+2014-10-10 15:01 Christos Zoulas <christos@zoulas.com>
+
+ * release 5.20
+
+2014-08-17 10:01 Christos Zoulas <christos@zoulas.com>
+
+ * recognize encrypted CDF documents
+
+2014-08-04 9:18 Christos Zoulas <christos@zoulas.com>
+
+ * add magic_load_buffers from Brooks Davis
+
+2014-07-24 16:40 Christos Zoulas <christos@zoulas.com>
+
+ * add thumbs.db support
+
+2014-06-12 12:28 Christos Zoulas <christos@zoulas.com>
+
+ * release 5.19
+
+2014-06-09 9:04 Christos Zoulas <christos@zoulas.com>
+
+ * Misc buffer overruns and missing buffer size tests in cdf parsing
+ (Francisco Alonso, Jan Kaluza)
+
+2014-06-02 14:50 Christos Zoulas <christos@zoulas.com>
+
+ * Enforce limit of 8K on regex searches that have no limits
+ * Allow the l modifier for regex to mean line count. Default
+ to byte count. If line count is specified, assume a max
+ of 80 characters per line to limit the byte count.
+ * Don't allow conversions to be used for dates, allowing
+ the mask field to be used as an offset.
+
+2014-05-30 12:51 Christos Zoulas <christos@zoulas.com>
+
+ * Make the range operator limit the length of the
+ regex search.
+
+2014-05-14 19:23 Christos Zoulas <christos@zoulas.com>
+
+ * PR/347: Windows fixes
+ * PR/352: Hangul word processor recognition
+ * PR/354: Encoding irregularities in text files
+
+2014-05-06 6:12 Christos Zoulas <christos@zoulas.com>
+
+ * Fix uninitialized title in CDF files (Jan Kaluza)
+
+2014-05-04 14:55 Christos Zoulas <christos@zoulas.com>
+
+ * PR/351: Fix compilation of empty files
+
+2014-04-30 17:39 Christos Zoulas <christos@zoulas.com>
+
+ * Fix integer formats: We don't specify 'l' or
+ 'h' and 'hh' specifiers anymore, only 'll' for
+ quads and nothing for the rest. This is so that
+ magic writing is simpler.
+
+2014-04-01 15:25 Christos Zoulas <christos@zoulas.com>
+
+ * PR/341: Jan Kaluza, fix memory leak
+ * PR/342: Jan Kaluza, fix out of bounds read
+
+2014-03-28 15:25 Christos Zoulas <christos@zoulas.com>
+
+ * Fix issue with long formats not matching fmtcheck
+
2014-03-26 11:25 Christos Zoulas <christos@zoulas.com>
* release 5.18
2014-03-15 17:45 Christos Zoulas <christos@zoulas.com>
- * add fmtcheck(3) for those who don't have it
+ * add fmtcheck(3) for those who don't have it
2014-03-14 15:12 Christos Zoulas <christos@zoulas.com>
* Identify gnu tar vs. posix tar
- * When keep going, don't print spurious newlines (Radek Vokál)
+ * When keep going, don't print spurious newlines (Radek Vokal)
2006-04-01 12:02 Christos Zoulas <christos@astron.com>
2005-10-31 8:54 Christos Zoulas <christos@astron.com>
* Fix regression where the core info was not completely processed
- (Radek Vokál)
+ (Radek Vokal)
2005-10-20 11:15 Christos Zoulas <christos@astron.com>
2005-09-20 13:33 Christos Zoulas <christos@astron.com>
* Don't print SVR4 Style in core files multiple times
- (Radek Vokál)
+ (Radek Vokal)
2005-08-27 04:09 Christos Zoulas <christos@astron.com>
/* Define to 1 if you have the `fork' function. */
#undef HAVE_FORK
+/* Define to 1 if you have the `freelocale' function. */
+#undef HAVE_FREELOCALE
+
/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
#undef HAVE_FSEEKO
/* Define to 1 if you have the `getpagesize' function. */
#undef HAVE_GETPAGESIZE
+/* Define to 1 if the system has the type `intptr_t'. */
+#undef HAVE_INTPTR_T
+
/* Define to 1 if you have the <inttypes.h> header file. */
#undef HAVE_INTTYPES_H
/* Define to 1 if you have a working `mmap' system call. */
#undef HAVE_MMAP
+/* Define to 1 if you have the `newlocale' function. */
+#undef HAVE_NEWLOCALE
+
/* Define to 1 if you have the `pread' function. */
#undef HAVE_PREAD
/* HAVE_TZNAME */
#undef HAVE_TZNAME
+/* Define to 1 if the system has the type `uintptr_t'. */
+#undef HAVE_UINTPTR_T
+
/* Define to 1 if you have the <unistd.h> header file. */
#undef HAVE_UNISTD_H
+/* Define to 1 if you have the `uselocale' function. */
+#undef HAVE_USELOCALE
+
/* Define to 1 if you have the `utime' function. */
#undef HAVE_UTIME
such a type exists and the standard includes do not define it. */
#undef int64_t
+/* Define to the type of a signed integer type wide enough to hold a pointer,
+ if such a type exists, and if the system does not define it. */
+#undef intptr_t
+
/* Define to a type if <wchar.h> does not define. */
#undef mbstate_t
such a type exists and the standard includes do not define it. */
#undef uint8_t
+/* Define to the type of an unsigned integer type wide enough to hold a
+ pointer, if such a type exists, and if the system does not define it. */
+#undef uintptr_t
+
/* Define as `fork' if `vfork' does not work. */
#undef vfork
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for file 5.18.
+# Generated by GNU Autoconf 2.69 for file 5.20.
#
# Report bugs to <christos@astron.com>.
#
# Identity of this package.
PACKAGE_NAME='file'
PACKAGE_TARNAME='file'
-PACKAGE_VERSION='5.18'
-PACKAGE_STRING='file 5.18'
+PACKAGE_VERSION='5.20'
+PACKAGE_STRING='file 5.20'
PACKAGE_BUGREPORT='christos@astron.com'
PACKAGE_URL=''
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
-\`configure' configures file 5.18 to adapt to many kinds of systems.
+\`configure' configures file 5.20 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
if test -n "$ac_init_help"; then
case $ac_init_help in
- short | recursive ) echo "Configuration of file 5.18:";;
+ short | recursive ) echo "Configuration of file 5.20:";;
esac
cat <<\_ACEOF
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
-file configure 5.18
+file configure 5.20
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
-It was created by file $as_me 5.18, which was
+It was created by file $as_me 5.20, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
# Define the identity of the package.
PACKAGE='file'
- VERSION='5.18'
+ VERSION='5.20'
cat >>confdefs.h <<_ACEOF
esac
+ ac_fn_c_check_type "$LINENO" "intptr_t" "ac_cv_type_intptr_t" "$ac_includes_default"
+if test "x$ac_cv_type_intptr_t" = xyes; then :
+
+$as_echo "#define HAVE_INTPTR_T 1" >>confdefs.h
+
+else
+ for ac_type in 'int' 'long int' 'long long int'; do
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+$ac_includes_default
+int
+main ()
+{
+static int test_array [1 - 2 * !(sizeof (void *) <= sizeof ($ac_type))];
+test_array [0] = 0;
+return test_array [0];
+
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+
+cat >>confdefs.h <<_ACEOF
+#define intptr_t $ac_type
+_ACEOF
+
+ ac_type=
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ test -z "$ac_type" && break
+ done
+fi
+
+
+
+ ac_fn_c_check_type "$LINENO" "uintptr_t" "ac_cv_type_uintptr_t" "$ac_includes_default"
+if test "x$ac_cv_type_uintptr_t" = xyes; then :
+
+$as_echo "#define HAVE_UINTPTR_T 1" >>confdefs.h
+
+else
+ for ac_type in 'unsigned int' 'unsigned long int' \
+ 'unsigned long long int'; do
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+$ac_includes_default
+int
+main ()
+{
+static int test_array [1 - 2 * !(sizeof (void *) <= sizeof ($ac_type))];
+test_array [0] = 0;
+return test_array [0];
+
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+
+cat >>confdefs.h <<_ACEOF
+#define uintptr_t $ac_type
+_ACEOF
+
+ ac_type=
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ test -z "$ac_type" && break
+ done
+fi
+
+
+
for ac_header in $ac_header_list
fi
-for ac_func in strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof
+for ac_func in strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale
do :
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
-This file was extended by file $as_me 5.18, which was
+This file was extended by file $as_me 5.20, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
-file config.status 5.18
+file config.status 5.20
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"
dnl Process this file with autoconf to produce a configure script.
-AC_INIT([file],[5.18],[christos@astron.com])
+AC_INIT([file],[5.20],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
AC_TYPE_INT32_T
AC_TYPE_UINT64_T
AC_TYPE_INT64_T
+AC_TYPE_INTPTR_T
+AC_TYPE_UINTPTR_T
AC_FUNC_MMAP
AC_FUNC_FORK
AC_FUNC_MBRTOWC
fi])
dnl Checks for functions
-AC_CHECK_FUNCS(strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof)
+AC_CHECK_FUNCS(strerror strndup strtoul mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale)
dnl Provide implementation of some required functions if necessary
AC_REPLACE_FUNCS(getopt_long asprintf vasprintf strlcpy strlcat getline ctime_r asctime_r pread strcasestr fmtcheck)
-.\" $File: libmagic.man,v 1.28 2014/03/02 14:47:16 christos Exp $
+.\" $File: libmagic.man,v 1.29 2014/08/04 06:19:44 christos Exp $
.\"
.\" Copyright (c) Christos Zoulas 2003.
.\" All Rights Reserved.
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd January 6, 2012
+.Dd August 4, 2014
.Dt LIBMAGIC 3
.Os
.Sh NAME
.Ft int
.Fn magic_load "magic_t cookie" "const char *filename"
.Ft int
+.Fn magic_load_buffers "magic_t cookie" "void **buffers" "size_t *sizes" "size_t nbuffers"
+.Ft int
.Fn magic_version "void"
.Sh DESCRIPTION
These functions
to the database filename as appropriate.
.Pp
The
+.Fn magic_load_buffers
+function takes an array of size
+.Fa nbuffers
+of
+.Fa buffers
+with a respective size for each in the array of
+.Fa sizes
+loaded with the contents of the magic databases from the filesystem.
+This function can be used in environment where the magic library does
+not have direct access to the filesystem, but can access the magic
+database via shared memory or other IPC means.
+.Pp
+The
.Fn magic_version
command returns the version number of this library which is compiled into
the shared library using the constant
-.\" $File: magic.man,v 1.81 2014/03/08 17:28:08 christos Exp $
-.Dd April 22, 2013
+.\" $File: magic.man,v 1.84 2014/06/03 19:01:34 christos Exp $
+.Dd June 3, 2014
.Dt MAGIC __FSECTION__
.Os
.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
performance is hard to predict, so their use is discouraged.
When used in production environments, their performance
should be carefully checked.
-The type specification can be optionally followed by
-.Dv /[c][s] .
+The size of the string to search should also be limited by specifying
+.Dv /<length> ,
+to avoid performance issues scanning long files.
+The type specification can also be optionally followed by
+.Dv /[c][s][l] .
The
.Dq c
flag makes the match case insensitive, while the
.Dq s
flag update the offset to the start offset of the match, rather than the end.
-The regular expression is tested against line
-.Dv N + 1
-onwards, where
-.Dv N
-is the given offset.
-Line endings are assumed to be in the machine's native format.
+The
+.Dq l
+modifier, changes the limit of length to mean number of lines instead of a
+byte count.
+Lines are delimited by the platforms native line delimiter.
+When a line count is specified, an implicit byte count also computed assuming
+each line is 80 characters long.
+If neither a byte or line count is specified, the search is limited automatically
+to 8KiB.
.Dv ^
and
.Dv $
.Dv 0x13
is hexadecimal.
.Pp
+Numeric operations are not performed on date types, instead the numeric
+value is interpreted as an offset.
+.Pp
For string values, the string from the
file must match the specified string.
The operators
#------------------------------------------------------------
-# $File: android,v 1.3 2013/11/08 01:24:22 christos Exp $
+# $File: android,v 1.6 2014/08/04 06:00:36 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
>17 string 0\n \b, Not-Compressed
>17 string 1\n \b, Compressed
# any string as long as it's not the word none (which is matched below)
->>19 regex/1 \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s)
+>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s)
>>19 string none\n \b, Not-Encrypted
# Commented out because they don't seem useful to print
# (but they are part of the header - the tar file comes after them):
-#>>>&1 regex/1 .* \b, Password salt: %s
-#>>>>&1 regex/1 .* \b, Master salt: %s
-#>>>>>&1 regex/1 .* \b, PBKDF2 rounds: %s
-#>>>>>>&1 regex/1 .* \b, IV: %s
-#>>>>>>>&1 regex/1 .* \b, Key: %s
+#>>>&1 regex/1l .* \b, Password salt: %s
+#>>>>&1 regex/1l .* \b, Master salt: %s
+#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s
+#>>>>>>&1 regex/1l .* \b, IV: %s
+#>>>>>>>&1 regex/1l .* \b, Key: %s
+
+# *.pit files by Joerg Jenderek
+# http://forum.xda-developers.com/showthread.php?p=9122369
+# http://forum.xda-developers.com/showthread.php?t=816449
+# Partition Information Table for Samsung's smartphone with Android
+# used by flash software Odin
+0 ulelong 0x12349876
+# 1st pit entry marker
+>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
+# minimal 13 and maximal 18 PIT entries found
+>>4 ulelong <128 Partition Information Table for Samsung smartphone
+>>>4 ulelong x \b, %d entries
+# 1. pit entry
+>>>4 ulelong >0 \b; #1
+>>>0x01C use PIT-entry
+>>>4 ulelong >1 \b; #2
+>>>0x0A0 use PIT-entry
+>>>4 ulelong >2 \b; #3
+>>>0x124 use PIT-entry
+>>>4 ulelong >3 \b; #4
+>>>0x1A8 use PIT-entry
+>>>4 ulelong >4 \b; #5
+>>>0x22C use PIT-entry
+>>>4 ulelong >5 \b; #6
+>>>0x2B0 use PIT-entry
+>>>4 ulelong >6 \b; #7
+>>>0x334 use PIT-entry
+>>>4 ulelong >7 \b; #8
+>>>0x3B8 use PIT-entry
+>>>4 ulelong >8 \b; #9
+>>>0x43C use PIT-entry
+>>>4 ulelong >9 \b; #10
+>>>0x4C0 use PIT-entry
+>>>4 ulelong >10 \b; #11
+>>>0x544 use PIT-entry
+>>>4 ulelong >11 \b; #12
+>>>0x5C8 use PIT-entry
+>>>4 ulelong >12 \b; #13
+>>>>0x64C use PIT-entry
+# 14. pit entry
+>>>4 ulelong >13 \b; #14
+>>>>0x6D0 use PIT-entry
+>>>4 ulelong >14 \b; #15
+>>>0x754 use PIT-entry
+>>>4 ulelong >15 \b; #16
+>>>0x7D8 use PIT-entry
+>>>4 ulelong >16 \b; #17
+>>>0x85C use PIT-entry
+# 18. pit entry
+>>>4 ulelong >17 \b; #18
+>>>0x8E0 use PIT-entry
+
+0 name PIT-entry
+# garbage value implies end of pit entries
+>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
+# skip empty partition name
+>>0x24 ubyte !0
+# partition name
+>>>0x24 string >\0 %-.32s
+# flags
+>>>0x0C ulelong&0x00000002 2 \b+RW
+# partition ID:
+# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
+# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
+>>>0x08 ulelong x (0x%x)
+# filename
+>>>0x44 string >\0 "%-.64s"
+#>>>0x18 ulelong >0
+# blocksize in 512 byte units ?
+#>>>>0x18 ulelong x \b, %db
+# partition size in blocks ?
+#>>>>0x22 ulelong x \b*%d
+
+# Android bootimg format
+# From https://android.googlesource.com/\
+# platform/system/core/+/master/libsparse/sparse_format.h
+0 lelong 0xed26ff3a Android sparse image
+>4 leshort x \b, version: %d
+>6 leshort x \b.%d
+>16 lelong x \b, Total of %d
+>12 lelong x \b %d-byte output blocks in
+>20 lelong x \b %d input chunks.
