&0xF0 0xd0
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
#------------------------------------------------------------------------------
# convex: file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
0 long 0513 Convex executable
#------------------------------------------------------------------------------
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
# Will be maintained as part of the GDBM distribution in the future.
# <downsj@teeny.org>
0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
0 string GDBM GNU dbm 2.x database
#
0 belong 0x061561 Berkeley DB Hash file
>4 belong >0 (Version %d,
>8 belong 1234 Little Endian,
>8 belong 4321 Big Endian,
>12 belong x Bucket Size %d,
>16 belong x Directory Size %d,
>20 belong x Segment Size %d,
>24 belong x Segment Shift %d,
>28 belong x Overflow Point %d,
>32 belong x Last Freed %d,
>36 belong x Max Bucket %d,
>40 belong x High Mask 0x%x,
>44 belong x Low Mask 0x%x,
>48 belong x Fill Factor %d,
>52 belong x Number of Keys %d)
#
0 belong 0x053162 Berkeley DB Btree file
>4 belong >0 (Version %d,
>8 belong x Page Size %d,
>12 belong x Free Page %d,
>16 belong x Number of Records %d,
>20 belong x Flags 0x%x)
#------------------------------------------------------------------------------
# diamond: file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
# The full deal is too long...
#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
#------------------------------------------------------------------------------
# diff: file(1) magic for diff(1) output
#
0 string diff\ 'diff' output text
0 string ***\ 'diff' output text
0 string Only\ in\ 'diff' output text
0 string Common\ subdirectories:\ 'diff' output text
#------------------------------------------------------------------------------
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24 belong 60012 new-fs dump file (big endian),
>4 bedate x Previous dump %s,
>8 bedate x This dump %s,
>12 belong >0 Volume %ld,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 belong 60011 old-fs dump file (big endian),
#>4 bedate x Previous dump %s,
#>8 bedate x This dump %s,
>12 belong >0 Volume %ld,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 lelong 60012 new-fs dump file (little endian),
>4 ledate x Previous dump %s,
>8 ledate x This dump %s,
>12 lelong >0 Volume %ld,
>692 lelong 0 Level zero, type:
>692 lelong >0 Level %d, type:
>0 lelong 1 tape header,
>0 lelong 2 beginning of file record,
>0 lelong 3 map of inodes on tape,
>0 lelong 4 continuation of file record,
>0 lelong 5 end of volume,
>0 lelong 6 map of inodes deleted,
>0 lelong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 lelong >0 Flags %x
24 lelong 60011 old-fs dump file (little endian),
#>4 ledate x Previous dump %s,
#>8 ledate x This dump %s,
>12 lelong >0 Volume %ld,
>692 lelong 0 Level zero, type:
>692 lelong >0 Level %d, type:
>0 lelong 1 tape header,
>0 lelong 2 beginning of file record,
>0 lelong 3 map of inodes on tape,
>0 lelong 4 continuation of file record,
>0 lelong 5 end of volume,
>0 lelong 6 map of inodes deleted,
>0 lelong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 lelong >0 Flags %x
#------------------------------------------------------------------------------
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# Byte order is probably big-endian for MIPS RS3000 and Amdahl.
# MIPS RS3000 may also be for MIPS RS2000.
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0 string \177ELF ELF
>4 byte 0 invalid class
>4 byte 1 32-bit
>4 byte 2 64-bit
>5 byte 0 invalid byte order
>5 byte 1 LSB
>>16 leshort 0 no file type,
>>16 leshort 1 relocatable,
>>16 leshort 2 executable,
>>16 leshort 3 shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
>>16 leshort 4 core file
>>>576 string >\0 of '%s'
>>>400 lelong >0 (signal %d),
>>16 leshort &0xff00 processor-specific,
>>18 leshort 0 no machine,
>>18 leshort 1 AT&T WE32100 - invalid byte order,
>>18 leshort 2 SPARC - invalid byte order,
>>18 leshort 3 Intel 80386,
>>18 leshort 4 Motorola 68000 - invalid byte order,
>>18 leshort 5 Motorola 88000 - invalid byte order,
>>18 leshort 6 Intel 80486,
>>18 leshort 7 Intel 80860,
>>18 leshort 8 MIPS RS3000,
>>18 leshort 9 Amdahl,
>>20 lelong 0 invalid version
>>20 lelong 1 version 1
>>36 lelong 1 MathCoPro/FPU/MAU Required
>5 byte 2 MSB
>>16 beshort 0 no file type,
>>16 beshort 1 relocatable,
>>16 beshort 2 executable,
>>16 beshort 3 shared object,
>>16 beshort 4 core file,
>>>576 string >\0 of '%s'
>>>400 lelong >0 (signal %d),
>>16 beshort &0xff00 processor-specific,
>>18 beshort 0 no machine,
>>18 beshort 1 AT&T WE32100,
>>18 beshort 2 SPARC,
>>18 beshort 3 Intel 80386 - invalid byte order,
>>18 beshort 4 Motorola 68000,
>>18 beshort 5 Motorola 88000,
>>18 beshort 6 Intel 80486 - invalid byte order,
>>18 beshort 7 Intel 80860,
>>18 beshort 8 MIPS RS3000,
>>18 leshort 9 Amdahl,
>>20 belong 0 invalid version
>>20 belong 1 version 1
>>36 belong 1 MathCoPro/FPU/MAU Required
#------------------------------------------------------------------------------
# encore: file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0 short 0x154 Encore
>20 short 0x107 executable
>20 short 0x108 pure executable
>20 short 0x10b demand-paged executable
>20 short 0x10f unsupported executable
>12 long >0 not stripped
>22 short >0 - version %ld
>22 short 0 -
#>4 date x stamp %s
0 short 0x155 Encore unsupported executable
>12 long >0 not stripped
>22 short >0 - version %ld
>22 short 0 -
#>4 date x stamp %s
#------------------------------------------------------------------------------
# filesystems: file(1) magic for different filesystems
#
0x438 leshort 0xEF53 Linux/i386 ext2 filesystem
0 string \366\366\366\366 PC formatted floppy with no filesystem
#------------------------------------------------------------------------------
# fonts: file(1) magic for font data
#
0 string FONT ASCII vfont text
0 short 0436 Berkeley vfont data
0 short 017001 byte-swapped Berkeley vfont data
# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data
# X11 font files in SNF (Server Natural Format) format
0 belong 00000004 X11 SNF font data, MSB first
0 lelong 00000004 X11 SNF font data, LSB first
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string STARTFONT\040 X11 BDF font text
# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0 string \001fcp X11 Portable Compiled Font data
>12 byte 0x02 \b, LSB first
>12 byte 0x0a \b, MSB first
0 string D1.0\015 X11 Speedo font data
#------------------------------------------------------------------------------
# frame: file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0 string \<MakerFile FrameMaker document
>11 string 4.0 (4.0
