From 79343712f725e22dd7010730453b5f3a7b17bb4f Mon Sep 17 00:00:00 2001 From: Peter Avalos Date: Sat, 20 Jun 2009 13:57:23 -1000 Subject: [PATCH] Upgrade to file-5.03. Changes can be viewed in the ChangeLog file. --- contrib/file/{LEGAL.NOTICE => COPYING} | 2 +- contrib/file/ChangeLog | 469 ++++++++-- contrib/file/MAINT | 5 +- contrib/file/README | 97 ++- contrib/file/README.DELETED | 16 +- contrib/file/doc/file.man | 296 +++---- contrib/file/doc/libmagic.man | 20 +- contrib/file/doc/magic.man | 216 +++-- contrib/file/magic/Magdir/adventure | 10 + contrib/file/magic/Magdir/animation | 420 +++++---- contrib/file/magic/Magdir/apple | 31 +- contrib/file/magic/Magdir/archive | 71 +- contrib/file/magic/Magdir/audio | 125 ++- contrib/file/magic/Magdir/bFLT | 12 - contrib/file/magic/Magdir/c-lang | 13 +- contrib/file/magic/Magdir/c64 | 1 - contrib/file/magic/Magdir/cafebabe | 21 +- contrib/file/magic/Magdir/cddb | 3 +- contrib/file/magic/Magdir/chi | 7 - contrib/file/magic/Magdir/clarion | 26 + contrib/file/magic/Magdir/commands | 42 +- contrib/file/magic/Magdir/compress | 52 +- contrib/file/magic/Magdir/console | 12 +- contrib/file/magic/Magdir/cracklib | 2 +- contrib/file/magic/Magdir/ctags | 3 +- contrib/file/magic/Magdir/database | 51 +- contrib/file/magic/Magdir/diff | 24 +- contrib/file/magic/Magdir/dump | 38 + contrib/file/magic/Magdir/elf | 79 +- contrib/file/magic/Magdir/epoc | 15 +- contrib/file/magic/Magdir/erlang | 18 + contrib/file/magic/Magdir/filesystems | 411 ++++++--- contrib/file/magic/Magdir/flash | 3 + contrib/file/magic/Magdir/fonts | 7 +- contrib/file/magic/Magdir/fortran | 3 +- contrib/file/magic/Magdir/frame | 14 +- contrib/file/magic/Magdir/freebsd | 4 +- contrib/file/magic/Magdir/fsav | 10 +- contrib/file/magic/Magdir/games | 110 ++- contrib/file/magic/Magdir/gimp | 4 + contrib/file/magic/Magdir/gnome-keyring | 23 + contrib/file/magic/Magdir/gnu | 8 + contrib/file/magic/Magdir/gnumeric | 7 + contrib/file/magic/Magdir/graphviz | 10 + contrib/file/magic/Magdir/hdf | 7 - contrib/file/magic/Magdir/hp | 104 ++- contrib/file/magic/Magdir/iff | 3 + contrib/file/magic/Magdir/images | 156 +++- contrib/file/magic/Magdir/inform | 8 + contrib/file/magic/Magdir/java | 3 +- contrib/file/magic/Magdir/jpeg | 10 + contrib/file/magic/Magdir/kde | 10 + contrib/file/magic/Magdir/kml | 32 + contrib/file/magic/Magdir/lex | 9 +- contrib/file/magic/Magdir/linux | 36 +- contrib/file/magic/Magdir/lisp | 52 +- contrib/file/magic/Magdir/llvm | 10 + contrib/file/magic/Magdir/lua | 19 + contrib/file/magic/Magdir/luks | 12 + contrib/file/magic/Magdir/mach | 2 +- contrib/file/magic/Magdir/macintosh | 135 +-- contrib/file/magic/Magdir/mail.news | 14 +- contrib/file/magic/Magdir/mathcad | 7 + contrib/file/magic/Magdir/mathematica | 4 +- contrib/file/magic/Magdir/mercurial | 12 + contrib/file/magic/Magdir/misctools | 14 +- contrib/file/magic/Magdir/mozilla | 8 + contrib/file/magic/Magdir/msdos | 358 ++++---- contrib/file/magic/Magdir/mup | 2 +- contrib/file/magic/Magdir/netware | 6 + contrib/file/magic/Magdir/ole2compounddocs | 13 + contrib/file/magic/Magdir/os2 | 5 +- contrib/file/magic/Magdir/palm | 2 +- contrib/file/magic/Magdir/pdf | 3 +- contrib/file/magic/Magdir/perl | 47 +- contrib/file/magic/Magdir/pgp | 23 +- contrib/file/magic/Magdir/pkgadd | 1 + contrib/file/magic/Magdir/printer | 35 +- contrib/file/magic/Magdir/psion | 2 +- contrib/file/magic/Magdir/python | 2 + contrib/file/magic/Magdir/revision | 10 + contrib/file/magic/Magdir/riff | 6 +- contrib/file/magic/Magdir/rpm | 3 +- contrib/file/magic/Magdir/rtf | 13 +- contrib/file/magic/Magdir/ruby | 10 + contrib/file/magic/Magdir/sc | 1 + contrib/file/magic/Magdir/scientific | 13 +- contrib/file/magic/Magdir/securitycerts | 3 + contrib/file/magic/Magdir/sgi | 18 +- contrib/file/magic/Magdir/sgml | 60 +- contrib/file/magic/Magdir/sharc | 8 +- contrib/file/magic/Magdir/sketch | 3 +- contrib/file/magic/Magdir/softquad | 10 +- contrib/file/magic/Magdir/spectrum | 11 +- contrib/file/magic/Magdir/tex | 60 +- contrib/file/magic/Magdir/timezone | 17 + contrib/file/magic/Magdir/troff | 64 +- contrib/file/magic/Magdir/unicode | 7 +- contrib/file/magic/Magdir/uuencode | 15 +- contrib/file/magic/Magdir/varied.script | 6 + contrib/file/magic/Magdir/vorbis | 28 +- contrib/file/magic/Magdir/warc | 6 + contrib/file/magic/Magdir/weak | 15 + contrib/file/magic/Magdir/windows | 121 +++ contrib/file/magic/Magdir/wireless | 5 + contrib/file/magic/Magdir/wordprocessors | 30 +- contrib/file/magic/Magdir/xilinx | 34 + contrib/file/magic/Magdir/xwindows | 9 + contrib/file/magic/magic.mime | 991 --------------------- contrib/file/magic/magic2mime | 68 -- contrib/file/src/apprentice.c | 745 ++++++++++++---- contrib/file/src/apptype.c | 12 +- contrib/file/src/ascmagic.c | 1104 +++++++++--------------- contrib/file/src/cdf.c | 1235 +++++++++++++++++++++++++++ contrib/file/src/cdf.h | 305 +++++++ contrib/file/src/cdf_time.c | 183 ++++ contrib/file/src/compress.c | 27 +- contrib/file/src/{test.c => elfclass.h} | 70 +- contrib/file/src/{ascmagic.c => encoding.c} | 441 +++------- contrib/file/src/file.c | 272 +++--- contrib/file/src/file.h | 194 +++-- contrib/file/src/file_opts.h | 1 + contrib/file/src/fsmagic.c | 194 +++-- contrib/file/src/funcs.c | 303 ++++--- contrib/file/src/is_tar.c | 24 +- contrib/file/src/magic.c | 98 +-- contrib/file/src/magic.h | 25 +- contrib/file/src/mygetopt.h | 68 ++ contrib/file/src/names.h | 29 +- contrib/file/src/patchlevel.h | 27 +- contrib/file/src/print.c | 28 +- contrib/file/src/readcdf.c | 269 ++++++ contrib/file/src/readelf.c | 529 ++++++++---- contrib/file/src/readelf.h | 81 +- contrib/file/src/softmagic.c | 453 +++++++--- contrib/file/src/tar.h | 64 +- 136 files changed, 7797 insertions(+), 4606 deletions(-) rename contrib/file/{LEGAL.NOTICE => COPYING} (96%) delete mode 100644 contrib/file/magic/Magdir/bFLT delete mode 100644 contrib/file/magic/Magdir/chi create mode 100644 contrib/file/magic/Magdir/clarion rewrite contrib/file/magic/Magdir/diff (62%) create mode 100644 contrib/file/magic/Magdir/erlang create mode 100644 contrib/file/magic/Magdir/gnome-keyring create mode 100644 contrib/file/magic/Magdir/gnumeric create mode 100644 contrib/file/magic/Magdir/graphviz delete mode 100644 contrib/file/magic/Magdir/hdf create mode 100644 contrib/file/magic/Magdir/inform create mode 100644 contrib/file/magic/Magdir/kde create mode 100644 contrib/file/magic/Magdir/kml create mode 100644 contrib/file/magic/Magdir/llvm create mode 100644 contrib/file/magic/Magdir/lua create mode 100644 contrib/file/magic/Magdir/luks create mode 100644 contrib/file/magic/Magdir/mathcad create mode 100644 contrib/file/magic/Magdir/mercurial create mode 100644 contrib/file/magic/Magdir/mozilla create mode 100644 contrib/file/magic/Magdir/netware create mode 100644 contrib/file/magic/Magdir/ole2compounddocs create mode 100644 contrib/file/magic/Magdir/ruby create mode 100644 contrib/file/magic/Magdir/securitycerts rewrite contrib/file/magic/Magdir/troff (67%) create mode 100644 contrib/file/magic/Magdir/warc create mode 100644 contrib/file/magic/Magdir/weak create mode 100644 contrib/file/magic/Magdir/windows create mode 100644 contrib/file/magic/Magdir/wireless create mode 100644 contrib/file/magic/Magdir/xilinx delete mode 100644 contrib/file/magic/magic.mime delete mode 100644 contrib/file/magic/magic2mime rewrite contrib/file/src/ascmagic.c (71%) create mode 100644 contrib/file/src/cdf.c create mode 100644 contrib/file/src/cdf.h create mode 100644 contrib/file/src/cdf_time.c rename contrib/file/src/{test.c => elfclass.h} (55%) copy contrib/file/src/{ascmagic.c => encoding.c} (62%) create mode 100644 contrib/file/src/mygetopt.h create mode 100644 contrib/file/src/readcdf.c diff --git a/contrib/file/LEGAL.NOTICE b/contrib/file/COPYING similarity index 96% rename from contrib/file/LEGAL.NOTICE rename to contrib/file/COPYING index 68148e2ffd..b3db8b23fb 100644 --- a/contrib/file/LEGAL.NOTICE +++ b/contrib/file/COPYING @@ -1,4 +1,4 @@ -$File: LEGAL.NOTICE,v 1.15 2006/05/03 18:48:33 christos Exp $ +$File: COPYING,v 1.1 2008/02/05 19:08:11 christos Exp $ Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995. Software written by Ian F. Darwin and others; maintained 1994- Christos Zoulas. diff --git a/contrib/file/ChangeLog b/contrib/file/ChangeLog index 2beffb0cfd..90a32fcecf 100644 --- a/contrib/file/ChangeLog +++ b/contrib/file/ChangeLog @@ -1,4 +1,287 @@ -2007-12-28 15:06 Christos Zoulas +2009-05-06 10:25 Christos Zoulas + + * Avoid null dereference in cdf code (Drew Yao) + + * More cdf bounds checks and overflow checks + +2009-05-01 18:37 Christos Zoulas + + * Buffer overflow fixes from Drew Yao + +2009-04-30 17:10 Christos Zoulas + + * Fix more cdf lossage. All the documents I have + right now print the correct information. + +2009-03-27 18:43 Christos Zoulas + + * don't print \012- separators in the same magic entry + if it consists of multiple magic printing lines. + +2009-03-23 10:20 Christos Zoulas + + * Avoid file descriptor leak in compress code from + (Daniel Novotny) + +2009-03-18 16:50 Christos Zoulas + + * Allow escaping of relation characters, so that we can say \^[A-Z] + and the ^ is not eaten as a relation char. + + * Fix troff and fortran to their previous glory using + regex. This was broken since their removel from ascmagic. + +2009-03-10 16:50 Christos Zoulas + + * don't use strlen in strndup() (Toby Peterson) + +2009-03-10 7:45 Christos Zoulas + + * avoid c99 syntax. + +2009-02-23 15:45 Christos Zoulas + + * make the cdf code use the buffer first if available, + and then the fd code. + +2009-02-13 13:45 Christos Zoulas + + * look for struct option to determine if getopt.h is usable for IRIX. + + * sanitize cdf document strings + +2009-02-04 13:25 Christos Zoulas + + * fix OS/2 warnings. + +2008-12-12 15:50 Christos Zoulas + + * fix initial offset calculation for non 4K sector files + + * add loop limits to avoid DoS attacks by constructing + looping sector references. + +2008-12-03 13:05 Christos Zoulas + + * fix memory botches on cdf file parsing. + + * exit with non-zero value for any error, not just for the last + file processed. + +2008-11-09 20:42 Charles Longeau + + * Replace all str{cpy,cat} functions with strl{cpy,cat} + * Ensure that strl{cpy,cat} are included in libmagic, + as needed. + +2008-11-06 18:18 Christos Zoulas + + * Handle ID3 format files. + +2008-11-06 23:00 Reuben Thomas + + * Fix --mime, --mime-type and --mime-encoding under new scheme. + + * Rename "ascii" to "text" and add "encoding" test. + + * Return a precise ("utf-16le" or "utf-16be") MIME charset for + UTF-16. + + * Fix error in comment caused by automatic indentation adding + words! + +2008-11-06 10:35 Christos Zoulas + + * use memchr instead of strchr because the string + might not be NUL terminated (Scott MacVicar) + +2008-11-03 07:31 Reuben Thomas + + * Fix a printf with a non-literal format string. + + * Fix formatting and punctuation of help for "--apple". + +2008-10-30 11:00 Reuben Thomas + + * Correct words counts in comments of struct magic. + + * Fix handle_annotation to allow both Apple and MIME types to be + printed, and to return correct code if MIME type is + printed (1, not 0) or if there's an error (-1 not 1). + + * Fix output of charset for MIME type (precede with semi-colon; + fixes Debian bug #501460). + + * Fix potential attacks via conversion specifications in magic + strings. + + * Add a FIXME for Debian bug #488562 (magic files should be + read in a defined order, by sorting the names). + +2008-10-18 16:45 Christos Zoulas + + * Added APPLE file creator/type + +2008-10-12 10:20 Christos Zoulas + + * Added CDF parsing + +2008-10-09 16:40 Christos Zoulas + + * filesystem and msdos patches (Joerg Jenderek) + +2008-10-09 13:20 Christos Zoulas + + * correct --exclude documentation issues: remove troff and fortran + and rename "token" to "tokens". (Randy McMurchy) + +2008-10-01 10:30 Christos Zoulas + + * Read ~/.magic in addition to the default magic file not instead + of, as documented in the man page. + +2008-09-10 21:30 Reuben Thomas + + * Comment out graphviz patterns, as they match too many files. + +2008-08-30 12:54 Christos Zoulas + + * Don't eat trailing \n in magic enties. + + * Cast defines to allow compilation using a c++ compiler. + +2008-08-25 23:56 Reuben Thomas + + * Add text/x-lua MIME type for Lua scripts. + + * Escape { in regex in graphviz patterns. + +2008-07-26 00:59 Reuben Thomas + + * Add MIME types for special files. + + * Use access to give more accurate information for files that + can't be opened. + + * Add a TODO list. + +2008-07-02 11:15 Christos Zoulas + + * add !:strength op to adjust magic strength (experimental) + +2008-06-16 21:41 Reuben Thomas + + * Fix automake error in configure.ac. + + * Add MIME type for Psion Sketch files. + +2008-06-05 08:59 Christos Zoulas + + * Don't print warnings about bad namesize in stripped + binaries with PT_NOTE is still there, and the actual + note is gone (Jakub Jelinek) + +2008-05-28 15:12 Robert Byrnes + + * magic/Magdir/elf: + Note invalid byte order for little-endian SPARC32PLUS. + Add SPARC V9 vendor extensions and memory model. + + * src/elfclass.h: + Pass target machine to doshn (for Solaris hardware capabilities). + + * src/readelf.c (doshn): + Add support for Solaris hardware/software capabilities. + + * src/readelf.h: + Ditto. + + * src/vasprintf.c (dispatch): + Add support for ll modifier. + +2008-05-16 10:25 Christos Zoulas + + * Fix compiler warnings. + + * remove stray printf, and fix a vprintf bug. (Martin Dorey) + +2008-05-06 00:13 Robert Byrnes + + * src/Makefile.am: + Ensure that getopt_long and [v]asprintf are included in libmagic, + as needed. + + Remove unnecessary EXTRA_DIST. + + * src/Makefile.in: + Rerun automake. + + * src/vasprintf.c (dispatch): + Fix variable precision bug: be sure to step past '*'. + + * src/vasprintf.c (core): + Remove unreachable code. + + * src/apprentice.c (set_test_type): + Add cast to avoid compiler warning. + +2008-04-22 23:45 Christos Zoulas + + * Add magic submission guidelines (Abel Cheung) + + * split msdos and windows magic (Abel Cheung) + +2008-04-04 11:00 Christos Zoulas + + * >= <= is not supported, so fix the magic and warn about it. + reported by: Thien-Thi Nguyen + +2008-03-27 16:16 Robert Byrnes + + * src/readelf.c (donote): + ELF core file command name/line bug fixes and enhancements: + + Try larger offsets first to avoid false matches + from earlier data that happen to look like strings; + this primarily affected SunOS 5.x 32-bit Intel core files. + + Add support for command line (instead of just short name) + for SunOS 5.x. + + Add information about NT_PSINFO for SunOS 5.x. + + Only trim whitespace from end of command line. + +2007-02-11 01:36 Reuben Thomas + + * Change strength of ! from MULT to 0, as it matches almost + anything (Reuben Thomas) + + * Debian fixes (Reuben Thomas) + +2007-02-11 00:17 Reuben Thomas + + * Clarify UTF-8 BOM message (Reuben Thomas) + + * Add HTML comment to token list in names.h + +2007-02-04 15:50 Christos Zoulas + + * Debian fixes (Reuben Thomas) + +2007-02-04 11:31 Christos Zoulas + + * !:mime annotations in magic files (Reuben Thomas) + +2007-01-29 15:35 Christos Zoulas + + * zero out utime/utimes structs (Gavin Atkinson) + +2007-01-26 13:45 Christos Zoulas + + * reduce writable data from Diego "Flameeyes" Petten + +2007-12-28 15:06 Christos Zoulas * strtof detection @@ -6,7 +289,7 @@ * better mismatch version message -2007-12-27 11:35 Christos Zoulas +2007-12-27 11:35 Christos Zoulas * bring back some fixes from OpenBSD @@ -14,46 +297,46 @@ * fix gcc warnings -2007-12-01 19:55 Christos Zoulas +2007-12-01 19:55 Christos Zoulas * make sure we have zlib.h and libz to compile the builtin decompress code -2007-10-28 20:48 Christos Zoulas +2007-10-28 20:48 Christos Zoulas - * float and double magic support (Behan Webster) + * float and double magic support (Behan Webster) -2007-10-28 20:48 Christos Zoulas +2007-10-28 20:48 Christos Zoulas * Convert fortran to a soft test (Reuben Thomas) -2007-10-23 5:25 Christos Zoulas +2007-10-23 5:25 Christos Zoulas * Add --with-filename, and --no-filename (Reuben Thomas) -2007-10-23 3:59 Christos Zoulas +2007-10-23 3:59 Christos Zoulas * Rest of the mime split (Reuben Thomas) * Make usage message generated from the flags so that they stay consistent (Reuben Thomas) -2007-10-20 3:06 Christos Zoulas +2007-10-20 3:06 Christos Zoulas * typo in comment, missing ifdef QUICK, remove unneeded code (Charles Longeau) -2007-10-17 3:33 Christos Zoulas +2007-10-17 3:33 Christos Zoulas * Fix problem printing -\012 in some entries * Separate magic type and encoding flags (Reuben Thomas) -2007-10-09 3:55 Christos Zoulas +2007-10-09 3:55 Christos Zoulas * configure fix for int64 and strndup (Reuben Thomas) -2007-09-26 4:45 Christos Zoulas +2007-09-26 4:45 Christos Zoulas * Add magic_descriptor() function. @@ -62,13 +345,13 @@ * Don't convert NUL's to spaces in {l,b}estring16 (Daniel Dawson) -2007-08-19 6:30 Christos Zoulas +2007-08-19 6:30 Christos Zoulas * Make mime format consistent so that it can be easily parsed: mimetype [charset=character-set] [encoding=encoding-mime-type] - Remove spurious extra text from some MIME type printouts + Remove spurious extra text from some MIME type printouts (mostly in is_tar). Fix one case where -i produced nothing at all (for a 1-byte file, @@ -79,45 +362,45 @@ This work was done by Reuben Thomas -2007-05-24 10:00 Christos Zoulas +2007-05-24 10:00 Christos Zoulas * Fix another integer overflow (Colin Percival) -2007-03-26 13:58 Christos Zoulas +2007-03-26 13:58 Christos Zoulas * make sure that all of struct magic_set is initialized appropriately (Brett) -2007-03-25 17:44 Christos Zoulas +2007-03-25 17:44 Christos Zoulas * reset left bytes in the buffer (Dmitry V. Levin) * compilation failed with COMPILE_ONLY and ENABLE_CONDITIONALS (Peter Avalos) -2007-03-15 10:51 Christos Zoulas +2007-03-15 10:51 Christos Zoulas * fix fortran and nroff reversed tests (Dmitry V. Levin) - + * fix exclude option (Dmitry V. Levin) -2007-02-08 17:30 Christos Zoulas +2007-02-08 17:30 Christos Zoulas * fix integer underflow in file_printf which can lead to to exploitable heap overflow (Jean-Sebastien Guay-Lero) -2007-02-05 11:35 Christos Zoulas +2007-02-05 11:35 Christos Zoulas * make socket/pipe reading more robust -2007-01-25 16:01 Christos Zoulas +2007-01-25 16:01 Christos Zoulas * Centralize all the tests in file_buffer. * Add exclude flag. 2007-01-18 05:29 Anon Ymous - + * Move the "type" detection code from parse() into its own table driven routine. This avoids maintaining multiple lists in file.h. @@ -125,7 +408,7 @@ * Add an optional conditional field (ust before the type field). This code is wrapped in "#ifdef ENABLE_CONDITIONALS" as it is likely to go away. - + 2007-01-16 23:24 Anon Ymous * Fix an initialization bug in check_mem(). @@ -184,7 +467,7 @@ * make file.c compile with gcc warnings and pass lint -2006-12-11 16:49 Christos Zoulas +2006-12-11 16:49 Christos Zoulas * fix byteswapping issue @@ -193,10 +476,10 @@ * add a few missed cases in the strength routine -2006-12-08 16:32 Christos Zoulas +2006-12-08 16:32 Christos Zoulas * store and print the line number of the magic - entry for debugging. + entry for debugging. * if the magic entry did not print anything, don't treat it as a match @@ -210,8 +493,8 @@ * propagate the error return from match to file_softmagic. -2006-11-25 13:35 Christos Zoulas - +2006-11-25 13:35 Christos Zoulas + * Don't store the current offset in the magic struct, because it needs to be restored and it was not done properly all the time. Bug @@ -221,12 +504,12 @@ print it as an additional separator; print it as the only separator. -2006-11-17 10:51 Christos Zoulas +2006-11-17 10:51 Christos Zoulas * Added a -0 option to print a '\0' separator Etienne Buira -2006-10-31 15:14 Christos Zoulas +2006-10-31 15:14 Christos Zoulas * Check offset before copying (Mike Frysinger) @@ -242,7 +525,7 @@ * use calloc to initialize the ascii buffers (Jos van den Oever) -2006-06-08 11:11 Christos Zoulas +2006-06-08 11:11 Christos Zoulas * QNX fixes (Mike Gorchak) @@ -256,7 +539,7 @@ * Magic format function improvent (Karl Chen) -2006-05-03 11:11 Christos Zoulas +2006-05-03 11:11 Christos Zoulas * Pick up some elf changes and some constant fixes from SUSE @@ -264,13 +547,13 @@ * When keep going, don't print spurious newlines (Radek Vokál) -2006-04-01 12:02 Christos Zoulas +2006-04-01 12:02 Christos Zoulas * Use calloc instead of malloc (Mike Frysinger) * Fix configure script to detect wctypes.h (Mike Frysinger) -2006-03-02 16:06 Christos Zoulas +2006-03-02 16:06 Christos Zoulas * Print empty if the file is (Mike Frysinger) @@ -278,21 +561,21 @@ * Sort magic entries by strength [experimental] -2005-11-29 13:26 Christos Zoulas +2005-11-29 13:26 Christos Zoulas * Use iswprint() to convert the output string. (Bastien Nocera) -2005-10-31 8:54 Christos Zoulas +2005-10-31 8:54 Christos Zoulas * Fix regression where the core info was not completely processed (Radek Vokál) -2005-10-20 11:15 Christos Zoulas +2005-10-20 11:15 Christos Zoulas * Middle Endian magic (Diomidis Spinellis) -2005-10-17 11:15 Christos Zoulas +2005-10-17 11:15 Christos Zoulas * Open with O_BINARY for CYGWIN (Corinna Vinschen) @@ -300,39 +583,39 @@ * Look for note sections in non executables. -2005-09-20 13:33 Christos Zoulas - +2005-09-20 13:33 Christos Zoulas + * Don't print SVR4 Style in core files multiple times (Radek Vokál) -2005-08-27 04:09 Christos Zoulas +2005-08-27 04:09 Christos Zoulas * Cygwin changes Corinna Vinschen -2005-08-18 09:53 Christos Zoulas +2005-08-18 09:53 Christos Zoulas * Remove erroreous mention of /etc/magic in the file man page - This is gentoo bug 101639. (Mike Frysinger) + This is gentoo bug 101639. (Mike Frysinger) - * Cross-compile support and detection (Mike Frysinger) + * Cross-compile support and detection (Mike Frysinger) -2005-08-12 10:17 Christos Zoulas +2005-08-12 10:17 Christos Zoulas * Add -h flag and dereference symlinks if POSIXLY_CORRECT is set. -2005-07-29 13:57 Christos Zoulas +2005-07-29 13:57 Christos Zoulas * Avoid search and regex buffer overflows (Kelledin) -2005-07-12 11:48 Christos Zoulas +2005-07-12 11:48 Christos Zoulas * Provide stub implementations for {v,}nsprintf() for older OS's that don't have them. * Change mbstate_t autoconf detection macro from AC_MBSTATE_T to AC_TYPE_MBSTATE_T. -2005-06-25 11:48 Christos Zoulas +2005-06-25 11:48 Christos Zoulas * Dynamically allocate the string buffers and make the default read size 256K. @@ -346,60 +629,60 @@ * Avoid NULL pointer dereference in time conversion. 