#------------------------------------------------------------------------------
-# $File: animation,v 1.51 2014/03/14 18:47:29 christos Exp $
+# $File: animation,v 1.55 2014/09/13 14:29:51 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
!:mime application/x-quicktime-player
4 string/W jP JPEG 2000 image
!:mime image/jp2
+# http://www.ftyps.com/ with local additions
4 string ftyp ISO Media
->8 string isom \b, MPEG v4 system, version 1
-!:mime video/mp4
->8 string iso2 \b, MPEG v4 system, part 12 revision
->8 string mp41 \b, MPEG v4 system, version 1
-!:mime video/mp4
->8 string mp42 \b, MPEG v4 system, version 2
-!:mime video/mp4
->8 string mp7t \b, MPEG v4 system, MPEG v7 XML
->8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
->8 string/W jp2 \b, JPEG 2000
-!:mime image/jp2
+>8 string 3g2 \b, MPEG v4 system, 3GPP2
+!:mime video/3gpp2
+>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
+>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
+>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
+>>11 byte a \b C.S0050-0 V1.0
+>>11 byte b \b C.S0050-0-A V1.0.0
+>>11 byte c \b C.S0050-0-B V1.0
>8 string 3ge \b, MPEG v4 system, 3GPP
!:mime video/3gpp
+>>11 byte 6 \b, Release 6 MBMS Extended Presentations
+>>11 byte 7 \b, Release 7 MBMS Extended Presentations
>8 string 3gg \b, MPEG v4 system, 3GPP
+>11 byte 6 \b, Release 6 General Profile
!:mime video/3gpp
>8 string 3gp \b, MPEG v4 system, 3GPP
+>11 byte 1 \b, Release %d (non existent)
+>11 byte 2 \b, Release %d (non existent)
+>11 byte 3 \b, Release %d (non existent)
+>11 byte 4 \b, Release %d
+>11 byte 5 \b, Release %d
+>11 byte 6 \b, Release %d
+>11 byte 7 \b, Release %d Streaming Servers
!:mime video/3gpp
>8 string 3gs \b, MPEG v4 system, 3GPP
+>11 byte 7 \b, Release %d Streaming Servers
!:mime video/3gpp
->8 string 3g2 \b, MPEG v4 system, 3GPP2
+>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
+!:mime video/mp4
+>8 string/W qt \b, Apple QuickTime movie
+!:mime video/quicktime
+>8 string CAEP \b, Canon Digital Camera
+>8 string caqv \b, Casio Digital Camera
+>8 string CDes \b, Convergent Design
+>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
+>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
+>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
+>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
+>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
+>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
+>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
+>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
+>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec
+>8 string dmpf \b, Digital Media Project
+>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4)
+>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
+>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
+>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
+>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
+>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
+>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
+>8 string dvr1 \b, DVB (.DVB) over RTP
+!:mime video/vnd.dvb.file
+>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream
+!:mime video/vnd.dvb.file
+>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V)
+!:mime video/mp4
+>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P)
+!:mime video/mp4
+>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A)
+!:mime audio/mp4
+>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B)
+!:mime audio/mp4
+>8 string isc2 \b, ISMACryp 2.0 Encrypted File
+# ?/enc-isoff-generic
+>8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005]
+!:mime video/mp4
+>8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003]
+!:mime video/mp4
+>8 string/W jp2 \b, JPEG 2000
+!:mime image/jp2
+>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
+!:mime image/jp2
+>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent)
+>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
+!:mime image/jpm
+>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
+!:mime image/jpx
+>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones
!:mime video/3gpp2
->>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
->>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
->>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
+>8 string M4A \b, Apple iTunes AAC-LC (.M4A) Audio
+!:mime audio/x-m4a
+>8 string M4B \b, Apple iTunes AAC-LC (.M4B) Audio Book
+!:mime audio/mp4
+>8 string M4P \b, Apple iTunes AAC-LC (.M4P) AES Protected Audio
+!:mime video/mp4
+>8 string M4V \b, Apple iTunes Video (.M4V) Video
+!:mime video/x-m4v
+>8 string M4VH \b, Apple TV (.M4V)
+!:mime video/x-m4v
+>8 string M4VP \b, Apple iPhone (.M4V)
+!:mime video/x-m4v
+>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
+!:mime video/mj2
+>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile
+!:mime video/mj2
+>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
+!:mime video/mp4
+>8 string mobi \b, MPEG-4, MOBI format
+!:mime video/mp4
+>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9]
+>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13]
+!:mime video/mp4
+>8 string mp42 \b, MP4 v2 [ISO 14496-14]
+!:mime video/mp4
+>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
+>8 string mp7t \b, MPEG v4 system, MPEG v7 XML
+>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
!:mime video/mp4
->8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
-!:mime video/3gpp
->8 string/W M4A \b, MPEG v4 system, iTunes AAC-LC
+>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3]
+>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
+!:mime video/quicktime
+>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP
+!:mime audio/mp4
+>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
!:mime audio/mp4
->8 string/W M4V \b, MPEG v4 system, iTunes AVC-LC
+>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile
!:mime video/mp4
->8 string/W M4P \b, MPEG v4 system, iTunes AES encrypted
->8 string/W M4B \b, MPEG v4 system, iTunes bookmarked
->8 string/W qt \b, Apple QuickTime movie
+>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile
+!:mime video/mp4
+>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile
+!:mime video/mp4
+>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile
+!:mime video/mp4
+>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile
+!:mime video/mp4
+>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
+!:mime video/mp4
+>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
+!:mime video/mp4
+>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
+!:mime video/mp4
+>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
+!:mime video/mp4
+>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
+!:mime video/mp4
+>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
+>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
+>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
+>8 string pana \b, Panasonic Digital Camera
+>8 string qt \b, Apple QuickTime (.MOV/QT)
!:mime video/quicktime
+>8 string ROSS \b, Ross Video
+>8 string sdv \b, SD Memory Card Video
+>8 string ssc1 \b, Samsung stereo, single stream (patent pending)
+>8 string ssc2 \b, Samsung stereo, dual stream (patent pending)
# MPEG sequences
# Scans for all common MPEG header start codes
# Live MPEG-4 audio streams (instead of RTP FlexMux)
0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
!:mime audio/x-mp4a-latm
-#>1 beshort&0x1FFF x \b, %u byte packet
+#>1 beshort&0x1FFF x \b, %hu byte packet
>3 byte&0xE0 0x40
>>4 byte&0x3C 0x04 \b, single stream
>>4 byte&0x3C 0x08 \b, 2 streams
!:mime video/x-mng
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
->>16 belong x %ld x
->>20 belong x %ld
+>>16 belong x %d x
+>>20 belong x %d
# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0 string \x8bJNG JNG video data,
!:mime video/x-jng
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
->>16 belong x %ld x
->>20 belong x %ld
+>>16 belong x %d x
+>>20 belong x %d
# Vivo video (Wolfram Kleff)
3 string \x0D\x0AVersion:Vivo Vivo video data
#------------------------------------------------------------------------------
-# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $
+# $File: apple,v 1.29 2014/04/30 21:41:02 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
# purposes in YellowStep/Cocoa, including some nib files.
# From: David Remahl <dremahl@apple.com>
2 string typedstream NeXT/Apple typedstream data, big endian
->0 byte x \b, version %hhd
+>0 byte x \b, version %d
>0 byte <5 \b
>>13 byte 0x81 \b
->>>14 ubeshort x \b, system %hd
+>>>14 ubeshort x \b, system %d
2 string streamtyped NeXT/Apple typedstream data, little endian
->0 byte x \b, version %hhd
+>0 byte x \b, version %d
>0 byte <5 \b
>>13 byte 0x81 \b
->>>14 uleshort x \b, system %hd
+>>>14 uleshort x \b, system %d
#------------------------------------------------------------------------------
# CAF: Apple CoreAudio File Format
#------------------------------------------------------------------------------
-# $File: archive,v 1.82 2014/03/14 18:47:29 christos Exp $
+# $File: archive,v 1.88 2014/08/16 10:42:17 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
#
0 string =!<arch>\ndebian
>8 string debian-split part of multipart Debian package
-!:mime application/x-debian-package
+!:mime application/vnd.debian.binary-package
>8 string debian-binary Debian binary package
-!:mime application/x-debian-package
+!:mime application/vnd.debian.binary-package
>8 string !debian
>68 string >\0 (format %s)
# These next two lines do not work, because a bzip2 Debian archive
>9 string \0
>>0 string KWAJ
>>>7 string \321\003 MS Compress archive data
->>>>14 ulong >0 \b, original size: %ld bytes
+>>>>14 ulong >0 \b, original size: %d bytes
>>>>18 ubyte >0x65
>>>>>18 string x \b, was %.8s
>>>>>(10.b-4) string x \b.%.3s
# This is a really bad format. A file containing HAWAII will match this...
#0 string HA HA archive data,
#>2 leshort =1 1 file,
-#>2 leshort >1 %u files,
+#>2 leshort >1 %hu files,
#>4 byte&0x0f =0 first is type CPY
#>4 byte&0x0f =1 first is type ASC
#>4 byte&0x0f =2 first is type HSC
# From: Dirk Jagdmann <doj@cubic.org>
# xar archive format: http://code.google.com/p/xar/
0 string xar! xar archive
->6 beshort x - version %ld
+>6 beshort x - version %d
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
# .kgb
>36 byte 16 \b, back-to-front
>42 beshort x \b, (%dx,
>44 beshort x %d)
+
+# Symantec GHOST image by Joerg Jenderek at May 2014
+# http://us.norton.com/ghost/
+# http://www.garykessler.net/library/file_sigs.html
+0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image
+# *.GHO
+>2 ubyte&0x08 0x00 \b, first file
+# *.GHS or *.[0-9] with cns program option
+>2 ubyte&0x08 0x08 \b, split file
+# part of split index interesting for *.ghs
+>>4 ubyte x id=0x%x
+# compression tag minus one equals numeric compression command line switch z[1-9]
+>3 ubyte 0 \b, no compression
+>3 ubyte 2 \b, fast compression (Z1)
+>3 ubyte 3 \b, medium compression (Z2)
+>3 ubyte >3
+>>3 ubyte <11 \b, compression (Z%d-1)
+>2 ubyte&0x08 0x00
+# ~ 30 byte password field only for *.gho
+>>12 ubequad !0 \b, password protected
+>>44 ubyte !1
+# 1~Image All, sector-by-sector only for *.gho
+>>>10 ubyte 1 \b, sector copy
+# 1~Image Boot track only for *.gho
+>>>43 ubyte 1 \b, boot track
+# 1~Image Disc only for *.gho implies Image Boot track and sector copy
+>>44 ubyte 1 \b, disc sector copy
+# optional image description only *.gho
+>>0xff string >\0 "%-.254s"
+# look for DOS sector end sequence
+>0xE08 search/7776 \x55\xAA
+>>&-512 indirect x \b; contains
+
#------------------------------------------------------------------------------
-# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
+# $File: att3b,v 1.9 2014/04/30 21:41:02 christos Exp $
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# The 3B20 conflicts with SCCS.
#0 beshort 0550 3b20 COFF executable
#>12 belong >0 not stripped
-#>22 beshort >0 - version %ld
+#>22 beshort >0 - version %d
#0 beshort 0551 3b20 COFF executable (TV)
#>12 belong >0 not stripped
-#>22 beshort >0 - version %ld
+#>22 beshort >0 - version %d
#
# WE32K
#
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0443 (target shared library)
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 0561 WE32000 COFF executable (TV)
>12 belong >0 not stripped
#>18 beshort &00020000 - 32100 required
#>18 beshort &00040000 and MAU hardware required
-#>22 beshort >0 - version %ld
+#>22 beshort >0 - version %d
#
# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
#------------------------------------------------------------------------------
-# $File: audio,v 1.68 2013/12/02 13:32:26 christos Exp $
+# $File: audio,v 1.71 2014/05/14 23:30:28 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# first entry is also the string "NTRK"
0 belong 0x4e54524b MultiTrack sound data
->4 belong x - version %ld
+>4 belong x - version %d
# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
# From: Mike Melanson <mike@multimedia.cx>
0 string wvpk WavPack Lossless Audio
-# From Fábio R. Schmidlin <frs@pop.com.br>
+# From Fabio R. Schmidlin <frs@pop.com.br>
# VGM music file
0 string Vgm\
>9 ubyte >0 VGM Video Game Music dump v
#------------------------------------------------------------------------------
-# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $
+# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
# bFLT: file(1) magic for BFLT uclinux binary files
#
# From Philippe De Muyter <phdm@macqel.be>
#
0 string bFLT BFLT executable
->4 belong x - version %ld
+>4 belong x - version %d
>4 belong 4
>>36 belong&0x1 0x1 ram
>>36 belong&0x2 0x2 gotpic
#------------------------------------------------------------------------------
-# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
+# $File: blender,v 1.6 2014/08/30 08:34:17 christos Exp $
# blender: file(1) magic for Blender 3D related files
#
# Native format rule v1.2. For questions use the developers list
>>>0x44 string =GLOB \b.
>>>>0x60 beshort x \b%.4d
-# Scripts that run in the embeded Python interpreter
+# Scripts that run in the embedded Python interpreter
0 string #!BPY Blender3D BPython script
#------------------------------------------------------------------------------
-# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $
+# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
# bsdi: file(1) magic for BSD/OS (from BSDI) objects
# Some object/executable formats use the same magic numbers as are used
# in other OSes; those are handled by entries in aout.
>32 byte 0x6a (uses shared libs)
# same as in SunOS 4.x, except for static shared libraries
-0 belong&077777777 0600413 sparc demand paged
+0 belong&077777777 0600413 SPARC demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
-0 belong&077777777 0600410 sparc pure
+0 belong&077777777 0600410 SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
>36 belong 0xb4100001 (uses shared libs)
-0 belong&077777777 0600407 sparc
+0 belong&077777777 0600407 SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
#------------------------------------------------------------------------------
-# $File: c-lang,v 1.18 2013/08/14 13:06:43 christos Exp $
+# $File: c-lang,v 1.19 2014/06/03 19:17:27 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
>7 string x version %.2s
# We skip the path here, because it is often long (so file will
# truncate it) and mostly redundant.
-# The inverted index functionality was added some time betwen
+# The inverted index functionality was added some time between
# versions 11 and 15, so look for -q if version is above 14:
>7 string >14
>>10 search/100 \ -q\ with inverted index
#------------------------------------------------------------------------------
-# $File: cafebabe,v 1.15 2014/03/14 18:47:29 christos Exp $
+# $File: cafebabe,v 1.16 2014/04/30 21:41:02 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
>4 belong 1 Mach-O universal binary with 1 architecture:
>>8 use mach-o \b
>4 belong >1
->>4 belong <20 Mach-O universal binary with %ld architectures:
+>>4 belong <20 Mach-O universal binary with %d architectures:
>>>8 use mach-o \b
>>>28 use mach-o \b
>>4 belong >2
#------------------------------------------------------------------------------
-# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $
+# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
# clarion: file(1) magic for # Clarion Personal/Professional Developer
# (v2 and above)
# From: Julien Blache <jb@jblache.org>
>2 leshort &0x0010 \b, compressed
>2 leshort &0x0040 \b, read only
# number of records
->5 lelong x \b, %ld records
+>5 lelong x \b, %d records
# Memo files
0 leshort 0x334d Clarion Developer (v2 and above) memo data
#------------------------------------------------------------------------------
-# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $
+# $File: claris,v 1.7 2014/06/03 19:17:27 christos Exp $
# claris: file(1) magic for claris
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Claris Works a word processor, etc.
# .cwk
0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
# .plt
-0 string \020\341\000\000\010\010 Claris Works pallete files .plt
+0 string \020\341\000\000\010\010 Claris Works palette files .plt
# .msp a dictionary file I am not sure about this I have only one .msp file
0 string \002\271\262\000\040\002\000\164 Claris works dictionary
#------------------------------------------------------------------------------
-# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
+# $File: clipper,v 1.7 2014/04/30 21:41:02 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
>20 short 0413 (demand paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
0 short 0577 CLIPPER COFF executable
>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>20 short 0413 (paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
>48 long&01 01 alignment trap enabled
>52 byte 1 -Ctnc
>52 byte 2 -Ctsw
#------------------------------------------------------------------------------
-# $File: commands,v 1.48 2014/03/04 12:20:42 kim Exp $
+# $File: commands,v 1.51 2014/09/27 00:12:55 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
-0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
+0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk or perl script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
#------------------------------------------------------------------------------
-# $File: compress,v 1.54 2014/03/14 18:47:29 christos Exp $
+# $File: compress,v 1.62 2014/09/13 14:27:12 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
!:mime application/x-lrzip
# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
-0 lelong 0x184d2204 LZ4 compressed data
+0 lelong 0x184d2204 LZ4 compressed data (v1.4+)
!:mime application/x-lz4
-0 lelong 0x184c2102 LZ4 compressed data, legacy format
+# Added by osm0sis@xda-developers.com
+0 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3)
+!:mime application/x-lz4
+0 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9)
!:mime application/x-lz4
# AFX compressed files (Wolfram Kleff)
>0x4 lelong x \b, version %u
>0x8 lelong x \b, %u entries
+# Snappy framing format
+# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
+0 string \377\006\0\0sNaPpY snappy framed data
+!:mime application/x-snappy-framed
+
+# qpress, http://www.quicklz.com/
+0 string qpress10 qpress compressed data
+!:mime application/x-qpress
+
+# Zlib https://www.ietf.org/rfc/rfc6713.txt
+0 beshort%31 =0
+>0 byte&0xf =8
+>>0 byte&0x80 =0 zlib compressed data
+!:mime application/zlib
#------------------------------------------------------------------------------
-# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $
+# $File: cups,v 1.3 2014/05/28 19:50:41 christos Exp $
# Cups: file(1) magic for the cups raster file format
# From: Laurent Martelli <martellilaurent@gmail.com>
# http://www.cups.org/documentation.php/spec-raster.html
#
-0 name cups-be
+0 name cups-le
>280 lelong x \b, %d
>284 lelong x \bx%d dpi
>376 lelong x \b, %dx
>3 string 2 Cups Raster version 2, Big Endian
>3 string 3 Cups Raster version 3, Big Endian
!:mime application/vnd.cups-raster
->0 use ^cups-be
+>0 use ^cups-le
# Cups Raster image format, Little Endian
>0 string 2 Cups Raster version 2, Little Endian
>0 string 3 Cups Raster version 3, Little Endian
!:mime application/vnd.cups-raster
->0 use \^cups-be
+>0 use cups-le
#------------------------------------------------------------------------------
-# $File: database,v 1.37 2014/03/14 18:47:29 christos Exp $
+# $File: database,v 1.42 2014/08/19 14:18:04 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
