From e88a9a209f1faac286add2eddf2565a220f68876 Mon Sep 17 00:00:00 2001 From: Sascha Wildner Date: Fri, 8 May 2020 13:33:55 +0200 Subject: [PATCH] vendor/file: upgrade from 5.32 to 5.38 Submitted-by: Daniel Fojt --- contrib/file/COPYING | 4 +- contrib/file/ChangeLog | 161 ++++- contrib/file/README | 132 ++--- contrib/file/README.DELETED | 41 -- contrib/file/README.DRAGONFLY | 9 - contrib/file/doc/file.man | 170 ++++-- contrib/file/doc/libmagic.man | 23 +- contrib/file/doc/magic.man | 46 +- contrib/file/magic/Header | 2 +- contrib/file/magic/Magdir/acorn | 35 +- contrib/file/magic/Magdir/adventure | 8 +- contrib/file/magic/Magdir/algol68 | 10 +- contrib/file/magic/Magdir/amigaos | 21 +- contrib/file/magic/Magdir/android | 61 +- contrib/file/magic/Magdir/animation | 186 +++--- contrib/file/magic/Magdir/apple | 141 ++++- contrib/file/magic/Magdir/archive | 586 +++++++++++++++--- contrib/file/magic/Magdir/audio | 378 +++++++++++- contrib/file/magic/Magdir/basis | 4 +- contrib/file/magic/Magdir/beetle | 7 + contrib/file/magic/Magdir/ber | 6 +- contrib/file/magic/Magdir/bioinformatics | 8 +- contrib/file/magic/Magdir/biosig | 154 +++++ contrib/file/magic/Magdir/blcr | 2 +- contrib/file/magic/Magdir/blender | 4 +- contrib/file/magic/Magdir/bsi | 2 +- contrib/file/magic/Magdir/c-lang | 71 ++- contrib/file/magic/Magdir/c64 | 13 +- contrib/file/magic/Magdir/cad | 242 ++++++-- contrib/file/magic/Magdir/cafebabe | 12 +- contrib/file/magic/Magdir/clojure | 30 + contrib/file/magic/Magdir/coff | 6 +- contrib/file/magic/Magdir/commands | 9 +- contrib/file/magic/Magdir/compress | 142 ++++- contrib/file/magic/Magdir/console | 244 ++++++-- contrib/file/magic/Magdir/coverage | 12 +- contrib/file/magic/Magdir/ctf | 2 +- contrib/file/magic/Magdir/cups | 4 +- contrib/file/magic/Magdir/database | 79 +-- contrib/file/magic/Magdir/dataone | 47 ++ contrib/file/magic/Magdir/dbpf | 15 + contrib/file/magic/Magdir/dolby | 4 +- contrib/file/magic/Magdir/dump | 14 +- contrib/file/magic/Magdir/dyadic | 6 +- contrib/file/magic/Magdir/ebml | 4 +- contrib/file/magic/Magdir/edid | 11 + contrib/file/magic/Magdir/elf | 13 +- contrib/file/magic/Magdir/erlang | 4 +- contrib/file/magic/Magdir/espressif | 57 ++ contrib/file/magic/Magdir/esri | 4 +- contrib/file/magic/Magdir/filesystems | 220 ++++--- contrib/file/magic/Magdir/finger | 4 +- contrib/file/magic/Magdir/flash | 6 +- contrib/file/magic/Magdir/fonts | 81 ++- contrib/file/magic/Magdir/forth | 80 +++ contrib/file/magic/Magdir/frame | 24 +- contrib/file/magic/Magdir/fsav | 96 ++- contrib/file/magic/Magdir/games | 50 +- contrib/file/magic/Magdir/geo | 23 +- contrib/file/magic/Magdir/gimp | 32 +- contrib/file/magic/Magdir/git | 13 + contrib/file/magic/Magdir/glibc | 21 + contrib/file/magic/Magdir/gnome | 6 +- contrib/file/magic/Magdir/gnu | 120 +++- contrib/file/magic/Magdir/graphviz | 4 +- contrib/file/magic/Magdir/guile | 6 +- contrib/file/magic/Magdir/hardware | 12 + contrib/file/magic/Magdir/hitachi-sh | 4 +- contrib/file/magic/Magdir/hp | 8 +- contrib/file/magic/Magdir/ibm6000 | 4 +- contrib/file/magic/Magdir/icc | 4 +- contrib/file/magic/Magdir/images | 917 ++++++++++++++++++++++++++--- contrib/file/magic/Magdir/intel | 8 +- contrib/file/magic/Magdir/isz | 4 +- contrib/file/magic/Magdir/java | 26 +- contrib/file/magic/Magdir/javascript | 7 +- contrib/file/magic/Magdir/jpeg | 8 +- contrib/file/magic/Magdir/keepass | 8 +- contrib/file/magic/Magdir/kerberos | 4 +- contrib/file/magic/Magdir/kicad | 69 +++ contrib/file/magic/Magdir/kml | 8 +- contrib/file/magic/Magdir/linux | 39 +- contrib/file/magic/Magdir/lisp | 4 +- contrib/file/magic/Magdir/llvm | 4 +- contrib/file/magic/Magdir/lua | 4 +- contrib/file/magic/Magdir/m4 | 8 +- contrib/file/magic/Magdir/macintosh | 455 ++++++++------ contrib/file/magic/Magdir/mail.news | 15 +- contrib/file/magic/Magdir/make | 13 +- contrib/file/magic/Magdir/map | 375 +++++++++++- contrib/file/magic/Magdir/marc21 | 2 +- contrib/file/magic/Magdir/matroska | 4 +- contrib/file/magic/Magdir/measure | 39 ++ contrib/file/magic/Magdir/mercurial | 4 +- contrib/file/magic/Magdir/metastore | 4 +- contrib/file/magic/Magdir/microfocus | 4 +- contrib/file/magic/Magdir/misctools | 6 +- contrib/file/magic/Magdir/modem | 4 +- contrib/file/magic/Magdir/modulefile | 9 + contrib/file/magic/Magdir/mozilla | 31 +- contrib/file/magic/Magdir/msdos | 663 ++++++++++++++++----- contrib/file/magic/Magdir/msooxml | 35 +- contrib/file/magic/Magdir/msvc | 4 +- contrib/file/magic/Magdir/neko | 4 +- contrib/file/magic/Magdir/netbsd | 266 ++++----- contrib/file/magic/Magdir/nitpicker | 4 +- contrib/file/magic/Magdir/numpy | 9 + contrib/file/magic/Magdir/ole2compounddocs | 469 ++++++++++++++- contrib/file/magic/Magdir/openfst | 17 + contrib/file/magic/Magdir/opentimestamps | 16 + contrib/file/magic/Magdir/palm | 6 +- contrib/file/magic/Magdir/parrot | 4 +- contrib/file/magic/Magdir/pbf | 4 +- contrib/file/magic/Magdir/pc98 | 2 +- contrib/file/magic/Magdir/pdf | 12 +- contrib/file/magic/Magdir/pgp | 53 +- contrib/file/magic/Magdir/pmem | 46 ++ contrib/file/magic/Magdir/polyml | 4 +- contrib/file/magic/Magdir/printer | 4 +- contrib/file/magic/Magdir/psl | 4 +- contrib/file/magic/Magdir/pwsafe | 8 +- contrib/file/magic/Magdir/python | 41 +- contrib/file/magic/Magdir/qt | 4 +- contrib/file/magic/Magdir/revision | 24 +- contrib/file/magic/Magdir/riff | 37 +- contrib/file/magic/Magdir/rpi | 29 + contrib/file/magic/Magdir/rpmsg | 7 + contrib/file/magic/Magdir/rst | 11 + contrib/file/magic/Magdir/ruby | 22 +- contrib/file/magic/Magdir/scientific | 6 +- contrib/file/magic/Magdir/selinux | 2 +- contrib/file/magic/Magdir/sendmail | 4 +- contrib/file/magic/Magdir/sequent | 4 +- contrib/file/magic/Magdir/sgi | 6 +- contrib/file/magic/Magdir/sgml | 17 +- contrib/file/magic/Magdir/sniffer | 150 ++++- contrib/file/magic/Magdir/sosi | 40 ++ contrib/file/magic/Magdir/spectrum | 28 +- contrib/file/magic/Magdir/sql | 8 +- contrib/file/magic/Magdir/ssh | 6 + contrib/file/magic/Magdir/ssl | 4 +- contrib/file/magic/Magdir/sun | 4 +- contrib/file/magic/Magdir/sysex | 6 +- contrib/file/magic/Magdir/tcl | 2 +- contrib/file/magic/Magdir/terminfo | 17 +- contrib/file/magic/Magdir/tex | 4 +- contrib/file/magic/Magdir/tplink | 86 +++ contrib/file/magic/Magdir/unicode | 7 +- contrib/file/magic/Magdir/uuencode | 7 +- contrib/file/magic/Magdir/varied.script | 12 +- contrib/file/magic/Magdir/vax | 19 +- contrib/file/magic/Magdir/virtual | 200 ++++++- contrib/file/magic/Magdir/vorbis | 11 +- contrib/file/magic/Magdir/warc | 4 +- contrib/file/magic/Magdir/webassembly | 6 +- contrib/file/magic/Magdir/windows | 524 +++++++++++++++-- contrib/file/magic/Magdir/wordprocessors | 52 +- contrib/file/magic/Magdir/wsdl | 8 +- contrib/file/magic/Magdir/xwindows | 6 +- contrib/file/magic/Magdir/yara | 4 +- contrib/file/magic/Magdir/zip | 63 ++ contrib/file/src/apprentice.c | 424 ++++++------- contrib/file/src/apptype.c | 12 +- contrib/file/src/ascmagic.c | 102 ++-- contrib/file/src/buffer.c | 88 +++ contrib/file/src/cdf.c | 217 ++++--- contrib/file/src/cdf.h | 7 +- contrib/file/src/cdf_time.c | 28 +- contrib/file/src/compress.c | 485 ++++++++++----- contrib/file/src/der.c | 39 +- contrib/file/src/elfclass.h | 18 +- contrib/file/src/encoding.c | 92 ++- contrib/file/src/file.c | 219 +++++-- contrib/file/src/file.h | 101 ++-- contrib/file/src/file_opts.h | 6 +- contrib/file/src/fsmagic.c | 43 +- contrib/file/src/funcs.c | 206 ++++--- contrib/file/src/is_csv.c | 197 +++++++ contrib/file/src/is_json.c | 462 +++++++++++++++ contrib/file/src/is_tar.c | 23 +- contrib/file/src/magic.c | 105 ++-- contrib/file/src/magic.h.in | 6 +- contrib/file/src/mygetopt.h | 2 +- contrib/file/src/print.c | 42 +- contrib/file/src/readcdf.c | 422 ++++++------- contrib/file/src/readelf.c | 608 ++++++++++++------- contrib/file/src/readelf.h | 120 +++- contrib/file/src/softmagic.c | 716 ++++++++++++++-------- 188 files changed, 10917 insertions(+), 3146 deletions(-) delete mode 100644 contrib/file/README.DELETED delete mode 100644 contrib/file/README.DRAGONFLY create mode 100644 contrib/file/magic/Magdir/beetle create mode 100644 contrib/file/magic/Magdir/biosig create mode 100644 contrib/file/magic/Magdir/clojure create mode 100644 contrib/file/magic/Magdir/dataone create mode 100644 contrib/file/magic/Magdir/dbpf create mode 100644 contrib/file/magic/Magdir/edid create mode 100644 contrib/file/magic/Magdir/espressif create mode 100644 contrib/file/magic/Magdir/forth create mode 100644 contrib/file/magic/Magdir/git create mode 100644 contrib/file/magic/Magdir/glibc create mode 100644 contrib/file/magic/Magdir/hardware create mode 100644 contrib/file/magic/Magdir/kicad create mode 100644 contrib/file/magic/Magdir/measure create mode 100644 contrib/file/magic/Magdir/modulefile create mode 100644 contrib/file/magic/Magdir/numpy create mode 100644 contrib/file/magic/Magdir/openfst create mode 100644 contrib/file/magic/Magdir/opentimestamps create mode 100644 contrib/file/magic/Magdir/pmem create mode 100644 contrib/file/magic/Magdir/rpi create mode 100644 contrib/file/magic/Magdir/rpmsg create mode 100644 contrib/file/magic/Magdir/rst create mode 100644 contrib/file/magic/Magdir/sosi create mode 100644 contrib/file/magic/Magdir/tplink create mode 100644 contrib/file/magic/Magdir/zip create mode 100644 contrib/file/src/buffer.c create mode 100644 contrib/file/src/is_csv.c create mode 100644 contrib/file/src/is_json.c diff --git a/contrib/file/COPYING b/contrib/file/COPYING index b3db8b23fb..16410a17f2 100644 --- a/contrib/file/COPYING +++ b/contrib/file/COPYING @@ -1,4 +1,4 @@ -$File: COPYING,v 1.1 2008/02/05 19:08:11 christos Exp $ +$File: COPYING,v 1.2 2018/09/09 20:33:28 christos Exp $ Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995. Software written by Ian F. Darwin and others; maintained 1994- Christos Zoulas. @@ -15,7 +15,7 @@ are met: 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - + THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE diff --git a/contrib/file/ChangeLog b/contrib/file/ChangeLog index 2063a23bef..661a144e05 100644 --- a/contrib/file/ChangeLog +++ b/contrib/file/ChangeLog @@ -1,3 +1,132 @@ +2019-12-16 21:11 Christos Zoulas + + * release 5.38 + +2019-12-15 22:13 Christos Zoulas + Document changes since the previous release: + - Always accept -S (no sandbox) even if we don't support sandboxing + - More syscalls elided for sandboxiing + - For ELF dynamic means having an interpreter not just PT_DYNAMIC + - Check for large ELF session header offset + - When saving and restoring a locale, keep the locale name in our + own storage. + - Add a flag to disable CSV file detection. + - Don't pass NULL/0 to memset to appease sanitizers. + - Avoid spurious prints when looks for extensions or apple strings + in fsmagic. + - Add builtin decompressors for xz and and bzip. + - Add a limit for the number of CDF elements. + - More checks for overflow in CDF. + +2019-05-14 22:26 Christos Zoulas + + * release 5.37 + +2019-05-09 22:27 Christos Zoulas + + * Make sure that continuation separators are printed + with -k within softmagic + +2019-05-06 22:27 Christos Zoulas + + * Change SIGPIPE saving and restoring during compression to use + sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) + * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) + +2019-05-06 17:25 Christos Zoulas + + * PR/77: Handle --mime-type and -k correctly. + +2019-05-03 15:26 Christos Zoulas + + * Switch decompression code to use vfork() because + tools like rpmdiff and rpmbuild call libmagic + with large process footprints (Denys Vlasenko) + +2019-04-07 14:05 Christos Zoulas + + * PR/75: --enable-zlib, did not work. + +2019-02-27 11:54 Christos Zoulas + + * Improve regex efficiency (Michael Schroeder) by: + 1. Prefixing regex searches with regular search + for keywords where possible + 2. Using memmem(3) where available + +2019-02-20 10:16 Christos Zoulas + + * release 5.36 + +2019-02-19 15:30 Christos Zoulas + + * Fix cast to use cast macros + * Add UCS-32 builtin detection (PR/61) reported by tmc + +2019-02-18 18:24 Christos Zoulas + + * Fix stack read (PR/62) and write (PR/64) stack overflows + reported by spinpx + +2018-10-18 19:32 Christos Zoulas + + * release 5.35 + +2018-09-10 20:38 Christos Zoulas + + * Add FreeBSD ELF core file support (John Baldwin) + +2018-08-20 18:40 Christos Zoulas + + * PR/30: Allow all parameter values to be set (don't treat 0 specially) + * handle default annotations on the softmagic match instead at the + end. + +2018-07-25 10:17 Christos Zoulas + + * PR/23: Recognize JSON files + +2018-07-25 10:17 Christos Zoulas + + * PR/18: file --mime-encoding should not print mime-type + +2018-07-25 8:50 Christos Zoulas + + * release 5.34 + +2018-06-22 16:38 Christos Zoulas + + * Add Quad indirect offsets + +2018-05-24 14:10 Christos Zoulas + + * Enable parsing of ELF dynamic sections to handle PIE better + +2018-04-15 14:52 Christos Zoulas + + * release 5.33 + +2018-02-24 14:50 Christos Zoulas + + * extend the support for ${x?:} expansions for magic descriptions + +2018-02-21 16:25 Christos Zoulas + + * add support for ${x?:} in mime types to handle + pie binaries. + +2017-11-03 9:23 Christos Zoulas + + * add support for negative offsets (offsets from the end of file) + +2017-09-26 8:22 Christos Zoulas + + * close the file on error when writing magic (Steve Grubb) + +2017-09-24 12:02 Christos Zoulas + + * seccomp support (Paul Moore) + 2017-09-02 11:53 Christos Zoulas * release 5.32 @@ -53,7 +182,7 @@ * Add missing overflow check in der magic (Jonas Wagner) 2016-10-25 10:40 Christos Zoulas - + * release 5.29 2016-10-24 11:20 Christos Zoulas @@ -94,11 +223,11 @@ - set offset to 0 on failure. 2016-05-13 12:00 Christos Zoulas - + * release 5.27 2016-04-18 9:35 Christos Zoulas - + * Errors comparing DER entries or computing offsets are just indications of malformed non-DER files. Don't print them. @@ -107,7 +236,7 @@ * Put new bytes constant in the right file (not the generated one) 2016-04-16 18:34 Christos Zoulas - + * release 5.26 2016-03-31 13:50 Christos Zoulas @@ -153,7 +282,7 @@ * PR/492: compression forking was broken with magic_buffer. 2015-09-16 9:50 Christos Zoulas - + * release 5.25 2015-09-11 13:25 Christos Zoulas @@ -181,7 +310,7 @@ * release 5.23 2015-06-09 16:10 Christos Zoulas - + * Fix issue with regex range for magic with offset * Always return true from mget with USE (success to mget not match indication). Fixes mime evaluation after USE magic @@ -234,12 +363,12 @@ * add indirect relative for TIFF/Exif 2014-12-16 18:10 Christos Zoulas - + * restructure elf note printing to avoid repeated messages * add note limit, suggested by Alexander Cherepanov 2014-12-16 16:53 Christos Zoulas - + * Bail out on partial pread()'s (Alexander Cherepanov) * Fix incorrect bounds check in file_printable (Alexander Cherepanov) @@ -250,7 +379,7 @@ more places for safety * in ELF, instead of "(uses dynamic libraries)" when PT_INTERP is present print the interpreter name. - + 2014-12-10 20:01 Christos Zoulas * release 5.21 @@ -293,7 +422,7 @@ on a byte by byte basis, so that we don't get issues with locale's trying to interpret random byte streams as UTF-8 and having printf error out with EILSEQ. - + 2014-10-17 11:48 Christos Zoulas * fix bounds in note reading (Francisco Alonso / Red Hat) @@ -324,7 +453,7 @@ * release 5.19 2014-06-09 9:04 Christos Zoulas - + * Misc buffer overruns and missing buffer size tests in cdf parsing (Francisco Alonso, Jan Kaluza) @@ -354,7 +483,7 @@ 2014-05-04 14:55 Christos Zoulas - * PR/351: Fix compilation of empty files + * PR/351: Fix compilation of empty files 2014-04-30 17:39 Christos Zoulas @@ -458,7 +587,7 @@ * Don't treat magic as an error if offset was past EOF (Christoph Biedl) 2013-05-28 17:25 Christos Zoulas - + * Fix spacing issues in softmagic and elf (Jan Kaluza) 2013-05-02 18:00 Christos Zoulas @@ -514,7 +643,7 @@ * Make getline public so that file can link against it. Perhaps it is better to rename it, or hide it differently. Fixes builds on platforms that do not provide it. - + 2013-01-07 16:30 Christos Zoulas * Add SuS d{,1,2,4,8}, u{,1,2,4,8} and document @@ -864,7 +993,7 @@ (Cheng Renquan) 2009-05-08 13:40 Christos Zoulas - + * lint fixes and more from NetBSD 2009-05-06 10:25 Christos Zoulas @@ -884,7 +1013,7 @@ 2009-03-27 18:43 Christos Zoulas - * don't print \012- separators in the same magic entry + * don't print \012- separators in the same magic entry if it consists of multiple magic printing lines. 2009-03-23 10:20 Christos Zoulas diff --git a/contrib/file/README b/contrib/file/README index bb8186f476..f69dc43e0f 100644 --- a/contrib/file/README +++ b/contrib/file/README @@ -1,13 +1,12 @@ -## README for file(1) Command ## +## README for file(1) Command and the libmagic(3) library ## - @(#) $File: README,v 1.50 2016/04/16 22:40:54 christos Exp $ + @(#) $File: README,v 1.59 2019/09/19 01:04:01 christos Exp $ -Mailing List: file@mx.gw.com -Mailing List archives: http://mx.gw.com/pipermail/file/ -Bug tracker: http://bugs.gw.com/ +Mailing List: file@astron.com +Mailing List archives: http://mailman.astron.com/pipermail/file/ +Bug tracker: http://bugs.astron.com/ E-mail: christos@astron.com - -[![Build Status](https://travis-ci.org/file/file.png?branch=master)](https://travis-ci.org/file/file) +Build Status: https://travis-ci.org/file/file Phone: Do not even think of telephoning me about this program. Send cash first! @@ -25,6 +24,10 @@ A public read-only git repository of the same sources is available at: https://github.com/file/file +We are continuously being fuzzed by OSS-FUZZ: + + https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:file + The major changes for 5.x are CDF file parsing, indirect magic, name/use (recursion) and overhaul in mime and ascii encoding handling. @@ -64,73 +67,55 @@ magic numbers assigned to all sorts of data files that are in reasonable circulation. Send your magic numbers, in magic(5) format please, to the maintainer, Christos Zoulas. -COPYING - read this first. -README - read this second (you are currently reading this file). +COPYING - read this first. +README - read this second (you are currently reading this file). INSTALL - read on how to install -src/localtime_r.c -src/magic.c -src/magic.h -src/mygetopt.h -src/newtest2.c -src/newtest3.c -src/pread.c -src/print.c -src/readcdf.c -src/readelf.c -src/readelf.h -src/regex.c -src/regex2.c -src/softmagic.c -src/strcasestr.c -src/strlcat.c -src/strlcpy.c -src/strndup.c -src/tar.h -src/teststrchr.c -src/vasprintf.c -src/x.c -src/apprentice.c - parses /etc/magic to learn magic -src/apptype.c - used for OS/2 specific application type magic -src/ascmagic.c - third & last set of tests, based on hardwired assumptions. -src/asctime_r.c - replacement for OS's that don't have it. -src/asprintf.c - replacement for OS's that don't have it. -src/asctime_r.c - replacement for OS's that don't have it. -src/asprintf.c - replacement for OS's that don't have it. -src/cdf.[ch] - parser for Microsoft Compound Document Files -src/cdf_time.c - time converter for CDF. -src/compress.c - handles decompressing files to look inside. -src/ctime_r.c - replacement for OS's that don't have it. +src/apprentice.c - parses /etc/magic to learn magic +src/apptype.c - used for OS/2 specific application type magic +src/ascmagic.c - third & last set of tests, based on hardwired assumptions. +src/asctime_r.c - replacement for OS's that don't have it. +src/asprintf.c - replacement for OS's that don't have it. +src/asctime_r.c - replacement for OS's that don't have it. +src/asprintf.c - replacement for OS's that don't have it. +src/buffer.c - buffer handling functions. +src/cdf.[ch] - parser for Microsoft Compound Document Files +src/cdf_time.c - time converter for CDF. +src/compress.c - handles decompressing files to look inside. +src/ctime_r.c - replacement for OS's that don't have it. src/der.[ch] - parser for Distinguished Encoding Rules src/dprintf.c - replacement for OS's that don't have it. src/elfclass.h - common code for elf 32/64. -src/encoding.c - handles unicode encodings -src/file.c - the main program -src/file.h - header file +src/encoding.c - handles unicode encodings +src/file.c - the main program +src/file.h - header file src/file_opts.h - list of options -src/fmtcheck.c - replacement for OS's that don't have it. -src/fsmagic.c - first set of tests the program runs, based on filesystem info -src/funcs.c - utilility functions -src/getline.c - replacement for OS's that don't have it. -src/getopt_long.c - replacement for OS's that don't have it. -src/gmtime_r.c - replacement for OS's that don't have it. -src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore). -src/localtime_r.c - replacement for OS's that don't have it. +src/fmtcheck.c - replacement for OS's that don't have it. +src/fsmagic.c - first set of tests the program runs, based on filesystem info +src/funcs.c - utilility functions +src/getline.c - replacement for OS's that don't have it. +src/getopt_long.c - replacement for OS's that don't have it. +src/gmtime_r.c - replacement for OS's that don't have it. +src/is_csv.c - knows about Comma Separated Value file format (RFC 4180). +src/is_json.c - knows about JavaScript Object Notation format (RFC 8259). +src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore). +src/localtime_r.c - replacement for OS's that don't have it. src/magic.h.in - source file for magic.h -src/mygetopt.h - replacement for OS's that don't have it. -src/magic.c - the libmagic api -src/names.h - header file for ascmagic.c -src/pread.c - replacement for OS's that don't have it. -src/print.c - print results, errors, warnings. -src/readcdf.c - CDF wrapper. -src/readelf.