The Datafile PD-CD 4

home *** CD-ROM | disk | FTP | other *** search

/ The Datafile PD-CD 4 / DATAFILE_PDCD4.iso / unix / riscbsd / 1_1_beta / upgrades / magic_gz / magic

Wrap

Text File | 1995-12-08 | 97.9 KB | 2,914 lines

#! file # Magic data for file(1) command. # Machine-genererated from src/cmd/file/magdir/*; edit there only! # Format is described in magic(files), where: # files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID. #------------------------------------------------------------------------------ # Localstuff: file(1) magic for locally observed files # # $Id: Localstuff,v 1.2 1995/03/25 22:37:25 christos Exp $ # Add any locally observed files here. Remember: # text if readable, executable if runnable binary, data if unreadable. #------------------------------------------------------------------------------ # mirage: file(1) magic for NetBSD executables # # All new-style magic numbers are in network byte order. # 0 lelong 000000413 386BSD demand paged executable >16 lelong >0 not stripped 0 lelong 000000314 BSDI demand paged executable >16 lelong >0 not stripped 0 lelong 000000407 NetBSD little-endian object file >16 lelong >0 not stripped 0 belong 000000407 NetBSD big-endian object file >16 belong >0 not stripped 0 belong&0377777777 041400413 NetBSD/i386 demand paged >0 byte &0x80 >>20 lelong <4096 shared library >>20 lelong =4096 dynamically linked executable >>20 lelong >4096 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 041400410 NetBSD/i386 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 041400407 NetBSD/i386 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong&0377777777 041400507 NetBSD/i386 core >12 string >\0 from '%s' 0 belong&0377777777 041600413 NetBSD/m68k demand paged >0 byte &0x80 >>20 belong <8192 shared library >>20 belong =8192 dynamically linked executable >>20 belong >8192 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 041600410 NetBSD/m68k pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 041600407 NetBSD/m68k >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 belong !0 executable >>20 belong =0 object file >16 belong >0 not stripped 0 belong&0377777777 041600507 NetBSD/m68k core >12 string >\0 from '%s' 0 belong&0377777777 042000413 NetBSD/m68k4k demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042000410 NetBSD/m68k4k pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042000407 NetBSD/m68k4k >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 belong !0 executable >>20 belong =0 object file >16 belong >0 not stripped 0 belong&0377777777 042000507 NetBSD/m68k4k core >12 string >\0 from '%s' 0 belong&0377777777 042200413 NetBSD/ns32532 demand paged >0 byte &0x80 >>20 lelong <4096 shared library >>20 lelong =4096 dynamically linked executable >>20 lelong >4096 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 042200410 NetBSD/ns32532 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 042200407 NetBSD/ns32532 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong&0377777777 042200507 NetBSD/ns32532 core >12 string >\0 from '%s' 0 belong&0377777777 042400413 NetBSD/sparc demand paged >0 byte &0x80 >>20 belong <8192 shared library >>20 belong =8192 dynamically linked executable >>20 belong >8192 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042400410 NetBSD/sparc pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042400407 NetBSD/sparc >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 belong !0 executable >>20 belong =0 object file >16 belong >0 not stripped 0 belong&0377777777 042400507 NetBSD/sparc core >12 string >\0 from '%s' 0 belong&0377777777 042600413 NetBSD/pmax demand paged >0 byte &0x80 >>20 lelong <4096 shared library >>20 lelong =4096 dynamically linked executable >>20 lelong >4096 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 042600410 NetBSD/pmax pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 042600407 NetBSD/pmax >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong&0377777777 042600507 NetBSD/pmax core >12 string >\0 from '%s' 0 belong&0377777777 043000413 NetBSD/vax demand paged >0 byte &0x80 >>20 lelong <4096 shared library >>20 lelong =4096 dynamically linked executable >>20 lelong >4096 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 043000410 NetBSD/vax pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 043000407 NetBSD/vax >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong&0377777777 043000507 NetBSD/vax core >12 string >\0 from '%s' 0 belong&0377777777 043400413 NetBSD/mips demand paged >0 byte &0x80 >>20 belong <8192 shared library >>20 belong =8192 dynamically linked executable >>20 belong >8192 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 043400410 NetBSD/mips pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 043400407 NetBSD/mips >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>0 byte &0x40 position independent >>20 belong !0 executable >>20 belong =0 object file >16 belong >0 not stripped 0 belong&0377777777 043400507 NetBSD/mips core >12 string >\0 from '%s' 0 belong 043600413 NetBSD/arm32 demand paged >0 byte &0x80 >>20 lelong <8192 shared library >>20 lelong =8192 dynamically linked executable >>20 lelong >8192 dynamically linked executable >0 byte ^0x80 executable >>20 lelong =0x400000 4M text base >>20 lelong >0x400000 4M text base >16 lelong >0 not stripped 0 belong 043600410 NetBSD/arm32 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong 043600407 NetBSD/arm32 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong 043600507 NetBSD/arm32 core >12 string >\0 from '%s' # Old arm MID 0 belong 031600413 old NetBSD/arm demand paged >0 byte &0x80 >>20 lelong <8192 old shared library >>20 lelong =8192 dynamically linked executable >>20 lelong >8192 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong 031600410 old NetBSD/arm pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong 031600407 old NetBSD/arm >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong 031600507 old NetBSD/arm core >12 string >\0 from '%s' #------------------------------------------------------------------------------ # alliant: file(1) magic for Alliant FX series a.out files # # If the FX series is the one that had a processor with a 68K-derived # instruction set, the "short" should probably become "beshort" and the # "long" should probably become "belong". # If it's the i860-based one, they should probably become either the # big-endian or little-endian versions, depending on the mode they ran # the 860 in.... # 0 short 0420 0420 Alliant virtual executable >2 short &0x0020 common library >16 long >0 not stripped 0 short 0421 0421 Alliant compact executable >2 short &0x0020 common library >16 long >0 not stripped #------------------------------------------------------------------------------ # animation: file(1) magic for animation/movie formats # # animation formats # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) # MPEG animation format 0 string \000\000\001\263 MPEG file # FLI animation format 4 leshort 0xAF11 FLI file >6 leshort x - %d frames, >8 leshort x width=%d pixels, >10 leshort x height=%d pixels, >12 leshort x depth=%d, >16 leshort x ticks/frame=%d # newer FLI or FLC format 4 leshort 0xAF12 newer FLI or FLC file >6 leshort x - %d frames >8 leshort x width=%d pixels, >10 leshort x height=%d pixels, >12 leshort x depth=%d, >16 leshort x ticks/frame=%d # DL animation format # XXX - collision with most `mips' magic # # I couldn't find a real magic number for these, however, this # -appears- to work. Note that it might catch other files, too, so be # careful! # # Note that title and author appear in the two 20-byte chunks # at decimal offsets 2 and 22, respectively, but they are XOR'ed with # 255 (hex FF)! The DL format is really bad. # #0 byte 1 DL version 1, medium format (160x100, 4 images/screen) #>42 byte x - %d screens, #>43 byte x %d commands #0 byte 2 DL version 2 #>1 byte 1 - large format (320x200,1 image/screen), #>1 byte 2 - medium format (160x100,4 images/screen), #>1 byte >2 - unknown format, #>42 byte x %d screens, #>43 byte x %d commands # Based on empirical evidence, DL version 3 have several nulls following the # \003. Most of them start with non-null values at hex offset 0x34 or so. #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 # SGI and Apple formats 0 string MOVI Silicon Graphics movie file 4 string moov Apple QuickTime movie file (moov) 4 string mdat Apple QuickTime movie file (mdat) #------------------------------------------------------------------------------ # apl: file(1) magic for APL (see also "pdp" and "vax" for other APL # workspaces) # 0 long 0100554 APL workspace (Ken's original?) #------------------------------------------------------------------------------ # apple: file(1) magic for Apple II file formats # 0 string FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string SIT! StuffIt (macintosh) text 0 string NuFile NuFile archive (apple ][) data 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data #------------------------------------------------------------------------------ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. # pre-POSIX "tar" archives are handled in the C code. # POSIX tar archives 257 string ustar\0 POSIX tar archive 257 string ustar\040\040\0 GNU tar archive # cpio archives # # Yes, the top two "cpio archive" formats *are* supposed to just be "short". # The idea is to indicate archives produced on machines with the same # byte order as the machine running "file" with "cpio archive", and # to indicate archives produced on machines with the opposite byte order # from the machine running "file" with "byte-swapped cpio archive". # # The SVR4 "cpio(4)" hints that there are additional formats, but they # are defined as "short"s; I think all the new formats are # character-header formats and thus are strings, not numbers. 0 short 070707 cpio archive 0 short 0143561 byte-swapped cpio archive 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC) # other archives 0 long 0177555 very old archive 0 short 0177555 very old PDP-11 archive 0 long 0177545 old archive 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string =<ar> archive # MIPS archive (needs to go first) # 0 string !<arch>\n__________E MIPS archive >20 string U with MIPS Ucode members >21 string L with MIPSEL members >21 string B with MIPSEB members >19 string L and an EL hash table >19 string B and an EB hash table >22 string X -- out of date 0 string !<arch> archive >8 string __.SYMDEF random library 0 string -h- Software Tools format archive text # # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: # # 0 string !<arch> current ar archive # 0 long 0x213c6172 archive file # # and for SVR3.1 archives, we have: # # 0 string \<ar> System V Release 1 ar archive # 0 string =<ar> archive # 0 string =<ar> archive # # XXX - did Aegis really store shared libraries, breakpointed modules, # and absolute code program modules in the same format as new-style # "ar" archives? # 0 string !