>11 string 3.0 (3.0
>11 string 2.0 (2.0
>11 string 1.0 (1.0
>14 byte x %c)
0 string \<MIFFile FrameMaker MIF (ASCII) file
>9 string 4.0 (4.0)
>9 string 3.0 (3.0)
>9 string 2.0 (2.0)
>9 string 1.0 (1.x)
0 string \<MakerDictionary FrameMaker Dictionary text
>17 string 3.0 (3.0)
>17 string 2.0 (2.0)
>17 string 1.0 (1.x)
0 string \<MakerScreenFont FrameMaker Font file
>17 string 1.01 (%s)
0 string \<MML FrameMaker MML file
0 string \<BookFile FrameMaker Book file
>10 string 3.0 (3.0
>10 string 2.0 (2.0
>10 string 1.0 (1.0
>13 byte x %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0 string \<Book\ FrameMaker Book (ASCII) file
#>6 string 3.0 (3.0)
#>6 string 2.0 (2.0)
#>6 string 1.0 (1.0)
0 string \<Maker Intermediate Print File FrameMaker IPL file
#------------------------------------------------------------------------------
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I
# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first
# showed up in the 700 series, although later 800 series machines are,
# I think, based on the PA7100 which implements HP-PA 1.1) are flagged
# as big-endian.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k. The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# 0 beshort 200 hp200 (68010) BSD binary
# 0 beshort 300 hp300 (68020+68881) BSD binary
# 0 beshort 0x20c hp200/300 HP-UX binary
# 0 beshort 0x20b hp800 HP-UX binary
#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0 beshort 0627 Apollo m68k COFF executable
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 beshort 0624 apollo a88k COFF executable
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 long 01203604016 TML 0123 byte-order format
0 long 01702407010 TML 1032 byte-order format
0 long 01003405017 TML 2301 byte-order format
0 long 01602007412 TML 3210 byte-order format
#### HPPA
0 belong 0x02100106 HPPA-RISC1.1 relocatable object
0 belong 0x02100107 HPPA-RISC1.1 executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x02100108 HPPA-RISC1.1 shared executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x0210010b HPPA-RISC1.1 demand-load executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x0210010e HPPA-RISC1.1 shared library
>96 belong >0 - not stripped
0 belong 0x0210010d HPPA-RISC1.1 dynamic load library
>96 belong >0 - not stripped
#### 800
0 belong 0x020b0106 HP s800 relocatable object
0 belong 0x020b0107 HP s800 executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x020b0108 HP s800 shared executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x020b010b HP s800 demand-load executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 - not stripped
0 belong 0x020b010e HP s800 shared library
>96 belong >0 - not stripped
0 belong 0x020b010d HP s800 dynamic load library
>96 belong >0 - not stripped
0 belong 0x213c6172 archive file
>68 belong 0x020b0619 - HP s800 relocatable library
#### 500
0 long 0x02080106 HP s500 relocatable executable
>16 long >0 - version %ld
0 long 0x02080107 HP s500 executable
>16 long >0 - version %ld
0 long 0x02080108 HP s500 pure executable
>16 long >0 - version %ld
#### 200
0 belong 0x020c0108 HP s200 pure executable
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0107 HP s200 executable
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c010b HP s200 demand-load executable
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0106 HP s200 relocatable executable
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>8 belong &0x80000000 save fp regs
>8 belong &0x20000000 debuggable
>8 belong &0x10000000 PIC
0 belong 0x020a0108 HP s200 (2.x release) pure executable
>4 beshort >0 - version %ld
>36 belong >0 not stripped
0 belong 0x020a0107 HP s200 (2.x release) executable
>4 beshort >0 - version %ld
>36 belong >0 not stripped
0 belong 0x020c010e HP s200 shared library
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
0 belong 0x020c010d HP s200 dynamic load library
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
#### MISC
0 long 0x0000ff65 HP old archive
0 long 0x020aff65 HP s200 old archive
0 long 0x020cff65 HP s200 old archive
0 long 0x0208ff65 HP s500 old archive
0 long 0x015821a6 HP core file
0 long 0x4da7eee8 HP-WINDOWS font
>8 byte >0 - version %ld
0 string Bitmapfile HP Bitmapfile
0 string IMGfile CIS compimg HP Bitmapfile
# XXX - see "lif"
0 short 0x8000 lif file
0 long 0x020c010c compiled Lisp
0 string msgcat01 HP NLS message catalog,
>8 long >0 %d messages
# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0 string HPHP48- HP48 binary
>7 byte >0 - Rev %c
>8 short 0x1129 (ADR)
>8 short 0x3329 (REAL)
>8 short 0x5529 (LREAL)
>8 short 0x7729 (COMPLX)
>8 short 0x9d29 (LCOMPLX)
>8 short 0xbf29 (CHAR)
>8 short 0xe829 (ARRAY)
>8 short 0x0a2a (LNKARRAY)
>8 short 0x2c2a (STRING)
>8 short 0x4e2a (HXS)
>8 short 0x742a (LIST)
>8 short 0x962a (DIR)
>8 short 0xb82a (ALG)
>8 short 0xda2a (UNIT)
>8 short 0xfc2a (TAGGED)
>8 short 0x1e2b (GROB)
>8 short 0x402b (LIB)
>8 short 0x622b (BACKUP)
>8 short 0x882b (LIBDATA)
>8 short 0x9d2d (PROG)
>8 short 0xcc2d (CODE)
>8 short 0x482e (GNAME)
>8 short 0x6d2e (LNAME)
>8 short 0x922e (XLIB)
0 string %%HP: HP48 text
>6 string T(0) - T(0)
>6 string T(1) - T(1)
>6 string T(2) - T(2)
>6 string T(3) - T(3)
>10 string A(D) A(D)
>10 string A(R) A(R)
>10 string A(G) A(G)
>14 string F(.) F(.);
>14 string F(,) F(,);
# hpBSD magic numbers
0 beshort 200 hp200 (68010) BSD
>2 beshort 0407 impure binary
>2 beshort 0410 read-only binary
>2 beshort 0413 demand paged binary
0 beshort 300 hp300 (68020+68881) BSD
>2 beshort 0407 impure binary
>2 beshort 0410 read-only binary
>2 beshort 0413 demand paged binary
#------------------------------------------------------------------------------
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
#
0 beshort 0531 SVR2 executable (Amdahl-UTS)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0530 SVR2 pure executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %ld
#------------------------------------------------------------------------------
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
>12 belong >0 not stripped
# Breaks sun4 statically linked execs.
#0 beshort 0x0103 executable (RT Version 2) or obj module
#>2 byte 0x50 pure
#>28 belong >0 not stripped
#>6 beshort >0 - version %ld
0 beshort 0x0104 shared library
0 beshort 0x0105 ctab data
0 beshort 0xfe04 structured file
0 string 0xabcdef message catalog
0 string \<aiaff> archive
#------------------------------------------------------------------------------
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange. It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.