[ch] - Stand-alone elf parsing code. -src/softmagic.c - 2nd set of tests, based on /etc/magic -src/mygetopt.h - replacement for OS's that don't have it. -src/strcasestr.c - replacement for OS's that don't have it. -src/strlcat.c - replacement for OS's that don't have it. -src/strlcpy.c - replacement for OS's that don't have it. +src/mygetopt.h - replacement for OS's that don't have it. +src/magic.c - the libmagic api +src/names.h - header file for ascmagic.c +src/pread.c - replacement for OS's that don't have it. +src/print.c - print results, errors, warnings. +src/readcdf.c - CDF wrapper. +src/readelf.[ch] - Stand-alone elf parsing code. +src/softmagic.c - 2nd set of tests, based on /etc/magic +src/mygetopt.h - replacement for OS's that don't have it. +src/strcasestr.c - replacement for OS's that don't have it. +src/strlcat.c - replacement for OS's that don't have it. +src/strlcpy.c - replacement for OS's that don't have it. +src/strndup.c - replacement for OS's that don't have it. src/tar.h - tar file definitions -src/vasprintf.c - for systems that don't have it. -doc/file.man - man page for the command +src/vasprintf.c - for systems that don't have it. +doc/file.man - man page for the command doc/magic.man - man page for the magic file, courtesy Guy Harris. Install as magic.4 on USG and magic.5 on V7 or Berkeley; cf Makefile. @@ -156,6 +141,19 @@ guidelines: ------------------------------------------------------------------------------ +gpg for dummies: + +$ gpg --verify file-X.YY.tar.gz.asc file-X.YY.tar.gz +gpg: assuming signed data in `file-X.YY.tar.gz' +gpg: Signature made WWW MMM DD HH:MM:SS YYYY ZZZ using DSA key ID KKKKKKKK + +To download the key: + +$ gpg --keyserver hkp://keys.gnupg.net --recv-keys KKKKKKKK + +------------------------------------------------------------------------------ + + Parts of this software were developed at SoftQuad Inc., developers of SGML/HTML/XML publishing software, in Toronto, Canada. SoftQuad was swallowed up by Corel in 2002 and does not exist any longer. diff --git a/contrib/file/README.DELETED b/contrib/file/README.DELETED deleted file mode 100644 index 0e5ac69d96..0000000000 --- a/contrib/file/README.DELETED +++ /dev/null @@ -1,41 +0,0 @@ -AUTHORS -INSTALL -Makefile.am -Makefile.in -NEWS -TODO -acinclude.m4 -aclocal.m4 -compile -config.guess -config.h.in -config.sub -configure -configure.ac -depcomp -doc/Makefile.am -doc/Makefile.in -install-sh -ltmain.sh -m4/ -magic/Makefile.am -magic/Makefile.in -missing -python/ -src/Makefile.am -src/Makefile.in -src/asctime_r.c -src/asprintf.c -src/ctime_r.c -src/dprintf.c -src/fmtcheck.c -src/getline.c -src/getopt_long.c -src/gmtime_r.c -src/localtime_r.c -src/pread.c -src/strcasestr.c -src/strlcat.c -src/strlcpy.c -src/vasprintf.c -tests/ diff --git a/contrib/file/README.DRAGONFLY b/contrib/file/README.DRAGONFLY deleted file mode 100644 index c85cdfa498..0000000000 --- a/contrib/file/README.DRAGONFLY +++ /dev/null @@ -1,9 +0,0 @@ -This directory contains most of the file distribution. The original -source can be obtained from: - ftp://ftp.astron.com/pub/file/ - -A list of the omitted files and directories can be found in -README.DELETED. - -This is used in lib/libmagic and usr.bin/file. When upgrading, remember -to update config.h in lib/libmagic. diff --git a/contrib/file/doc/file.man b/contrib/file/doc/file.man index 1c66241c8c..84b4b357f0 100644 --- a/contrib/file/doc/file.man +++ b/contrib/file/doc/file.man @@ -1,5 +1,5 @@ -.\" $File: file.man,v 1.125 2017/01/03 11:24:46 christos Exp $ -.Dd October 19, 2016 +.\" $File: file.man,v 1.138 2019/10/15 18:00:40 christos Exp $ +.Dd July 13, 2019 .Dt FILE __CSECTION__ .Os .Sh NAME @@ -8,7 +8,7 @@ .Sh SYNOPSIS .Nm .Bk -words -.Op Fl bcdEhiklLNnprsvzZ0 +.Op Fl bcdEhiklLNnprsSvzZ0 .Op Fl Fl apple .Op Fl Fl extension .Op Fl Fl mime-encoding @@ -159,7 +159,7 @@ two groups, so they are performed last. The language test routines also test for some miscellany (such as .Xr tar 1 -archives). +archives, JSON files). .Pp Any file that cannot be identified as having been written in any of the character sets listed above is simply said to be @@ -168,8 +168,11 @@ in any of the character sets listed above is simply said to be .Bl -tag -width indent .It Fl Fl apple Causes the file command to output the file type and creator code as -used by older MacOS versions. The code consists of eight letters, +used by older MacOS versions. +The code consists of eight letters, the first describing the file type, the latter the creator. +This option works properly only for file formats that have the +apple-style output defined. .It Fl b , Fl Fl brief Do not prepend filenames to output lines (brief mode). .It Fl C , Fl Fl compile @@ -209,18 +212,24 @@ Ignored for backwards compatibility. Prints details of Compound Document Files. .It compress Checks for, and looks inside, compressed files. +.It csv +Checks Comma Separated Value files. .It elf Prints ELF file details, provided soft magic tests are enabled and the elf magic is found. +.It json +Examines JSON (RFC-7159) files by parsing them for compliance. .It soft Consults magic files. .It tar -Examines tar files. +Examines tar files by verifying the checksum of the 512 byte tar header. +Excluding this test can provide more detailed content description by using +the soft magic method. .It text A synonym for .Sq ascii . .El -.It Fl Fl extension +.It Fl Fl extension Print a slash-separated list of valid extensions for the file type found. .It Fl F , Fl Fl separator Ar separator Use the specified string as the separator between the filename and the @@ -282,7 +291,7 @@ The magic pattern with the highest strength (see the option) comes first. .It Fl l , Fl Fl list Shows a list of patterns and their strength sorted descending by -.Xr magic 4 +.Xr magic __FSECTION__ strength which is used for the matching (see also the .Fl k @@ -350,6 +359,17 @@ This option also causes to disregard the file size as reported by .Xr stat 2 since on some systems it reports a zero size for raw disk partitions. +.It Fl S , Fl Fl no-sandbox +On systems where libseccomp +.Pa ( https://github.com/seccomp/libseccomp ) +is available, the +.Fl S +flag disables sandboxing which is enabled by default. +This option is needed for file to execute external decompressing programs, +i.e. when the +.Fl z +flag is specified and the built-in decompressors are not available. +On systems where sandboxing is not available, this option has no effect. .It Fl v , Fl Fl version Print the version of the program and exit. .It Fl z , Fl Fl uncompress @@ -366,20 +386,13 @@ Nice to the output. This does not affect the separator, which is still printed. .Pp -If this option is repeated more than once, then +If this option is repeated more than once, then .Nm prints just the filename followed by a NUL followed by the description (or ERROR: text) followed by a second NUL for each entry. .It Fl -help Print a help message and exit. .El -.Sh FILES -.Bl -tag -width __MAGIC__.mgc -compact -.It Pa __MAGIC__.mgc -Default compiled list of magic. -.It Pa __MAGIC__ -Directory containing default magic files. -.El .Sh ENVIRONMENT The environment variable .Ev MAGIC @@ -392,11 +405,6 @@ will not attempt to open adds .Dq Pa .mgc to the value of this variable as appropriate. -However, -.Pa file -has to exist in order for -.Pa file.mime -to be considered. The environment variable .Ev POSIXLY_CORRECT controls (on systems that support symbolic links), whether @@ -410,6 +418,65 @@ This is also controlled by the and .Fl h options. +.Sh FILES +.Bl -tag -width __MAGIC__.mgc -compact +.It Pa __MAGIC__.mgc +Default compiled list of magic. +.It Pa __MAGIC__ +Directory containing default magic files. +.El +.Sh EXIT STATUS +.Nm +will exit with +.Dv 0 +if the operation was successful or +.Dv >0 +if an error was encountered. +The following errors cause diagnostic messages, but don't affect the program +exit code (as POSIX requires), unless +.Fl E +is specified: +.Bl -bullet -compact -offset indent +.It +A file cannot be found +.It +There is no permission to read a file +.It +The file type cannot be determined +.El +.Sh EXAMPLES +.Bd -literal -offset indent +$ file file.c file /dev/{wd0a,hda} +file.c: C program text +file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), + dynamically linked (uses shared libs), stripped +/dev/wd0a: block special (0/0) +/dev/hda: block special (3/0) + +$ file -s /dev/wd0{b,d} +/dev/wd0b: data +/dev/wd0d: x86 boot sector + +$ file -s /dev/hda{,1,2,3,4,5,6,7,8,9,10} +/dev/hda: x86 boot sector +/dev/hda1: Linux/i386 ext2 filesystem +/dev/hda2: x86 boot sector +/dev/hda3: x86 boot sector, extended partition table +/dev/hda4: Linux/i386 ext2 filesystem +/dev/hda5: Linux/i386 swap file +/dev/hda6: Linux/i386 swap file +/dev/hda7: Linux/i386 swap file +/dev/hda8: Linux/i386 swap file +/dev/hda9: empty +/dev/hda10: empty + +$ file -i file.c file /dev/{wd0a,hda} +file.c: text/x-c +file: application/x-executable +/dev/hda: application/x-not-regular-file +/dev/wd0a: application/x-not-regular-file + +.Ed .Sh SEE ALSO .Xr hexdump 1 , .Xr od 1 , @@ -461,6 +528,23 @@ for example, .Bd -literal -offset indent \*[Gt]16 long\*[Am]0x7fffffff \*[Gt]0 not stripped .Ed +.Sh SECURITY +On systems where libseccomp +.Pa ( https://github.com/seccomp/libseccomp ) +is available, +.Nm +is enforces limiting system calls to only the ones necessary for the +operation of the program. +This enforcement does not provide any security benefit when +.Nm +is asked to decompress input files running external programs with +the +.Fl z +option. +To enable execution of external decompressors, one needs to disable +sandboxing using the +.Fl S +flag. .Sh MAGIC DIRECTORY The magic file entries have been collected from various sources, mainly USENET, and contributed by various authors. @@ -478,39 +562,6 @@ command uses a magic file, keep the old magic file around for comparison purposes (rename it to .Pa __MAGIC__.orig ) . -.Sh EXAMPLES -.Bd -literal -offset indent -$ file file.c file /dev/{wd0a,hda} -file.c: C program text -file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), - dynamically linked (uses shared libs), stripped -/dev/wd0a: block special (0/0) -/dev/hda: block special (3/0) - -$ file -s /dev/wd0{b,d} -/dev/wd0b: data -/dev/wd0d: x86 boot sector - -$ file -s /dev/hda{,1,2,3,4,5,6,7,8,9,10} -/dev/hda: x86 boot sector -/dev/hda1: Linux/i386 ext2 filesystem -/dev/hda2: x86 boot sector -/dev/hda3: x86 boot sector, extended partition table -/dev/hda4: Linux/i386 ext2 filesystem -/dev/hda5: Linux/i386 swap file -/dev/hda6: Linux/i386 swap file -/dev/hda7: Linux/i386 swap file -/dev/hda8: Linux/i386 swap file -/dev/hda9: empty -/dev/hda10: empty - -$ file -i file.c file /dev/{wd0a,hda} -file.c: text/x-c -file: application/x-executable -/dev/hda: application/x-not-regular-file -/dev/wd0a: application/x-not-regular-file - -.Ed .Sh HISTORY There has been a .Nm @@ -532,7 +583,7 @@ Geoff Collyer found several inadequacies and provided some magic file entries. Contributions of the .Sq \*[Am] -operator by Rob McMahon, +operator by Rob McMahon, .Aq cudcv@warwick.ac.uk , 1989. .Pp @@ -582,16 +633,13 @@ and were written by John Gilmore from his public-domain .Xr tar 1 program, and are not covered by the above license. -.Sh RETURN CODE -.Nm -returns 0 on success, and non-zero on error. .Sh BUGS Please report bugs and send patches to the bug tracker at -.Pa http://bugs.gw.com/ +.Pa https://bugs.astron.com/ or the mailing list at -.Aq file@mx.gw.com +.Aq file@astron.com (visit -.Pa http://mx.gw.com/mailman/listinfo/file +.Pa https://mailman.astron.com/mailman/listinfo/file first to subscribe). .Sh TODO Fix output so that tests for MIME and APPLE flags are not needed all diff --git a/contrib/file/doc/libmagic.man b/contrib/file/doc/libmagic.man index 4c7e42ff4f..b0cf0339f1 100644 --- a/contrib/file/doc/libmagic.man +++ b/contrib/file/doc/libmagic.man @@ -1,6 +1,6 @@ -.\" $File: libmagic.man,v 1.41 2017/05/23 21:54:07 christos Exp $ +.\" $File: libmagic.man,v 1.45 2019/06/08 22:16:24 christos Exp $ .\" -.\" Copyright (c) Christos Zoulas 2003. +.\" Copyright (c) Christos Zoulas 2003, 2018. .\" All Rights Reserved. .\" .\" Redistribution and use in source and binary forms, with or without @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd May 23, 2017 +.Dd June 8, 2019 .Dt LIBMAGIC 3 .Os .Sh NAME @@ -159,6 +159,10 @@ Don't examine tar files. Don't check for various types of text files. .It Dv MAGIC_NO_CHECK_TOKENS Don't look for known tokens inside ascii files. +.It Dv MAGIC_NO_CHECK_JSON +Don't examine JSON files. +.It Dv MAGIC_NO_CHECK_CSV +Don't examine CSV files. .El .Pp The @@ -391,6 +395,19 @@ The compiled default magic database. .Sh SEE ALSO .Xr file __CSECTION__ , .Xr magic __FSECTION__ +.Sh BUGS +The results from +.Fn magic_buffer +and +.Fn magic_file +where the buffer and the file contain the same data +can produce different results, because in the +.Fn magic_file +case, the program can +.Xr lseek 2 +and +.Xr stat 2 +the file descriptor. .Sh AUTHORS .An M\(oans Rullg\(oard Initial libmagic implementation, and configuration. diff --git a/contrib/file/doc/magic.man b/contrib/file/doc/magic.man index 4c69bca2ab..ed074adbcc 100644 --- a/contrib/file/doc/magic.man +++ b/contrib/file/doc/magic.man @@ -1,5 +1,5 @@ -.\" $File: magic.man,v 1.91 2017/02/12 15:30:08 christos Exp $ -.Dd February 12, 2017 +.\" $File: magic.man,v 1.97 2019/11/15 21:03:14 christos Exp $ +.Dd January 21, 2019 .Dt MAGIC __FSECTION__ .Os .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. @@ -36,8 +36,20 @@ If the test succeeds, a message is printed. The line consists of the following fields: .Bl -tag -width ".Dv message" .It Dv offset -A number specifying the offset, in bytes, into the file of the data +A number specifying the offset (in bytes) into the file of the data which is to be tested. +This offset can be a negative number if it is: +.Bl -bullet -compact +.It +The first direct offset of the magic entry (at continuation level 0), +in which case it is interpreted an offset from end end of the file +going backwards. +This works only when a file descriptor to the file is available and it +is a regular file. +.It +A continuation offset relative to the end of the last up-level field +.Dv ( \*[Am] ) . +.El .It Dv type The type of the data to be tested. The possible values are: @@ -104,13 +116,13 @@ The following modifiers are supported: .It B A byte length (default). .It H -A 4 byte big endian length. -.It h A 2 byte big endian length. +.It h +A 2 byte little endian length. .It L -A 4 byte little endian length. +A 4 byte big endian length. .It l -A 2 byte little endian length. +A 4 byte little endian length. .It J The length includes itself in its count. .El @@ -124,7 +136,7 @@ format. .It Dv date A four-byte value interpreted as a UNIX date. .It Dv qdate -A eight-byte value interpreted as a UNIX date. +An eight-byte value interpreted as a UNIX date. .It Dv ldate A four-byte value interpreted as a UNIX-style date, but interpreted as local time rather than UTC. @@ -541,12 +553,12 @@ the file. The value at that offset is read, and is used again as an offset in the file. Indirect offsets are of the form: -.Em (( x [[.,][bislBISL]][+\-][ y ]) . +.Em (( x [[.,][bBcCeEfFgGhHiIlmsSqQ]][+\-][ y ]) . The value of .Em x is used as an offset in the file. A byte, id3 length, short or long is read at that offset depending on the -.Em [bislBISLm] +.Em [bBcCeEfFgGhHiIlmsSqQ] type specifier. The value is treated as signed if .Dq , @@ -563,6 +575,20 @@ To that number the value of .Em y is added and the result is used as an offset in the file. The default type if one is not specified is long. +The following types are recognized: +.Bl -column -offset indent "Type" "Half/Short" "Little" "Size" +.It Sy Type Sy Mnemonic Sy Endian Sy Size +.It bcBc Byte/Char N/A 1 +.It efg Double Little 8 +.It EFG Double Big 8 +.It hs Half/Short Little 2 +.It HS Half/Short Big 2 +.It i ID3 Little 4 +.It I ID3 Big 4 +.It m Middle Middle 4 +.It q Quad Little 8 +.It Q Quad Big 8 +.El .Pp That way variable length structures can be examined: .Bd -literal -offset indent diff --git a/contrib/file/magic/Header b/contrib/file/magic/Header index 831122e27a..345a50fb1e 100644 --- a/contrib/file/magic/Header +++ b/contrib/file/magic/Header @@ -2,4 +2,4 @@ # Format is described in magic(files), where: # files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. # Don't edit this file, edit /etc/magic or send your magic improvements -# to the maintainers, at file@mx.gw.com +# to the maintainers, at file@astron.com diff --git a/contrib/file/magic/Magdir/acorn b/contrib/file/magic/Magdir/acorn index 4202be9124..4aa34551a7 100644 --- a/contrib/file/magic/Magdir/acorn +++ b/contrib/file/magic/Magdir/acorn @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ +# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $ # acorn: file(1) magic for files found on Acorn systems # @@ -67,3 +67,36 @@ >>8 byte x version %d, >>10 leshort =1 1 pattern >>10 leshort !1 %d patterns + +# From: Joerg Jenderek +# URL: https://www.kyzer.me.uk/pack/xad/#PackDir +# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c +# GRR: line below is too general as it matches also "Git pack" in ./revision +0 string PACK\0 +# check for valid compression method 0-4 +>5 ulelong <5 +# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems +# To skip "Git pack" version 0 test for root directory object like +# ADFS::RPC.$.websitezip.FONTFIX +>>9 string >ADFS\ PackDir archive (RISC OS) +# TrID labels above as "Acorn PackDir compressed Archive" +# compression mode y (0 - 4) for GIF LZW with a maximum n bits +# (y~n,0~12,1~13,2~14,3~15,4~16) +>>>5 ulelong+12 x \b, LZW %u-bits compression +# https://www.filebase.org.uk/filetypes +# !Packdir compressed archive has three hexadecimal digits code 68E +!:mime application/x-acorn-68E +!:ext pkd/bin +# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo +>>>9 string x \b, root "%s" +# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time +>>>>&1 ulelong x \b, load address 0x%x +# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC +>>>>&5 ulelong x \b, exec address 0x%x +# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) +>>>>&9 ulelong x \b, attributes 0x%x +# number of entries in this directory. for root dir 0 +#>>>&13 ulelong x \b, entries 0x%x +# the entries start here with object name +>>>>&17 string x \b, 1st object "%s" + diff --git a/contrib/file/magic/Magdir/adventure b/contrib/file/magic/Magdir/adventure index 6fae85adfd..bd7f863be2 100644 --- a/contrib/file/magic/Magdir/adventure +++ b/contrib/file/magic/Magdir/adventure @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $ +# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $ # adventure: file(1) magic for Adventure game files # # from Allen Garvin @@ -21,8 +21,8 @@ # Updated by Adam Buchbinder # #http://www.gnelson.demon.co.uk/zspec/sect11.html -#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt -#http://en.wikipedia.org/wiki/Z-machine +#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt +#https://en.wikipedia.org/wiki/Z-machine # The first byte is the Z-machine revision; it is always between 1 and 8. We # had false matches (for instance, inbig5.ocp from the Omega TeX extension as # well as an occasional MP3 file), so we sanity-check the version number. @@ -111,7 +111,7 @@ # Danny Milosavljevic # These are ADRIFT (adventure game standard) game files, extension .taf # Checked from source at (http://www.adrift.co/) and various taf files -# found at the Interactive Fiction Archive (http://ifarchive.org/) +# found at the Interactive Fiction Archive (https://ifarchive.org/) 0 belong 0x3C423FC9 >4 belong 0x6A87C2CF Adrift game file version >>8 belong 0x94453661 3.80 diff --git a/contrib/file/magic/Magdir/algol68 b/contrib/file/magic/Magdir/algol68 index a9aad46e1f..3675b840e3 100644 --- a/contrib/file/magic/Magdir/algol68 +++ b/contrib/file/magic/Magdir/algol68 @@ -1,17 +1,17 @@ #------------------------------------------------------------------------------ -# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $ +# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $ # algol68: file(1) magic for Algol 68 source # 0 search/8192 (input, Algol 68 source text !:mime text/x-Algol68 -0 regex \^PROC Algol 68 source text +0 regex/1024 \^PROC Algol 68 source text !:mime text/x-Algol68 -0 regex MODE[\t\ ] Algol 68 source text +0 regex/1024 \bMODE[\t\ ] Algol 68 source text !:mime text/x-Algol68 -0 regex REF[\t\ ] Algol 68 source text +0 regex/1024 \bREF[\t\ ] Algol 68 source text !:mime text/x-Algol68 -0 regex FLEX[\t\ ]\*\\[ Algol 68 source text +0 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text !:mime text/x-Algol68 #0 regex [\t\ ]OD Algol 68 source text #!:mime text/x-Algol68 diff --git a/contrib/file/magic/Magdir/amigaos b/contrib/file/magic/Magdir/amigaos index d9330bd149..e719921ef3 100644 --- a/contrib/file/magic/Magdir/amigaos +++ b/contrib/file/magic/Magdir/amigaos @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $ +# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $ # amigaos: file(1) magic for AmigaOS binary formats: # @@ -66,3 +66,22 @@ # From: Przemek Kramarczyk 0 string .KEY AmigaDOS script 0 string .key AmigaDOS script + +# AMOS Basic file formats +# https://www.exotica.org.uk/wiki/AMOS_file_formats +0 string AMOS\040Basic\040 AMOS Basic source code +>11 byte =0x56 \b, tested +>11 byte =0x76 \b, untested +0 string AMOS\040Pro AMOS Basic source code +>11 byte =0x56 \b, tested +>11 byte =0x76 \b, untested +0 string AmSp AMOS Basic sprite bank +>4 beshort x \b, %d sprites +0 string AmIc AMOS Basic icon bank +>4 beshort x \b, %d icons +0 string AmBk AMOS Basic memory bank +>4 beshort x \b, bank number %d +>8 belong&0xFFFFFFF x \b, length %d +>12 regex .