<arch> current ar archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 >0 beshort 2 - object archive >0 beshort 3 - shared library module >0 beshort 4 - debug break-pointed module >0 beshort 5 - absolute code program module 0 string \<ar> System V Release 1 ar archive 0 string =<ar> archive # # XXX - from "vax", which appears to collect a bunch of byte-swapped # thingies, to help you recognize VAX files on big-endian machines; # with "leshort", "lelong", and "string", that's no longer necessary.... # 0 belong 0x65ff0000 VAX 3.0 archive 0 belong 0x3c61723e VAX 5.0 archive # 0 long 0x213c6172 archive file 0 lelong 0177555 very old VAX archive 0 leshort 0177555 very old PDP-11 archive # # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus # be a random library (it said 0xff65 rather than 0177545). # 0 lelong 0177545 old VAX archive >8 string __.SYMDEF random library 0 leshort 0177545 old PDP-11 archive >8 string __.SYMDEF random library # 0 string =<ar> archive # # From "pdp": # 0 lelong 0x39bed PDP-11 old archive 0 lelong 0x39bee PDP-11 4.0 archive # 0 string -h- Software Tools format archive text # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) # # The first byte is the magic (0x1a), byte 2 is the compression type for # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS # filename of the first file (null terminated). Since some types collide # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff # [GRR: the original entries collide with ARC, above; replaced with combined # version (not tested)] #0 byte 0x1a RISC OS archive #>1 string archive (ArcFS format) 0 string \032archive RISC OS archive (ArcFS format) # ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data >5 byte x \b, v%d, >8 byte &0x04 multi-volume, >8 byte &0x10 slash-switched, >8 byte &0x20 backup, >34 string x original name: %s, >7 byte 0 os: MS-DOS >7 byte 1 os: PRIMOS >7 byte 2 os: Unix >7 byte 3 os: Amiga >7 byte 4 os: Macintosh >7 byte 5 os: OS/2 >7 byte 6 os: Apple ][ GS >7 byte 7 os: Atari ST >7 byte 8 os: NeXT >7 byte 9 os: VAX/VMS >3 byte >0 %d] # HA archiver (Greg Roelofs, newt@uchicago.edu) # This is a really bad format. A file containing HAWAII will match this... #0 string HA HA archive data, #>2 leshort =1 1 file, #>2 leshort >1 %u files, #>4 byte&0x0f =0 first is type CPY #>4 byte&0x0f =1 first is type ASC #>4 byte&0x0f =2 first is type HSC #>4 byte&0x0f =0x0e first is type DIR #>4 byte&0x0f =0x0f first is type SPECIAL # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 0 string HPAK HPACK archive data # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 0 string \351,\001JAM\ JAM archive, >7 string >\0 version %.4s >0x26 byte =0x27 - >>0x2b string >\0 label %.11s, >>0x27 lelong x serial %08x, >>0x36 string >\0 fstype %.8s # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 2 string -lh0- LHarc 1.x archive data [lh0] 2 string -lh1- LHarc 1.x archive data [lh1] 2 string -lz4- LHarc 1.x archive data [lz4] 2 string -lz5- LHarc 1.x archive data [lz5] # [never seen any but the last; -lh4- reported in comp.compression:] 2 string -lzs- LHa 2.x? archive data [lzs] 2 string -lh - LHa 2.x? archive data [lh ] 2 string -lhd- LHa 2.x? archive data [lhd] 2 string -lh2- LHa 2.x? archive data [lh2] 2 string -lh3- LHa 2.x? archive data [lh3] 2 string -lh4- LHa (2.x) archive data [lh4] 2 string -lh5- LHa (2.x) archive data [lh5] >20 byte x - header level %d # RAR archiver (Greg Roelofs, newt@uchicago.edu) 0 string Rar! RAR archive data # SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 0 string SQSH squished archive data (Acorn RISCOS) # UC2 archiver (Greg Roelofs, newt@uchicago.edu) # I can't figure out the self-extracting form of these buggers... 0 string UC2\x1a UC2 archive data # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 0 string PK\003\004 Zip archive data >4 byte 0x09 \b, at least v0.9 to extract >4 byte 0x0a \b, at least v1.0 to extract >4 byte 0x0b \b, at least v1.1 to extract >4 byte 0x14 \b, at least v2.0 to extract # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data >4 byte >48 \b, v%c. >>6 byte >47 \b%c >>>7 byte >47 \b%c >32 byte >0 \b, modify: v%d >>33 byte x \b.%d+ >42 lelong 0xfdc4a7dc \b, >>70 byte >0 extract: v%d >>>71 byte x \b.%d+ # Shell archives 10 string #\ This\ is\ a\ shell\ archive shell archive text #------------------------------------------------------------------------------ # att3b: file(1) magic for AT&T 3B machines # # The `versions' should be un-commented if they work for you. # (Was the problem just one of endianness?) # # 3B20 # 0 beshort 0550 3b20 COFF executable >12 belong >0 not stripped #>22 beshort >0 - version %ld 0 beshort 0551 3b20 COFF executable (TV) >12 belong >0 not stripped #>22 beshort >0 - version %ld # # WE32K # 0 beshort 0560 WE32000 COFF >18 beshort ^00000020 object >18 beshort &00000020 executable >12 belong >0 not stripped >18 beshort ^00010000 N/A on 3b2/300 w/paging >18 beshort &00020000 32100 required >18 beshort &00040000 and MAU hardware required >20 beshort 0407 (impure) >20 beshort 0410 (pure) >20 beshort 0413 (demand paged) >20 beshort 0443 (target shared library) >22 beshort >0 - version %ld 0 beshort 0561 WE32000 COFF executable (TV) >12 belong >0 not stripped #>18 beshort &00020000 - 32100 required #>18 beshort &00040000 and MAU hardware required #>22 beshort >0 - version %ld # # core file for 3b2 0 string \000\004\036\212\200 3b2 core file >364 string >\0 of '%s' #------------------------------------------------------------------------------ # audio: file(1) magic for sound formats # # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), # and others # # Sun/NeXT audio data 0 string .snd Sun/NeXT audio data: >12 belong 1 8-bit ISDN u-law, >12 belong 2 8-bit linear PCM [REF-PCM], >12 belong 3 16-bit linear PCM, >12 belong 4 24-bit linear PCM, >12 belong 5 32-bit linear PCM, >12 belong 6 32-bit IEEE floating point, >12 belong 7 64-bit IEEE floating point, >12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), >20 belong 1 mono, >20 belong 2 stereo, >20 belong 4 quad, >16 belong >0 %d Hz # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format # that uses little-endian encoding and has a different magic number 0 lelong 0x0064732E DEC audio data: >12 lelong 1 8-bit ISDN u-law, >12 lelong 2 8-bit linear PCM [REF-PCM], >12 lelong 3 16-bit linear PCM, >12 lelong 4 24-bit linear PCM, >12 lelong 5 32-bit linear PCM, >12 lelong 6 32-bit IEEE floating point, >12 lelong 7 64-bit IEEE floating point, >12 lelong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), >20 lelong 1 mono, >20 lelong 2 stereo, >20 lelong 4 quad, >16 lelong >0 %d Hz # Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM" 8 string AIFF AIFF audio data 8 string AIFC AIFF-C audio data 8 string 8SVX IFF/8SVX audio data # Creative Labs AUDIO stuff 0 string MThd Standard MIDI data >9 byte >0 (format %d) >11 byte >1 using %d channels 0 string CTMF Creative Music (CMF) data 0 string SBI SoundBlaster instrument data 0 string Creative\ Voice\ File Creative Labs voice data # is this next line right? it came this way... >19 byte 0x1A >23 byte >0 - version %d >22 byte >0 \b.%d # first entry is also the string "NTRK" 0 belong 0x4e54524b MultiTrack sound data >4 belong x - version %ld # Microsoft WAVE format (*.wav) # [GRR 950115: probably all of the shorts and longs should be leshort/lelong] 0 string RIFF Microsoft RIFF >8 string WAVE - WAVE format >34 short >0 %d bit >22 short =1 Mono >22 short =2 Stereo >22 short >2 %d Channels >24 long >0 %d Hz # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 0 string EMOD Extended MOD sound data, >4 byte&0xf0 x version %d >4 byte&0x0f x \b.%d, >45 byte x %d instruments >83 byte 0 (module) >83 byte 1 (song) #------------------------------------------------------------------------------ # blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine # # Note that this 0407 conflicts with several other a.out formats... # # XXX - should this be redone with "be" and "le", so that it works on # little-endian machines as well? If so, what's the deal with # "VAX-order" and "VAX-order2"? # #0 long 0407 68K Blit (standalone) executable #0 short 0407 VAX-order2 68K Blit (standalone) executable 0 short 03401 VAX-order 68K Blit (standalone) executable 0 long 0406 68k Blit mpx/mux executable 0 short 0406 VAX-order2 68k Blit mpx/mux executable 0 short 03001 VAX-order 68k Blit mpx/mux executable # Need more values for WE32 DMD executables. # Note that 0520 is the same as COFF #0 short 0520 tty630 layers executable #------------------------------------------------------------------------------ # c-lang: file(1) magic for C programs (or REXX) # # XPM icons (Greg Roelofs, newt@uchicago.edu) # ideally should go into "images", but entries below would tag XPM as C source 0 string /*\ XPM X pixmap image data # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs #0 string /* C or REXX program text 0 string // C++ program text #------------------------------------------------------------------------------ # chi: file(1) magic for ChiWriter files # 0 string \\1cw\ ChiWriter file >5 string >\0 version %s 0 string \\1cw ChiWriter file #------------------------------------------------------------------------------ # clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. # # XXX - what byte order does the Clipper use? # # XXX - what's the "!" stuff: # # >18 short !074000,000000 C1 R1 # >18 short !074000,004000 C2 R1 # >18 short !074000,010000 C3 R1 # >18 short !074000,074000 TEST # # I shall assume it's ANDing the field with the first value and # comparing it with the second, and rewrite it as: # # >18 short&074000 000000 C1 R1 # >18 short&074000 004000 C2 R1 # >18 short&074000 010000 C3 R1 # >18 short&074000 074000 TEST # # as SVR3.1's "file" doesn't support anything of the "!074000,000000" # sort, nor does SunOS 4.x, so either it's something Intergraph added # in CLIX, or something AT&T added in SVR3.2 or later, or something # somebody else thought was a good idea; it's not documented in the # man page for this version of "magic", nor does it appear to be # implemented (at least not after I blew off the bogus code to turn # old-style "&"s into new-style "&"s, which just didn't work at all). # 0 short 0575 CLIPPER COFF executable (VAX #) >20 short 0407 (impure) >20 short 0410 (5.2 compatible) >20 short 0411 (pure) >20 short 0413 (demand paged) >20 short 0443 (target shared library) >12 long >0 not stripped >22 short >0 - version %ld 0 short 0577 CLIPPER COFF executable >18 short&074000 000000 C1 R1 >18 short&074000 004000 C2 R1 >18 short&074000 010000 C3 R1 >18 short&074000 074000 TEST >20 short 0407 (impure) >20 short 0410 (pure) >20 short 0411 (separate I&D) >20 short 0413 (paged) >20 short 0443 (target shared library) >12 long >0 not stripped >22 short >0 - version %ld >48 long&01 01 alignment trap enabled >52 byte 1 -Ctnc >52 byte 2 -Ctsw >52 byte 3 -Ctpw >52 byte 4 -Ctcb >53 byte 1 -Cdnc >53 byte 2 -Cdsw >53 byte 3 -Cdpw >53 byte 4 -Cdcb >54 byte 1 -Csnc >54 byte 2 -Cssw >54 byte 3 -Cspw >54 byte 4 -Cscb 4 string pipe CLIPPER instruction trace 4 string prof CLIPPER instruction profile #------------------------------------------------------------------------------ # commands: file(1) magic for various shells and interpreters # 0 string :\ shell archive or commands for antique kernel text 0 string #!