2005-03-06 00:00 Joerg Walter - + * Add indirect magic offset support, and search mode. 2005-01-12 00:00 Stepan Kasal - * src/ascmagic.c (file_ascmagic): Fix three bugs about text files: - If a CRLF text file happens to have CR at offset HOWMANY - 1 - (currently 0xffff), it should not be counted as CR line - terminator. - If a line has length exactly MAXLINELEN, it should not yet be - treated as a ``very long line'', as MAXLINELEN is ``longest sane - line length''. - With CRLF, the line length was not computed correctly, and even - lines of length MAXLINELEN - 1 were treated as ``very long''. + * src/ascmagic.c (file_ascmagic): Fix three bugs about text files: + If a CRLF text file happens to have CR at offset HOWMANY - 1 + (currently 0xffff), it should not be counted as CR line + terminator. + If a line has length exactly MAXLINELEN, it should not yet be + treated as a ``very long line'', as MAXLINELEN is ``longest sane + line length''. + With CRLF, the line length was not computed correctly, and even + lines of length MAXLINELEN - 1 were treated as ``very long''. -2004-12-07 14:15 Christos Zoulas +2004-12-07 14:15 Christos Zoulas * bzip2 needs a lot of input buffer space on some files before it can begin uncompressing. This makes file -z fail on some bz2 files. Fix it by giving it a copy of the file descriptor to read as much as it wants if we - have access to it. + have access to it. -2004-11-24 12:39 Christos Zoulas +2004-11-24 12:39 Christos Zoulas * Stack smash fix, and ELF more conservative reading. Jakub Bogusz -2004-11-20 18:50 Christos Zoulas +2004-11-20 18:50 Christos Zoulas * New FreeBSD version parsing code: Jon Noack - * Hackish support for ucs16 strings + * Hackish support for ucs16 strings -2004-11-13 03:07 Christos Zoulas +2004-11-13 03:07 Christos Zoulas * print the file name and line number in syntax errors. -2004 10-12 10:50 Christos Zoulas +2004 10-12 10:50 Christos Zoulas * Fix stack overwriting on 0 length strings: Tim Waugh Ned Ludd -2004-09-27 11:30 Christos Zoulas +2004-09-27 11:30 Christos Zoulas * Remove 3rd and 4th copyright clause; approved by Ian Darwin. - * Fix small memory leaks; caught by: Tamas Sarlos + * Fix small memory leaks; caught by: Tamas Sarlos -2004-07-24 16:33 Christos Zoulas +2004-07-24 16:33 Christos Zoulas - * magic.mime update Danny Milosavljevic + * magic.mime update Danny Milosavljevic * FreeBSD version update Oliver Eikemeier @@ -407,19 +690,19 @@ * errors reading elf magic Jakub Bogusz -2004-04-12 10:55 Christos Zoulas +2004-04-12 10:55 Christos Zoulas * make sure that magic formats match magic types during compilation * fix broken sgi magic file -2004-04-06 20:36 Christos Zoulas +2004-04-06 20:36 Christos Zoulas * detect present of mbstate_t Petter Reinholdtsen * magic fixes -2004-03-22 15:25 Christos Zoulas +2004-03-22 15:25 Christos Zoulas * Lots of mime fixes (Joerg Ostertag) @@ -428,7 +711,7 @@ (Edwin Groothuis) * correct cleanup in all cases; don't just close the file. - (Christos Zoulas) + (Christos Zoulas) * add gettext message catalogue support (Michael Piefel) @@ -446,37 +729,37 @@ or name and description note sizes. Reported by (Mikael Magnusson) -2004-03-09 13:55 Christos Zoulas +2004-03-09 13:55 Christos Zoulas * Fix possible memory leak on error and add missing regfree (Dmitry V. Levin) -2003-12-23 12:12 Christos Zoulas +2003-12-23 12:12 Christos Zoulas * fix -k flag (Maciej W. Rozycki) -2003-11-18 14:10 Christos Zoulas +2003-11-18 14:10 Christos Zoulas * Try to give us much info as possible on corrupt elf files. (Willy Tarreau) * Updated python bindings (Brett Funderburg) -2003-11-11 15:03 Christos Zoulas +2003-11-11 15:03 Christos Zoulas * Include file.h first, because it includes config.h breaks largefile test macros otherwise. (Paul Eggert via Lars Hecking ) -2003-10-14 21:39 Christos Zoulas +2003-10-14 21:39 Christos Zoulas * Python bindings (Brett Funderburg) * Don't lookup past the end of the buffer (Chad Hanson) * Add MAGIC_ERROR and api on magic_errno() -2003-10-08 12:40 Christos Zoulas +2003-10-08 12:40 Christos Zoulas * handle error conditions from compile as fatal (Antti Kantee) @@ -486,32 +769,32 @@ * describe magic file handling (Bryan Henderson) -2003-09-12 15:09 Christos Zoulas +2003-09-12 15:09 Christos Zoulas * update magic files. * remove largefile support from file.h; it breaks things on most OS's -2003-08-10 10:25 Christos Zoulas +2003-08-10 10:25 Christos Zoulas * fix unmapping'ing of mmaped files. -2003-07-10 12:03 Christos Zoulas +2003-07-10 12:03 Christos Zoulas * don't exit with -1 on error; always exit 1 (Marty Leisner) * restore utimes code. -2003-06-10 17:03 Christos Zoulas +2003-06-10 17:03 Christos Zoulas * make sure we don't access uninitialized memory. * pass lint * #ifdef __cplusplus in magic.h -2003-05-25 19:23 Christos Zoulas +2003-05-25 19:23 Christos Zoulas * rename cvs magic file to revision to deal with case insensitive filesystems. -2003-05-23 17:03 Christos Zoulas +2003-05-23 17:03 Christos Zoulas * documentation fixes from Michael Piefel * magic fixes (various) @@ -521,30 +804,30 @@ close files Maciej W. Rozycki +2003-04-21 20:12 Christos Zoulas * fix zsh magic -2003-04-04 16:59 Christos Zoulas +2003-04-04 16:59 Christos Zoulas * fix operand sort order in string. -2003-04-02 17:30 Christos Zoulas +2003-04-02 17:30 Christos Zoulas * cleanup namespace in magic.h -2003-04-02 13:50 Christos Zoulas +2003-04-02 13:50 Christos Zoulas * Magic additions (Alex Ott) * Fix bug that broke VPATH compilation (Peter Breitenlohner) -2003-03-28 16:03 Christos Zoulas +2003-03-28 16:03 Christos Zoulas * remove packed attribute from magic struct. * make the magic struct properly aligned. * bump version number of compiled files to 2. -2003-03-27 13:10 Christos Zoulas +2003-03-27 13:10 Christos Zoulas * separate tar detection and run it before softmagic. * fix reversed symlink test. @@ -552,7 +835,7 @@ * make separator a string instead of a char. * update manual page and sort options. -2003-03-26 11:00 Christos Zoulas +2003-03-26 11:00 Christos Zoulas * Pass lint * make NULL in magic_file mean stdin diff --git a/contrib/file/MAINT b/contrib/file/MAINT index 077f9d67df..b881615c3c 100644 --- a/contrib/file/MAINT +++ b/contrib/file/MAINT @@ -1,4 +1,4 @@ -$File: MAINT,v 1.9 2007/01/19 21:15:27 christos Exp $ +$File: MAINT,v 1.10 2008/02/05 19:08:11 christos Exp $ Maintenance notes: @@ -41,5 +41,4 @@ ascmagic.c file_ascmagic() readelf.c file_tryelf() "unknown" -Christos Zoulas -christos@astron.com +Christos Zoulas (see README for email address) diff --git a/contrib/file/README b/contrib/file/README index b7e9d559dc..901989a0e2 100644 --- a/contrib/file/README +++ b/contrib/file/README @@ -1,10 +1,18 @@ ** README for file(1) Command ** -@(#) $File: README,v 1.34 2006/05/03 18:48:33 christos Exp $ +@(#) $File: README,v 1.42 2009/02/14 15:16:24 christos Exp $ -This is Release 4.x of Ian Darwin's (copyright but distributable) +E-mail: christos@astron.com +Mailing List: file@mx.gw.com + +Phone: Do not even think of telephoning me about this program. Send cash first! + +This is Release 5.x of Ian Darwin's (copyright but distributable) file(1) command. This version is the standard "file" command for Linux, *BSD, and other systems. (See "patchlevel.h" for the exact release number). +The major changes for 5.x are CDF file parsing, indirect magic, and +overhaul in mime and ascii encoding handling. + The major feature of 4.x is the refactoring of the code into a library, and the re-write of the file command in terms of that library. The library itself, libmagic can be used by 3rd party programs that wish to identify @@ -41,35 +49,62 @@ magic numbers assigned to all sorts of data files that are in reasonable circulation. Send your magic numbers, in magic(5) format please, to the maintainer, Christos Zoulas. -LEGAL.NOTICE - read this first. +COPYING - read this first. README - read this second (you are currently reading this file). -PORTING - read this only if the program won't compile. -Makefile - read this next, adapt it as needed (particularly - the location of the old existing file command and - the man page layouts), type "make" to compile, - "make try" to try it out against your old version. - Expect some diffs, particularly since your original - file(1) may not grok the embedded-space ("\ ") in - the current magic file, or may even not use the - magic file. -apprentice.c - parses /etc/magic to learn magic -ascmagic.c - third & last set of tests, based on hardwired assumptions. -core - not included in distribution due to mailer limitations. -debug.c - includes -c printout routine -file.1 - man page for the command -magic.4 - man page for the magic file, courtesy Guy Harris. +INSTALL - read on how to install + +src/apprentice.c - parses /etc/magic to learn magic +src/apptype.c - used for OS/2 specific application type magic +src/asprintf.c - replacement for OS's that don't have it. +src/ascmagic.c - third & last set of tests, based on hardwired assumptions. +src/cdf.c - parser for Microsoft Compound Document Files +src/cdf_time.c - time converter for CDF. +src/compress.c - handles decompressing files to look inside. +src/encoding.c - handles unicode encodings +src/file.c - the main program +src/file.h - header file +src/fsmagic.c - first set of tests the program runs, based on filesystem info +src/funcs.c - utilility functions +src/getopt_long.c - used for OS/2 specific application type magic +src/is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore). +src/names.h - header file for ascmagic.c +src/magic.c - the libmagic api +src/print.c - print results, errors, warnings. +src/readcdf.c - CDF wrapper. +src/readelf.[ch] - Stand-alone elf parsing code. +src/softmagic.c - 2nd set of tests, based on /etc/magic +src/strlcat.c - used for OS/2 specific application type magic +src/strlcpy.c - used for OS/2 specific application type magic +src/vasprintf.c - used for OS/2 specific application type magic +doc/file.1 - man page for the command +doc/magic.4 - man page for the magic file, courtesy Guy Harris. Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile. -file.c - main program -file.h - header file -fsmagic.c - first set of tests the program runs, based on filesystem info -is_tar.c, tar.h - knows about tarchives (courtesy John Gilmore). -magdir - directory of /etc/magic pieces - magdir/Makefile - ADJUST THIS FOR YOUR CONFIGURATION -names.h - header file for ascmagic.c -softmagic.c - 2nd set of tests, based on /etc/magic -readelf.[ch] - Stand-alone elf parsing code. -compress.c - on-the-fly decompression. -print.c - print results, errors, warnings. +Magdir - directory of /etc/magic pieces + +------------------------------------------------------------------------------ + +If you submit a new magic entry please make sure you read the following +guidelines: + +- Initial match is preferably at least 32 bits long, and is a _unique_ match +- If this is not feasible, use additional check +- Match of <= 16 bits are not accepted +- Delay printing string as much as possible, don't print output too early +- Avoid printf arbitrary byte as string, which can be a source of + crash and buffer overflow + +- Provide complete information with entry: + * One line short summary + * Optional long description + * File extension, if applicable + * Full name and contact method (for discussion when entry has problem) + * Further reference, such as documentation of format + +------------------------------------------------------------------------------ + +You can download the latest version of file from: + + ftp://ftp.astron.com/pub/file/ If your gzip sometimes fails to decompress things complaining about a short file, apply this patch [which is going to be in the next version of gzip]: @@ -85,10 +120,6 @@ file, apply this patch [which is going to be in the next version of gzip]: } bytes_in += (ulg)insize; -E-mail: christos@astron.com - -Phone: Do not even think of telephoning me about this program. Send cash first! - Parts of this software were developed at SoftQuad Inc., developers of SGML/HTML/XML publishing software, in Toronto, Canada. SoftQuad was swallowed up by Corel in 2002 diff --git a/contrib/file/README.DELETED b/contrib/file/README.DELETED index 71c739eb48..f7b28c4978 100644 --- a/contrib/file/README.DELETED +++ b/contrib/file/README.DELETED @@ -1,23 +1,31 @@ +AUTHORS +INSTALL Makefile.am Makefile.in -PORTING +NEWS +TODO acinclude.m4 aclocal.m4 +compile config.guess config.h.in config.sub configure -configure.in +configure.ac depcomp install-sh ltmain.sh missing -mkinstalldirs doc/Makefile.am doc/Makefile.in magic/Makefile.am magic/Makefile.in -magic/magic2mime python src/Makefile.am src/Makefile.in +src/asprintf.c +src/getopt_long.c +src/strlcat.c +src/strlcpy.c +src/vasprintf.c +tests/ diff --git a/contrib/file/doc/file.man b/contrib/file/doc/file.man index 05bf9e71d9..1215e69e16 100644 --- a/contrib/file/doc/file.man +++ b/contrib/file/doc/file.man @@ -1,5 +1,5 @@ -.\" $File: file.man,v 1.66 2007/10/23 19:58:59 christos Exp $ -.Dd January 8, 2007 +.\" $File: file.man,v 1.79 2008/11/06 22:49:08 rrt Exp $ +.Dd October 9, 2008 .Dt FILE __CSECTION__ .Os .Sh NAME @@ -8,8 +8,8 @@ .Sh SYNOPSIS .Nm .Op Fl bchikLnNprsvz -.Op Fl mime-type -.Op Fl mime-encoding +.Op Fl -mime-type +.Op Fl -mime-encoding .Op Fl f Ar namefile .Op Fl F Ar separator .Op Fl m Ar magicfiles @@ -17,6 +17,8 @@ .Nm .Fl C .Op Fl m Ar magicfile +.Nm +.Op Fl -help .Sh DESCRIPTION This manual page documents version __VERSION__ of the .Nm @@ -25,7 +27,7 @@ command. .Nm tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: -filesystem tests, magic number tests, and language tests. +filesystem tests, magic tests, and language tests. The .Em first test that succeeds causes the file type to be printed. @@ -39,34 +41,26 @@ characters and is probably safe to read on an terminal), .Em executable (the file contains the result of compiling a program -in a form understandable to some +in a form understandable to some .Dv UNIX kernel or another), or .Em data -meaning anything else (data is usually +meaning anything else (data is usually .Sq binary or non-printable). Exceptions are well-known file formats (core files, tar archives) that are known to contain binary data. -When modifying the file -.Pa __MAGIC__ -or the program itself, make sure to +When modifying magic files or the program itself, make sure to .Em "preserve these keywords" . -People depend on knowing that all the readable files in a directory -have the word -.Dq text +Users depend on knowing that all the readable files in a directory +have the word +.Sq text printed. -Don't do as Berkeley did and change -.Dq shell commands text -to -.Dq shell script . -Note that the file -.Pa __MAGIC__ -is built mechanically from a large number of small files in -the subdirectory -.Pa Magdir -in the source distribution of this program. +Don't do as Berkeley did and change +.Sq shell commands text +to +.Sq shell script . .Pp The filesystem tests are based on examining the return from a .Xr stat 2 @@ -80,39 +74,37 @@ are intuited if they are defined in the system header file .In sys/stat.h . .Pp -The magic number tests are used to check for files with data in +The magic tests are used to check for files with data in particular fixed formats. The canonical example of this is a binary executable (compiled program) .Dv a.out -file, whose format is defined in +file, whose format is defined in .In elf.h , .In a.out.h and possibly .In exec.h in the standard include directory. -These files have a +These files have a .Sq "magic number" stored in a particular place -near the beginning of the file that tells the +near the beginning of the file that tells the .Dv UNIX operating system that the file is a binary executable, and which of several types thereof. The concept of a -.Sq "magic number" +.Sq "magic" has been applied by extension to data files. Any file with some invariant identifier at a small fixed offset into the file can usually be described in this way. The information identifying these files is read from the compiled magic file .Pa __MAGIC__.mgc , -or +or the files in the directory .Pa __MAGIC__ -if the compile file does not exist. In addition -.Nm -will look in -.Pa $HOME/.magic.mgc , +if the compiled file does not exist. In addition, if +.Pa $HOME/.magic.mgc or .Pa $HOME/.magic -for magic entries. +exists, it will be used in preference to the system magic files. .Pp If a file does not match any of the entries in the magic file, it is examined to see if it seems to be a text file. @@ -124,11 +116,11 @@ ranges and sequences of bytes that constitute printable text in each set. If a file passes any of these tests, its character set is reported. ASCII, ISO-8859-x, UTF-8, and extended-ASCII files are identified -as -.Dq text +as +.Sq text because they will be mostly readable on nearly any terminal; -UTF-16 and EBCDIC are only -.Dq character data +UTF-16 and EBCDIC are only +.Sq character data because, while they contain text, it is text that will require translation before it can be read. @@ -145,25 +137,26 @@ Once has determined the character set used in a text-type file, it will attempt to determine in what language the file is written. -The language tests look for particular strings (cf +The language tests look for particular strings (cf. .In names.h -that can appear anywhere in the first few blocks of a file. +) that can appear anywhere in the first few blocks of a file. For example, the keyword .Em .br indicates that the file is most likely a .Xr troff 1 -input file, just as the keyword +input file, just as the keyword .Em struct indicates a C program. These tests are less reliable than the previous two groups, so they are performed last. The language test routines also test for some miscellany -(such as +(such as .Xr tar 1 archives). .Pp Any file that cannot be identified as having been written -in any of the character sets listed above is simply said to be ``data''. +in any of the character sets listed above is simply said to be +.Sq data . .Sh OPTIONS .Bl -tag -width indent .It Fl b , -brief @@ -176,7 +169,7 @@ flag to debug a new magic file before installing it. .It Fl C , -compile Write a .Pa magic.mgc -output file that contains a pre-parsed version of the magic file. +output file that contains a pre-parsed version of the magic file or directory. .It Fl e , -exclude Ar testname Exclude the test named in .Ar testname @@ -184,40 +177,41 @@ from the list of tests made to determine the file type. Valid test names are: .Bl -tag -width .It apptype -Check for .Dv EMX application type (only on EMX). -.It ascii -Check for various types of ascii files. +.It text +Various types of text files (this test will try to guess the text encoding, irrespective of the setting of the +.Sq encoding +option). +.It encoding +Different text encodings for soft magic tests. +.It tokens +Looks for known tokens inside text files. +.It cdf +Prints details of Compound Document Files. .It compress -Don't look for, or inside compressed files. +Checks for, and looks inside, compressed files. .It elf -Don't print elf details. -.It fortran -Don't look for fortran sequences inside ascii files. +Prints ELF file details. .It soft -Don't consult magic files. +Consults magic files. .It tar -Don't examine tar files. -.It token -Don't look for known tokens inside ascii files. -.It troff -Don't look for troff sequences inside ascii files. +Examines tar files. .El .It Fl f , -files-from Ar namefile -Read the names of the files to be examined from +Read the names of the files to be examined from .Ar namefile -(one per line) +(one per line) before the argument list. -Either +Either .Ar namefile or at least one filename argument must be present; -to test the standard input, use +to test the standard input, use .Sq - as a filename argument. .It Fl F , -separator Ar separator Use the specified string as the separator between the filename and the -file result returned. Defaults to +file result returned. Defaults to .Sq \&: . .It Fl h , -no-dereference option causes symlinks not to be followed @@ -228,23 +222,27 @@ is not defined. .It Fl i , -mime Causes the file command to output mime type strings rather than the more traditional human readable ones. Thus it may say -.Dq text/plain charset=us-ascii +.Sq text/plain; charset=us-ascii rather than -.Dq ASCII text . +.Sq ASCII text . In order for this option to work, file changes the way it handles files recognized by the command itself (such as many of the text file types, directories etc), and makes use of an alternative -.Dq magic +.Sq magic file. -(See -.Dq FILES -section, below). -.It Fl -mime-type , -mime-encoding +(See the FILES section, below). +.It Fl -mime-type , -mime-encoding Like .Fl i , but print only the specified element(s). .It Fl k , -keep-going -Don't stop at the first match, keep going. +Don't stop at the first match, keep going. Subsequent matches will be +have the string +.Sq "\[rs]012\- " +prepended. +(If you want a newline, see the +.Sq "\-r" +option.) .It Fl L , -dereference option causes symlinks to be followed, as the like-named option in .Xr ls 1 @@ -253,16 +251,9 @@ This is the default if the environment variable .Dv POSIXLY_CORRECT is defined. .It Fl m , -magic-file Ar list -Specify an alternate list of files containing magic numbers. -This can be a single file, or a colon-separated list of files. -If a compiled magic file is found alongside, it will be used instead. -With the -.Fl i -or -.Fl "mime" -option, the program adds -.Dq .mime -to each file name. +Specify an alternate list of files and directories containing magic. +This can be a single item, or a colon-separated list. +If a compiled magic file is found alongside a file or directory, it will be used instead. .It Fl n , -no-buffer Force stdout to be flushed after checking each file. This is only useful if checking a list of files. @@ -316,38 +307,27 @@ the output. This does not affect the separator which is still printed. Print a help message and exit. .El .Sh FILES -.Bl -tag -width __MAGIC__.mime.mgc -compact +.Bl -tag -width __MAGIC__.mgc -compact .It Pa __MAGIC__.mgc -Default compiled list of magic numbers +Default compiled list of magic. .It Pa __MAGIC__ -Default list of magic numbers -.It Pa __MAGIC__.mime.mgc -Default compiled list of magic numbers, used to output mime types when -the -.Fl i -option is specified. -.It Pa __MAGIC__.mime -Default list of magic numbers, used to output mime types when the -.Fl i -option is specified. +Directory containing default magic files. .El .Sh ENVIRONMENT The environment variable .Dv MAGIC -can be used to set the default magic number file name. +can be used to set the default magic file name. If that variable is set, then .Nm will not attempt to open .Pa $HOME/.magic . .Nm adds -.Dq .mime -and/or -.Dq .mgc +.Sq .mgc to the value of this variable as appropriate. The environment variable .Dv POSIXLY_CORRECT -controls (on systems that support symbolic links), if +controls (on systems that support symbolic links), whether .Nm will attempt to follow symlinks or not. If set, then .Nm @@ -361,51 +341,52 @@ options. .Xr magic __FSECTION__ , .Xr strings 1 , .Xr od 1 , -.Xr hexdump 1 +.Xr hexdump 1, +.Xr file 1posix .Sh STANDARDS CONFORMANCE This program is believed to exceed the System V Interface Definition of FILE(CMD), as near as one can determine from the vague language -contained therein. +contained therein. Its behavior is mostly compatible with the System V program of the same name. This version knows more magic, however, so it will produce -different (albeit more accurate) output in many cases. +different (albeit more accurate) output in many cases. .