0 string FORM IFF data
#>4 belong x \b, FORM is %d bytes long
# audio formats
>8 string AIFF \b, AIFF audio
>8 string AIFC \b, AIFF-C compressed audio
>8 string 8SVX \b, 8SVX 8-bit sampled sound voice
>8 string SAMP \b, SAMP sampled audio
# image formats
>8 string ILBMBMHD \b, ILBM interleaved image
>>20 beshort x \b, %d x
>>22 beshort x %d
>8 string RGBN \b, RGBN 12-bit RGB image
>8 string RGB8 \b, RGB8 24-bit RGB image
>8 string DR2D \b, DR2D 2-D object
>8 string TDDD \b, TDDD 3-D rendering
# other formats
>8 string FTXT \b, FTXT formatted text
#------------------------------------------------------------------------------
# images: file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)
# no magic: Targa
# PBMPLUS images
# The next byte following the magic is always whitespace.
0 string P1 PBM image text
0 string P2 PGM image text
0 string P3 PPM image text
0 string P4 PBM "rawbits" image data
0 string P5 PGM "rawbits" image data
0 string P6 PPM "rawbits" image data
# NIFF (Navy Interchange File Format, a modification of TIFF) images
0 string IIN1 NIFF image data
# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed. The TIFF specification recommends testing for it.
0 string MM\x00\x2a TIFF image data, big-endian
0 string II\x2a\x00 TIFF image data, little-endian
# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0 string \x89PNG PNG image data,
>4 belong !0x0d0a1a0a CORRUPTED,
>16 belong x %ld x
>20 belong x %ld,
>24 byte x %d-bit
>25 byte 0 grayscale,
>25 byte 2 \b/color RGB,
>25 byte 3 colormap,
>25 byte 4 gray+alpha,
>25 byte 6 \b/color RGBA,
#>26 byte 0 deflate/32K,
>28 byte 0 non-interlaced
>28 byte 1 interlaced
# GIF
0 string GIF8 GIF image data
>4 string 7a \b, version 8%s,
>4 string 9a \b, version 8%s,
>6 leshort >0 %hd x
>8 leshort >0 %hd,
#>10 byte &0x80 color mapped,
#>10 byte&0x07 =0x00 2 colors
#>10 byte&0x07 =0x01 4 colors
#>10 byte&0x07 =0x02 8 colors
#>10 byte&0x07 =0x03 16 colors
#>10 byte&0x07 =0x04 32 colors
#>10 byte&0x07 =0x05 64 colors
#>10 byte&0x07 =0x06 128 colors
#>10 byte&0x07 =0x07 256 colors
# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0 string \361\0\100\273 CMU window manager raster image data
>4 lelong >0 %d x
>8 lelong >0 %d,
>12 lelong >0 %d-bit
# Magick Image File Format
0 string id=ImageMagick MIFF image data
# Artisan
0 long 1123028772 Artisan image data
>4 long 1 \b, rectangular 24-bit
>4 long 2 \b, rectangular 8-bit with colormap
>4 long 3 \b, rectangular 32-bit (24-bit with matte)
# FIG (Facility for Interactive Generation of figures), an object-based format
0 string #FIG FIG image text
>5 string x \b, version %.3s
# PHIGS
0 string ARF_BEGARF PHIGS clear text archive
0 string @(#)SunPHIGS SunPHIGS
# version number follows, in the form m.n
>40 string SunBin binary
>32 string archive archive
# GKS (Graphics Kernel System)
0 string GKSM GKS Metafile
>24 string SunGKS \b, SunGKS
# CGM image files
0 string BEGMF clear text Computer Graphics Metafile
# XXX - questionable magic
0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
0 beshort 0x3020 character Computer Graphics Metafile
# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0 string yz MGR bitmap, modern format, 8-bit aligned
0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
0 string yx MGR bitmap, modern format, squeezed
# Fuzzy Bitmap (FBM) images
0 string %bitmap\0 FBM image data
>30 long 0x31 \b, mono
>30 long 0x33 \b, color
# facsimile data
1 string PC\ Research,\ Inc group 3 fax data
>29 byte 0 \b, normal resolution (204x98 DPI)
>29 byte 1 \b, fine resolution (204x196 DPI)
# JPEG images
0 beshort 0xffd8 JPEG image data
>6 string JFIF \b, JFIF standard
# HSI is Handmade Software's proprietary JPEG encoding scheme
0 string hsi1 JPEG image data, HSI proprietary
# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)
0 string BM PC bitmap data
>14 leshort 12 \b, OS/2 1.x format
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 64 \b, OS/2 2.x format
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 40 \b, Windows 3.x format
>>18 lelong x \b, %d x
>>22 lelong x %d x
>>28 leshort x %d
0 string IC PC icon data
0 string PI PC pointer image data
0 string CI PC color icon data
0 string CP PC color pointer image data
# Conflicts with other entries [BABYL]
#0 string BA PC bitmap array data
# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0 string /*\ XPM\ */ X pixmap image text
# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0 leshort 0xcc52 RLE image data,
>6 leshort x %d x
>8 leshort x %d
>2 leshort >0 \b, lower left corner: %d
>4 leshort >0 \b, lower right corner: %d
>10 byte&0x1 =0x1 \b, clear first
>10 byte&0x2 =0x2 \b, no background
>10 byte&0x4 =0x4 \b, alpha channel
>10 byte&0x8 =0x8 \b, comment
>11 byte >0 \b, %d color channels
>12 byte >0 \b, %d bits per pixel
>13 byte >0 \b, %d color map channels
# image file format (Robert Potter, potter@cs.rochester.edu)
0 string Imagefile\ version- iff image data
# this adds the whole header (inc. version number), informative but longish
>10 string >\0 %s
# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0 belong 0x59a66a95 Sun raster image data
>4 belong >0 \b, %d x
>8 belong >0 %d,
>12 belong >0 %d-bit,
#>16 belong >0 %d bytes long,
>20 belong 0 old format,
#>20 belong 1 standard,
>20 belong 2 compressed,
>20 belong 3 RGB,
>20 belong 4 TIFF,
>20 belong 5 IFF,
>20 belong 0xffff reserved for testing,
>24 belong 0 no colormap
>24 belong 1 RGB colormap
>24 belong 2 raw colormap
#>28 belong >0 colormap is %d bytes long
# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
# file://sgi.com/graphics/SGIIMAGESPEC
0 beshort 474 SGI image data
#>2 byte 0 \b, verbatim
>2 byte 1 \b, RLE
#>3 byte 1 \b, normal precision
>3 byte 2 \b, high precision
>4 beshort x \b, %d-D
>6 beshort x \b, %d x
>8 beshort x %d
>10 beshort x \b, %d channel
>10 beshort !1 \bs
>80 string >0 \b, "%s"
0 string IT01 FIT image data
>4 belong x \b, %d x
>8 belong x %d x
>12 belong x %d
#
0 string IT02 FIT image data
>4 belong x \b, %d x
>8 belong x %d x
>12 belong x %d
#
2048 string PCD_IPI Kodak Photo CD image pack file
0 string PCD_OPA Kodak Photo CD overview pack file
# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0 string SIMPLE\ \ = FITS image data
>109 string 8 \b, 8-bit, character or unsigned binary integer
>108 string 16 \b, 16-bit, two's complement binary integer
>107 string \ 32 \b, 32-bit, two's complement binary integer
>107 string -32 \b, 32-bit, floating point, single precision
>107 string -64 \b, 64-bit, floating point, double precision