/bin/sh Bourne Shell script text 0 string #!\ /bin/sh Bourne Shell script text 0 string #!/bin/csh C Shell script text 0 string #!\ /bin/csh C Shell script text # korn shell magic, sent by George Wu, gwu@clyde.att.com 0 string #!/bin/ksh Korn Shell script text 0 string #!\ /bin/ksh Korn Shell script text 0 string #!/bin/tcsh Tenex C Shell script text 0 string #!\ /bin/tcsh Tenex C Shell script text 0 string #!/usr/local/tcsh Tenex C Shell script text 0 string #!\ /usr/local/tcsh Tenex C Shell script text 0 string #!/usr/local/bin/tcsh Tenex C Shell script text 0 string #!\ /usr/local/bin/tcsh Tenex C Shell script text # # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 0 string #!/usr/local/bin/zsh - Paul Falstad's zsh 0 string #!\ /usr/local/bin/zsh - Paul Falstad's zsh 0 string #!/usr/local/bin/ash - NeilBrown's ash 0 string #!\ /usr/local/bin/ash - NeilBrown's ash 0 string #!/usr/local/bin/ae - NeilBrown's ae 0 string #!\ /usr/local/bin/ae - NeilBrown's ae 0 string #!/bin/nawk - New Awk script text 0 string #!\ /bin/nawk - New Awk script text 0 string #!/usr/bin/nawk - New Awk script text 0 string #!\ /usr/bin/nawk - New Awk script text 0 string #!/usr/local/bin/nawk - New Awk script text 0 string #!\ /usr/local/bin/nawk - New Awk script text 0 string #!/bin/gawk - GNU awk script text 0 string #!\ /bin/gawk - GNU awk script text 0 string #!/usr/bin/gawk - GNU awk script text 0 string #!\ /usr/bin/gawk - GNU awk script text 0 string #!/usr/local/bin/gawk - GNU awk script text 0 string #!\ /usr/local/bin/gawk - GNU awk script text # 0 string #!/bin/awk Awk Commands text 0 string #!\ /bin/awk Awk Commands text 0 string #!/usr/bin/awk Awk Commands text 0 string #!\ /usr/bin/awk Awk Commands text # For Larry Wall's perl language. The ``eval'' line recognizes an # outrageously clever hack for USG systems. # Keith Waclena <keith@cerberus.uchicago.edu> 0 string #!/bin/perl perl commands text 0 string #!\ /bin/perl perl commands text 0 string eval\ "exec\ /bin/perl perl commands text 0 string #!/usr/bin/perl perl commands text 0 string #!\ /usr/bin/perl perl commands text 0 string eval\ "exec\ /usr/bin/perl perl commands text 0 string #!/usr/local/bin/perl perl commands text 0 string #!\ /usr/local/bin/perl perl commands text 0 string eval\ "exec\ /usr/local/bin/perl perl commands text # AT&T Bell Labs' Plan 9 shell 0 string #!/bin/rc Plan 9 rc Shell script text 0 string #!\ /bin/rc Plan 9 rc Shell script text # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 0 string #!/bin/bash Bourne-Again Shell script text 0 string #!\ /bin/bash Bourne-Again Shell script text 0 string #!/usr/local/bin/bash Bourne-Again Shell script text 0 string #!\ /usr/local/bin/bash Bourne-Again Shell script text # generic shell magic 0 string #!\ / a >3 string >\0 %s script text 0 string #!/ a >2 string >\0 %s script text 0 string #!\ commands text >3 string >\0 for %s #------------------------------------------------------------------------------ # compress: file(1) magic for pure-compression formats (no archives) # # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc. # # Formats for various forms of compressed data # Formats for "compress" proper have been moved into "compress.c", # because it tries to uncompress it to figure out what's inside. # standard unix compress 0 string \037\235 compress'd data >2 byte&0x80 >0 block compressed >2 byte&0x1f x %d bits # gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver) 0 string \037\213 gzip compressed data >2 byte <8 - reserved method, >2 byte 8 - deflate method, >3 byte &0x01 ascii, >3 byte &0x02 continuation, >3 byte &0x04 extra field, >3 byte &0x08 original file name, >3 byte &0x10 comment, >3 byte &0x20 encrypted, >4 ledate x last modified: %s, >8 byte 2 max compression, >8 byte 4 max speed, >9 byte =0x00 os: MS-DOS >9 byte =0x01 os: Amiga >9 byte =0x02 os: VMS >9 byte =0x03 os: Unix >9 byte =0x05 os: Atari >9 byte =0x06 os: OS/2 >9 byte =0x07 os: MacOS >9 byte =0x0A os: Tops/20 >9 byte =0x0B os: Win/32 # According to gzip.h, this is the correct byte order for packed data. # 0 string \037\036 packed data >2 belong >1 %d characters originally >2 belong =1 %d character originally # # This magic number is byte-order-independent. # Are there two types of old packed data? One big endian, one little endian? # #0 beshort 017437 old packed data, big endian #0 leshort 017437 old packed data, little endian 0 short 017437 old packed data # XXX - why *two* entries for "compacted data", one of which is # byte-order independent, and one of which is byte-order dependent? # 0 short 0x1fff compacted data 0 string \377\037 compacted data 0 short 0145405 huf output # Squeeze and Crunch... # These numbers were gleaned from the Unix versions of the programs to # handle these formats. Note that I can only uncrunch, not crunch, and # I didn't have a crunched file handy, so the crunch number is untested. # Keith Waclena <keith@cerberus.uchicago.edu> 0 leshort 0x76FF squeezed data (CP/M, DOS) 0 leshort 0x76FE crunched data (CP/M, DOS) # Freeze 0 string \037\237 Frozen file 2.1 0 string \037\236 Frozen file 1.0 (or gzip 0.5) # lzh? 0 string \037\240 LZH compressed data # European GSM 06.10 is a provisional standard for full-rate speech # transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse # excitation/long term prediction) coding at 13 kbit/s. # # WEAK - There's only a magic nibble (4 bits); but that nibble repeats # every 33 bytes. This magic is NOT suited for use, but maybe we can # use it someday. # # This will cause very short GSM files to be declared as data and # mismatches to be declared as data too! #0 byte&0xF0 0xd0 data #>33 byte&0xF0 0xd0 #>66 byte&0xF0 0xd0 #>99 byte&0xF0 0xd0 #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio #------------------------------------------------------------------------------ # convex: file(1) magic for Convex boxes # # Convexes are big-endian. # 0 long 0513 Convex executable #------------------------------------------------------------------------------ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) # 0 long 0x13579ace GNU gdbm or ndbm database # 0 belong 0x061561 Berkeley DB Hash file >4 belong >0 (Version %d, >8 belong 1234 Little Endian, >8 belong 4321 Big Endian, >12 belong x Bucket Size %d, >16 belong x Directory Size %d, >20 belong x Segment Size %d, >24 belong x Segment Shift %d, >28 belong x Overflow Point %d, >32 belong x Last Freed %d, >36 belong x Max Bucket %d, >40 belong x High Mask 0x%x, >44 belong x Low Mask 0x%x, >48 belong x Fill Factor %d, >52 belong x Number of Keys %d) # 0 belong 0x053162 Berkeley DB Btree file >4 belong >0 (Version %d, >8 belong x Page Size %d, >12 belong x Free Page %d, >16 belong x Number of Records %d, >20 belong x Flags 0x%x) #------------------------------------------------------------------------------ # diamond: file(1) magic for Diamond system # # ... diamond is a multi-media mail and electronic conferencing system.... # # XXX - I think it was either renamed Slate, or replaced by Slate.... # # The full deal is too long... #0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document #------------------------------------------------------------------------------ # diff: file(1) magic for diff(1) output # 0 string diff\ 'diff' output text 0 string ***\ 'diff' output text 0 string Only\ in\ 'diff' output text 0 string Common\ subdirectories:\ 'diff' output text #------------------------------------------------------------------------------ # dump: file(1) magic for dump file format--for new and old dump filesystems # # We specify both byte orders in order to recognize byte-swapped dumps. # 24 belong 60012 new-fs dump file (big endian), >4 bedate x Previous dump %s, >8 bedate x This dump %s, >12 belong >0 Volume %ld, >692 belong 0 Level zero, type: >692 belong >0 Level %d, type: >0 belong 1 tape header, >0 belong 2 beginning of file record, >0 belong 3 map of inodes on tape, >0 belong 4 continuation of file record, >0 belong 5 end of volume, >0 belong 6 map of inodes deleted, >0 belong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 belong >0 Flags %x 24 belong 60011 old-fs dump file (big endian), #>4 bedate x Previous dump %s, #>8 bedate x This dump %s, >12 belong >0 Volume %ld, >692 belong 0 Level zero, type: >692 belong >0 Level %d, type: >0 belong 1 tape header, >0 belong 2 beginning of file record, >0 belong 3 map of inodes on tape, >0 belong 4 continuation of file record, >0 belong 5 end of volume, >0 belong 6 map of inodes deleted, >0 belong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 belong >0 Flags %x 24 lelong 60012 new-fs dump file (little endian), >4 ledate x Previous dump %s, >8 ledate x This dump %s, >12 lelong >0 Volume %ld, >692 lelong 0 Level zero, type: >692 lelong >0 Level %d, type: >0 lelong 1 tape header, >0 lelong 2 beginning of file record, >0 lelong 3 map of inodes on tape, >0 lelong 4 continuation of file record, >0 lelong 5 end of volume, >0 lelong 6 map of inodes deleted, >0 lelong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 lelong >0 Flags %x 24 lelong 60011 old-fs dump file (little endian), #>4 ledate x Previous dump %s, #>8 ledate x This dump %s, >12 lelong >0 Volume %ld, >692 lelong 0 Level zero, type: >692 lelong >0 Level %d, type: >0 lelong 1 tape header, >0 lelong 2 beginning of file record, >0 lelong 3 map of inodes on tape, >0 lelong 4 continuation of file record, >0 lelong 5 end of volume, >0 lelong 6 map of inodes deleted, >0 lelong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 lelong >0 Flags %x #------------------------------------------------------------------------------ # elf: file(1) magic for ELF executables # # We have to check the byte order flag to see what byte order all the # other stuff in the header is in. # # updated by Daniel Quinlan (quinlan@yggdrasil.com) 0 string \177ELF ELF >4 byte 0 invalid class >4 byte 1 32-bit >4 byte 2 64-bit >5 byte 0 invalid byte order >5 byte 1 LSB >>16 leshort 0 no file type, >>16 leshort 1 relocatable, >>16 leshort 2 executable, >>16 leshort 3 shared object, >>16 leshort 4 core file, >>16 leshort &0xff00 processor-specific, >>18 leshort 0 no machine, >>18 leshort 1 AT&T WE32100, >>18 leshort 2 SPARC - invalid byte order, >>18 leshort 3 Intel 80386, >>18 leshort 4 Motorola 68000 - invalid byte order, >>18 leshort 5 Motorola 88000 - invalid byte order, >>18 leshort 6 Intel 80486, >>18 leshort 7 Intel 80860, >>18 leshort 8 MIPS RS3000, >>20 lelong 0 invalid version >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB >>16 beshort 0 no file type, >>16 beshort 1 relocatable, >>16 beshort 2 executable, >>16 beshort 3 shared object, >>16 beshort 4 core file, >>16 beshort &0xff00 processor-specific, >>18 beshort 0 no machine, >>18 beshort 1 AT&T WE32100, >>18 beshort 2 SPARC, >>18 beshort 3 Intel 80386 - invalid byte order, >>18 beshort 4 Motorola 68000, >>18 beshort 