{8} \b, type %s +0 string AmBs AMOS Basic memory banks +>4 beshort x \b, %d banks diff --git a/contrib/file/magic/Magdir/android b/contrib/file/magic/Magdir/android index dca5c33482..1265d95925 100644 --- a/contrib/file/magic/Magdir/android +++ b/contrib/file/magic/Magdir/android @@ -1,6 +1,6 @@ #------------------------------------------------------------ -# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $ +# $File: android,v 1.16 2019/11/15 21:03:14 christos Exp $ # Various android related magic entries #------------------------------------------------------------ @@ -18,8 +18,11 @@ # Android bootimg format # From https://android.googlesource.com/\ # platform/system/core/+/master/mkbootimg/bootimg.h +# https://github.com/djrbliss/loki/blob/master/loki.h#L43 0 string ANDROID! Android bootimg ->1024 string LOKI\01 \b, LOKI'd +>1024 string LOKI \b, LOKI'd +>>1028 lelong 0 \b (boot) +>>1028 lelong 1 \b (recovery) >8 lelong >0 \b, kernel >>12 lelong >0 \b (0x%x) >16 lelong >0 \b, ramdisk @@ -32,33 +35,68 @@ # Android Backup archive # From: Ariel Shkedi -# File extension: .ab -# No mime-type defined +# Update: Joerg Jenderek # URL: https://github.com/android/platform_frameworks_base/blob/\ # 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ # android/server/BackupManagerService.java#L2367 +# Reference: https://sourceforge.net/projects/adbextractor/ +# android-backup-extractor/perl/backupencrypt.pl +# Note: only unix line feeds "\n" found # After the header comes a tar file # If compressed, the entire tar file is compressed with JAVA deflate # # Include the version number hardcoded with the magic string to avoid # false positives -0 string/b ANDROID\ BACKUP\n1\n Android Backup +0 string/b ANDROID\ BACKUP\n Android Backup +# maybe look for some more characteristics like linefeed '\n' or version +#>16 string \n +# No mime-type defined officially +!:mime application/x-google-ab +!:ext ab +# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) +>15 string >\0 \b, version %s +# "1" on 3rd line means compressed >17 string 0\n \b, Not-Compressed >17 string 1\n \b, Compressed +# The 4th line is encryption "none" or "AES-256" # any string as long as it's not the word none (which is matched below) +>19 string none\n \b, Not-Encrypted +# look for backup content after line with encryption info +#>>19 search/7 \n +# data part after header for not encrypted Android Backup +#>>>&0 ubequad x \b, content 0x%16.16llx... +# look for zlib compressed by ./compress after message with 1 space at end +#>>>&0 indirect x \b; contains +# look for tar archive block by ./archive for package name manifest +>>288 string ustar \b; contains +>>>31 use tar-file +# look for zip/jar archive by ./archive ./zip after message with 1 space at end +#>>2079 search/1025/s PK\003\004 \b; contains +#>>>&0 indirect x +>19 string !none >>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) ->>19 string none\n \b, Not-Encrypted # Commented out because they don't seem useful to print # (but they are part of the header - the tar file comes after them): +# The 5th line is User Password Salt (128 Hex) +# string length too high with standard src configuration +#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s" #>>>&1 regex/1l .* \b, Password salt: %s +# The 6th line is Master Key Checksum Salt (128 Hex) #>>>>&1 regex/1l .* \b, Master salt: %s +# The 7th line is Number of PBDKF2 Rounds (10000) #>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s +# The 8th line is User key Initialization Vector (IV) (32 Hex) #>>>>>>&1 regex/1l .* \b, IV: %s +#>>>>>>&1 regex/1l .* \b, IV: %s +# The 9th line is Master IV+Key+Checksum (192 Hex) #>>>>>>>&1 regex/1l .* \b, Key: %s +# look for new line separator char after line number 9 +#>>>0x204 ubyte 0x0a NL found +#>>>>&1 ubequad x \b, Content magic %16.16llx # *.pit files by Joerg Jenderek -# http://forum.xda-developers.com/showthread.php?p=9122369 -# http://forum.xda-developers.com/showthread.php?t=816449 +# https://forum.xda-developers.com/showthread.php?p=9122369 +# https://forum.xda-developers.com/showthread.php?t=816449 # Partition Information Table for Samsung's smartphone with Android # used by flash software Odin 0 ulelong 0x12349876 @@ -143,3 +181,10 @@ # RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), # which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 0 lelong 0x00080003 Android binary XML + +# Android cryptfs footer +# From https://android.googlesource.com/\ +# platform/system/vold/+/refs/heads/master/cryptfs.h +0 lelong 0xd0b5b1c4 Android cryptfs footer +>4 leshort x \b, version: %d +>6 leshort x \b.%d diff --git a/contrib/file/magic/Magdir/animation b/contrib/file/magic/Magdir/animation index a6e50ff86b..62145b976e 100644 --- a/contrib/file/magic/Magdir/animation +++ b/contrib/file/magic/Magdir/animation @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: animation,v 1.63 2017/05/26 14:33:07 christos Exp $ +# $File: animation,v 1.74 2019/10/29 01:06:20 christos Exp $ # animation: file(1) magic for animation/movie formats # # animation formats @@ -32,9 +32,9 @@ !:mime application/x-quicktime-player 4 string/W jP JPEG 2000 image !:mime image/jp2 -# http://www.ftyps.com/ with local additions +# https://www.ftyps.com/ with local additions 4 string ftyp ISO Media -# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ +# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ >8 string XAVC \b, MPEG v4 system, Sony XAVC Codec >>96 string x \b, Audio "%.4s" >>118 beshort x at %dHz @@ -46,7 +46,7 @@ >>11 byte 4 \b v4 (H.263/AMR GSM 6.10) >>11 byte 5 \b v5 (H.263/AMR GSM 6.10) >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) -# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf +# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf # Section 8.1.1, corresponds to a, b, c >>11 byte 0x61 \b C.S0050-0 V1.0 >>11 byte 0x62 \b C.S0050-0-A V1.0.0 @@ -56,20 +56,20 @@ >>11 byte 6 \b, Release 6 MBMS Extended Presentations >>11 byte 7 \b, Release 7 MBMS Extended Presentations >8 string 3gg \b, MPEG v4 system, 3GPP ->11 byte 6 \b, Release 6 General Profile !:mime video/3gpp +>>11 byte 6 \b, Release 6 General Profile >8 string 3gp \b, MPEG v4 system, 3GPP ->11 byte 1 \b, Release %d (non existent) ->11 byte 2 \b, Release %d (non existent) ->11 byte 3 \b, Release %d (non existent) ->11 byte 4 \b, Release %d ->11 byte 5 \b, Release %d ->11 byte 6 \b, Release %d ->11 byte 7 \b, Release %d Streaming Servers !:mime video/3gpp +>>11 byte 1 \b, Release %d (non existent) +>>11 byte 2 \b, Release %d (non existent) +>>11 byte 3 \b, Release %d (non existent) +>>11 byte 4 \b, Release %d +>>11 byte 5 \b, Release %d +>>11 byte 6 \b, Release %d +>>11 byte 7 \b, Release %d Streaming Servers >8 string 3gs \b, MPEG v4 system, 3GPP ->11 byte 7 \b, Release %d Streaming Servers !:mime video/3gpp +>>11 byte 7 \b, Release %d Streaming Servers >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] !:mime video/mp4 >8 string/W qt \b, Apple QuickTime movie @@ -188,6 +188,36 @@ >8 string pana \b, Panasonic Digital Camera >8 string qt \b, Apple QuickTime (.MOV/QT) !:mime video/quicktime +# HEIF image format +# see https://nokiatech.github.io/heif/technical.html +>8 string mif1 \b, HEIF Image +!:mime image/heif +>8 string msf1 \b, HEIF Image Sequence +!:mime image/heif-sequence +>8 string heic \b, HEIF Image HEVC Main or Main Still Picture Profile +!:mime image/heic +>8 string heix \b, HEIF Image HEVC Main 10 Profile +!:mime image/heic +>8 string hevc \b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile +!:mime image/heic-sequence +>8 string hevx \b, HEIF Image Sequence HEVC Main 10 Profile +!:mime image/heic-sequence +# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017) +# but used in the reference implementation: +# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp +>8 string heim \b, HEIF Image L-HEVC +!:mime image/heif +>8 string heis \b, HEIF Image L-HEVC +!:mime image/heif +>8 string avic \b, HEIF Image AVC +!:mime image/heif +>8 string hevm \b, HEIF Image Sequence L-HEVC +!:mime image/heif-sequence +>8 string hevs \b, HEIF Image Sequence L-HEVC +!:mime image/heif-sequence +>8 string avcs \b, HEIF Image Sequence AVC +!:mime image/heif-sequence + >8 string ROSS \b, Ross Video >8 string sdv \b, SD Memory Card Video >8 string ssc1 \b, Samsung stereo, single stream (patent pending) @@ -415,52 +445,43 @@ # modified by Joerg Jenderek # GRR the original test are too common for many DOS files # so don't accept as MP3 until we've tested the rate +# But also beat GEMDOS fonts 0 beshort&0xFFFE 0xFFFA # rates ->2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps -!:mime audio/mpeg ->2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps -!:mime audio/mpeg ->2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps +>2 byte&0xF0 !0 +>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1 +!:strength +20 !:mime audio/mpeg +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 40 kbps +>2 byte&0xF0 0x30 \b, 48 kbps +>2 byte&0xF0 0x40 \b, 56 kbps +>2 byte&0xF0 0x50 \b, 64 kbps +>2 byte&0xF0 0x60 \b, 80 kbps +>2 byte&0xF0 0x70 \b, 96 kbps +>2 byte&0xF0 0x80 \b, 112 kbps +>2 byte&0xF0 0x90 \b, 128 kbps +>2 byte&0xF0 0xA0 \b, 160 kbps +>2 byte&0xF0 0xB0 \b, 192 kbps +>2 byte&0xF0 0xC0 \b, 224 kbps +>2 byte&0xF0 0xD0 \b, 256 kbps +>2 byte&0xF0 0xE0 \b, 320 kbps # timing ->2 byte&0x0C 0x00 \b, 44.1 kHz ->2 byte&0x0C 0x04 \b, 48 kHz ->2 byte&0x0C 0x08 \b, 32 kHz +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz # channels/options ->3 byte&0xC0 0x00 \b, Stereo ->3 byte&0xC0 0x40 \b, JntStereo ->3 byte&0xC0 0x80 \b, 2x Monaural ->3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 # MP2, M1A 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 @@ -825,6 +846,7 @@ # conti_count 4 bit - 0 belong&0xFF5FFF10 0x47400010 >188 byte 0x47 MPEG transport stream data +!:mime video/MP2T # DIF digital video file format 0 belong&0xffffff00 0x1f070000 DIF @@ -856,16 +878,19 @@ # Vivo video (Wolfram Kleff) 3 string \x0D\x0AVersion:Vivo Vivo video data +# ABC (alembic.io 3d models) +0 string 0gawa ABC 3d model + # VRML (Virtual Reality Modelling Language) 0 string/w #VRML\ V1.0\ ascii VRML 1 file !:mime model/vrml 0 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file !:mime model/vrml -# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] +# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd] # From Michel Briand # mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml -# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d +# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 0 string/w \20 search/1000/w \ 2008-07-18 -0 string BIK Bink Video ->3 regex =[a-z] rev.%s +0 name bik #>4 ulelong x size %d >20 ulelong x \b, %d >24 ulelong x \bx%d @@ -957,62 +981,70 @@ #>>51 byte&0x10 0 FFT #>>51 byte&0x10 !0 DCT +0 string BIK +>3 regex =[bdfghi] Bink Video rev.%s +>>0 use bik + +0 string KB2 +>3 regex =[adfghi] Bink Video 2 rev.%s +>>0 use bik + # Type: NUT Container -# URL: http://wiki.multimedia.cx/index.php?title=NUT +# URL: https://wiki.multimedia.cx/index.php?title=NUT # From: Adam Buchbinder 0 string nut/multimedia\ container\0 NUT multimedia container # Type: Nullsoft Video (NSV) -# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video +# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video # From: Mike Melanson 0 string NSVf Nullsoft Video # Type: REDCode Video -# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode +# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode # From: Mike Melanson 4 string RED1 REDCode Video # Type: MTV Multimedia File -# URL: http://wiki.multimedia.cx/index.php?title=MTV +# URL: https://wiki.multimedia.cx/index.php?title=MTV # From: Mike Melanson 0 string AMVS MTV Multimedia File # Type: ARMovie -# URL: http://wiki.multimedia.cx/index.php?title=ARMovie +# URL: https://wiki.multimedia.cx/index.php?title=ARMovie # From: Mike Melanson 0 string ARMovie\012 ARMovie # Type: Interplay MVE Movie -# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE +# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE # From: Mike Melanson 0 string Interplay\040MVE\040File\032 Interplay MVE Movie # Type: Windows Television DVR File -# URL: http://wiki.multimedia.cx/index.php?title=WTV +# URL: https://wiki.multimedia.cx/index.php?title=WTV # From: Mike Melanson # This takes the form of a Windows-style GUID 0 bequad 0xB7D800203749DA11 >8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media # Type: Sega FILM/CPK Multimedia -# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM +# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM # From: Mike Melanson 0 string FILM Sega FILM/CPK Multimedia, >32 belong x %d x >28 belong x %d # Type: Nintendo THP Multimedia -# URL: http://wiki.multimedia.cx/index.php?title=THP +# URL: https://wiki.multimedia.cx/index.php?title=THP # From: Mike Melanson 0 string THP\0 Nintendo THP Multimedia # Type: BBC Dirac Video -# URL: http://wiki.multimedia.cx/index.php?title=Dirac +# URL: https://wiki.multimedia.cx/index.php?title=Dirac # From: Mike Melanson 0 string BBCD BBC Dirac Video # Type: RAD Game Tools Smacker Multimedia -# URL: http://wiki.multimedia.cx/index.php?title=Smacker +# URL: https://wiki.multimedia.cx/index.php?title=Smacker # From: Mike Melanson 0 string SMK RAD Game Tools Smacker Multimedia >3 byte x version %c, @@ -1027,3 +1059,17 @@ 0 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format !:ext mxf !:mime application/mxf + +# Recognize LucasArts Smush video files (cf. +# https://wiki.multimedia.cx/index.php/Smush) +0 string ANIM +>8 string AHDR LucasArts Smush Animation Format (SAN) video +0 string SANM +>8 string SHDR LucasArts Smush v2 (SANM) video + +# Type: Scaleform video +# Extension: .usm +# URL: https://wiki.multimedia.cx/index.php/USM +# From: David Korth +0 string CRID +>32 string @UTF Scaleform video diff --git a/contrib/file/magic/Magdir/apple b/contrib/file/magic/Magdir/apple index 391205f265..e0617454cd 100644 --- a/contrib/file/magic/Magdir/apple +++ b/contrib/file/magic/Magdir/apple @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $ +# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $ # apple: file(1) magic for Apple file formats # 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text @@ -11,22 +11,109 @@ 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file +# Type: Apple Emulator WOZ format +# From: Greg Wildman +# Ref: https://applesaucefdc.com/woz/reference/ +# Ref: https://applesaucefdc.com/woz/reference2/ +# +# Note: The following test are mostly identical. I would rather not +# use a regex to identify the WOZ format number. +0 string WOZ1 +>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image +>12 string INFO +>>21 byte 01 \b, 5.25 inch +>>21 byte 02 \b, 3.5 inch +>>22 byte 01 \b, write protected +>>23 byte 01 \b, cross track synchronized +>>25 string/T x \b, %.32s +0 string WOZ2 +>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image +>12 string INFO +>>21 byte 01 \b, 5.25 inch +>>21 byte 02 \b, 3.5 inch +>>22 byte 01 \b, write protected +>>23 byte 01 \b, cross track synchronized +>>25 string/T x \b, %.32s + +# Type: Apple Emulator disk images +# From: Greg Wildman +# ProDOS boot loader? +0 string \x01\x38\xB0\x03\x4C Apple ProDOS Image +# Detect Volume Directory block ($02) +>0x400 string \x00\x00\x03\x00 +>>0x404 byte &0xF0 +>>>0x405 string x \b, Volume /%s +>>>0x429 leshort x \b, %u Blocks +# ProDOS ordered ? +>0xb00 string \x00\x00\x03\x00 +>>0xb04 byte &0xF0 +>>>0xb05 string x \b, Volume /%s +>>>0xb29 leshort x \b, %u Blocks +# +# DOS3.3 boot loader? +0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B +>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image +>>0x11006 byte x \b, Volume %u +>>0x11034 byte x \b, %u Tracks +>>0x11035 byte x \b, %u Sectors +>>0x11036 leshort x \b, %u bytes per sector +# DOS3.2 ? +>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image +>>0x11006 byte x \b, Volume %u +>>0x11034 byte x \b, %u Tracks +>>0x11035 byte x \b, %u Sectors +>>0x11036 leshort x \b, %u bytes per sector +# DOS3.1 ? +>0x11001 string \x11\x0C\x01 +>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image +# +# Pascal boot loader? +0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD +>0xd6 pstring SYSTEM.APPLE +>>0xb00 leshort 0x0000 +>>>0xb04 leshort 0x0000 Apple Pascal Image +>>>>0xb06 pstring x \b, Volume %s: +>>>>0xb0e leshort x \b, %u Blocks +>>>>0xb10 leshort x \b, %u Files +# +# Diversi Dos boot loader? +0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD +>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image +>>0x11006 byte x \b, Volume %u +>>0x11034 byte x \b, %u Tracks +>>0x11035 byte x \b, %u Sectors +>>0x11036 leshort x \b, %u bytes per sector + # Type: Apple Emulator 2IMG format # From: Radek Vokal -0 string 2IMG Apple ][ 2IMG Disk Image ->4 string XGS! \b, XGS ->4 string CTKG \b, Catakig ->4 string ShIm \b, Sheppy's ImageMaker ->4 string WOOF \b, Sweet 16 ->4 string B2TR \b, Bernie ][ the Rescue ->4 string !nfc \b, ASIMOV2 ->4 string x \b, Unknown Format ->0xc byte 00 \b, DOS 3.3 sector order ->>0x10 byte 00 \b, Volume 254 ->>0x10 byte&0x7f x \b, Volume %u ->0xc byte 01 \b, ProDOS sector order ->>0x14 short x \b, %u Blocks ->0xc byte 02 \b, NIB data +# Update: Greg Wildman +0 string 2IMG Apple ][ 2IMG Disk Image +>4 clear x +>4 string XGS! \b, XGS +>4 string CTKG \b, Catakig +>4 string ShIm \b, Sheppy's ImageMaker +>4 string SHEP \b, Sheppy's ImageMaker +>4 string WOOF \b, Sweet 16 +>4 string B2TR \b, Bernie ][ the Rescue +>4 string \!nfc \b, ASIMOV2 +>4 string \>BD\< \b, Brutal Deluxe's Cadius +>4 string CdrP \b, CiderPress +>4 string Vi][ \b, Virtual ][ +>4 string PRFS \b, ProFUSE +>4 string FISH \b, FishWings +>4 string RVLW \b, Revival for Windows +>4 default x +>>4 string x \b, Creator tag "%-4.4s" +>0xc byte 00 \b, DOS 3.3 sector order +>>0x10 byte 00 \b, Volume 254 +>>0x10 byte&0x7f x \b, Volume %u +>0xc byte 01 \b, ProDOS sector order +# Detect Volume Directory block ($02) + 2mg header offset +>>0x440 string \x00\x00\x03\x00 +>>>0x444 byte &0xF0 +>>>>0x445 string x \b, Volume /%s +>>>>0x469 leshort x \b, %u Blocks +>0xc byte 02 \b, NIB data # magic for Newton PDA package formats # from Ruda Moura @@ -88,7 +175,7 @@ # http://home.earthlink.net/~hughhood/appleiiworksenvoy/ # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') # $70 $1A $F8 $FF is this the apple type ? -#:apple pdospøÿ +#:apple pdosp^Z\xf8\xff !:ext awp # minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) >>>183 ubyte 30 3.0 @@ -354,7 +441,7 @@ >>6 ubeshort x \b, type 0x%x # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map -# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h +# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h # Update: Joerg Jenderek # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the # magic stronger. @@ -396,8 +483,8 @@ # is the startup partition APPLE_PS_STARTUP >>88 ubelong &0x80000000 \b, is the startup partition -#http://wiki.mozilla.org/DS_Store_File_Format -#http://en.wikipedia.org/wiki/.DS_Store +#https://wiki.mozilla.org/DS_Store_File_Format +#https://en.wikipedia.org/wiki/.DS_Store 0 string \0\0\0\1Bud1\0 Apple Desktop Services Store # HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) @@ -431,3 +518,19 @@ >>>>0 use appleworks >0 belong 0x0481ad00 >>0 use appleworks + +# magic for Apple File System (APFS) +# from Alex Myczko +32 string NXSB Apple File System (APFS) +>36 ulelong x \b, blocksize %u + +# iTunes cover art (versions 1 and 2) +4 string itch +>24 string artw +>>0x1e8 string data iTunes cover art +>>>0x1ed string PNG (PNG) +>>>0x1ec beshort 0xffd8 (JPEG) + +# MacPaint image +65 string PNTGMPNT MacPaint image data +#0 belong 2 MacPaint image data diff --git a/contrib/file/magic/Magdir/archive b/contrib/file/magic/Magdir/archive index abecf7101f..6ec5b6d3c3 100644 --- a/contrib/file/magic/Magdir/archive +++ b/contrib/file/magic/Magdir/archive @@ -1,19 +1,154 @@ #------------------------------------------------------------------------------ -# $File: archive,v 1.108 2017/08/30 13:45:10 christos Exp $ +# $File: archive,v 1.133 2019/11/15 21:03:14 christos Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. -# pre-POSIX "tar" archives are handled in the C code. +# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. # POSIX tar archives -257 string ustar\0 POSIX tar archive -!:mime application/x-tar # encoding: posix -257 string ustar\040\040\0 GNU tar archive -!:mime application/x-tar # encoding: gnu +# URL: https://en.wikipedia.org/wiki/Tar_(computing) +# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current +# header mainly padded with nul bytes +500 quad 0 +!:strength /2 +# filename or extended attribute printable strings in range space null til umlaut ue +>0 ubeshort >0x1F00 +>>0 ubeshort <0xFCFD +# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad +# at https://sourceforge.net/projects/s-tar/files/testscripts/ +>>>508 