# other images
0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
0 string !! Bennet Yee's "face" format
#------------------------------------------------------------------------------
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0 leshort 0502 basic-16 executable
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort 0503 basic-16 executable (TV)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort 0510 x86 executable
>12 lelong >0 not stripped
0 leshort 0511 x86 executable (TV)
>12 lelong >0 not stripped
0 leshort =0512 iAPX 286 executable small model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort =0522 iAPX 286 executable large model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514 80386 COFF executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
#------------------------------------------------------------------------------
# interleaf: file(1) magic for InterLeaf TPS:
#
0 string =\210OPS Interleaf saved data
0 string =<!OPS Interleaf document text
>5 string ,\ Version\ = \b, version
>>17 string >\0 %.3s
#------------------------------------------------------------------------------
# ispell: file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0 leshort&0xFFFC 0x9600 little endian ispell
>0 byte 0 hash file (?),
>0 byte 1 3.0 hash file,
>0 byte 2 3.1 hash file,
>0 byte 3 hash file (?),
>2 leshort 0x00 8-bit, no capitalization, 26 flags
>2 leshort 0x01 7-bit, no capitalization, 26 flags
>2 leshort 0x02 8-bit, capitalization, 26 flags
>2 leshort 0x03 7-bit, capitalization, 26 flags
>2 leshort 0x04 8-bit, no capitalization, 52 flags
>2 leshort 0x05 7-bit, no capitalization, 52 flags
>2 leshort 0x06 8-bit, capitalization, 52 flags
>2 leshort 0x07 7-bit, capitalization, 52 flags
>2 leshort 0x08 8-bit, no capitalization, 128 flags
>2 leshort 0x09 7-bit, no capitalization, 128 flags
>2 leshort 0x0A 8-bit, capitalization, 128 flags
>2 leshort 0x0B 7-bit, capitalization, 128 flags
>2 leshort 0x0C 8-bit, no capitalization, 256 flags
>2 leshort 0x0D 7-bit, no capitalization, 256 flags
>2 leshort 0x0E 8-bit, capitalization, 256 flags
>2 leshort 0x0F 7-bit, capitalization, 256 flags
>4 leshort >0 and %d string characters
0 beshort&0xFFFC 0x9600 big endian ispell
>1 byte 0 hash file (?),
>1 byte 1 3.0 hash file,
>1 byte 2 3.1 hash file,
>1 byte 3 hash file (?),
>2 beshort 0x00 8-bit, no capitalization, 26 flags
>2 beshort 0x01 7-bit, no capitalization, 26 flags
>2 beshort 0x02 8-bit, capitalization, 26 flags
>2 beshort 0x03 7-bit, capitalization, 26 flags
>2 beshort 0x04 8-bit, no capitalization, 52 flags
>2 beshort 0x05 7-bit, no capitalization, 52 flags
>2 beshort 0x06 8-bit, capitalization, 52 flags
>2 beshort 0x07 7-bit, capitalization, 52 flags
>2 beshort 0x08 8-bit, no capitalization, 128 flags
>2 beshort 0x09 7-bit, no capitalization, 128 flags
>2 beshort 0x0A 8-bit, capitalization, 128 flags
>2 beshort 0x0B 7-bit, capitalization, 128 flags
>2 beshort 0x0C 8-bit, no capitalization, 256 flags
>2 beshort 0x0D 7-bit, no capitalization, 256 flags
>2 beshort 0x0E 8-bit, capitalization, 256 flags
>2 beshort 0x0F 7-bit, capitalization, 256 flags
>4 beshort >0 and %d string characters
#------------------------------------------------------------
# Java ByteCode
0 belong 0xcafebabe
>4 belong 0x0003002d Java bytecode
#------------------------------------------------------------------------------
# karma: file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>
0 string KarmaRHD Version Karma Data Structure Version
>16 long x %lu
#------------------------------------------------------------------------------
# lex: file(1) magic for lex
#
# derived empirically, your offsets may vary!
53 string yyprevious C program text (from lex)
>3 string >\0 for %s
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21 string generated\ by\ flex C program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0 string %{ lex description text
#------------------------------------------------------------------------------
# lif: file(1) magic for lif
#
# XXX - byte order? (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
#
0 short 0x8000 lif file
#------------------------------------------------------------------------------
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2 leshort 100 Linux/i386
# >0 leshort 0407 impure executable (OMAGIC)
# >0 leshort 0410 pure executable (NMAGIC)
# >0 leshort 0413 demand-paged executable (ZMAGIC)
# >0 leshort 0314 demand-paged executable (QMAGIC)
#
0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
>16 lelong 0 \b, stripped
0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
>16 lelong 0 \b, stripped
0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
>16 lelong 0 \b, stripped
0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
>16 lelong 0 \b, stripped
#
0 string \007\001\000 Linux/i386 object file
>20 lelong >0x1020 \b, DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0 string *nazgul* compiled message catalog
>8 lelong >0 \b, version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216 lelong 0421 Linux/i386 core file
>220 string >\0 of '%s'
>200 lelong >0 (signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2 string LILO Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0 string 0.9
>8 byte 0x0a Debian Binary Package
>>3 byte >0 \b, created by dpkg 0.9%c
>>4 byte >0 pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0 leshort 0x0436 Linux/i386 PC Screen Font data,
>2 byte 0 256 characters, no directory,
>2 byte 1 512 characters, no directory,
>2 byte 2 256 characters, Unicode directory,
>2 byte 3 512 characters, Unicode directory,
>3 byte >0 8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086 string SWAP-SPACE Linux/i386 swap file
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
# from Erik Troan (ewt@redhat.com) examining od dumps, so this
# could be wrong
# updated by David Mosberger (davidm@azstarnet.com) based on
# GNU BFD and MIPS info found below.
#
0 leshort 0x0183 ECOFF alpha
>24 leshort 0407 executable
>24 leshort 0410 pure
>24 leshort 0413 demand paged
>8 long >0 not stripped
>8 long 0 stripped
>23 leshort >0 - version %ld.
# linux Kernel images version 1.3.80 - ?
# from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
0 belong 0xb8c0078e Linux/x86 kernel image,
>0x048c byte 0x31
>>0x048c string x version %s
>0x0493 byte 0x31
>>0x0493 string x version %s
#
#------------------------------------------------------------------------------
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string ;; Lisp/Scheme program text
