2 #------------------------------------------------------------------------------
3 # $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $
4 # database: file(1) magic for various databases
6 # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
10 # Will be maintained as part of the GDBM distribution in the future.
12 0 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit
13 !:mime application/x-gdbm
14 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old
15 !:mime application/x-gdbm
16 0 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit
17 !:mime application/x-gdbm
18 0 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit
19 !:mime application/x-gdbm
20 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old
21 !:mime application/x-gdbm
22 0 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit
23 !:mime application/x-gdbm
24 0 string GDBM GNU dbm 2.x database
25 !:mime application/x-gdbm
29 # Ian Darwin's file /etc/magic files: big/little-endian version.
31 # Hash 1.85/1.86 databases store metadata in network byte order.
32 # Btree 1.85/1.86 databases store the metadata in host byte order.
33 # Hash and Btree 2.X and later databases store the metadata in host byte order.
35 0 long 0x00061561 Berkeley DB
36 !:mime application/x-dbm
40 >>4 belong >0 (Hash, version %d, native byte-order)
44 >>4 belong >0 (Hash, version %d, little-endian)
46 0 belong 0x00061561 Berkeley DB
50 >>4 belong >0 (Hash, version %d, big-endian)
54 >>4 belong >0 (Hash, version %d, native byte-order)
56 0 long 0x00053162 Berkeley DB 1.85/1.86
57 >4 long >0 (Btree, version %d, native byte-order)
58 0 belong 0x00053162 Berkeley DB 1.85/1.86
59 >4 belong >0 (Btree, version %d, big-endian)
60 0 lelong 0x00053162 Berkeley DB 1.85/1.86
61 >4 lelong >0 (Btree, version %d, little-endian)
63 12 long 0x00061561 Berkeley DB
64 >16 long >0 (Hash, version %d, native byte-order)
65 12 belong 0x00061561 Berkeley DB
66 >16 belong >0 (Hash, version %d, big-endian)
67 12 lelong 0x00061561 Berkeley DB
68 >16 lelong >0 (Hash, version %d, little-endian)
70 12 long 0x00053162 Berkeley DB
71 >16 long >0 (Btree, version %d, native byte-order)
72 12 belong 0x00053162 Berkeley DB
73 >16 belong >0 (Btree, version %d, big-endian)
74 12 lelong 0x00053162 Berkeley DB
75 >16 lelong >0 (Btree, version %d, little-endian)
77 12 long 0x00042253 Berkeley DB
78 >16 long >0 (Queue, version %d, native byte-order)
79 12 belong 0x00042253 Berkeley DB
80 >16 belong >0 (Queue, version %d, big-endian)
81 12 lelong 0x00042253 Berkeley DB
82 >16 lelong >0 (Queue, version %d, little-endian)
85 12 long 0x00040988 Berkeley DB
86 >16 long >0 (Log, version %d, native byte-order)
87 12 belong 0x00040988 Berkeley DB
88 >16 belong >0 (Log, version %d, big-endian)
89 12 lelong 0x00040988 Berkeley DB
90 >16 lelong >0 (Log, version %d, little-endian)
94 # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
95 0 string/b RRD\0 RRDTool DB
96 >4 string/b x version %s
98 >>10 short !0 16bit aligned
99 >>>10 bedouble 8.642135e+130 big-endian
100 >>>>18 short x 32bit long (m68k)
103 >>>12 long !0 32bit aligned
104 >>>>12 bedouble 8.642135e+130 big-endian
105 >>>>>20 long 0 64bit long
106 >>>>>20 long !0 32bit long
107 >>>>12 ledouble 8.642135e+130 little-endian
108 >>>>>24 long 0 64bit long
109 >>>>>24 long !0 32bit long (i386)
110 >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian
111 >>>>>24 short !0 32bit long (arm)
113 >>8 quad 0 64bit aligned
114 >>>16 bedouble 8.642135e+130 big-endian