5 Motorola 88000, >>18 beshort 6 Intel 80486 - invalid byte order, >>18 beshort 7 Intel 80860, >>18 beshort 8 MIPS RS3000, >>20 belong 0 invalid version >>20 belong 1 version 1 >>36 belong 1 MathCoPro/FPU/MAU Required #------------------------------------------------------------------------------ # encore: file(1) magic for Encore machines # # XXX - needs to have the byte order specified (NS32K was little-endian, # dunno whether they run the 88K in little-endian mode or not). # 0 short 0x154 Encore >20 short 0x107 executable >20 short 0x108 pure executable >20 short 0x10b demand-paged executable >20 short 0x10f unsupported executable >12 long >0 not stripped >22 short >0 - version %ld >22 short 0 - #>4 date x stamp %s 0 short 0x155 Encore unsupported executable >12 long >0 not stripped >22 short >0 - version %ld >22 short 0 - #>4 date x stamp %s #------------------------------------------------------------------------------ # filesystems: file(1) magic for different filesystems # 0x438 leshort 0xEF53 Linux/i386 ext2 filesystem 0 string \366\366\366\366 PC formatted floppy with no filesystem #------------------------------------------------------------------------------ # fonts: file(1) magic for font data # 0 string FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text >20 string >\0 (%s) 6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data # X11 font files in SNF (Server Natural Format) format 0 belong 00000004 X11 big-endian SNF font 0 lelong 00000004 X11 little-endian SNF font # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) # (0x7063601 is "PCF" + \001 as a lelong) 0 lelong 0x70636601 X11 Portable Compiled Font data 0 string D1.0\015 X11 Speedo font data #------------------------------------------------------------------------------ # frame: file(1) magic for FrameMaker files # # This stuff came on a FrameMaker demo tape, most of which is # copyright, but this file is "published" as witness the following: # 0 string \<MakerFile FrameMaker document >11 string 4.0 (4.0 >11 string 3.0 (3.0 >11 string 2.0 (2.0 >11 string 1.0 (1.0 >14 byte x %c) 0 string \<MIFFile FrameMaker MIF (ASCII) file >9 string 4.0 (4.0) >9 string 3.0 (3.0) >9 string 2.0 (2.0) >9 string 1.0 (1.x) 0 string \<MakerDictionary FrameMaker Dictionary text >17 string 3.0 (3.0) >17 string 2.0 (2.0) >17 string 1.0 (1.x) 0 string \<MakerScreenFon FrameMaker Font file >17 string 1.01 (%s) 0 string \<MML FrameMaker MML file 0 string \<Book FrameMaker Book file >10 string 3.0 (3.0 >10 string 2.0 (2.0 >10 string 1.0 (1.0 >13 byte x %c) 0 string \<Maker Intermediate Print File FrameMaker IPL file #------------------------------------------------------------------------------ # hp: file(1) magic for Hewlett Packard machines (see also "printer") # # XXX - somebody should figure out whether any byte order needs to be # applied to the "TML" stuff; I'm assuming the Apollo stuff is # big-endian as it was mostly 68K-based. # # HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I # assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first # showed up in the 700 series, although later 800 series machines are, # I think, based on the PA7100 which implements HP-PA 1.1) are flagged # as big-endian. # # I think the 500 series was the old stack-based machines, running a # UNIX environment atop the "SUN kernel"; dunno whether it was # big-endian or little-endian. # # Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; # hp300 are 68020+68881 based; hp400 are also 68k. The following basic # HP magic is useful for reference, but using "long" magic is a better # practice in order to avoid collisions. # # 0 beshort 200 hp200 (68010) BSD binary # 0 beshort 300 hp300 (68020+68881) BSD binary # 0 beshort 0x20c hp200/300 HP-UX binary # 0 beshort 0x20b hp800 HP-UX binary # # The "misc" stuff needs a byte order; the archives look suspiciously # like the old 177545 archives (0xff65 = 0177545). # #### Old Apollo stuff 0 beshort 0627 Apollo m68k COFF executable >18 beshort ^040000 not stripped >22 beshort >0 - version %ld 0 beshort 0624 apollo a88k COFF executable >18 beshort ^040000 not stripped >22 beshort >0 - version %ld 0 long 01203604016 TML 0123 byte-order format 0 long 01702407010 TML 1032 byte-order format 0 long 01003405017 TML 2301 byte-order format 0 long 01602007412 TML 3210 byte-order format #### HPPA 0 belong 0x02100106 HPPA-RISC1.1 relocatable object 0 belong 0x02100107 HPPA-RISC1.1 executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x02100108 HPPA-RISC1.1 shared executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x0210010b HPPA-RISC1.1 demand-load executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x0210010e HPPA-RISC1.1 shared library >96 belong >0 -not stripped 0 belong 0x0210010d HPPA-RISC1.1 dynamic load library >96 belong >0 -not stripped #### 800 0 belong 0x020b0106 HP s800 relocatable object 0 belong 0x020b0107 HP s800 executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x020b0108 HP s800 shared executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x020b010b HP s800 demand-load executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x020b010e HP s800 shared library >96 belong >0 -not stripped 0 belong 0x020b010d HP s800 dynamic load library >96 belong >0 -not stripped 0 belong 0x213c6172 archive file >68 belong 0x020b0619 -HP s800 relocatable library #### 500 0 long 0x02080106 HP s500 relocatable executable >16 long >0 -version %ld 0 long 0x02080107 HP s500 executable >16 long >0 -version %ld 0 long 0x02080108 HP s500 pure executable >16 long >0 -version %ld #### 200 0 belong 0x020c0108 HP s200 pure executable >4 beshort >0 -version %ld >8 belong &0x80000000 save fp regs >8 belong &0x40000000 dynamically linked >8 belong &0x20000000 debuggable >36 belong >0 not stripped 0 belong 0x020c0107 HP s200 executable >4 beshort >0 -version %ld >8 belong &0x80000000 save fp regs >8 belong &0x40000000 dynamically linked >8 belong &0x20000000 debuggable >36 belong >0 not stripped 0 belong 0x020c010b HP s200 demand-load executable >4 beshort >0 -version %ld >8 belong &0x80000000 save fp regs >8 belong &0x40000000 dynamically linked >8 belong &0x20000000 debuggable >36 belong >0 not stripped 0 belong 0x020c0106 HP s200 relocatable executable >4 beshort >0 -version %ld >6 beshort >0 -highwater %d >8 belong &0x80000000 save fp regs >8 belong &0x20000000 debuggable >8 belong &0x10000000 PIC 0 belong 0x020a0108 HP s200 (2.x release) pure executable >4 beshort >0 -version %ld >36 belong >0 not stripped 0 belong 0x020a0107 HP s200 (2.x release) executable >4 beshort >0 -version %ld >36 belong >0 not stripped 0 belong 0x020c010e HP s200 shared library >4 beshort >0 -version %ld >6 beshort >0 -highwater %d >36 belong >0 not stripped 0 belong 0x020c010d HP s200 dynamic load library >4 beshort >0 -version %ld >6 beshort >0 -highwater %d >36 belong >0 not stripped #### MISC 0 long 0x0000ff65 HP old archive 0 long 0x020aff65 HP s200 old archive 0 long 0x020cff65 HP s200 old archive 0 long 0x0208ff65 HP s500 old archive 0 long 0x015821a6 HP core file 0 long 0x4da7eee8 HP-WINDOWS font >8 byte >0 -version %ld 0 string Bitmapfile HP Bitmapfile 0 string IMGfile CIS compimg HP Bitmapfile # XXX - see "lif" 0 short 0x8000 lif file 0 long 0x020c010c compiled Lisp 0 string msgcat01 HP NLS message catalog, >8 long >0 %d messages # addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 0 string HPHP48- HP48 binary >7 byte >0 - Rev %c >8 short 0x1129 (ADR) >8 short 0x3329 (REAL) >8 short 0x5529 (LREAL) >8 short 0x7729 (COMPLX) >8 short 0x9d29 (LCOMPLX) >8 short 0xbf29 (CHAR) >8 short 0xe829 (ARRAY) >8 short 0x0a2a (LNKARRAY) >8 short 0x2c2a (STRING) >8 short 0x4e2a (HXS) >8 short 0x742a (LIST) >8 short 0x962a (DIR) >8 short 0xb82a (ALG) >8 short 0xda2a (UNIT) >8 short 0xfc2a (TAGGED) >8 short 0x1e2b (GROB) >8 short 0x402b (LIB) >8 short 0x622b (BACKUP) >8 short 0x882b (LIBDATA) >8 short 0x9d2d (PROG) >8 short 0xcc2d (CODE) >8 short 0x482e (GNAME) >8 short 0x6d2e (LNAME) >8 short 0x922e (XLIB) 0 string %%HP: HP48 text >6 string T(0) - T(0) >6 string T(1) - T(1) >6 string T(2) - T(2) >6 string T(3) - T(3) >10 string A(D) A(D) >10 string A(R) A(R) >10 string A(G) A(G) >14 string F(.) F(.); >14 string F(,) F(,); # hpBSD magic numbers 0 beshort 200 hp200 (68010) BSD >2 beshort 0407 impure binary >2 beshort 0410 read-only binary >2 beshort 0413 demand paged binary 0 beshort 300 hp300 (68020+68881) BSD >2 beshort 0407 impure binary >2 beshort 0410 read-only binary >2 beshort 0413 demand paged binary #------------------------------------------------------------------------------ # html: file(1) magic for HTML (HyperText Markup Language) docs # # from Daniel Quinlan <quinlan@yggdrasil.com> # 0 string \<HEAD HTML document text (old type) 0 string \<head HTML document text (old type) 0 string \<TITLE HTML document text (old type) 0 string \<title HTML document text (old type) 0 string \<html HTML document text 0 string \<HTML HTML document text 0 string \<! HTML document text 0 string \<h1 Untitled HTML document text 0 string \<H1 Untitled HTML document text #------------------------------------------------------------------------------ # ibm370: file(1) magic for IBM 370 and compatibles. # # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". # What the heck *is* "USS/370"? # 0 beshort 0531 SVR2 executable (Amdahl-UTS) >12 belong >0 not stripped >24 belong >0 - version %ld 0 beshort 0534 SVR2 pure executable (Amdahl-UTS) >12 belong >0 not stripped >24 belong >0 - version %ld 0 beshort 0530 SVR2 pure executable (USS/370) >12 belong >0 not stripped >24 belong >0 - version %ld 0 beshort 0535 SVR2 executable (USS/370) >12 belong >0 not stripped >24 belong >0 - version %ld #------------------------------------------------------------------------------ # ibm6000: file(1) magic for RS/6000 and the RT PC. # 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module >12 belong >0 not stripped # Breaks sun4 statically linked execs. #0 beshort 0x0103 executable (RT Version 2) or obj module #>2 byte 0x50 pure #>28 belong >0 not stripped #>6 beshort >0 - version %ld 0 beshort 0x0104 shared library 0 beshort 0x0105 ctab data 0 beshort 0xfe04 structured file 0 string 0xabcdef message catalog #0 string <aiaff> archive #------------------------------------------------------------------------------ # images: file(1) magic for image formats (see also "c-lang" for XPM bitmaps) # # originally from jef@helios.ee.lbl.gov (Jef Poskanzer), # additions by janl@ifi.uio.no as well as others. Jan also suggested # merging several one- and two-line files into here. # # XXX - byte order for GIF and TIFF fields? # [GRR: TIFF allows both byte orders; GIF is little-endian] # # [GRR: what the hell is this doing in here?] 0 string xbtoa btoa'd file # PBMPLUS 0 string P1 PBM file 0 string P2 PGM file 0 string P3 PPM file 0 string P4 PBM "rawbits" file 0 string P5 PGM "rawbits" file 0 string P6 PPM "rawbits" file # NIFF (Navy Interchange File Format, a modification of TIFF) images # this *must* go before TIFF 0 string IIN1 NIFF raster data # TIFF