# Emacs 18 - this is always correct, but not very magical.
0 string \012( byte-compiled Emacs-Lisp program data
# Emacs 19
0 string ;ELC\023\000\000\000 byte-compiled Emacs-Lisp program data
#------------------------------------------------------------------------------
# mach file description
#
0 belong 0xcafebabe mach-o fat file
>4 belong 1 with 1 architecture
>4 belong >1
>>4 belong x with %ld architectures
#
0 belong 0xfeedface mach-o
>12 belong 1 object
>12 belong 2 executable
>12 belong 3 shared library
>12 belong 4 core
>12 belong 5 preload executable
>12 belong >5
>>12 belong x filetype=%ld
>4 belong <0
>>4 belong x architecture=%ld
>4 belong 1 vax
>4 belong 2 romp
>4 belong 3 architecture=3
>4 belong 4 ns32032
>4 belong 5 ns32332
>4 belong 6 for m68k architecture
>4 belong 7 i386
>4 belong 8 mips
>4 belong 9 ns32532
>4 belong 10 architecture=10
>4 belong 11 hp pa-risc
>4 belong 12 acorn
>4 belong 13 m88k
>4 belong 14 sparc
>4 belong 15 i860-big
>4 belong 16 i860
>4 belong 17 rs6000
>4 belong 18 powerPC
>4 belong >18
>>4 belong x architecture=%ld
#------------------------------------------------------------------------------
# magic: file(1) magic for magic files
#
0 string #\ Magic magic text file for file(1) cmd
#------------------------------------------------------------------------------
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0 string From mail text
# There are tests to ascmagic.c to cope with mail and news.
0 string Relay-Version: old news text
0 string #!\ rnews batched news text
0 string N#!\ rnews mailed, batched news text
0 string Forward\ to mail forwarding text
0 string Pipe\ to mail piping text
0 string Return-Path: smtp mail text
0 string Path: news text
0 string Xref: news text
0 string From: news or mail text
0 string Article saved news text
0 string BABYL Emacs RMAIL text
0 string Received: RFC 822 mail message
0 string MIME-Version: MIME entity
0 string Content- MIME entity
#------------------------------------------------------------------------------
# microsoft: file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
# treat as folklore until proven"
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives
#
0 string core core file (Xenix)
0 byte 0x80 8086 relocatable (Microsoft)
0 leshort 0xff65 x.out
>2 string __.SYMDEF randomized
>0 byte x archive
0 leshort 0x206 Microsoft a.out
>8 leshort 1 Middle model
>0x1e leshort &0x10 overlay
>0x1e leshort &0x2 separate
>0x1e leshort &0x4 pure
>0x1e leshort &0x800 segmented
>0x1e leshort &0x400 standalone
>0x1e leshort &0x8 fixed-stack
>0x1c byte &0x80 byte-swapped
>0x1c byte &0x40 word-swapped
>0x10 lelong >0 not-stripped
>0x1e leshort ^0xc000 pre-SysV
>0x1e leshort &0x4000 V2.3
>0x1e leshort &0x8000 V3.0
>0x1c byte &0x4 86
>0x1c byte &0xb 186
>0x1c byte &0x9 286
>0x1c byte &0xa 386
>0x1f byte <0x040 small model
>0x1f byte =0x048 large model
>0x1f byte =0x049 huge model
>0x1e leshort &0x1 executable
>0x1e leshort ^0x1 object file
>0x1e leshort &0x40 Large Text
>0x1e leshort &0x20 Large Data
>0x1e leshort &0x120 Huge Objects Enabled
>0x10 lelong >0 not stripped
0 leshort 0x140 old Microsoft 8086 x.out
>0x3 byte &0x4 separate
>0x3 byte &0x2 pure
>0 byte &0x1 executable
>0 byte ^0x1 relocatable
>0x14 lelong >0 not stripped
0 lelong 0x206 b.out
>0x1e leshort &0x10 overlay
>0x1e leshort &0x2 separate
>0x1e leshort &0x4 pure
>0x1e leshort &0x800 segmented
>0x1e leshort &0x400 standalone
>0x1e leshort &0x1 executable
>0x1e leshort ^0x1 object file
>0x1e leshort &0x4000 V2.3
>0x1e leshort &0x8000 V3.0
>0x1c byte &0x4 86
>0x1c byte &0xb 186
>0x1c byte &0x9 286
>0x1c byte &0x29 286
>0x1c byte &0xa 386
>0x1e leshort &0x4 Large Text
>0x1e leshort &0x2 Large Data
>0x1e leshort &0x102 Huge Objects Enabled
0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
#------------------------------------------------------------------------------
# mirage: file(1) magic for Mirage executables
#
# XXX - byte order?
#
0 long 31415 Mirage Assembler m.out executable
#------------------------------------------------------------------------------
# mkid: file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0 string \311\304 ID tags data
>2 short >0 version %d
#------------------------------------------------------------------------------
# mmdf: file(1) magic for MMDF mail files
#
0 string \001\001\001\001 MMDF mailbox
#------------------------------------------------------------------------------
# motorola: file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
0 beshort 0520 mc68k COFF
>18 beshort ^00000020 object
>18 beshort &00000020 executable
>12 belong >0 not stripped
>168 string .lowmem Apple toolbox
>20 beshort 0407 (impure)
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0421 (standalone)
0 beshort 0521 mc68k executable (shared)
>12 belong >0 not stripped
0 beshort 0522 mc68k executable (shared demand paged)
>12 belong >0 not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0 beshort 0554 68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0 beshort 0555 88K BCS executable
#
# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
0 string S0 Motorola S-Record; binary data in text format
#------------------------------------------------------------------------------
# msdos: file(1) magic for MS-DOS files
#
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0 string @echo\ off MS-DOS batch file text
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0 string MZ MS-DOS executable (EXE)