115 >>>>24 long 0 64bit long (s390x)
116 >>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC)
117 >>>16 ledouble 8.642135e+130 little-endian
118 >>>>28 long 0 64bit long (alpha/amd64/ia64)
119 >>>>28 long !0 32bit long (armel/mipsel)
121 #----------------------------------------------------------------------
122 # ROOT: file(1) magic for ROOT databases
124 0 string root\0 ROOT file
125 >4 belong x Version %d
126 >33 belong x (Compression: %d)
129 # Alex Ott <ott@jet.msk.su>
130 ## Paradox file formats
131 #2 leshort 0x0800 Paradox
135 #>0x39 byte 10 v. 5.x
136 #>0x39 byte 11 v. 5.x
137 #>0x39 byte 12 v. 7.x
138 #>>0x04 byte 0 indexed .DB data file
139 #>>0x04 byte 1 primary index .PX file
140 #>>0x04 byte 2 non-indexed .DB data file
141 #>>0x04 byte 3 non-incrementing secondary index .Xnn file
142 #>>0x04 byte 4 secondary index .Ynn file
143 #>>0x04 byte 5 incrementing secondary index .Xnn file
144 #>>0x04 byte 6 non-incrementing secondary index .XGn file
145 #>>0x04 byte 7 secondary index .YGn file
146 #>>>0x04 byte 8 incrementing secondary index .XGn file
148 ## XBase database files
149 # updated by Joerg Jenderek at Feb 2013
150 # https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
151 # https://www.clicketyclick.dk/databases/xbase/format/dbf.html
152 # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
153 0 ubelong&0x0000FFFF <0x00000C20
154 # skip Infocom game Z-machine
156 # skip Androids *.xml
161 # skip HELP.CA3 by test for reserved byte ( NULL )
163 # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
164 #>>>>>30 ubeshort x 30NULL?%x
165 # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
166 >>>>>>24 ubelong&0xffFFFFff >0x01302000
168 >>>>>>24 ubelong&0xffFFFFff <0x01302001
169 # for Xbase Database file (*.DBF) reserved (NULL) for multi-user
170 >>>>>>>24 ubelong&0xffFFFFff =0
171 # test for 2 reserved NULL bytes,transaction and encryption byte flag
172 >>>>>>>>12 ubelong&0xFFFFfEfE 0
175 >>>>>>>>>28 ubyte&0xf8 0
177 >>>>>>>>>>8 uleshort >31
178 # skip PIC15736.PCX by test for language driver name or field name
179 >>>>>>>>>>>32 ubyte >0
180 #!:mime application/x-dbf; charset=unknown-8bit ??
181 #!:mime application/x-dbase
182 >>>>>>>>>>>>0 use xbase-type
184 >>>>>>>>>>>>0 ubyte x \b DBF
185 >>>>>>>>>>>>4 lelong 0 \b, no records
186 >>>>>>>>>>>>4 lelong >0 \b, %d record
188 >>>>>>>>>>>>>4 lelong >1 \bs
189 # https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
190 # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
191 >>>>>>>>>>>>10 uleshort x * %d
192 # file size = records * record size + header size
193 >>>>>>>>>>>>1 ubyte x \b, update-date
194 >>>>>>>>>>>>1 use xbase-date
195 # https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
196 #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
197 # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
198 >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
199 #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
200 >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
201 >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
202 >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
203 # 1st record offset + 1 = header size
204 >>>>>>>>>>>>8 uleshort >0
205 >>>>>>>>>>>>(8.s+1) ubyte >0
206 >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
207 >>>>>>>>>>>>>(8.s+1) ubyte >0
208 >>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
209 # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
210 >>>>>>>24 ubelong&0x0133f7ff >0