images 0 string MM TIFF file, big-endian >2 beshort >0 - version %d 0 string II TIFF file, little-endian >2 leshort >0 - version %d # PNG [Portable Network Graphics, or "PNG's Not GIF"] images # (Greg Roelofs, newt@uchicago.edu) # # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... # 0 string \x89PNG PNG image, >4 belong !0x0d0a1a0a CORRUPTED, >16 belong x %ld x >20 belong x %ld, >24 byte x %d-bit >25 byte 0 grayscale, >25 byte 2 \b/color RGB, >25 byte 3 colormap, >25 byte 4 gray+alpha, >25 byte 6 \b/color RGBA, #>26 byte 0 deflate/32K, >28 byte 0 non-interlaced >28 byte 1 interlaced # GIF 0 string GIF GIF image >3 string 87a - version %s, >3 string 89a - version %s, >6 leshort >0 %hd x >8 leshort >0 %hd, #>10 byte &0x80 color mapped, # GRR 950330: the following is not accurate for most GIFs: #>10 byte &0x40 interlaced, >10 byte&0x07 =0x00 2 colors >10 byte&0x07 =0x01 4 colors >10 byte&0x07 =0x02 8 colors >10 byte&0x07 =0x03 16 colors >10 byte&0x07 =0x04 32 colors >10 byte&0x07 =0x05 64 colors >10 byte&0x07 =0x06 128 colors >10 byte&0x07 =0x07 256 colors # Miscellany 0 long 1123028772 Artisan image file >4 long 1 rectangular 24-bit image >4 long 2 rectangular 8-bit image with colormap >4 long 3 rectangular 32-bit image (24-bit with matte) 0 string \361\0\100\273 CMU window manager bitmap 0 string #FIG FIG graphics savefile text >6 string 2.1 Version 2.1 >6 string 2.0 Version 2.0 0 string GKSM GKS Metafile 8 string ILBM IFF ILBM file 0 string ARF_BEGARF PHIGS clear text archive # More miscellany from Daniel Quinlan (quinlan@yggdrasil.com) 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 0 string !! Bennet Yee's "face" format 0 string @(#)SunPHIGS SunPHIGS # version number follows, in the form m.n >40 string SunBin binary >32 string archive archive 0 string BEGMF clear text Computer Graphics Metafile # these should be beshort, but not sure 0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 0 beshort 0x3020 character Computer Graphics Metafile # From: <u31b3hs@pool.informatik.rwth-aachen.de> (Michael Haardt) 0 string yz MGR bitmap, modern format, 8 bit aligned 0 string zz MGR bitmap, old format, 1 bit deep, 16 bit aligned 0 string xz MGR bitmap, old format, 1 bit deep, 32 bit aligned 0 string yx MGR bitmap, modern format, squeezed 0 string %bitmap FBM pixmap >30 long 0x31 (mono) >30 long 0x33 (color) 4 string Research, Digifax-G3-File >29 byte 1 , fine resolution >29 byte 0 , normal resolution # JPEG images 0 beshort 0xffd8 JPEG image >6 string JFIF - JFIF standard # from cameron@cs.unsw.oz.au (Cameron Simpson): 0 string hsi1 JPEG image - HSI encoded (proprietary) # PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu) 0 string BM bitmap >14 byte 12 (OS/2 1.x format) >14 byte 64 (OS/2 2.x format) >14 byte 40 (Windows 3.x format) 0 string IC icon 0 string PI pointer 0 string CI color icon 0 string CP color pointer 0 string BA bitmap array # Utah Raster Toolkit RLE images (two versions) # # From <janl@ifi.uio.no> # I made this with the help of the man page for rle(5). Ihey missing # from the magic numbers I have: 0 beshort 0xcc52 Utah Raster Toolkit RLE >2 beshort >0 lower left corner: %d >4 beshort >0 lower right corner: %d >6 beshort >0 %d x >8 beshort >0 %d >10 byte&0x1 =0x1 CLEARFIRST >10 byte&0x2 =0x2 NO_BACKGROUND >10 byte&0x4 =0x4 ALPHA >10 byte&0x8 =0x8 COMMENT >11 byte >0 %d colour channels >12 byte >0 %d bits per pixel >13 byte >0 %d colour map channels # # RLE images (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # Here's a magic file entry for rle images. 24-bit images tend to produce # foo.rle size 42x42, 3 comps each 8 bits # (for arbitary, prossibly different values of 42). # freely redistribuable under the GPL # [GRR: which endianness? big?] 0 short 0xcc55 RLE image data >6 short >0 %d x >8 short >0 %d, >2 short >0 x offset by %d, >4 short >0 y offset by %d, >11 byte =0 colour map >11 byte >1 %d comps each >12 byte =1 1 bit >12 byte >1 %d bits # FBM images, culled from xli source (d. p. simpleton, m91dps@ecs.ox.ac.uk) 0 string %bitmap fbm image data # image file format (Robert Potter, potter@cs.rochester.edu) 0 string Imagefile\ version- iff image data # this adds the whole header (inc. version number), informative but longish >10 string >\0 %s # Sun rasterfiles, from Daniel Quinlan (quinlan@yggdrasil.com) # # XXX - Does the Sun 386i use the same byte order? # 0 belong 0x59a66a95 Sun raster image >4 belong >0 %d x >8 belong >0 %d, >12 belong >0 %d-bit, # this is almost the same as the file length (what about compressed?) #>16 belong >0 %d bytes long, >20 belong 0 old format, # no need to complain if it is standard #>20 belong 1 standard, >20 belong 2 compressed, >20 belong 3 RGB, >20 belong 4 TIFF, >20 belong 5 IFF, >20 belong 0xffff reserved for testing, >24 belong 0 no colormap >24 belong 1 RGB colormap >24 belong 2 raw colormap # this doesn't impart much useful information (or does it?) #>28 belong >0 colormap is %d bytes long # Daniel Quinlan (quinlan@yggdrasil.com) -- from an SGI machine # There may be a byte swapped version of SGI imagelib images, but # I haven't seen any evidence of programs that support it. 0 beshort 000732 SGI imagelib image >6 beshort x \b, %d x >8 beshort x %d # 0 string IT01 FIT image file >4 belong x \b, %d x >8 belong x %d x >12 belong x %d # 0 string IT02 FIT image file >4 belong x \b, %d x >8 belong x %d x >12 belong x %d # 2048 string PCD_IPI Kodak Photo CD image pack file 0 string PCD_OPA Kodak Photo CD overview pack file # Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> # FITS is the Flexible Image Transport System, the de facto standard for # data and image transfer, storage, etc., for the astronomical community. # FITS format. 0 string SIMPLE\ \ = FITS >107 string -32 32 bits per pixel, IEEE big endian float >107 string \ 32 32 bits per pixel, unsigned integer >108 string 16 16 bits per pixel, unsigned integer >109 string 8 8 bits per pixel, unsigned integer #------------------------------------------------------------------------------ # intel: file(1) magic for x86 Unix # # Various flavors of x86 UNIX executable/object (other than Xenix, which # is in "microsoft"). DOS is in "ms-dos"; the ambitious soul can do # Windows as well. # # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere # as well, if, as, and when IBM makes it portable. # # The `versions' should be un-commented if they work for you. # (Was the problem just one of endianness?) # 0 leshort 0502 basic-16 executable >12 lelong >0 not stripped #>22 leshort >0 - version %ld 0 leshort 0503 basic-16 executable (TV) >12 lelong >0 not stripped #>22 leshort >0 - version %ld 0 leshort 0510 x86 executable >12 lelong >0 not stripped 0 leshort 0511 x86 executable (TV) >12 lelong >0 not stripped 0 leshort =0512 iAPX 286 executable small model (COFF) >12 lelong >0 not stripped #>22 leshort >0 - version %ld 0 leshort =0522 iAPX 286 executable large model (COFF) >12 lelong >0 not stripped #>22 leshort >0 - version %ld # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 0 leshort =0514 80386 COFF executable >12 lelong >0 not stripped >22 leshort >0 - version %ld #------------------------------------------------------------------------------ # interleaf: file(1) magic for InterLeaf TPS: # 0 string =\210OPS Interleaf saved data 0 string =<!OPS Interleaf document text >5 string ,\ Version\ (version >>14 string >\0 %s) #------------------------------------------------------------------------------ # ispell: file(1) magic for ispell # # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic # will match 0x9600 through 0x9603 in *both* little endian and big endian. # (No other current magic entries collide.) # # Updated by Daniel Quinlan (quinlan@yggdrasil.com) # 0 leshort&0xFFFC 0x9600 little endian ispell >0 byte 0 hash file (?), >0 byte 1 3.0 hash file, >0 byte 2 3.1 hash file, >0 byte 3 hash file (?), >2 leshort 0x00 8-bit, no capitalization, 26 flags >2 leshort 0x01 7-bit, no capitalization, 26 flags >2 leshort 0x02 8-bit, capitalization, 26 flags >2 leshort 0x03 7-bit, capitalization, 26 flags >2 leshort 0x04 8-bit, no capitalization, 52 flags >2 leshort 0x05 7-bit, no capitalization, 52 flags >2 leshort 0x06 8-bit, capitalization, 52 flags >2 leshort 0x07 7-bit, capitalization, 52 flags >2 leshort 0x08 8-bit, no capitalization, 128 flags >2 leshort 0x09 7-bit, no capitalization, 128 flags >2 leshort 0x0A 8-bit, capitalization, 128 flags >2 leshort 0x0B 7-bit, capitalization, 128 flags >2 leshort 0x0C 8-bit, no capitalization, 256 flags >2 leshort 0x0D 7-bit, no capitalization, 256 flags >2 leshort 0x0E 8-bit, capitalization, 256 flags >2 leshort 0x0F 7-bit, capitalization, 256 flags >4 leshort >0 and %d string characters 0 beshort&0xFFFC 0x9600 big endian ispell >1 byte 0 hash file (?), >1 byte 1 3.0 hash file, >1 byte 2 3.1 hash file, >1 byte 3 hash file (?), >2 beshort 0x00 8-bit, no capitalization, 26 flags >2 beshort 0x01 7-bit, no capitalization, 26 flags >2 beshort 0x02 8-bit, capitalization, 26 flags >2 beshort 0x03 7-bit, capitalization, 26 flags >2 beshort 0x04 8-bit, no capitalization, 52 flags >2 beshort 0x05 7-bit, no capitalization, 52 flags >2 beshort 0x06 8-bit, capitalization, 52 flags >2 beshort 0x07 7-bit, capitalization, 52 flags >2 beshort 0x08 8-bit, no capitalization, 128 flags >2 beshort 0x09 7-bit, no capitalization, 128 flags >2 beshort 0x0A 8-bit, capitalization, 128 flags >2 beshort 0x0B 7-bit, capitalization, 128 flags >2 beshort 0x0C 8-bit, no capitalization, 256 flags >2 beshort 0x0D 7-bit, no capitalization, 256 flags >2 beshort 0x0E 8-bit, capitalization, 256 flags >2 beshort 0x0F 7-bit, capitalization, 256 flags >4 beshort >0 and %d string characters #------------------------------------------------------------------------------ # karma: file(1) magic for Karma data files # # From <rgooch@atnf.csiro.au> 0 string KarmaRHD Version Karma Data Structure Version >16 long x %lu #------------------------------------------------------------------------------ # lex: file(1) magic for lex # # derived empirically, your offsets may vary! 53 string yyprevious c program text (from lex) >3 string >\0 for %s # C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 21 string generated\ by\ flex C program text (from flex) # lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 0 string %{ lex description text #------------------------------------------------------------------------------ # lif: file(1) magic for lif # # XXX - byte order? (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>) # 0 short 0x8000 lif file #------------------------------------------------------------------------------ # linux: file(1) magic for Linux files # # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> # The following basic Linux magic is useful for reference, but using # "long" magic is a better practice in order to avoid collisions. # # 2 leshort 100 Linux/i386 # >0 leshort 0407 impure executable (OMAGIC) # >0 leshort 0410 pure executable (NMAGIC) # >0 leshort 0413 demand-paged executable (ZMAGIC) # >0 leshort 0314 demand-paged executable (QMAGIC) # 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) >16 lelong 0 - stripped 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) >16 lelong 0 - stripped 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) >16 lelong 0 - stripped 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) >16 lelong 0 - stripped # 0 string \007\001\000 Linux/i386 object file >20 lelong >0x1020 - DLL library # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> 0 string *nazgul* compiled message catalog >8 lelong >0 - version %ld # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 216 lelong 0421 Linux/i386 core file >220 string >\0 of '%s' >200 lelong >0 (signal %d) # # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> # this can be overridden by the DOS executable (COM) entry 2 string LILO Linux/i386 LILO boot/chain loader # # Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de> 0 string 0.9 >8 byte 0x0a Debian Binary Package - >>3 byte >0 created by dpkg 0.9%c >>4 byte >0 pl%c # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 0 leshort 0x0436 Linux/i386 PC Screen Font data >2 byte 0 - 256 characters, no directory, >2 byte 1 - 512 characters, no directory, >2 byte 2 - 256 characters, Unicode directory, >2 byte 3 - 512 characters, Unicode directory, >3 byte >0 8x%d # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 4086 string SWAP-SPACE Linux/i386 swap file #------------------------------------------------------------------------------ # lisp: file(1) magic for lisp programs # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 0 string ;; Lisp/Scheme program text # Emacs 18 - this is always correct, but not very magical. 