# GDBM magic numbers
# Will be maintained as part of the GDBM distribution in the future.
# <downsj@teeny.org>
-0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
+0 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit
!:mime application/x-gdbm
-0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
+0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old
+!:mime application/x-gdbm
+0 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit
+!:mime application/x-gdbm
+0 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit
+!:mime application/x-gdbm
+0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old
+!:mime application/x-gdbm
+0 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit
!:mime application/x-gdbm
0 string GDBM GNU dbm 2.x database
!:mime application/x-gdbm
>>8 quad 0 64bit aligned
>>>16 bedouble 8.642135e+130 big-endian
>>>>24 long 0 64bit long (s390x)
->>>>24 long !0 32bit long (hppa/mips/ppc/s390/sparc)
+>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC)
>>>16 ledouble 8.642135e+130 little-endian
>>>>28 long 0 64bit long (alpha/amd64/ia64)
>>>>28 long !0 32bit long (armel/mipsel)
# database file
>>>>>>>>>>>>0 ubyte x \b DBF
>>>>>>>>>>>>4 lelong 0 \b, no records
->>>>>>>>>>>>4 lelong >0 \b, %ld record
+>>>>>>>>>>>>4 lelong >0 \b, %d record
# plural s appended
>>>>>>>>>>>>>4 lelong >1 \bs
# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
>>16 ubyte 0
>>>512 ubelong <0x00000003 FoxPro FPT
# Size of blocks for FoxPro
->>>>6 ubeshort x \b, blocks size %lu
+>>>>6 ubeshort x \b, blocks size %u
# Number of next available block for appending data for FoxPro
->>>>0 ubelong =0 \b, next free block index %lu
->>>>0 ubelong !0 \b, next free block index %lu
+>>>>0 ubelong =0 \b, next free block index %u
+>>>>0 ubelong !0 \b, next free block index %u
>>>512 default x dBase IV DBT
-# DBF file name without extention
+# DBF file name without extension
>>>>8 string >\0 \b of %-.8s.DBF
# size of blocks ; not reliable 0x2020204C
-#>>>>4 ulelong =0 \b, blocks size %lu
->>>>4 ulelong !0 \b, blocks size %lu
+#>>>>4 ulelong =0 \b, blocks size %u
+>>>>4 ulelong !0 \b, blocks size %u
# Block length found 0 , 512
#>>>>20 uleshort =0 \b, block length %u
>>>>20 uleshort !0 \b, block length %u
# Number of next available block for appending data
->>>>0 ulelong =0 \b, next free block index %lu
->>>>0 ulelong !0 \b, next free block index %lu
+>>>>0 ulelong =0 \b, next free block index %u
+>>>>0 ulelong !0 \b, next free block index %u
>>512 ubelong x
>>>512 ubelong =0xFFFF0800
>>>>520 string >\0 \b, 1st used item "%s"
#------------------------------------------------------------------------------
-# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $
+# $File: dump,v 1.13 2014/04/30 21:41:02 christos Exp $
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
0 name new-dump-be
>4 bedate x Previous dump %s,
>8 bedate x This dump %s,
->12 belong >0 Volume %ld,
+>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
0 name old-dump-be
#>4 bedate x Previous dump %s,
#>8 bedate x This dump %s,
->12 belong >0 Volume %ld,
+>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
0 name ufs2-dump-be
>896 beqdate x Previous dump %s,
>904 beqdate x This dump %s,
->12 belong >0 Volume %ld,
+>12 belong >0 Volume %d,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
>2 medate x Previous dump %s,
>6 medate x This dump %s,
->10 leshort >0 Volume %ld,
+>10 leshort >0 Volume %d,
>0 leshort 1 tape header.
>0 leshort 2 beginning of file record.
>0 leshort 3 map of inodes on tape.
#------------------------------------------------------------------------------
-# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $
+# $File: dyadic,v 1.6 2014/06/01 19:14:42 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
-0 byte 0xaa
->1 byte <4 Dyalog APL
->>1 byte 0x00 incomplete workspace
->>1 byte 0x01 component file
->>1 byte 0x02 external variable
->>1 byte 0x03 workspace
->>2 byte x version %d
->>3 byte x .%d
-
-0 beshort 0xaa03 Dyalog APL
->2 byte x workspace type %d
->3 byte x subtype %d
->7 byte&0x28 0x00 32-bit
->7 byte&0x28 0x20 64-bit
->7 byte&0x0c 0x00 classic
->7 byte&0x0c 0x04 unicode
->7 byte&0x88 0x00 big-endian
->7 byte&0x88 0x80 little-endian
-
-0 byte 0xaa Dyalog APL
->1 byte 0x00 aplcore
->1 byte 0x01 component file 32-bit non-journaled non-checksummed
->1 byte 0x02 external variable exclusive
->1 byte 0x06 external variable shared
->1 byte 0x07 session
->1 byte 0x08 mapped file 32-bit
->1 byte 0x09 component file 64-bit non-journaled non-checksummed
->1 byte 0x0a mapped file 64-bit
->1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
->1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
->1 byte 0x0d component file 32-bit level 1 journaled checksummed
->1 byte 0x0e component file 64-bit level 1 journaled checksummed
->1 byte 0x0f component file 32-bit level 2 journaled checksummed
->1 byte 0x10 component file 64-bit level 2 journaled checksummed
->1 byte 0x11 component file 32-bit level 3 journaled checksummed
->1 byte 0x12 component file 64-bit level 3 journaled checksummed
->1 byte 0x13 component file 32-bit non-journaled checksummed
->1 byte 0x14 component file 64-bit non-journaled checksummed
->1 byte 0x80 DDB
+# updated by Joerg Jenderek at Oct 2013
+# http://en.wikipedia.org/wiki/Dyalog_APL
+# http://www.dyalog.com/
+# .DXV Dyalog APL External Variable
+# .DIN Dyalog APL Input Table
+# .DOT Dyalog APL Output Table
+# .DFT Dyalog APL Format File
+0 ubeshort&0xFF60 0xaa00
+# skip biblio.dbt
+>1 byte !4
+# real Dyalog APL have non zero version numbers like 7.3 or 13.4
+>>2 ubeshort >0x0000 Dyalog APL
+>>>1 byte 0x00 aplcore
+#>>>1 byte 0x00 incomplete workspace
+# *.DCF Dyalog APL Component File
+>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed
+#>>>1 byte 0x01 component file
+>>>1 byte 0x02 external variable exclusive
+#>>>1 byte 0x02 external variable
+# *.DWS Dyalog APL Workspace
+>>>1 byte 0x03 workspace
+>>>>7 byte&0x28 0x00 32-bit
+>>>>7 byte&0x28 0x20 64-bit
+>>>>7 byte&0x0c 0x00 classic
+>>>>7 byte&0x0c 0x04 unicode
+>>>>7 byte&0x88 0x00 big-endian
+>>>>7 byte&0x88 0x80 little-endian
+>>>1 byte 0x06 external variable shared
+# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
+>>>1 byte 0x07 session
+>>>1 byte 0x08 mapped file 32-bit
+>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed
+>>>1 byte 0x0a mapped file 64-bit
+>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed
+>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed
+>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed
+>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed
+>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed
+>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed
+>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed
+>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed
+>>>1 byte 0x13 component file 32-bit non-journaled checksummed
+>>>1 byte 0x14 component file 64-bit non-journaled checksummed
+>>>1 byte 0x80 DDB
+>>>2 byte x version %d
+>>>3 byte x \b.%d
+#>>>2 byte x type %d
+#>>>3 byte x subtype %d
+# *.DXF Dyalog APL Transfer File
0 short 0x6060 Dyalog APL transfer
#------------------------------------------------------------------------------
-# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $
+# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
# efi: file(1) magic for Universal EFI binaries
0 lelong 0x0ef1fab9
>>&0 lelong 0x01000007 \b, x86_64
>>&20 lelong 7 \b, i386
>>&20 lelong 0x01000007 \b, x86_64
->4 lelong >2 Universal EFI binary with %ld architectures
+>4 lelong >2 Universal EFI binary with %d architectures
#------------------------------------------------------------------------------
-# $File: elf,v 1.66 2014/03/06 16:37:39 christos Exp $
+# $File: elf,v 1.68 2014/09/19 19:05:57 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
>18 leshort 191 Tilera TILE-Gx,
>18 leshort 197 Renesas RL78 family,
>18 leshort 199 Renesas 78K0R,
+>18 leshort 200 Freescale 56800EX,
+>18 leshort 201 Beyond BA1,
+>18 leshort 202 Beyond BA2,
+>18 leshort 203 XMOS xCORE,
+>18 leshort 204 Microchip 8-bit PIC(r),
+>18 leshort 210 KM211 KM32,
+>18 leshort 211 KM211 KMX32,
+>18 leshort 212 KM211 KMX16,
+>18 leshort 213 KM211 KMX8,
+>18 leshort 214 KM211 KVARC,
+>18 leshort 215 Paneve CDP,
+>18 leshort 216 Cognitive Smart Memory,
+>18 leshort 217 iCelero CoolEngine,
+>18 leshort 218 Nanoradio Optimized RISC,
+>18 leshort 243 UCB RISC-V,
>18 leshort 0x1057 AVR (unofficial),
>18 leshort 0x1059 MSP430 (unofficial),
>18 leshort 0x1223 Adapteva Epiphany (unofficial),
#------------------------------------------------------------------------------
-# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $
+# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
# encore: file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
>20 short 0x10b demand-paged executable
>20 short 0x10f unsupported executable
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
>22 short 0 -
#>4 date x stamp %s
0 short 0x155 Encore unsupported executable
>12 long >0 not stripped
->22 short >0 - version %ld
+>22 short >0 - version %d
>22 short 0 -
#>4 date x stamp %s
#------------------------------------------------------------------------------
-# $File: filesystems,v 1.87 2014/03/01 03:04:06 christos Exp $
+# $File: filesystems,v 1.103 2014/09/11 15:09:34 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
>>0752 short >0 %d alt cyls,
>>0754 short >0 %d heads/partition,
>>0756 short >0 %d sectors/track,
->>0764 long >0 start cyl %ld,
->>0770 long x %ld blocks
+>>0764 long >0 start cyl %d,
+>>0770 long x %d blocks
# Is there a boot block written 1 sector in?
>512 belong&077777777 0600407 \b, boot block present
0 string PNCIUNDO Norton Disk Doctor UnDo file
#
-# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011
+# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
# for any allowed sector sizes
30 search/481 \x55\xAA
# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
-!:strength +72
+!:strength +65
# for sector sizes < 512 Bytes
>11 uleshort <512
>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
>0x1FE leshort 0xAA55 DOS/MBR boot sector
# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
# only for sector sizes with 512 or more Bytes
-0x1FE leshort 0xAA55 DOS/MBR boot sector
-!:strength +72
+0x1FE leshort 0xAA55
+#
# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
-#!:strength +21
->2 string OSBS \b, OS/BS MBR
+!:strength +70
+>2 string OSBS OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
>>>24 ubequad 0xf3a4cbbebe07b104 9M
# "Invalid partition table" nn=0x10F for english version
-# "Ungültige Partitionstabelle" nn=0x10F for german version
-# "Table de partition erronée" nn=0x10F for french version
+# "Ung\201ltige Partitionstabelle" nn=0x10F for german version
+# "Table de partition erron\202e" nn=0x10F for french version
# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version
>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english
>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german
>>>>(0x3C.b+0x0FF) string >\0 "%s"
# "Error loading operating system" nn=0x127 for english version
# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version
-# "Erreur lors du chargement du système d'exploitation" nn=0x12a for french version
+# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version
# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version
>>>>0xBD ubyte x at offset 0x1%x
>>>>(0xBD.b+0x100) string >\0 "%s"
# "Missing operating system" nn=0x146 for english version
# "Betriebssystem fehlt" nn=0x151 for german version
-# "Système d'exploitation manquant" nn=0x15e for french version
+# "Syst\212me d'exploitation manquant" nn=0x15e for french version
# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version
>>>>0xA9 ubyte x at offset 0x1%x
>>>>(0xA9.b+0x100) string >\0 "%s"
>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english
>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german
# "Invalid partition table" xx=0x12C for english version
-# "Ungültige Partitionstabelle" xx=0x12C for german version
+# "Ung\201ltige Partitionstabelle" xx=0x12C for german version
>>>>0x1b5 ubyte >0 at offset 0x1%x
>>>>(0x1b5.b+0x100) string >\0 "%s"
# "Error loading operating system" yy=0x144 for english version
>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english
#>>>>0x1B4 ubelong&0x00FFFFFF ? german
# "Invalid partition table" xx=0x162 for english version
-# "Ungültige Partitionstabelle" xx=0x1?? for german version
+# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
>>>>0x1b5 ubyte >0 at offset 0x1%x
>>>>(0x1b5.b+0x100) string >\0 "%s"
# "Error loading operating system" yy=0x17a for english version
>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english
#>>>>0x1B4 ubelong&0x00FFFFFF ? german
# "Invalid partition table" xx=0x163 for english version
-# "Ungültige Partitionstabelle" xx=0x1?? for german version
+# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version
>>>>0x1b5 ubyte >0 at offset 0x1%x
>>>>(0x1b5.b+0x100) string >\0 "%s"
# "Error loading operating system" yy=0x17b for english version
>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>>385 string GRUB\ \0 \b, GRUB version 0.97
-#unkown version
+# unknown version
>>>343 string Geom\0Read\0\ Error\0
>>>>321 string Loading\ stage1.5 \b, GRUB version x.y
>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
#OEM-ID=BOOTWIZ0
>442 string Non-system\ disk,\
>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
-# updated by Joerg Jenderek at Nov 2012
+# updated by Joerg Jenderek at Nov 2012, Sep 2013
# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
->>>477 ubyte&0xDF >0
->>>>477 string x \b %-.3s
->>>>>480 ubyte&0xDF >0
->>>>>>480 string x \b%-.4s
->>>>>>>484 ubyte&0xDF >0
->>>>>>>>484 string x \b%-.1s
->>>>485 ubyte&0xDF >0
->>>>>485 string x \b.%-.3s
+# display 1 space
+>>>447 ubyte x \b
+>>>477 use DOS-filename
#
>185 string FDBOOT\ Version\
>>204 string \rNo\ Systemdisk.\
# It just looks for a program file name at the root directory
# and loads corresponding file with following execution.
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
->>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
->>>>>499 string x \b %-.1s
->>>>>>500 ubyte&0xDF >0
->>>>>>>500 string x \b%-.1s
->>>>>>>>501 ubyte&0xDF >0
->>>>>>>>>501 string x \b%-.1s
->>>>>>>>>>502 ubyte&0xDF >0
->>>>>>>>>>>502 string x \b%-.1s
->>>>>>>>>>>>503 ubyte&0xDF >0
->>>>>>>>>>>>>503 string x \b%-.1s
->>>>>>>>>>>>>>504 ubyte&0xDF >0
->>>>>>>>>>>>>>>504 string x \b%-.1s
->>>>>>>>>>>>>>>>505 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>505 string x \b%-.1s
->>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
-#name extension
->>>>>507 ubyte&0xDF >0 \b.
->>>>>>507 string x \b%-.1s
->>>>>>>508 ubyte&0xDF >0
->>>>>>>>508 string x \b%-.1s
->>>>>>>>>509 ubyte&0xDF >0
->>>>>>>>>>509 string x \b%-.1s
+>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
+>>>>>499 use DOS-filename
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
#If the boot sector fails to find needed program in the root directory,
#it also hangs with another message ("NF").
>>>>>492 string RENF \b, FAT (12 bit)
>>>>>495 string RENF \b, FAT (16 bit)
-# http://alexfru.chat.ru/epm.html#bootprog
->494 ubyte >0x4D
->>495 string >E
->>>495 string <S
-#OEM-ID is not reliable
->>>>3 string BootProg
-# It just looks for a program file name at the root directory
-# and loads corresponding file with following execution.
-# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
->>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
->>>>>499 string x \b %-.1s
->>>>>>500 ubyte&0xDF >0
->>>>>>>500 string x \b%-.1s
->>>>>>>>501 ubyte&0xDF >0
->>>>>>>>>501 string x \b%-.1s
->>>>>>>>>>502 ubyte&0xDF >0
->>>>>>>>>>>502 string x \b%-.1s
->>>>>>>>>>>>503 ubyte&0xDF >0
->>>>>>>>>>>>>503 string x \b%-.1s
->>>>>>>>>>>>>>504 ubyte&0xDF >0
->>>>>>>>>>>>>>>504 string x \b%-.1s
->>>>>>>>>>>>>>>>505 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>505 string x \b%-.1s
->>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
->>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
-#name extension
->>>>>507 ubyte&0xDF >0 \b.
->>>>>>507 string x \b%-.1s
->>>>>>>508 ubyte&0xDF >0
->>>>>>>>508 string x \b%-.1s
->>>>>>>>>509 ubyte&0xDF >0
->>>>>>>>>>509 string x \b%-.1s
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
-#If the boot sector fails to find needed program in the root directory,
-#it also hangs with another message ("NF").