\" URL: http://www.opengroup.org/onlinepubs/009695399/utilities/file.html .Pp -The one significant difference +The one significant difference between this version and System V is that this version treats any white space as a delimiter, so that spaces in pattern strings must be escaped. For example, -.Bd -literal -offset indent +.Bd -literal -offset indent >10 string language impress\ (imPRESS data) .Ed .Pp in an existing magic file would have to be changed to -.Bd -literal -offset indent +.Bd -literal -offset indent >10 string language\e impress (imPRESS data) .Ed .Pp In addition, in this version, if a pattern string contains a backslash, it must be escaped. For example -.Bd -literal -offset indent +.Bd -literal -offset indent 0 string \ebegindata Andrew Toolkit document .Ed .Pp in an existing magic file would have to be changed to -.Bd -literal -offset indent +.Bd -literal -offset indent 0 string \e\ebegindata Andrew Toolkit document .Ed .Pp SunOS releases 3.2 and later from Sun Microsystems include a -.Nm +.Nm command derived from the System V one, but with some extensions. My version differs from Sun's only in minor ways. -It includes the extension of the +It includes the extension of the .Sq & operator, used as, for example, -.Bd -literal -offset indent +.Bd -literal -offset indent >16 long&0x7fffffff >0 not stripped .Ed .Sh MAGIC DIRECTORY @@ -413,7 +394,7 @@ The magic file entries have been collected from various sources, mainly USENET, and contributed by various authors. Christos Zoulas (address below) will collect additional or corrected magic file entries. -A consolidation of magic file entries +A consolidation of magic file entries will be distributed periodically. .Pp The order of entries in the magic file is significant. @@ -423,14 +404,14 @@ If your old .Nm command uses a magic file, keep the old magic file around for comparison purposes -(rename it to +(rename it to .Pa __MAGIC__.orig ). .Sh EXAMPLES -.Bd -literal -offset indent +.Bd -literal -offset indent $ file file.c file /dev/{wd0a,hda} file.c: C program text file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), - dynamically linked (uses shared libs), stripped + dynamically linked (uses shared libs), stripped /dev/wd0a: block special (0/0) /dev/hda: block special (3/0) @@ -459,13 +440,13 @@ file: application/x-executable .Ed .Sh HISTORY -There has been a -.Nm -command in every +There has been a +.Nm +command in every .Dv UNIX since at least Research Version 4 (man page dated November, 1973). The System V version introduced one significant major change: -the external list of magic number types. +the external list of magic types. This slowed the program down slightly but made it a lot more flexible. .Pp This program, based on the System V version, @@ -484,19 +465,25 @@ Primary development and maintenance from 1990 to the present by Christos Zoulas (christos@astron.com). .Pp Altered by Chris Lowth, chris@lowth.com, 2000: -Handle the +Handle the .Fl i -option to output mime type strings and using an alternative +option to output mime type strings, using an alternative magic file and internal logic. .Pp Altered by Eric Fischer (enf@pobox.com), July, 2000, to identify character codes and attempt to identify the languages of non-ASCII files. .Pp -The list of contributors to the "Magdir" directory (source for the -.Pa __MAGIC__ -file) is too long to include here. +Altered by Reuben Thomas (rrt@sc3d.org), 2007 to 2008, to improve MIME +support and merge MIME and non-MIME magic, support directories as well +as files of magic, apply many bug fixes and improve the build system. +.Pp +The list of contributors to the +.Sq magic +directory (magic files) +is too long to include here. You know who you are; thank you. +Many contributors are listed in the source files. .Sh LEGAL NOTICE Copyright (c) Ian F. Darwin, Toronto, Canada, 1986-1999. Covered by the standard Berkeley Software Distribution copyright; see the file @@ -510,17 +497,10 @@ were written by John Gilmore from his public-domain .Xr tar 1 program, and are not covered by the above license. .Sh BUGS +.Pp There must be a better way to automate the construction of the Magic file from all the glop in Magdir. What is it? -.\" Compilation support has been done -.\" Better yet, the magic file should be compiled into binary (say, -.\" .Xr ndbm 3 -.\" or, better yet, fixed-length -.\" .Dv ASCII -.\" strings for use in heterogenous network environments) for faster startup. -.\" Then the program would run as fast as the Version 7 program of the same -.\" name, with the flexibility of the System V version. .Pp .Nm uses several algorithms that favor speed over accuracy, @@ -530,67 +510,37 @@ files. .Pp The support for text files (primarily for programming languages) is simplistic, inefficient and requires recompilation to update. -.\" Else support has been done -.\" There should be an -.\" .Dv else -.\" clause to follow a series of continuation lines. -.\" .Pp -.\" Regular expression support has been done -.\" The magic file and keywords should have regular expression support. -Their use of -.Dv ASCII TAB -as a field delimiter is ugly and makes -it hard to edit the files, but is entrenched. .Pp -It might be advisable to allow upper-case letters in keywords -for e.g., -.Xr troff 1 -commands vs man page macros. -Regular expression support would make this easy. -.Pp -The program doesn't grok -.Dv FORTRAN . -It should be able to figure -.Dv FORTRAN -by seeing some keywords which -appear indented at the start of line. -Regular expression support would make this easy. -.Pp -The list of keywords in +The list of keywords in .Dv ascmagic probably belongs in the Magic file. -This could be done by using some keyword like +This could be done by using some keyword like .Sq * for the offset value. .Pp -.\" Sorting has been done. -.\" Another optimization would be to sort -.\" the magic file so that we can just run down all the -.\" tests for the first byte, first word, first long, etc, once we -.\" have fetched it. Complain about conflicts in the magic file entries. Make a rule that the magic entries sort based on file offset rather than position within the magic file? .Pp -The program should provide a way to give an estimate -of -.Dq how good +The program should provide a way to give an estimate +of +.Sq how good a guess is. -We end up removing guesses (e.g. -.Dq From\ +We end up removing guesses (e.g. +.Sq From\ as first 5 chars of file) because -they are not as good as other guesses (e.g. -.Dq Newsgroups: +they are not as good as other guesses (e.g. +.Sq Newsgroups: versus -.Dq Return-Path: +.Sq Return-Path: ). Still, if the others don't pan out, it should be possible to use the -first guess. -.Pp -This program is slower than some vendors' file commands. -The new support for multiple character codes makes it even slower. +first guess. .Pp This manual page, and particularly this section, is too long. +.Sh RETURN CODE +.Nm +returns 0 on success, and non-zero on error. .Sh AVAILABILITY You can obtain the original author's latest version by anonymous FTP on diff --git a/contrib/file/doc/libmagic.man b/contrib/file/doc/libmagic.man index 61e8f27e3d..e39a61053c 100644 --- a/contrib/file/doc/libmagic.man +++ b/contrib/file/doc/libmagic.man @@ -1,3 +1,4 @@ +.\" $File: libmagic.man,v 1.19 2008/10/06 20:16:04 christos Exp $ .\" .\" Copyright (c) Christos Zoulas 2003. .\" All Rights Reserved. @@ -24,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd November 15, 2006 +.Dd October 6, 2008 .Dt MAGIC 3 .Os .Sh NAME @@ -164,7 +165,7 @@ bytes size. .Pp The .Fn magic_setflags -function, sets the +function sets the .Ar flags described above. Note that using both MIME flags together can also return extra information on the charset. @@ -185,7 +186,9 @@ separated list of database files passed in as or NULL for the default database. It returns 0 on success and -1 on failure. The compiled files created are named from the .Xr basename 1 -of each file argument with ".mgc" appended to it. +of each file argument with +.Dq .mgc +appended to it. .Pp The .Fn magic_load @@ -197,9 +200,10 @@ before any magic queries can performed. .Pp The default database file is named by the MAGIC environment variable. If that variable is not set, the default database file name is __MAGIC__. -.Pp .Fn magic_load -adds ".mime" and/or ".mgc" to the database filename as appropriate. +adds +.Dq .mgc +to the database filename as appropriate. .Sh RETURN VALUES The function .Fn magic_open @@ -230,11 +234,7 @@ when .Dv MAGIC_PRESERVE_ATIME is set. .Sh FILES -.Bl -tag -width __MAGIC__.mime.mgc -compact -.It Pa __MAGIC__.mime -The non-compiled default magic mime database. -.It Pa __MAGIC__.mime.mgc -The compiled default magic mime database. +.Bl -tag -width __MAGIC__.mgc -compact .It Pa __MAGIC__ The non-compiled default magic database. .It Pa __MAGIC__.mgc diff --git a/contrib/file/doc/magic.man b/contrib/file/doc/magic.man index 3842b6481c..fb334bc9cf 100644 --- a/contrib/file/doc/magic.man +++ b/contrib/file/doc/magic.man @@ -1,11 +1,11 @@ -.\" $File: magic.man,v 1.39 2007/11/08 00:31:37 christos Exp $ -.Dd January 10, 2007 +.\" $File: magic.man,v 1.59 2008/11/06 23:22:53 christos Exp $ +.Dd August 30, 2008 .Dt MAGIC __FSECTION__ .Os -.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems. +.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. .Sh NAME .Nm magic -.Nd file command's magic number file +.Nd file command's magic pattern file .Sh DESCRIPTION This manual page documents the format of the magic file as used by the @@ -15,18 +15,17 @@ The .Xr file __CSECTION__ command identifies the type of a file using, among other tests, -a test for whether the file begins with a certain -.Dq "magic number" . +a test for whether the file contains certain +.Dq "magic patterns" . The file .Pa __MAGIC__ -specifies what magic numbers are to be tested for, -what message to print if a particular magic number is found, +specifies what patterns are to be tested for, what message or +MIME type to print if a particular pattern is found, and additional information to extract from the file. .Pp Each line of the file specifies a test to be performed. A test compares the data starting at a particular offset -in the file with a 1-byte, 2-byte, or 4-byte numeric value or -a string. +in the file with a byte value, a string or a numeric value. If the test succeeds, a message is printed. The line consists of the following fields: .Bl -tag -width ".Dv message" @@ -40,15 +39,15 @@ The possible values are: .It Dv byte A one-byte value. .It Dv short -A two-byte value (on most systems) in this machine's native byte order. +A two-byte value in this machine's native byte order. .It Dv long -A four-byte value (on most systems) in this machine's native byte order. +A four-byte value in this machine's native byte order. .It Dv quad -An eight-byte value (on most systems) in this machine's native byte order. +An eight-byte value in this machine's native byte order. .It Dv float -A 32-bit (on most systems) single precision IEEE floating point number in this machine's native byte order. +A 32-bit single precision IEEE floating point number in this machine's native byte order. .It Dv double -A 64-bit (on most systems) double precision IEEE floating point number in this machine's native byte order. +A 64-bit double precision IEEE floating point number in this machine's native byte order. .It Dv string A string of bytes. The string type specification can be optionally followed @@ -69,10 +68,10 @@ Finally the .Dq c flag, specifies case insensitive matching: lowercase characters in the magic match both lower and upper case characters in the -targer, whereas upper case characters in the magic, only much uppercase +target, whereas upper case characters in the magic only match uppercase characters in the target. .It Dv pstring -A pascal style string where the first byte is interpreted as the an +A Pascal-style string where the first byte is interpreted as the an unsigned length. The string is not NUL terminated. .It Dv date @@ -85,107 +84,126 @@ local time rather than UTC. .It Dv qldate An eight-byte value interpreted as a UNIX-style date, but interpreted as local time rather than UTC. +.It Dv beid3 +A 32-bit ID3 length in big-endian byte order. .It Dv beshort -A two-byte value (on most systems) in big-endian byte order. +A two-byte value in big-endian byte order. .It Dv belong -A four-byte value (on most systems) in big-endian byte order. +A four-byte value in big-endian byte order. .It Dv bequad -An eight-byte value (on most systems) in big-endian byte order. +An eight-byte value in big-endian byte order. .It Dv befloat -A 32-bit (on most systems) single precision IEEE floating point number in big-endian byte order. +A 32-bit single precision IEEE floating point number in big-endian byte order. .It Dv bedouble -A 64-bit (on most systems) double precision IEEE floating point number in big-endian byte order. +A 64-bit double precision IEEE floating point number in big-endian byte order. .It Dv bedate -A four-byte value (on most systems) in big-endian byte order, +A four-byte value in big-endian byte order, interpreted as a Unix date. .It Dv beqdate -An eight-byte value (on most systems) in big-endian byte order, +An eight-byte value in big-endian byte order, interpreted as a Unix date. .It Dv beldate -A four-byte value (on most systems) in big-endian byte order, +A four-byte value in big-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv beqldate -An eight-byte value (on most systems) in big-endian byte order, +An eight-byte value in big-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv bestring16 A two-byte unicode (UCS16) string in big-endian byte order. +.It Dv leid3 +A 32-bit ID3 length in little-endian byte order. .It Dv leshort -A two-byte value (on most systems) in little-endian byte order. +A two-byte value in little-endian byte order. .It Dv lelong -A four-byte value (on most systems) in little-endian byte order. +A four-byte value in little-endian byte order. .It Dv lequad -An eight-byte value (on most systems) in little-endian byte order. +An eight-byte value in little-endian byte order. .It Dv lefloat -A 32-bit (on most systems) single precision IEEE floating point number in little-endian byte order. +A 32-bit single precision IEEE floating point number in little-endian byte order. .It Dv ledouble -A 64-bit (on most systems) double precision IEEE floating point number in little-endian byte order. +A 64-bit double precision IEEE floating point number in little-endian byte order. .It Dv ledate -A four-byte value (on most systems) in little-endian byte order, +A four-byte value in little-endian byte order, interpreted as a UNIX date. .It Dv leqdate -An eight-byte value (on most systems) in little-endian byte order, +An eight-byte value in little-endian byte order, interpreted as a UNIX date. .It Dv leldate -A four-byte value (on most systems) in little-endian byte order, +A four-byte value in little-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv leqldate -An eight-byte value (on most systems) in little-endian byte order, +An eight-byte value in little-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv lestring16 A two-byte unicode (UCS16) string in little-endian byte order. .It Dv melong -A four-byte value (on most systems) in middle-endian (PDP-11) byte order. +A four-byte value in middle-endian (PDP-11) byte order. .It Dv medate -A four-byte value (on most systems) in middle-endian (PDP-11) byte order, +A four-byte value in middle-endian (PDP-11) byte order, interpreted as a UNIX date. .It Dv meldate -A four-byte value (on most systems) in middle-endian (PDP-11) byte order, +A four-byte value in middle-endian (PDP-11) byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. +.It Dv indirect +Starting at the given offset, consult the magic database again. .It Dv regex A regular expression match in extended POSIX regular expression syntax -(much like egrep). -The type specification can be optionally followed by /[cse]*. +(like egrep). Regular expressions can take exponential time to +process, and their performance is hard to predict, so their use is +discouraged. When used in production environments, their performance +should be carefully checked. The type specification can be optionally +followed by +.Dv /[c][s] . The .Dq c flag makes the match case insensitive, while the .Dq s -or -.Dq e -flags update the offset to the starting or ending offsets of the -match (only one should be used). -By default, regex does not update the offset. -The regular expression is always tested against the first -.Dv N -lines, where +flag update the offset to the start offset of the match, rather than the end. +The regular expression is tested against line +.Dv N + 1 +onwards, where .Dv N -is the given offset, thus it -is only useful for (single-byte encoded) text. +is the given offset. +Line endings are assumed to be in the machine's native format. .Dv ^ and .Dv $ -will match the beginning and end of individual lines, respectively, +match the beginning and end of individual lines, respectively, not beginning and end of file. .It Dv search -A literal string search starting at the given offset. -It must be followed by -.Dv \*[Lt]number\*[Gt] -which specifies how many matches shall be attempted (the range). -This is suitable for searching larger binary expressions with variable -offsets, using +A literal string search starting at the given offset. The same +modifier flags can be used as for string patterns. The modifier flags +(if any) must be followed by +.Dv /number +the range, that is, the number of positions at which the match will be +attempted, starting from the start offset. This is suitable for +searching larger binary expressions with variable offsets, using .Dv \e -escapes for special characters. +escapes for special characters. The offset works as for regex. .It Dv default -This is intended to be used with the text -.Dv x +This is intended to be used with the test +.Em x (which is always true) and a message that is to be used if there are no other matches. .El -.El +.Pp +Each top-level magic pattern (see below for an explanation of levels) +is classified as text or binary according to the types used. Types +.Dq regex +and +.Dq search +are classified as text tests, unless non-printable characters are used +in the pattern. All other tests are classified as binary. A top-level +pattern is considered to be a test text when all its patterns are text +patterns; otherwise, it is considered to be a binary pattern. When +matching a file, binary patterns are tried first; if no match is +found, and the file looks like text, then its encoding is determined +and the text patterns are tried. .Pp The numeric types may optionally be followed by .Dv \*[Am] @@ -195,7 +213,6 @@ numeric value before any comparisons are done. Prepending a .Dv u to the type indicates that ordered comparisons should be unsigned. -.Bl -tag -width ".Dv message" .It Dv test The value to be compared with the value from the file. If the type is @@ -232,12 +249,8 @@ Operators and .Dv ~ don't work with floats and doubles. -For all tests except -.Em string -and -.Em regex , -operation -.Dv ! +The operator +.Dv !\& specifies that the line matches if the test does .Em not succeed. @@ -250,8 +263,8 @@ is octal, and .Dv 0x13 is hexadecimal. .Pp -For string values, the byte string from the -file must match the specified byte string. +For string values, the string from the +file must match the specified string. The operators .Dv = , .Dv \*[Lt] @@ -262,10 +275,10 @@ and can be applied to strings. The length used for matching is that of the string argument in the magic file. -This means that a line can match any string, and -then presumably print that string, by doing +This means that a line can match any non-empty string (usually used to +then print the string), with .Em \*[Gt]\e0 -(because all strings are greater than the null string). +(because all non-empty strings are greater than the empty string). .Pp The special test .Em x @@ -276,11 +289,49 @@ If the string contains a .Xr printf 3 format specification, the value from the file (with any specified masking performed) is printed using the message as the format string. -If the string begins with ``\\b'', the message printed is the -remainder of the string with no whitespace added before it: multiple -matches are normally separated by a single space. +If the string begins with +.Dq \eb , +the message printed is the remainder of the string with no whitespace +added before it: multiple matches are normally separated by a single +space. .El .Pp +An APPLE 4+4 character APPLE creator and type can be specified as: +.Bd -literal -offset indent +!:apple CREATYPE +.Ed +.Pp +A MIME type is given on a separate line, which must be the next +non-blank or comment line after the magic line that identifies the +file type, and has the following format: +.Bd -literal -offset indent +!:mime MIMETYPE +.Ed +.Pp +i.e. the literal string +.Dq !:mime +followed by the MIME type. +.Pp +An optional strength can be supplied on a separate line which refers to +the current magic description using the following format: +.Bd -literal -offset indent +!:strength OP VALUE +.Ed +.Pp +The operand +.Dv OP +can be: +.Dv + , +.Dv - , +.Dv * , +or +.Dv / +and +.Dv VALUE +is a constant between 0 and 255. +This constant is applied using the specified operand +to the currently computed default magic strength. +.Pp Some file formats contain additional information which is to be printed along with the file type or need additional tests to determine the true file type. @@ -321,12 +372,12 @@ the file. The value at that offset is read, and is used again as an offset in the file. Indirect offsets are of the form: -.Em (( x [.[bslBSL]][+\-][ y ]) . +.Em (( x [.[bislBISL]][+\-][ y ]) . The value of .Em x is used as an offset in the file. -A byte, short or long is read at that offset depending on the -.Em [bslBSLm] +A byte, id3 length, short or long is read at that offset depending on the +.Em [bislBISLm] type specifier. The capitalized types interpret the number as a big endian value, whereas the small letter versions interpret the number as a little @@ -350,13 +401,13 @@ That way variable length structures can be examined: \*[Gt]\*[Gt](0x3c.l) string LX\e0\e0 LX executable (OS/2) .Ed .Pp -This strategy of examining has one drawback: You must make sure that +This strategy of examining has a drawback: You must make sure that you eventually print something, or users may get empty output (like, when there is neither PE\e0\e0 nor LE\e0\e0 in the above example) .Pp -If this indirect offset cannot be used as-is, there are simple calculations +If this indirect offset cannot be used directly, simple calculations are possible: appending -.Em [+-*/%\*[Am]|^]\*[Lt]number\*[Gt] +.Em [+-*/%\*[Am]|^]number inside parentheses allows one to modify the value read from the file before it is used as an offset: .Bd -literal -offset indent @@ -468,4 +519,3 @@ a system on which the lengths are invariant. .\" the changes I posted to the S5R2 version. .\" .\" Modified for Ian Darwin's version of the file command. -.