211 # test for reserved NULL byte
213 # test for valid TAG key format (0x10 or 0)
214 >>>>>>>>>559 ubyte&0xeF 0
216 >>>>>>>>>>45 ubeshort <0x0C20
217 >>>>>>>>>>>45 ubyte >0
218 >>>>>>>>>>>>46 ubyte <32
219 >>>>>>>>>>>>>46 ubyte >0
220 #!:mime application/x-mdx
221 >>>>>>>>>>>>>>0 use xbase-type
222 >>>>>>>>>>>>>>0 ubyte x \b MDX
223 >>>>>>>>>>>>>>1 ubyte x \b, creation-date
224 >>>>>>>>>>>>>>1 use xbase-date
225 >>>>>>>>>>>>>>44 ubyte x \b, update-date
226 >>>>>>>>>>>>>>44 use xbase-date
227 # No.of tags in use (1,2,5,12)
228 >>>>>>>>>>>>>>28 uleshort x \b, %d
229 # No. of entries in tag (0x30)
230 >>>>>>>>>>>>>>25 ubyte x \b/%d tags
232 >>>>>>>>>>>>>>26 ubyte x * %d
234 >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
236 #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
238 # Print the xBase names of different version variants
243 >>0 ubyte 0x02 FoxBase
244 # FoxBase+/dBaseIII+, no memo
245 >>0 ubyte 0x03 FoxBase+/dBase III
246 !:mime application/x-dbf
247 # dBASE IV no memo file
248 >>0 ubyte 0x04 dBase IV
249 !:mime application/x-dbf
250 # dBASE V no memo file
251 >>0 ubyte 0x05 dBase V
252 !:mime application/x-dbf
253 >>0 ubyte 0x30 Visual FoxPro
254 !:mime application/x-dbf
255 >>0 ubyte 0x31 Visual FoxPro, autoincrement
256 !:mime application/x-dbf
257 # Visual FoxPro, with field type Varchar or Varbinary
258 >>0 ubyte 0x32 Visual FoxPro, with field type Varchar
259 !:mime application/x-dbf
260 # dBASE IV SQL, no memo;dbv memo var size (Flagship)
261 >>0 ubyte 0x43 dBase IV, with SQL table
262 !:mime application/x-dbf
263 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
264 #>>0 ubyte 0x62 dBase IV, with SQL table
265 #!:mime application/x-dbf
266 # dBASE IV, with memo!!
267 >>0 ubyte 0x7b dBase IV, with memo
268 !:mime application/x-dbf
269 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
270 #>>0 ubyte 0x82 dBase IV, with SQL system
271 #!:mime application/x-dbf
272 # FoxBase+/dBaseIII+ with memo .DBT!
273 >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
274 !:mime application/x-dbf
275 # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
276 >>0 ubyte 0x87 VISUAL OBJECTS, with memo file
277 !:mime application/x-dbf
278 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
279 #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
280 #!:mime application/x-dbf
281 # dBASE IV with memo!
282 >>0 ubyte 0x8B dBase IV, with memo .DBT
283 !:mime application/x-dbf
284 # dBase IV with SQL Table,no memo?
285 >>0 ubyte 0x8E dBase IV, with SQL table
286 !:mime application/x-dbf
287 # .dbv and .dbt memo (Flagship)?
288 >>0 ubyte 0xB3 Flagship
289 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
290 #>>0 ubyte 0xCA dBase IV with memo .DBT
291 #!:mime application/x-dbf
292 # dBASE IV with SQL table, with memo .DBT
293 >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
294 !:mime application/x-dbf
295 # HiPer-Six format;Clipper SIX, with SMT memo file
296 >>0 ubyte 0xE5 Clipper SIX with memo
297 !:mime application/x-dbf
298 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
299 #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
300 #!:mime application/x-dbf
301 >>0 ubyte 0xF5 FoxPro with memo
302 !:mime application/x-dbf
303 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
304 #>>0 ubyte 0xFA FoxPro 2.x, with memo
305 #!:mime application/x-dbf
306 # unknown version (should not happen)
308 !:mime application/x-dbf
310 # flags in version byte
311 # DBT flag (with dBASE III memo .DBT)!!