->>>>>492 string RENF \b, FAT (12 bit)
->>>>>495 string RENF \b, FAT (16 bit)
# x86 bootloader end
+# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
+# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
+>0 string RRaA
+>>0x1E4 string rrAa \b, FSInfosector
+#>>0x1FC uleshort =0 SHOULD BE ZERO
+>>>0x1E8 ulelong <0xffffffff \b, %u free clusters
+>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
+
+# updated by Joerg Jenderek at Sep 2007
+>3 ubyte 0
+#no active flag
+>>446 ubyte 0
+# partition 1 not empty
+>>>450 ubyte >0
+# partitions 3,4 empty
+>>>>482 ubyte 0
+>>>>>498 ubyte 0
+# partition 2 ID=0,5,15
+>>>>>>466 ubyte <0x10
+>>>>>>>466 ubyte 0x05 \b, extended partition table
+>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
+>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
+
+# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
+
+>0x200 lelong 0x82564557 \b, BSD disklabel
+
# by Joerg Jenderek at Apr 2013
# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
>11 ubyte x \b+
>11 use DOS-filename
-# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
-# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
->0 string RRaA
->>0x1E4 string rrAa \b, FSInfosector
-#>>0x1FC uleshort =0 SHOULD BE ZERO
->>>0x1E8 ulelong <0xffffffff \b, %u free clusters
->>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
-
-# updated by Joerg Jenderek at Sep 2007
->3 ubyte 0
-#no active flag
->>446 ubyte 0
-# partition 1 not empty
->>>450 ubyte >0
-# partitions 3,4 empty
->>>>482 ubyte 0
->>>>>498 ubyte 0
-# partition 2 ID=0,5,15
->>>>>>466 ubyte <0x10
->>>>>>>466 ubyte 0x05 \b, extended partition table
->>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
->>>>>>>466 ubyte 0x0 \b, extended partition table (last)
-
-# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
-
->0x200 lelong 0x82564557 \b, BSD disklabel
-
# http://en.wikipedia.org/wiki/Master_boot_record#PTE
# display standard partition table
0 name partition-table
#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
# for older versions
>>>(0x1BC.s+9) ubyte <2
-#>>>>(0x1BC.s+12) ubyte 18 \b,%u/18 seconds
+#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
>>>>0x207 ubyte x \b.%u
# module_size for 1.94
>>>>0x208 ulelong <0xffffff \b, installed partition %u
-#>>>>0x208 ulelong =0xffffff \b, %u (default)
+#>>>>0x208 ulelong =0xffffff \b, %lu (default)
>>>>0x208 ulelong >0xffffff \b, installed partition %u
# GRUB 0.5.95 unofficial
>>>>0x20C ulelong&0x2E300000 0x2E300000
# minimal short forward jump found 0x29 for bootloaders or 0x0
# maximal short forward jump is 0x7f
# OEM-ID is empty or contain readable bytes
-0 ulelong&0x804000E9 0x000000E9
+0 ulelong&0x804000E9 0x000000E9
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize must be a power of 2 from 32 to 32768
->11 uleshort&0xf001f 0
+>11 uleshort&0x001f 0
>>11 uleshort <32769
>>>11 uleshort >31
>>>>21 ubyte&0xf0 0xF0
>>>>>0 ubyte 0xEB
>>>>>>1 ubyte x \b, code offset 0x%x+2
>>>>>0 ubyte 0xE9
->>>>>>1 uleshort x \b, code offset 0x%x+2
+>>>>>>1 uleshort x \b, code offset 0x%x+3
>>>>>3 string >\0 \b, OEM-ID "%-.8s"
#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
>>>>>>8 string IHC \b cached by Windows 9M
>>>>>11 uleshort <512 \b, Bytes/sector %u
>>>>>13 ubyte >1 \b, sectors/cluster %u
#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
->>>>>82 string FAT32
+# for lazy FAT32 implementation like Transcend digital photo frame PF830
+>>>>>82 string/c fat32
>>>>>>14 uleshort !32 \b, reserved sectors %u
#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
->>>>>82 string !FAT32
+>>>>>82 string/c !fat32
>>>>>>14 uleshort >1 \b, reserved sectors %u
#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
>>>>>16 ubyte =1 \b, FAT %u
>>>>>16 ubyte >0
>>>>>17 uleshort >0 \b, root entries %u
-#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
+#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
-#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
+#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
>>>>>22 uleshort >0 \b, sectors/FAT %u
-#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
+#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32)
>>>>>24 uleshort x \b, sectors/track %u
>>>>>26 ubyte >2 \b, heads %u
#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
>>>>>26 ubyte =1 \b, heads %u
# valid only for sector sizes with more then 32 Bytes
>>>>>11 uleshort >32
-# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
->>>>>>38 ubyte !0x70
+# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
+# skip for values 2,2Ah,70h,73h,DFh
+# and continue for extended boot signature values 0,28h,29h,80h
+>>>>>>38 ubyte&0x56 =0
>>>>>>>28 ulelong >0 \b, hidden sectors %u
#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
# FAT<32 bit specific
->>>>>>>82 string !FAT32
+>>>>>>>82 string/c !fat32
#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
>>>>>>>>36 ubyte !0x80
>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
+# VGA-copy CRC or
+# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
>>>>>>>>37 ubyte >0 \b, reserved 0x%x
#>>>>>>>>37 ubyte =0 \b, reserved 0x%x
-# value is 0x80 for NTFS
+# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
->>>>>>>>38 ubyte =0x29
+>>>>>>>>38 ubyte&0xFE =0x28
>>>>>>>>>39 ulelong x \b, serial number 0x%x
+>>>>>>>>38 ubyte =0x29
>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
>>>>>>>>>43 string =NO\ NAME \b, unlabeled
# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
# otherwise FAT is 16 bit.
# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
->>>>>>54 string FAT \b, FAT
->>>>>>>54 string FAT12 \b (12 bit)
->>>>>>>54 string FAT16 \b (16 bit)
+>>>>>82 string/c !fat32
+>>>>>>54 string FAT12 \b, FAT (12 bit)
+>>>>>>54 string FAT16 \b, FAT (16 bit)
+>>>>>>54 default x
+# determinate FAT bit size by media descriptor
+# small floppies implies FAT12
+>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor)
+# with media descriptor F0h floppy or maybe superfloppy with FAT16
+>>>>>>>21 ubyte =0xF0
+# superfloppy (many sectors) implies FAT16
+>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors)
+# no superfloppy with media descriptor F0h implies FAT12
+>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors)
+# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
+>>>>>>>21 ubyte =0xF8
+# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
+>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry)
+# hard disc with FAT12 or FAT16
+>>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
+# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
+>>>>>>>21 ubyte =0xFA
+# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
+>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry)
+# RAM disc with FAT12 or FAT16 or Tandy hard disc
+>>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
+# others are floppy
+>>>>>>>21 default x \b, FAT (12 bit by descriptor)
# FAT32 bit specific
->>>>>82 string FAT32 \b, FAT (32 bit)
+>>>>>82 string/c fat32 \b, FAT (32 bit)
>>>>>>36 ulelong x \b, sectors/FAT %u
# http://technet.microsoft.com/en-us/library/cc977221.aspx
>>>>>>40 uleshort >0 \b, extension flags 0x%x
-#>>>>>>40 uleshort =0 \b, extension flags %u
+#>>>>>>40 uleshort =0 \b, extension flags %hu
>>>>>>42 uleshort >0 \b, fsVersion %u
#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
>>>>>>44 ulelong >2 \b, rootdir cluster %u
>>>>>>48 uleshort >1 \b, infoSector %u
#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
>>>>>>48 uleshort <1 \b, infoSector %u
->>>>>>50 uleshort >6 \b, Backup boot sector %u
+# 0 or 0xFFFF instead of usual 6 means no backup sector
+>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector
+>>>>>>50 uleshort =0 \b, no Backup boot sector
#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
->>>>>>50 uleshort <6 \b, Backup boot sector %u
+>>>>>>50 default x
+>>>>>>>50 uleshort x \b, Backup boot sector %u
# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
>>>>>>52 ulelong >0 \b, reserved1 0x%x
>>>>>>56 ulelong >0 \b, reserved2 0x%x
# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
>>>>>>>>>64 lelong <256
>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
->>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%hhi)
+>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i)
# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
# Values 128 to 255 represent index block sizes of 2^(256-N) byte
>>>>>>>>>68 ulelong <256
>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
->>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%hhi)
+>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i)
>>>>>>>>>72 ulequad x \b, serial number 0%llx
>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
>&-180 lelong x average file size %d,
>&-176 lelong x average number of files in dir %d,
>&-272 lequad x pending blocks to free %lld,
->&-264 lelong x pending inodes to free %ld,
+>&-264 lelong x pending inodes to free %d,
>&-664 lequad x system-wide uuid %0llx,
>&-1316 lelong x minimum percentage of free blocks %d,
>&-1248 lelong 0 TIME optimization
>&-180 lelong x average file size %d,
>&-176 lelong x average number of files in dir %d,
>&-272 lequad x pending blocks to free %lld,
->&-264 lelong x pending inodes to free %ld,
+>&-264 lelong x pending inodes to free %d,
>&-664 lequad x system-wide uuid %0llx,
>&-1316 lelong x minimum percentage of free blocks %d,
>&-1248 lelong 0 TIME optimization
>&-180 belong x average file size %d,
>&-176 belong x average number of files in dir %d,
>&-272 bequad x pending blocks to free %lld,
->&-264 belong x pending inodes to free %ld,
+>&-264 belong x pending inodes to free %d,
>&-664 bequad x system-wide uuid %0llx,
>&-1316 belong x minimum percentage of free blocks %d,
>&-1248 belong 0 TIME optimization
>&-180 belong x average file size %d,
>&-176 belong x average number of files in dir %d,
>&-272 bequad x pending blocks to free %lld,
->&-264 belong x pending inodes to free %ld,
+>&-264 belong x pending inodes to free %d,
>&-664 bequad x system-wide uuid %0llx,
>&-1316 belong x minimum percentage of free blocks %d,
>&-1248 belong 0 TIME optimization
#>>>>>0x162 use 2xDOS-filename
# CDROM Filesystems
+# https://en.wikipedia.org/wiki/ISO_9660
# Modified for UDF by gerardo.cacciari@gmail.com
-32769 string CD001 #
-!:mime application/x-iso9660-image
+32769 string CD001
+# mime line at that position does not work
+# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
+!:strength -11
+# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
+# does not work
+#!:strength +33
>38913 string !NSR0 ISO 9660 CD-ROM filesystem data
+!:mime application/x-iso9660-image
>38913 string NSR0 UDF filesystem data
+!:mime application/x-iso9660-image
>>38917 string 1 (version 1.0)
>>38917 string 2 (version 1.5)
>>38917 string 3 (version 2.0)
# cramfs filesystem - russell@coker.com.au
0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
->4 lelong x size %lu
+>4 lelong x size %u
>8 lelong &1 version #2
>8 lelong &2 sorted_dirs
>8 lelong &4 hole_support
>32 lelong x CRC 0x%x,
->36 lelong x edition %lu,
->40 lelong x %lu blocks,
->44 lelong x %lu files
+>36 lelong x edition %u,
+>40 lelong x %u blocks,
+>44 lelong x %u files
0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
->4 belong x size %lu
+>4 belong x size %u
>8 belong &1 version #2
>8 belong &2 sorted_dirs
>8 belong &4 hole_support
>32 belong x CRC 0x%x,
->36 belong x edition %lu,
->40 belong x %lu blocks,
->44 belong x %lu files
+>36 belong x edition %u,
+>40 belong x %u blocks,
+>44 belong x %u files
# reiserfs - russell@coker.com.au
0x10034 string ReIsErFs ReiserFS V3.5
# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
#
1008 string DECFILE11 Files-11 On-Disk Structure
->525 byte x Level %d
>525 byte x (ODS-%d);
>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
>1017 string B
>16 ulequad >0 \b fblock table at %lld,
>24 ulequad >0 \b inode table at %lld,
>32 ulequad >0 \b root at %lld,
->40 ulelong >0 \b fblock size = %ld,
->44 ulelong >0 \b block size = %ld,
+>40 ulelong >0 \b fblock size = %d,
+>44 ulelong >0 \b block size = %d,
>48 ulequad >0 \b bytes = %lld
# Type: xfs metadump image
# UBIfs
# Linux kernel sources: fs/ubifs/ubifs-media.h
-0 belong 0x31181006
->0x16 short 0 UBIfs image
->0x08 lequad x \b, sequence number %llu
->0x10 leshort x \b, length %u
->0x04 lelong x \b, CRC 0x%08x
-
-0 belong 0x55424923
->0x04 short <2
->0x05 string \0\0\0
->0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
->0x04 short x UBI image, version %u
+0 lelong 0x06101831
+>0x16 leshort 0 UBIfs image
+>0x08 lequad x \b, sequence number %llu
+>0x10 leshort x \b, length %u
+>0x04 lelong x \b, CRC 0x%08x
+
+0 lelong 0x23494255
+>0x04 leshort <2
+>0x05 string \0\0\0
+>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>0x04 leshort x UBI image, version %u
+
+# NEC PC-88 2D disk image
+# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
+0x20 ulelong&0xFFFFFEFF 0x2A0
+>0x10 string \0\0\0\0\0\0\0\0\0\0
+>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+>>>0x1A ubyte&0xEF 0
+>>>>0x1B ubyte&0x8F 0
+>>>>>0x1B ubyte&70 <0x40
+>>>>>>0x1C ulelong >0x21
+>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
+>>>>>>>>0x1B ubyte 0 \b, media=2D
+>>>>>>>>0x1B ubyte 0x10 \b, media=2DD
+>>>>>>>>0x1B ubyte 0x20 \b, media=2HD
+>>>>>>>>0x1B ubyte 0x30 \b, media=1D
+>>>>>>>>0x1B ubyte 0x40 \b, media=1DD
+>>>>>>>>0x1A ubyte 0x10 \b, write-protected
#------------------------------------------------------------------------------
-# $File: flash,v 1.10 2014/03/06 16:07:24 christos Exp $
+# $File: flash,v 1.11 2014/05/02 00:26:49 christos Exp $
# flash: file(1) magic for Macromedia Flash file format
#
# See
# http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
#
-0 string FWS Macromedia Flash data,
->3 byte x version %d
+
+0 name swf-details
+>0 string F Macromedia Flash data
!:mime application/x-shockwave-flash
-0 string CWS Macromedia Flash data (compressed),
+>0 string C Macromedia Flash data (compressed)
!:mime application/x-shockwave-flash
->3 byte x version %d
-0 string ZWS Macromedia Flash data (lzma compressed),
+>0 string Z Macromedia Flash data (lzma compressed)
!:mime application/x-shockwave-flash
->3 byte x version %d
+>3 byte x \b, version %d
+
+1 string WS
+>4 lelong !0
+>>3 byte 255 Suspicious
+>>>0 use swf-details
+
+>>3 ubyte <32
+>>>3 ubyte !0
+>>>>0 use swf-details
+
# From: Cal Peake <cp@absolutedigital.net>
-0 string FLV Macromedia Flash Video
+0 string FLV\x01 Macromedia Flash Video
!:mime video/x-flv
#
#------------------------------------------------------------------------------
-# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $
+# $File: fonts,v 1.27 2014/04/30 21:41:02 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
0 string wOFF Web Open Font Format
>4 belong x \b, flavor %d
>8 belong x \b, length %d
->20 beshort x \b, version %hd
->22 beshort x \b.%hd
+>20 beshort x \b, version %d
+>22 beshort x \b.%d
#------------------------------------------------------------------------------
-# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $
+# $File: fortran,v 1.8 2014/06/03 19:01:34 christos Exp $
# FORTRAN source
-0 regex/100 \^[Cc][\ \t] FORTRAN program
+0 regex/100l \^[Cc][\ \t] FORTRAN program
!:mime text/x-fortran
!:strength - 5
#------------------------------------------------------------------------------
-# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $
+# $File: games,v 1.14 2014/04/30 21:41:02 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
# Quake II - III data files
0 string IDP2 Quake II 3D Model file,
->20 long x %lu skin(s),
->8 long x (%lu x
->12 long x %lu),
->40 long x %lu frame(s),
->16 long x Frame size %lu bytes,
->24 long x %lu vertices/frame,
->28 long x %lu texture coordinates,
->32 long x %lu triangles/frame
+>20 long x %u skin(s),
+>8 long x (%u x
+>12 long x %u),
+>40 long x %u frame(s),
+>16 long x Frame size %u bytes,
+>24 long x %u vertices/frame,
+>28 long x %u texture coordinates,
+>32 long x %u triangles/frame
0 string IBSP Quake
>4 long 0x26 II Map file (BSP)
0 string MComprHD MAME CHD compressed hard disk image,
->12 belong x version %lu
+>12 belong x version %u
# doom - submitted by Jon Dowland
#------------------------------------------------------------------------------
-# $File: gimp,v 1.8 2013/12/21 14:29:45 christos Exp $
+# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $
# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
# by Federico Mena <federico@nuclecu.unam.mx>
>9 string file version 0,
>9 string v version
>>10 string >\0 %s,
->14 belong x %lu x
->18 belong x %lu,
+>14 belong x %u x
+>18 belong x %u,
>22 belong 0 RGB Color
>22 belong 1 Greyscale
>22 belong 2 Indexed Color
#------------------------------------------------------------------------------
-# $File: gnome,v 1.3 2013/02/05 15:20:47 christos Exp $
+# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $
# GNOME related files
# Contributed by Josh Triplett
>&0 ubyte 0 \b, major version 0
>>&0 ubyte 0 \b, minor version 0
>>>&0 ubyte 0 \b, crypto type 0 (AES)
->>>&0 ubyte >0 \b, crypto type %hhu (unknown)
+>>>&0 ubyte >0 \b, crypto type %u (unknown)
>>>&1 ubyte 0 \b, hash type 0 (MD5)
->>>&1 ubyte >0 \b, hash type %hhu (unknown)
+>>>&1 ubyte >0 \b, hash type %u (unknown)
>>>&2 ubelong 0xFFFFFFFF \b, name NULL
>>>&2 ubelong !0xFFFFFFFF
>>>>&-4 ubelong >255 \b, name too long for file's pstring type
#------------------------------------------------------------------------------
-# $File: gpt,v 1.1 2013/02/18 18:31:09 christos Exp $
+# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
0 name gpt-table
>10 uleshort x \b, version %u
>8 uleshort x \b.%u
-# a GUID is just like a UUID, except it's displayed mixed-endian.