\" @(#)$Id: magic.man,v 1.39 2007/11/08 00:31:37 christos Exp $ diff --git a/contrib/file/magic/Magdir/adventure b/contrib/file/magic/Magdir/adventure index 405d3cc41e..7b30c49614 100644 --- a/contrib/file/magic/Magdir/adventure +++ b/contrib/file/magic/Magdir/adventure @@ -73,3 +73,13 @@ >10 belong 0x0A0D1A00 >>14 string >\0 %s saved game data +# Danny Milosavljevic +# this are adrift (adventure game standard) game files, extension .taf +# depending on version magic continues with 0x93453E6139FA (V 4.0) +# 0x9445376139FA (V 3.90) +# 0x9445366139FA (V 3.80) +# this is from source (http://www.adrift.org.uk/) and I have some taf +# files, and checked them. +#0 belong 0x3C423FC9 +#>4 belong 0x6A87C2CF Adrift game file +#!:mime application/x-adrift diff --git a/contrib/file/magic/Magdir/animation b/contrib/file/magic/Magdir/animation index 6392f85088..46b23ecd50 100644 --- a/contrib/file/magic/Magdir/animation +++ b/contrib/file/magic/Magdir/animation @@ -8,57 +8,78 @@ # SGI and Apple formats 0 string MOVI Silicon Graphics movie file +!:mime video/x-sgi-movie 4 string moov Apple QuickTime +!:mime video/quicktime >12 string mvhd \b movie (fast start) >12 string mdra \b URL >12 string cmov \b movie (fast start, compressed header) >12 string rmra \b multiple URLs 4 string mdat Apple QuickTime movie (unoptimized) -4 string wide Apple QuickTime movie (unoptimized) -4 string skip Apple QuickTime movie (modified) -4 string free Apple QuickTime movie (modified) +!:mime video/quicktime +#4 string wide Apple QuickTime movie (unoptimized) +#!:mime video/quicktime +#4 string skip Apple QuickTime movie (modified) +#!:mime video/quicktime +#4 string free Apple QuickTime movie (modified) +#!:mime video/quicktime 4 string idsc Apple QuickTime image (fast start) -4 string idat Apple QuickTime image (unoptimized) +!:mime image/x-quicktime +#4 string idat Apple QuickTime image (unoptimized) +#!:mime image/x-quicktime 4 string pckg Apple QuickTime compressed archive +!:mime application/x-quicktime-player 4 string/B jP JPEG 2000 image +!:mime image/jp2 4 string ftyp ISO Media >8 string isom \b, MPEG v4 system, version 1 +!:mime video/mp4 >8 string iso2 \b, MPEG v4 system, part 12 revision >8 string mp41 \b, MPEG v4 system, version 1 +!:mime video/mp4 >8 string mp42 \b, MPEG v4 system, version 2 +!:mime video/mp4 >8 string mp7t \b, MPEG v4 system, MPEG v7 XML >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML >8 string/B jp2 \b, JPEG 2000 +!:mime image/jp2 >8 string 3gp \b, MPEG v4 system, 3GPP +!:mime video/3gpp >>11 byte 4 \b v4 (H.263/AMR GSM 6.10) >>11 byte 5 \b v5 (H.263/AMR GSM 6.10) >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile +!:mime video/mp4 >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC +!:mime video/3gpp >8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC +!:mime audio/mp4 +>8 string/B M4V \b, MPEG v4 system, iTunes AVC-LC +!:mime video/mp4 >8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted >8 string/B M4B \b, MPEG v4 system, iTunes bookmarked >8 string/B qt \b, Apple QuickTime movie +!:mime video/quicktime # MPEG sequences # Scans for all common MPEG header start codes -0 belong 0x00000001 JVT NAL sequence ->4 byte&0x1F 0x07 \b, H.264 video +0 belong 0x00000001 +>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video >>5 byte 66 \b, baseline >>5 byte 77 \b, main >>5 byte 88 \b, extended >>7 byte x \b @ L %u -0 belong&0xFFFFFF00 0x00000100 MPEG sequence ->3 byte 0xBA +0 belong&0xFFFFFF00 0x00000100 +>3 byte 0xBA MPEG sequence >>4 byte &0x40 \b, v2, program multiplex >>4 byte ^0x40 \b, v1, system multiplex ->3 byte 0xBB \b, v1/2, multiplex (missing pack header) ->3 byte&0x1F 0x07 \b, H.264 video +>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) +>3 byte&0x1F 0x07 MPEG sequence, H.264 video >>4 byte 66 \b, baseline >>4 byte 77 \b, main >>4 byte 88 \b, extended >>6 byte x \b @ L %u ->3 byte 0xB0 \b, v4 +>3 byte 0xB0 MPEG sequence, v4 >>5 belong 0x000001B5 >>>9 byte &0x80 >>>>10 byte&0xF0 16 \b, video @@ -127,7 +148,7 @@ >>4 byte 251 \b, FGS @ L3 >>4 byte 252 \b, FGS @ L4 >>4 byte 253 \b, FGS @ L5 ->3 byte 0xB5 \b, v4 +>3 byte 0xB5 MPEG sequence, v4 >>4 byte &0x80 >>>5 byte&0xF0 16 \b, video (missing profile header) >>>5 byte&0xF0 32 \b, still texture (missing profile header) @@ -137,7 +158,7 @@ >>4 byte&0xF8 16 \b, still texture (missing profile header) >>4 byte&0xF8 24 \b, mesh (missing profile header) >>4 byte&0xF8 32 \b, face (missing profile header) ->3 byte 0xB3 +>3 byte 0xB3 MPEG sequence >>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video >>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video >>12 belong 0x000001B5 \b, v2, @@ -252,22 +273,39 @@ # modified to fully support MPEG ADTS # MP3, M1A -0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1 +# modified by Joerg Jenderek +# GRR the original test are too common for many DOS files +# so don't accept as MP3 until we've tested the rate +0 beshort&0xFFFE 0xFFFA # rates ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 40 kBits ->2 byte&0xF0 0x30 \b, 48 kBits ->2 byte&0xF0 0x40 \b, 56 kBits ->2 byte&0xF0 0x50 \b, 64 kBits ->2 byte&0xF0 0x60 \b, 80 kBits ->2 byte&0xF0 0x70 \b, 96 kBits ->2 byte&0xF0 0x80 \b, 112 kBits ->2 byte&0xF0 0x90 \b, 128 kBits ->2 byte&0xF0 0xA0 \b, 160 kBits ->2 byte&0xF0 0xB0 \b, 192 kBits ->2 byte&0xF0 0xC0 \b, 224 kBits ->2 byte&0xF0 0xD0 \b, 256 kBits ->2 byte&0xF0 0xE0 \b, 320 kBits +>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps +!:mime audio/mpeg # timing >2 byte&0x0C 0x00 \b, 44.1 kHz >2 byte&0x0C 0x04 \b, 48 kHz @@ -287,21 +325,22 @@ # MP2, M1A 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 +!:mime audio/mpeg # rates ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 48 kBits ->2 byte&0xF0 0x30 \b, 56 kBits ->2 byte&0xF0 0x40 \b, 64 kBits ->2 byte&0xF0 0x50 \b, 80 kBits ->2 byte&0xF0 0x60 \b, 96 kBits ->2 byte&0xF0 0x70 \b, 112 kBits ->2 byte&0xF0 0x80 \b, 128 kBits ->2 byte&0xF0 0x90 \b, 160 kBits ->2 byte&0xF0 0xA0 \b, 192 kBits ->2 byte&0xF0 0xB0 \b, 224 kBits ->2 byte&0xF0 0xC0 \b, 256 kBits ->2 byte&0xF0 0xD0 \b, 320 kBits ->2 byte&0xF0 0xE0 \b, 384 kBits +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 160 kbps +>2 byte&0xF0 0xA0 \b, 192 kbps +>2 byte&0xF0 0xB0 \b, 224 kbps +>2 byte&0xF0 0xC0 \b, 256 kbps +>2 byte&0xF0 0xD0 \b, 320 kbps +>2 byte&0xF0 0xE0 \b, 384 kbps # timing >2 byte&0x0C 0x00 \b, 44.1 kHz >2 byte&0x0C 0x04 \b, 48 kHz @@ -322,58 +361,61 @@ # MPA, M1A # updated by Joerg Jenderek # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 -0 beshort&0xFFFE 0xFFFE ->2 ubyte&0xF0 >0x0F ->>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 -# rate ->>>2 byte&0xF0 0x10 \b, 32 kBits ->>>2 byte&0xF0 0x20 \b, 64 kBits ->>>2 byte&0xF0 0x30 \b, 96 kBits ->>>2 byte&0xF0 0x40 \b, 128 kBits ->>>2 byte&0xF0 0x50 \b, 160 kBits ->>>2 byte&0xF0 0x60 \b, 192 kBits ->>>2 byte&0xF0 0x70 \b, 224 kBits ->>>2 byte&0xF0 0x80 \b, 256 kBits ->>>2 byte&0xF0 0x90 \b, 288 kBits ->>>2 byte&0xF0 0xA0 \b, 320 kBits ->>>2 byte&0xF0 0xB0 \b, 352 kBits ->>>2 byte&0xF0 0xC0 \b, 384 kBits ->>>2 byte&0xF0 0xD0 \b, 416 kBits ->>>2 byte&0xF0 0xE0 \b, 448 kBits -# timing ->>>2 byte&0x0C 0x00 \b, 44.1 kHz ->>>2 byte&0x0C 0x04 \b, 48 kHz ->>>2 byte&0x0C 0x08 \b, 32 kHz -# channels/options ->>>3 byte&0xC0 0x00 \b, Stereo ->>>3 byte&0xC0 0x40 \b, JntStereo ->>>3 byte&0xC0 0x80 \b, 2x Monaural ->>>3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) +# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries +#0 beshort&0xFFFE 0xFFFE +#>2 ubyte&0xF0 >0x0F +#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 +## rate +#>>>2 byte&0xF0 0x10 \b, 32 kbps +#>>>2 byte&0xF0 0x20 \b, 64 kbps +#>>>2 byte&0xF0 0x30 \b, 96 kbps +#>>>2 byte&0xF0 0x40 \b, 128 kbps +#>>>2 byte&0xF0 0x50 \b, 160 kbps +#>>>2 byte&0xF0 0x60 \b, 192 kbps +#>>>2 byte&0xF0 0x70 \b, 224 kbps +#>>>2 byte&0xF0 0x80 \b, 256 kbps +#>>>2 byte&0xF0 0x90 \b, 288 kbps +#>>>2 byte&0xF0 0xA0 \b, 320 kbps +#>>>2 byte&0xF0 0xB0 \b, 352 kbps +#>>>2 byte&0xF0 0xC0 \b, 384 kbps +#>>>2 byte&0xF0 0xD0 \b, 416 kbps +#>>>2 byte&0xF0 0xE0 \b, 448 kbps +## timing +#>>>2 byte&0x0C 0x00 \b, 44.1 kHz +#>>>2 byte&0x0C 0x04 \b, 48 kHz +#>>>2 byte&0x0C 0x08 \b, 32 kHz +## channels/options +#>>>3 byte&0xC0 0x00 \b, Stereo +#>>>3 byte&0xC0 0x40 \b, JntStereo +#>>>3 byte&0xC0 0x80 \b, 2x Monaural +#>>>3 byte&0xC0 0xC0 \b, Monaural +##>1 byte ^0x01 \b, Data Verify +##>2 byte &0x02 \b, Packet Pad +##>2 byte &0x01 \b, Custom Flag +##>3 byte &0x08 \b, Copyrighted +##>3 byte &0x04 \b, Original Source +##>3 byte&0x03 1 \b, NR: 50/15 ms +##>3 byte&0x03 3 \b, NR: CCIT J.17 # MP3, M2A 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 +!:mime audio/mpeg # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -394,20 +436,20 @@ # MP2, M2A 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -428,20 +470,20 @@ # MPA, M2A 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 # rate ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 48 kBits ->2 byte&0xF0 0x30 \b, 56 kBits ->2 byte&0xF0 0x40 \b, 64 kBits ->2 byte&0xF0 0x50 \b, 80 kBits ->2 byte&0xF0 0x60 \b, 96 kBits ->2 byte&0xF0 0x70 \b, 112 kBits ->2 byte&0xF0 0x80 \b, 128 kBits ->2 byte&0xF0 0x90 \b, 144 kBits ->2 byte&0xF0 0xA0 \b, 160 kBits ->2 byte&0xF0 0xB0 \b, 176 kBits ->2 byte&0xF0 0xC0 \b, 192 kBits ->2 byte&0xF0 0xD0 \b, 224 kBits ->2 byte&0xF0 0xE0 \b, 256 kBits +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 144 kbps +>2 byte&0xF0 0xA0 \b, 160 kbps +>2 byte&0xF0 0xB0 \b, 176 kbps +>2 byte&0xF0 0xC0 \b, 192 kbps +>2 byte&0xF0 0xD0 \b, 224 kbps +>2 byte&0xF0 0xE0 \b, 256 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -462,20 +504,20 @@ # MP3, M25A 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 11.025 kHz >2 byte&0x0C 0x04 \b, 12 kHz @@ -497,6 +539,7 @@ # Stored AAC streams (instead of the MP4 format) 0 string ADIF MPEG ADIF, AAC +!:mime audio/x-hx-aac-adif >4 byte &0x80 >>13 byte &0x10 \b, VBR >>13 byte ^0x10 \b, CBR @@ -521,6 +564,7 @@ # Live or stored single AAC stream (used with MPEG-2 systems) 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC +!:mime audio/x-hx-aac-adts >1 byte &0x08 \b, v2 >1 byte ^0x08 \b, v4 # profile @@ -557,6 +601,7 @@ # Live MPEG-4 audio streams (instead of RTP FlexMux) 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS +!:mime audio/x-mp4a-latm #>1 beshort&0x1FFF x \b, %u byte packet >3 byte&0xE0 0x40 >>4 byte&0x3C 0x04 \b, single stream @@ -570,22 +615,34 @@ >>4 byte&0x78 0x18 \b, 3 streams >>4 byte &0x20 \b, 4 or more streams >>4 byte &0x40 \b, 8 or more streams -0 beshort 0x4DE1 MPEG-4 LO-EP audio stream +# This magic isn't strong enough (matches plausible ISO-8859-1 text) +#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream +#!:mime audio/x-mp4a-latm + +# Summary: FLI animation format +# Created by: Daniel Quinlan +# Modified by (1): Abel Cheung (avoid over-generic detection) +4 leshort 0xAF11 +# standard FLI always has 320x200 resolution and 8 bit color +>8 leshort 320 +>>10 leshort 200 +>>>12 leshort 8 FLI animation, 320x200x8 +!:mime video/x-fli +>>>>6 leshort x \b, %d frames +# frame speed is multiple of 1/70s +>>>>16 leshort x \b, %d/70s per frame -# FLI animation format -4 leshort 0xAF11 FLI file ->6 leshort x - %d frames, ->8 leshort x width=%d pixels, ->10 leshort x height=%d pixels, ->12 leshort x depth=%d, ->16 leshort x ticks/frame=%d -# FLC animation format -4 leshort 0xAF12 FLC file ->6 leshort x - %d frames ->8 leshort x width=%d pixels, ->10 leshort x height=%d pixels, ->12 leshort x depth=%d, ->16 leshort x ticks/frame=%d +# Summary: FLC animation format +# Created by: Daniel Quinlan +# Modified by (1): Abel Cheung (avoid over-generic detection) +4 leshort 0xAF12 +# standard FLC always use 8 bit color +>12 leshort 8 FLC animation +!:mime video/x-flc +>>8 leshort x \b, %d +>>10 leshort x \bx%dx8 +>>6 uleshort x \b, %d frames +>>16 uleshort x \b, %dms per frame # DL animation format # XXX - collision with most `mips' magic @@ -599,9 +656,11 @@ # 255 (hex FF)! The DL format is really bad. # #0 byte 1 DL version 1, medium format (160x100, 4 images/screen) +#!:mime video/x-unknown #>42 byte x - %d screens, #>43 byte x %d commands #0 byte 2 DL version 2 +#!:mime video/x-unknown #>1 byte 1 - large format (320x200,1 image/screen), #>1 byte 2 - medium format (160x100,4 images/screen), #>1 byte >2 - unknown format, @@ -641,6 +700,7 @@ # MNG Video Format, 0 string \x8aMNG MNG video data, +!:mime video/x-mng >4 belong !0x0d0a1a0a CORRUPTED, >4 belong 0x0d0a1a0a >>16 belong x %ld x @@ -648,6 +708,7 @@ # JNG Video Format, 0 string \x8bJNG JNG video data, +!:mime video/x-jng >4 belong !0x0d0a1a0a CORRUPTED, >4 belong 0x0d0a1a0a >>16 belong x %ld x @@ -658,7 +719,16 @@ # VRML (Virtual Reality Modelling Language) 0 string/b #VRML\ V1.0\ ascii VRML 1 file +!:mime model/vrml 0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file +!:mime model/vrml + +# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] +# From Michel Briand +0 string \20 search/1000/cb \ # NuppelVideo used by Mythtv (*.nuv) -0 regex NuppelVideo|MythTVVideo MythTV NuppelVideo +# Note: there are two identical stanzas here differing only in the +# initial string matched. It used to be done with a regex, but we're +# trying to get rid of those. +0 string NuppelVideo MythTV NuppelVideo >12 string x v%s >20 lelong x (%d >24 lelong x \bx%d), @@ -689,3 +762,54 @@ >36 string I \binterlaced, >40 ledouble x \baspect:%.2f, >48 ledouble x \bfps:%.2f +0 string MythTV MythTV NuppelVideo +>12 string x v%s +>20 lelong x (%d +>24 lelong x \bx%d), +>36 string P \bprogressive, +>36 string I \binterlaced, +>40 ledouble x \baspect:%.2f, +>48 ledouble x \bfps:%.2f + +# MPEG file +# MPEG sequences +# FIXME: This section is from the old magic.mime file and needs integrating with the rest +0 belong 0x000001BA +>4 byte &0x40 +!:mime video/mp2p +>4 byte ^0x40 +!:mime video/mpeg +0 belong 0x000001BB +!:mime video/mpeg +0 belong 0x000001B0 +!:mime video/mp4v-es +0 belong 0x000001B5 +!:mime video/mp4v-es +0 belong 0x000001B3 +!:mime video/mpv +0 belong&0xFF5FFF1F 0x47400010 +!:mime video/mp2t +0 belong 0x00000001 +>4 byte&0x1F 0x07 +!:mime video/h264 + +# Type: Bink Video +# URL: http://wiki.multimedia.cx/index.php?title=3DBink_Container +# From: 2008-07-18 +0 string BIK Bink Video +>3 regex =[a-z] rev.%s +#>4 ulelong x size %d +>20 ulelong x \b, %d +>24 ulelong x \bx%d +>8 ulelong x \b, %d frames +>32 ulelong x at rate %d/ +>28 ulelong >1 \b%d +>40 ulelong =0 \b, no audio +>40 ulelong !0 \b, %d audio track +>>40 ulelong !1 \bs +# follow properties of the first audio track only +>>48 uleshort x %dHz +>>51 byte&0x20 0 mono +>>51 byte&0x20 !0 stereo +#>>51 byte&0x10 0 FFT +#>>51 byte&0x10 !0 DCT diff --git a/contrib/file/magic/Magdir/apple b/contrib/file/magic/Magdir/apple index 4a593ea221..669ab04dcc 100644 --- a/contrib/file/magic/Magdir/apple +++ b/contrib/file/magic/Magdir/apple @@ -1,8 +1,7 @@ - #------------------------------------------------------------------------------ # apple: file(1) magic for Apple file formats # -0 string FiLeStArTfIlEsTaRt binscii (apple ][) text +0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string NuFile NuFile archive (apple ][) data @@ -10,6 +9,23 @@ 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file +# Type: Apple Emulator 2IMG format +# From: Radek Vokal +0 string 2IMG Apple ][ 2IMG Disk Image +>4 string XGS! \b, XGS +>4 string CTKG \b, Catakig +>4 string ShIm \b, Sheppy's ImageMaker +>4 string WOOF \b, Sweet 16 +>4 string B2TR \b, Bernie ][ the Rescue +>4 string !nfc \b, ASIMOV2 +>4 string x \b, Unknown Format +>0xc byte 00 \b, DOS 3.3 sector order +>>0x10 byte 00 \b, Volume 254 +>>0x10 byte&0x7f x \b, Volume %u +>0xc byte 01 \b, ProDOS sector order +>>0x14 short x \b, %u Blocks +>0xc byte 02 \b, NIB data + # magic for Newton PDA package formats # from Ruda Moura 0 string package0 Newton package, NOS 1.x, @@ -118,11 +134,12 @@ # Nevertheless this will manage to catch a lot of images that happen # to have a solid-colored line at the bottom of the screen. -8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background -8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background -8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background -8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background -8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background +# GRR: Magic too weak +#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background +#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background +#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background +#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background +#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background # Beagle Bros. Apple Mechanic fonts diff --git a/contrib/file/magic/Magdir/archive b/contrib/file/magic/Magdir/archive index 0b3a9ba92b..b75fac0838 100644 --- a/contrib/file/magic/Magdir/archive +++ b/contrib/file/magic/Magdir/archive @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) @@ -8,7 +7,9 @@ # POSIX tar archives 257 string ustar\0 POSIX tar archive +!:mime application/x-tar # encoding: posix 257 string ustar\040\040\0 GNU tar archive +!:mime application/x-tar # encoding: gnu # cpio archives # @@ -22,7 +23,9 @@ # are defined as "short"s; I think all the new formats are # character-header formats and thus are strings, not numbers. 0 short 070707 cpio archive +!:mime application/x-cpio 0 short 0143561 byte-swapped cpio archive +!:mime application/x-cpio # encoding: swapped 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC) @@ -30,8 +33,10 @@ # Debian package (needs to go before regular portable archives) # 0 string =!\ndebian +!:mime application/x-debian-package >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package +>8 string !debian >68 string >\0 (format %s) # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only @@ -49,6 +54,7 @@ 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string = archive +!:mime application/x-archive # MIPS archive (needs to go before regular portable archives) # @@ -60,7 +66,7 @@ >19 string B and an EB hash table >22 string X -- out of date -0 string -h- Software Tools format archive text +0 search/1 -h- Software Tools format archive text # # XXX - why are there multiple thingies? Note that 0x213c6172 is @@ -79,6 +85,7 @@ # "ar" archives? # 0 string =! current ar archive +!:mime application/x-archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 @@ -121,15 +128,24 @@ # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched +!:mime application/x-arc # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000141a ARC+ archive data +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000481a HYP archive data +!:mime application/x-arc # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff @@ -435,6 +451,7 @@ # ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data +!:mime application/x-arj >5 byte x \b, v%d, >8 byte &0x04 multi-volume, >8 byte &0x10 slash-switched, @@ -487,19 +504,32 @@ # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 2 string -lh0- LHarc 1.x/ARX archive data [lh0] +!:mime application/x-lharc 2 string -lh1- LHarc 1.x/ARX archive data [lh1] +!:mime application/x-lharc 2 string -lz4- LHarc 1.x archive data [lz4] +!:mime application/x-lharc 2 string -lz5- LHarc 1.x archive data [lz5] +!:mime application/x-lharc # [never seen any but the last; -lh4- reported in comp.compression:] 2 string -lzs- LHa/LZS archive data [lzs] +!:mime application/x-lha 2 string -lh\40- LHa 2.x? archive data [lh ] +!:mime application/x-lha 2 string -lhd- LHa 2.x? archive data [lhd] +!:mime application/x-lha 2 string -lh2- LHa 2.x? archive data [lh2] +!:mime application/x-lha 2 string -lh3- LHa 2.x? archive data [lh3] +!:mime application/x-lha 2 string -lh4- LHa (2.x) archive data [lh4] +!:mime application/x-lha 2 string -lh5- LHa (2.x) archive data [lh5] +!:mime application/x-lha 2 string -lh6- LHa (2.x) archive data [lh6] +!:mime application/x-lha 2 string -lh7- LHa (2.x)/LHark archive data [lh7] +!:mime application/x-lha >20 byte x - header level %d # taken from idarc [JW] 2 string -lZ PUT archive data @@ -508,6 +538,7 @@ # RAR archiver (Greg Roelofs, newt@uchicago.edu) 0 string Rar! RAR archive data, +!:mime application/x-rar >44 byte x v%0x, >10 byte >0 flags: >>10 byte &0x01 Archive volume, @@ -532,17 +563,24 @@ # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 0 string PK\003\004 >4 byte 0x00 Zip archive data +!:mime application/zip >4 byte 0x09 Zip archive data, at least v0.9 to extract +!:mime application/zip >4 byte 0x0a Zip archive data, at least v1.0 to extract +!:mime application/zip >4 byte 0x0b Zip archive data, at least v1.1 to extract +!:mime application/zip +>0x161 string WINZIP Zip archive data, WinZIP self-extracting +!:mime application/zip >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract ->0x161 string WINZIP Zip archive data, WinZIP self-extracting - +!:mime application/zip # OpenOffice.org / KOffice / StarOffice documents +# Listed here because they ARE zip files +# # From: Abel Cheung -# Listed here because they are basically zip files +>4 byte 0x14 >>30 string mimetype # KOffice (1.2 or above) formats @@ -572,12 +610,14 @@ >>>>>69 byte !0x2e presentation >>>>>69 string .template template >>>>62 string math Math document +>>>>62 string base Database file # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # http://lists.oasis-open.org/archives/office/200505/msg00006.html >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text +!:mime application/vnd.oasis.opendocument.text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document @@ -596,6 +636,7 @@ # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data +!:mime application/x-zoo >4 byte >48 \b, v%c. >>6 byte >47 \b%c >>>7 byte >47 \b%c @@ -607,6 +648,7 @@ # Shell archives 10 string #\ This\ is\ a\ shell\ archive shell archive text +!:mime application/octet-stream # # LBR. NB: May conflict with the questionable @@ -652,6 +694,7 @@ # Felix von Leitner 0 string d8:announce BitTorrent file +!:mime application/x-bittorrent # Atari MSA archive - Teemu Hukkanen 0 beshort 0x0e0f Atari MSA archive data @@ -709,6 +752,7 @@ # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive +!:mime application/x-eet # rzip archives 0 string RZIP rzip compressed data @@ -729,12 +773,11 @@ # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file +!:mime application/vnd.symbian.install >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) - -# Pack200 Java archives, http://jcp.org/en/jsr/detail?id=200 -0 belong 0xcafed00d Pack200 Java archive +!:mime x-epoc/x-sisx-app # From "Nelson A. de Oliveira" 0 string MPQ\032 MoPaQ (MPQ) archive @@ -748,3 +791,15 @@ # .kgb 0 string KGB_arch KGB Archiver file >10 string x with compression level %.1s + +# xar (eXtensible ARchiver) archive +# From: "David Remahl" +0 string xar! xar archive +#>4 beshort x header size %d +>6 beshort x version %d, +#>8 quad x compressed TOC: %d, +#>16 quad x uncompressed TOC: %d, +>24 belong 0 no checksum +>24 belong 1 SHA-1 checksum +>24 belong 2 MD5 checksum + diff --git a/contrib/file/magic/Magdir/audio b/contrib/file/magic/Magdir/audio index 511da1dc5b..04f80eb47c 100644 --- a/contrib/file/magic/Magdir/audio +++ b/contrib/file/magic/Magdir/audio @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # audio: file(1) magic for sound formats (see also "iff") # @@ -9,12 +8,19 @@ # Sun/NeXT audio data 0 string .snd Sun/NeXT audio data: >12 belong 1 8-bit ISDN mu-law, +!:mime audio/basic >12 belong 2 8-bit linear PCM [REF-PCM], +!:mime audio/basic >12 belong 3 16-bit linear PCM, +!:mime audio/basic >12 belong 4 24-bit linear PCM, +!:mime audio/basic >12 belong 5 32-bit linear PCM, +!:mime audio/basic >12 belong 6 32-bit IEEE floating point, +!:mime audio/basic >12 belong 7 64-bit IEEE floating point, +!:mime audio/basic >12 belong 8 Fragmented sample data, >12 belong 10 DSP program, >12 belong 11 8-bit fixed point, @@ -26,6 +32,7 @@ >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-adpcm >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -39,12 +46,19 @@ # that uses little-endian encoding and has a different magic number 0 lelong 0x0064732E DEC audio data: >12 lelong 1 8-bit ISDN mu-law, +!:mime audio/x-dec-basic >12 lelong 2 8-bit linear PCM [REF-PCM], +!:mime audio/x-dec-basic >12 lelong 3 16-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 4 24-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 5 32-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 6 32-bit IEEE floating point, +!:mime audio/x-dec-basic >12 lelong 7 64-bit IEEE floating point, +!:mime audio/x-dec-basic >12 belong 8 Fragmented sample data, >12 belong 10 DSP program, >12 belong 11 8-bit fixed point, @@ -56,6 +70,7 @@ >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-dec-basic >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -67,6 +82,7 @@ # Creative Labs AUDIO stuff 0 string MThd Standard MIDI data +!:mime audio/midi >8 beshort x (format %d) >10 beshort x using %d track >10 beshort >1 \bs @@ -74,8 +90,11 @@ >12 beshort&0x8000 >0 SMPTE 0 string CTMF Creative Music (CMF) data +!:mime audio/x-unknown 0 string SBI SoundBlaster instrument data +!:mime audio/x-unknown 0 string Creative\ Voice\ File Creative Labs voice data +!:mime audio/x-unknown # is this next line right? it came this way... >19 byte 0x1A >23 byte >0 - version %d @@ -96,7 +115,13 @@ # Real Audio (Magic .ra\0375) 0 belong 0x2e7261fd RealAudio sound file +!:mime audio/x-pn-realaudio 0 string .RMF RealMedia file +!:mime application/vnd.rn-realmedia +#video/x-pn-realvideo +#video/vnd.rn-realvideo +#application/vnd.rn-realmedia +# sigh, there are many mimes for that but the above are the most common. # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] # Oct 31, 1995 @@ -119,44 +144,84 @@ 0 string GF1PATCH110\0ID#000002\0 GUS patch 0 string GF1PATCH100\0ID#000002\0 Old GUS patch +# mime types according to http://www.geocities.com/nevilo/mod.htm: +# audio/it .it +# audio/x-zipped-it .itz +# audio/xm fasttracker modules +# audio/x-s3m screamtracker modules +# audio/s3m screamtracker modules +# audio/x-zipped-mod mdz +# audio/mod mod +# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) + # # Taken from loader code from mikmod version 2.14 # by Steve McIntyre (stevem@chiark.greenend.org.uk) # added title printing on 2003-06-24 0 string MAS_UTrack_V00 >14 string >/0 ultratracker V1.