312 # >>0 ubyte&0x80 >0 DBT_FLAG=%x
314 # >>0 ubyte&0x08 >0 MEMO_FLAG=%x
316 # >>0 ubyte&0x70 >0 SQL_FLAG=%x
317 # test and print the date of xBase .DBF .MDX
319 # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
326 # YY is interpreted as 20YY or 19YY
327 >>>>>>0 ubyte <100 \b %.2d
328 # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
329 >>>>>>0 ubyte >99 \b %d
333 # dBase memo files .DBT or .FPT
334 # https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
338 # next free block index is positive
340 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
341 >>>>17 ubelong&0xFFfdFEff 0x00000000
342 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
343 >>>>>20 ubelong&0xFF01209B 0x00000000
347 >>>>>>>0 use dbase3-memo-print
348 # dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
350 # unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
352 # FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
354 >>>>>>>>>6 ubeshort >0
357 # check for valid FoxPro field type
358 >>>>>>>>>>>512 ubelong <3
359 >>>>>>>>>>>>0 use foxpro-memo-print
360 # dBASE III DBT , garbage
361 # skip WORD1XW.DOC with improbably high free block index
362 >>>>>>>>>0 ulelong <0x400000
363 # skip WinStore.App.exe by looking for printable 2nd character of 1st memo item
364 >>>>>>>>>>513 ubyte >037
365 # unusual dBASE III DBT like adressen.dbt
366 >>>>>>>>>>>0 use dbase3-memo-print
367 # dBASE III DBT like angest.dbt, or garbage PCX DBF
369 # skip PCX and some DBF by test for for reserved NULL bytes
370 >>>>>>>>>510 ubeshort 0
371 # skip bad symples with improbably high free block index above 2 GiB file limit
372 >>>>>>>>>>0 ulelong <0x400000
373 # skip AI070GEP.EPS by printable 1st character of 1st memo item
374 >>>>>>>>>>>512 ubyte >037
375 # skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
376 >>>>>>>>>>>>513 ubyte >037
377 >>>>>>>>>>>>>0 use dbase3-memo-print
378 # dBASE IV DBT with positive block size
379 >>>>>>>20 uleshort >0
380 # dBASE IV DBT with valid block length like 512, 1024
381 # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
382 # skip also 3600h 3E00h size
383 >>>>>>>>20 uleshort&0xE00f 0
384 >>>>>>>>>0 use dbase4-memo-print
386 # Print the information of dBase III DBT memo file
387 0 name dbase3-memo-print
388 >0 ubyte x dBase III DBT
389 !:mime application/x-dbt
391 # instead 3 as version number 0 for unusual examples like biblio.dbt
392 >16 ubyte !3 \b, version number %u
393 # Number of next available block for appending data
394 #>0 lelong =0 \b, next free block index %u
395 >0 lelong !0 \b, next free block index %u
396 # no positiv block length
397 #>20 uleshort =0 \b, block length %u
398 >20 uleshort !0 \b, block length %u
399 # dBase III memo field terminated by \032\032
400 >512 string >\0 \b, 1st item "%s"
401 # https://www.clicketyclick.dk/databases/xbase/format/dbt.html
402 # Print the information of dBase IV DBT memo file
403 0 name dbase4-memo-print
404 >0 lelong x dBase IV DBT
405 !:mime application/x-dbt
407 # 8 character shorted main name of coresponding dBASE IV DBF file
408 >8 ubelong >0x20000000
409 # skip unusual like for angest.dbt
411 >>>8 string >\0 \b of %-.8s.DBF
412 # value 0 implies 512 as size