>24 string @ \b, OS/2 or Windows
>1638 string -lh5- \b, LHa SFX archive v2.13S
>7195 string Rar! \b, RAR self-extracting archive
#
# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
# 8161 bytes are ignored. To make the following entries work, increase
# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
# NT/Win32 and VMS.]
# [GRR: some company sells a self-extractor/displayer for image data(!)]
#
>11696 string PK\003\004 \b, PKZIP SFX archive v1.1
>13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
>15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
>15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
>28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
# these are the DOS versions:
>25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# these are the OS/2 versions (OS/2 is flagged above):
>47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# this is the NT/Win32 version:
>69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0 byte 0xe9 MS-DOS executable (COM)
#0 byte 0x8c MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0 byte 0xeb MS-DOS executable (COM)
#0 byte 0xb8 MS-DOS executable (COM)
# miscellaneous formats
0 string LZ MS-DOS executable (built-in)
#0 byte 0xf0 MS-DOS program library data
#
# Popular applications
2080 string Microsoft\ Word\ 6.0\ Document %s
#
0 belong 0x31be0000 Microsoft Word Document
#
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
#
0 belong 0x00001a00 Lotus 1-2-3
>4 belong 0x00100400 wk3 document
>4 belong 0x02100400 wk4 document
>4 belong 0x07800100 fm3 or fmb document
>4 belong 0x07800000 fm3 or fmb document
#
0 belong 0x00000200 Lotus 1-2-3
>4 belong 0x06040600 wk1 document
>4 belong 0x06800200 fmt document
#------------------------------------------------------------------------------
# ncr: file(1) magic for NCR Tower objects
#
# contributed by
# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
#
0 beshort 000610 Tower/XP rel 2 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000615 Tower/XP rel 2 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000620 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000625 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000630 Tower32/600/400 68020 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000640 Tower32/800 68020
>18 beshort &020000 w/68881 object
>18 beshort &040000 compatible object
>18 beshort &~060000 object
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %ld
0 beshort 000645 Tower32/800 68010
>18 beshort &040000 compatible object
>18 beshort &~060000 object
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %ld
#------------------------------------------------------------------------------
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
#
0 lelong 000000413 386BSD demand paged executable
>16 lelong >0 not stripped
0 lelong 000000314 BSDI demand paged executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong&077777777 041400314 FreeBSD/i386 demand paged
>3 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>3 byte ^0x80 executable
>16 lelong >0 not stripped
0 lelong 000000407 NetBSD little-endian object file
>16 lelong >0 not stripped
0 belong 000000407 NetBSD big-endian object file
>16 belong >0 not stripped
0 belong&0377777777 041400413 NetBSD/i386 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 041400410 NetBSD/i386 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 041400407 NetBSD/i386
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 041400507 NetBSD/i386 core
>12 string >\0 from '%s'
0 belong&0377777777 041600413 NetBSD/m68k demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 041600410 NetBSD/m68k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 041600407 NetBSD/m68k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 041600507 NetBSD/m68k core
>12 string >\0 from '%s'
0 belong&0377777777 042000413 NetBSD/m68k4k demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042000410 NetBSD/m68k4k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042000407 NetBSD/m68k4k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 042000507 NetBSD/m68k4k core
>12 string >\0 from '%s'
0 belong&0377777777 042200413 NetBSD/ns32532 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042200410 NetBSD/ns32532 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042200407 NetBSD/ns32532
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 042200507 NetBSD/ns32532 core
>12 string >\0 from '%s'
0 belong&0377777777 042400413 NetBSD/sparc demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042400410 NetBSD/sparc pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042400407 NetBSD/sparc
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 042400507 NetBSD/sparc core
>12 string >\0 from '%s'
0 belong&0377777777 042600413 NetBSD/pmax demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042600410 NetBSD/pmax pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042600407 NetBSD/pmax
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 042600507 NetBSD/pmax core
>12 string >\0 from '%s'
0 belong&0377777777 043000413 NetBSD/vax demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 043000410 NetBSD/vax pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 043000407 NetBSD/vax
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 043000507 NetBSD/vax core
>12 string >\0 from '%s'
0 belong&0377777777 043400413 NetBSD/mips demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 043400410 NetBSD/mips pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 043400407 NetBSD/mips
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 043400507 NetBSD/mips core
>12 string >\0 from '%s'
#------------------------------------------------------------------------------
# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
#
0 string StartFontMetrics ASCII font metrics
0 string StartFont ASCII font bits
0 belong 0x137A2944 NeWS bitmap font
0 belong 0x137A2947 NeWS font family
0 belong 0x137A2950 scalable OpenFont binary
0 belong 0x137A2951 encrypted scalable OpenFont binary
8 belong 0x137A2B45 X11/NeWS bitmap font
8 belong 0x137A2B48 X11/NeWS font family
#------------------------------------------------------------------------------
# pbm: file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
0 short 0x2a17 "compact bitmap" format (Poskanzer)
#------------------------------------------------------------------------------
# pdf: file(1) magic for Portable Document Format
#
0 string %PDF- PDF document
>5 byte x \b, version %c
>7 byte x \b.%c
#------------------------------------------------------------------------------
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
0 lelong 0101554 PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0 leshort 0407 PDP-11 executable
>8 leshort >0 not stripped
>15 byte >0 - version %ld
0 leshort 0401 PDP-11 UNIX/RT ldp
0 leshort 0405 PDP-11 old overlay
0 leshort 0410 PDP-11 pure executable
>8 leshort >0 not stripped
>15 byte >0 - version %ld
0 leshort 0411 PDP-11 separate I&D executable
>8 leshort >0 not stripped
>15 byte >0 - version %ld
0 leshort 0437 PDP-11 kernel overlay
#------------------------------------------------------------------------------
# pgp: file(1) magic for Pretty Good Privacy
#
0 beshort 0x9900 PGP key public ring
0 beshort 0x9501 PGP key security ring
0 beshort 0x9500 PGP key security ring
0 beshort 0xa600 PGP encrypted data
0 string -----BEGIN\040PGP PGP armored data
>15 string PUBLIC\040KEY\040BLOCK- public key block
>15 string MESSAGE- message
>15 string SIGNED\040MESSAGE- signed message
>15 string PGP\040SIGNATURE- signature
#------------------------------------------------------------------------------
# pkgadd: file(1) magic for SysV R4 PKG Datastreams
#
0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
#------------------------------------------------------------------------------
# plus5: file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order? Paging Hokey....
#
0 short 0x259 mumps avl global
>2 byte >0 (V%d)
>6 byte >0 with %d byte name
>7 byte >0 and %d byte data cells
0 short 0x25a mumps blt global
>2 byte >0 (V%d)
>8 short >0 - %d byte blocks
>15 byte 0x00 - P/D format
>15 byte 0x01 - P/K/D format
>15 byte 0x02 - K/D format
>15 byte >0x02 - Bad Flags
#------------------------------------------------------------------------------
# printer: file(1) magic for printer-formatted files
#
# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0 string %! PostScript document text
>2 string PS-Adobe- conforming
>>11 string >\0 at level %.3s
>>>15 string EPS - type %s
>>>15 string Query - type %s
>>>15 string ExitServer - type %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0 string \004%! PostScript document text
>3 string PS-Adobe- conforming
>>12 string >\0 at level %.3s
>>>16 string EPS - type %s
>>>16 string Query - type %s
>>>16 string ExitServer - type %s
# HP Printer Job Language
0 string \033%-12345X@PJL HP Printer Job Language data
>15 string \ ENTER\ LANGUAGE\ =
>31 string PostScript Postscript
# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0 string \033E\033 HP PCL printer data
>3 string \&l0A - default page size
>3 string \&l1A - US executive page size
>3 string \&l2A - US letter page size
>3 string \&l3A - US legal page size
>3 string \&l26A - A4 page size
>3 string \&l80A - Monarch envelope size
>3 string \&l81A - No. 10 envelope size
>3 string \&l90A - Intl. DL envelope size
>3 string \&l91A - Intl. C5 envelope size
>3 string \&l100A - Intl. B5 envelope size
>3 string \&l-81A - No. 10 envelope size (landscape)
>3 string \&l-90A - Intl. DL envelope size (landscape)
# IMAGEN printer-ready files:
0 string @document( Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10 string language\ impress (imPRESS data)
>10 string language\ daisy (daisywheel text)
>10 string language\ diablo (daisywheel text)
>10 string language\ printer (line printer emulation)
>10 string language\ tektronix (Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0 string Rast RST-format raster font data