%.1s module sound data +!:mime audio/x-mod +#audio/x-tracker-module 0 string UN05 MikMod UNI format module sound data 0 string Extended\ Module: Fasttracker II module sound data +!:mime audio/x-mod +#audio/x-tracker-module >17 string >\0 Title: "%s" 21 string/c =!SCREAM! Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module 21 string BMOD2STM Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module 1080 string M.K. 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module >0 string >\0 Title: "%s" 1080 string M!K! 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module >0 string >\0 Title: "%s" 1080 string FLT4 4-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module >0 string >\0 Title: "%s" 1080 string FLT8 8-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module >0 string >\0 Title: "%s" 1080 string 4CHN 4-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string 6CHN 6-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string 8CHN 8-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string CD81 8-channel Octalyser module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module >0 string >\0 Title: "%s" -1080 string OKTA 8-channel Oktalyzer module sound data +1080 string OKTA 8-channel Octalyzer module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module >0 string >\0 Title: "%s" # Not good enough. #1082 string CH #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 1080 string 16CN 16-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module >0 string >\0 Title: "%s" 1080 string 32CN 32-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module >0 string >\0 Title: "%s" # TOC sound files -Trevor Johnson @@ -208,7 +273,7 @@ >22 belong&0x00ffffff x %d Hz, >18 beshort =0 no loop, >18 beshort =-1 loop, ->21 ubyte <=127 note %d, +>21 ubyte <128 note %d, >22 byte =0 replay 5.485 KHz >22 byte =1 replay 8.084 KHz >22 byte =2 replay 10.971 Khz @@ -222,40 +287,13 @@ 0 string _SGI_SoundTrack SGI SoundTrack project file # ID3 version 2 tags 0 string ID3 Audio file with ID3 version 2 ->3 ubyte <0xff \b%d. ->4 ubyte <0xff \b%d tag ->2584 string fLaC \b, FLAC encoding ->>2588 byte&0x7f >0 \b, unknown version ->>2588 byte&0x7f 0 \b -# some common bits/sample values ->>>2600 beshort&0x1f0 0x030 \b, 4 bit ->>>2600 beshort&0x1f0 0x050 \b, 6 bit ->>>2600 beshort&0x1f0 0x070 \b, 8 bit ->>>2600 beshort&0x1f0 0x0b0 \b, 12 bit ->>>2600 beshort&0x1f0 0x0f0 \b, 16 bit ->>>2600 beshort&0x1f0 0x170 \b, 24 bit ->>>2600 byte&0xe 0x0 \b, mono ->>>2600 byte&0xe 0x2 \b, stereo ->>>2600 byte&0xe 0x4 \b, 3 channels ->>>2600 byte&0xe 0x6 \b, 4 channels ->>>2600 byte&0xe 0x8 \b, 5 channels ->>>2600 byte&0xe 0xa \b, 6 channels ->>>2600 byte&0xe 0xc \b, 7 channels ->>>2600 byte&0xe 0xe \b, 8 channels -# some common sample rates ->>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz ->>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz ->>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz ->>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz ->>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz ->>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz ->>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz ->>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz ->>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz ->>>2597 belong&0xfffff0 0x177000 \b, 96 kHz ->>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz ->>>2601 byte&0xf >0 \b, >4G samples ->2584 string !fLaC \b, MP3 encoding +>3 byte x \b.%d +>4 byte x \b.%d +>>5 byte &0x80 \b, unsynchronized frames +>>5 byte &0x40 \b, extended header +>>5 byte &0x20 \b, experimental +>>5 byte &0x10 \b, footer present +>(6.I) indirect x \b, contains: # NSF (NES sound file) magic 0 string NESM\x1a NES Sound File @@ -270,6 +308,7 @@ # Impulse tracker module (audio/x-it) 0 string IMPM Impulse Tracker module sound data - +!:mime audio/x-mod >4 string >\0 "%s" >40 leshort !0 compatible w/ITv%x >42 leshort !0 created w/ITv%x @@ -380,6 +419,7 @@ # Free lossless audio codec # From: Przemyslaw Augustyniak 0 string fLaC FLAC audio bitstream data +!:mime audio/x-flac >4 byte&0x7f >0 \b, unknown version >4 byte&0x7f 0 \b # some common bits/sample values @@ -502,9 +542,9 @@ # .preset 0 string [Equalizer\ preset] XMMS equalizer preset # .m3u -0 string #EXTM3U M3U playlist +0 search/1 #EXTM3U M3U playlist text # .pls -0 string [playlist] PLS playlist +0 search/1 [playlist] PLS playlist text # licq.conf 1 string [licq] LICQ configuration file @@ -553,9 +593,6 @@ # http://www.wx800.com/msg/download/irda/iMelody.pdf 0 string BEGIN:IMELODY iMelody Ringtone Format -# From: Matthew Flaschen -0 string #EXTM3U M3U playlist text - # From: "Mateus Caruccio" # guitar pro v3,4,5 from http://filext.com/file-extension/gp3 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature @@ -563,3 +600,7 @@ # From: "Leslie P. Polzer" 60 string SONG SoundFX Module sound file +# Type: Adaptive Multi-Rate Codec +# URL: http://filext.com/detaillist.php?extdetail=AMR +# From: Russell Coker +0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) diff --git a/contrib/file/magic/Magdir/bFLT b/contrib/file/magic/Magdir/bFLT deleted file mode 100644 index 5e288d130b..0000000000 --- a/contrib/file/magic/Magdir/bFLT +++ /dev/null @@ -1,12 +0,0 @@ -#------------------------------------------------------------------------------ -# bFLT: file(1) magic for BFLT uclinux binary files -# -# From Philippe De Muyter -# -0 string bFLT BFLT executable ->4 belong x - version %ld ->4 belong 4 ->>36 belong&0x1 0x1 ram ->>36 belong&0x2 0x2 gotpic ->>36 belong&0x4 0x4 gzip ->>36 belong&0x8 0x8 gzdata diff --git a/contrib/file/magic/Magdir/c-lang b/contrib/file/magic/Magdir/c-lang index fd3f9aa249..895e37f656 100644 --- a/contrib/file/magic/Magdir/c-lang +++ b/contrib/file/magic/Magdir/c-lang @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # c-lang: file(1) magic for C programs (or REXX) # @@ -6,11 +5,15 @@ # XPM icons (Greg Roelofs, newt@uchicago.edu) # if you uncomment "/*" for C/REXX below, also uncomment this entry #0 string /*\ XPM\ */ X pixmap image data +#!:mime image/x-xpmi + +# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' +#16 beshort 0x3d3d image/x-3ds # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs -#0 string /* C or REXX program text -#0 string // C++ program text +#0 search/1 /* C or REXX program text +#0 search/1 // C++ program text # From: Mikhail Teterin 0 string cscope cscope reference data @@ -20,5 +23,5 @@ # The inverted index functionality was added some time betwen # versions 11 and 15, so look for -q if version is above 14: >7 string >14 ->>10 regex .+\ -q\ with inverted index ->10 regex .+\ -c\ text (non-compressed) +>>10 search/100 \ -q\ with inverted index +>10 search/100 \ -c\ text (non-compressed) diff --git a/contrib/file/magic/Magdir/c64 b/contrib/file/magic/Magdir/c64 index a224b21634..f8a8b76c6b 100644 --- a/contrib/file/magic/Magdir/c64 +++ b/contrib/file/magic/Magdir/c64 @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # c64: file(1) magic for various commodore 64 related files # diff --git a/contrib/file/magic/Magdir/cafebabe b/contrib/file/magic/Magdir/cafebabe index 233411c804..e25c974dd5 100644 --- a/contrib/file/magic/Magdir/cafebabe +++ b/contrib/file/magic/Magdir/cafebabe @@ -13,9 +13,26 @@ # might add another one or two as time goes by... # 0 belong 0xcafebabe +!:mime application/x-java-applet >4 belong >30 compiled Java class data, ->>6 beshort x version %d. ->>4 beshort x \b%d +>>6 beshort x version %d. +>>4 beshort x \b%d +# Which is which? +#>>4 belong 0x032d (Java 1.0) +#>>4 belong 0x032d (Java 1.1) +>>4 belong 0x002e (Java 1.2) +>>4 belong 0x002f (Java 1.3) +>>4 belong 0x0030 (Java 1.4) +>>4 belong 0x0031 (Java 1.5) +>>4 belong 0x0032 (Java 1.6) + + +0 belong 0xcafebabe >4 belong 1 Mach-O fat file with 1 architecture >4 belong >1 >>4 belong <20 Mach-O fat file with %ld architectures + +0 belong 0xcafed00d JAR compressed with pack200, +>>5 byte x version %d. +>>4 byte x \b%d +!:mime application/x-java-pack200 diff --git a/contrib/file/magic/Magdir/cddb b/contrib/file/magic/Magdir/cddb index 2ea97eecd2..42ca416bd8 100644 --- a/contrib/file/magic/Magdir/cddb +++ b/contrib/file/magic/Magdir/cddb @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # CDDB: file(1) magic for CDDB(tm) format CD text data files # @@ -8,4 +7,4 @@ # CDDB-enabled CD player applications. # -0 string/b #\040xmcd CDDB(tm) format CD text data +0 search/1/b #\040xmcd CDDB(tm) format CD text data diff --git a/contrib/file/magic/Magdir/chi b/contrib/file/magic/Magdir/chi deleted file mode 100644 index ee450f5558..0000000000 --- a/contrib/file/magic/Magdir/chi +++ /dev/null @@ -1,7 +0,0 @@ - -#------------------------------------------------------------------------------ -# chi: file(1) magic for ChiWriter files -# -0 string \\1cw\ ChiWriter file ->5 string >\0 version %s -0 string \\1cw ChiWriter file diff --git a/contrib/file/magic/Magdir/clarion b/contrib/file/magic/Magdir/clarion new file mode 100644 index 0000000000..5f5f6e7561 --- /dev/null +++ b/contrib/file/magic/Magdir/clarion @@ -0,0 +1,26 @@ + +#------------------------------------------------------------------------------ +# clarion: file(1) magic for # Clarion Personal/Professional Developer +# (v2 and above) +# From: Julien Blache + +# Database files +# signature +0 leshort 0x3343 Clarion Developer (v2 and above) data file +# attributes +>2 leshort &0x0001 \b, locked +>2 leshort &0x0004 \b, encrypted +>2 leshort &0x0008 \b, memo file exists +>2 leshort &0x0010 \b, compressed +>2 leshort &0x0040 \b, read only +# number of records +>5 lelong x \b, %ld records + +# Memo files +0 leshort 0x334d Clarion Developer (v2 and above) memo data + +# Key/Index files +# No magic? :( + +# Help files +0 leshort 0x49e0 Clarion Developer (v2 and above) help data diff --git a/contrib/file/magic/Magdir/commands b/contrib/file/magic/Magdir/commands index 599c190a45..0942802d91 100644 --- a/contrib/file/magic/Magdir/commands +++ b/contrib/file/magic/Magdir/commands @@ -2,41 +2,62 @@ #------------------------------------------------------------------------------ # commands: file(1) magic for various shells and interpreters # -0 string : shell archive or script for antique kernel text -0 string/b #!\ /bin/sh Bourne shell script text executable +#0 string : shell archive or script for antique kernel text +0 string/b #!\ /bin/sh POSIX shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /bin/csh C shell script text executable +!:mime text/x-shellscript # korn shell magic, sent by George Wu, gwu@clyde.att.com 0 string/b #!\ /bin/ksh Korn shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /bin/tcsh Tenex C shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable +!:mime text/x-shellscript # # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable +!:mime text/x-shellscript 0 string/b #!\ /bin/nawk new awk script text executable +!:mime text/x-nawk 0 string/b #!\ /usr/bin/nawk new awk script text executable +!:mime text/x-nawk 0 string/b #!\ /usr/local/bin/nawk new awk script text executable +!:mime text/x-nawk 0 string/b #!\ /bin/gawk GNU awk script text executable +!:mime text/x-gawk 0 string/b #!\ /usr/bin/gawk GNU awk script text executable +!:mime text/x-gawk 0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable +!:mime text/x-gawk # 0 string/b #!\ /bin/awk awk script text executable +!:mime text/x-awk 0 string/b #!\ /usr/bin/awk awk script text executable +!:mime text/x-awk # update to distinguish from *.vcf files # this is broken because postscript has /EBEGIN{ for example. -#0 regex BEGIN[[:space:]]*[{] awk script text +#0 search/Bb BEGIN { awk script text # AT&T Bell Labs' Plan 9 shell 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 0 string/b #!\ /bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript 0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable +!:mime text/x-shellscript # using env 0 string #!/usr/bin/env a @@ -46,11 +67,16 @@ # PHP scripts # Ulf Harnhammar -0 string/c =2 byte&0x80 >0 block compressed >2 byte&0x1f x %d bits @@ -19,6 +21,7 @@ # * Produce shorter output - notably, only report compression methods # other than 8 ("deflate", the only method defined in RFC 1952). 0 string \037\213 gzip compressed data +!:mime application/x-gzip >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII @@ -49,25 +52,36 @@ # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 0 string \037\036 packed data +!:mime application/octet-stream >2 belong >1 \b, %d characters originally >2 belong =1 \b, %d character originally # # This magic number is byte-order-independent. 0 short 0x1f1f old packed data +!:mime application/octet-stream # XXX - why *two* entries for "compacted data", one of which is # byte-order independent, and one of which is byte-order dependent? # 0 short 0x1fff compacted data +!:mime application/octet-stream # This string is valid for SunOS (BE) and a matching "short" is listed # in the Ultrix (LE) magic file. 0 string \377\037 compacted data +!:mime application/octet-stream 0 short 0145405 huf output +!:mime application/octet-stream # bzip2 0 string BZh bzip2 compressed data +!:mime application/x-bzip2 >3 byte >47 \b, block size = %c00k +# lzip +0 string LZIP lzip compressed data +!:mime application/x-lzip +>4 byte x \b, version: %d + # squeeze and crunch # Michael Haardt 0 beshort 0x76FF squeezed data, @@ -102,17 +116,17 @@ # bzip a block-sorting file compressor # by Julian Seward and others # -0 string BZ bzip compressed data ->2 byte x \b, version: %c ->3 string =1 \b, compression block size 100k ->3 string =2 \b, compression block size 200k ->3 string =3 \b, compression block size 300k ->3 string =4 \b, compression block size 400k ->3 string =5 \b, compression block size 500k ->3 string =6 \b, compression block size 600k ->3 string =7 \b, compression block size 700k ->3 string =8 \b, compression block size 800k ->3 string =9 \b, compression block size 900k +#0 string BZ bzip compressed data +#>2 byte x \b, version: %c +#>3 string =1 \b, compression block size 100k +#>3 string =2 \b, compression block size 200k +#>3 string =3 \b, compression block size 300k +#>3 string =4 \b, compression block size 400k +#>3 string =5 \b, compression block size 500k +#>3 string =6 \b, compression block size 600k +#>3 string =7 \b, compression block size 700k +#>3 string =8 \b, compression block size 800k +#>3 string =9 \b, compression block size 900k # lzop from 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data @@ -174,6 +188,17 @@ >6 byte x version %d >7 byte x \b.%d +# Type: LZMA +# URL: http://www.7-zip.org/sdk.html +# From: Robert Millan and Reuben Thomas +# Commented out because apparently not reliable (according to Debian +# bug #364260) +#0 string ]\000\000\200\000 LZMA compressed data + +# http://tukaani.org/xz/xz-file-format.txt +0 ustring \xFD7zXZ\x00 xz compressed data +!:mime application/x-xz + # AFX compressed files (Wolfram Kleff) 2 string -afx- AFX compressed file data @@ -187,3 +212,8 @@ >4 byte x - version %d >5 byte x \b.%d >6 belong x (%d bytes) + +# Type: XZ +# URL: http://tukaani.org/xz/ +0 string \xfd\x37\x7a\x58\x5a\x00 XZ compressed data +!:mime application/x-xz diff --git a/contrib/file/magic/Magdir/console b/contrib/file/magic/Magdir/console index 775472d426..2af6575499 100644 --- a/contrib/file/magic/Magdir/console +++ b/contrib/file/magic/Magdir/console @@ -117,6 +117,12 @@ # 0 belong 0x37804012 V64 Nintendo 64 ROM dump +# From: "Nelson A. de Oliveira" +# Nintendo .nds +192 string \044\377\256Qi\232 Nintendo DS Game ROM Image +# Nintendo .gba +0 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image + #------------------------------------------------------------------------------ # msx: file(1) magic for MSX game cartridge dumps # Too simple - MPi @@ -246,9 +252,3 @@ >>>(0x18.l-26) lelong x CRC32 0x%08x >>>(0x18.l-23) string x "%s" -# From: "Nelson A. de Oliveira" -# .w3g -0 string Warcraft\ III\ recorded\ game %s -# .w3m -0 string HM3W Warcraft III map file - diff --git a/contrib/file/magic/Magdir/cracklib b/contrib/file/magic/Magdir/cracklib index 8f7e0d460e..a1a5a27553 100644 --- a/contrib/file/magic/Magdir/cracklib +++ b/contrib/file/magic/Magdir/cracklib @@ -9,5 +9,5 @@ 0 belong 0x70775631 Cracklib password index, big endian >4 belong >-1 (%i words) # really bellong 0x0000000070775631 -4 belong 0x70775631 Cracklib password index, big endian ("64-bit") +0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") >12 belong >0 (%i words) diff --git a/contrib/file/magic/Magdir/ctags b/contrib/file/magic/Magdir/ctags index 84c5b7f93a..f326cf5cf9 100644 --- a/contrib/file/magic/Magdir/ctags +++ b/contrib/file/magic/Magdir/ctags @@ -1,5 +1,4 @@ - # ---------------------------------------------------------------------------- # ctags: file (1) magic for Exuberant Ctags files # From: Alexander Mai -0 string =!_TAG Exuberant Ctags tag file text +0 search/1 =!_TAG Exuberant Ctags tag file text diff --git a/contrib/file/magic/Magdir/database b/contrib/file/magic/Magdir/database index 8f2fc0a76d..0134355f38 100644 --- a/contrib/file/magic/Magdir/database +++ b/contrib/file/magic/Magdir/database @@ -9,8 +9,11 @@ # Will be maintained as part of the GDBM distribution in the future. # 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian +!:mime application/x-gdbm 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian +!:mime application/x-gdbm 0 string GDBM GNU dbm 2.x database +!:mime application/x-gdbm # # Berkeley DB # @@ -21,6 +24,7 @@ # Hash and Btree 2.X and later databases store the metadata in host byte order. 0 long 0x00061561 Berkeley DB +!:mime application/x-dbm >8 belong 4321 >>4 belong >2 1.86 >>4 belong <3 1.85 @@ -107,74 +111,87 @@ #>>0x04 byte 6 non-incrementing secondary index .XGn file #>>0x04 byte 7 secondary index .YGn file #>>>0x04 byte 8 incrementing secondary index .XGn file + ## XBase database files #0 byte 0x02 #>8 leshort >0 #>>12 leshort 0 FoxBase +#!:mime application/x-dbf #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x03 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x04 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE IV no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x05 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE V no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x30 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 Visual FoxPro #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x43 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with memo var size #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x7b +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASEIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x83 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, dBaseIII+ with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8b +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8e +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with SQL Table #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xb3 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with .dbt memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xf5 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxPro with memo #>>>0x04 lelong 0 (no records) @@ -183,7 +200,8 @@ #0 leshort 0x0006 DBase 3 index file # MS Access database -4 string Standard\ Jet\ DB Microsoft Access Database +4 string Standard\ Jet\ DB Microsoft Access Database +!:mime application/x-msaccess # TDB database from Samba et al - Martin Pool 0 string TDB\ file TDB database @@ -216,7 +234,36 @@ 0 string PGDMP PostgreSQL custom database dump >5 byte x - v%d >6 byte x \b.