413 #>4 ulelong =0 \b, blocks size %u
414 # size of blocks not reliable like 0x2020204C in angest.dbt
416 >>4 ulelong&0x0000003f 0 \b, blocks size %u
417 # dBase IV DBT with positive block length (found 512 , 1024)
418 >20 uleshort >0 \b, block length %u
419 # next available block
420 #>0 lelong =0 \b, next free block index %u
421 >0 lelong !0 \b, next free block index %u
424 >>>&-4 use dbase4-memofield-print
425 # unusual dBase IV DBT without block length (implies 512 as length)
428 >>>&-4 use dbase4-memofield-print
429 # Print the information of dBase IV memo field
430 0 name dbase4-memofield-print
431 # free dBase IV memo field
432 >0 ubelong !0xFFFF0800
433 >>0 lelong x \b, next free block %u
434 >>4 lelong x \b, next used block %u
435 # used dBase IV memo field
436 >0 ubelong =0xFFFF0800
437 # length of memo field
438 >>4 lelong x \b, field length %d
439 >>>8 string >\0 \b, 1st used item "%s"
440 # http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
441 # Print the information of FoxPro FPT memo file
442 0 name foxpro-memo-print
443 >0 belong x FoxPro FPT
444 !:mime application/x-fpt
446 # Size of blocks for FoxPro ( 64,256 )
447 >6 ubeshort x \b, blocks size %u
448 # next available block
449 #>0 belong =0 \b, next free block index %u
450 >0 belong !0 \b, next free block index %u
451 # field type ( 0~picture, 1~memo, 2~object )
452 >512 ubelong <3 \b, field type %u
453 # length of memo field
455 >>516 belong >0 \b, field length %d
456 >>>520 string >\0 \b, 1st item "%s"
459 # DBASE index file *.NDX
460 # DBASE Compound Index file *.CDX
461 # dBASE IV Printer Driver *.PRF
462 ## End of XBase database stuff
465 4 string Standard\ Jet\ DB Microsoft Access Database
466 !:mime application/x-msaccess
467 4 string Standard\ ACE\ DB Microsoft Access Database
468 !:mime application/x-msaccess
470 # From: Joerg Jenderek
471 # URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
472 # Reference: https://github.com/libyal/libesedb/archive/master.zip
473 # libesedb-master/documentation/
474 # Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
475 # Note: also known as "JET Blue". Used by numerous Windows components such as
476 # Windows Search, Mail, Exchange and Active Directory.
479 >132 ubelong 0 Extensible storage engine
480 !:mime application/x-ms-ese
481 # file_type 0~database 1~stream
482 >>12 ulelong 0 DataBase
483 # Security DataBase (sdb)
485 >>12 ulelong 1 STreaMing
487 # format_version 620h
488 >>8 uleshort x \b, version 0x%x
489 >>10 uleshort >0 revision 0x%4.4x
490 >>0 ubelong x \b, checksum 0x%8.8x
491 # Page size 4096 8192 32768
492 >>236 ulequad x \b, page size %lld
494 >>52 ulelong 1 \b, JustCreated
495 >>52 ulelong 2 \b, DirtyShutdown
496 #>>52 ulelong 3 \b, CleanShutdown
497 >>52 ulelong 4 \b, BeingConverted
498 >>52 ulelong 5 \b, ForceDetach
499 # Windows NT major version when the databases indexes were updated.
500 >>216 ulelong x \b, Windows version %d
501 # Windows NT minor version
502 >>220 ulelong x \b.%d
504 # From: Joerg Jenderek
505 # URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
506 # Note: files contain application compatibility fixes, application compatibility modes and application help messages.