0 string \012( byte-compiled Emacs-Lisp program data # Emacs 19 0 string ;ELC\023\000\000\000 byte-compiled Emacs-Lisp program data #------------------------------------------------------------------------------ # magic: file(1) magic for magic files # 0 string #\ Magic magic text file for file(1) cmd #------------------------------------------------------------------------------ # mail.news: file(1) magic for mail and news # # Unfortunately, saved netnews also has From line added in some news software. #0 string From mail text # There are tests to ascmagic.c to cope with mail and news. 0 string Relay-Version: old news text 0 string #!\ rnews batched news text 0 string N#!\ rnews mailed, batched news text 0 string Forward\ to mail forwarding text 0 string Pipe\ to mail piping text 0 string Return-Path: smtp mail text 0 string Path: news text 0 string Xref: news text 0 string From: news or mail text 0 string Article saved news text #------------------------------------------------------------------------------ # microsoft: file(1) magic for Microsoft Xenix # # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small # model" lifted from "magic.xenix", with comment "derived empirically; # treat as folklore until proven" # # "small model", "large model", "huge model" stuff lifted from XXX # # XXX - "x.out" collides with PDP-11 archives # 0 string core core file (Xenix) 0 byte 0x80 8086 relocatable (Microsoft) 0 leshort 0xff65 x.out >2 string __.SYMDEF randomized >0 byte x archive 0 leshort 0x206 Microsoft a.out >8 leshort 1 Middle model >0x1e leshort &0x10 overlay >0x1e leshort &0x2 separate >0x1e leshort &0x4 pure >0x1e leshort &0x800 segmented >0x1e leshort &0x400 standalone >0x1e leshort &0x8 fixed-stack >0x1c byte &0x80 byte-swapped >0x1c byte &0x40 word-swapped >0x10 lelong >0 not-stripped >0x1e leshort ^0xc000 pre-SysV >0x1e leshort &0x4000 V2.3 >0x1e leshort &0x8000 V3.0 >0x1c byte &0x4 86 >0x1c byte &0xb 186 >0x1c byte &0x9 286 >0x1c byte &0xa 386 >0x1f byte <0x040 small model >0x1f byte =0x048 large model >0x1f byte =0x049 huge model >0x1e leshort &0x1 executable >0x1e leshort ^0x1 object file >0x1e leshort &0x40 Large Text >0x1e leshort &0x20 Large Data >0x1e leshort &0x120 Huge Objects Enabled >0x10 lelong >0 not stripped 0 leshort 0x140 old Microsoft 8086 x.out >0x3 byte &0x4 separate >0x3 byte &0x2 pure >0 byte &0x1 executable >0 byte ^0x1 relocatable >0x14 lelong >0 not stripped 0 lelong 0x206 b.out >0x1e leshort &0x10 overlay >0x1e leshort &0x2 separate >0x1e leshort &0x4 pure >0x1e leshort &0x800 segmented >0x1e leshort &0x400 standalone >0x1e leshort &0x1 executable >0x1e leshort ^0x1 object file >0x1e leshort &0x4000 V2.3 >0x1e leshort &0x8000 V3.0 >0x1c byte &0x4 86 >0x1c byte &0xb 186 >0x1c byte &0x9 286 >0x1c byte &0x29 286 >0x1c byte &0xa 386 >0x1e leshort &0x4 Large Text >0x1e leshort &0x2 Large Data >0x1e leshort &0x102 Huge Objects Enabled 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model #------------------------------------------------------------------------------ # mirage: file(1) magic for Mirage executables # # XXX - byte order? # 0 long 31415 Mirage Assembler m.out executable #------------------------------------------------------------------------------ # mkid: file(1) magic for mkid(1) databases # # ID is the binary tags database produced by mkid(1). # # XXX - byte order? # 0 string \311\304 ID tags data >2 short >0 version %d #------------------------------------------------------------------------------ # mmdf: file(1) magic for MMDF mail files # 0 string \001\001\001\001 MMDF mailbox #------------------------------------------------------------------------------ # motorola: file(1) magic for Motorola 68K and 88K binaries # # 68K # 0 beshort 0520 mc68k COFF >18 beshort ^00000020 object >18 beshort &00000020 executable >12 belong >0 not stripped >168 string .lowmem Apple toolbox >20 beshort 0407 (impure) >20 beshort 0410 (pure) >20 beshort 0413 (demand paged) >20 beshort 0421 (standalone) 0 beshort 0521 mc68k executable (shared) >12 belong >0 not stripped 0 beshort 0522 mc68k executable (shared demand paged) >12 belong >0 not stripped # # Motorola/UniSoft 68K Binary Compatibility Standard (BCS) # 0 beshort 0554 68K BCS executable # # 88K # # Motorola/88Open BCS # 0 beshort 0555 88K BCS executable #------------------------------------------------------------------------------ # msdos: file(1) magic for MS-DOS files # # .EXE formats (Greg Roelofs, newt@uchicago.edu) # 0 string MZ MS-DOS executable (EXE) >24 string @ \b, OS/2 or Windows >1638 string -lh5- \b, LHa SFX archive v2.13S >7195 string Rar! \b, RAR self-extracting archive # # [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than # 8161 bytes are ignored. To make the following entries work, increase # HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2, # NT/Win32 and VMS.] # [GRR: some company sells a self-extractor/displayer for image data(!)] # >11696 string PK\003\004 \b, PKZIP SFX archive v1.1 >13297 string PK\003\004 \b, PKZIP SFX archive v1.93a >15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09 >15770 string PK\003\004 \b, PKZIP SFX archive v2.04g >28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02 # # Info-ZIP self-extractors # these are the DOS versions: >25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12 >26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption # these are the OS/2 versions (OS/2 is flagged above): >47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12 >49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption # this is the NT/Win32 version: >69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption # # TELVOX Teleinformatica CODEC self-extractor for OS/2: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 >>49824 leshort =1 \b, 1 file >>49824 leshort >1 \b, %u files # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least # two dozen different one-byte "magics". #0 byte 0xe9 MS-DOS executable (COM) #0 byte 0x8c MS-DOS executable (COM) # 0xeb conflicts with "sequent" magic #0 byte 0xeb MS-DOS executable (COM) #0 byte 0xb8 MS-DOS executable (COM) # miscellaneous formats 0 string LZ MS-DOS executable (built-in) #0 byte 0xf0 MS-DOS program library data # # Popular applications 2080 string Microsoft\ Word\ 6.0\ Document %s # 0 belong 0x31be0000 Microsoft Word Document # 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s # 0 belong 0x00001a00 Lotus 1-2-3 >4 belong 0x00100400 wk3 document >4 belong 0x02100400 wk4 document >4 belong 0x07800100 fm3 or fmb document >4 belong 0x07800000 fm3 or fmb document # 0 belong 0x00000200 Lotus 1-2-3 >4 belong 0x06040600 wk1 document >4 belong 0x06800200 fmt document #------------------------------------------------------------------------------ # ncr: file(1) magic for NCR Tower objects # # contributed by # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP # 0 beshort 000610 Tower/XP rel 2 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000615 Tower/XP rel 2 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000620 Tower/XP rel 3 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000625 Tower/XP rel 3 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000630 Tower32/600/400 68020 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000640 Tower32/800 68020 >18 beshort &020000 w/68881 object >18 beshort &040000 compatible object >18 beshort &~060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped >22 beshort >0 - version %ld 0 beshort 000645 Tower32/800 68010 >18 beshort &040000 compatible object >18 beshort &~060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped >22 beshort >0 - version %ld #------------------------------------------------------------------------------ # news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") # 0 string StartFontMetrics ASCII font metrics 0 string StartFont ASCII font bits 0 belong 0x137A2944 NeWS bitmap font 0 belong 0x137A2947 NeWS font family 0 belong 0x137A2950 scalable OpenFont binary 0 belong 0x137A2951 encrypted scalable OpenFont binary 8 belong 0x137A2B45 X11/NeWS bitmap font 8 belong 0x137A2B48 X11/NeWS font family #------------------------------------------------------------------------------ # pbm: file(1) magic for Portable Bitmap files # # XXX - byte order? # 0 short 0x2a17 "compact bitmap" format (Poskanzer) #------------------------------------------------------------------------------ # pdp: file(1) magic for PDP-11 executable/object and APL workspace # 0 lelong 0101555 PDP-11 single precision APL workspace 0 lelong 0101554 PDP-11 double precision APL workspace # # PDP-11 a.out # 0 leshort 0407 PDP-11 executable >8 leshort >0 not stripped >15 byte >0 - version %ld 0 leshort 0401 PDP-11 UNIX/RT ldp 0 leshort 0405 PDP-11 old overlay 0 leshort 0410 PDP-11 pure executable >8 leshort >0 not stripped >15 byte >0 - version %ld 0 leshort 0411 PDP-11 separate I&D executable >8 leshort >0 not stripped >15 byte >0 - version %ld 0 leshort 0437 PDP-11 kernel overlay #------------------------------------------------------------------------------ # pgp: file(1) magic for Pretty Good Privacy # 0 beshort 0x9900 pgp key public ring 0 beshort 0x9501 pgp key security ring 0 beshort 0x9500 pgp key security ring 0 string -----BEGIN\040PGP pgp armored data >15 string PUBLIC\040KEY\040BLOCK- public key blocK >15 string MESSAGE- message >15 string SIGNED\040MESSAGE- signed message >15 string