>56 ulelong x \b, GUID: %08x
>60 uleshort x \b-%04x
>62 uleshort x \b-%04x
#------------------------------------------------------------------------------
-# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $
+# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $
# graphviz: file(1) magic for http://www.graphviz.org/
# FIXME: These patterns match too generally. For example, the first
# line matches a LaTeX file containing the word "graph" (with a {
# following later) and the second line matches this file.
-#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text
+#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text
#!:mime text/vnd.graphviz
-#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text
+#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text
#!:mime text/vnd.graphviz
#------------------------------------------------------------------------------
-# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $
+# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
#### Old Apollo stuff
0 beshort 0627 Apollo m68k COFF executable
>18 beshort ^040000 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 0624 apollo a88k COFF executable
>18 beshort ^040000 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 long 01203604016 TML 0123 byte-order format
0 long 01702407010 TML 1032 byte-order format
0 long 01003405017 TML 2301 byte-order format
#### 500
0 long 0x02080106 HP s500 relocatable executable
->16 long >0 - version %ld
+>16 long >0 - version %d
0 long 0x02080107 HP s500 executable
->16 long >0 - version %ld
+>16 long >0 - version %d
0 long 0x02080108 HP s500 pure executable
->16 long >0 - version %ld
+>16 long >0 - version %d
#### 200
0 belong 0x020c0108 HP s200 pure executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0107 HP s200 executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c010b HP s200 demand-load executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0106 HP s200 relocatable executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>6 beshort >0 - highwater %d
>8 belong &0x80000000 save fp regs
>8 belong &0x20000000 debuggable
>8 belong &0x10000000 PIC
0 belong 0x020a0108 HP s200 (2.x release) pure executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>36 belong >0 not stripped
0 belong 0x020a0107 HP s200 (2.x release) executable
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>36 belong >0 not stripped
0 belong 0x020c010e HP s200 shared library
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
0 belong 0x020c010d HP s200 dynamic load library
->4 beshort >0 - version %ld
+>4 beshort >0 - version %d
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
0 long 0x015821a6 HP core file
0 long 0x4da7eee8 HP-WINDOWS font
->8 byte >0 - version %ld
+>8 byte >0 - version %d
0 string Bitmapfile HP Bitmapfile
0 string IMGfile CIS compimg HP Bitmapfile
#------------------------------------------------------------------------------
-# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
+# $File: ibm370,v 1.9 2014/04/30 21:41:02 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
>12 belong >0 not stripped
0 beshort 0531 SVR2 executable (Amdahl-UTS)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
0 beshort 0530 SVR2 pure executable (USS/370)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
->24 belong >0 - version %ld
+>24 belong >0 - version %d
#------------------------------------------------------------------------------
-# $File: images,v 1.87 2013/12/11 14:14:20 christos Exp $
+# $File: images,v 1.95 2014/09/22 21:21:59 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
# `tgatoppm' recognizes a superset (Index may be anything)
1 belong&0xfff7ffff 0x01010000 Targa image data - Map
+!:strength + 2
>2 byte&8 8 - RLE
->12 leshort >0 %hd x
->14 leshort >0 %hd
+>12 leshort >0 %d x
+>14 leshort >0 %d
1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
+!:strength + 2
>2 byte&8 8 - RLE
->12 leshort >0 %hd x
->14 leshort >0 %hd
+>12 leshort >0 %d x
+>14 leshort >0 %d
1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
+!:strength + 2
>2 byte&8 8 - RLE
->12 leshort >0 %hd x
->14 leshort >0 %hd
+>12 leshort >0 %d x
+>14 leshort >0 %d
# PBMPLUS images
# The next byte following the magic is always whitespace.
# never changed. The TIFF specification recommends testing for it.
0 string MM\x00\x2a TIFF image data, big-endian
!:mime image/tiff
+>(4.L) use tiff_ifd
0 string II\x2a\x00 TIFF image data, little-endian
!:mime image/tiff
+>(4.l) use tiff_ifd
+
+0 name tiff_ifd
+>0 leshort x \b, direntries=%d
+>2 use tiff_entry
+
+0 name tiff_entry
+>0 leshort 0x100
+>>4 lelong 1
+>>>12 use tiff_entry
+>>>8 lelong x \b, width=%d
+>0 leshort 0x101
+>>4 lelong 1
+>>>8 lelong x \b, height=%d
+>>>12 use tiff_entry
+>0 leshort 0x102
+>>8 lelong x \b, bps=%d
+>>12 use tiff_entry
+>0 leshort 0x103
+>>4 lelong 1 \b, compression=
+>>>8 lelong 1 \bnone
+>>>8 lelong 2 \bhuffman
+>>>8 lelong 3 \bbi-level group 3
+>>>8 lelong 4 \bbi-level group 4
+>>>8 lelong 5 \bLZW
+>>>8 lelong 6 \bJPEG (old)
+>>>8 lelong 7 \bJPEG
+>>>8 lelong 8 \bdeflate
+>>>8 lelong 9 \bJBIG, ITU-T T.85
+>>>8 lelong 0xa \bJBIG, ITU-T T.43
+>>>8 lelong 0x7ffe \bNeXT RLE 2-bit
+>>>8 lelong 0x8005 \bPackBits (Macintosh RLE)
+>>>8 lelong 0x8029 \bThunderscan RLE
+>>>8 lelong 0x807f \bRasterPadding (CT or MP)
+>>>8 lelong 0x8080 \bRLE (Line Work)
+>>>8 lelong 0x8081 \bRLE (High-Res Cont-Tone)
+>>>8 lelong 0x8082 \bRLE (Binary Line Work)
+>>>8 lelong 0x80b2 \bDeflate (PKZIP)
+>>>8 lelong 0x80b3 \bKodak DCS
+>>>8 lelong 0x8765 \bJBIG
+>>>8 lelong 0x8798 \bJPEG2000
+>>>8 lelong 0x8799 \bNikon NEF Compressed
+>>>8 default x
+>>>>8 lelong x \b(unknown 0x%x)
+>>>12 use tiff_entry
+>0 leshort 0x106 \b, PhotometricIntepretation=
+>>8 lelong 0 \bWhiteIsZero
+>>8 lelong 1 \bBlackIsZero
+>>8 lelong 2 \bRGB
+>>8 lelong 3 \bRGB Palette
+>>8 lelong 4 \bTransparency Mask
+>>8 lelong 5 \bCMYK
+>>8 lelong 6 \bYCbCr
+>>8 lelong 8 \bCIELab
+>>>8 lelong x \b(unknown=0x%x)
+>>12 use tiff_entry
+# FillOrder
+>0 leshort 0x10a
+>>4 lelong 1
+>>>12 use tiff_entry
+# DocumentName
+>0 leshort 0x10d
+>>(8.l) string x \b, name=%s
+>>>12 use tiff_entry
+# ImageDescription
+>0 leshort 0x10e
+>>(8.l) string x \b, description=%s
+>>>12 use tiff_entry
+# StripOffsets
+>0 leshort 0x111
+>>12 use tiff_entry
+# NewSubFileType
+>0 leshort 0xfe
+>>12 use tiff_entry
+# Datetime
+>0 leshort 0x132
+>>(8.l) string x \b, datetime=%s
+>>>12 use tiff_entry
+# HostComputer
+>0 leshort 0x13c
+>>(8.l) string x \b, hostcomputer=%s
+>>>12 use tiff_entry
+#>0 leshort x \b, unknown=0x%x
0 string MM\x00\x2b Big TIFF image data, big-endian
!:mime image/tiff
#
0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
!:mime image/png
->16 belong x \b, %ld x
->20 belong x %ld,
+>16 belong x \b, %d x
+>20 belong x %d,
>24 byte x %d-bit
>25 byte 0 grayscale,
>25 byte 2 \b/color RGB,
!:apple 8BIMGIFf
>4 string 7a \b, version 8%s,
>4 string 9a \b, version 8%s,
->6 leshort >0 %hd x
->8 leshort >0 %hd
+>6 leshort >0 %d x
+>8 leshort >0 %d
#>10 byte &0x80 color mapped,
#>10 byte&0x07 =0x00 2 colors
#>10 byte&0x07 =0x01 4 colors
>>>>1 ubyte 3 ver. 2.8 image data, without palette
>>>>1 ubyte 4 for Windows image data
>>>>1 ubyte 5 ver. 3.0 image data
->>>>4 uleshort x bounding box [%hd,
+>>>>4 uleshort x bounding box [%d,
>>>>6 uleshort x %d] -
>>>>8 uleshort x [%d,
>>>>10 uleshort x %d],
# Author: Hans-Joachim Baader <hjb@pro-linux.de>
0 string PaRtImAgE-VoLuMe PartImage
>0x0020 string 0.6.1 file version %s
->>0x0060 lelong >-1 volume %ld
+>>0x0060 lelong >-1 volume %d
#>>0x0064 8 byte identifier
#>>0x007c reserved
>>0x0200 string >\0 type %s
# Kodak Cineon format for scanned negatives
# http://www.kodak.com/US/en/motion/support/dlad/
0 lelong 0xd75f2a80 Cineon image data
->200 belong >0 \b, %ld x
->204 belong >0 %ld
+>200 belong >0 \b, %d x
+>204 belong >0 %d
# Bio-Rad .PIC is an image format used by microscope control systems
14 leshort <2
>62 leshort <2
>>54 leshort 12345 Bio-Rad .PIC Image File
->>>0 leshort >0 %hd x
->>>2 leshort >0 %hd,
+>>>0 leshort >0 %d x
+>>>2 leshort >0 %d,
>>>4 leshort =1 1 image in file
->>>4 leshort >1 %hd images in file
+>>>4 leshort >1 %d images in file
# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
# The description of *.mrw format can be found at
0 string/t [BitmapInfo2] Polar Monitor Bitmap text
!:mime image/x-polar-monitor-bitmap
-# From: Rick Richardson <rick.richardson@comcast.net>
+# From: Rick Richardson <rickrich@gmail.com>
0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file
# Type: Ulead Photo Explorer5 (.pe5)
0 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR)
# WEBP https://developers.google.com/speed/webp/docs/riff_container
-0 string RIFF
->8 string WEBP Web/P image data
->>4 lelong x \b, %d bytes
+#0 string RIFF
+#>8 string WEBP Web/P image data
+#>>4 lelong x \b, %d bytes
+
+# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
+# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
+90 bequad 0x574D50484F544F00 JPEG-XR Image
+>98 byte&0x08 =0x08 \b, hard tiling
+>99 byte&0x80 =0x80 \b, tiling present
+>99 byte&0x40 =0x40 \b, codestream present
+>99 byte&0x38 x \b, spatial xform=
+>99 byte&0x38 0x00 \bTL
+>99 byte&0x38 0x08 \bBL
+>99 byte&0x38 0x10 \bTR
+>99 byte&0x38 0x18 \bBR
+>99 byte&0x38 0x20 \bBT
+>99 byte&0x38 0x28 \bRB
+>99 byte&0x38 0x30 \bLT
+>99 byte&0x38 0x38 \bLB
+>100 byte&0x80 =0x80 \b, short header
+>>102 beshort+1 x \b, %d
+>>104 beshort+1 x \bx%d
+>100 byte&0x80 =0x00 \b, long header
+>>102 belong+1 x \b, %x
+>>106 belong+1 x \bx%x
+>101 beshort&0xf x \b, bitdepth=
+>>101 beshort&0xf 0x0 \b1-WHITE=1
+>>101 beshort&0xf 0x1 \b8
+>>101 beshort&0xf 0x2 \b16
+>>101 beshort&0xf 0x3 \b16-SIGNED
+>>101 beshort&0xf 0x4 \b16-FLOAT
+>>101 beshort&0xf 0x5 \b(reserved 5)
+>>101 beshort&0xf 0x6 \b32-SIGNED
+>>101 beshort&0xf 0x7 \b32-FLOAT
+>>101 beshort&0xf 0x8 \b5
+>>101 beshort&0xf 0x9 \b10
+>>101 beshort&0xf 0xa \b5-6-5
+>>101 beshort&0xf 0xb \b(reserved %d)
+>>101 beshort&0xf 0xc \b(reserved %d)
+>>101 beshort&0xf 0xd \b(reserved %d)
+>>101 beshort&0xf 0xe \b(reserved %d)
+>>101 beshort&0xf 0xf \b1-BLACK=1
+>101 beshort&0xf0 x \b, colorfmt=
+>>101 beshort&0xf0 0x00 \bYONLY
+>>101 beshort&0xf0 0x10 \bYUV240
+>>101 beshort&0xf0 0x20 \bYWV422
+>>101 beshort&0xf0 0x30 \bYWV444
+>>101 beshort&0xf0 0x40 \bCMYK
+>>101 beshort&0xf0 0x50 \bCMYKDIRECT
+>>101 beshort&0xf0 0x60 \bNCOMPONENT
+>>101 beshort&0xf0 0x70 \bRGB
+>>101 beshort&0xf0 0x80 \bRGBE
+>>101 beshort&0xf0 >0x80 \b(reserved 0x%x)
#------------------------------------------------------------------------------
-# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $
+# $File: intel,v 1.12 2014/04/30 21:41:02 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
#
0 leshort 0502 basic-16 executable
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
0 leshort 0503 basic-16 executable (TV)
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
0 leshort 0510 x86 executable
>12 lelong >0 not stripped
0 leshort 0511 x86 executable (TV)
>12 lelong >0 not stripped
0 leshort =0512 iAPX 286 executable small model (COFF)
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
0 leshort =0522 iAPX 286 executable large model (COFF)
>12 lelong >0 not stripped
-#>22 leshort >0 - version %ld
+#>22 leshort >0 - version %d
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514 80386 COFF executable
>12 lelong >0 not stripped
->22 leshort >0 - version %ld
+>22 leshort >0 - version %d
# rom: file(1) magic for BIOS ROM Extensions found in intel machines
# mapped into memory between 0xC0000 and 0xFFFFF
#------------------------------------------------------------------------------
-# $File: isz,v 1.1 2010/03/27 16:17:09 christos Exp $
+# $File: isz,v 1.3 2014/04/30 21:41:02 christos Exp $
# ISO Zipped file format
# http://www.ezbsystems.com/isz/iszspec.txt
0 string IsZ! ISO Zipped file
#------------------------------------------------------------------------------
-# $File: jpeg,v 1.19 2013/02/04 15:50:03 christos Exp $
+# $File: jpeg,v 1.21 2014/09/12 20:47:00 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
>>11 byte x \b %d.
>>12 byte x \b%02d
# Next, the resolution or aspect ratio of the image:
-#>>13 byte 0 \b, aspect ratio
-#>>13 byte 1 \b, resolution (DPI)
-#>>13 byte 2 \b, resolution (DPCM)
-#>>4 beshort x \b, segment length %d
+>>13 byte 0 \b, aspect ratio
+>>13 byte 1 \b, resolution (DPI)
+>>13 byte 2 \b, resolution (DPCM)
+>>14 beshort x \b, density %dx
+>>16 beshort x \b%d
+>>4 beshort x \b, segment length %d
# Next, show thumbnail info, if it exists:
>>18 byte !0 \b, thumbnail %dx
>>>19 byte x \b%d
>>>>>(150.L+59) byte x %c
>>>>>(150.L+60) byte x \b.%c
>>>>>(150.L+61) byte !0x30 \b%c
-# Here things get sticky. We can do ONE MORE marker segment with
-# indirect addressing, and that's all. It would be great if we could
-# do pointer arithemetic like in an assembler language. Christos?
-# And if there was some sort of looping construct to do searches, plus a few
-# named accumulators, it would be even more effective...
-# At least we can show a comment if no other segments got inserted before:
->(4.S+5) byte 0xFE \b, comment:
->>(4.S+6) pstring/HJ x "%s"
-# Or, we can show the encoding type (I've included only the three most common)
-# and image dimensions if we are lucky and the SOFn (image segment) is here:
->(4.S+5) byte 0xC0 \b, baseline
->>(4.S+6) byte x \b, precision %d
->>(4.S+7) beshort x \b, %dx
->>(4.S+9) beshort x \b%d
->(4.S+5) byte 0xC1 \b, extended sequential
->>(4.S+6) byte x \b, precision %d
->>(4.S+7) beshort x \b, %dx
->>(4.S+9) beshort x \b%d
->(4.S+5) byte 0xC2 \b, progressive
->>(4.S+6) byte x \b, precision %d
->>(4.S+7) beshort x \b, %dx
->>(4.S+9) beshort x \b%d
-# I've commented-out quantisation table reporting. I doubt anyone cares yet.
-#>(4.S+5) byte 0xDB \b, quantisation table
-#>>(4.S+6) beshort x \b length=%d
-#>14 beshort x \b, %d x
-#>16 beshort x \b %d
+
+# Jump to the first segment
+>(4.S+4) use jpeg_segment
+
+# This uses recursion...