>45 string >0 face %
#------------------------------------------------------------------------------
# psdbms: file(1) magic for psdatabase
#
0 belong&0xff00ffff 0x56000000 ps database
>1 string >\0 version %s
>4 string >\0 from kernel %s
#------------------------------------------------------------------------------
# pyramid: file(1) magic for Pyramids
#
# XXX - byte order?
#
0 long 0x50900107 Pyramid 90x family executable
0 long 0x50900108 Pyramid 90x family pure executable
>16 long >0 not stripped
0 long 0x5090010b Pyramid 90x family demand paged pure executable
>16 long >0 not stripped
#------------------------------------------------------------------------------
#
# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
#
0 beshort 0xedab
>2 beshort 0xeedb RPM
>>4 byte x v%d
>>6 beshort 0 bin
>>6 beshort 1 src
>>8 beshort 1 i386
>>8 beshort 2 Alpha
>>8 beshort 3 Sparc
>>8 beshort 4 MIPS
>>8 beshort 5 PowerPC
>>8 beshort 6 68000
>>8 beshort 7 SGI
>>10 string x %s
#------------------------------------------------------------------------------
# rtf: file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0 string {\\rtf Rich Text Format data,
>5 byte x version %c,
>6 string \\ansi ANSI
>6 string \\mac Apple Macintosh
>6 string \\pc IBM PC, code page 437
>6 string \\pca IBM PS/2, code page 850
#------------------------------------------------------------------------------
# sc: file(1) magic for "sc" spreadsheet
#
38 string Spreadsheet sc spreadsheet file
#------------------------------------------------------------------------------
# sccs: file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet.
# Hence the following official kludge:
8 string \001s\ SCCS archive data
#------------------------------------------------------------------------------
# sendmail: file(1) magic for sendmail config files
#
# XXX - byte order?
#
0 byte 046 Sendmail frozen configuration
>16 string >\0 - version %s
0 short 0x271c Sendmail frozen configuration
>16 string >\0 - version %s
#------------------------------------------------------------------------------
# sequent: file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0 lelong 0x00ea BALANCE NS32000 .o
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 lelong 0x30ea BALANCE NS32000 standalone executable
>16 lelong >0 not stripped
>124 lelong >0 version %ld
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0 leshort 0x12eb SYMMETRY i386 .o
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 leshort 0x42eb SYMMETRY i386 standalone executable
>16 lelong >0 not stripped
>124 lelong >0 version %ld
#------------------------------------------------------------------------------
# sgi: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
#
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
0 belong 0407 old SGI 68020 executable
0 belong 0410 old SGI 68020 pure executable
0 beshort 0x8765 disk quotas file
0 beshort 0x0506 IRIS Showcase file
>2 byte 0x49 -
>3 byte x - version %ld
0 beshort 0x0226 IRIS Showcase template
>2 byte 0x63 -
>3 byte x - version %ld
0 belong 0x5343464d IRIS Showcase file
>4 byte x - version %ld
0 belong 0x5443464d IRIS Showcase template
>4 byte x - version %ld
0 belong 0xdeadbabe IRIX Parallel Arena
>8 belong >0 - version %ld
#
0 beshort 0x0160 MIPSEB COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x0162 MIPSEL COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x .%ld
#
0 beshort 0x6001 MIPSEB-LE COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %d
>23 byte x .%ld
#
0 beshort 0x6201 MIPSEL-LE COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
# MIPS 2 additions
#
0 beshort 0x0163 MIPSEB MIPS-II COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x0166 MIPSEL MIPS-II COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x6301 MIPSEB-LE MIPS-II COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x6601 MIPSEL-LE MIPS-II COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
# MIPS 3 additions
#
0 beshort 0x0140 MIPSEB MIPS-III COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x0142 MIPSEL MIPS-III COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x4001 MIPSEB-LE MIPS-III COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x4201 MIPSEL-LE MIPS-III COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x180 MIPSEB Ucode
0 beshort 0x182 MIPSEL Ucode
# 32bit core file
0 belong 0xdeadadb0 IRIX core dump
>4 belong 1 of
>16 string >\0 '%s'
# 64bit core file
0 belong 0xdeadad40 IRIX 64-bit core dump
>4 belong 1 of
>16 string >\0 '%s'
# New style crash dump file
0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
>36 string >\0 '%s'
# Trusted IRIX info
0 string SGIAUDIT SGI Audit file
>8 byte x - version %d
>9 byte x .%ld
# Are these three SGI-based file types or general ones?
0 string WNGZWZSC Wingz compiled script
0 string WNGZWZSS Wingz spreadsheet
0 string WNGZWZHP Wingz help file
#
0 string \#Inventor V IRIS Inventor file
# XXX - I don't know what next thing is! It is likely to be an image
# (or movie) format
0 string glfHeadMagic(); GLF_TEXT
4 belong 0x41010000 GLF_BINARY_LSB_FIRST
4 belong 0x00000141 GLF_BINARY_MSB_FIRST
#------------------------------------------------------------------------------
# sgml: file(1) magic for Standard Generalized Markup Language
# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \<!DOCTYPE\ HTML HTML document text
0 string \<!doctype\ html HTML document text
0 string \<HEAD HTML document text
0 string \<head HTML document text
0 string \<TITLE HTML document text
0 string \<title HTML document text
0 string \<html HTML document text
0 string \<HTML HTML document text
# SGML, mostly from rph@sq
0 string \<!DOCTYPE exported SGML document text
0 string \<!doctype exported SGML document text
0 string \<!SUBDOC exported SGML subdocument text
0 string \<!subdoc exported SGML subdocument text
0 string \<!-- exported SGML document text
#------------------------------------------------------------------------------
# softquad: file(1) magic for SoftQuad Publishing Software
#
# $Id: softquad,v 1.9 1995/01/21 21:09:00 christos Exp $
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0 string \<!SQ\ DTD> Compiled SGML rules file
>9 string >\0 Type %s
0 string \<!SQ\ A/E> A/E SGML Document binary
>9 string >\0 Type %s
0 string \<!SQ\ STS> A/E SGML binary styles file
>9 string >\0 Type %s
0 short 0xc0de Compiled PSI (v1) data
0 short 0xc0da Compiled PSI (v2) data
>3 string >\0 (%s)
# Binary sqtroff font/desc files...
0 short 0125252 SoftQuad DESC or font file binary
>2 short >0 - version %d
# Bitmaps...
0 string SQ\ BITMAP1 SoftQuad Raster Format text
#0 string SQ\ BITMAP2 SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0 string X\ SoftQuad troff Context intermediate
>2 string 495 for AT&T 495 laser printer
>2 string hp for Hewlett-Packard LaserJet
>2 string impr for IMAGEN imPRESS
>2 string ps for PostScript
#------------------------------------------------------------------------------
# sun: file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases. (5.x uses ELF.)
#
0 belong&077777777 0600413 sparc demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0600410 sparc pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0600407 sparc
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0400413 mc68020 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>16 belong >0 not stripped
0 belong&077777777 0400410 mc68020 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0400407 mc68020
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0200413 mc68010 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>16 belong >0 not stripped
0 belong&077777777 0200410 mc68010 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0200407 mc68010
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
# reworked these to avoid anything beginning with zero becoming "old sun-2"
0 belong 0407 old sun-2 executable
>16 belong >0 not stripped
0 belong 0410 old sun-2 pure executable
>16 belong >0 not stripped
0 belong 0413 old sun-2 demand paged executable
>16 belong >0 not stripped
#
# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
#
0 belong 0x080456 SunOS core file
>4 belong 432 (SPARC)
>>132 string >\0 from '%s'
>>116 belong =3 (quit)
>>116 belong =4 (illegal instruction)
>>116 belong =5 (trace trap)
>>116 belong =6 (abort)
>>116 belong =7 (emulator trap)
>>116 belong =8 (arithmetic exception)
>>116 belong =9 (kill)
>>116 belong =10 (bus error)
>>116 belong =11 (segmentation violation)
>>116 belong =12 (bad argument to system call)
>>116 belong =29 (resource lost)
>>120 belong x (T=%dK,
>>124 belong x D=%dK,
>>128 belong x S=%dK)
>4 belong 826 (68K)
>>128 string >\0 from '%s'
>4 belong 456 (SPARC 4.x BCP)
>>152 string >\0 from '%s'