PGP\040SIGNATURE- signature #------------------------------------------------------------------------------ # pkgadd: file(1) magic for SysV R4 PKG Datastreams # 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) #------------------------------------------------------------------------------ # plus5: file(1) magic for Plus Five's UNIX MUMPS # # XXX - byte order? Paging Hokey.... # 0 short 0x259 mumps avl global >2 byte >0 (V%d) >6 byte >0 with %d byte name >7 byte >0 and %d byte data cells 0 short 0x25a mumps blt global >2 byte >0 (V%d) >8 short >0 - %d byte blocks >15 byte 0x00 - P/D format >15 byte 0x01 - P/K/D format >15 byte 0x02 - K/D format >15 byte >0x02 - Bad Flags #------------------------------------------------------------------------------ # printer: file(1) magic for printer-formatted files # # PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 0 string %! PostScript document >2 string PS-Adobe- conforming >>11 string >\0 at level %.3s >>>15 string EPS - type %s >>>15 string Query - type %s >>>15 string ExitServer - type %s # Some PCs have the annoying habit of adding a ^D as a document separator 0 string \004%! PostScript document >3 string PS-Adobe- conforming >>12 string >\0 at level %.3s >>>16 string EPS - type %s >>>16 string Query - type %s >>>16 string ExitServer - type %s # HP Printer Job Language 0 string \033%-12345X@PJL HP Printer Job Language data # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 0 string \033E\033 HP PCL printer data >3 string \&l0A - default page size >3 string \&l1A - US executive page size >3 string \&l2A - US letter page size >3 string \&l3A - US legal page size >3 string \&l26A - A4 page size >3 string \&l80A - Monarch envelope size >3 string \&l81A - No. 10 envelope size >3 string \&l90A - Intl. DL envelope size >3 string \&l91A - Intl. C5 envelope size >3 string \&l100A - Intl. B5 envelope size >3 string \&l-81A - No. 10 envelope size (landscape) >3 string \&l-90A - Intl. DL envelope size (landscape) # IMAGEN printer-ready files: 0 string @document( Imagen printer # this only works if "language xxx" is first item in Imagen header. >10 string language\ impress (imPRESS data) >10 string language\ daisy (daisywheel text) >10 string language\ diablo (daisywheel text) >10 string language\ printer (line printer emulation) >10 string language\ tektronix (Tektronix 4014 emulation) # Add any other languages that your Imagen uses - remember # to keep the word `text' if the file is human-readable. # [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] # # Now magic for IMAGEN font files... 0 string Rast RST-format raster font data >45 string >0 face % #------------------------------------------------------------------------------ # psdbms: file(1) magic for psdatabase # 0 belong&0xff00ffff 0x56000000 ps database >1 string >\0 version %s >4 string >\0 from kernel %s #------------------------------------------------------------------------------ # compress: file(1) magic for Pyramids # # XXX - byte order? # 0 long 0x50900107 Pyramid 90x family executable 0 long 0x50900108 Pyramid 90x family pure executable >16 long >0 not stripped 0 long 0x5090010b Pyramid 90x family demand paged pure executable >16 long >0 not stripped #------------------------------------------------------------------------------ # rtf: file(1) magic for Rich Text Format (RTF) # # Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk # 0 string {\\rtf Rich Text Format data, >5 byte x version %c, >6 string \\ansi ANSI >6 string \\mac Apple Macintosh >6 string \\pc IBM PC code page 437 >6 string \\pca IBM PC code page 850 #------------------------------------------------------------------------------ # sc: file(1) magic for "sc" spreadsheet # 38 string Spreadsheet sc spreadsheet file #------------------------------------------------------------------------------ # sccs: file(1) magic for SCCS archives # # SCCS archive structure: # \001h01207 # \001s 00276/00000/00000 # \001d D 1.1 87/09/23 08:09:20 ian 1 0 # \001c date and time created 87/09/23 08:09:20 by ian # \001e # \001u # \001U # ... etc. # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). # *Sigh*. And these both came from various parts of the USG. # Maybe we should just switch everybody from SCCS to RCS! # Further, you can't just say '\001h0', because the five-digit number # is a checksum that could (presumably) have any leading digit, # and we don't have regular expression matching yet. # Hence the following official kludge: 8 string \001s\ SCCS archive. #------------------------------------------------------------------------------ # sendmail: file(1) magic for sendmail config files # # XXX - byte order? # 0 byte 046 Sendmail frozen configuration >16 string >\0 - version %s 0 short 0x271c Sendmail frozen configuration >16 string >\0 - version %s #------------------------------------------------------------------------------ # sequent: file(1) magic for Sequent machines # # Sequent information updated by Don Dwiggins <atsun!dwiggins>. # For Sequent's multiprocessor systems (incomplete). 0 lelong 0x00ea BALANCE NS32000 .o >16 lelong >0 not stripped >124 lelong >0 version %ld 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 lelong 0x30ea BALANCE NS32000 standalone executable >16 lelong >0 not stripped >124 lelong >0 version %ld # # Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. # Symmetry magic nums will not be reached if DOS COM comes before them; # byte 0xeb is matched before these get a chance. 0 leshort 0x12eb SYMMETRY i386 .o >16 lelong >0 not stripped >124 lelong >0 version %ld 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 leshort 0x42eb SYMMETRY i386 standalone executable >16 lelong >0 not stripped >124 lelong >0 version %ld #------------------------------------------------------------------------------ # sgi: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) # # all of SGI's *current* machines and OSes run in big-endian mode on the # MIPS machines, as far as I know. # # XXX - what is the blank "-" line? # 0 belong 0407 old SGI 68020 executable 0 belong 0410 old SGI 68020 pure executable 0 beshort 0x8765 disk quotas file 0 beshort 0x0506 IRIS Showcase file >2 byte 0x49 - >3 byte x - version %ld 0 beshort 0x0226 IRIS Showcase template >2 byte 0x63 - >3 byte x - version %ld 0 belong 0x5343464d IRIS Showcase file >4 byte x - version %ld 0 belong 0x5443464d IRIS Showcase template >4 byte x - version %ld 0 belong 0xdeadbabe IRIX Parallel Arena >8 belong >0 - version %ld # 0 beshort 0x0160 MIPSEB COFF executable >20 beshort 0407 (impure) >20 beshort 0410 (swapped) >20 beshort 0413 (paged) >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld >23 byte x .%ld # 0 beshort 0x0162 MIPSEL COFF executable >20 beshort 0407 (impure) >20 beshort 0410 (swapped) >20 beshort 0413 (paged) >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %d >22 byte x .%ld # 0 beshort 0x6001 MIPSEB-LE COFF executable >20 beshort 03401 (impure) >20 beshort 04001 (swapped) >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %d >23 byte x .%ld # 0 beshort 0x6201 MIPSEL-LE COFF executable >20 beshort 03401 (impure) >20 beshort 04001 (swapped) >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld >23 byte x .%ld # # MIPS 2 additions # 0 beshort 0x0163 MIPSEB MIPS-II COFF executable >20 beshort 0407 (impure) >20 beshort 0410 (swapped) >20 beshort 0413 (paged) >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld >23 byte x .%ld # 0 beshort 0x0166 MIPSEL MIPS-II COFF executable >20 beshort 0407 (impure) >20 beshort 0410 (swapped) >20 beshort 0413 (paged) >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld >23 byte x .%ld # 0 beshort 0x6301 MIPSEB-LE MIPS-II COFF executable >20 beshort 03401 (impure) >20 beshort 04001 (swapped) >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld >23 byte x .%ld # 0 beshort 0x6601 MIPSEL-LE MIPS-II COFF executable >20 beshort 03401 (impure) >20 beshort 04001 (swapped) >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld >23 byte x .%ld # # MIPS 3 additions # 0 beshort 0x0140 MIPSEB MIPS-III COFF executable >20 beshort 0407 (impure) >20 beshort 0410 (swapped) >20 beshort 0413 (paged) >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld >23 byte x .%ld # 0 beshort 0x0142 MIPSEL MIPS-III COFF executable >20 beshort 0407 (impure) >20 beshort 0410 (swapped) >20 beshort 0413 (paged) >8 belong >0 not stripped >8 belong 0 stripped >22 byte x - version %ld >23 byte x .%ld # 0 beshort 0x4001 MIPSEB-LE MIPS-III COFF executable >20 beshort 03401 (impure) >20 beshort 04001 (swapped) >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld >23 byte x .%ld # 0 beshort 0x4201 MIPSEL-LE MIPS-III COFF executable >20 beshort 03401 (impure) >20 beshort 04001 (swapped) >20 beshort 05401 (paged) >8 belong >0 not stripped >8 belong 0 stripped >23 byte x - version %ld >23 byte x .%ld # 0 beshort 0x180 MIPSEB Ucode 0 beshort 0x182 MIPSEL Ucode # 32bit core file 0 belong 0xdeadadb0 IRIX core dump >4 belong 1 of >16 string >\0 '%s' # 64bit core file 0 belong 0xdeadad40 IRIX 64-bit core dump >4 belong 1 of >16 string >\0 '%s' # New style crash dump file 0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of >36 string >\0 '%s' # Trusted IRIX info 0 string SGIAUDIT SGI Audit file >8 byte x - version %d >9 byte x .%ld # Are these three SGI-based file types or general ones? 0 string WNGZWZSC Wingz compiled script 0 string WNGZWZSS Wingz spreadsheet 0 string WNGZWZHP Wingz help file # 0 string \#Inventor V IRIS Inventor file # XXX - I don't know what next thing is! It is likely to be an image # (or movie) format 0 string glfHeadMagic(); GLF_TEXT 4 belong 0x41010000 GLF_BINARY_LSB_FIRST 4 belong 0x00000141 GLF_BINARY_MSB_FIRST #------------------------------------------------------------------------------ # sgml: file(1) magic for Standard(?) Generalized Mark-up Language # # $Id: sgml,v 1.3 1995/04/28 19:24:37 christos Exp $ # SGML goop, mostly from rph@sq. 0 string \<!DOCTYPE Exported SGML document 0 string \<!doctype Exported SGML document 0 string \<!SUBDOC Exported SGML subdocument 0 string \<!subdoc Exported SGML subdocument 0 string \<!-- Exported SGML document #------------------------------------------------------------------------------ # softquad: file(1) magic for SoftQuad Publishing Software # # $Id: softquad,v 1.4 1995/04/28 19:24:38 christos Exp $ # Author/Editor and RulesBuilder # # XXX - byte order? # 0 string \<!SQ\ DTD> Compiled SGML rules file >9 string >\0 Type %s 0 string \<!SQ\ A/E> A/E SGML Document binary >9 string >\0 Type %s 0 string \<!SQ\ STS> A/E SGML binary styles file >9 string >\0 Type %s 0 short 0xc0de Compiled PSI (v1) data 0 short 0xc0da Compiled PSI (v2) data >3 string >\0 (%s) # Binary sqtroff font/desc files... 0 short 0125252 SoftQuad DESC or font file binary >2 short >0 - version %d # Bitmaps... 