%d ->5 beshort <=0x100 \b-0 +>5 beshort <0x101 \b-0 >5 beshort >0x100 >>7 byte x \b-%d +# Type: Advanced Data Format (ADF) database +# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ +# From: Nicolas Chauvat +0 string @(#)ADF\ Database CGNS Advanced Data Format + +# Tokyo Cabinet magic data +# http://tokyocabinet.sourceforge.net/index.html +0 string ToKyO\ CaBiNeT\n Tokyo Cabinet +>14 string x \b (%s) +>32 byte 0 \b, Hash +!:mime application/x-tokyocabinet-hash +>32 byte 1 \b, B+ tree +!:mime application/x-tokyocabinet-btree +>32 byte 2 \b, Fixed-length +!:mime application/x-tokyocabinet-fixed +>32 byte 3 \b, Table +!:mime application/x-tokyocabinet-table +>33 byte &1 \b, [open] +>33 byte &2 \b, [fatal] +>34 byte x \b, apow=%d +>35 byte x \b, fpow=%d +>36 byte &0x01 \b, [large] +>36 byte &0x02 \b, [deflate] +>36 byte &0x04 \b, [bzip] +>36 byte &0x08 \b, [tcbs] +>36 byte &0x10 \b, [excodec] +>40 lequad x \b, bnum=%lld +>48 lequad x \b, rnum=%lld +>56 lequad x \b, fsiz=%lld diff --git a/contrib/file/magic/Magdir/diff b/contrib/file/magic/Magdir/diff dissimilarity index 62% index 187e892a6d..291bae67f5 100644 --- a/contrib/file/magic/Magdir/diff +++ b/contrib/file/magic/Magdir/diff @@ -1,10 +1,14 @@ - -#------------------------------------------------------------------------------ -# diff: file(1) magic for diff(1) output -# -0 string diff\ 'diff' output text -0 string ***\ 'diff' output text -0 string Only\ in\ 'diff' output text -0 string Common\ subdirectories:\ 'diff' output text - -0 string Index: RCS/CVS diff output text +#------------------------------------------------------------------------------ +# diff: file(1) magic for diff(1) output +# +0 search/1 diff\ diff output text +!:mime text/x-diff +0 search/1 ***\ diff output text +!:mime text/x-diff +0 search/1 Only\ in\ diff output text +!:mime text/x-diff +0 search/1 Common\ subdirectories:\ diff output text +!:mime text/x-diff + +0 search/1 Index: RCS/CVS diff output text +!:mime text/x-diff diff --git a/contrib/file/magic/Magdir/dump b/contrib/file/magic/Magdir/dump index addd9549cc..cef191a2de 100644 --- a/contrib/file/magic/Magdir/dump +++ b/contrib/file/magic/Magdir/dump @@ -91,3 +91,41 @@ >0 leshort 5 end of volume. >0 leshort 6 map of inodes deleted. >0 leshort 7 end of medium (for floppy). + +24 belong 0x19540119 new-fs dump file (ufs2, big endian), +>896 beqdate x Previous dump %s, +>904 beqdate x This dump %s, +>12 belong >0 Volume %ld, +>692 belong 0 Level zero, type: +>692 belong >0 Level %d, type: +>0 belong 1 tape header, +>0 belong 2 beginning of file record, +>0 belong 3 map of inodes on tape, +>0 belong 4 continuation of file record, +>0 belong 5 end of volume, +>0 belong 6 map of inodes deleted, +>0 belong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 belong >0 Flags %x + +24 lelong 0x19540119 new-fs dump file (ufs2, little endian), +>896 leqdate x This dump %s, +>904 leqdate x Previous dump %s, +>12 lelong >0 Volume %ld, +>692 lelong 0 Level zero, type: +>692 lelong >0 Level %d, type: +>0 lelong 1 tape header, +>0 lelong 2 beginning of file record, +>0 lelong 3 map of inodes on tape, +>0 lelong 4 continuation of file record, +>0 lelong 5 end of volume, +>0 lelong 6 map of inodes deleted, +>0 lelong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 lelong >0 Flags %x diff --git a/contrib/file/magic/Magdir/elf b/contrib/file/magic/Magdir/elf index 464b436aca..c605495429 100644 --- a/contrib/file/magic/Magdir/elf +++ b/contrib/file/magic/Magdir/elf @@ -7,7 +7,12 @@ # # What're the correct byte orders for the nCUBE and the Fujitsu VPP500? # -# updated by Daniel Quinlan (quinlan@yggdrasil.com) +# Created by: unknown +# Modified by (1): Daniel Quinlan +# Modified by (2): Peter Tobias (core support) +# Modified by (3): Christian 'Dr. Disk' Hechelmann (fix of core support) +# Modified by (4): (VMS Itanium) +# Modified by (5): Matthias Urlichs (Listing of many architectures) 0 string \177ELF ELF >4 byte 0 invalid class >4 byte 1 32-bit @@ -15,12 +20,16 @@ >5 byte 0 invalid byte order >5 byte 1 LSB >>16 leshort 0 no file type, +!:strength *2 +!:mime application/octet-stream >>16 leshort 1 relocatable, +!:mime application/x-object >>16 leshort 2 executable, +!:mime application/x-executable >>16 leshort 3 shared object, -# Core handling from Peter Tobias -# corrections by Christian 'Dr. Disk' Hechelmann +!:mime application/x-sharedlib >>16 leshort 4 core file +!:mime application/x-coredump # Core file detection is not reliable. #>>>(0x38+0xcc) string >\0 of '%s' #>>>(0x38+0x10) lelong >0 (signal %d), @@ -74,7 +83,7 @@ >>>48 leshort &0x0008 (LP64), >>18 leshort 16 nCUBE, >>18 leshort 17 Fujitsu VPP500, ->>18 leshort 18 SPARC32PLUS, +>>18 leshort 18 SPARC32PLUS - invalid byte order, >>18 leshort 20 PowerPC, >>18 leshort 22 IBM S/390, >>18 leshort 36 NEC V800, @@ -96,22 +105,66 @@ >>18 leshort 51 Stanford MIPS-X, >>18 leshort 52 Motorola Coldfire, >>18 leshort 53 Motorola M68HC12, +>>18 leshort 54 Fujitsu MMA, +>>18 leshort 55 Siemens PCP, +>>18 leshort 56 Sony nCPU, +>>18 leshort 57 Denso NDR1, +>>18 leshort 58 Start*Core, +>>18 leshort 59 Toyota ME16, +>>18 leshort 60 ST100, +>>18 leshort 61 Tinyj emb., >>18 leshort 62 x86-64, +>>18 leshort 63 Sony DSP, +>>18 leshort 66 FX66, +>>18 leshort 67 ST9+ 8/16 bit, +>>18 leshort 68 ST7 8 bit, +>>18 leshort 69 MC68HC16, +>>18 leshort 70 MC68HC11, +>>18 leshort 71 MC68HC08, +>>18 leshort 72 MC68HC05, +>>18 leshort 73 SGI SVx, +>>18 leshort 74 ST19 8 bit, >>18 leshort 75 Digital VAX, +>>18 leshort 76 Axis cris, +>>18 leshort 77 Infineon 32-bit embedded, +>>18 leshort 78 Element 14 64-bit DSP, +>>18 leshort 79 LSI Logic 16-bit DSP, +>>18 leshort 80 MMIX, +>>18 leshort 81 Harvard machine-independent, +>>18 leshort 82 SiTera Prism, +>>18 leshort 83 Atmel AVR 8-bit, +>>18 leshort 84 Fujitsu FR30, +>>18 leshort 85 Mitsubishi D10V, +>>18 leshort 86 Mitsubishi D30V, +>>18 leshort 87 NEC v850, >>18 leshort 88 Renesas M32R, +>>18 leshort 89 Matsushita MN10300, +>>18 leshort 90 Matsushita MN10200, +>>18 leshort 91 picoJava, +>>18 leshort 92 OpenRISC, +>>18 leshort 93 ARC Cores Tangent-A5, >>18 leshort 94 Tensilica Xtensa, >>18 leshort 97 NatSemi 32k, >>18 leshort 106 Analog Devices Blackfin, +>>18 leshort 113 Altera Nios II, +>>18 leshort 0xae META, +>>18 leshort 0x3426 OpenRISC (obsolete), +>>18 leshort 0x8472 OpenRISC (obsolete), >>18 leshort 0x9026 Alpha (unofficial), >>20 lelong 0 invalid version >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB >>16 beshort 0 no file type, +!:mime application/octet-stream >>16 beshort 1 relocatable, +!:mime application/x-object >>16 beshort 2 executable, +!:mime application/x-executable >>16 beshort 3 shared object, +!:mime application/x-sharedlib >>16 beshort 4 core file, +!:mime application/x-coredump #>>>(0x38+0xcc) string >\0 of '%s' #>>>(0x38+0x10) belong >0 (signal %d), >>16 beshort &0xff00 processor-specific, @@ -163,10 +216,10 @@ >>18 beshort 16 nCUBE, >>18 beshort 17 Fujitsu VPP500, >>18 beshort 18 SPARC32PLUS, ->>>36 belong&0xffff00 &0x000100 V8+ Required, ->>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required, ->>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required, ->>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required, +>>>36 belong&0xffff00 0x000100 V8+ Required, +>>>36 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, +>>>36 belong&0xffff00 0x000400 HaL R1 Extensions Required, +>>>36 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, >>18 beshort 20 PowerPC or cisco 4500, >>18 beshort 21 64-bit PowerPC or cisco 7500, >>18 beshort 22 IBM S/390, @@ -181,6 +234,12 @@ >>18 beshort 41 Alpha, >>18 beshort 42 Renesas SH, >>18 beshort 43 SPARC V9, +>>>48 belong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, +>>>48 belong&0xffff00 0x000400 HaL R1 Extensions Required, +>>>48 belong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, +>>>48 belong&0x3 0 total store ordering, +>>>48 belong&0x3 1 partial store ordering, +>>>48 belong&0x3 2 relaxed memory ordering, >>18 beshort 44 Siemens Tricore Embedded Processor, >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., >>18 beshort 46 Renesas H8/300, @@ -194,6 +253,9 @@ >>18 beshort 73 Cray NV1, >>18 beshort 75 Digital VAX, >>18 beshort 88 Renesas M32R, +>>18 leshort 92 OpenRISC, +>>18 leshort 0x3426 OpenRISC (obsolete), +>>18 leshort 0x8472 OpenRISC (obsolete), >>18 beshort 94 Tensilica Xtensa, >>18 beshort 97 NatSemi 32k, >>18 beshort 0x18ad AVR32 (unofficial), @@ -220,7 +282,6 @@ >>7 byte 10 (Tru64) >>7 byte 11 (Novell Modesto) >>7 byte 12 (OpenBSD) -# VMS Itanium added by gerardo.cacciari@gmail.com >8 string \2 >>7 byte 13 (OpenVMS) >>7 byte 97 (ARM) diff --git a/contrib/file/magic/Magdir/epoc b/contrib/file/magic/Magdir/epoc index 29bd94799b..80229c47f3 100644 --- a/contrib/file/magic/Magdir/epoc +++ b/contrib/file/magic/Magdir/epoc @@ -1,10 +1,11 @@ - #------------------------------------------------------------------------------ -# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris +# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] # Stefan Praszalowicz (hpicollo@worldnet.fr) -#0 lelong 0x10000037 Epoc32 +# Useful information for improving this file can be found at: +# http://software.frodo.looijaard.name/psiconv/formats/Index.html +0 lelong 0x10000037 >4 lelong 0x1000006D ->>8 lelong 0x1000007F Word ->>8 lelong 0x10000088 Sheet ->>8 lelong 0x1000007D Sketch ->>8 lelong 0x10000085 TextEd +>>8 lelong 0x1000007F Psion Word +>>8 lelong 0x10000088 Psion Sheet +>>8 lelong 0x1000007D Psion Sketch +>>8 lelong 0x10000085 Psion TextEd diff --git a/contrib/file/magic/Magdir/erlang b/contrib/file/magic/Magdir/erlang new file mode 100644 index 0000000000..6b2c4dcc3c --- /dev/null +++ b/contrib/file/magic/Magdir/erlang @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# erlang: file(1) magic for Erlang JAM and BEAM files +# URL: http://www.erlang.org/faq/x779.html#AEN812 + +# OTP R3-R4 +0 string \0177BEAM! Old Erlang BEAM file +>6 short >0 - version %d + +# OTP R5 and onwards +0 string FOR1 +>8 string BEAM Erlang BEAM file + +# 4.2 version may have a copyright notice! +4 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 +79 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 + +4 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 diff --git a/contrib/file/magic/Magdir/filesystems b/contrib/file/magic/Magdir/filesystems index 20b257bc3a..93da429432 100644 --- a/contrib/file/magic/Magdir/filesystems +++ b/contrib/file/magic/Magdir/filesystems @@ -104,9 +104,32 @@ >>>346 string des\ Betriebssystems >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x ->0x145 string Default:\ F \b, FREE-DOS MBR +#>0x145 string Default:\ F \b, FREE-DOS MBR +#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR +>0x145 search/7 Default:\ F \b, FREE-DOS MBR +#>>313 string F0\ .\ .\ . +#>>>322 string disk\ 1 +#>>>>382 string FAT3 >64 string no\ active\ partition\ found >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR +# Ranish Partition Manager http://www.ranish.com/part/ +>387 search/4 \0\ Error!\r +>>378 search/7 Virus! +>>>397 search/4 Booting\ +>>>>408 search/4 HD1/\0 \b, Ranish MBR ( +>>>>>416 string Writing\ changes... \b2.37 +>>>>>>438 ubyte x \b,0x%x dots +>>>>>>440 ubyte >0 \b,virus check +>>>>>>441 ubyte >0 \b,partition %c +#2.38,2.42,2.44 +>>>>>416 string !Writing\ changes... \b +>>>>>>418 ubyte 1 \bvirus check, +>>>>>>419 ubyte x \b0x%x seconds +>>>>>>420 ubyte&0x0F >0 \b,partition +>>>>>>>420 ubyte&0x0F <5 \b %x +>>>>>>>420 ubyte&0x0F 0Xf \b ask +>>>>>420 ubyte x \b) +# >271 string Operating\ system\ loading >>296 string error\r \b, SYSLINUX MBR (2.10) # http://www.acronis.de/ @@ -124,18 +147,20 @@ >0x40 string SBML # label with 11 characters of FAT 12 bit filesystem >>43 string SMART\ BTMGR ->>>430 string SBMK\ Bad!\r ->>>>3 string SBM \b, Smart Boot Manager ->>>>>6 string >\0 \b, version %s +>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager +# OEM-ID not always "SBM" +#>>>>3 strings SBM +>>>>6 string >\0 \b, version %s >382 string XOSLLOADXCF \b, eXtended Operating System Loader >6 string LILO \b, LInux i386 boot LOader >>120 string LILO \b, version 22.3.4 SuSe >>172 string LILO \b, version 22.5.8 Debian -# updated by Joerg Jenderek +# updated by Joerg Jenderek at Oct 2008 # variables according to grub-0.97/stage1/stage1.S or # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only informations of strange GRUB loaders ->0 ulelong 0x009048EB +>342 search/60 \0Geom\0 +#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 >>0x41 ubyte <2 >>>0x3E ubyte >2 \b; GRand Unified Bootloader # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 @@ -178,15 +203,14 @@ >3 string BCDL >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) # mbr partion table entries -# OEM-ID not Microsoft,SYSLINUX,or MTOOLs +# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs >3 string !MS >>3 string !SYSLINUX >>>3 string !MTOOL +>>>>3 string !NEWLDR +>>>>>5 string !DOS # not FAT (32 bit) ->>>>82 string !FAT32 -#not IO.SYS ->>>>>472 string !IO\ \ \ \ \ \ SYS ->>>>>>480 string !IO\ \ \ \ \ \ SYS +>>>>>>82 string !FAT32 #not Linux kernel >>>>>>>514 string !HdrS #not BeOS @@ -272,6 +296,11 @@ >>>>>>>>>(1.b+11) ubyte 0xb >>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display +>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display +#>>244 string from\ dosemu-freedos-*-bin.tgz\r +#>>>170 string Sorry,\ could\ not\ load\ an\ +#>>>>195 string operating\ system.\r\n +# >103 string This\ is\ not\ a\ bootable\ disk.\ >>132 string Please\ insert\ a\ bootable\ >>>157 string floppy\ and\r\n @@ -374,12 +403,22 @@ >430 string Datentr\204ger\ entfernen\xFF\r\n >>454 string Medienfehler\xFF\r\n >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) ->>>>368 ubyte&0xDF >0 ->>>>>368 string x %-.5s ->>>>>>373 ubyte&0xDF >0 ->>>>>>>373 string x \b%-.3s ->>>>>376 ubyte&0xDF >0 ->>>>>>376 string x \b.%-.3s +>>>>379 string \0 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# variant +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# + #>3 string NTFS\ \ \ \ >389 string Fehler\ beim\ Lesen\ >>407 string des\ Datentr\204gers @@ -567,12 +606,27 @@ >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader >>471 string Cannot\ load\ DOS\ >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader +#?? >444 string KERNEL\ \ SYS >>314 string BOOT\ error! \b, FREE-DOS Bootloader >499 string KERNEL\ \ SYS >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader >449 string KERNEL\ \ SYS >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader +# +>449 string Loading\ FreeDOS +>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +# +>331 string Error!.0 \b, FREE-DOS 1.0 bootloader +# >125 string Loading\ FreeDOS...\r >>311 string BOOT\ error!\r \b, FREE-DOS bootloader >>>441 ubyte&0xDF >0 @@ -706,13 +760,7 @@ #it also hangs with another message ("NF"). >>>>>492 string RENF \b, FAT (12 bit) >>>>>495 string RENF \b, FAT (16 bit) -# added by Joerg Jenderek -# http://syslinux.zytor.com/iso.php -0 ulelong 0x7c40eafa isolinux Loader -# http://syslinux.zytor.com/pxe.php -0 ulelong 0x007c05ea pxelinux Loader -0 ulelong 0x60669c66 pxelinux Loader -# loader end +# x86 bootloader end # updated by Joerg Jenderek at Sep 2007 >3 ubyte 0 #no active flag @@ -732,6 +780,7 @@ # older drives may use Near JuMP instruction E9 xx xx >0 lelong&0x009000EB 0x009000EB >0 lelong&0x000000E9 0x000000E9 +# minimal short forward jump found 03cx?? # maximal short forward jump is 07fx >1 ubyte <0xff \b, code offset 0x%x # mtools-3.9.8/msdos.h @@ -740,91 +789,92 @@ >>11 uleshort&0x000f x >>>11 uleshort <32769 >>>>11 uleshort >31 ->>>>>3 string >\0 \b, OEM-ID "%8.8s" +>>>>>21 ubyte&0xf0 0xF0 +>>>>>>3 string >\0 \b, OEM-ID "%8.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC ->>>>>>8 string IHC \b cached by Windows 9M ->>>>>11 uleshort >512 \b, Bytes/sector %u -#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) ->>>>>11 uleshort <512 \b, Bytes/sector %u ->>>>>13 ubyte >1 \b, sectors/cluster %u -#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) ->>>>>14 uleshort >32 \b, reserved sectors %u -#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) -#>>>>>14 uleshort >1 \b, reserved sectors %u -#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) ->>>>>14 uleshort <1 \b, reserved sectors %u ->>>>>16 ubyte >2 \b, FATs %u -#>>>>>16 ubyte =2 \b, FATs %u (usual) ->>>>>16 ubyte =1 \b, FAT %u ->>>>>16 ubyte >0 ->>>>>17 uleshort >0 \b, root entries %u -#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) ->>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) -#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) ->>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x -#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) ->>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x ->>>>>22 uleshort >0 \b, sectors/FAT %u -#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) ->>>>>26 ubyte >2 \b, heads %u -#>>>>>26 ubyte =2 \b, heads %u (usual floppy) ->>>>>26 ubyte =1 \b, heads %u +>>>>>>>8 string IHC \b cached by Windows 9M +>>>>>>11 uleshort >512 \b, Bytes/sector %u +#>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) +>>>>>>11 uleshort <512 \b, Bytes/sector %u +>>>>>>13 ubyte >1 \b, sectors/cluster %u +#>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) +>>>>>>14 uleshort >32 \b, reserved sectors %u +#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) +#>>>>>>14 uleshort >1 \b, reserved sectors %u +#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) +>>>>>>14 uleshort <1 \b, reserved sectors %u +>>>>>>16 ubyte >2 \b, FATs %u +#>>>>>>16 ubyte =2 \b, FATs %u (usual) +>>>>>>16 ubyte =1 \b, FAT %u +>>>>>>16 ubyte >0 +>>>>>>17 uleshort >0 \b, root entries %u +#>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) +>>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) +#>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) +>>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x +#>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) +>>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x +>>>>>>22 uleshort >0 \b, sectors/FAT %u +#>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) +>>>>>>26 ubyte >2 \b, heads %u +#>>>>>>26 ubyte =2 \b, heads %u (usual floppy) +>>>>>>26 ubyte =1 \b, heads %u #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk ->>>>>38 ubyte !0x70 ->>>>>>28 ulelong >0 \b, hidden sectors %u -#>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) ->>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) -#>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) +>>>>>>38 ubyte !0x70 +>>>>>>>28 ulelong >0 \b, hidden sectors %u +#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) +>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) +#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 specific ->>>>>82 string !FAT32 -#>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) -#>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) ->>>>>>36 ubyte !0x80 ->>>>>>>36 ubyte !0 \b, physical drive 0x%x ->>>>>>37 ubyte >0 \b, reserved 0x%x -#>>>>>>37 ubyte =0 \b, reserved 0x%x ->>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>38 ubyte =0x29 ->>>>>>>39 ulelong x \b, serial number 0x%x ->>>>>>>43 string >>>>>>43 string >NO\ NAME \b, label: "%11.11s" ->>>>>>>43 string =NO\ NAME \b, unlabeled ->>>>>>54 string FAT \b, FAT ->>>>>>>54 string FAT12 \b (12 bit) ->>>>>>>54 string FAT16 \b (16 bit) +>>>>>>82 string !FAT32 +#>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) +#>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) +>>>>>>>36 ubyte !0x80 +>>>>>>>>36 ubyte !0 \b, physical drive 0x%x +>>>>>>>37 ubyte >0 \b, reserved 0x%x +#>>>>>>>37 ubyte =0 \b, reserved 0x%x +>>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>38 ubyte =0x29 +>>>>>>>>39 ulelong x \b, serial number 0x%x +>>>>>>>>43 string >>>>>>>43 string >NO\ NAME \b, label: "%11.11s" +>>>>>>>>43 string =NO\ NAME \b, unlabeled +>>>>>>>54 string FAT \b, FAT +>>>>>>>>54 string FAT12 \b (12 bit) +>>>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific ->>>>>82 string FAT32 \b, FAT (32 bit) ->>>>>>36 ulelong x \b, sectors/FAT %u ->>>>>>40 uleshort >0 \b, extension flags %u -#>>>>>>40 uleshort =0 \b, extension flags %u ->>>>>>42 uleshort >0 \b, fsVersion %u -#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) ->>>>>>44 ulelong >2 \b, rootdir cluster %u -#>>>>>>44 ulelong =2 \b, rootdir cluster %u -#>>>>>>44 ulelong =1 \b, rootdir cluster %u ->>>>>>48 uleshort >1 \b, infoSector %u -#>>>>>>48 uleshort =1 \b, infoSector %u (usual) ->>>>>>48 uleshort <1 \b, infoSector %u ->>>>>>50 uleshort >6 \b, Backup boot sector %u -#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) ->>>>>>50 uleshort <6 \b, Backup boot sector %u ->>>>>>54 ulelong >0 \b, reserved1 0x%x ->>>>>>58 ulelong >0 \b, reserved2 0x%x ->>>>>>62 ulelong >0 \b, reserved3 0x%x +>>>>>>82 string FAT32 \b, FAT (32 bit) +>>>>>>>36 ulelong x \b, sectors/FAT %u +>>>>>>>40 uleshort >0 \b, extension flags %u +#>>>>>>>40 uleshort =0 \b, extension flags %u +>>>>>>>42 uleshort >0 \b, fsVersion %u +#>>>>>>>42 uleshort =0 \b, fsVersion %u (usual) +>>>>>>>44 ulelong >2 \b, rootdir cluster %u +#>>>>>>>44 ulelong =2 \b, rootdir cluster %u +#>>>>>>>44 ulelong =1 \b, rootdir cluster %u +>>>>>>>48 uleshort >1 \b, infoSector %u +#>>>>>>>48 uleshort =1 \b, infoSector %u (usual) +>>>>>>>48 uleshort <1 \b, infoSector %u +>>>>>>>50 uleshort >6 \b, Backup boot sector %u +#>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) +>>>>>>>50 uleshort <6 \b, Backup boot sector %u +>>>>>>>54 ulelong >0 \b, reserved1 0x%x +>>>>>>>58 ulelong >0 \b, reserved2 0x%x +>>>>>>>62 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X ->>>>>>64 ubyte >0x80 \b, physical drive 0x%x -#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) ->>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x -#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) ->>>>>>65 ubyte >0 \b, reserved 0x%x ->>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>66 ubyte =0x29 ->>>>>>>67 ulelong x \b, serial number 0x%x ->>>>>>>71 string >>>>>71 string >NO\ NAME \b, label: "%11.11s" ->>>>>>71 string =NO\ NAME \b, unlabeled +>>>>>>>64 ubyte >0x80 \b, physical drive 0x%x +#>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) +>>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x +#>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) +>>>>>>>65 ubyte >0 \b, reserved 0x%x +>>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>66 ubyte =0x29 +>>>>>>>>67 ulelong x \b, serial number 0x%x +>>>>>>>>71 string >>>>>>71 string >NO\ NAME \b, label: "%11.11s" +>>>>>>>71 string =NO\ NAME \b, unlabeled ### FATs end >0x200 lelong 0x82564557 \b, BSD disklabel # FATX @@ -833,7 +883,7 @@ # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f Minix filesystem -0x410 beshort 0x137f Minix filesystem (big endian), +0x410 beshort 0x137f Minix filesystem (big endian) >0x402 beshort !0 \b, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f Minix filesystem, 30 char names @@ -841,7 +891,7 @@ 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names # romfs filesystems - Juan Cespedes -0 string -rom1fs-\0 romfs filesystem, version 1 +0 string -rom1fs- romfs filesystem, version 1 >8 belong x %d bytes, >16 string x named %s. @@ -854,6 +904,13 @@ 0x18b string OS/2 OS/2 Boot Manager +# updated by Joerg Jenderek at Oct 2008!! +# http://syslinux.zytor.com/iso.php +0 ulelong 0x7c40eafa isolinux Loader +# http://syslinux.zytor.com/pxe.php +0 ulelong 0x007c05ea pxelinux Loader +0 ulelong 0x60669c66 pxelinux Loader + # added by Joerg Jenderek # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or # grub-1.94/kern/i386/pc/startup.S @@ -1025,19 +1082,42 @@ >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization -# ext2/ext3 filesystems - Andreas Dilger -0x438 leshort 0xEF53 Linux ->0x44c lelong x rev %d ->0x43e leshort x \b.