+0 name jpeg_segment
+>0 beshort 0xFFFE
+>>(2.S+2) use jpeg_segment
+>>2 pstring/HJ x \b, comment: "%s"
+
+>0 beshort 0xFFC0
+>>(2.S+2) use jpeg_segment
+>>4 byte x \b, baseline, precision %d
+>>7 beshort x \b, %dx
+>>5 beshort x \b%d
+>>9 byte x \b, frames %d
+
+>0 beshort 0xFFC1
+>>(2.S+2) use jpeg_segment
+>>4 byte x \b, extended sequential, precision %d
+>>7 beshort x \b, %dx
+>>5 beshort x \b%d
+>>9 byte x \b, frames %d
+
+>0 beshort 0xFFC2
+>>(2.S+2) use jpeg_segment
+>>4 byte x \b, progressive, precision %d
+>>7 beshort x \b, %dx
+>>5 beshort x \b%d
+>>9 byte x \b, frames %d
+
+# Define Huffman Tables
+>0 beshort 0xFFC4
+>>(2.S+2) use jpeg_segment
+
+# Application specific markers
+>0 beshort&0xFFE0 =0xFFE0
+>>(2.S+2) use jpeg_segment
+
+# DB: Define Quantization tables
+# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
+# D8: Start of image
+# D9: End of image
+# Dn: Restart
+>0 beshort&0xFFD0 =0xFFD0
+>>(2.S+2) use jpeg_segment
# HSI is Handmade Software's proprietary JPEG encoding scheme
0 string hsi1 JPEG image data, HSI proprietary
#------------------------------------------------------------------------------
-# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $
+# $File: karma,v 1.7 2014/04/30 21:41:02 christos Exp $
# karma: file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>
0 string KarmaRHD Version Karma Data Structure Version
->16 belong x %lu
+>16 belong x %u
#------------------------------------------------------------------------------
-# $File: linux,v 1.54 2014/03/02 00:01:29 christos Exp $
+# $File: linux,v 1.58 2014/08/04 06:21:30 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
>>0x1042 ubelong x \b-%08x
>>0x1046 ubeshort x \b%04x
+# Linux device tree:
+# File format description can be found in the Linux kernel sources at
+# Documentation/devicetree/booting-without-of.txt
+# From Christoph Biedl
+0 belong 0xd00dfeed
+# structure and strings must be within blob
+>&(8.L) byte x
+>>&(12.L) byte x
+>>>20 belong >1 Device Tree Blob version %d
+>>>>4 belong x \b, size=%d
+>>>>20 belong >1
+>>>>>28 belong x \b, boot CPU=%d
+>>>>20 belong >2
+>>>>>32 belong x \b, string block size=%d
+>>>>20 belong >16
+>>>>>36 belong x \b, DT structure block size=%d
+
+# glibc locale archive as defined in glibc locale/locarchive.h
+0 lelong 0xde020109 locale archive
+>24 lelong x %d strings
#------------------------------------------------------------
-# $File: mach,v 1.17 2013/03/07 02:22:52 christos Exp $
+# $File: mach,v 1.19 2014/04/30 21:41:02 christos Exp $
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file "cafebabe".
>>>4 belong&0x00ffffff 10 vax8650
>>>4 belong&0x00ffffff 11 vax8800
>>>4 belong&0x00ffffff 12 uvaxIII
->>>4 belong&0x00ffffff >12 vax subarchitecture=%ld
+>>>4 belong&0x00ffffff >12 vax subarchitecture=%d
>>0 belong&0x00ffffff 2 romp
>>0 belong&0x00ffffff 3 architecture=3
>>0 belong&0x00ffffff 4 ns32032
>>>>4 belong&0x00fffff0 0x30 pentium_2_m3
>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40
>>>>4 belong&0x00fffff0 0x50 pentium_2_m5
->>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%lx
+>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x
>>>4 belong&0x0000000f 7 celeron
->>>>4 belong&0x00fffff0 0x00 \b_m0x%lx
->>>>4 belong&0x00fffff0 0x10 \b_m0x%lx
->>>>4 belong&0x00fffff0 0x20 \b_m0x%lx
->>>>4 belong&0x00fffff0 0x30 \b_m0x%lx
->>>>4 belong&0x00fffff0 0x40 \b_m0x%lx
->>>>4 belong&0x00fffff0 0x50 \b_m0x%lx
+>>>>4 belong&0x00fffff0 0x00 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x10 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x20 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x30 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x40 \b_m0x%x
+>>>>4 belong&0x00fffff0 0x50 \b_m0x%x
>>>>4 belong&0x00fffff0 0x60
>>>>4 belong&0x00fffff0 0x70 \b_mobile
->>>>4 belong&0x00fffff0 >0x70 \b_m0x%lx
+>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x
>>>4 belong&0x0000000f 8 pentium_3
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_m
>>>>4 belong&0x00fffff0 0x20 \b_xeon
->>>>4 belong&0x00fffff0 >0x20 \b_m0x%lx
+>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x
>>>4 belong&0x0000000f 9 pentiumM
>>>>4 belong&0x00fffff0 0x00
->>>>4 belong&0x00fffff0 >0x00 \b_m0x%lx
+>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x
>>>4 belong&0x0000000f 10 pentium_4
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_m
->>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
+>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
>>>4 belong&0x0000000f 11 itanium
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_2
->>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
+>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
>>>4 belong&0x0000000f 12 xeon
>>>>4 belong&0x00fffff0 0x00
>>>>4 belong&0x00fffff0 0x10 \b_mp
->>>>4 belong&0x00fffff0 >0x10 \b_m0x%lx
->>>4 belong&0x0000000f >12 ia32 family=%ld
+>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x
+>>>4 belong&0x0000000f >12 ia32 family=%d
>>>>4 belong&0x00fffff0 0x00
->>>>4 belong&0x00fffff0 >0x00 model=%lx
+>>>>4 belong&0x00fffff0 >0x00 model=%x
>>0 belong&0x00ffffff 8 mips
>>>4 belong&0x00ffffff 1 R2300
>>>4 belong&0x00ffffff 2 R2600
>>>4 belong&0x00ffffff 5 R2000
>>>4 belong&0x00ffffff 6 R3000a
>>>4 belong&0x00ffffff 7 R3000
->>>4 belong&0x00ffffff >7 subarchitecture=%ld
+>>>4 belong&0x00ffffff >7 subarchitecture=%d
>>0 belong&0x00ffffff 9 ns32532
>>0 belong&0x00ffffff 10 mc98000
>>0 belong&0x00ffffff 11 hppa
>>>4 belong&0x00ffffff 0 7100
>>>4 belong&0x00ffffff 1 7100LC
->>>4 belong&0x00ffffff >1 subarchitecture=%ld
+>>>4 belong&0x00ffffff >1 subarchitecture=%d
>>0 belong&0x00ffffff 12 arm
>>>4 belong&0x00ffffff 0
->>>4 belong&0x00ffffff 1 subarchitecture=%ld
->>>4 belong&0x00ffffff 2 subarchitecture=%ld
->>>4 belong&0x00ffffff 3 subarchitecture=%ld
->>>4 belong&0x00ffffff 4 subarchitecture=%ld
+>>>4 belong&0x00ffffff 1 subarchitecture=%d
+>>>4 belong&0x00ffffff 2 subarchitecture=%d
+>>>4 belong&0x00ffffff 3 subarchitecture=%d
+>>>4 belong&0x00ffffff 4 subarchitecture=%d
>>>4 belong&0x00ffffff 5 \b_v4t
>>>4 belong&0x00ffffff 6 \b_v6
>>>4 belong&0x00ffffff 7 \b_v5tej
>>>4 belong&0x00ffffff 8 \b_xscale
>>>4 belong&0x00ffffff 9 \b_v7
>>>4 belong&0x00ffffff 10 \b_v7f
->>>4 belong&0x00ffffff 11 subarchitecture=%ld
+>>>4 belong&0x00ffffff 11 subarchitecture=%d
>>>4 belong&0x00ffffff 12 \b_v7k
->>>4 belong&0x00ffffff >12 subarchitecture=%ld
+>>>4 belong&0x00ffffff >12 subarchitecture=%d
# 13 m88k
>>0 belong&0x00ffffff 13
>>>4 belong&0x00ffffff 0 mc88000
>>>4 belong&0x00ffffff 1 mc88100
>>>4 belong&0x00ffffff 2 mc88110
->>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%ld
->>0 belong&0x00ffffff 14 sparc
+>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d
+>>0 belong&0x00ffffff 14 SPARC
>>0 belong&0x00ffffff 15 i860g
>>0 belong&0x00ffffff 16 alpha
>>0 belong&0x00ffffff 17 rs6000
>>>4 belong&0x00ffffff 10 \b_7400
>>>4 belong&0x00ffffff 11 \b_7450
>>>4 belong&0x00ffffff 100 \b_970
->>>4 belong&0x00ffffff >100 subarchitecture=%ld
->>0 belong&0x00ffffff >18 architecture=%ld
+>>>4 belong&0x00ffffff >100 subarchitecture=%d
+>>0 belong&0x00ffffff >18 architecture=%d
>0 belong&0x01000000 0x01000000
#
# 64-bit ABIs.
#
->>0 belong&0x00ffffff 0 64-bit architecture=%ld
->>0 belong&0x00ffffff 1 64-bit architecture=%ld
->>0 belong&0x00ffffff 2 64-bit architecture=%ld
->>0 belong&0x00ffffff 3 64-bit architecture=%ld
->>0 belong&0x00ffffff 4 64-bit architecture=%ld
->>0 belong&0x00ffffff 5 64-bit architecture=%ld
->>0 belong&0x00ffffff 6 64-bit architecture=%ld
+>>0 belong&0x00ffffff 0 64-bit architecture=%d
+>>0 belong&0x00ffffff 1 64-bit architecture=%d
+>>0 belong&0x00ffffff 2 64-bit architecture=%d
+>>0 belong&0x00ffffff 3 64-bit architecture=%d
+>>0 belong&0x00ffffff 4 64-bit architecture=%d
+>>0 belong&0x00ffffff 5 64-bit architecture=%d
+>>0 belong&0x00ffffff 6 64-bit architecture=%d
>>0 belong&0x00ffffff 7 x86_64
->>>4 belong&0x00ffffff 0 subarchitecture=%ld
->>>4 belong&0x00ffffff 1 subarchitecture=%ld
->>>4 belong&0x00ffffff 2 subarchitecture=%ld
+>>>4 belong&0x00ffffff 0 subarchitecture=%d
+>>>4 belong&0x00ffffff 1 subarchitecture=%d
+>>>4 belong&0x00ffffff 2 subarchitecture=%d
>>>4 belong&0x00ffffff 3
>>>4 belong&0x00ffffff 4 \b_arch1
->>>4 belong&0x00ffffff >4 subarchitecture=%ld
->>0 belong&0x00ffffff 8 64-bit architecture=%ld
->>0 belong&0x00ffffff 9 64-bit architecture=%ld
->>0 belong&0x00ffffff 10 64-bit architecture=%ld
->>0 belong&0x00ffffff 11 64-bit architecture=%ld
->>0 belong&0x00ffffff 12 64-bit architecture=%ld
->>0 belong&0x00ffffff 13 64-bit architecture=%ld
->>0 belong&0x00ffffff 14 64-bit architecture=%ld
->>0 belong&0x00ffffff 15 64-bit architecture=%ld
->>0 belong&0x00ffffff 16 64-bit architecture=%ld
->>0 belong&0x00ffffff 17 64-bit architecture=%ld
+>>>4 belong&0x00ffffff >4 subarchitecture=%d
+>>0 belong&0x00ffffff 8 64-bit architecture=%d
+>>0 belong&0x00ffffff 9 64-bit architecture=%d
+>>0 belong&0x00ffffff 10 64-bit architecture=%d
+>>0 belong&0x00ffffff 11 64-bit architecture=%d
+>>0 belong&0x00ffffff 12 64-bit architecture=%d
+>>0 belong&0x00ffffff 13 64-bit architecture=%d
+>>0 belong&0x00ffffff 14 64-bit architecture=%d
+>>0 belong&0x00ffffff 15 64-bit architecture=%d
+>>0 belong&0x00ffffff 16 64-bit architecture=%d
+>>0 belong&0x00ffffff 17 64-bit architecture=%d
>>0 belong&0x00ffffff 18 ppc64
>>>4 belong&0x00ffffff 0
>>>4 belong&0x00ffffff 1 \b_601
>>>4 belong&0x00ffffff 10 \b_7400
>>>4 belong&0x00ffffff 11 \b_7450
>>>4 belong&0x00ffffff 100 \b_970
->>>4 belong&0x00ffffff >100 subarchitecture=%ld
->>0 belong&0x00ffffff >18 64-bit architecture=%ld
+>>>4 belong&0x00ffffff >100 subarchitecture=%d
+>>0 belong&0x00ffffff >18 64-bit architecture=%d
0 name mach-o-be
>12 belong 10 dSYM companion file
>12 belong 11 kext bundle
>12 belong >11
->>12 belong x filetype=%ld
+>>12 belong x filetype=%d
#
0 lelong&0xfffffffe 0xfeedface Mach-O
#------------------------------------------------------------------------------
-# $File: macintosh,v 1.23 2013/11/19 18:47:58 christos Exp $
+# $File: macintosh,v 1.25 2014/09/03 13:34:16 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
#>65 string ZSYS (Pre-System 7 system file)
#>65 string acf3 (Aldus FreeHand)
#>65 string cdev (control panel)
-#>65 string dfil (Desk Acessory suitcase)
+#>65 string dfil (Desk Accessory suitcase)
#>65 string libr (library)
#>65 string nX^d (WriteNow word processor)
#>65 string nX^w (WriteNow dictionary)
>0x412 beshort x number of blocks: %d,
>0x424 pstring x volume name: %s
+# *.hfs updated by Joerg Jenderek
+# http://en.wikipedia.org/wiki/Hierarchical_File_System
# "BD" gives many false positives
-#0x400 beshort 0x4244 Macintosh HFS data
-#>0 beshort 0x4C4B (bootable)
-#>0x40a beshort &0x8000 (locked)
-#>0x40a beshort ^0x0100 (mounted)
-#>0x40a beshort &0x0200 (spared blocks)
-#>0x40a beshort &0x0800 (unclean)
-#>0x47C beshort 0x482B (Embedded HFS+ Volume)
-#>0x402 beldate-0x7C25B080 x created: %s,
-#>0x406 beldate-0x7C25B080 x last modified: %s,
-#>0x440 beldate-0x7C25B080 >0 last backup: %s,
-#>0x414 belong x block size: %d,
-#>0x412 beshort x number of blocks: %d,
-#>0x424 pstring x volume name: %s
+0x400 beshort 0x4244
+# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
+# first block of volume bit map (always 3)
+>0x40e ubeshort 0x0003
+# maximal length of volume name is 27
+>>0x424 ubyte <28 Macintosh HFS data
+#!:mime application/octet-stream
+# these mime and apple types are not sure
+!:mime application/x-apple-diskimage
+#!:apple hfsdINIT
+#!:apple MACSdisk
+>>>0 beshort 0x4C4B (bootable)
+#>>>0 beshort 0x0000 (not bootable)
+>>>0x40a beshort &0x8000 (locked)
+>>>0x40a beshort ^0x0100 (mounted)
+>>>0x40a beshort &0x0200 (spared blocks)
+>>>0x40a beshort &0x0800 (unclean)
+>>>0x47C beshort 0x482B (Embedded HFS+ Volume)
+# http://www.epochconverter.com/
+# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970
+# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00
+# construct not working
+#>>>0x402 beldate-0x7C25B080 x created: %s,
+#>>>0x406 beldate-0x7C25B080 x last modified: %s,
+#>>>0x440 beldate-0x7C25B080 >0 last backup: %s,
+# found block sizes 200h,1200h,2800h
+>>>0x414 belong x block size: %d,
+>>>0x412 beshort x number of blocks: %d,
+>>>0x424 pstring x volume name: %s
0x400 beshort 0x482B Macintosh HFS Extended
>&0 beshort x version %d data
>&42 belong x number of blocks: %d,
>&46 belong x free blocks: %d
-# I don't think this is really necessary since it doesn't do much and
-# anything with a valid driver descriptor will also have a valid
-# partition map
-#0 beshort 0x4552 Apple Device Driver data
-#>&24 beshort =1 \b, MacOS
-
-# Is that the partition type a cstring or a pstring? Well, IM says "strings
-# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
-# cstring. Of course, partitions can contain more than four entries, but
-# what're you gonna do?