ubelong&0x8B9E8DFF 0 +# nul, space or ascii digit 0-7 at start of mode +>>>>100 ubyte&0xC8 =0 +>>>>>101 ubyte&0xC8 =0 +# nul, space at end of check sum +>>>>>>155 ubyte&0xDF =0 +# space or ascii digit 0 at start of check sum +>>>>>>>148 ubyte&0xEF =0x20 +>>>>>>>>0 use tar-file +# minimal check and then display tar archive information which can also be +# embedded inside others like Android Backup, Clam AntiVirus database +0 name tar-file +>257 string !ustar +# header padded with nuls +>>257 ulong =0 +# GNU tar version 1.29 with non pax format option without refusing +# creates misleading V7 header for Long path, Multi-volume, Volume type +>>>156 ubyte 0x4c GNU tar archive +!:mime application/x-gtar +!:ext tar/gtar +>>>156 ubyte 0x4d GNU tar archive +!:mime application/x-gtar +!:ext tar/gtar +>>>156 ubyte 0x56 GNU tar archive +!:mime application/x-gtar +!:ext tar/gtar +>>>156 default x tar archive (V7) +!:mime application/x-tar +!:ext tar +# other stuff in padding +# some implementations add new fields to the blank area at the end of the header record +# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option +>>257 ulong !0 tar archive (old) +!:mime application/x-tar +!:ext tar +# magic in newer, GNU, posix variants +>257 string =ustar +# 2 last char of magic and UStar version because string expression does not work +# 2 space characters followed by a null for GNU variant +>>261 ubelong =0x72202000 POSIX tar archive (GNU) +!:mime application/x-gtar +!:ext tar/gtar +# UStar version with ASCII "00" +>>261 ubelong 0x72003030 POSIX +# gLOBAL and ExTENSION type only found in POSIX.1-2001 format +>>>156 ubyte 0x67 \b.1-2001 +>>>156 ubyte 0x78 \b.1-2001 +>>>156 ubyte x tar archive +!:mime application/x-ustar +!:ext tar/ustar +# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab +>>261 ubelong 0x72000000 tar archive (ustar) +!:mime application/x-ustar +!:ext tar/ustar +# not seen ustar variant with garbish version +>>261 default x tar archive (unknown ustar) +!:mime application/x-ustar +!:ext tar/ustar +# type flag of 1st tar archive member +#>156 ubyte x \b, %c-type +>156 ubyte x +>>156 ubyte 0 \b, file +>>156 ubyte 0x30 \b, file +>>156 ubyte 0x31 \b, hard link +>>156 ubyte 0x32 \b, symlink +>>156 ubyte 0x33 \b, char device +>>156 ubyte 0x34 \b, block device +>>156 ubyte 0x35 \b, directory +>>156 ubyte 0x36 \b, fifo +>>156 ubyte 0x37 \b, reserved +>>156 ubyte 0x4c \b, long path +>>156 ubyte 0x4d \b, multi volume +>>156 ubyte 0x56 \b, volume +>>156 ubyte 0x67 \b, global +>>156 ubyte 0x78 \b, extension +>>156 default x \b, type +>>>156 ubyte x '%c' +# name[100] +>0 string >\0 %-.60s +# mode mainly stored as an octal number in ASCII null or space terminated +>100 string >\0 \b, mode %-.7s +# user id mainly as octal numbers in ASCII null or space terminated +>108 string >\0 \b, uid %-.7s +# group id mainly as octal numbers in ASCII null or space terminated +>116 string >\0 \b, gid %-.7s +# size mainly as octal number in ASCII +>124 ubyte <0x38 +>>124 string >\0 \b, size %-.12s +# coding indicated by setting the high-order bit of the leftmost byte +>124 ubyte >0xEF \b, size 0x +>>124 ubyte !0xff \b%2.2x +>>125 ubyte !0xff \b%2.2x +>>126 ubyte !0xff \b%2.2x +>>127 ubyte !0xff \b%2.2x +>>128 ubyte !0xff \b%2.2x +>>129 ubyte !0xff \b%2.2x +>>130 ubyte !0xff \b%2.2x +>>131 ubyte !0xff \b%2.2x +>>132 ubyte !0xff \b%2.2x +>>133 ubyte !0xff \b%2.2x +>>134 ubyte !0xff \b%2.2x +>>135 ubyte !0xff \b%2.2x +# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated +>136 string >\0 \b, seconds %-.11s +# header checksum stored as an octal number in ASCII null or space terminated +#>148 string x \b, cksum %.7s +# linkname[100] +>157 string >\0 \b, linkname %-.40s +# additional fields for ustar +>257 string =ustar +# owner user name null terminated +>>265 string >\0 \b, user %-.32s +# group name null terminated +>>297 string >\0 \b, group %-.32s +# device major minor if not zero +>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 +>>>329 string x \b, devmaj %-.7s +>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 +>>>337 string x \b, devmin %-.7s +# prefix[155] +>>345 string >\0 \b, prefix %-.155s +# old non ustar/POSIX tar +>257 string !ustar +>>508 string =tar\0 +# padding[255] in old star +>>>257 string >\0 \b, padding: %-.40s +>>508 default x +# padding[255] in old tar sometimes comment field +>>>257 string >\0 \b, comment: %-.40s # Incremental snapshot gnu-tar format from: -# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html +# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 0 string GNU\ tar- GNU tar incremental snapshot data >&0 regex [0-9]\.[0-9]+-[0-9]+ version %s @@ -91,21 +226,48 @@ # a portable archive whose first member has a name beginning with # "debian". # +# Update: Joerg Jenderek +# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 0 string =!\ndebian ->8 string debian-split part of multipart Debian package +# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html +>14 string -split part of multipart Debian package !:mime application/vnd.debian.binary-package ->8 string debian-binary Debian binary package +# udeb is used for stripped down deb file +!:ext deb/udeb +>14 string -binary Debian binary package !:mime application/vnd.debian.binary-package ->8 string !debian +!:ext deb/udeb +# This should not happen +>14 default x Unknown Debian package +# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted >68 string >\0 (format %s) -# These next two lines do not work, because a bzip2 Debian archive -# still uses gzip for the control.tar (first in the archive). Only -# data.tar varies, and the location of its filename varies too. -# file/libmagic does not current have support for ascii-string based -# (offsets) as of 2005-09-15. -#>81 string bz2 \b, uses bzip2 compression -#>84 string gz \b, uses gzip compression -#>136 ledate x created: %s +#>68 string !2.0\n +#>>68 string x (format %.3s) +>68 string =2.0\n +# 2nd archive name=control archive name like control.tar.gz or control.tar.xz +>>72 string >\0 \b, with %.14s +# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} +>>0 search/0x93e4f data.tar. \b, data compression +# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised +# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb +>>>&0 string x %.4s +# splitted debian package case +>68 string =2.1\n +# dpkg-1.18.25/dpkg-split/info.c +# NL terminated ASCII package name like ckermit +>>&0 string x \b, %s +# NL terminated package version like 302-5.3 +>>>&1 string x %s +# NL terminated MD5 checksum +>>>>&1 string x \b, MD5 %s +# NL terminated original package length +>>>>>&1 string x \b, unsplitted size %s +# NL terminated part length +>>>>>>&1 string x \b, part length %s +# NL terminated package part like n/m +>>>>>>>&1 string x \b, part %s +# NL terminated package architecture like armhf since dpkg 1.16.1 or later +>>>>>>>>&1 string x \b, %s # # MIPS archive; they're in the portable archive format, and need to go @@ -122,15 +284,35 @@ >19 string B and an EB hash table >22 string X -- out of date -0 search/1 -h- Software Tools format archive text - # # BSD/SVR2-and-later portable archive formats. # -0 string =! current ar archive +# Update: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/AR +# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ +# Note: Mach-O universal binary in ./cafebabe is dependent +# TODO: unify current ar archive, MIPS archive, Debian package +# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; +# *.ar packages from *.a libraries. handle empty archive +0 string =!\n current ar archive +# print first and possibly second ar_name[16] for debugging purpose +#>8 string x \b, 1st "%.16s" +#>68 string x \b, 2nd "%.16s" !:mime application/x-archive +# a in most case for libraries; lib for Microsoft libraries; ar else cases +!:ext a/lib/ar >8 string __.SYMDEF random library +# first member with long marked name __.SYMDEF SORTED implies BSD library >68 string __.SYMDEF\ SORTED random library +# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf +# "archive file" entry moved from ./hp +# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture +# LST header a_magic 0619h~relocatable library +>68 belong 0x020b0619 - PA-RISC1.0 relocatable library +>68 belong 0x02100619 - PA-RISC1.1 relocatable library +>68 belong 0x02110619 - PA-RISC1.2 relocatable library +>68 belong 0x02140619 - PA-RISC2.0 relocatable library +#EOF for common ar archives # # "Thin" archive, as can be produced by GNU ar. @@ -140,6 +322,8 @@ >68 belong 1 %d symbol entry >68 belong >1 %d symbol entries +0 search/1 -h- Software Tools format archive text + # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) # # The first byte is the magic (0x1a), byte 2 is the compression type for @@ -255,6 +439,34 @@ # skip keyword with low entropy >12 default x TTComp archive, binary, 4K dictionary # (version 5.25) labeled the above entry as "TTComp archive data" +# From: Joerg Jenderek +# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification +# reference: http://nulib.com/library/FTN.e00005.htm +0x52 ubeshort 0x0100 +# test for disk size equal or above 400k +>0x40 ubelong >409599 Apple DiskCopy 4.2 image +#!:mime application/octet-stream +!:apple dCpydImg +!:ext image/dc42 +# image pascal name padded with NULs like Microsoft Mail +>>00 pstring/B x %s +# data size in bytes like 409600 +>>0x40 ubelong x \b, %u bytes +# tag size in bytes +>>0x44 ubelong >0 \b, 0x%x tag size +# data checksum +#>>0x48 ubelong x \b, 0x%x checksum +# tag checksum +#>>0x4c ubelong x \b, 0x%x tag checksum +# disk encoding +>>0x50 ubyte 0 \b, GCR CLV ssdd (400k) +>>0x50 ubyte 1 \b, GCR CLV dsdd (800k) +>>0x50 ubyte 2 \b, MFM CAV dsdd (720k) +>>0x50 ubyte 3 \b, MFM CAV dshd (1440k) +>>0x50 ubyte >3 \b, 0x%x encoding +# format byte +>>0x51 ubyte x \b, 0x%x format +#>>0x54 ubequad x \b, data 0x%16.16llx # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack @@ -272,15 +484,115 @@ # PPMZ 0 string PPMZ PPMZ archive data # MS Compress -4 string \x88\xf0\x27 MS Compress archive data -# updated by Joerg Jenderek ->9 string \0 ->>0 string KWAJ ->>>7 string \321\003 MS Compress archive data ->>>>14 ulong >0 \b, original size: %d bytes ->>>>18 ubyte >0x65 ->>>>>18 string x \b, was %.8s ->>>>>(10.b-4) string x \b.%.3s +# Update: Joerg Jenderek +# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression +# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html +# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z +4 string \x88\xf0\x27 +# KWAJ variant +>0 string KWAJ MS Compress archive data, KWAJ variant +!:mime application/x-ms-compress-kwaj +# extension not working in version 5.32 +# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' +# file: line 284: Bad magic entry ' ??_' +!:ext ??_ +# compression method (0-4) +>>8 uleshort x \b, %u method +# offset of compressed data +>>10 uleshort x \b, 0x%x offset +#>>(10.s) uleshort x +#>>>&-6 string x \b, TEST extension %-.3s +# header flags to mark header extensions +>>12 uleshort >0 \b, 0x%x flags +# 4 bytes: decompressed length of file +>>12 uleshort &0x01 +>>>14 ulelong x \b, original size: %u bytes +# 2 bytes: unknown purpose +# 2 bytes: length of unknown data + mentioned bytes +# 1-9 bytes: null-terminated file name +# 1-4 bytes: null-terminated file extension +>>12 uleshort &0x08 +>>>12 uleshort ^0x01 +>>>>12 uleshort ^0x02 +>>>>>12 uleshort ^0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>14 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>14 string x \b, %-.8s +>>>>>>>>&1 string x \b.%-.3s +>>>>>12 uleshort &0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>(14.s) uleshort x +>>>>>>>>&14 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>(14.s) uleshort x +>>>>>>>>&14 string x \b, %-.8s +>>>>>>>>>&1 string x \b.%-.3s +>>>>12 uleshort &0x02 +>>>>>12 uleshort ^0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>16 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>16 string x \b, %-.8s +>>>>>>>>&1 string x \b.%-.3s +>>>>>12 uleshort &0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>(16.s) uleshort x +>>>>>>>>&16 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>(16.s) uleshort x +>>>>>>>&16 string x %-.8s +>>>>>>>>&1 string x \b.%-.3s +>>>12 uleshort &0x01 +>>>>12 uleshort ^0x02 +>>>>>12 uleshort ^0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>18 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>18 string x \b, %-.8s +>>>>>>>>&1 string x \b.%-.3s +>>>>>12 uleshort &0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>(18.s) uleshort x +>>>>>>>>&18 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>(18.s) uleshort x +>>>>>>>>&18 string x \b, %-.8s +>>>>>>>>>&1 string x \b.%-.3s +>>>>12 uleshort &0x02 +>>>>>12 uleshort ^0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>20 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>20 string x \b, %-.8s +>>>>>>>>&1 string x \b.%-.3s +>>>>>12 uleshort &0x04 +>>>>>>12 uleshort ^0x10 +>>>>>>>(20.s) uleshort x +>>>>>>>>&20 string x \b, %-.8s +>>>>>>12 uleshort &0x10 +>>>>>>>(20.s) uleshort x +>>>>>>>>&20 string x \b, %-.8s +>>>>>>>>>&1 string x \b.%-.3s +# 2 bytes: length of data + mentioned bytes +# +# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ +>0 string SZDD MS Compress archive data, SZDD variant +!:mime application/x-ms-compress-szdd +!:ext ??_ +# The character missing from the end of the filename (0=unknown) +>>9 string >\0 \b, %-.1s is last character of original name +# https://www.betaarchive.com/forum/viewtopic.php?t=26161 +# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e +>>8 string !A \b, %-.1s method +>>10 ulelong >0 \b, original size: %u bytes +# QBasic SZDD variant +3 string \x88\xf0\x27 +>0 string SZ\x20 MS Compress archive data, QBasic variant +!:mime application/x-ms-compress-sz +!:ext ??$ +>>8 ulelong >0 \b, original size: %u bytes + # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET @@ -483,9 +795,19 @@ # These were inspired by idarc, but actually verified # Dzip archiver (.dz) -0 string DZ Dzip archive data ->2 byte x \b, version %i ->3 byte x \b.%i +# Update: Joerg Jenderek +# URL: http://speeddemosarchive.com/dzip/ +# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c +# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt +0 string DZ +# latest version is 2.9 dated 7 may 2003 +>2 byte <4 Dzip archive data +!:mime application/x-dzip +!:ext dz +>>2 byte x \b, version %i +>>3 byte x \b.%i +>>4 ulelong x \b, offset 0x%x +>>8 ulelong x \b, %u files # ZZip archiver (.zz) 0 string ZZ\ \0\0 ZZip archive data 0 string ZZ0 ZZip archive data @@ -554,7 +876,7 @@ # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/LHA_(file_format) -# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html +# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html # # check and display information of lharc (LHa,PMarc) file 0 name lharc-file @@ -754,7 +1076,7 @@ !:ext rar # Very old RAR archive -# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf +# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 0 string RE\x7e\x5e RAR archive data (>>62 string base Database file # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) -# http://lists.oasis-open.org/archives/office/200505/msg00006.html +# https://lists.oasis-open.org/archives/office/200505/msg00006.html # (mimetype contains "application/vnd.oasis.opendocument.") >>50 string vnd.oasis.opendocument. OpenDocument >>>73 string text @@ -857,6 +1181,9 @@ !:mime application/vnd.oasis.opendocument.formula-template >>>73 string database Database !:mime application/vnd.oasis.opendocument.database +# Valid for LibreOffice Base 6.0.1.1 at least +>>>73 string base Database +!:mime application/vnd.oasis.opendocument.base >>>73 string image >>>>78 byte !0x2d Image !:mime application/vnd.oasis.opendocument.image @@ -864,22 +1191,36 @@ !:mime application/vnd.oasis.opendocument.image-template # EPUB (OEBPS) books using OCF (OEBPS Container Format) -# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. +# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. # From: Ralf Brown >>50 string epub+zip EPUB document !:mime application/epub+zip +# From: Joerg Jenderek +# URL: http://en.wikipedia.org/wiki/CorelDRAW +# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based +>>50 string x-vnd.corel. Corel +>>>62 string draw.document+zip Draw drawing, version 14-16 +!:mime application/x-vnd.corel.draw.document+zip +!:ext cdr +>>>62 string draw.template+zip Draw template, version 14-16 +!:mime application/x-vnd.corel.draw.template+zip +!:ext cdrt +>>>62 string zcf.draw.document+zip Draw drawing, version 17-21 +!:mime application/x-vnd.corel.zcf.draw.document+zip +!:ext cdr +>>>62 string zcf.draw.template+zip Draw template, version 17-21 +!:mime application/x-vnd.corel.zcf.draw.template+zip +!:ext cdt/cdrt + # Catch other ZIP-with-mimetype formats # In a ZIP file, the bytes immediately after a member's contents are # always "PK". The 2 regex rules here print the "mimetype" member's # contents up to the first 'P'. Luckily, most MIME types don't contain # any capital 'P's. This is a kludge. # (mimetype contains "application/") ->>50 string !epub+zip ->>>50 string !vnd.oasis.opendocument. ->>>>50 string !vnd.sun.xml. ->>>>>50 string !vnd.kde. ->>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) +>>50 default x Zip data +>>>38 regex [!-OQ-~]+ (MIME type "%s"?) !:mime application/zip # (mimetype contents other than "application/*") >26 string \x8\0\0\0mimetype @@ -904,21 +1245,9 @@ >(26.s+30) leshort !0xcafe >>26 string !\x8\0\0\0mimetype Zip archive data !:mime application/zip ->>>4 byte 0x09 \b, at least v0.9 to extract ->>>4 byte 0x0a \b, at least v1.0 to extract ->>>4 byte 0x0b \b, at least v1.1 to extract ->>>4 byte 0x14 \b, at least v2.0 to extract ->>>4 byte 0x15 \b, at least v2.1 to extract ->>>4 byte 0x19 \b, at least v2.5 to extract ->>>4 byte 0x1b \b, at least v2.7 to extract ->>>4 byte 0x2d \b, at least v4.5 to extract ->>>4 byte 0x2e \b, at least v4.6 to extract ->>>4 byte 0x32 \b, at least v5.0 to extract ->>>4 byte 0x33 \b, at least v5.1 to extract ->>>4 byte 0x34 \b, at least v5.2 to extract ->>>4 byte 0x3d \b, at least v6.1 to extract ->>>4 byte 0x3e \b, at least v6.2 to extract ->>>4 byte 0x3f \b, at least v6.3 to extract +>>>4 beshort x \b, at least +>>>4 use zipversion +>>>4 beshort x to extract >>>0x161 string WINZIP \b, WinZIP self-extracting # StarView Metafile @@ -1003,6 +1332,10 @@ # Durval Menezes, 0 string d13:announce-list BitTorrent file !:mime application/x-bittorrent +0 string d7:comment BitTorrent file +!:mime application/x-bittorrent +0 string d4:info BitTorrent file +!:mime application/x-bittorrent # Atari MSA archive - Teemu Hukkanen 0 beshort 0x0e0f Atari MSA archive data @@ -1014,6 +1347,8 @@ # Alternate ZIP string (amc@arwen.cs.berkeley.edu) 0 string PK00PK\003\004 Zip archive data +!:mime application/zip +!:ext zip/cbz # ACE archive (from http://www.wotsit.org/download.asp?f=ace) # by Stefan `Sec` Zehl @@ -1068,6 +1403,16 @@ >5 byte x \b.