%d ->0x45c lelong ^0x0000004 ext2 filesystem data ->>0x43a leshort ^0x0000001 (mounted or unclean) ->0x45c lelong &0x0000004 ext3 filesystem data ->>0x460 lelong &0x0000004 (needs journal recovery) ->0x43a leshort &0x0000002 (errors) ->0x460 lelong &0x0000001 (compressed) -#>0x460 lelong &0x0000002 (filetype) -#>0x464 lelong &0x0000001 (sparse_super) ->0x464 lelong &0x0000002 (large files) +# ext2/ext3 filesystems - Andreas Dilger +# ext4 filesystem - Eric Sandeen +0x438 leshort 0xEF53 Linux +>0x44c lelong x rev %d +>0x43e leshort x \b.%d +# No journal? ext2 +>0x45c lelong ^0x0000004 ext2 filesystem data +>>0x43a leshort ^0x0000001 (mounted or unclean) +# Has a journal? ext3 or ext4 +>0x45c lelong &0x0000004 +# and small INCOMPAT? +>>0x460 lelong <0x0000040 +# and small RO_COMPAT? +>>>0x464 lelong <0x0000008 ext3 filesystem data +# else large RO_COMPAT? +>>>0x464 lelong >0x0000007 ext4 filesystem data +# else large INCOMPAT? +>>0x460 lelong >0x000003f ext4 filesystem data +# General flags for any ext* fs +>0x460 lelong &0x0000004 (needs journal recovery) +>0x43a leshort &0x0000002 (errors) +# INCOMPAT flags +>0x460 lelong &0x0000001 (compressed) +#>0x460 lelong &0x0000002 (filetype) +#>0x460 lelong &0x0000010 (meta bg) +>0x460 lelong &0x0000040 (extents) +>0x460 lelong &0x0000080 (64bit) +#>0x460 lelong &0x0000100 (mmp) +#>0x460 lelong &0x0000200 (flex bg) +# RO_INCOMPAT flags +#>0x464 lelong &0x0000001 (sparse super) +>0x464 lelong &0x0000002 (large files) +>0x464 lelong &0x0000008 (huge files) +#>0x464 lelong &0x0000010 (gdt checksum) +#>0x464 lelong &0x0000020 (many subdirs) +#>0x463 lelong &0x0000040 (extra isize) # SGI disk labels - Nathan Scott 0 belong 0x0BE5A941 SGI disk label (volume header) @@ -1115,40 +1195,42 @@ # CDROM Filesystems # Modified for UDF by gerardo.cacciari@gmail.com -32769 string CD001 ->38913 string !NSR0 ISO 9660 CD-ROM filesystem data ->38913 string NSR0 UDF filesystem data ->>38917 string 1 (version 1.0) ->>38917 string 2 (version 1.5) ->>38917 string 3 (version 2.0) ->>38917 byte >0x33 (unknown version, ID 0x%X) ->>38917 byte <0x31 (unknown version, ID 0x%X) +32769 string CD001 +!:mime application/x-iso9660-image +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data +>38913 string NSR0 UDF filesystem data +>>38917 string 1 (version 1.0) +>>38917 string 2 (version 1.5) +>>38917 string 3 (version 2.0) +>>38917 byte >0x33 (unknown version, ID 0x%X) +>>38917 byte <0x31 (unknown version, ID 0x%X) # "application id" which appears to be used as a volume label ->32808 string >\0 '%s' ->34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) -37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) -32776 string CDROM High Sierra CD-ROM filesystem data +>32808 string >\0 '%s' +>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) +37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) +!:mime application/x-iso9660-image +32776 string CDROM High Sierra CD-ROM filesystem data # cramfs filesystem - russell@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian ->4 lelong x size %d +>4 lelong x size %lu >8 lelong &1 version #2 >8 lelong &2 sorted_dirs >8 lelong &4 hole_support >32 lelong x CRC 0x%x, ->36 lelong x edition %d, ->40 lelong x %d blocks, ->44 lelong x %d files +>36 lelong x edition %lu, +>40 lelong x %lu blocks, +>44 lelong x %lu files 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian ->4 belong x size %d +>4 belong x size %lu >8 belong &1 version #2 >8 belong &2 sorted_dirs >8 belong &4 hole_support >32 belong x CRC 0x%x, ->36 belong x edition %d, ->40 belong x %d blocks, ->44 belong x %d files +>36 belong x edition %lu, +>40 belong x %lu blocks, +>44 belong x %lu files # reiserfs - russell@coker.com.au 0x10034 string ReIsErFs ReiserFS V3.5 @@ -1241,6 +1323,34 @@ >>>2 short 2048 AXP generated) >>>2 short 4096 I64 generated) +# Summary: Oracle Clustered Filesystem +# Created by: Aaron Botsis +8 string OracleCFS Oracle Clustered Filesystem, +>4 long x rev %d +>0 long x \b.%d, +>560 string x label: %.64s, +>136 string x mountpoint: %.128s + +# Summary: Oracle ASM tagged volume +# Created by: Aaron Botsis +32 string ORCLDISK Oracle ASM Volume, +>40 string x Disk Name: %0.12s +32 string ORCLCLRD Oracle ASM Volume (cleared), +>40 string x Disk Name: %0.12s + +# Oracle Clustered Filesystem - Aaron Botsis +8 string OracleCFS Oracle Clustered Filesystem, +>4 long x rev %d +>0 long x \b.%d, +>560 string x label: %.64s, +>136 string x mountpoint: %.128s + +# Oracle ASM tagged volume - Aaron Botsis +32 string ORCLDISK Oracle ASM Volume, +>40 string x Disk Name: %0.12s +32 string ORCLCLRD Oracle ASM Volume (cleared), +>40 string x Disk Name: %0.12s + # Compaq/HP RILOE floppy image # From: Dirk Jagdmann 0 string CPQRFBLO Compaq/HP RILOE floppy image @@ -1259,3 +1369,26 @@ # http://filext.com/file-extension/DAA # describes the daa file format. The magic would be: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive + +# From Albert Cahalan +# really le32 operation,destination,payloadsize (but quite predictable) +# 01 00 00 00 00 00 00 c0 00 02 00 00 +0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware + +# From Eric Sandeen +# GFS2 +0x10000 belong 0x01161970 GFS2 Filesystem +>0x10024 belong x (blocksize %d, +>0x10060 string >\0 lockproto %s) + +# BTRFS +0x10040 string _BHRfS_M BTRFS Filesystem +>0x1012b string >\0 (label "%s", +>0x10090 lelong x sectorsize %d, +>0x10094 lelong x nodesize %d, +>0x10098 lelong x leafsize %d) + + +# dvdisaster's .ecc +# From: "Nelson A. de Oliveira" +0 string *dvdisaster* dvdisaster error correction file diff --git a/contrib/file/magic/Magdir/flash b/contrib/file/magic/Magdir/flash index f14b460c70..0b985f22b7 100644 --- a/contrib/file/magic/Magdir/flash +++ b/contrib/file/magic/Magdir/flash @@ -8,10 +8,13 @@ # 0 string FWS Macromedia Flash data, >3 byte x version %d +!:mime application/x-shockwave-flash 0 string CWS Macromedia Flash data (compressed), +!:mime application/x-shockwave-flash >3 byte x version %d # From: Cal Peake 0 string FLV Macromedia Flash Video +!:mime video/x-flv # # From Dave Wilson diff --git a/contrib/file/magic/Magdir/fonts b/contrib/file/magic/Magdir/fonts index cf6e0d7cc1..31ff8a2c8b 100644 --- a/contrib/file/magic/Magdir/fonts +++ b/contrib/file/magic/Magdir/fonts @@ -1,8 +1,7 @@ - #------------------------------------------------------------------------------ # fonts: file(1) magic for font data # -0 string FONT ASCII vfont text +0 search/1 FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data @@ -16,7 +15,7 @@ 0 lelong 00000004 X11 SNF font data, LSB first # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) -0 string STARTFONT\040 X11 BDF font text +0 search/1 STARTFONT\ X11 BDF font text # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) @@ -56,6 +55,8 @@ 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font +0 string ttcf TrueType font collection data + # Opentype font data from Avi Bercovich 0 string OTTO OpenType font data diff --git a/contrib/file/magic/Magdir/fortran b/contrib/file/magic/Magdir/fortran index ce004adb36..f42c7c8a8d 100644 --- a/contrib/file/magic/Magdir/fortran +++ b/contrib/file/magic/Magdir/fortran @@ -1,2 +1,3 @@ # FORTRAN source -0 string/c c\ FORTRAN program +0 regex/100 \^[Cc][\ \t] FORTRAN program +!:mime text/x-fortran diff --git a/contrib/file/magic/Magdir/frame b/contrib/file/magic/Magdir/frame index 1b397df057..3699b44223 100644 --- a/contrib/file/magic/Magdir/frame +++ b/contrib/file/magic/Magdir/frame @@ -1,11 +1,14 @@ - #------------------------------------------------------------------------------ # frame: file(1) magic for FrameMaker files # # This stuff came on a FrameMaker demo tape, most of which is # copyright, but this file is "published" as witness the following: # +# Note that this is the Framemaker Maker Interchange Format, not the +# Normal format which would be application/vnd.framemaker. +# 0 string \11 string 5.5 (5.5 >11 string 5.0 (5.0 >11 string 4.0 (4.0 @@ -14,25 +17,32 @@ >11 string 1.0 (1.0 >14 byte x %c) 0 string \9 string 4.0 (4.0) >9 string 3.0 (3.0) >9 string 2.0 (2.0) >9 string 1.0 (1.x) -0 string \17 string 3.0 (3.0) >17 string 2.0 (2.0) >17 string 1.0 (1.x) 0 string \17 string 1.01 (%s) 0 string \10 string 3.0 (3.0 >10 string 2.0 (2.0 >10 string 1.0 (1.0 >13 byte x %c) # XXX - this book entry should be verified, if you find one, uncomment this #0 string \6 string 3.0 (3.0) #>6 string 2.0 (2.0) #>6 string 1.0 (1.0) 0 string \4 lelong >0 \b, version %d) ->4 belong <=0 \b) +>4 belong <1 \b) 0 belong 011421044151 ld.so hints file (Big Endian >4 belong >0 \b, version %d) ->4 belong <=0 \b) +>4 belong <1 \b) # # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities diff --git a/contrib/file/magic/Magdir/fsav b/contrib/file/magic/Magdir/fsav index 4d61bebaa2..ccc6d596c2 100644 --- a/contrib/file/magic/Magdir/fsav +++ b/contrib/file/magic/Magdir/fsav @@ -46,7 +46,7 @@ 0 string ClamAV-VDB: >11 string >\0 Clam AntiVirus database %-.23s >>34 string : ->>>35 regex [^:]+ \b, version +>>>35 string !: \b, version >>>>35 string x \b%-.1s >>>>>36 string !: >>>>>>36 string x \b%-.1s @@ -54,7 +54,9 @@ >>>>>>>>37 string x \b%-.1s >>>>>>>>>38 string !: >>>>>>>>>>38 string x \b%-.1s ->>>>512 string \037\213 \b, gzipped ->>>>769 string ustar\0 \b, tared >512 string \037\213 \b, gzipped ->769 string ustar\0 \b, tared +>769 string ustar\0 \b, tarred + +# Type: Grisoft AVG AntiVirus +# From: David Newgas +0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data diff --git a/contrib/file/magic/Magdir/games b/contrib/file/magic/Magdir/games index 2dc17da6c6..32ccdfeaab 100644 --- a/contrib/file/magic/Magdir/games +++ b/contrib/file/magic/Magdir/games @@ -1,12 +1,6 @@ #------------------------------------------------------------------------------ # games: file(1) for games -# Thomas M. Ott (ThMO) -1 string =WAD DOOM data, ->0 string =I main wad ->0 string =P patch wad ->0 byte x unknown junk - # Fabio Bonelli # Quake II - III data files 0 string IDP2 Quake II 3D Model file, @@ -29,11 +23,6 @@ # Doom and Quake # submitted by Nicolas Patrois -# DOOM - -0 string IWAD DOOM or DOOM ][ world -0 string PWAD DOOM or DOOM ][ extension world - 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 @@ -155,3 +144,102 @@ 0 string MComprHD MAME CHD compressed hard disk image, >12 belong x version %lu + +# doom - submitted by Jon Dowland + +0 string =IWAD doom main IWAD data +>4 lelong x containing %d lumps +0 string =PWAD doom patch PWAD data +>4 lelong x containing %d lumps + + +# Summary: Warcraft 3 save +# Extension: .w3g +# Created by: "Nelson A. de Oliveira" +0 string Warcraft\ III\ recorded\ game %s + + +# Summary: Warcraft 3 map +# Extension: .w3m +# Created by: "Nelson A. de Oliveira" +0 string HM3W Warcraft III map file + + +# Summary: SGF Smart Game Format +# Extension: .sgf +# Reference: http://www.red-bean.com/sgf/ +# Created by: Eduardo Sabbatella +# Modified by (1): Abel Cheung (regex, more game format) +# FIXME: Some games don't have GM (game type) +0 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format +>2 search/0x200 GM[ +>>&0 string 1] (Go) +>>&0 string 2] (Othello) +>>&0 string 3] (chess) +>>&0 string 4] (Gomoku+Renju) +>>&0 string 5] (Nine Men's Morris) +>>&0 string 6] (Backgammon) +>>&0 string 7] (Chinese chess) +>>&0 string 8] (Shogi) +>>&0 string 9] (Lines of Action) +>>&0 string 10] (Ataxx) +>>&0 string 11] (Hex) +>>&0 string 12] (Jungle) +>>&0 string 13] (Neutron) +>>&0 string 14] (Philosopher's Football) +>>&0 string 15] (Quadrature) +>>&0 string 16] (Trax) +>>&0 string 17] (Tantrix) +>>&0 string 18] (Amazons) +>>&0 string 19] (Octi) +>>&0 string 20] (Gess) +>>&0 string 21] (Twixt) +>>&0 string 22] (Zertz) +>>&0 string 23] (Plateau) +>>&0 string 24] (Yinsh) +>>&0 string 25] (Punct) +>>&0 string 26] (Gobblet) +>>&0 string 27] (hive) +>>&0 string 28] (Exxit) +>>&0 string 29] (Hnefatal) +>>&0 string 30] (Kuba) +>>&0 string 31] (Tripples) +>>&0 string 32] (Chase) +>>&0 string 33] (Tumbling Down) +>>&0 string 34] (Sahara) +>>&0 string 35] (Byte) +>>&0 string 36] (Focus) +>>&0 string 37] (Dvonn) +>>&0 string 38] (Tamsk) +>>&0 string 39] (Gipf) +>>&0 string 40] (Kropki) + + +# Summary: Civilization 4 video +# Extension: .bik +# Created by: Abel Cheung +0 string BIKi Civilization 4 Video + + +############################################## +# NetImmerse/Gamebryo game engine entries + +# Summary: Gamebryo game engine file +# Extension: .nif, .kf +# Created by: Abel Cheung +0 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file +>&0 regex [0-9a-z.]+ \b, version %s + +# Summary: Gamebryo game engine file +# Extension: .kfm +# Created by: Abel Cheung +0 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File +>&0 regex [0-9a-z.]+ \b, version %s + +# Summary: NetImmerse game engine file +# Extension .nif +# Created by: Abel Cheung +0 string NetImmerse\ File\ Format,\ Versio +>&0 string n\ NetImmerse game engine file +>>&0 regex [0-9a-z.]+ \b, version %s + diff --git a/contrib/file/magic/Magdir/gimp b/contrib/file/magic/Magdir/gimp index 9a9d61e2f7..674bbfba62 100644 --- a/contrib/file/magic/Magdir/gimp +++ b/contrib/file/magic/Magdir/gimp @@ -34,3 +34,7 @@ # ('Bucky' LaDieu, nega@vt.edu) 20 string GIMP GIMP brush data + +# GIMP Curves File +# From: "Nelson A. de Oliveira" +0 string #\040GIMP\040Curves\040File GIMP curve file diff --git a/contrib/file/magic/Magdir/gnome-keyring b/contrib/file/magic/Magdir/gnome-keyring new file mode 100644 index 0000000000..80a4f882c1 --- /dev/null +++ b/contrib/file/magic/Magdir/gnome-keyring @@ -0,0 +1,23 @@ +# GNOME keyring +# Contributed by Josh Triplett +# FIXME: Could be simplified if pstring supported two-byte counts +0 string GnomeKeyring\n\r\0\n GNOME keyring +>&0 ubyte 0 \b, major version 0 +>>&0 ubyte 0 \b, minor version 0 +>>>&0 ubyte 0 \b, crypto type 0 (AEL) +>>>&0 ubyte >0 \b, crypto type %hhu (unknown) +>>>&1 ubyte 0 \b, hash type 0 (MD5) +>>>&1 ubyte >0 \b, hash type %hhu (unknown) +>>>&2 ubelong 0xFFFFFFFF \b, name NULL +>>>&2 ubelong !0xFFFFFFFF +>>>>&-4 ubelong >255 \b, name too long for file's pstring type +>>>>&-4 ubelong <256 +>>>>>&-1 pstring x \b, name "%s" +>>>>>>&0 ubeqdate x \b, last modified %s +>>>>>>&8 ubeqdate x \b, created %s +>>>>>>&16 ubelong &1 +>>>>>>>&0 ubelong x \b, locked if idle for %u seconds +>>>>>>&16 ubelong ^1 \b, not locked if idle +>>>>>>&24 ubelong x \b, hash iterations %u +>>>>>>&28 ubequad x \b, salt %llu +>>>>>>&52 ubelong x \b, %u item(s) diff --git a/contrib/file/magic/Magdir/gnu b/contrib/file/magic/Magdir/gnu index 42d9c7bc68..66c670c55f 100644 --- a/contrib/file/magic/Magdir/gnu +++ b/contrib/file/magic/Magdir/gnu @@ -17,10 +17,14 @@ # The format is very similar to pgp 0 string \001gpg GPG key trust database >4 byte x version %d +# Note: magic.mime had 0x8501 for the next line instead of 0x8502 0 beshort 0x8502 GPG encrypted data +!:mime text/PGP # encoding: data + # This magic is not particularly good, as the keyrings don't have true # magic. Nevertheless, it covers many keyrings. 0 beshort 0x9901 GPG key public ring +!:mime application/x-gnupg-keyring # Gnumeric spreadsheet # This entry is only semi-helpful, as Gnumeric compresses its files, so @@ -32,3 +36,7 @@ 0 string \0LOCATE GNU findutils locate database data >7 string >\0 \b, format %s >7 string 02 \b (frcode) + +# Files produced by GNU gettext +0 long 0xDE120495 GNU-format message catalog data +0 long 0x950412DE GNU-format message catalog data diff --git a/contrib/file/magic/Magdir/gnumeric b/contrib/file/magic/Magdir/gnumeric new file mode 100644 index 0000000000..76dfa90684 --- /dev/null +++ b/contrib/file/magic/Magdir/gnumeric @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# gnumeric: file(1) magic for Gnumeric spreadsheet +# This entry is only semi-helpful, as Gnumeric compresses its files, so +# they will ordinarily reported as "compressed", but at least -z helps +39 string =8 long >0 %d messages -# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 -0 string HPHP48- HP48 binary ->7 byte >0 - Rev %c ->8 beshort 0x1129 (ADR) ->8 beshort 0x3329 (REAL) ->8 beshort 0x5529 (LREAL) ->8 beshort 0x7729 (COMPLX) ->8 beshort 0x9d29 (LCOMPLX) ->8 beshort 0xbf29 (CHAR) ->8 beshort 0xe829 (ARRAY) ->8 beshort 0x0a2a (LNKARRAY) ->8 beshort 0x2c2a (STRING) ->8 beshort 0x4e2a (HXS) ->8 beshort 0x742a (LIST) ->8 beshort 0x962a (DIR) ->8 beshort 0xb82a (ALG) ->8 beshort 0xda2a (UNIT) ->8 beshort 0xfc2a (TAGGED) ->8 beshort 0x1e2b (GROB) ->8 beshort 0x402b (LIB) ->8 beshort 0x622b (BACKUP) ->8 beshort 0x882b (LIBDATA) ->8 beshort 0x9d2d (PROG) ->8 beshort 0xcc2d (CODE) ->8 beshort 0x482e (GNAME) ->8 beshort 0x6d2e (LNAME) ->8 beshort 0x922e (XLIB) -0 string %%HP: HP48 text +# Summary: HP-48/49 calculator +# Created by: phk@data.fls.dk +# Modified by (1): AMAKAWA Shuhei +# Modified by (2): Samuel Thibault (HP49 support) +0 string HPHP HP +>4 string 48 48 binary +>4 string 49 49 binary +>7 byte >64 - Rev %c +>8 leshort 0x2911 (ADR) +>8 leshort 0x2933 (REAL) +>8 leshort 0x2955 (LREAL) +>8 leshort 0x2977 (COMPLX) +>8 leshort 0x299d (LCOMPLX) +>8 leshort 0x29bf (CHAR) +>8 leshort 0x29e8 (ARRAY) +>8 leshort 0x2a0a (LNKARRAY) +>8 leshort 0x2a2c (STRING) +>8 leshort 0x2a4e (HXS) +>8 leshort 0x2a74 (LIST) +>8 leshort 0x2a96 (DIR) +>8 leshort 0x2ab8 (ALG) +>8 leshort 0x2ada (UNIT) +>8 leshort 0x2afc (TAGGED) +>8 leshort 0x2b1e (GROB) +>8 leshort 0x2b40 (LIB) +>8 leshort 0x2b62 (BACKUP) +>8 leshort 0x2b88 (LIBDATA) +>8 leshort 0x2d9d (PROG) +>8 leshort 0x2dcc (CODE) +>8 leshort 0x2e48 (GNAME) +>8 leshort 0x2e6d (LNAME) +>8 leshort 0x2e92 (XLIB) + +0 string %%HP: HP text >6 string T(0) - T(0) >6 string T(1) - T(1) >6 string T(2) - T(2) @@ -240,6 +245,45 @@ >14 string F(.) F(.); >14 string F(,) F(,); + +# Summary: HP-38/39 calculator +# Created by: Samuel Thibault +0 string HP3 +>3 string 8 HP 38 +>3 string 9 HP 39 +>4 string Bin binary +>4 string Asc ASCII +>7 string A (Directory List) +>7 string B (Zaplet) +>7 string C (Note) +>7 string D (Program) +>7 string E (Variable) +>7 string F (List) +>7 string G (Matrix) +>7 string H (Library) +>7 string I (Target List) +>7 string J (ASCII Vector specification) +>7 string K (wildcard) + +# Summary: HP-38/39 calculator +# Created by: Samuel Thibault +0 string HP3 +>3 string 8 HP 38 +>3 string 9 HP 39 +>4 string Bin binary +>4 string Asc ASCII +>7 string A (Directory List) +>7 string B (Zaplet) +>7 string C (Note) +>7 string D (Program) +>7 string E (Variable) +>7 string F (List) +>7 string G (Matrix) +>7 string H (Library) +>7 string I (Target List) +>7 string J (ASCII Vector specification) +>7 string K (wildcard) + # hpBSD magic numbers 0 beshort 200 hp200 (68010) BSD >2 beshort 0407 impure binary @@ -390,6 +434,4 @@ >>>>>>>>>0xC4 belong 33 - received SIGXCPU >>>>>>>>>0xC4 belong 34 - received SIGXFSZ -# From: AMAKAWA Shuhei -0 string HPHP49- HP49 binary diff --git a/contrib/file/magic/Magdir/iff b/contrib/file/magic/Magdir/iff index 3c88f9039c..4d2a832c6e 100644 --- a/contrib/file/magic/Magdir/iff +++ b/contrib/file/magic/Magdir/iff @@ -13,8 +13,11 @@ #>4 belong x \b, FORM is %d bytes long # audio formats >8 string AIFF \b, AIFF audio +!:mime audio/x-aiff >8 string AIFC \b, AIFF-C compressed audio +!:mime audio/x-aiff >8 string 8SVX \b, 8SVX 8-bit sampled sound voice +!:mime audio/x-aiff >8 string 16SV \b, 16SV 16-bit sampled sound voice >8 string SAMP \b, SAMP sampled audio >8 string MAUD \b, MAUD MacroSystem audio diff --git a/contrib/file/magic/Magdir/images b/contrib/file/magic/Magdir/images index fd9e14f9fd..7eacf862fa 100644 --- a/contrib/file/magic/Magdir/images +++ b/contrib/file/magic/Magdir/images @@ -1,6 +1,6 @@ - #------------------------------------------------------------------------------ -# images: file(1) magic for image formats (see also "iff") +# images: file(1) magic for image formats (see also "iff", and "c-lang" for +# XPM bitmaps) # # originally from jef@helios.ee.lbl.gov (Jef Poskanzer), # additions by janl@ifi.uio.no as well as others. Jan also suggested @@ -30,13 +30,20 @@ # PBMPLUS images # The next byte following the magic is always whitespace. -0 string P1 Netpbm PBM image text -0 string P2 Netpbm PGM image text -0 string P3 Netpbm PPM image text +0 search/1 P1 Netpbm PBM image text +!:mime image/x-portable-bitmap +0 search/1 P2 Netpbm PGM image text +!:mime image/x-portable-greymap +0 search/1 P3 Netpbm PPM image text +!:mime image/x-portable-pixmap 0 string P4 Netpbm PBM "rawbits" image data +!:mime image/x-portable-bitmap 0 string P5 Netpbm PGM "rawbits" image data +!:mime image/x-portable-greymap 0 string P6 Netpbm PPM "rawbits" image data +!:mime image/x-portable-pixmap 0 string P7 Netpbm PAM image file +!:mime image/x-portable-pixmap # From: bryanh@giraffe-data.com (Bryan Henderson) 0 string \117\072 Solitaire Image Recorder format @@ -50,13 +57,17 @@ >21 byte 51 version 3 # NIFF (Navy Interchange File Format, a modification of TIFF) images +# [GRR: this *must* go before TIFF] 0 string IIN1 NIFF image data +!:mime image/x-niff # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) # The second word of TIFF files is the TIFF version number, 42, which has # never changed. The TIFF specification recommends testing for it. 0 string MM\x00\x2a TIFF image data, big-endian +!:mime image/tiff 0 string II\x2a\x00 TIFF image data, little-endian +!:mime image/tiff # PNG [Portable Network Graphics, or "PNG's Not GIF"] images # (Greg Roelofs, newt@uchicago.edu) @@ -64,24 +75,42 @@ # # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... # -0 string \x89PNG PNG image data, ->4 belong !0x0d0a1a0a CORRUPTED, ->4 belong 0x0d0a1a0a ->>16 belong x %ld x ->>20 belong x %ld, ->>24 byte x %d-bit ->>25 byte 0 grayscale, ->>25 byte 2 \b/color RGB, ->>25 byte 3 colormap, ->>25 byte 4 gray+alpha, ->>25 byte 6 \b/color RGBA, -#>>26 byte 0 deflate/32K, ->>28 byte 0 non-interlaced ->>28 byte 1 interlaced -1 string PNG PNG image data, CORRUPTED +0 string \x89PNG\x0d\x0a\x1a\x0a PNG image +!:mime image/png +>16 belong x \b, %ld x +>20 belong x %ld, +>24 byte x %d-bit +>25 byte 0 grayscale, +>25 byte 2 \b/color RGB, +>25 byte 3 colormap, +>25 byte 4 gray+alpha, +>25 byte 6 \b/color RGBA, +#>26 byte 0 deflate/32K, +>28 byte 0 non-interlaced +>28 byte 1 interlaced + +# possible GIF replacements; none yet released! +# (Greg Roelofs, newt@uchicago.edu) +# +# GRR 950115: this was mine ("Zip GIF"): +0 string GIF94z ZIF image (GIF+deflate alpha) +!:mime image/x-unknown +# +# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): +# +0 string FGF95a FGF image (GIF+deflate beta) +!:mime image/x-unknown +# +# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal +# (best; not yet implemented): +# +0 string PBF PBF image (deflate compression) +!:mime image/x-unknown # GIF 0 string GIF8 GIF image data +!:mime image/gif +!:apple 8BIMGIFf >4 string 7a \b, version 