-# GRR: This magic is too weak, it is just "PM"
-#0x200 beshort 0x504D Apple Partition data
-#>0x2 beshort x (block size: %d):
-#>0x230 string x first type: %s,
-#>0x210 string x name: %s,
-#>0x254 belong x number of blocks: %d,
-#>0x400 beshort 0x504D
-#>>0x430 string x second type: %s,
-#>>0x410 string x name: %s,
-#>>0x454 belong x number of blocks: %d,
-#>>0x600 beshort 0x504D
-#>>>0x630 string x third type: %s,
-#>>>0x610 string x name: %s,
-#>>>0x654 belong x number of blocks: %d,
-#>>0x800 beshort 0x504D
-#>>>0x830 string x fourth type: %s,
-#>>>0x810 string x name: %s,
-#>>>0x854 belong x number of blocks: %d,
-#>>>0xa00 beshort 0x504D
-#>>>>0xa30 string x fifth type: %s,
-#>>>>0xa10 string x name: %s,
-#>>>>0xa54 belong x number of blocks: %d
-#>>>0xc00 beshort 0x504D
-#>>>>0xc30 string x sixth type: %s,
-#>>>>0xc10 string x name: %s,
-#>>>>0xc54 belong x number of blocks: %d
## AFAIK, only the signature is different
+# same as Apple Partition Map
+# GRR: This magic is too weak, it is just "TS"
#0x200 beshort 0x5453 Apple Old Partition data
#>0x2 beshort x block size: %d,
#>0x230 string x first type: %s,
--- /dev/null
+
+
+#------------------------------------------------------------------------------
+# $File: map,v 1.1 2014/06/03 18:22:25 christos Exp $
+# map: file(1) magic for Map data
+#
+
+# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
+8 string .FIT FIT Map data
+>15 byte 0
+>>35 belong x \b, unit id %d
+# 20 years after unix epoch
+>>39 lelong x \b, serial %u
+>>43 ledate/631152000 x \b, %s
+
+>>47 leshort x \b, manufacturer %d
+>>47 leshort 1 \b (garmin)
+>>49 leshort x \b, product %d
+>>53 byte x \b, type %d
+>>53 byte 1 \b (Device)
+>>53 byte 2 \b (Settings)
+>>53 byte 3 \b (Sports/Cycling)
+>>53 byte 4 \b (Activity)
+>>53 byte 8 \b (Elevations)
+>>53 byte 10 \b (Totals)
20 string 45
# leader starts with 5 digits, followed by codes specific to MARC format
->0 regex/1 (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
+>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
!:mime application/marc
->0 regex/1 (^[0-9]{5})[acdnosx][z] MARC21 Authority
+>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
!:mime application/marc
->0 regex/1 (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
+>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
!:mime application/marc
-0 regex/1 (^[0-9]{5})[acdn][w] MARC21 Classification
+0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
!:mime application/marc
->0 regex/1 (^[0-9]{5})[cdn][q] MARC21 Community
+>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
!:mime application/marc
# leader position 22-23, should be "00" but is it?
->0 regex/1 (^.{21})([^0]{2}) (non-conforming)
+>0 regex/1l (^.{21})([^0]{2}) (non-conforming)
!:mime application/marc
#------------------------------------------------------------------------------
-# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $
+# $File: meteorological,v 1.1 2014/08/04 06:26:16 christos Exp $
# rinex: file(1) magic for RINEX files
# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
>>&32 string x \b, date %15.15s
>>5 string x \b, version %6.6s
!:mime rinex/observation
+
+# https://en.wikipedia.org/wiki/GRIB
+0 string GRIB
+>7 byte =1 Gridded binary (GRIB) version 1
+>7 byte =2 Gridded binary (GRIB) version 2
#------------------------------------------------------------------------------
-# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $
+# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
# and DEC Ultrix
#
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x \b.%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x0162 MIPSEL-BE ECOFF executable
>20 beshort 0407 (impure)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
->22 byte x \b.%ld
+>22 byte x \b.%d
#
0 beshort 0x6001 MIPSEB-LE ECOFF executable
>20 beshort 03401 (impure)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
->22 byte x \b.%ld
+>22 byte x \b.%d
#
0 beshort 0x6201 MIPSEL ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x \b.%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
# MIPS 2 additions
#
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x \b.%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x \b.%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x \b.%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x \b.%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
# MIPS 3 additions
#
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x \b.%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
>20 beshort 0407 (impure)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->22 byte x - version %ld
->23 byte x \b.%ld
+>22 byte x - version %d
+>23 byte x \b.%d
#
0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x \b.%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
>20 beshort 03401 (impure)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
->23 byte x - version %ld
->22 byte x \b.%ld
+>23 byte x - version %d
+>22 byte x \b.%d
#
0 beshort 0x180 MIPSEB Ucode
0 beshort 0x182 MIPSEL-BE Ucode
#------------------------------------------------------------------------------
-# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $
+# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
# motorola: file(1) magic for Motorola 68K and 88K binaries
#
# 68K
# not larger than 1 MB (which is a lot on ST).
# The additional 0x601b distinction I took from Doug Lee's magic.
0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
->2 belong x (txt=%ld,
->6 belong x dat=%ld,
->10 belong x bss=%ld,
->14 belong x sym=%ld)
+>2 belong x (txt=%d,
+>6 belong x dat=%d,
+>10 belong x bss=%d,
+>14 belong x sym=%d)
0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
->2 belong x (txt=%ld,
->6 belong x dat=%ld,
->10 belong x bss=%ld,
->14 belong x sym=%ld)
+>2 belong x (txt=%d,
+>6 belong x dat=%d,
+>10 belong x bss=%d,
+>14 belong x sym=%d)
# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
0 beshort 0x601A Atari 68xxx executable,
->2 belong x text len %lu,
->6 belong x data len %lu,
->10 belong x BSS len %lu,
->14 belong x symboltab len %lu,
+>2 belong x text len %u,
+>6 belong x data len %u,
+>10 belong x BSS len %u,
+>14 belong x symboltab len %u,
>18 belong 0
>22 belong &0x01 fastload flag,
>22 belong &0x02 may be loaded to alternate RAM,
>22 belong &0x04 malloc may be from alternate RAM,
->22 belong x flags: 0x%lX,
+>22 belong x flags: 0x%X,
>26 beshort 0 no relocation tab
>26 beshort !0 + relocation tab
>30 string SFX [Self-Extracting LZH SFX archive]
>44 string ZIP! [Self-Extracting ZIP SFX archive]
0 beshort 0x0064 Atari 68xxx CPX file
->8 beshort x (version %04lx)
+>8 beshort x (version %04x)
#------------------------------------------------------------------------------
-# $File: msdos,v 1.92 2014/03/14 18:47:29 christos Exp $
+# $File: msdos,v 1.100 2014/06/03 19:17:27 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
# Maybe it's a PE?
>>(0x3c.l) string PE\0\0 PE
+!:mime application/x-dosexec
>>>(0x3c.l+24) leshort 0x010b \b32 executable
>>>(0x3c.l+24) leshort 0x020b \b32+ executable
>>>(0x3c.l+24) leshort 0x0107 ROM image
# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
# must be one of the unusual subformats.
>>(0x3c.l) string !PE\0\0 MS-DOS executable
+!:mime application/x-dosexec
>>(0x3c.l) string NE \b, NE
+!:mime application/x-dosexec
>>>(0x3c.l+0x36) byte 1 for OS/2 1.x
>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
>>>(0x3c.l+0x36) byte 3 for MS-DOS
>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
>>(0x3c.l) string LX\0\0 \b, LX
+!:mime application/x-dosexec
>>>(0x3c.l+0x0a) leshort <1 (unknown OS)
>>>(0x3c.l+0x0a) leshort 1 for OS/2
>>>(0x3c.l+0x0a) leshort 2 for MS Windows
# MS Windows system file, supposedly a collection of LE executables
>>(0x3c.l) string W3 \b, W3 for MS Windows
+!:mime application/x-dosexec
>>(0x3c.l) string LE\0\0 \b, LE executable
+!:mime application/x-dosexec
>>>(0x3c.l+0x0a) leshort 1
# some DOS extenders use LE files with OS/2 header
>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
# and definitely not NE/LE/LX/PE
>>0x3c lelong >0x20000000
>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
+!:mime application/x-dosexec
# header data too small for extended executable
>2 long !0
>>0x18 leshort <0x40
>>>>&(2.s-514) string !LE
>>>>>&-2 string !BW \b, MZ for MS-DOS
+!:mime application/x-dosexec
>>>>&(2.s-514) string LE \b, LE
>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
# educated guess since indirection is still not capable enough for complex offset
# This sequence skips to the first COFF segment, usually .text
>(4.s*512) leshort 0x014c \b, COFF
+!:mime application/x-dosexec
>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
>>(8.s*16) string emx
>>>&1 string x for DOS, Win or OS/2, emx %s
# they have their real name at offset 22
>>>>>22 string >\0 \b%-.5s
>4 uleshort&0x8000 0x0000
-# 32 bit sector adressing ( > 32 MB) for block devices
+# 32 bit sector addressing ( > 32 MB) for block devices
>>4 uleshort&0x0002 0x0002 \b,32-bit sector-
# support by driver functions 13h, 17h, 18h
>4 uleshort&0x0040 0x0040 \b,IOCTL-
>4 ubyte !0 \b, %d colors
0 belong 0x00000100
-
>9 byte 0
>>0 byte x MS Windows icon resource
!:mime image/x-icon
0 leshort 0x223e9f78 TNEF
!:mime application/vnd.ms-tnef
+# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
+# of http://www.davep.org/norton-guides/ng2h-105.tgz
+# http://en.wikipedia.org/wiki/Norton_Guides
+0 string NG\0\001
+# only value 0x100 found at offset 2
+>2 ulelong 0x00000100 Norton Guide
+# Title[40]
+>>8 string >\0 "%-.40s"
+#>>6 uleshort x \b, MenuCount=%u
+# szCredits[5][66]
+>>48 string >\0 \b, %-.66s
+>>114 string >\0 %-.66s
+
# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of http://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
>40 string \ EMF Windows Enhanced Metafile (EMF) image data
>>44 ulelong x version 0x%x
-# From: Alex Beregszaszi <alex@fsn.hu>
-0 string/b COWD VMWare3
->4 byte 3 disk image
->>32 lelong x (%d/
->>36 lelong x \b%d/
->>40 lelong x \b%d)
->4 byte 2 undoable disk image
->>32 string >\0 (%s)
-
-0 string/b VMDK VMware4 disk image
-0 string/b KDMV VMware4 disk image
-
-#--------------------------------------------------------------------
-# Qemu Emulator Images
-# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
-# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
-# Made by reading sources, reading documentation, and doing trial and error
-# on existing QCOW files
-0 string/b QFI\xFB QEMU QCOW Image
-
-# Uncomment the following line to display Magic (only used for debugging
-# this magic number)
-#>0 string/b x , Magic: %s
-
-# There are currently 2 Versions: "1" and "2".
-# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
->4 belong 1 (v1)
-
-# Using the existence of the Backing File Offset to determine whether
-# to read Backing File Information
->>12 belong >0 \b, has backing file (
-# Note that this isn't a null-terminated string; the length is actually
-# (16.L). Assuming a null-terminated string happens to work usually, but it
-# may spew junk until it reaches a \0 in some cases.
->>>(12.L) string >\0 \bpath %s
-
-# Modification time of the Backing File
-# Really useful if you want to know if your backing
-# file is still usable together with this image
->>>>20 bedate >0 \b, mtime %s)
->>>>20 default x \b)
-
-# Size is stored in bytes in a big-endian u64.
->>24 bequad x \b, %lld bytes
-
-# 1 for AES encryption, 0 for none.
->>36 belong 1 \b, AES-encrypted
-
-# http://www.gnome.org/~markmc/qcow-image-format.html
->4 belong 2 (v2)
-# Using the existence of the Backing File Offset to determine whether
-# to read Backing File Information
->>8 bequad >0 \b, has backing file
-# Note that this isn't a null-terminated string; the length is actually
-# (16.L). Assuming a null-terminated string happens to work usually, but it
-# may spew junk until it reaches a \0 in some cases. Also, since there's no
-# .Q modifier, we just use the bottom four bytes as an offset. Note that if
-# the file is over 4G, and the backing file path is stored after the first 4G,
-# the wrong filename will be printed. (This should be (8.Q), when that syntax
-# is introduced.)
->>>(12.L) string >\0 (path %s)
->>24 bequad x \b, %lld bytes
->>32 belong 1 \b, AES-encrypted
-
->4 belong 3 (v3)
-# Using the existence of the Backing File Offset to determine whether
-# to read Backing File Information
->>8 bequad >0 \b, has backing file
-# Note that this isn't a null-terminated string; the length is actually
-# (16.L). Assuming a null-terminated string happens to work usually, but it
-# may spew junk until it reaches a \0 in some cases. Also, since there's no
-# .Q modifier, we just use the bottom four bytes as an offset. Note that if
-# the file is over 4G, and the backing file path is stored after the first 4G,
-# the wrong filename will be printed. (This should be (8.Q), when that syntax
-# is introduced.)
->>>(12.L) string >\0 (path %s)
->>24 bequad x \b, %lld bytes
->>32 belong 1 \b, AES-encrypted
-
->4 default x (unknown version)
-
-0 string/b QEVM QEMU suspend to disk image
-
-# QEMU QED Image
-# http://wiki.qemu.org/Features/QED/Specification
-0 string/b QED\0 QEMU QED Image
-
-# VDI Image
-64 string/b \x7f\x10\xda\xbe VDI Image
->68 string/b \x01\x00\x01\x00 version 1.1
->0 string >\0 (%s)
->368 lequad x \b, %lld bytes
-
-0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image,
->32 string x type %s,
->48 string x subtype %s
-
-0 lelong 0x02468ace Bochs Sparse disk image
-
# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
# False positive with PPT (also currently this string is too long)
#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
# From: Morten Hustveit <morten@debian.org>
0 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
->16 lelong >0 %hd x
->12 lelong >0 %hd,
+>16 lelong >0 %d x
+>12 lelong >0 %d,
>84 string x %.4s
# Type: Microsoft Document Imaging Format (.mdi)
#------------------------------------------------------------------------------
-# $File: msooxml,v 1.4 2014/01/06 18:16:24 rrt Exp $
+# $File: msooxml,v 1.5 2014/08/05 07:38:45 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
0 string PK\003\004
!:strength +10
# make sure the first file is correct
->0x1E regex \[Content_Types\]\.xml|_rels/\.rels
+>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels
# skip to the second local file header
# since some documents include a 520-byte extra field following the file
# header, we need to scan for the next header
#------------------------------------------------------------------------------
# msx: file(1) magic for the MSX Home Computer
# v1.1
-# Fábio R. Schmidlin <sd-snatcher@users.sourceforge.net>
+# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
############## MSX Music file formats ##############
#-----------------------------------------------------------------------------
-# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $
+# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
# natinst: file(1) magic for National Instruments Code Files
#
0 string RSRC National Instruments,
# Check if it's a LabVIEW File
>8 string LV LabVIEW File,
-# Check wich kind of file is
+# Check which kind of file it is
>>10 string SB Code Resource File, data
>>10 string IN Virtual Instrument Program, data
>>10 string AR VI Library, data
#------------------------------------------------------------------------------
-# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $
+# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
# ncr: file(1) magic for NCR Tower objects
#
# contributed by
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000615 Tower/XP rel 2 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000620 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000625 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000630 Tower32/600/400 68020 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000640 Tower32/800 68020
>18 beshort &020000 w/68881 object
>18 beshort &040000 compatible object
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
0 beshort 000645 Tower32/800 68010
>18 beshort &040000 compatible object
>18 beshort &060000 object
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
->22 beshort >0 - version %ld
+>22 beshort >0 - version %d
#------------------------------------------------------------------------------
-# $File: netbsd,v 1.20 2013/01/09 22:37:24 christos Exp $
+# $File: netbsd,v 1.21 2014/03/29 15:40:34 christos Exp $
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
0 belong&0377777777 045200507 a.out NetBSD/powerpc core
>12 string >\0 from '%s'
-0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
+0 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&0377777777 042400410 a.out NetBSD/sparc pure
+0 belong&0377777777 042400410 a.out NetBSD/SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&0377777777 042400407 a.out NetBSD/sparc
+0 belong&0377777777 042400407 a.out NetBSD/SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
-0 belong&0377777777 042400507 a.out NetBSD/sparc core
+0 belong&0377777777 042400507 a.out NetBSD/SPARC core
>12 string >\0 from '%s'
>32 belong !0 (signal %d)
>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages)
>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages)
>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD
->0 belong&0x03ff0000 0x008a0000 \b, sparc/32 BSD
+>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD
>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD
>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages)
>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD
>0 belong&0x03ff0000 0x00950000 \b, mips2 BSD
>0 belong&0x03ff0000 0x00960000 \b, parisc BSD
>0 belong&0x03ff0000 0x00970000 \b, sh5/64 BSD
->0 belong&0x03ff0000 0x00980000 \b, sparc/64 BSD
+>0 belong&0x03ff0000 0x00980000 \b, SPARC/64 BSD
>0 belong&0x03ff0000 0x00990000 \b, amd64 BSD
>0 belong&0x03ff0000 0x009a0000 \b, hp200 (68010) BSD
>0 belong&0x03ff0000 0x009b0000 \b, hp300 (68020+68881) BSD
#------------------------------------------------------------------------------
-# $File: nitpicker,v 1.4 2009/09/19 16:28:11 christos Exp $
+# $File: nitpicker,v 1.6 2014/04/30 21:41:02 christos Exp $
# nitpicker: file(1) magic for Flowfiles.
# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
0 string NPFF NItpicker Flow File
#------------------------------------------------------------------------------
-# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $
+# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
# OASIS
# Summary: OASIS stream file
-# Long descripton: Open Artwork System Interchange Standard
+# Long description: Open Artwork System Interchange Standard
# File extension: .oas
# Full name: Ben Cowley (bcowley@broadcom.com)
# Philip Dixon (pdixon@broadcom.com)
#------------------------------------------------------------------------------
-# $File: palm,v 1.11 2013/12/31 19:18:02 christos Exp $
+# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $
# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
#
# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
>>(0x4E.L+1) byte x %02d)
# Palm OS .prc file types
-60 string libr Palm OS dynamic library data
->0 string >\0 "%s"
+60 string libr
+# flags, only bit 0 or bit 6
+# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
+# http://web.mit.edu/tytso/www/pilot/prc-format.html
+>0x20 beshort&0xffbe 0
+>>0 string >\0 Palm OS dynamic library data "%s"
60 string ptch Palm OS operating system patch data
>0 string >\0 "%s"