%d >6 belong x (%d bytes) +# From: Joerg Jenderek +# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php +# reference: http://mark0.net/download/triddefs_xml.7z/ +# defs/f/fzip.trid.xml +# Note: unknown compression; No "PK" zip magic; normally in directory like +# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" +0 ubequad 0x2506781901010000 Foxit add-on/update +!:mime application/x-fzip +!:ext fzip + # From: "Robert Dale" 0 belong 123 dar archive, >4 belong x label "%.8x @@ -1078,7 +1423,7 @@ >14 beshort 0x4e53 multi-part, with -S # Symbian installation files -# http://www.thouky.co.uk/software/psifs/sis.html +# https://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file !:mime application/vnd.symbian.install @@ -1096,24 +1441,74 @@ >10 string x with compression level %.1s # xar (eXtensible ARchiver) archive -# xar archive format: http://code.google.com/p/xar/ +# URL: https://en.wikipedia.org/wiki/Xar_(archiver) +# xar archive format: https://code.google.com/p/xar/ # From: "David Remahl" +# Update: Joerg Jenderek +# TODO: lzma compression; X509Data for pkg and xip +# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or +# 7z t -txar Xcode_10.2_beta_4.xip` 0 string xar! xar archive !:mime application/x-xar -#>4 beshort x header size %d ->6 beshort x version %d, -#>8 quad x compressed TOC: %d, -#>16 quad x uncompressed TOC: %d, +# pkg for Mac OSX installer package like FullBundleUpdate.pkg +# xip for signed Apple software like Xcode_10.2_beta_4.xip +!:ext xar/pkg/xip +# always 28 in older archives +>4 ubeshort >28 \b, header size %u +# currently there exit only version 1 since about 2014 +>6 ubeshort >1 version %u, +>8 ubequad x compressed TOC: %llu, +#>16 ubequad x uncompressed TOC: %llu, +# cksum_alg 0-2 in older and also 3-4 in newer >24 belong 0 no checksum >24 belong 1 SHA-1 checksum >24 belong 2 MD5 checksum +>24 belong 3 SHA-256 checksum +>24 belong 4 SHA-512 checksum +>24 belong >4 unknown 0x%x checksum +#>24 belong >4 checksum +# For no compression jump 0 bytes +>24 belong 0 +>>0 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +#>>>>&(8.Q) ubequad x \b, heap data 0x%llx +>>>>&(8.Q) ubyte x +# look for data by ./compress after message with 1 space at end +>>>>>&-3 indirect x \b, contains +# For SHA-1 jump 20 minus 2 bytes +>24 belong 1 +>>18 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +>>>>&(8.Q) ubyte x +# data compressed by gzip, bzip, lzma or none +>>>>>&-1 indirect x \b, contains +# For SHA-256 jump 32 minus 2 bytes +>24 belong 3 +>>30 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +>>>>&(8.Q) ubyte x +>>>>>&-1 indirect x \b, contains +# For SHA-512 jump 64 minus 2 bytes +>24 belong 4 +>>62 ubyte x +# jump more bytes forward by header size +>>>&(4.S) ubyte x +# jump more bytes forward by compressed table of contents size +>>>>&(8.Q) ubyte x +>>>>>&-1 indirect x \b, contains # Type: Parity Archive # From: Daniel van Eeden 0 string PAR2 Parity Archive Volume Set # Bacula volume format. (Volumes always start with a block header.) -# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html +# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html # From: Adam Buchbinder 12 string BB02 Bacula volume >20 bedate x \b, started %s @@ -1128,11 +1523,11 @@ 0 string zPQ ZPAQ stream >3 byte x \b, level %d # From: Barry Carter -# http://encode.ru/threads/456-zpaq-updates/page32 +# https://encode.ru/threads/456-zpaq-updates/page32 0 string 7kSt ZPAQ file # BBeB ebook, unencrypted (LRF format) -# URL: http://www.sven.de/librie/Librie/LrfFormat +# URL: https://www.sven.de/librie/Librie/LrfFormat # From: Adam Buchbinder 0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted >8 beshort x \b, version %d @@ -1142,8 +1537,8 @@ >44 beshort x %d) # Symantec GHOST image by Joerg Jenderek at May 2014 -# http://us.norton.com/ghost/ -# http://www.garykessler.net/library/file_sigs.html +# https://us.norton.com/ghost/ +# https://www.garykessler.net/library/file_sigs.html 0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image # *.GHO >2 ubyte&0x08 0x00 \b, first file @@ -1186,3 +1581,58 @@ # reference: https://github.com/MarcoPon/SeqBox 0 string SBx SeqBox, >3 byte x version %d + +# LyNX archive +56 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive + +# From: Joerg Jenderek +# URL: https://www.acronis.com/ +# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) +# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 +0 ubequad 0xce24b9a220000000 Acronis True Image backup +!:mime application/x-acronis-tib +!:ext tib +# 01000000 +#>20 ubelong x \b, at 20 0x%x +# 20000000 +#>28 ubelong x \b, at 28 0x%x +# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" +# ??? +# strings like "\Device\0000011e" "\Device\0000015a" +#>0 search/0x6852300/cs \\Device\\ +#>>&-1 pstring x \b, %s +# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" +#>>>&1 search/180/cs \\Device\\ +#>>>>&-1 pstring x \b, %s +#>>>>>&0 search/29/cs \0\0\xc8\0 +# disk label +#>>>>>>&10 lestring16 x \b, disk label %11.11s +#>>>>>>&9 plestring16 x \b, disk label "%11.11s" +#>>>>>>&10 ubequad x %16.16llx + + +# Gentoo XPAK binary package +# by Michal Gorny +# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 +-4 string STOP +>-16 string XPAKSTOP Gentoo binary package (XPAK) + +# From: Joerg Jenderek +# URL: https://kodi.wiki/view/TexturePacker +# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz +# /xbmc-Krypton/xbmc/guilib/XBTF.h +# /xbmc-Krypton/xbmc/guilib/XBTF.cpp +0 string XBTF +# skip ASCII text by looking for terminating \0 of path +>264 ubyte 0 XBMC texture package +!:mime application/x-xbmc-xbt +!:ext xbt +# XBTF_VERSION 2 +>>4 string !2 \b, version %-.1s +# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp +>>5 ulelong x \b, %u file +# plural s +>>5 ulelong >1 \bs +# path[CXBTFFile[MaximumPathLength=256] +>>9 string x \b, 1st %s + diff --git a/contrib/file/magic/Magdir/audio b/contrib/file/magic/Magdir/audio index 0330bbfa80..448f000a38 100644 --- a/contrib/file/magic/Magdir/audio +++ b/contrib/file/magic/Magdir/audio @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: audio,v 1.80 2017/08/13 00:21:47 christos Exp $ +# $File: audio,v 1.118 2019/11/19 05:30:07 christos Exp $ # audio: file(1) magic for sound formats (see also "iff") # # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), @@ -139,6 +139,11 @@ 0x2c string SCRM ScreamTracker III Module sound data >0 string >\0 Title: "%s" +!:mime audio/x-s3m + +# .stm before it got above .s3m extension +0x16 string \!Scream\! ScreamTracker Module sound data +>0 string >\0 Title: "%s" # Gravis UltraSound patches # From @@ -393,9 +398,15 @@ 0 string MED MED_Song 0 string SymM Symphonie SymMOD music file # +# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS) +# http://lclevy.free.fr/exotica/ahx/ahxformat.txt 0 string THX AHX version >3 byte =0 1 module data >3 byte =1 2 module data +>10 byte x TRL: %u +>11 byte x TRK: %u +>12 byte x SMP: %u +>13 byte x SS: %u # 0 string OKTASONG Oktalyzer module data # @@ -450,7 +461,7 @@ # Free lossless audio codec # From: Przemyslaw Augustyniak 0 string fLaC FLAC audio bitstream data -!:mime audio/x-flac +!:mime audio/flac >4 byte&0x7f >0 \b, unknown version >4 byte&0x7f 0 \b # some common bits/sample values @@ -468,20 +479,25 @@ >>20 byte&0xe 0xa \b, 6 channels >>20 byte&0xe 0xc \b, 7 channels >>20 byte&0xe 0xe \b, 8 channels -# some common sample rates ->>17 belong&0xfffff0 0x2ee000 \b, 192 kHz ->>17 belong&0xfffff0 0x158880 \b, 88.2 kHz ->>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz ->>17 belong&0xfffff0 0x0bb800 \b, 48 kHz ->>17 belong&0xfffff0 0x07d000 \b, 32 kHz ->>17 belong&0xfffff0 0x056220 \b, 22.05 kHz ->>17 belong&0xfffff0 0x05dc00 \b, 24 kHz ->>17 belong&0xfffff0 0x03e800 \b, 16 kHz ->>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz ->>17 belong&0xfffff0 0x02ee00 \b, 12 kHz ->>17 belong&0xfffff0 0x01f400 \b, 8 kHz ->>17 belong&0xfffff0 0x177000 \b, 96 kHz ->>17 belong&0xfffff0 0x0fa000 \b, 64 kHz +# sample rates derived from known oscillator frequencies; +# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and +# 16.384 (other/fs=32kHz). +>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz +>>17 belong&0xfffff0 0x03e800 \b, 16 kHz +>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz +>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz +>>17 belong&0xfffff0 0x07d000 \b, 32 kHz +>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz +>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz +>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz +>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz +>>17 belong&0xfffff0 0x177000 \b, 96 kHz +>>17 belong&0xfffff0 0x1f4000 \b, 128 kHz +>>17 belong&0xfffff0 0x2b1100 \b, 176.4 kHz +>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz +>>17 belong&0xfffff0 0x3e8000 \b, 256 kHz +>>17 belong&0xfffff0 0x562200 \b, 352.8 kHz +>>17 belong&0xfffff0 0x5dc000 \b, 384 kHz >>21 byte&0xf >0 \b, >4G samples >>21 byte&0xf 0 \b >>>22 belong >0 \b, %u samples @@ -529,7 +545,21 @@ >>12 ulelong x \b, sample rate %d # adlib sound files -# From Gurkan Sengun , http://www.linuks.mine.nu +# From: Alex Myczko + +# https://github.com/rerrahkr/BambooTracker +0 string BambooTrackerMod BambooTracker module +>22 byte x \b, version %u +>21 byte x \b.%u +>20 byte x \b.%u + +0 string BambooTrackerIst BambooTracker instrument +>22 byte x \b, version %u +>21 byte x \b.%u +>20 byte x \b.%u + +0 string CC2x CheeseCutter 2 song + 0 string RAWADATA RdosPlay RAW 1068 string RoR AMUSIC Adlib Tracker @@ -545,6 +575,14 @@ 0 string ofTAZ! eXtra Simple Music +0 string FMK! FM Kingtracker Song + +0 string DFM DFM Song + +0 string \ CFF Song + +0 string _A2module A2M Song + # Spectrum 128 tunes (.ay files). # From: Emanuel Haupt 0 string ZXAYEMUL Spectrum 128 tune @@ -583,7 +621,13 @@ 1 string [licq] LICQ configuration file # Atari ST audio files by Dirk Jagdmann -0 string ICE! SNDH Atari ST music +# NOTE: Most SNDH music is packed using ICE, which has +# magic numbers "ICE!" and "Ice!". Some SNDH music is +# not packed, so we check for both packed and unpacked. +12 string SNDH SNDH Atari ST music +0 belong&0xFFDFDFFF 0x49434521 +>14 search/40 NDH SNDH Atari ST music +>14 search/40 TITL SNDH Atari ST music 0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music # musepak support From: "Jiri Pejchal" @@ -626,7 +670,7 @@ # IMY # from http://filext.com/detaillist.php?extdetail=IMY -# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm +# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm # http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html # http://www.wx800.com/msg/download/irda/iMelody.pdf 0 string BEGIN:IMELODY iMelody Ringtone Format @@ -642,6 +686,8 @@ # URL: http://filext.com/detaillist.php?extdetail=AMR # From: Russell Coker 0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) +!:mime audio/amr +!:ext amr # Type: SuperCollider 3 Synth Definition File Format # From: Mario Lang @@ -649,12 +695,12 @@ >4 belong x version %d # Type: True Audio Lossless Audio -# URL: http://wiki.multimedia.cx/index.php?title=True_Audio +# URL: https://wiki.multimedia.cx/index.php?title=True_Audio # From: Mike Melanson 0 string TTA1 True Audio Lossless Audio # Type: WavPack Lossless Audio -# URL: http://wiki.multimedia.cx/index.php?title=WavPack +# URL: https://wiki.multimedia.cx/index.php?title=WavPack # From: Mike Melanson 0 string wvpk WavPack Lossless Audio @@ -662,6 +708,8 @@ # VGM music file 0 string Vgm\040 >9 ubyte >0 VGM Video Game Music dump v +!:mime audio/x-vgm +!:ext vgm >>9 ubyte/16 >0 \b%d >>9 ubyte&0x0F x \b%d >>8 ubyte/16 x \b.%d @@ -708,6 +756,56 @@ >>>>0x78 ubyte 0x03 AY-3-8930, >>>>0x78 ubyte 0x10 YM2149, >>>>0x78 ubyte 0x11 YM3439, +>>>>0x78 ubyte 0x12 YMZ284, +>>>>0x78 ubyte 0x13 YMZ294, +# VGM 1.61 +>>0x34 ulelong >0x4C +>>>0x80 ulelong >0 DMG, +>>0x34 ulelong >0x50 +>>>0x84 lelong >0 NES APU, +>>>0x84 lelong <0 NES APU with FDS, +>>0x34 ulelong >0x54 +>>>0x88 ulelong >0 MultiPCM, +>>0x34 ulelong >0x58 +>>>0x8C ulelong >0 uPD7759, +>>0x34 ulelong >0x5C +>>>0x90 ulelong >0 OKIM6258, +>>0x34 ulelong >0x64 +>>>0x98 ulelong >0 OKIM6295, +>>0x34 ulelong >0x68 +>>>0x9C ulelong >0 K051649, +>>0x34 ulelong >0x6C +>>>0xA0 ulelong >0 K054539, +>>0x34 ulelong >0x70 +>>>0xA4 ulelong >0 HuC6280, +>>0x34 ulelong >0x74 +>>>0xA8 ulelong >0 C140, +>>0x34 ulelong >0x78 +>>>0xAC ulelong >0 K053260, +>>0x34 ulelong >0x7C +>>>0xB0 ulelong >0 Pokey, +>>0x34 ulelong >0x80 +>>>0xB4 ulelong >0 QSound, +# VGM 1.71 +>>0x34 ulelong >0x84 +>>>0xB8 ulelong >0 SCSP, +>>0x34 ulelong >0x8C +>>>0xC0 ulelong >0 WonderSwan, +>>0x34 ulelong >0x90 +>>>0xC4 ulelong >0 VSU, +>>0x34 ulelong >0x94 +>>>0xC8 ulelong >0 SAA1099, +>>0x34 ulelong >0x98 +>>>0xCC ulelong >0 ES5503, +>>0x34 ulelong >0x9C +>>>0xD0 lelong >0 ES5505, +>>>0xD0 lelong <0 ES5506, +>>0x34 ulelong >0xA4 +>>>0xD8 ulelong >0 X1-010, +>>0x34 ulelong >0xA8 +>>>0xDC ulelong >0 C352, +>>0x34 ulelong >0xAC +>>>0xE0 ulelong >0 GA20, # GVOX Encore file format # Since this is a proprietary file format and there is no publicly available @@ -722,8 +820,8 @@ # Summary: Garmin Voice Processing Module (WAVE audios) # From: Joerg Jenderek -# URL: http://www.garmin.com/ -# Reference: http://turboccc.wikispaces.com/share/view/28622555 +# URL: https://www.garmin.com/ +# Reference: http://www.poi-factory.com/node/19580 # NOTE: there exist 2 other Garmin VPM formats 0 string AUDIMG # skip text files starting with string "AUDIMG" @@ -747,16 +845,35 @@ # if you select a language like german on your garmin device # you can only select voice modules with corresponding language byte ID like 1 >>18 ubyte x \b, language ID %d +# structure for phrases/sentences? +# number of voice sample in the 1st phrase? +#>>19 uleshort x \b, 0x%x samples +#>>>21 uleshort >0 \b, at 0x%4.4x +#>>>(21.s) ubequad x 0x%llx +# 2nd phrase? +#>>23 uleshort x \b, 0x%x samples +#>>>25 uleshort >0 \b, at 0x%4.4x +#>>>(25.s) ubequad x 0x%llx # pointer to 1st audio WAV sample >>16 uleshort >0 ->>>(16.s) ulelong >0 \b, at offset 0x%x +>>>(16.s) ulelong >0 \b, at 0x%x # WAV length ->>>>(16.s+4) ulelong >0 %d Bytes +# 1 space char after "bytes" to get phrase "bytes RIFF" +>>>>(16.s+4) ulelong >0 %u bytes # look for magic >>>>>(&-8.l) string RIFF # determine type by ./riff ->>>>>>&-4 indirect x \b +>>>>>>&-4 indirect x # 2 - ~ 131 WAV samples following same way +# +# Summary: encrypted Garmin Voice Processing Module +# From: Joerg Jenderek +# URL: https://www.garmin.com/us/products/ontheroad/voicestudio +# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti. +# There exist 2 other Garmin VPM formats +0 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted) +!:mime audio/x-vpm-garmin +!:ext vpm # From Martin Mueller Skarbiniks Pedersen 0 string GDM @@ -810,3 +927,212 @@ >>>0x31 byte/16 x Version %d. >>>0x31 byte&0x0F x \b%02d >>>>0x4 string >\0 \b, title: "%s" + +# magic for Klystrack, https://kometbomb.github.io/klystrack/ +# from Alex Myczko +0 string cyd!song Klystrack song +>8 byte >0 \b, version %u +>8 byte >26 +#>>9 byte x \b, channels %u +#>>10 leshort x \b, time signature %u +#>>12 leshort x \b, sequence step %u +#>>14 byte x \b, instruments %u +#>>15 leshort x \b, patterns %u +#>>17 leshort x \b, sequences %u +#>>19 leshort x \b, length %u +#>>21 leshort x \b, loop point %u +#>>23 byte x \b, master volume %u +#>>24 byte x \b, song speed %u +#>>25 byte x \b, song speed2 %u +#>>26 byte x \b, song rate %u +#>>27 belong x \b, flags %#x +#>>31 byte x \b, multiplex period %u +#>>32 byte x \b, pitch inaccuracy %u +>>149 pstring x \b, title %s + +0 string cyd!inst Klystrack instrument + +# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor +# see Specifications/WOPL-and-OPLI-Specification.txt + +0 string WOPL3-INST\0 WOPL instrument +>11 leshort x \b, version %u +0 string WOPL3-BANK\0 WOPL instrument bank +>11 leshort x \b, version %u + +# AdLib/OPL instrument files. Format specifications on +# http://www.shikadi.net/moddingwiki +0 string Junglevision\ Patch\ File Junglevision instrument data +0 string #OPL_II# DMX OP2 instrument data +0 string IBK\x1a IBK instrument data +0 string 2OP\x1a IBK instrument data, 2 operators +0 string 4OP\x1a IBK instrument data, 4 operators +2 string ADLIB- AdLib instrument data +>0 byte x \b, version %u +>1 byte x \b.%u + +# CRI ADX ADPCM audio +# Used by various Sega games. +# https://en.wikipedia.org/wiki/ADX_(file_format) +# https://wiki.multimedia.cx/index.php/CRI_ADX_file +# Added by David Korth +0x00 beshort 0x8000 +>(2.S-2) string (c)CRI CRI ADX ADPCM audio +!:ext adx +!:mime audio/x-adx +!:strength +50 +>>0x12 byte x v%u +>>0x04 byte 0x02 \b, pre-set prediction coefficients +>>0x04 byte 0x03 \b, standard ADX +>>0x04 byte 0x04 \b, exponential scale +>>0x04 byte 0x10 \b, AHX (Dreamcast) +>>0x04 byte 0x11 \b, AHX +>>0x08 belong x \b, %u Hz +>>0x12 byte 0x03 +>>>0x02 beshort >0x2B +>>>>0x18 belong !0 \b, looping +>>0x12 byte 0x04 +>>>0x02 beshort >0x37 +>>>>0x24 belong !0 \b, looping +>>0x13 byte&0x08 0x08 \b, encrypted + +# Lossless audio (.la) (http://www.lossless-audio.com/) +0 string LA +>2 string 03 Lossless audio version 0.3 +>2 string 04 Lossless audio version 0.4 + +# Sony PlayStation Audio (.xa) +0 leshort 0x4158 Sony PlayStation Audio + +# Portable Sound Format +# Used for audio rips for various consoles. +# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format +# Added by David Korth +0 string PSF +>3 byte 0x01 +>3 byte 0x02 +>3 byte 0x11 +>3 byte 0x12 +>3 byte 0x13 +>3 byte 0x21 +>3 byte 0x22 +>3 byte 0x23 +>3 byte 0x41 +>>0 string PSF Portable Sound Format +!:mime audio/x-psf +>>>3 byte 0x01 (Sony PlayStation) +>>>3 byte 0x02 (Sony PlayStation 2) +>>>3 byte 0x11 (Sega Saturn) +>>>3 byte 0x12 (Sega Dreamcast) +>>>3 byte 0x13 (Sega Mega Drive) +>>>3 byte 0x21 (Nintendo 64) +>>>3 byte 0x22 (Game Boy Advance) +>>>3 byte 0x23 (Super NES) +>>>3 byte 0x41 (Capcom QSound) + +# Atari 8-bit SAP audio format +# http://asap.sourceforge.net/sap-format.html +# Added by David Korth +0 string SAP\r\n Atari 8-bit SAP audio file +!:mime audio/x-sap +!:ext sap +>5 search/1024 NAME +>>&1 string x \b: %s +>>5 search/1024 AUTHOR +>>>&1 string x by %s + +# Nintendo Wii BRSTM audio format (fields) +# NOTE: Assuming HEAD starts at 0x40. +# FIXME: Replace 0x48 with HEAD offset plus 8. +0 name nintendo-wii-brstm-fields +>(0x10.L) string HEAD \b: +>>(0x10.L+0x0C) belong x +>>>(&-4.L+0x48) belong x +>>>>&-4 byte 0 PCM, signed 8-bit, +>>>>&-4 byte 1 PCM, signed 16-bit, +>>>>&-4 byte 2 THP ADPCM, +>>>>&-3 byte !0 looping, +>>>>&-2 byte 1 mono +>>>>&-2 byte 2 stereo +>>>>&-2 byte 3 3 channels +>>>>&-2 byte 4 quad +>>>>&-2 byte >4 %u channels +>>>>&0 beshort !0 %u Hz + +# Nintendo Wii BRSTM audio format +# https://wiibrew.org/wiki/BRSTM_file +# Added by David Korth +0 string RSTM Nintendo Wii BRSTM audio file +!:mime audio/x-brstm +!:ext brstm +# Wii is big-endian, so default to BE. +>4 beshort 0xFEFF +>>0 use nintendo-wii-brstm-fields +>4 leshort 0xFEFF +>>0 use \^nintendo-wii-brstm-fields + +# Nintendo 3DS BCSTM audio format (fields) +0 name nintendo-3ds-bcstm-fields +>(0x18.l) string INFO \b: +# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic) +>>&0x1C byte 0 PCM, signed 8-bit, +>>&0x1C byte 1 PCM, signed 16-bit, +>>&0x1C byte 2 DSP ADPCM, +>>&0x1C byte 3 IMA ADPCM, +>>&0x1D byte !0 looping, +>>&0x1E byte 1 mono +>>&0x1E byte 2 stereo +>>&0x1E byte 3 3 channels +>>&0x1E byte 4 quad +>>&0x1E byte >4 %u channels +>>&0x20 lelong !0 %u Hz + +# Nintendo 3DS BCSTM audio format +# https://www.3dbrew.org/wiki/BCSTM +# Added by David Korth +0 string CSTM Nintendo 3DS BCSTM audio file +!:mime audio/x-bcstm +!:ext bcstm +# 3DS is little-endian, so default to LE. +>4 leshort 0xFEFF +>>0 use nintendo-3ds-bcstm-fields +>4 beshort 0xFEFF +>>0 use \^nintendo-3ds-bcstm-fields + +# Nintendo Wii U BFSTM audio format +# http://mk8.tockdom.com/wiki/BFSTM_(File_Format) +# NOTE: This format is very similar to BCSTM. +# Added by David Korth +0 string FSTM Nintendo Wii U BFSTM audio file +!:mime audio/x-bfstm +!:ext bfstm +# BFSTM is used on both Wii U (BE) and Switch (LE), +# so default to LE. +>4 leshort 0xFEFF +>>0 use nintendo-3ds-bcstm-fields +>4 beshort 0xFEFF +>>0 use \^nintendo-3ds-bcstm-fields + +# Nintendo 3DS BCSTM audio format (fields) +0 name nintendo-3ds-bcwav-fields +>(0x18.l) string INFO \b: +# INFO block (minus 4 for INFO magic) +>>&0x4 byte 0 PCM, signed 8-bit, +>>&0x4 byte 1 PCM, signed 16-bit, +>>&0x4 byte 2 DSP ADPCM, +>>&0x4 byte 3 IMA ADPCM, +>>&0x5 byte !0 looping, +>>&0x8 lelong x stereo +>>&0x8 lelong !0 %u Hz + +# Nintendo 3DS BCWAV audio format +# https://www.3dbrew.org/wiki/BCWAV +# Added by David Korth +0 string CWAV Nintendo 3DS BCWAV audio file +!:mime audio/x-bcwav +!:ext bcwav +# 3DS is little-endian, so default to LE. +>4 leshort 0xFEFF +>>0 use nintendo-3ds-bcwav-fields +>4 beshort 0xFEFF +>>0 use \^nintendo-3ds-bcwav-fields diff --git a/contrib/file/magic/Magdir/basis b/contrib/file/magic/Magdir/basis index 128aa4c77c..19dd463b41 100644 --- a/contrib/file/magic/Magdir/basis +++ b/contrib/file/magic/Magdir/basis @@ -1,9 +1,9 @@ #---------------------------------------------------------------- -# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ +# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $ # basis: file(1) magic for BBx/Pro5-files # Oliver Dammer 2005/11/07 -# http://www.basis.com business-basic-files. +# https://www.basis.com business-basic-files. # 0 string \074\074bbx\076\076 BBx >7 string \000 indexed file diff --git a/contrib/file/magic/Magdir/beetle b/contrib/file/magic/Magdir/beetle new file mode 100644 index 0000000000..94a835ccc4 --- /dev/null +++ b/contrib/file/magic/Magdir/beetle @@ -0,0 +1,7 @@ +#------------------------------------------------------------------------------ +# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $ +# beetle: file(1) magic for Beetle VM object files +# https://github.com/rrthomas/beetle/ + +# Beetle object module +0 string BEETLE\000 Beetle VM object file diff --git a/contrib/file/magic/Magdir/ber b/contrib/file/magic/Magdir/ber index db7a8613d9..15288c6824 100644 --- a/contrib/file/magic/Magdir/ber +++ b/contrib/file/magic/Magdir/ber @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $ +# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $ # ber: file(1) magic for several BER formats used in the mobile # telecommunications industry (Georg Sauthoff) @@ -19,7 +19,7 @@ # # TAP 3 Files # TAP -> Transferred Account Procedure -# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf +# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf # TransferBatch short tag 0 byte 0x61 # BatchControlInfo short tag @@ -47,7 +47,7 @@ >>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) # RAP Files -# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf +# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf # Long ReturnBatch tag 0 string \x7f\x84\x16 # Long RapBatchControlInfo tag diff --git a/contrib/file/magic/Magdir/bioinformatics b/contrib/file/magic/Magdir/bioinformatics index 0c761ed351..2966fa6e49 100644 --- a/contrib/file/magic/Magdir/bioinformatics +++ b/contrib/file/magic/Magdir/bioinformatics @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $ +# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $ # bioinfomatics: file(1) magic for Bioinfomatics file formats ############################################################################### @@ -83,7 +83,7 @@ ############################################################################### # BCF (Binary Call Format), version 2.1 -# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) +# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) # data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it ############################################################################### 0 string BCF\2\1 Binary Call Format (BCF) version 2.1 @@ -96,7 +96,7 @@ ############################################################################### # BCF (Binary Call Format), version 2.2 -# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) +# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) # data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it ############################################################################### 0 string BCF\2\2 Binary Call Format (BCF) version 2.2 @@ -129,7 +129,7 @@ ############################################################################### # FASTA -# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) +# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) ############################################################################### #0 byte 0x3e # q>0 regex =^[>][!