509 # TAG_TYPE_LIST+TAG_INDEXES
510 >>12 uleshort 0x7802 Windows application compatibility Shim DataBase
512 #>>>0 ulelong x \b, version %d
513 !:mime application/x-ms-sdb
516 # TDB database from Samba et al - Martin Pool <mbp@samba.org>
517 0 string TDB\ file TDB database
518 >32 lelong 0x2601196D version 6, little-endian
519 >>36 lelong x hash size %d bytes
521 # SE Linux policy database
522 0 lelong 0xf97cff8c SE Linux policy
525 >24 lelong x %d symbols
526 >28 lelong x %d ocons
528 # ICE authority file data (Wolfram Kleff)
529 2 string ICE ICE authority data
531 # X11 Xauthority file (Wolfram Kleff)
532 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
533 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
534 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
535 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
536 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
537 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
538 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
539 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
540 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
542 # From: Maxime Henrion <mux@FreeBSD.org>
543 # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
544 0 string PGDMP PostgreSQL custom database dump
547 >5 beshort <0x101 \b-0
551 # Type: Advanced Data Format (ADF) database
552 # URL: https://www.grc.nasa.gov/WWW/cgns/adf/
553 # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
554 0 string @(#)ADF\ Database CGNS Advanced Data Format
556 # Tokyo Cabinet magic data
557 # http://tokyocabinet.sourceforge.net/index.html
558 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
561 !:mime application/x-tokyocabinet-hash
562 >32 byte 1 \b, B+ tree
563 !:mime application/x-tokyocabinet-btree
564 >32 byte 2 \b, Fixed-length
565 !:mime application/x-tokyocabinet-fixed
567 !:mime application/x-tokyocabinet-table
568 >33 byte &1 \b, [open]
569 >33 byte &2 \b, [fatal]
570 >34 byte x \b, apow=%d
571 >35 byte x \b, fpow=%d
572 >36 byte &0x01 \b, [large]
573 >36 byte &0x02 \b, [deflate]
574 >36 byte &0x04 \b, [bzip]
575 >36 byte &0x08 \b, [tcbs]
576 >36 byte &0x10 \b, [excodec]
577 >40 lequad x \b, bnum=%lld
578 >48 lequad x \b, rnum=%lld
579 >56 lequad x \b, fsiz=%lld
581 # Type: QDBM Quick Database Manager
582 # From: Benoit Sibaud <bsibaud@april.org>
583 0 string \\[depot\\]\n\f Quick Database Manager, little endian
584 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
586 # Type: TokyoCabinet database
587 # URL: http://tokyocabinet.sourceforge.net/
588 # From: Benoit Sibaud <bsibaud@april.org>
589 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
590 >14 string x (version %s)
592 # From: Stephane Blondon https://www.yaal.fr
593 # Database file for Zope (done by FileStorage)
594 0 string FS21 Zope Object Database File Storage v3 (data)
595 0 string FS30 Zope Object Database File Storage v4 (data)
597 # Cache file for the database of Zope (done by ClientStorage)
598 0 string ZEC3 Zope Object Database Client Cache File (data)
600 # IDA (Interactive Disassembler) database
601 0 string IDA1 IDA (Interactive Disassembler) database
603 # Hopper (reverse engineering tool) https://www.hopperapp.com/
604 0 string hopperdb Hopper database
606 # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
607 # Reference: http://www.provue.com/Panorama/
608 # From: Joerg Jenderek
609 # NOTE: test only versions 4 and 6.0 with Windows
610 # length of Panorama database name
612 # look after database name for "some" null bits
613 >(5.B+7) ubelong&0xF3ffF000 0
614 # look for first keyword
615 >>&1 search/2 DESIGN Panorama database
616 #!:mime application/x-panorama-database
620 >>>5 pstring x \b, "%s"
624 # askSam Database by Stefan A. Haubenthal <polluks@web.de>
625 0 string askw40\0 askSam DB
629 # MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
630 0 string MBSTV\040 MUIbase DB
631 >6 string x version %s
635 0 string NBCDB\012 NetBSD Constant Database
636 >7 byte x \b, version %d
637 >8 string x \b, for '%s'
638 >24 lelong x \b, datasize %d
639 >28 lelong x \b, entries %d
640 >32 lelong x \b, index %d
641 >36 lelong x \b, seed %#x
644 # Redis RDB - https://redis.io/topics/persistence
645 0 string REDIS Redis RDB file,
646 >5 regex [0-9][0-9][0-9][0-9] version %s
649 # Used by older versions of Mozilla Suite and Firefox,
650 # and current versions of Thunderbird.
651 # From: David Korth <gerbilsoft@gerbilsoft.com>
652 0 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database
653 >23 string x \b, version %.3s
655 # URL: https://en.wikipedia.org/wiki/Management_Information_Format
656 # Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
657 # From: Joerg Jenderek
658 # Note: only tested with monitor asset reports of Dell Display Manager
659 # skip start like Language=fr|CA|iso8859-1
660 0 search/27/C Start\040Component DMI Management Information Format
662 !:mime text/x-dmtf-mif