0 string SQ\ BITMAP1 SoftQuad Raster Format text #0 string SQ\ BITMAP2 SoftQuad Raster Format data # sqtroff intermediate language (replacement for ditroff int. lang.) 0 string X\ SoftQuad troff Context intermediate >2 string 495 for AT&T 495 laser printer >2 string hp for Hewlett-Packard LaserJet >2 string impr for IMAGEN imPRESS >2 string ps for PostScript #------------------------------------------------------------------------------ # sun: file(1) magic for Sun machines # # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x # releases. (5.x uses ELF.) # 0 belong&077777777 0600413 sparc demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0600410 sparc pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0600407 sparc >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0400413 mc68020 demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >16 belong >0 not stripped 0 belong&077777777 0400410 mc68020 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0400407 mc68020 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0200413 mc68010 demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >16 belong >0 not stripped 0 belong&077777777 0200410 mc68010 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0200407 mc68010 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped # reworked these to avoid anything beginning with zero becoming "old sun-2" 0 belong 0407 old sun-2 executable >16 belong >0 not stripped 0 belong 0410 old sun-2 pure executable >16 belong >0 not stripped 0 belong 0413 old sun-2 demand paged executable >16 belong >0 not stripped # # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC # binary executed in compatibility mode under SunOS 5.x". # 0 belong 0x080456 SunOS core file >4 belong 432 (SPARC) >>132 string >\0 from '%s' >>116 belong =3 (quit) >>116 belong =4 (illegal instruction) >>116 belong =5 (trace trap) >>116 belong =6 (abort) >>116 belong =7 (emulator trap) >>116 belong =8 (arithmetic exception) >>116 belong =9 (kill) >>116 belong =10 (bus error) >>116 belong =11 (segmentation violation) >>116 belong =12 (bad argument to system call) >>116 belong =29 (resource lost) >>120 belong x (T=%dK, >>124 belong x D=%dK, >>128 belong x S=%dK) >4 belong 826 (68K) >>128 string >\0 from '%s' >4 belong 456 (SPARC 4.x BCP) >>152 string >\0 from '%s' #------------------------------------------------------------------------------ # terminfo: file(1) magic for terminfo # # XXX - byte order for screen images? # 0 string \032\001 Compiled terminfo entry 0 short 0433 Curses screen image 0 short 0434 Curses screen image #------------------------------------------------------------------------------ # tex: file(1) magic for TeX files # # From <conklin@talisman.kaleida.com> # Although we may know the offset of certain text fields in TeX DVI # and font files, we can't use them reliably because they are not # zero terminated. [but we do anyway, christos] 0 string \367\002 TeX DVI file >16 string >\0 (%s) 0 string \367\203 TeX generic font data 0 string \367\131 TeX packed font data >3 string >\0 (%s) 0 string \367\312 TeX virtual font data 0 string This\ is\ TeX, TeX transcript text 0 string This\ is\ METAFONT, METAFONT transcript text # There is no way to detect TeX Font Metric (*.tfm) files without # breaking them apart and reading the data. The following patterns # match most *.tfm files generated by METAFONT or afm2tfm. 2 string \000\021 TeX font metric data 2 string \000\022 TeX font metric data >33 string >\0 (%s) # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 0 string \\input\ texinfo Texinfo source text 0 string This\ is\ Info\ file GNU Info text # TeX document additions from Daniel Quinlan, quinlan@yggdrasil.com 0 string \\input TeX or TeX-derivative document text 0 string \\chapter TeX or TeX-derivative document text 0 string \\documentstyle TeX or TeX-derivative document text 0 string \\section TeX or TeX-derivative document text 0 string \\setlength TeX or TeX-derivative document text #------------------------------------------------------------------------------ # timezone: file(1) magic for timezone data # # from Daniel Quinlan (quinlan@yggdrasil.com) # this should work on Linux, SunOS, and maybe others 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 timezone data 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 timezone data 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 timezone data 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 timezone data 0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 timezone data #------------------------------------------------------------------------------ # troff: file(1) magic for *roff # # updated by Daniel Quinlan (quinlan@yggdrasil.com) # troff input 0 string .\\" troff or preprocessor input text 0 string '\\" troff or preprocessor input text 0 string '.\\" troff or preprocessor input text 0 string \\" troff or preprocessor input text # ditroff intermediate output text 0 string x\ T ditroff text >4 string cat for the C/A/T phototypesetter >4 string ps for PostScript >4 string dvi for DVI >4 string ascii for ASCII >4 string lj4 for LaserJet 4 >4 string latin1 for ISO 8859-1 (Latin 1) >4 string X75 for xditview at 75dpi >>7 string -12 (12pt) >4 string X100 for xditview at 100dpi >>8 string -12 (12pt) # output data formats 0 string \100\357 very old (C/A/T) troff output data #------------------------------------------------------------------------------ # typeset: file(1) magic for other typesetting # 0 string Interpress/Xerox Xerox InterPress data >16 string / (version >>17 string >\0 %s) #------------------------------------------------------------------------------ # unknown: file(1) magic for unknown machines # # XXX - this probably should be pruned, as it'll match PDP-11 and # VAX image formats. # # 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, # respectively). # # 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't # have the "version %ld", which may be a bogus COFFism (I don't think # there ever was COFF for the PDP-11). # # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a # long, as it would be on a VAX. # # 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown. # 0 short 0x107 unknown machine executable >8 short >0 not stripped >15 byte >0 - version %ld 0 short 0x108 unknown pure executable >8 short >0 not stripped >15 byte >0 - version %ld 0 short 0x109 PDP-11 separate I&D >8 short >0 not stripped >15 byte >0 - version %ld 0 short 0x10b unknown pure executable >8 short >0 not stripped >15 byte >0 - version %ld 0 long 0x10c unknown demand paged pure executable >16 long >0 not stripped 0 long 0x10d unknown demand paged pure executable >16 long >0 not stripped 0 long 0x10e unknown readable demand paged pure executable #------------------------------------------------------------------------------ # uuencoded: file(1) magic for ASCII-encoded files # 0 string begin uuencoded mail text # Btoa(1) is an alternative to uuencode that requires less space. 0 string xbtoa\ Begin btoa'd text #------------------------------------------------------------------------------ # varied.out: file(1) magic for various USG systems # # Herewith many of the object file formats used by USG systems. # Most have been moved to files for a particular processor, # and deleted if they duplicate other entries. # 0 short 0610 Perkin-Elmer executable # AMD 29K 0 beshort 0572 amd 29k coff noprebar executable 0 beshort 01572 amd 29k coff prebar executable 0 beshort 0160007 amd 29k coff archive # Cray 6 beshort 0407 unicos (cray) executable #------------------------------------------------------------------------------ # vax: file(1) magic for VAX executable/object and APL workspace # 0 lelong 0101557 VAX single precision APL workspace 0 lelong 0101556 VAX double precision APL workspace # # VAX a.out (32V, BSD) # 0 lelong 0407 VAX executable >16 lelong >0 not stripped 0 lelong 0410 VAX pure executable >16 lelong >0 not stripped 0 lelong 0413 VAX demand paged pure executable >16 lelong >0 not stripped 0 lelong 0420 VAX demand paged (first page unmapped) pure executable >16 lelong >0 not stripped # # VAX COFF # # The `versions' should be un-commented if they work for you. # (Was the problem just one of endianness?) # 0 leshort 0570 VAX COFF executable >12 lelong >0 not stripped >22 leshort >0 - version %ld 0 leshort 0575 VAX COFF pure executable >12 lelong >0 not stripped >22 leshort >0 - version %ld #------------------------------------------------------------------------------ # visx: file(1) magic for Visx format files # 0 short 0x5555 VISX image file >2 byte 0 (zero) >2 byte 1 (unsigned char) >2 byte 2 (short integer) >2 byte 3 (float 32) >2 byte 4 (float 64) >2 byte 5 (signed char) >2 byte 6 (bit-plane) >2 byte 7 (classes) >2 byte 8 (statistics) >2 byte 10 (ascii text) >2 byte 15 (image segments) >2 byte 100 (image set) >2 byte 101 (unsigned char vector) >2 byte 102 (short integer vector) >2 byte 103 (float 32 vector) >2 byte 104 (float 64 vector) >2 byte 105 (signed char vector) >2 byte 106 (bit plane vector) >2 byte 121 (feature vector) >2 byte 122 (feature vector library) >2 byte 124 (chain code) >2 byte 126 (bit vector) >2 byte 130 (graph) >2 byte 131 (adjacency graph) >2 byte 132 (adjacency graph library) >2 string .VISIX (ascii text) #------------------------------------------------------------------------------ # vms: file(1) magic for VMS executables (experimental) # # VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) # GRR 950122: I'm just guessing on these, based on inspection of the headers # of three executables each for Alpha and VAX architectures. The VAX files # all had headers similar to this: # # 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 # 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ # 0 string \xb0\x00\x30\x00 VMS VAX executable >44032 string PK\003\004 (Info-ZIP SFX archive v5.12 w/decryption) # # The AXP files all looked like this, except that the byte at offset 0x22 # was 06 in some of them and 07 in others: # # 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ # 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... # 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ # 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ # 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ # 0 belong 0x03000000 VMS Alpha executable >75264 string PK\003\004 (Info-ZIP SFX archive v5.12 w/decryption) #------------------------------------------------------------------------------ # zilog: file(1) magic for Zilog Z8000. # # Was it big-endian or little-endian? My Product Specification doesn't # say. # 0 long 0xe807 object file (z8000 a.out) 0 long 0xe808 pure object file (z8000 a.out) 0 long 0xe809 separate object file (z8000 a.out) 0 long 0xe805 overlay object file (z8000 a.out) #------------------------------------------------------------------------------ # zyxel: file(1) magic for ZyXEL modems # # From <rob@pe1chl.ampr.org> # These are the /etc/magic entries to decode datafiles as used for the # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a # ZyXEL-defined standard) 0 string ZyXEL\002 ZyXEL voice data >10 byte 0 - CELP encoding >10 byte&0x0B 1 - ADPCM2 encoding >10 byte&0x0B 2 - ADPCM3 encoding >10 byte&0x0B 3 - ADPCM4 encoding >10 byte&0x0B 8 - New ADPCM3 encoding >10 byte&0x04 4 with resync