-~\t\ ]+$ diff --git a/contrib/file/magic/Magdir/biosig b/contrib/file/magic/Magdir/biosig new file mode 100644 index 0000000000..e490f6cc7e --- /dev/null +++ b/contrib/file/magic/Magdir/biosig @@ -0,0 +1,154 @@ + +############################################################################## +# +# Magic ids for biomedical signal file formats +# Copyright (C) 2018 Alois Schloegl +# +# The list has been derived from biosig projects +# http://biosig.sourceforge.net +# https://pub.ist.ac.at/~schloegl/matlab/eeg/ +# https://pub.ist.ac.at/~schloegl/biosig/TESTED +# +############################################################################## +# +0 string ABF\x20 Biosig/Axon Binary format +!:mime biosig/abf2 +0 string ABF2\0\0 Biosig/Axon Binary format +!:mime biosig/abf2 +# +0 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows +!:mime biosig/ates +# +0 string ATF\x09 Biosig/Axon Text fomrat +!:mime biosig/atf +# +0 string ADU1 Biosig/Axona file format +!:mime biosig/axona +0 string ADU2 Biosig/Axona file format +!:mime biosig/axona +# +0 string ALPHA-TRACE-MEDICAL Biosig/alpha trace +!:mime biosig/alpha +# +0 string AxGr Biosig/AXG +0 string axgx Biosig/AXG +!:mime biosig/axg +# +0 string HeaderLen= Biosig/BCI2000 +0 string BCI2000V Biosig/BCI2000 +!:mime biosig/bci2000 +# +### Specification: https://www.biosemi.com/faq/file_format.htm +0 string \xffBIOSEMI Biosig/Biosemi data format +!:mime biosig/bdf +# +0 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file +0 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file +0 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file +!:mime biosig/brainvision +# +0 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format +!:mime biosig/ced +# +### Specification: https://www.edfplus.info/specs/index.html +0 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format +!:mime biosig/edf +# +### Specifications: https://arxiv.org/abs/cs/0608052 +0 string GDF Biosig/GDF: General data format for biosignals +!:mime biosig/gdf +# +0 string DATA\0\0\0\0 Biosig/Heka Patchmaster +0 string DAT1\0\0\0\0 Biosig/Heka Patchmaster +0 string DAT2\0\0\0\0 Biosig/Heka Patchmaster +!:mime biosig/heka +# +0 string (C)\x20CED\x2087 Biosig/CED SMR +!:mime biosig/ced-smr +# +0 string CFWB\1\0\0\0 Biosig/CFWB +!:mime biosig/cfwb +# +0 string DEMG Biosig/DEMG +!:mime biosig/demg +# +0 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS +!:mime biosig/ebs +# +0 string Embla\x20data\x20file Biosig/Embla +!:mime biosig/embla +# +0 string Header\r\nFile Version Biosig/ETG4000 +!:mime biosig/etg4000 +# +0 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo +!:mime biosig/galileo +# +0 string IGOR Biosig/IgorPro ITX file +!:mime biosig/igorpro +# +# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf +0 string ISHNE1.0 Biosig/ISHNE +!:mime biosig/ishne +# +# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm +0 string @\x20\x20MFER\x20 Biosig/MFER +0 string @\x20MFR\x20 Biosig/MFER +!:mime biosig/mfer +# +0 string NEURALEV Biosig/NEV +0 string N.EV.\0 Biosig/NEV +!:mime biosig/nev +# +0 string NEX1 Biosig/NEX +!:mime biosig/nex1 +# +0 string PLEX Biosig/Plexon v1.0 +10 string PLEXON Biosig/Plexon v2.0 +!:mime biosig/plexon +# +0 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format +# +# Specification: CEN 1064:2005/ISO 11073:91064 +16 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 +!:mime biosig/scpecg +# +0 string IAvSFo Biosig/SIGIF +!:mime biosig/sigif +# +0 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32 +!:mime biosig/tms32 +# +0 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG +!:mime biosig/tmsilog +# +4 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0 +>63 string CRawDataElement +>>85 string CRawDataBuffer Biosig/SYNERGY +!:mime biosig/synergy +# +4 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO +!:mime biosig/unipro +# +0 string VER=9\r\nCTIME= Biosig/WCP +!:mime biosig/wcp +# +0 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek +0 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek +0 string \x55\x55\xFE\xAF Biosig/Walter Graphtek +!:mime biosig/walter-graphtek +# +0 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 +>32 string [PatInfo] Biosig/Sigma +!:mime biosig/sigma +# +0 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF) +!:mime biosig/fef +0 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF) +!:mime biosig/fef +# +0 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1 +>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0 +>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF +!:mime biosig/fiff +# diff --git a/contrib/file/magic/Magdir/blcr b/contrib/file/magic/Magdir/blcr index 70ea563e18..d2f901ae92 100644 --- a/contrib/file/magic/Magdir/blcr +++ b/contrib/file/magic/Magdir/blcr @@ -1,5 +1,5 @@ # Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files -# http://ftg.lbl.gov/checkpoint +# https://ftg.lbl.gov/checkpoint 0 string C\0\0\0R\0\0\0 BLCR >16 lelong 1 x86 >16 lelong 3 alpha diff --git a/contrib/file/magic/Magdir/blender b/contrib/file/magic/Magdir/blender index 09485702b1..276242eab0 100644 --- a/contrib/file/magic/Magdir/blender +++ b/contrib/file/magic/Magdir/blender @@ -1,10 +1,10 @@ #------------------------------------------------------------------------------ -# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $ +# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $ # blender: file(1) magic for Blender 3D related files # # Native format rule v1.2. For questions use the developers list -# http://lists.blender.org/mailman/listinfo/bf-committers +# https://lists.blender.org/mailman/listinfo/bf-committers # GLOB chunk was moved near start and provides subversion info since 2.42 0 string =BLENDER Blender3D, diff --git a/contrib/file/magic/Magdir/bsi b/contrib/file/magic/Magdir/bsi index 51a62891c2..20a17d9c2d 100644 --- a/contrib/file/magic/Magdir/bsi +++ b/contrib/file/magic/Magdir/bsi @@ -1,4 +1,4 @@ -# Chiasmus is a encryption standard developed by the German Federal +# Chiasmus is an encryption standard developed by the German Federal # Office for Information Security (Bundesamt fuer Sicherheit in der # Informationstechnik). diff --git a/contrib/file/magic/Magdir/c-lang b/contrib/file/magic/Magdir/c-lang index 7b3f703ef3..9356e82ed9 100644 --- a/contrib/file/magic/Magdir/c-lang +++ b/contrib/file/magic/Magdir/c-lang @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $ +# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $ # c-lang: file(1) magic for C and related languages programs # # The strength is to beat standard HTML @@ -11,32 +11,42 @@ !:mime text/x-bcpl # C -# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength -0 regex \^#include C ->0 regex \^class[[:space:]]+ ->>&0 regex \\{[\.\*]\\}(;)?$ \b++ ->&0 clear x source text +# Check for class if include is found, otherwise class is beaten by include because of lowered strength +0 search/8192 #include +>0 regex \^#include C +>>0 regex \^class[[:space:]]+ +>>>&0 regex \\{[\.\*]\\}(;)?$ \b++ +>>&0 clear x source text !:strength + 13 !:mime text/x-c -0 regex \^#[[:space:]]*pragma C source text +0 search/8192 pragma +>0 regex \^#[[:space:]]*pragma C source text !:mime text/x-c -0 regex \^#[[:space:]]*(if\|ifn)def ->&0 regex \^#[[:space:]]*endif$ C source text +0 search/8192 endif +>0 regex \^#[[:space:]]*(if\|ifn)def +>>&0 regex \^#[[:space:]]*endif$ C source text !:mime text/x-c -0 regex \^#[[:space:]]*(if\|ifn)def ->&0 regex \^#[[:space:]]*define C source text +0 search/8192 define +>0 regex \^#[[:space:]]*(if\|ifn)def +>>&0 regex \^#[[:space:]]*define C source text !:mime text/x-c -0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text +0 search/8192 char +>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text !:mime text/x-c -0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text +0 search/8192 double +>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text !:mime text/x-c -0 regex \^[[:space:]]*extern[[:space:]]+ C source text +0 search/8192 extern +>0 regex \^[[:space:]]*extern[[:space:]]+ C source text !:mime text/x-c -0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text +0 search/8192 float +>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text !:mime text/x-c -0 regex \^struct[[:space:]]+ C source text +0 search/8192 struct +>0 regex \^struct[[:space:]]+ C source text !:mime text/x-c -0 regex \^union[[:space:]]+ C source text +0 search/8192 union +>0 regex \^union[[:space:]]+ C source text !:mime text/x-c 0 search/8192 main( >&0 regex \\)[[:space:]]*\\{ C source text @@ -44,35 +54,44 @@ # C++ # The strength of these rules is increased so they beat the C rules above -0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text +0 search/8192 namespace +>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text !:strength + 30 !:mime text/x-c++ # using namespace [namespace] or using std::[lib] -0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text +0 search/8192 using +>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text +0 search/8192 template +>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text +0 search/8192 virtual +>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text !:strength + 30 !:mime text/x-c++ # But class alone is reduced to avoid beating php (Jens Schleusener) -0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text +0 search/8192 class +>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text !:strength + 13 !:mime text/x-c++ -0 regex \^[[:space:]]*public: C++ source text +0 search/8192 public +>0 regex \^[[:space:]]*public: C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*private: C++ source text +0 search/8192 private +>0 regex \^[[:space:]]*private: C++ source text !:strength + 30 !:mime text/x-c++ -0 regex \^[[:space:]]*protected: C++ source text +0 search/8192 protected +>0 regex \^[[:space:]]*protected: C++ source text !:strength + 30 !:mime text/x-c++ # Objective-C -0 regex \^#import Objective-C source text +0 search/8192 #import +>0 regex \^#import Objective-C source text !:strength + 25 !:mime text/x-objective-c diff --git a/contrib/file/magic/Magdir/c64 b/contrib/file/magic/Magdir/c64 index eb79ac3c15..ff4e93309e 100644 --- a/contrib/file/magic/Magdir/c64 +++ b/contrib/file/magic/Magdir/c64 @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: c64,v 1.6 2015/08/24 05:17:42 christos Exp $ +# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $ # c64: file(1) magic for various commodore 64 related files # # From: Dirk Jagdmann @@ -46,4 +46,13 @@ # Esa Hyyti 0 string C64-TAPE-RAW C64 Raw Tape File (.tap), >0x0c byte x Version:%u, ->0x10 lelong x Length:%u cycles +>0x10 lelong x Length:%u cycles + +# magic for Goattracker2, http://covertbitops.c64.org/ +# from Alex Myczko +0 string GTS5 GoatTracker 2 song +>4 string >\0 \b, "%s" +>36 string >\0 \b by %s +>68 string >\0 \b (C) %s +>100 byte >0 \b, %u subsong(s) + diff --git a/contrib/file/magic/Magdir/cad b/contrib/file/magic/Magdir/cad index daafba9d44..509cab3198 100644 --- a/contrib/file/magic/Magdir/cad +++ b/contrib/file/magic/Magdir/cad @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: cad,v 1.15 2017/06/24 15:24:56 christos Exp $ +# $File: cad,v 1.20 2019/08/10 13:34:17 christos Exp $ # autocad: file(1) magic for cad files # @@ -11,40 +11,173 @@ # raster underlays to Microstation DGN (vector) drawings. # # http://www.wotsit.org/search.asp -# http://filext.com/detaillist.php?extdetail=DGN -# http://filext.com/detaillist.php?extdetail=CIT +# https://filext.com/detaillist.php?extdetail=DGN +# https://filext.com/detaillist.php?extdetail=CIT # -# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 +# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 -# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 +# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F -0 string \010\011\376 Microstation ->3 string \002 ->>30 string \026\105 DGNFile ->>30 string \034\105 DGNFile ->>30 string \073\107 DGNFile ->>30 string \073\110 DGNFile ->>30 string \106\107 DGNFile ->>30 string \110\103 DGNFile ->>30 string \120\104 DGNFile ->>30 string \172\104 DGNFile ->>30 string \172\105 DGNFile ->>30 string \172\106 DGNFile ->>30 string \234\106 DGNFile ->>30 string \273\105 DGNFile ->>30 string \306\106 DGNFile ->>30 string \310\104 DGNFile ->>30 string \341\104 DGNFile ->>30 string \372\103 DGNFile ->>30 string \372\104 DGNFile ->>30 string \372\106 DGNFile ->>30 string \376\103 DGNFile ->4 string \030\000\000 CITFile ->4 string \030\000\003 CITFile +# +# URL: https://en.wikipedia.org/wiki/MicroStation +# reference: http://dgnlib.maptools.org/dgn.html +# http://dgnlib.maptools.org/dl/ref18.pdf +# Update: Joerg Jenderek +# Note: verfied by command like `dgndump seed2d_b.dgn` +# test for level 8 and type 5 or 9 +0 beshort&0x3F73 0x0801 +# level of element like 8 +#>0 ubyte&0x3F x \b, level %u +#>0 ubyte &0x80 \b, complex +#>0 ubyte &0x40 \b, reserved +# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements +#>1 ubyte&0x7F x \b, type %u +# words to follow in element: 17H~CEL libray 2FEh~DGN 9FEh,DFEh~CIT +#>2 uleshort x \b, words 0x%4.4x to follow +# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL) +#>508 ubelong x \b, RESERVED %8.8x +>508 ubelong&0xFFffFF00 =0 +# test for level 8 and type 9 for INGR raster image +>>0 beshort 0x0809 +# test for length of 1st element is multiple of blocks a 512 bytes +>>>2 ubyte 0xfe +>>>>0 use ingr-image +# test for DGN or CEL by jump words (uleshort) forward to next element +>(2.s*2) ulong x +# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT +#>>&1 ubyte&0x7F x \b, 2nd type %u +# DGN +>>&1 ubyte&0x7F 8 +>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing +!:mime application/x-bentley-dgn +!:ext dgn +# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0 +>>>>1214 ubyte &0x40 3D +>>>>1214 ubyte ^0x40 2D +# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040 +>>>>1120 string x \b, units %-.2s +# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0 +>>>>1122 string >\0 %-.2s +#>>>>1120 ubelong x \b, units 0x%8.8x +# element range low,high x y z like xlow=0 08010000h 01080000h +#>>>>4 ubelong !0 \b, xlow %8.8x +#>>>>8 ubelong !0 \b, ylow %8.8x +#>>>>12 ubelong !0 \b, zlow %8.8x +#>>>>16 ubelong !0 \b, xhigh %8.8x +#>>>>20 ubelong !0 \b, yhigh %8.8x +#>>>>24 ubelong !0 \b, zhigh %8.8x +# graphic group number; all other elements in that group have same non-0 number +#>>>>28 leshort x \b, grphgrp 0x%4.4x +# words to optional attribute linkage +#>>>>30 ubyte x \b, attindx \%o +#>>>>31 ubyte x \b\%o +# >>30 string \026\105 DGNFile +# >>30 string \034\105 DGNFile +# >>30 string \073\107 DGNFile +# >>30 string \073\110 DGNFile +# >>30 string \106\107 DGNFile +# >>30 string \110\103 DGNFile +# >>30 string \120\104 DGNFile +# >>30 string \172\104 DGNFile +# >>30 string \172\105 DGNFile +# >>30 string \172\106 DGNFile +# >>30 string \234\106 DGNFile +# >>30 string \273\105 DGNFile +# >>30 string \306\106 DGNFile +# >>30 string \310\104 DGNFile +# >>30 string \341\104 DGNFile +# >>30 string \372\103 DGNFile +# >>30 string \372\104 DGNFile +# >>30 string \372\106 DGNFile +# >>30 string \376\103 DGNFile +# elements properties indicator +#>>>>32 uleshort !0 \b, properties 0x%4.4x +# class 0~Primary +#>>>>>32 uleshort&0x000F !0 \b, class 0x%4.4x +# Symbology +#>>>>>34 uleshort x \b, Symbology 0x%4.4x +# test for 2nd element type 1~library cell header +>>&1 ubyte&0x7F 1 +# test for 1st element with level 8 and type 5 for cell library +>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library +!:mime application/x-bentley-cel +!:ext cel +# +# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster +# reference: https://web.archive.org/web/20140903185431/ +# http://oreilly.com/www/centers/gff/formats/ingr/index.htm +# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT` +# display information for intergraph raster bitmap +0 name ingr-image +# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD" +# DataTypeCode indicates format, depth of the pixel data and used compression +>4 uleshort x Intergraph raster image +>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit +!:mime image/x-intergraph-rle +!:ext rel +>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit +!:mime image/x-intergraph-cit +!:ext cit +>>4 uleshort 27 \b, Adaptive RLE RGB +!:mime image/x-intergraph-rgb +!:ext rgb +>>4 default x +>>>4 uleshort x \b, Type %u +!:mime image/x-intergraph +# TODO: +#>4 uleshort 0 \b, no data +# ... +#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed) +# ApplicationType: 0~generic raster image 3~drawing, scanning +# 8~I/IMAGE and MicroStation Imager 9~ModelView +>6 uleshort !0 \b, ApplicationType %u +#>6 uleshort x \b, ApplicationType %u +# XViewOrigin; Raster grid data X origin +#>8 ulequad !0 \b, XViewOrigin %llx +# PixelsPerLine is the number of pixels in a scan line of bitmapp +>184 ulelong x \b, %u x +# NumberOfLines is height of the raster data in scanlines +>188 ulelong x %u +# DeviceResolution; resolution of scanning device +# positive indicates number of micros between lines; negative indicates DPI +#>192 leshort x \b, DeviceResolution %d +# ScanlineOrient indicates the origin and the orientation of the scan lines +#>194 ubyte x \b, ScanlineOrient %x +>194 ubyte x \b, orientation +>194 ubyte &0x01 right +>194 ubyte ^0x01 left +>194 ubyte &0x02 down +>194 ubyte ^0x02 top +>194 ubyte &0x04 horizontal +>194 ubyte ^0x04 vertical +# ScannableFlag; Scanline indexing method used +#>195 ubyte !0 \b, ScannableFlag 0x%x +# RotationAngle; Rotation angle of raster data +#>196 ubequad !0 \b, RotationAngle 0x%llx +# SkewAngle; Skew angle of raster data +#>204 ubequad !0 \b, SkewAngle %llx +# DataTypeModifier; Additional raster data format info +#>212 uleshort !0 \b, DataTypeModifier 0x%4.4x +# DesignFile[66]; Name of the design file +>214 string >\0 \b, DesignFile %-.66s +# DatabaseFile[66]; Name of the database file +>280 string >\0 \b, DatabaseFile %-.66s +# ParentGridFile[66]; Name of parent grid file +>346 string >\0 \b, ParentGridFile %-.66s +# FileDescription[80]; Text description of file and contents +>412 string >\0 \b, FileDescription %-.80s +# MinValue +#>492 ubequad !0 \b, MinValue 0x%llx +# MaxValue +#>500 ubequad !0 \b, MaxValue 0x%llx +# Reserved[3]; Unused (always 0) +#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x +# GridFileVersion; Grid File Version like 2 3 +#>511 ubyte x \b, GridFileVersion %x # AutoCAD -# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg -# and http://www.iana.org/assignments/media-types/image/vnd.dwg +# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg +# and https://www.iana.org/assignments/media-types/image/vnd.dwg 0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 !:mime image/vnd.dwg 0 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 @@ -89,7 +222,7 @@ # Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, # ICQ 358572321) # From various sources like: -# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html +# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html 0 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 !:mime image/vnd.dwg 0 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 @@ -102,13 +235,13 @@ # KOMPAS 2D drawing from ASCON # This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor # gathered nor specification -# ASCON http://ascon.net/main/ in English, -# http://ascon.ru/ main site in Russian +# ASCON https://ascon.net/main/ in English, +# https://ascon.ru/ main site in Russian # Extension is CDW for drawing and FRW for fragment of drawing # Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, -# ICQ 358572321, http://vkontakte.ru/id16076543) +# ICQ 358572321, https://vkontakte.ru/id16076543) # From: -# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 +# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 # (in russian) and my experiments 0 string KF >2 belong 0x4E00000C Kompas drawing 12.0 SP1 @@ -140,12 +273,6 @@ # Phillip Griffith # AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. # -0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library -0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD -0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD -0 beshort 0x0809 Bentley/Intergraph MicroStation ->0x02 byte 0xfe ->>0x04 beshort 0x1800 CIT raster CAD # 3DS (3d Studio files) 0 leshort 0x4d4d @@ -153,9 +280,38 @@ >>8 lelong 0xa >>>16 leshort 0x3d3d 3D Studio model !:mime image/x-3ds -!:extension 3ds +!:ext 3ds # MegaCAD 2D/3D drawing (.prt) -# http://megacad.de/ +# https://megacad.de/ # From: Markus Heidelberg 0 string MegaCad23\0 MegaCAD 2D/3D drawing + +# Hoops CAD files +# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\ +# HSF_architecture.html +# Stephane Charette +0 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) +>7 regex/9 V[.0-9]{4,5}\020 %s +!:ext hsf + +# AutoCAD Drawing Exchange Format +0 regex \^[\ \t]*0\r?