8%s, >4 string 9a \b, version 8%s, >6 leshort >0 %hd x @@ -113,7 +142,7 @@ >4 long 3 \b, rectangular 32-bit (24-bit with matte) # FIG (Facility for Interactive Generation of figures), an object-based format -0 string #FIG FIG image text +0 search/1 #FIG FIG image text >5 string x \b, version %.3s # PHIGS @@ -129,9 +158,6 @@ # CGM image files 0 string BEGMF clear text Computer Graphics Metafile -# XXX - questionable magic -0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile -0 beshort 0x3020 character Computer Graphics Metafile # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 0 string yz MGR bitmap, modern format, 8-bit aligned @@ -152,15 +178,23 @@ 0 string Sfff structured fax file -# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu) -0 string BM PC bitmap data ->14 leshort 12 \b, OS/2 1.x format +# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) +0 string BM +>14 leshort 12 PC bitmap, OS/2 1.x format +!:mime image/x-ms-bmp >>18 leshort x \b, %d x >>20 leshort x %d ->14 leshort 64 \b, OS/2 2.x format +>14 leshort 64 PC bitmap, OS/2 2.x format +!:mime image/x-ms-bmp >>18 leshort x \b, %d x >>20 leshort x %d ->14 leshort 40 \b, Windows 3.x format +>14 leshort 40 PC bitmap, Windows 3.x format +!:mime image/x-ms-bmp +>>18 lelong x \b, %d x +>>22 lelong x %d x +>>28 leshort x %d +>14 leshort 128 PC bitmap, Windows NT/2000 format +!:mime image/x-ms-bmp >>18 lelong x \b, %d x >>22 lelong x %d x >>28 leshort x %d @@ -174,7 +208,7 @@ # XPM icons (Greg Roelofs, newt@uchicago.edu) # note possible collision with C/REXX entry in c-lang; currently commented out -0 string /*\ XPM\ */ X pixmap image text +0 search/1 /*\ XPM\ */ X pixmap image text # Utah Raster Toolkit RLE images (janl@ifi.uio.no) 0 leshort 0xcc52 RLE image data, @@ -260,7 +294,6 @@ # other images 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file -0 string =!! Bennet Yee's "face" format # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image # stuff. @@ -269,6 +302,7 @@ # DICOM medical imaging data 128 string DICM DICOM medical imaging data +!:mime application/dicom # XWD - X Window Dump file. # As described in /usr/X11R6/include/X11/XWDFile.h @@ -367,6 +401,7 @@ # Adobe Photoshop 0 string 8BPS Adobe Photoshop Image +!:mime image/vnd.adobe.photoshop # XV thumbnail indicator (ThMO) 0 string P7\ 332 XV thumbnail image data @@ -456,9 +491,9 @@ >12 long x \b, track size %d bytes >16 byte x \b, device type 33%2.2X -# Squeak images and - etoffi@softhome.net -0 string \146\031\0\0 Squeak image data -0 string 'From\040Squeak Squeak program text +# Squeak images and programs - etoffi@softhome.net +0 string \146\031\0\0 Squeak image data +0 search/1 'From\040Squeak Squeak program text # partimage: file(1) magic for PartImage files (experimental, incomplete) # Author: Hans-Joachim Baader @@ -505,12 +540,18 @@ # http://www.dalibor.cz/minolta/raw_file_format.htm 0 string \000MRM Minolta Dimage camera raw image data -# From: stephane.loeuillet@tiscali.f -# http://www.djvuzone.org/ -0 string AT&TFORM DjVu Image file +# Summary: DjVu image / document +# Extension: .djvu +# Reference: http://djvu.org/docs/DjVu3Spec.djvu +# Submitted by: Stephane Loeuillet +# Modified by (1): Abel Cheung +0 string AT&TFORM +!:mime image/vnd.djvu +>12 string DJVM DjVu multiple page document +>12 string DJVU DjVu image or single page document +>12 string DJVI DjVu shared document +>12 string THUM DjVu page thumbnails -# From: Jason Bacon -0 beshort 0x3020 character Computer Graphics Metafile # From Marc Espie 0 lelong 20000630 OpenEXR image data @@ -523,9 +564,44 @@ # Hierarchical Data Format, used to facilitate scientific data exchange # specifications at http://hdf.ncsa.uiuc.edu/ 0 belong 0x0e031301 Hierarchical Data Format (version 4) data +!:mime application/x-hdf 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data +!:mime application/x-hdf # From: Tobias Burnus # Xara (for a while: Corel Xara) is a graphic package, see -# http://www.xara.com/ for Windows and as GPL application for +# http://www.xara.com/ for Windows and as GPL application for Linux 0 string XARA\243\243 Xara graphics file + +# http://www.cartesianinc.com/Tech/ +0 string CPC\262 Cartesian Perceptual Compression image +!:mime image/x-cpi + +# From Albert Cahalan +# puredigital used it for the CVS disposable camcorder +#8 lelong 4 ZBM bitmap image data +#>4 leshort x %u x +#>6 leshort x %u + +# From Albert Cahalan +# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons +0 string C565 OLPC firmware icon image data +>4 leshort x %u x +>6 leshort x %u + +# Applied Images - Image files from Cytovision +# Gustavo Junior Alves +0 string \xce\xda\xde\xfa Cytovision Metaphases file +0 string \xed\xad\xef\xac Cytovision Karyotype file +0 string \x0b\x00\x03\x00 Cytovision FISH Probe file +0 string \xed\xfe\xda\xbe Cytovision FLEX file +0 string \xed\xab\xed\xfe Cytovision FLEX file +0 string \xad\xfd\xea\xad Cytovision RATS file + +# Wavelet Scalar Quantization format used in gray-scale fingerprint images +# From Tano M Fotang +0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data + +# JPEG 2000 Code Stream Bitmap +# From Petr Splichal +0 string \xFF\x4F\xFF\x51\x00 JPEG-2000 Code Stream Bitmap data diff --git a/contrib/file/magic/Magdir/inform b/contrib/file/magic/Magdir/inform new file mode 100644 index 0000000000..ba35d61e04 --- /dev/null +++ b/contrib/file/magic/Magdir/inform @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# inform: file(1) magic for Inform interactive fiction language + +# URL: http://www.inform-fiction.org/ +# From: Reuben Thomas + +0 search/cB/100 constant\ story Inform source text diff --git a/contrib/file/magic/Magdir/java b/contrib/file/magic/Magdir/java index 971b72ceb3..cca5542c1f 100644 --- a/contrib/file/magic/Magdir/java +++ b/contrib/file/magic/Magdir/java @@ -9,8 +9,9 @@ >2 beshort >0x0004 \b, version %d 0 belong 0xfeedfeed Java KeyStore - +!:mime application/x-java-keystore 0 belong 0xcececece Java JCE KeyStore +!:mime application/x-java-jce-keystore # Dalvik .dex format. http://retrodev.com/android/dexformat.html # From "Mike Fleming" diff --git a/contrib/file/magic/Magdir/jpeg b/contrib/file/magic/Magdir/jpeg index af646d6fb9..4470be4adf 100644 --- a/contrib/file/magic/Magdir/jpeg +++ b/contrib/file/magic/Magdir/jpeg @@ -9,6 +9,9 @@ # both of which turn into "JPEG image data" here. # 0 beshort 0xffd8 JPEG image data +!:mime image/jpeg +!:apple 8BIMJPEG +!:strength +1 >6 string JFIF \b, JFIF standard # The following added by Erik Rossen 1999-09-06 # in a vain attempt to add image size reporting for JFIF. Note that these @@ -125,6 +128,8 @@ # At least we can show a comment if no other segments got inserted before: >(4.S+5) byte 0xFE >>(4.S+8) string >\0 \b, comment: "%s" +# FIXME: When we can do non-byte counted strings, we can use that to get +# the string's count, and fix Debian bug #283760 #>(4.S+5) byte 0xFE \b, comment #>>(4.S+6) beshort x \b length=%d #>>(4.S+8) string >\0 \b, "%s" @@ -153,3 +158,8 @@ # From: David Santinoli 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data + +# Type: JPEG 2000 codesream +# From: Mathieu Malaterre +0 belong 0xff4fff51 JPEG 2000 codestream +45 beshort 0xff52 diff --git a/contrib/file/magic/Magdir/kde b/contrib/file/magic/Magdir/kde new file mode 100644 index 0000000000..d81ee693fd --- /dev/null +++ b/contrib/file/magic/Magdir/kde @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# kde: file(1) magic for KDE + +0 string [KDE\ Desktop\ Entry] KDE desktop entry +!:mime application/x-kdelnk +0 string #\ KDE\ Config\ File KDE config file +!:mime application/x-kdelnk +0 string #\ xmcd xmcd database file for kscd +!:mime text/x-xmcd diff --git a/contrib/file/magic/Magdir/kml b/contrib/file/magic/Magdir/kml new file mode 100644 index 0000000000..5b59b9e555 --- /dev/null +++ b/contrib/file/magic/Magdir/kml @@ -0,0 +1,32 @@ +#------------------------------------------------------------------------------ +# Type: Google KML, formerly Keyhole Markup Language +# Future development of this format has been handed +# over to the Open Geospatial Consortium. +# http://www.opengeospatial.org/standards/kml/ +# From: Asbjoern Sloth Toennesen +0 string \20 search/400 \ xmlns= +>>&0 regex ['"]http://earth.google.com/kml Google KML document +!:mime application/vnd.google-earth.kml+xml +>>>&1 string 2.0' \b, version 2.0 +>>>&1 string 2.1' \b, version 2.1 +>>>&1 string 2.2' \b, version 2.2 + +#------------------------------------------------------------------------------ +# Type: OpenGIS KML, formerly Keyhole Markup Language +# This standard is maintained by the +# Open Geospatial Consortium. +# http://www.opengeospatial.org/standards/kml/ +# From: Asbjoern Sloth Toennesen +>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document +!:mime application/vnd.google-earth.kml+xml +>>>&1 string 2.2 \b, version 2.2 + +#------------------------------------------------------------------------------ +# Type: Google KML Archive (ZIP based) +# http://code.google.com/apis/kml/documentation/kml_tut.html +# From: Asbjoern Sloth Toennesen +0 string PK\003\004 +>4 byte 0x14 +>>30 string doc.kml Compressed Google KML Document, including resources. +!:mime application/vnd.google-earth.kmz diff --git a/contrib/file/magic/Magdir/lex b/contrib/file/magic/Magdir/lex index 7b6d0f74a4..eae9b107c2 100644 --- a/contrib/file/magic/Magdir/lex +++ b/contrib/file/magic/Magdir/lex @@ -1,11 +1,10 @@ - #------------------------------------------------------------------------------ # lex: file(1) magic for lex # # derived empirically, your offsets may vary! -53 string yyprevious C program text (from lex) ->3 string >\0 for %s +0 search/100 yyprevious C program text (from lex) +>3 search/1 >\0 for %s # C program text from GNU flex, from Daniel Quinlan -21 string generated\ by\ flex C program text (from flex) +0 search/100 generated\ by\ flex C program text (from flex) # lex description file, from Daniel Quinlan -0 string %{ lex description text +0 search/1 %{ lex description text diff --git a/contrib/file/magic/Magdir/linux b/contrib/file/magic/Magdir/linux index fe68013a16..83d4305d0a 100644 --- a/contrib/file/magic/Magdir/linux +++ b/contrib/file/magic/Magdir/linux @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # linux: file(1) magic for Linux files # @@ -84,8 +83,8 @@ # Linux kernel boot images (i386 arch) (Wolfram Kleff) 514 string HdrS Linux kernel >510 leshort 0xAA55 x86 boot executable ->>518 leshort >=0x200 ->>529 byte 0 zImage, +>>518 leshort >0x1ff +>>>529 byte 0 zImage, >>>529 byte 1 bzImage, >>>(526.s+0x200) string >\0 version %s, >>498 leshort 1 RO-rootFS, @@ -103,16 +102,18 @@ >0x1e9 string Loading from prehistoric times # System.map files - Nicolás Lichtmaier -8 string \ A\ _text Linux kernel symbol map text +8 search/1 \ A\ _text Linux kernel symbol map text # LSM entries - Nicolás Lichtmaier -0 string Begin3 Linux Software Map entry text -0 string Begin4 Linux Software Map entry text (new format) +0 search/1 Begin3 Linux Software Map entry text +0 search/1 Begin4 Linux Software Map entry text (new format) -# From Matt Zimmerman -0 belong 0x4f4f4f4d User-mode Linux COW file ->4 belong x \b, version %d ->8 string >\0 \b, backing file %s +# From Matt Zimmerman, enhanced for v3 by Matthew Palmer +0 belong 0x4f4f4f4d User-mode Linux COW file +>4 belong <3 \b, version %d +>>8 string >\0 \b, backing file %s +>4 belong >2 \b, version %d +>>32 string >\0 \b, backing file %s ############################################################################ # Linux kernel versions @@ -230,6 +231,14 @@ 0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) >(0x614.l+0x600) string >\0 , UUID: %s +# LVM snapshot +# from Jason Farrel +0 string SnAp LVM Snapshot (CopyOnWrite store) +>4 lelong !0 - valid, +>4 lelong 0 - invalid, +>8 lelong x version %d, +>12 lelong x chunk_size %d + # SE Linux policy database 0 lelong 0xf97cff8c SE Linux policy >16 lelong x v%d @@ -246,3 +255,10 @@ >72 string x %s] >168 string x UUID: %s + +# Summary: Xen saved domain file +# Created by: Radek Vokal +0 string LinuxGuestRecord Xen saved domain +>20 search/256 (name +>>&1 string x (name %s) + diff --git a/contrib/file/magic/Magdir/lisp b/contrib/file/magic/Magdir/lisp index e9c8ba8ec4..c6f31dae42 100644 --- a/contrib/file/magic/Magdir/lisp +++ b/contrib/file/magic/Magdir/lisp @@ -1,44 +1,52 @@ - #------------------------------------------------------------------------------ # lisp: file(1) magic for lisp programs # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) # updated by Joerg Jenderek -0 string ;; +# GRR: This lot is too weak +#0 string ;; # windows INF files often begin with semicolon and use CRLF as line end # lisp files are mainly created on unix system with LF as line end ->2 search/2048 !\r Lisp/Scheme program text ->2 search/2048 \r Windows INF file - -0 search/256 (if\ Lisp/Scheme program text -0 search/256 (setq\ Lisp/Scheme program text -0 search/256 (defvar\ Lisp/Scheme program text -0 search/256 (defparam\ Lisp/Scheme program text -0 search/256 (defun\ Lisp/Scheme program text -0 search/256 (autoload\ Lisp/Scheme program text -0 search/256 (custom-set-variables\ Lisp/Scheme program text +#>2 search/4096 !\r Lisp/Scheme program text +#>2 search/4096 \r Windows INF file + +0 search/4096 (if\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (setq\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (defvar\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (defparam\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (defun\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (autoload\ Lisp/Scheme program text +!:mime text/x-lisp +0 search/4096 (custom-set-variables\ Lisp/Scheme program text +!:mime text/x-lisp # Emacs 18 - this is always correct, but not very magical. 0 string \012( Emacs v18 byte-compiled Lisp data +!:mime application/x-elc # Emacs 19+ - ver. recognition added by Ian Springer -# Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp -# support or similar - Chris Chittleborough -0 string ;ELC ->4 byte >19 +# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs +# - Chris Chittleborough +0 string ;ELC +>4 byte >18 >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data +!:mime application/x-elc # Files produced by CLISP Common Lisp From: Bruno Haible -0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text +0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) +0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text + 0 long 0x70768BD2 CLISP memory image data 0 long 0xD28B7670 CLISP memory image data, other endian -# Files produced by GNU gettext -0 long 0xDE120495 GNU-format message catalog data -0 long 0x950412DE GNU-format message catalog data - #.com and .bin for MIT scheme 0 string \372\372\372\372 MIT scheme (library?) # From: David Allouche -0 string \ + +0 string llvm LLVM byte-codes, uncompressed +0 string llvc0 LLVM byte-codes, null compression +0 string llvc1 LLVM byte-codes, gzip compression +0 string llvc2 LLVM byte-codes, bzip2 compression diff --git a/contrib/file/magic/Magdir/lua b/contrib/file/magic/Magdir/lua new file mode 100644 index 0000000000..9aa87b159c --- /dev/null +++ b/contrib/file/magic/Magdir/lua @@ -0,0 +1,19 @@ +#------------------------------------------------------------------------------ +# lua: file(1) magic for Lua scripting language +# URL: http://www.lua.org/ +# From: Reuben Thomas , Seo Sanghyeon + +# Lua scripts +0 search/1/b #!\ /usr/bin/lua Lua script text executable +!:mime text/x-lua +0 search/1/b #!\ /usr/local/bin/lua Lua script text executable +!:mime text/x-lua +0 search/1 #!/usr/bin/env\ lua Lua script text executable +!:mime text/x-lua +0 search/1 #!\ /usr/bin/env\ lua Lua script text executable +!:mime text/x-lua + +# Lua bytecode +0 string \033Lua Lua bytecode, +>4 byte 0x50 version 5.0 +>4 byte 0x51 version 5.1 diff --git a/contrib/file/magic/Magdir/luks b/contrib/file/magic/Magdir/luks new file mode 100644 index 0000000000..2ab23935ef --- /dev/null +++ b/contrib/file/magic/Magdir/luks @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# luks: file(1) magic for Linux Unified Key Setup +# URL: http://luks.endorphin.org/spec +# From: Anthon van der Neut + +0 string LUKS\xba\xbe LUKS encrypted file, +>6 beshort x ver %d +>8 string x [%s, +>40 string x %s, +>72 string x %s] +>168 string x UUID: %s diff --git a/contrib/file/magic/Magdir/mach b/contrib/file/magic/Magdir/mach index cced3a5873..e53be0737d 100644 --- a/contrib/file/magic/Magdir/mach +++ b/contrib/file/magic/Magdir/mach @@ -4,7 +4,7 @@ # Java ByteCode, so they are both handled in the file "cafebabe". # The "feedface" ones are handled herein. #------------------------------------------------------------ -0 lelong&0xfeffffff 0xfeedface Mach-O +0 lelong&0xfffffffe 0xfeedface Mach-O >0 byte 0xcf 64-bit >12 lelong 1 object >12 lelong 2 executable diff --git a/contrib/file/magic/Magdir/macintosh b/contrib/file/magic/Magdir/macintosh index 4acd5c88e1..ca665ded8c 100644 --- a/contrib/file/magic/Magdir/macintosh +++ b/contrib/file/magic/Magdir/macintosh @@ -5,11 +5,14 @@ # BinHex is the Macintosh ASCII-encoded file format (see also "apple") # Daniel Quinlan, quinlan@yggdrasil.com 11 string must\ be\ converted\ with\ BinHex BinHex binary text +!:mime application/mac-binhex40 >41 string x \b, version %.3s # Stuffit archives are the de facto standard of compression for Macintosh # files obtained from most archives. (franklsm@tuns.ca) 0 string SIT! StuffIt Archive (data) +!:mime application/x-stuffit +!:apple SIT!SIT! >2 string x : %s 0 string SITD StuffIt Deluxe (data) >2 string x : %s @@ -18,37 +21,42 @@ # Newer StuffIt archives (grant@netbsd.org) 0 string StuffIt StuffIt Archive +!:mime application/x-stuffit +!:apple SIT!SIT! #>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@tuns.ca) -0 string APPL Macintosh Application (data) ->2 string x \b: %s +# GRR: Too weak +#0 string APPL Macintosh Application (data) +#>2 string x \b: %s # Macintosh System files (franklsm@tuns.ca) -0 string zsys Macintosh System File (data) -0 string FNDR Macintosh Finder (data) -0 string libr Macintosh Library (data) ->2 string x : %s -0 string shlb Macintosh Shared Library (data) ->2 string x : %s -0 string cdev Macintosh Control Panel (data) ->2 string x : %s -0 string INIT Macintosh Extension (data) ->2 string x : %s -0 string FFIL Macintosh Truetype Font (data) ->2 string x : %s -0 string LWFN Macintosh Postscript Font (data) ->2 string x : %s +# GRR: Too weak +#0 string zsys Macintosh System File (data) +#0 string FNDR Macintosh Finder (data) +#0 string libr Macintosh Library (data) +#>2 string x : %s +#0 string shlb Macintosh Shared Library (data) +#>2 string x : %s +#0 string cdev Macintosh Control Panel (data) +#>2 string x : %s +#0 string INIT Macintosh Extension (data) +#>2 string x : %s +#0 string FFIL Macintosh Truetype Font (data) +#>2 string x : %s +#0 string LWFN Macintosh Postscript Font (data) +#>2 string x : %s # Additional Macintosh Files (franklsm@tuns.ca) -0 string PACT Macintosh Compact Pro Archive (data) ->2 string x : %s -0 string ttro Macintosh TeachText File (data) ->2 string x : %s -0 string TEXT Macintosh TeachText File (data) ->2 string x : %s -0 string PDF Macintosh PDF File (data) ->2 string x : %s +# GRR: Too weak +#0 string PACT Macintosh Compact Pro Archive (data) +#>2 string x : %s +#0 string ttro Macintosh TeachText File (data) +#>2 string x : %s +#0 string TEXT Macintosh TeachText File (data) +#>2 string x : %s +#0 string PDF Macintosh PDF File (data) +#>2 string x : %s # MacBinary format (Eric Fischer, enf@pobox.com) # @@ -320,41 +328,50 @@ # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a # cstring. Of course, partitions can contain more than four entries, but # what're you gonna do? -0x200 beshort 0x504D Apple Partition data ->0x2 beshort x block size: %d, ->0x230 string x first type: %s, ->0x210 string x name: %s, ->0x254 belong x number of blocks: %d, ->0x400 beshort 0x504D ->>0x430 string x second type: %s, ->>0x410 string x name: %s, ->>0x454 belong x number of blocks: %d, ->>0x800 beshort 0x504D ->>>0x830 string x third type: %s, ->>>0x810 string x name: %s, ->>>0x854 belong x number of blocks: %d, ->>>0xa00 beshort 0x504D ->>>>0xa30 string x fourth type: %s, ->>>>0xa10 string x name: %s, ->>>>0xa54 belong x number of blocks: %d -# AFAIK, only the signature is different -0x200 beshort 0x5453 Apple Old Partition data ->0x2 beshort x block size: %d, ->0x230 string x first type: %s, ->0x210 string x name: %s, ->0x254 belong x number of blocks: %d, ->0x400 beshort 0x504D ->>0x430 string x second type: %s, ->>0x410 string x name: %s, ->>0x454 belong x number of blocks: %d, ->>0x800 beshort 0x504D ->>>0x830 string x third type: %s, ->>>0x810 string x name: %s, ->>>0x854 belong x number of blocks: %d, ->>>0xa00 beshort 0x504D ->>>>0xa30 string x fourth type: %s, ->>>>0xa10 string x name: %s, ->>>>0xa54 belong x number of blocks: %d +# GRR: This magic is too weak, it is just "PM" +#0x200 beshort 0x504D Apple Partition data +#>0x2 beshort x (block size: %d): +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x600 beshort 0x504D +#>>>0x630 string x third type: %s, +#>>>0x610 string x name: %s, +#>>>0x654 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x fourth type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fifth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d +#>>>0xc00 beshort 0x504D +#>>>>0xc30 string x sixth type: %s, +#>>>>0xc10 string x name: %s, +#>>>>0xc54 belong x number of blocks: %d +## AFAIK, only the signature is different +#0x200 beshort 0x5453 Apple Old Partition data +#>0x2 beshort x block size: %d, +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x third type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fourth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d # From: Remi Mommsen 0 string BOMStore Mac OS X bill of materials (BOM) file diff --git a/contrib/file/magic/Magdir/mail.news b/contrib/file/magic/Magdir/mail.news index f08261ca3a..0b9d90a4e2 100644 --- a/contrib/file/magic/Magdir/mail.news +++ b/contrib/file/magic/Magdir/mail.news @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # mail.news: file(1) magic for mail and news # @@ -6,17 +5,28 @@ #0 string From mail text # There are tests to ascmagic.c to cope with mail and news. 0 string Relay-Version: old news text +!:mime message/rfc822 0 string #!\ rnews batched news text +!:mime message/rfc822 0 string N#!\ rnews mailed, batched news text +!:mime message/rfc822 0 string Forward\ to mail forwarding text +!:mime message/rfc822 0 string Pipe\ to mail piping text +!:mime message/rfc822 0 string Return-Path: smtp mail text +!:mime message/rfc822 0 string Path: news text +!:mime message/news 0 string Xref: news text +!:mime message/news 0 string From: news or mail text +!:mime message/rfc822 0 string Article saved news text +!:mime message/news 0 string BABYL Emacs RMAIL text 0 string Received: RFC 822 mail text +!:mime message/rfc822 0 string MIME-Version: MIME entity text #0 string Content- MIME entity text @@ -39,3 +49,5 @@ # XXX: Weak magic #256 leshort 0xAFAE4453 Squish message area data file #>4 leshort >0 (%d messages) + +#0 string \