#------------------------------------------------------------------------------
# terminfo: file(1) magic for terminfo
#
# XXX - byte order for screen images?
#
0 string \032\001 Compiled terminfo entry
0 short 0433 Curses screen image
0 short 0434 Curses screen image
#------------------------------------------------------------------------------
# tex: file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>
# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0 string \367\002 TeX DVI file
>16 string >\0 (%s)
0 string \367\203 TeX generic font data
0 string \367\131 TeX packed font data
>3 string >\0 (%s)
0 string \367\312 TeX virtual font data
0 string This\ is\ TeX, TeX transcript text
0 string This\ is\ METAFONT, METAFONT transcript text
# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data. The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2 string \000\021 TeX font metric data
>33 string >\0 (%s)
2 string \000\022 TeX font metric data
>33 string >\0 (%s)
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input\ texinfo Texinfo source text
0 string This\ is\ Info\ file GNU Info text
# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input TeX document text
0 string \\section LaTeX document text
0 string \\setlength LaTeX document text
0 string \\documentstyle LaTeX document text
0 string \\chapter LaTeX document text
#------------------------------------------------------------------------------
# timezone: file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 timezone data
#------------------------------------------------------------------------------
# troff: file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
# troff input
0 string .\\" troff or preprocessor input text
0 string '\\" troff or preprocessor input text
0 string '.\\" troff or preprocessor input text
0 string \\" troff or preprocessor input text
# ditroff intermediate output text
0 string x\ T ditroff text
>4 string cat for the C/A/T phototypesetter
>4 string ps for PostScript
>4 string dvi for DVI
>4 string ascii for ASCII
>4 string lj4 for LaserJet 4
>4 string latin1 for ISO 8859-1 (Latin 1)
>4 string X75 for xditview at 75dpi
>>7 string -12 (12pt)
>4 string X100 for xditview at 100dpi
>>8 string -12 (12pt)
# output data formats
0 string \100\357 very old (C/A/T) troff output data
#------------------------------------------------------------------------------
# typeset: file(1) magic for other typesetting
#
0 string Interpress/Xerox Xerox InterPress data
>16 string / (version
>>17 string >\0 %s)
#------------------------------------------------------------------------------
# unknown: file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
#
# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown.
#
0 short 0x107 unknown machine executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x108 unknown pure executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x109 PDP-11 separate I&D
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x10b unknown pure executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 long 0x10c unknown demand paged pure executable
>16 long >0 not stripped
0 long 0x10d unknown demand paged pure executable
>16 long >0 not stripped
0 long 0x10e unknown readable demand paged pure executable
#------------------------------------------------------------------------------
# uuencode: file(1) magic for ASCII-encoded files
#
# GRR: the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is 'h' instead of
# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.) If regular expressions
# were supported, this entry could possibly be split into two with
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
0 string begin\040 uuencoded or xxencoded text
# btoa(1) is an alternative to uuencode that requires less space.
0 string xbtoa\ Begin btoa'd text
# ship(1) is another, much cooler alternative to uuencode.
# Greg Roelofs, newt@uchicago.edu
0 string $\012ship ship'd binary text
# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
# Greg Roelofs, newt@uchicago.edu
0 string Decode\ the\ following\ with\ bdeco bencoded News text
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11 string must\ be\ converted\ with\ BinHex BinHex binary text
>41 string x \b, version %.3s
# GRR: is MIME BASE64 encoding handled somewhere?
#------------------------------------------------------------------------------
# varied.out: file(1) magic for various USG systems
#
# Herewith many of the object file formats used by USG systems.
# Most have been moved to files for a particular processor,
# and deleted if they duplicate other entries.
#
0 short 0610 Perkin-Elmer executable
# AMD 29K
0 beshort 0572 amd 29k coff noprebar executable
0 beshort 01572 amd 29k coff prebar executable
0 beshort 0160007 amd 29k coff archive
# Cray
6 beshort 0407 unicos (cray) executable
#------------------------------------------------------------------------------
# vax: file(1) magic for VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
0 lelong 0101556 VAX double precision APL workspace
#
# VAX a.out (32V, BSD)
#
0 lelong 0407 VAX executable
>16 lelong >0 not stripped
0 lelong 0410 VAX pure executable
>16 lelong >0 not stripped
0 lelong 0413 VAX demand paged pure executable
>16 lelong >0 not stripped
0 lelong 0420 VAX demand paged (first page unmapped) pure executable
>16 lelong >0 not stripped
#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0 leshort 0570 VAX COFF executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
0 leshort 0575 VAX COFF pure executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
#------------------------------------------------------------------------------
# visx: file(1) magic for Visx format files
#
0 short 0x5555 VISX image file
>2 byte 0 (zero)
>2 byte 1 (unsigned char)
>2 byte 2 (short integer)
>2 byte 3 (float 32)
>2 byte 4 (float 64)
>2 byte 5 (signed char)
>2 byte 6 (bit-plane)
>2 byte 7 (classes)
>2 byte 8 (statistics)
>2 byte 10 (ascii text)
>2 byte 15 (image segments)
>2 byte 100 (image set)
>2 byte 101 (unsigned char vector)
>2 byte 102 (short integer vector)
>2 byte 103 (float 32 vector)
>2 byte 104 (float 64 vector)
>2 byte 105 (signed char vector)
>2 byte 106 (bit plane vector)
>2 byte 121 (feature vector)
>2 byte 122 (feature vector library)
>2 byte 124 (chain code)
>2 byte 126 (bit vector)
>2 byte 130 (graph)
>2 byte 131 (adjacency graph)
>2 byte 132 (adjacency graph library)
>2 string .VISIX (ascii text)
#------------------------------------------------------------------------------
# vms: file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
# GRR 950122: I'm just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures. The VAX files
# all had headers similar to this:
#
# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
#
0 string \xb0\0\x30\0 VMS VAX executable
>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
#
0 belong 0x03000000 VMS Alpha executable
>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
#------------------------------------------------------------------------------
# zilog: file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian? My Product Specification doesn't
# say.
#
0 long 0xe807 object file (z8000 a.out)
0 long 0xe808 pure object file (z8000 a.out)
0 long 0xe809 separate object file (z8000 a.out)
0 long 0xe805 overlay object file (z8000 a.out)
#------------------------------------------------------------------------------
# zyxel: file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
# ZyXEL-defined standard)
0 string ZyXEL\002 ZyXEL voice data
>10 byte 0 - CELP encoding
>10 byte&0x0B 1 - ADPCM2 encoding
>10 byte&0x0B 2 - ADPCM3 encoding
>10 byte&0x0B 3 - ADPCM4 encoding
>10 byte&0x0B 8 - New ADPCM3 encoding
>10 byte&0x04 4 with resync