\000$ +>1 regex \^[\ \t]*SECTION\r?$ +>>2 regex \^[\ \t]*2\r?$ +>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format +!:mime application/x-dxf +!:ext dxf +>>>>&1 search/8192 AC1006 \b, R10 +>>>>&1 search/8192 AC1009 \b, R11/R12 +>>>>&1 search/8192 AC1012 \b, R13 +>>>>&1 search/8192 AC1014 \b, R14 +>>>>&1 search/8192 AC1015 \b, version 2000 +>>>>&1 search/8192 AC1018 \b, version 2004 +>>>>&1 search/8192 AC1021 \b, version 2007 +>>>>&1 search/8192 AC1024 \b, version 2010 + +# The Sketchup 3D model format https://www.sketchup.com/ +0 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model +!:mime application/vnd.sketchup.skp +!:ext skp diff --git a/contrib/file/magic/Magdir/cafebabe b/contrib/file/magic/Magdir/cafebabe index 6482858fc6..18dd1a27a3 100644 --- a/contrib/file/magic/Magdir/cafebabe +++ b/contrib/file/magic/Magdir/cafebabe @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $ +# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $ # Cafe Babes unite! # # Since Java bytecode and Mach-O universal binaries have the same magic number, @@ -58,15 +58,15 @@ >>4 belong <20 Mach-O universal binary with %d architectures: !:mime application/x-mach-binary >>>8 use mach-o \b ->>4 belong 2 +>>4 belong >1 >>>28 use mach-o \b ->>4 belong 3 +>>4 belong >2 >>>48 use mach-o \b ->>4 belong 4 +>>4 belong >3 >>>68 use mach-o \b ->>4 belong 5 +>>4 belong >4 >>>88 use mach-o \b ->>4 belong 6 +>>4 belong >5 >>>108 use mach-o \b ### MACH-O END ### diff --git a/contrib/file/magic/Magdir/clojure b/contrib/file/magic/Magdir/clojure new file mode 100644 index 0000000000..1f1cddf9a2 --- /dev/null +++ b/contrib/file/magic/Magdir/clojure @@ -0,0 +1,30 @@ +#------------------------------------------------------------------------------ +# file: file(1) magic for Clojure +# URL: https://clojure.org/ +# From: Jason Felice + +0 string/w #!\ /usr/bin/clj Clojure script text executable +!:mime text/x-clojure +0 string/w #!\ /usr/local/bin/clj Clojure script text executable +!:mime text/x-clojure +0 string/w #!\ /usr/bin/clojure Clojure script text executable +!:mime text/x-clojure +0 string/w #!\ /usr/local/bin/clojure Clojure script text executable +!:mime text/x-clojure +0 string/W #!/usr/bin/env\ clj Clojure script text executable +!:mime text/x-clojure +0 string/W #!/usr/bin/env\ clojure Clojure script text executable +!:mime text/x-clojure +0 string/W #!\ /usr/bin/env\ clj Clojure script text executable +!:mime text/x-clojure +0 string/W #!\ /usr/bin/env\ clojure Clojure script text executable +!:mime text/x-clojure + +0 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text +!:mime text/x-clojure + +0 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text +!:mime text/x-clojure + +0 regex \^\\\(defn-?[[:space:]] Clojure module source text +!:mime text/x-clojure diff --git a/contrib/file/magic/Magdir/coff b/contrib/file/magic/Magdir/coff index b4addec58f..31b47e7aff 100644 --- a/contrib/file/magic/Magdir/coff +++ b/contrib/file/magic/Magdir/coff @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $ +# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $ # coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures # # COFF @@ -26,6 +26,10 @@ >>0 uleshort 0x0550 Hitachi SH little-endian # executable (RISC System/6000 V3.1) or obj module (./ibm6000) #>>0 uleshort 0x01DF +# MS Windows COFF Intel Itanium, AMD64 +# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx +>>0 uleshort 0x0200 Intel ia64 +>>0 uleshort 0x8664 Intel amd64 # TODO for other COFFs #>>0 uleshort 0xABCD COFF_TEMPLATE >>0 default x diff --git a/contrib/file/magic/Magdir/commands b/contrib/file/magic/Magdir/commands index f6ad1c878a..faa94ae986 100644 --- a/contrib/file/magic/Magdir/commands +++ b/contrib/file/magic/Magdir/commands @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $ +# $File: commands,v 1.61 2019/10/30 03:16:43 christos Exp $ # commands: file(1) magic for various shells and interpreters # #0 string/w : shell archive or script for antique kernel text @@ -35,6 +35,9 @@ !:mime text/x-shellscript 0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable !:mime text/x-shellscript +0 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable +!:mime text/x-shellscript + 0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable !:mime text/x-shellscript 0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable @@ -96,7 +99,7 @@ 0 search/1/w #!\ /usr/bin/php PHP script text executable !:strength + 10 !:mime text/x-php -# Smarty compiled template, http://www.smarty.net/ +# Smarty compiled template, https://www.smarty.net/ # Elan Ruusamae 0 string =5 regex [\ \n] @@ -109,7 +112,7 @@ 0 string/t $! DCL command file # Type: Pdmenu -# URL: http://packages.debian.org/pdmenu +# URL: https://packages.debian.org/pdmenu # From: Edward Betts 0 string #!/usr/bin/pdmenu Pdmenu configuration file text diff --git a/contrib/file/magic/Magdir/compress b/contrib/file/magic/Magdir/compress index 6fa8f32150..c700b5a458 100644 --- a/contrib/file/magic/Magdir/compress +++ b/contrib/file/magic/Magdir/compress @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: compress,v 1.68 2017/05/25 20:07:23 christos Exp $ +# $File: compress,v 1.77 2019/10/08 20:25:13 christos Exp $ # compress: file(1) magic for pure-compression formats (no archives) # # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. @@ -16,13 +16,78 @@ >2 byte&0x1f x %d bits # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) +# URL: https://en.wikipedia.org/wiki/Gzip +# Reference: https://tools.ietf.org/html/rfc1952 +# Update: Joerg Jenderek, Apr 2019 # Edited by Chris Chittleborough , March 2002 # * Original filename is only at offset 10 if "extra field" absent # * Produce shorter output - notably, only report compression methods # other than 8 ("deflate", the only method defined in RFC 1952). -0 string \037\213 gzip compressed data -!:mime application/x-gzip -!:strength * 2 +# Note: find defs -iname '*.trid.xml' -exec grep -q '1F8B08' {} \; -ls +# TODO: +# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/ +# KPR KOffice/Calligra KPresenter application/x-kpresenter +# KPT KOffice/Calligra KPresenter template? application/x-kpresenter +# SAV Diggles Saved Game File http://www.innonics.com +# SAV FarCry (demo) saved game http://www.farcry-thegame.com +# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter +0 string \037\213 +# to display gzip compressed (strength=100=2*50) before other (strength=50)? +#!:strength * 2 +# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary +>3 byte&0x18 =0 +# For binary gzipped no ASCII text should occur +# mcd-monu-cad.trid.xml +>>10 string MCD Monu-Cad Drawing, Component or Font +#>>36 string Created\ with\ MONU-CAD +#!:mime application/octet-stream +# http://fileformats.archiveteam.org/wiki/Monu-CAD +# http://www.monucad.com/downloads/FullDemo-2005.EXE +# /HANDS96.MCC Component +# /DEMO_DD01.MCD Drawing +# /MCALF020.FNT Font +!:ext mcc/mcd/fnt +# http://www.generalcadd.com +>>10 string GXD General CADD, Drawing or Component +#!:mime application/octet-stream +# /gxc/BUILDINGEDGE.gxc Component +# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing +# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06 +!:ext gxc/gxd +#>>>13 ubyte 0 \b, version 0 +>>>13 string 09 \b, version 9 +# other gzipped binary like gzipped tar, VirtualBox extension package,... +>>10 default x gzip compressed data +!:mime application/gzip +>>>0 use gzip-info +# size of the original (uncompressed) input data modulo 2^32 +>>>-4 ulelong x \b, original size modulo 2^32 %u +# gzipped TAR or VirtualBox extension package +#!:mime application/x-compressed-tar +#!:mime application/x-virtualbox-vbox-extpack +# https://www.w3.org/TR/SVG/mimereg.html +#!:mime image/image/svg+xml-compressed +# zlib.3.gz +# microcode-20180312.tgz +# tpz same as tgz +# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg +# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack +!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz +# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text +>3 byte&0x18 >0 gzip compressed data +!:mime application/gzip +# gzipped tar, gzipped Abiword document +#!:mime application/x-compressed-tar +#!:mime application/x-abiword-compressed +#!:mime image/image/svg+xml-compressed +# kleopatra_splashscreen.svgz gzipped .svg +!:ext gz/tgz/tpz/zabw/svgz +>>0 use gzip-info +# size of the original (uncompressed) input data modulo 2^32 +>>-4 ulelong x \b, original size modulo 2^32 %u +# display information of gzip compressed files +0 name gzip-info +#>2 byte x THIS iS GZIP >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII @@ -49,6 +114,9 @@ >9 byte =0x0B \b, from NTFS filesystem (NT) >9 byte =0x0C \b, from QDOS >9 byte =0x0D \b, from Acorn RISCOS +# size of the original (uncompressed) input data modulo 2^32 +#>-4 ulelong x \b, original size modulo 2^32 %u +#ERROR: line 114: non zero offset 1048572 at level 1 # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 0 string \037\036 packed data @@ -77,6 +145,12 @@ !:mime application/x-bzip2 >3 byte >47 \b, block size = %c00k +# bzip a block-sorting file compressor +# by Julian Seward and others +0 string BZ0 bzip compressed data +!:mime application/x-bzip +>3 byte >47 \b, block size = %c00k + # lzip 0 string LZIP lzip compressed data !:mime application/x-lzip @@ -113,21 +187,6 @@ #>99 byte&0xF0 0xd0 #>132 byte&0xF0 0xd0 GSM 06.10 compressed audio -# bzip a block-sorting file compressor -# by Julian Seward and others -# -#0 string BZ bzip compressed data -#>2 byte x \b, version: %c -#>3 string =1 \b, compression block size 100k -#>3 string =2 \b, compression block size 200k -#>3 string =3 \b, compression block size 300k -#>3 string =4 \b, compression block size 400k -#>3 string =5 \b, compression block size 500k -#>3 string =6 \b, compression block size 600k -#>3 string =7 \b, compression block size 700k -#>3 string =8 \b, compression block size 800k -#>3 string =9 \b, compression block size 900k - # lzop from 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data >9 beshort <0x0940 @@ -168,7 +227,7 @@ >>17 byte =0x0E os: Win32 # 4.3BSD-Quasijarus Strong Compression -# http://minnie.tuhs.org/Quasijarus/compress.html +# https://minnie.tuhs.org/Quasijarus/compress.html 0 string \037\241 Quasijarus strong compressed data # From: Cory Dikkers @@ -182,7 +241,7 @@ >4 belong 0x090A0C0D best compression # 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) -# http://www.7-zip.org or DOC/7zFormat.txt +# https://www.7-zip.org or DOC/7zFormat.txt # 0 string 7z\274\257\047\034 7-zip archive data, >6 byte x version %d @@ -211,7 +270,7 @@ >5 byte x \b.%d !:mime application/x-lrzip -# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html +# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 0 lelong 0x184d2204 LZ4 compressed data (v1.4+) !:mime application/x-lz4 # Added by osm0sis@xda-developers.com @@ -249,25 +308,25 @@ # Zstandard compressed data # https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 0 lelong 0xFD2FB522 Zstandard compressed data (v0.2) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB523 Zstandard compressed data (v0.3) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB524 Zstandard compressed data (v0.4) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB525 Zstandard compressed data (v0.5) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB526 Zstandard compressed data (v0.6) -!:mime application/x-zstd +!:mime application/zstd 0 lelong 0xFD2FB527 Zstandard compressed data (v0.7) -!:mime application/x-zstd +!:mime application/zstd >4 use zstd-dictionary-id 0 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) -!:mime application/x-zstd +!:mime application/zstd >4 use zstd-dictionary-id # https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 0 lelong 0xEC30A437 Zstandard dictionary -!:mime application/x-zstd-dictionary +!:mime application/x-std-dictionary >4 lelong x (ID %u) # AFX compressed files (Wolfram Kleff) @@ -300,11 +359,11 @@ >0x8 lelong x \b, %u entries # Snappy framing format -# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt +# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 0 string \377\006\0\0sNaPpY snappy framed data !:mime application/x-snappy-framed -# qpress, http://www.quicklz.com/ +# qpress, https://www.quicklz.com/ 0 string qpress10 qpress compressed data !:mime application/x-qpress @@ -314,3 +373,22 @@ >>0 byte&0xf =8 >>>0 byte&0x80 =0 zlib compressed data !:mime application/zlib + +# BWC compression +0 string BWC +>3 byte 0 BWC compressed data + +# UCL compression +0 bequad 0x00e955434cff011a UCL compressed data + +# Softlib archive +0 string SLIB Softlib archive +>4 leshort x \b, version %d +>6 leshort x (contains %d files) + +# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276 +# From: Eric Hall +0 string bvx- lzfse encoded, no compression +0 string bvx1 lzfse compressed, uncompressed tables +0 string bvx2 lzfse compressed, compressed tables +0 string bvxn lzfse encoded, lzvn compressed diff --git a/contrib/file/magic/Magdir/console b/contrib/file/magic/Magdir/console index 66f5dbda29..28cc3681d5 100644 --- a/contrib/file/magic/Magdir/console +++ b/contrib/file/magic/Magdir/console @@ -1,14 +1,14 @@ #------------------------------------------------------------------------------ -# $File: console,v 1.32 2017/08/13 00:21:47 christos Exp $ +# $File: console,v 1.49 2019/05/27 01:33:32 christos Exp $ # Console game magic # Toby Deshane # ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format # Updated by David Korth # References: -# - http://wiki.nesdev.com/w/index.php/INES -# - http://wiki.nesdev.com/w/index.php/NES_2.0 +# - https://wiki.nesdev.com/w/index.php/INES +# - https://wiki.nesdev.com/w/index.php/NES_2.0 # Common header for iNES, NES 2.0, and Wii U iNES. 0 name nes-rom-image-ines @@ -47,15 +47,17 @@ # Standard iNES ROM header. 0 string NES\x1A NES ROM image (iNES) +!:mime application/x-nes-rom >0 use nes-rom-image-ines # Wii U Virtual Console iNES ROM header. 0 belong 0x4E455300 NES ROM image (Wii U Virtual Console) +!:mime application/x-nes-rom >0 use nes-rom-image-ines #------------------------------------------------------------------------------ # unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images -# Reference: http://wiki.nesdev.com/w/index.php/UNIF +# Reference: https://wiki.nesdev.com/w/index.php/UNIF # From: David Korth # # NOTE: The UNIF format uses chunks instead of a fixed header, @@ -63,10 +65,11 @@ # 0 string UNIF >4 lelong <16 NES ROM image (UNIF v%d format) +!:mime application/x-nes-rom #------------------------------------------------------------------------------ # fds: file(1) magic for Famciom Disk System disk images -# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format +# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format # From: David Korth # TODO: Check "Disk info block" and get info from that in addition to the optional header. @@ -81,12 +84,14 @@ # Headered version. 0 string FDS\x1A >0x11 string *NINTENDO-HVC* Famicom Disk System disk image: +!:mime application/x-fds-disk >>0x10 use nintendo-fds-disk-info-block >4 byte 1 (%u side) >4 byte !1 (%u sides) # Unheadered version. 1 string *NINTENDO-HVC* Famicom Disk System disk image: +!:mime application/x-fds-disk >0 use nintendo-fds-disk-info-block #------------------------------------------------------------------------------ @@ -95,6 +100,7 @@ # From: David Korth # 0 string TNES NES ROM image (Nintendo 3DS Virtual Console) +!:mime application/x-nes-rom >4 byte 100 \b: FDS, >>0x2010 use nintendo-fds-disk-info-block >4 byte !100 \b: TNES mapper %u @@ -110,6 +116,8 @@ # Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header # 0x104 bequad 0xCEED6666CC0D000B Game Boy ROM image +# TODO: application/x-gameboy-color-rom for GBC. +!:mime application/x-gameboy-rom >0x143 byte&0x80 0x80 >>0x134 string >\0 \b: "%.15s" >0x143 byte&0x80 !0x80 @@ -124,6 +132,7 @@ >>0x146 byte !0x03 >>>0x143 byte&0xC0 0x80 [CGB] >>>0x143 byte&0xC0 0xC0 [CGB ONLY] +>0x14b byte !0x33 # Mapper. >0x147 byte 0x00 [ROM ONLY] @@ -177,7 +186,7 @@ # genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats # Updated by David Korth # References: -# - http://www.retrodev.com/segacd.html +# - https://www.retrodev.com/segacd.html # - http://devster.monkeeh.com/sega/32xguide1.txt # @@ -199,29 +208,37 @@ # TODO: Check for 32X CD? # Sega Mega CD disc images: 2048-byte sectors. 0 string SEGADISCSYSTEM\ \ Sega Mega CD disc image +!:mime application/x-sega-cd-rom >0 use sega-mega-drive-header >0 byte x \b, 2048-byte sectors 0 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image +!:mime application/x-sega-cd-rom >0 use sega-mega-drive-header >0 byte x \b, 2048-byte sectors # Sega Mega CD disc images: 2352-byte sectors. 0x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image +!:mime application/x-sega-cd-rom >0x10 use sega-mega-drive-header >0 byte x \b, 2352-byte sectors 0x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image +!:mime application/x-sega-cd-rom >0x10 use sega-mega-drive-header >0 byte x \b, 2352-byte sectors # Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images. 0x100 string SEGA >0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image +!:mime application/x-genesis-32x-rom >>0 use sega-mega-drive-header >0x3C0 bequad !0x4D41525320434845 >>0x105 belong 0x5049434F Sega Pico ROM image +!:mime application/x-sega-pico-rom >>>0 use sega-mega-drive-header >>0x105 belong !0x5049434F >>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image +!:mime application/x-genesis-rom >>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image +!:mime application/x-genesis-rom >>>0 use sega-mega-drive-header #------------------------------------------------------------------------------ @@ -238,11 +255,13 @@ # "Sega Genesis" header. 0x280 string EAGN >8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): +!:mime application/x-genesis-rom >>0 use sega-genesis-smd-header # "Sega Mega Drive" header. 0x280 string EAMG >8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): +!:mime application/x-genesis-rom >>0 use sega-genesis-smd-header #------------------------------------------------------------------------------ @@ -250,7 +269,7 @@ # Detects all Game Gear and export Sega Master System ROM images, # and some Japanese Sega Master System ROM images. # From: David Korth -# Reference: http://www.smspower.org/Development/ROMHeader +# Reference: https://www.smspower.org/Development/ROMHeader # # General SMS header rule. @@ -258,12 +277,17 @@ 0 name sega-master-system-rom-header # Machine type. >0x0F byte&0xF0 0x30 Sega Master System +!:mime application/x-sms-rom >0x0F byte&0xF0 0x40 Sega Master System +!:mime application/x-sms-rom >0x0F byte&0xF0 0x50 Sega Game Gear +!:mime application/x-gamegear-rom >0x0F byte&0xF0 0x60 Sega Game Gear +!:mime application/x-gamegear-rom >0x0F byte&0xF0 0x70 Sega Game Gear ->0x0F byte&0xF0 <0x30 Sega Master System / Game Gear ->0x0F byte&0xF0 >0x70 Sega Master System / Game Gear +!:mime application/x-gamegear-rom +>0x0F default x Sega Master System / Game Gear +!:mime application/x-sms-rom >0 byte x ROM image: # Product code. >0x0E byte&0xF0 0x10 1 @@ -323,17 +347,19 @@ # 2048-byte sector version. 0 string SEGA\ SEGASATURN\ Sega Saturn disc image +!:mime application/x-saturn-rom >0 use sega-saturn-disc-header >0 byte x (2048-byte sectors) # 2352-byte sector version. 0x10 string SEGA\ SEGASATURN\ Sega Saturn disc image +!:mime application/x-saturn-rom >0x10 use sega-saturn-disc-header >0 byte x (2352-byte sectors) #------------------------------------------------------------------------------ # dreamcast: file(1) magic for the Sega Dreamcast disc image format. # From: David Korth -# Reference: http://mc.pp.se/dc/ip0000.bin.html +# Reference: https://mc.pp.se/dc/ip0000.bin.html # # Common Sega Dreamcast disc header format. @@ -347,10 +373,12 @@ # 2048-byte sector version. 0 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image +!:mime application/x-dc-rom >0 use sega-dreamcast-disc-header >0 byte x (2048-byte sectors) # 2352-byte sector version. 0x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image +!:mime application/x-dc-rom >0x10 use sega-dreamcast-disc-header >0 byte x (2352-byte sectors) @@ -366,6 +394,7 @@ # From: David Korth # 0 bequad 0x803712400000000F Nintendo 64 ROM image +!:mime application/x-n64-rom >0x20 string >\0 \b: "%.20s" >0x3B string x (%.4s >0x3F byte x \b, Rev.%02u) @@ -375,39 +404,44 @@ # Same as z64 format, but with 16-bit byteswapping. # 0 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) +!:mime application/x-n64-rom #------------------------------------------------------------------------------ # n64-swap2: file(1) magic for the swap2 format N64 ROM dumps # Same as z64 format, but with swapped 16-bit words. # 0 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) +!:mime application/x-n64-rom #------------------------------------------------------------------------------ # n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps # Same as z64 format, but with 32-bit byteswapping. # 0 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) +!:mime application/x-n64-rom #------------------------------------------------------------------------------ # gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format -# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader +# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader # # Original version from: "Nelson A. de Oliveira" # Updated version from: David Korth # 4 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image +!:mime application/x-gba-rom >0xA0 string >\0 \b: "%.12s" >0xAC string x (%.6s >0xBC byte x \b, Rev.%02u) #------------------------------------------------------------------------------ # nds: file(1) magic for the Nintendo DS(i) raw ROM format -# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader +# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader # # Original version from: "Nelson A. de Oliveira" # Updated version from: David Korth # 0xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image +!:mime application/x-nintendo-ds-rom >0x00 string >\0 \b: "%.12s" >0x0C string x (%.6s >0x1E byte x \b, Rev.%02u) @@ -428,15 +462,17 @@ # This is also used for loading .nds files using the MSET exploit on 3DS. # Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 0xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) +!:mime application/x-nintendo-ds-rom #------------------------------------------------------------------------------ # ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. # From: David Korth # References: # - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp -# - http://www.devrs.com/ngp/files/ngpctech.txt +# - https://www.devrs.com/ngp/files/ngpctech.txt # 0x0A string BY\ SNK\ CORPORATION Neo Geo Pocket +!:mime application/x-neo-geo-pocket-rom >0x23 byte 0x10 Color >0 byte x ROM image >0x24 string >\0 \b: "%.12s" @@ -471,7 +507,23 @@ #------------------------------------------------------------------------------ # Microsoft Xbox executables .xbe (Esa Hyytia ) -0 string XBEH XBE, Microsoft Xbox executable +0 string XBEH Microsoft Xbox executable +!:mime audio/x-xbox-executable +!:ext xbe +# expect base address of 0x10000 +>0x0104 ulelong =0x10000 +>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" +>>(0x0118.l-0x0FFF5) byte x (%c +>>(0x0118.l-0x0FFF6) byte x \b%c- +>>(0x0118.l-0x0FFF8) uleshort x \b%03u) +>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions +>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007 +>>>(0x0118.l-0x0FF60) ulelong >0 (regions: +>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA +>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan +>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World +>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer +>>>(0x0118.l-0x0FF60) ulelong >0 \b) # probabilistic checks whether signed or not >0x0004 ulelong =0x0 >>&2 ulelong =0x0 @@ -479,22 +531,108 @@ >0x0004 ulelong >0 >>&2 ulelong >0 >>>&2 ulelong >0 \b, signed -# expect base address of 0x10000 ->0x0104 ulelong =0x10000 ->>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions ->>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 ->>>(0x0118-0x0FF60) ulelong >0 (regions: ->>>>(0x0118-0x0FF60) ulelong &0x00000001 NA ->>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan ->>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World ->>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer ->>>(0x0118-0x0FF60) ulelong >0 \b) # -------------------------------- # Microsoft Xbox data file formats 0 string XIP0 XIP, Microsoft Xbox data 0 string XTF0 XTF, Microsoft Xbox data +#------------------------------------------------------------------------------ +# Microsoft Xbox 360 executables (.xex) +# From: David Korth +# References: +# - https://free60project.github.io/wiki/XEX.html +# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h + +# Title ID (part of Execution ID section) +0 name xbox-360-xex-execution-id +>(0.L+0xC) byte x (%c +>(0.L+0xD) byte x \b%c +>(0.L+0xE) beshort x \b-%04u, media ID: +>(0.L) belong x %08X) + +# Region code (part of Security Info) +0 name xbox-360-xex-region-code +>0 ubelong 0xFFFFFFFF \b, all regions +>0 ubelong !0xFFFFFFFF +>>0 ubelong >0 (regions: +>>0 ubelong&0x000000FF 0x000000FF USA +>>0 ubelong&0x00000100 0x00000100 Japan +>>0 ubelong&0x00000200 0x00000200 China +>>0 ubelong&0x0000FC00 0x0000FC00 Asia +>>0 ubelong&0x00FF0000 0x00FF0000 PAL +>>0 ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] +>>0 ubelong&0x00FF0000 0x00010000 AU/NZ +>>0 ubelong&0xFF000000 0xFF000000 Other +>>0 ubelong >0 \b) + +0 string XEX2 Microsoft Xbox 360 executable +!:mime audio/x-xbox360-executable +!:ext xex +>0x18 search/0x100 \x00\x04\x00\x06 +>>&0 use xbox-360-xex-execution-id +>(0x010.L+0x178) use xbox-360-xex-region-code + +0 string XEX1 Microsoft Xbox 360 executable (XEX1) +!:mime audio/x-xbox360-executable +!:ext xex +>0x18 search/0x100 \x00\x04\x00\x06 +>>&0 use xbox-360-xex-execution-id +>(0x010.L+0x154) use xbox-360-xex-region-code + +#------------------------------------------------------------------------------ +# Microsoft Xbox 360 packages +# From: David Korth +# References: +# - https://free60project.github.io/wiki/STFS.html +# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h + +# TODO: More information for console-signed packages. + +0 name xbox-360-package +>0x360 byte x (%c +>0x361 byte x \b%c +>0x362 beshort x \b-%04u, media ID: +>0x354 belong x %08X) +>0x344 belong x \b, content type: +>>0x344 belong 0x1 Saved Game +>>0x344 belong 0x2 Marketplace Content +>>0x344 belong 0x3 Publisher +>>0x344 belong 0x1000 Xbox 360 Title +>>0x344 belong 0x2000 IPTV Pause Buffer +>>0x344 belong 0x4000 Installed Game +>>0x344 belong 0x5000 Original Xbox Game +>>0x344 belong 0x9000 Avatar Item +>>0x344 belong 0x10000 Profile +>>0x344 belong 0x20000 Gamer Picture +>>0x344 belong 0x30000 Theme +>>0x344 belong 0x40000 Cache File +>>0x344 belong 0x50000 Storage Download +>>0x344 belong 0x60000 Xbox Saved Game +>>0x344 belong 0x70000 Xbox Download +>>0x344 belong 0x80000 Game Demo +>>0x344 belong 0x90000 Video +>>0x344 belong 0xA0000 Game +>>0x344 belong 0xB0000 Installer +>>0x344 belong 0xC0000 Game Trailer +>>0x344 belong 0xD0000 Arcade Title +>>0x344 belong 0xE0000 XNA +>>0x344 belong 0xF0000 License Store +>>0x344 belong 0x100000 Movie +>>0x344 belong 0x200000 TV +>>0x344 belong 0x300000 Music Video +>>0x344 belong 0x400000 Game Video +>>0x344 belong 0x500000 Podcast Video +>>0x344 belong 0x600000 Viral Video +>>0x344 belong 0x2000000 Community Game + +0 string CON\x20 Microsoft Xbox 360 package (console-signed) +>0 use xbox-360-package +0 string PIRS Microsoft Xbox 360 package (non-Xbox Live) +>0 use xbox-360-package +0 string LIVE Microsoft Xbox 360 package (Xbox Live) +>0 use xbox-360-package + # Atari Lynx cartridge dump (EXE/BLL header) # From: "Stefan A. Haubenthal" @@ -502,15 +640,17 @@ # 8 character OMF-86 object file headers. 0 beshort 0x8008 >6 string BS93 Lynx homebrew cartridge +!:mime application/x-atari-lynx-rom >>2 beshort x \b, RAM start $%04x >6 string LYNX Lynx cartridge +!:mime application/x-atari-lynx-rom >>2 beshort x \b, RAM start $%04x # Opera file system that is used on the 3DO console # From: Serge van den Boom 0 string \x01ZZZZZ\x01 3DO "Opera" file system -# From: Gurkan Sengun , www.linuks.mine.nu +# From: Alex Myczko # From: David Pflug # is the offset 12 or the offset 16 correct? # GBS (Game Boy Sound) magic @@ -518,14 +658,14 @@ # Gameboy%20Sound%20System%20(.gbs).txt 0 string GBS Nintendo Gameboy Music/Audio Data #12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module ->16 string >\0 ("%s" by ->48 string >\0 %s, copyright ->80 string >\0 %s), ->3 byte x version %d, ->4 byte x %d tracks +>16 string >\0 ("%.32s" by +>48 string >\0 %.32s, copyright +>80 string >\0 %.32s), +>3 byte x version %u, +>4 byte x %u tracks # IPS Patch Files from: From: Thomas Klausner -# see http://zerosoft.zophar.net/ips.php +# see https://zerosoft.zophar.net/ips.php 0 string PATCH IPS patch file # Playstations Patch Files from: From: Thomas Klausner @@ -616,7 +756,7 @@ # Type: Nintendo GameCube/Wii common disc header data. # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0 name nintendo-gcn-disc-common >0x20 string x "%.64s" >0x00 string x (%.6s @@ -625,11 +765,14 @@ >>0x06 byte 2 \b, Disc 3 >>0x06 byte 3 \b, Disc 4 >0x07 byte x \b, Rev.%02u) +>0x18 belong 0x5D1C9EA3 +>>0x60 beshort 0x0101 \b (Unencrypted) # Type: Nintendo GameCube disc image # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0x1C belong 0xC2339F3D Nintendo GameCube disc image: +!:mime application/x-gamecube-rom >0 use nintendo-gcn-disc-common # Type: Nintendo GameCube embedded disc image @@ -639,19 +782,21 @@ 0 belong 0xAE0F38A2 >0x0C belong 0x00100000 >>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: +!:mime application/x-gamecube-rom >>>(8.L) use nintendo-gcn-disc-common # Type: Nintendo Wii disc image # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0x18 belong 0x5D1C9EA3 Nintendo Wii disc image: >0 use nintendo-gcn-disc-common # Type: Nintendo Wii disc image (WBFS format) # From: David Korth -# Reference: http://wiibrew.org/wiki/Wii_Disc +# Reference: https://wiibrew.org/wiki/Wii_Disc 0 string WBFS >0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): +!:mime application/x-wii-rom >>0x200 use nintendo-gcn-disc-common # Type: Nintendo GameCube/Wii disc image (CISO format) @@ -665,41 +810,63 @@ >4 lelong 0x200000 >>8 byte 1 >>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): +!:mime application/x-wii-rom >>>>0x8000 use nintendo-gcn-disc-common >>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): +!:mime application/x-wii-rom >>>>0x8000 use nintendo-gcn-disc-common # Type: Nintendo GameCube/Wii disc image (GCZ format) # Due to zlib compression, we can't get the actual disc information. 0 lelong 0xB10BC001 >4 lelong 0 Nintendo GameCube disc image (GCZ format) +!:mime application/x-gamecube-rom >4 lelong 1 Nintendo Wii disc image (GCZ format) ->4 lelong >1 Nintendo GameCube/Wii disc image (GCZ format) +!:mime application/x-wii-rom +>4 default x Nintendo GameCube/Wii disc image (GCZ format) # Type: Nintendo GameCube/Wii disc image (WDF format) 0 string WII\001DISC >8 belong 1 # WDFv1 >>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): +!:mime application/x-gamecube-rom >>>0x38 use nintendo-gcn-disc-common >>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): +!:mime application/x-wii-rom >>>0x38 use nintendo-gcn-disc-common >8 belong 2 # WDFv2 >>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): +!:mime application/x-gamecube-rom >>>(12.L) use nintendo-gcn-disc-common >>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): +!:mime application/x-wii-rom >>>(12.L) use nintendo-gcn-disc-common # Type: Nintendo GameCube/Wii disc image (WIA format) 0 string WIA\001 Nintendo ->0x48 belong 0 GameCube/Wii >0x48 belong 1 GameCube +!:mime application/x-gamecube-rom >0x48 belong 2 Wii ->0x48 belong >2 GameCube/Wii +!:mime application/x-wii-rom +>0x48 default x GameCube/Wii >0x48 belong x disc image (WIA format): >>0x58 use nintendo-gcn-disc-common +# Type: Nintendo GameCube/Wii disc image (with SDK header) +# From: David Korth +# Reference: https://wiibrew.org/wiki/Wii_Disc +0 belong 0xFFFF0000 +>0x18 belong 0x00000000 +>>0x1C belong 0x00000000 +>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: +!:mime application/x-wii-rom +>>>>0x8000 use nintendo-gcn-disc-common +>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: +!:mime application/x-gamecube-rom +>>>>0x8000 use nintendo-gcn-disc-common + #------------------------------------------------------------------------------ # Nintendo 3DS file formats. # @@ -816,6 +983,7 @@ 0 byte >0 >0 byte <3 >>1 string ATARI7800 Atari 7800 ROM image +!:mime application/x-atari-7800-rom >>>0x11 string >\0 \b: "%.32s" # Display type. >>>0x39 byte 0 (NTSC) diff --git a/contrib/file/magic/Magdir/coverage b/contrib/file/magic/Magdir/coverage index 6dd36fa611..69eab70493 100644 --- a/contrib/file/magic/Magdir/coverage +++ b/contrib/file/magic/Magdir/coverage @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $ +# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $ # xoverage: file(1) magic for test coverage data # File formats used to store test coverage data @@ -67,7 +67,7 @@ # `clang -fprofile-instr-generate -fcoverage-mapping ...` # default name: default.profraw # magic is: \xFF lprofr \x81 -# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html +# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 0 lequad 0xff6c70726f667281 LLVM raw profile data, >&0 byte x version %d @@ -78,10 +78,10 @@ # LLVM indexed instruction profile (as generated by llvm-profdata) # magic is: reverse(\xFF lprofi \x81) -# cf. http://llvm.org/docs/CoverageMappingFormat.html -# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html -# http://llvm.org/docs/CommandGuide/llvm-cov.html -# http://llvm.org/docs/CommandGuide/llvm-profdata.html +# cf. https://llvm.org/docs/CoverageMappingFormat.html +# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html +# https://llvm.org/docs/CommandGuide/llvm-cov.html +# https://llvm.org/docs/CommandGuide/llvm-profdata.html 0 lequad 0x8169666f72706cff LLVM indexed profile data, >&0 byte x version %d diff --git a/contrib/file/magic/Magdir/ctf b/contrib/file/magic/Magdir/ctf index 37fdd1b60d..ebea8f3169 100644 --- a/contrib/file/magic/Magdir/ctf +++ b/contrib/file/magic/Magdir/ctf @@ -2,7 +2,7 @@ #-------------------------------------------------------------- # ctf: file(1) magic for CTF (Common Trace Format) trace files # -# Specs. available here: +# Specs. available here: #-------------------------------------------------------------- # CTF trace data diff --git a/contrib/file/magic/Magdir/cups b/contrib/file/magic/Magdir/cups index a065de3963..6dd14ac5a5 100644 --- a/contrib/file/magic/Magdir/cups +++ b/contrib/file/magic/Magdir/cups @@ -1,9 +1,9 @@ #------------------------------------------------------------------------------ -# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $ +# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $ # Cups: file(1) magic for the cups raster file format # From: Laurent Martelli -# http://www.cups.org/documentation.php/spec-raster.html +# https://www.cups.org/documentation.php/spec-raster.html # 0 name cups-le diff --git a/contrib/file/magic/Magdir/database b/contrib/file/magic/Magdir/database index a0300ae772..9578c0fc33 100644 --- a/contrib/file/magic/Magdir/database +++ b/contrib/file/magic/Magdir/database @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: database,v 1.52 2017/08/13 00:21:47 christos Exp $ +# $File: database,v 1.56 2019/06/14 20:12:00 christos Exp $ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) @@ -147,9 +147,8 @@ ## XBase database files # updated by Joerg Jenderek at Feb 2013 -# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm -# http://www.clicketyclick.dk/databases/xbase/format/dbf.html -# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm +# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm +# https://www.clicketyclick.dk/databases/xbase/format/dbf.html # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 0 ubelong&0x0000FFFF <0x00000C20 # skip Infocom game Z-machine @@ -187,13 +186,13 @@ >>>>>>>>>>>>4 lelong >0 \b, %d record # plural s appended >>>>>>>>>>>>>4 lelong >1 \bs -# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF +# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) >>>>>>>>>>>>10 uleshort x * %d # file size = records * record size + header size >>>>>>>>>>>>1 ubyte x \b, update-date >>>>>>>>>>>>1 use xbase-date -# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx +# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x @@ -261,13 +260,13 @@ # dBASE IV SQL, no memo;dbv memo var size (Flagship) >>0 ubyte 0x43 dBase IV, with SQL table !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x62 dBase IV, with SQL table #!:mime application/x-dbf # dBASE IV, with memo!! >>0 ubyte 0x7b dBase IV, with memo !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x82 dBase IV, with SQL system #!:mime application/x-dbf # FoxBase+/dBaseIII+ with memo .DBT! @@ -276,7 +275,7 @@ # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file >>0 ubyte 0x87 VISUAL OBJECTS, with memo file !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT #!:mime application/x-dbf # dBASE IV with memo! @@ -287,7 +286,7 @@ !:mime application/x-dbf # .dbv and .dbt memo (Flagship)? >>0 ubyte 0xB3 Flagship -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xCA dBase IV with memo .DBT #!:mime application/x-dbf # dBASE IV with SQL table, with memo .DBT @@ -296,12 +295,12 @@ # HiPer-Six format;Clipper SIX, with SMT memo file >>0 ubyte 0xE5 Clipper SIX with memo !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo #!:mime application/x-dbf >>0 ubyte 0xF5 FoxPro with memo !:mime application/x-dbf -# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx +# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xFA FoxPro 2.x, with memo #!:mime application/x-dbf # unknown version (should not happen) @@ -332,14 +331,14 @@ >>>>>2 ubyte x \b-%d # dBase memo files .DBT or .FPT -# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx +# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 16 ubyte <4 >16 ubyte !2 >>16 ubyte !1 # next free block index is positive >>>0 ulelong >0 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size ->>>>17 ubelong&0xFFfdFE00 0x00000000 +>>>>17 ubelong&0xFFfdFEff 0x00000000 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h >>>>>20 ubelong&0xFF01209B 0x00000000 # dBASE III @@ -355,36 +354,34 @@ >>>>>>>>>6 ubeshort >0 # skip emacs.PIF >>>>>>>>>>4 ushort 0 ->>>>>>>>>>>0 use foxpro-memo-print +# check for valid FoxPro field type +>>>>>>>>>>>512 ubelong <3 +>>>>>>>>>>>>0 use foxpro-memo-print # dBASE III DBT , garbage ->>>>>>>>>6 ubeshort 0 -# skip MM*DD*.bin by test for for reserved NULL byte ->>>>>>>>>>510 ubeshort 0 -# skip TK-DOS11.img image by looking for memo text ->>>>>>>>>>>512 ubelong <0xfeffff03 -# skip EFI executables by looking for memo text ->>>>>>>>>>>>512 ubelong >0x1F202020 ->>>>>>>>>>>>>513 ubyte >0 +# skip WORD1XW.DOC with improbably high free block index +>>>>>>>>>0 lelong <2205083 # unusual dBASE III DBT like adressen.dbt ->>>>>>>>>>>>>>0 use dbase3-memo-print +>>>>>>>>>>0 use dbase3-memo-print # dBASE III DBT like angest.dbt, or garbage PCX DBF >>>>>>>>8 ubelong !0 # skip PCX and some DBF by test for for reserved NULL bytes >>>>>>>>>510 ubeshort 0 -# skip some DBF by test of invalid version ->>>>>>>>>>0 ubyte >5 ->>>>>>>>>>>0 ubyte <48 ->>>>>>>>>>>>0 use dbase3-memo-print +# skip AI070GEP.EPS with improbably high free block index +>>>>>>>>>>0 lelong <458766 +>>>>>>>>>>>0 use dbase3-memo-print # dBASE IV DBT with positive block size >>>>>>>20 uleshort >0 # dBASE IV DBT with valid block length like 512, 1024 # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero ->>>>>>>>20 uleshort&0x800f 0 +# skip also 3600h 3E00h size +>>>>>>>>20 uleshort&0xE00f 0 >>>>>>>>>0 use dbase4-memo-print # Print the information of dBase III DBT memo file 0 name dbase3-memo-print >0 ubyte x dBase III DBT +!:mime application/x-dbt +!:ext dbt # instead 3 as version number 0 for unusual examples like biblio.dbt >16 ubyte !3 \b, version number %u # Number of next available block for appending data @@ -395,6 +392,7 @@ >20 uleshort !0 \b, block length %u # dBase III memo field terminated by \032\032 >512 string >\0 \b, 1st item "%s" +# https://www.clicketyclick.dk/databases/xbase/format/dbt.html # Print the information of dBase IV DBT memo file 0 name dbase4-memo-print >0 lelong x dBase IV DBT @@ -433,9 +431,12 @@ # length of memo field >>4 lelong x \b, field length %d >>>8 string >\0 \b, 1st used item "%s" +# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm # Print the information of FoxPro FPT memo file 0 name foxpro-memo-print >0 belong x FoxPro FPT +!:mime application/x-fpt +!:ext fpt # Size of blocks for FoxPro ( 64,256 ) >6 ubeshort x \b, blocks size %u # next available block @@ -495,7 +496,7 @@ >>220 ulelong x \b.%d # From: Joerg Jenderek -# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility +# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility # Note: files contain application compatibility fixes, application compatibility modes and application help messages. 8 string sdbf >7 ubyte 0 @@ -542,7 +543,7 @@ >>7 byte x \b-%d # Type: Advanced Data Format (ADF) database -# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ +# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ # From: Nicolas Chauvat 0 string @(#)ADF\ Database CGNS Advanced Data Format @@ -582,7 +583,7 @@ 0 string ToKyO\ CaBiNeT\n TokyoCabinet database >14 string x (version %s) -# From: Stephane Blondon http://www.yaal.fr +# From: Stephane Blondon https://www.yaal.fr # Database file for Zope (done by FileStorage) 0 string FS21 Zope Object Database File Storage v3 (data) 0 string FS30 Zope Object Database File Storage v4 (data) @@ -593,7 +594,7 @@ # IDA (Interactive Disassembler) database 0 string IDA1 IDA (Interactive Disassembler) database -# Hopper (reverse engineering tool) http://www.hopperapp.com/ +# Hopper (reverse engineering tool) https://www.hopperapp.com/ 0 string hopperdb Hopper database # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) @@ -632,3 +633,15 @@ >28 lelong x \b, entries %d >32 lelong x \b, index %d >36 lelong x \b, seed %#x + +# +# Redis RDB - https://redis.io/topics/persistence +0 string REDIS Redis RDB file, +>5 regex [0-9][0-9][0-9][0-9] version %s + +# Mork database. +# Used by older versions of Mozilla Suite and Firefox, +# and current versions of Thunderbird. +# From: David Korth +0 string //\