#------------------------------------------------------------------------------
-# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $
+# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $
# pascal: file(1) magic for Pascal source
#
0 search/8192 (input, Pascal source text
!:mime text/x-pascal
-0 regex \^program Pascal source text
-!:mime text/x-pascal
-0 regex \^record Pascal source text
-!:mime text/x-pascal
+#0 regex \^program Pascal source text
+#!:mime text/x-pascal
+#0 regex \^record Pascal source text
+#!:mime text/x-pascal
#------------------------------------------------------------------------------
-# $File: pdp,v 1.9 2013/04/19 20:11:43 christos Exp $
+# $File: pdp,v 1.10 2014/04/30 21:41:02 christos Exp $
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
#
0 leshort 0407 PDP-11 executable
>8 leshort >0 not stripped
->15 byte >0 - version %ld
+>15 byte >0 - version %d
# updated by Joerg Jenderek at Mar 2013
# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
0 leshort 0410 PDP-11 pure executable
>8 leshort >0 not stripped
->15 byte >0 - version %ld
+>15 byte >0 - version %d
0 leshort 0411 PDP-11 separate I&D executable
>8 leshort >0 not stripped
->15 byte >0 - version %ld
+>15 byte >0 - version %d
0 leshort 0437 PDP-11 kernel overlay
#------------------------------------------------------------------------------
-# $File: perl,v 1.21 2013/12/08 23:33:18 christos Exp $
+# $File: perl,v 1.22 2014/04/28 12:04:35 christos Exp $
# perl: file(1) magic for Larry Wall's perl language.
#
# The `eval' lines recognizes an outrageously clever hack.
>>4 byte =5 (major 2)
>>4 byte =4 (major 2)
>>5 byte >0 (minor %d)
+
+# This is Debian #742949 by Zefram <zefram@fysh.org>:
+# -----------------------------------------------------------
+# The Perl module Hash::SharedMem
+# <https://metacpan.org/release/Hash-SharedMem> defines a file format
+# for a key/value store. Details of the file format are in the "DESIGN"
+# file in the module distribution. Magic:
+0 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian
+>8 bequad <0x1000000
+>>15 byte >2 \b, line size 2^%d byte
+>>14 byte >2 \b, page size 2^%d byte
+>>13 byte &1
+>>>13 byte >1 \b, max fanout %d
+0 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian
+>8 lequad <0x1000000
+>>8 byte >2 \b, line size 2^%d byte
+>>9 byte >2 \b, page size 2^%d byte
+>>10 byte &1
+>>>10 byte >1 \b, max fanout %d
+0 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian
+>8 bequad <0x1000000
+>>15 byte >2 \b, line size 2^%d byte
+>>14 byte >2 \b, page size 2^%d byte
+>>13 byte &1
+>>>13 byte >1 \b, max fanout %d
+0 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian
+>8 lequad <0x1000000
+>>8 byte >2 \b, line size 2^%d byte
+>>9 byte >2 \b, page size 2^%d byte
+>>10 byte &1
+>>>10 byte >1 \b, max fanout %d
#------------------------------------------------------------------------------
-# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $
+# $File: printer,v 1.26 2014/04/12 14:51:52 christos Exp $
# printer: file(1) magic for printer-formatted files
#
0 string \033%-12345X@PJL
>&0 search/10000 %! PJL encapsulated PostScript document text
+# Rick Richardson <rickrich@gmail.com>
+
+# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
+# For Oki Data Printers - HIPERC
+# For Konica Minolta Printers - LAVAFLOW
+# For Samsung Printers - QPDL
+# For HP Printers - ZJS stands for Zenographics ZJStream
+0 string \033%-12345X@PJL HP Printer Job Language data
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL
+>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL
+>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS
+
+
# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0 string \033E\033 HP PCL printer data
>3 string \&l0A - default page size
#------------------------------------------------------------------------------
# zenographics: file(1) magic for Zenographics ZjStream printer data
-# Rick Richardson rickr@mn.rr.com
+# Rick Richardson <rickrich@gmail.com>
0 string JZJZ
>0x12 string ZZ Zenographics ZjStream printer data (big-endian)
0 string ZJZJ
#------------------------------------------------------------------------------
# Oak Technologies printer stream
-# Rick Richardson <rickr@mn.rr.com>
+# Rick Richardson <rickrich@gmail.com>
0 string OAK
>0x07 byte 0
>0x0b byte 0 Oak Technologies printer stream
#------------------------------------------------------------------------------
-# $File: python,v 1.24 2014/02/15 01:30:52 christos Exp $
+# $File: python,v 1.26 2014/08/04 05:58:40 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
0 belong 0x4f0c0d0a python 3.1 byte-compiled
0 belong 0x6c0c0d0a python 3.2 byte-compiled
0 belong 0x9e0c0d0a python 3.3 byte-compiled
+0 belong 0xee0c0d0a python 3.4 byte-compiled
0 search/1/w #!\ /usr/bin/python Python script text executable
!:mime text/x-python
# def name(args, args):
0 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
->&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,500}\\):$ Python script text executable
+>&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
!:mime text/x-python
#------------------------------------------------------------------------------
-# $File: riff,v 1.26 2014/03/06 18:55:09 christos Exp $
+# $File: riff,v 1.30 2014/09/23 17:02:12 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
>>&(4.l+4) use riff-walk
>0 string fact
>>&(4.l+4) use riff-walk
+>0 string VP8
+>>11 byte 0x9d
+>>>12 byte 0x01
+>>>>13 byte 0x2a \b, VP8 encoding
+>>>>>14 leshort&0x3fff x \b, %d
+>>>>>16 leshort&0x3fff x \bx%d, Scaling:
+>>>>>14 leshort&0xc000 0x0000 \b [none]
+>>>>>14 leshort&0xc000 0x1000 \b [5/4]
+>>>>>14 leshort&0xc000 0x2000 \b [5/3]
+>>>>>14 leshort&0xc000 0x3000 \b [2]
+>>>>>14 leshort&0xc000 0x0000 \bx[none]
+>>>>>14 leshort&0xc000 0x1000 \bx[5/4]
+>>>>>14 leshort&0xc000 0x2000 \bx[5/3]
+>>>>>14 leshort&0xc000 0x3000 \bx[2]
+>>>>>15 byte&0x80 =0x00 \b, YUV color
+>>>>>15 byte&0x80 =0x80 \b, bad color specification
+>>>>>15 byte&0x40 =0x40 \b, no clamping required
+>>>>>15 byte&0x40 =0x00 \b, decoders should clamp
+#>0 string x we got %s
+#>>&(4.l+4) use riff-walk
# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
#
!:mime video/x-msvideo
>>12 string LIST
>>>20 string hdrlavih
->>>>&36 lelong x \b, %lu x
->>>>&40 lelong x %lu,
+>>>>&36 lelong x \b, %u x
+>>>>&40 lelong x %u,
>>>>&4 lelong >1000000 <1 fps,
>>>>&4 lelong 1000000 1.00 fps,
>>>>&4 lelong 500000 2.00 fps,
>8 string 4XMV \b, 4X Movie file
# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
>8 string AMV\040 \b, AMV
+>8 string WEBP \b, Web/P image
+>>12 use riff-walk
#
# XXX - some of the below may only appear in little-endian form.
>>&6 leshort =2 \b, stereo
>>&6 leshort >2 \b, %d channels
>>&8 lelong >0 %d Hz
-
#------------------------------------------------------------------------------
-# $File: scientific,v 1.8 2014/01/06 17:46:23 rrt Exp $
+# $File: scientific,v 1.9 2014/06/03 19:01:34 christos Exp $
# scientific: file(1) magic for scientific formats
#
# From: Joe Krahn <krahn@niehs.nih.gov>
# uppercase letters. However, examples have been seen without the date string,
# e.g., the example on the chemime site.
0 string HEADER\ \ \ \
->&0 regex/1 \^.{40}
->>&0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
->>>&0 regex/1s [A-Z0-9]{4}.{14}$
->>>>&0 regex/1 [A-Z0-9]{4} Protein Data Bank data, ID Code %s
+>&0 regex/1l \^.{40}
+>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
+>>>&0 regex/1ls [A-Z0-9]{4}.{14}$
+>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s
!:mime chemical/x-pdb
->>>>0 regex/1 [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s
+>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s
# Type: GDSII Stream file
0 belong 0x00060002 GDSII Stream file
#------------------------------------------------------------------------------
-# $File: sequent,v 1.8 2009/09/19 16:28:12 christos Exp $
+# $File: sequent,v 1.12 2014/08/16 16:07:12 christos Exp $
# sequent: file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0 lelong 0x00ea BALANCE NS32000 .o
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 lelong 0x30ea BALANCE NS32000 standalone executable
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0 leshort 0x12eb SYMMETRY i386 .o
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
>16 lelong >0 not stripped
->124 lelong >0 version %ld
-0 leshort 0x42eb SYMMETRY i386 standalone executable
->16 lelong >0 not stripped
->124 lelong >0 version %ld
+>124 lelong >0 version %d
+# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
+# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
+#0 leshort 0x42eb SYMMETRY i386 standalone executable
+0 leshort 0x42eb
+# skip unlike negative version
+>124 lelong >-1
+# assuming version 28867614 is very low probable
+>>124 lelong !28867614 SYMMETRY i386 standalone executable
+>>>16 lelong >0 not stripped
+>>>124 lelong >0 version %d
--- /dev/null
+#------------------------------------------------------------------------------
+# $File: sereal,v 1.1 2014/05/14 23:04:59 christos Exp $
+# sereal: file(1) magic the Sereal binary serialization format
+#
+# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
+#
+# See the specification of the format at
+# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
+#
+# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
+# doing (byte&0xF0)>>4 here, but unfortunately that's not
+# supported. So when we print out a message about an unknown format
+# we'll print out e.g. 0x30 instead of the more human-readable
+# 0x30>>4.
+#
+# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
+# Sereal.git repository for test Sereal data.
+0 string \=srl Sereal data
+!:mime application/sereal
+>4 byte&0x0F x (version %d,
+>4 byte&0xF0 0x00 uncompressed)
+>4 byte&0xF0 0x10 compressed with non-incremental Snappy)
+>4 byte&0xF0 0x20 compressed with incremental Snappy)
+>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4)
#------------------------------------------------------------------------------
-# $File: sgi,v 1.20 2014/03/10 00:53:38 christos Exp $
+# $File: sgi,v 1.21 2014/04/30 21:41:02 christos Exp $
# sgi: file(1) magic for Silicon Graphics operating systems and applications
#
# Executable images are handled either in aout (for old-style a.out
0 beshort 0x0506 IRIS Showcase file
>2 byte 0x49 -
->3 byte x - version %ld
+>3 byte x - version %d
0 beshort 0x0226 IRIS Showcase template
>2 byte 0x63 -
->3 byte x - version %ld
+>3 byte x - version %d
0 belong 0x5343464d IRIS Showcase file
->4 byte x - version %ld
+>4 byte x - version %d
0 belong 0x5443464d IRIS Showcase template
->4 byte x - version %ld
+>4 byte x - version %d
0 belong 0xdeadbabe IRIX Parallel Arena
->8 belong >0 - version %ld
+>8 belong >0 - version %d
# core files
#
# Trusted IRIX info
0 string SGIAUDIT SGI Audit file
>8 byte x - version %d
->9 byte x \b.%ld
+>9 byte x \b.%d
#
0 string WNGZWZSC Wingz compiled script
0 string WNGZWZSS Wingz spreadsheet
#>20 lelong -2 temporal index
#>20 lelong -1 metadata
#>20 lelong 0 log volume #0
-#>20 lelong >0 log volume #%ld
+#>20 lelong >0 log volume #%d
>20 belong -2 temporal index
>20 belong -1 metadata
>20 belong 0 log volume #0
->20 belong >0 log volume #%ld
+>20 belong >0 log volume #%d
>24 string >\0 host: %s
0 string PCPFolio PCP
>9 string Version: Archive Folio
#------------------------------------------------------------------------
-# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: sharc,v 1.7 2014/04/30 21:41:02 christos Exp $
# file(1) magic for sharc files
#
# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
0 string .system SHARC architecture file
0 leshort 0x521C SHARC COFF binary
->2 leshort >1 , %hd sections
+>2 leshort >1 , %d sections
>>12 lelong >0 , not stripped
#------------------------------------------------------------------------------
-# $File: sql,v 1.13 2013/08/27 04:02:33 christos Exp $
+# $File: sql,v 1.15 2014/04/30 21:41:02 christos Exp $
# sql: file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
# SQLite Write-Ahead Log from SQLite version >= 3.7.0
# http://www.sqlite.org/fileformat.html#walformat
0 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log,
->4 belong x version %ld
+>4 belong x version %d
# SQLite Rollback Journal
# http://www.sqlite.org/fileformat.html#rollbackjournal
#------------------------------------------------------------------------------
-# $File: sun,v 1.25 2013/01/09 22:37:24 christos Exp $
+# $File: sun,v 1.27 2014/04/30 21:41:02 christos Exp $
# sun: file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# are in aout, as they're indistinguishable from other big-endian
# 32-bit a.out files.
#
-0 belong&077777777 0600413 a.out SunOS sparc demand paged
+0 belong&077777777 0600413 a.out SunOS SPARC demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0600410 a.out SunOS sparc pure
+0 belong&077777777 0600410 a.out SunOS SPARC pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
-0 belong&077777777 0600407 a.out SunOS sparc
+0 belong&077777777 0600407 a.out SunOS SPARC
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
# which is the IANA registry of Snoop datalink types)
#
0 string snoop Snoop capture file
->8 belong >0 - version %ld
+>8 belong >0 - version %d
>12 belong 0 (IEEE 802.3)
>12 belong 1 (IEEE 802.4)
>12 belong 2 (IEEE 802.5)
>12 belong 7 (IBM channel-to-channel adapter)
>12 belong 8 (FDDI)
>12 belong 9 (Other)
->12 belong 10 (type %ld)
->12 belong 11 (type %ld)
->12 belong 12 (type %ld)
->12 belong 13 (type %ld)
->12 belong 14 (type %ld)
->12 belong 15 (type %ld)
+>12 belong 10 (type %d)
+>12 belong 11 (type %d)
+>12 belong 12 (type %d)
+>12 belong 13 (type %d)
+>12 belong 14 (type %d)
+>12 belong 15 (type %d)
>12 belong 16 (Fibre Channel)
>12 belong 17 (ATM)
>12 belong 18 (ATM Classical IP)
->12 belong 19 (type %ld)
->12 belong 20 (type %ld)
->12 belong 21 (type %ld)
->12 belong 22 (type %ld)
->12 belong 23 (type %ld)
->12 belong 24 (type %ld)
->12 belong 25 (type %ld)
+>12 belong 19 (type %d)
+>12 belong 20 (type %d)
+>12 belong 21 (type %d)
+>12 belong 22 (type %d)
+>12 belong 23 (type %d)
+>12 belong 24 (type %d)
+>12 belong 25 (type %d)
>12 belong 26 (IP over Infiniband)
->12 belong >26 (type %ld)
+>12 belong >26 (type %d)
#---------------------------------------------------------------------------
# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
#------------------------------------------------------------------------------
# msx: file(1) magic for the SymbOS operating system
# http://www.symbos.de
-# Fábio R. Schmidlin <frs@pop.com.br>
+# Fabio R. Schmidlin <frs@pop.com.br>
# SymbOS EXE file
0x30 string SymExe SymbOS executable
#------------------------------------------------------------------------
-# $File: sysex,v 1.7 2013/09/16 15:12:42 christos Exp $
+# $File: sysex,v 1.8 2014/06/03 19:17:27 christos Exp $
# sysex: file(1) magic for MIDI sysex files
#
-# GRR: orginal 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
+# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
# where real SYStem EXclusive messages at offset 1 are limited to seven bits
# http://en.wikipedia.org/wiki/MIDI
0 ubeshort&0xFF80 0xF000 SysEx File -
#------------------------------------------------------------------------------
-# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $
# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
#
# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
>49 byte 0x24 type: application,
>49 byte 0x25 type: certificate,
>49 byte 0x3e type: license,
->74 lelong >0 size: %ld bytes
+>74 lelong >0 size: %d bytes
# VTi & TiEmu skins (TI Graphing Calculators).
# From: Romain Lievin (roms@lpg.ticalc.org).
#------------------------------------------------------------------------------
-# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $
+# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $
# troff: file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
!:mime text/troff
0 search/1 ''' troff or preprocessor input text
!:mime text/troff
-0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text
+0 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text
!:mime text/troff
-0 regex/20 \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text
+0 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text
!:mime text/troff
# ditroff intermediate output text
#------------------------------------------------------------------------------
-# $File: uterus,v 1.1 2012/12/18 18:53:32 christos Exp $
+# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
# file(1) magic for uterus files
# http://freecode.com/projects/uterus
#
#------------------------------------------------------------------------------
-# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $
+# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
# varied.out: file(1) magic for various USG systems
#
# Herewith many of the object file formats used by USG systems.
>7 string >\0 version '%s'
# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
0 string gmon GNU prof performance data
->4 long x - version %ld
+>4 long x - version %d
# From: Dave Pearson <davep@davep.org>
# Harbour <URL:http://harbour-project.org/> HRB files.
0 string \xc0HRB Harbour HRB file
#------------------------------------------------------------------------------
-# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $
+# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $
# vax: file(1) magic for VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
#
0 leshort 0570 VAX COFF executable
>12 lelong >0 not stripped
->22 leshort >0 - version %ld
+>22 leshort >0 - version %d
0 leshort 0575 VAX COFF pure executable
>12 lelong >0 not stripped
->22 leshort >0 - version %ld
+>22 leshort >0 - version %d
#------------------------------------------------------------------------------
-# $File: virtual,v 1.3 2014/03/03 14:19:46 christos Exp $
+# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $
# From: James Nobis <quel@quelrod.net>
# Microsoft hard disk images for:
# Virtual Server
# .vhd
0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
-# Sun xVM VirtualBox Disk Image
-# From: Richard W.M. Jones <rich@annexia.org>
-# VirtualBox Disk Image
-0x40 ulelong 0xbeda107f VirtualBox Disk Image
->0x44 uleshort >0 \b, major %u
->0x46 uleshort >0 \b, minor %u
-
# libvirt
# From: Philipp Hahn <hahn@univention.de>
0 string LibvirtQemudSave Libvirt QEMU Suspend Image
>0x1c lelong 1 \b, compressed
0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image
+# From: Alex Beregszaszi <alex@fsn.hu>
+0 string/b COWD VMWare3
+>4 byte 3 disk image
+>>32 lelong x (%d/
+>>36 lelong x \b%d/
+>>40 lelong x \b%d)
+>4 byte 2 undoable disk image
+>>32 string >\0 (%s)
+
+0 string/b VMDK VMware4 disk image
+0 string/b KDMV VMware4 disk image
+
+#--------------------------------------------------------------------
+# Qemu Emulator Images
+# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
+# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
+# Made by reading sources, reading documentation, and doing trial and error
+# on existing QCOW files
+0 string/b QFI\xFB QEMU QCOW Image
+
+# Uncomment the following line to display Magic (only used for debugging
+# this magic number)
+#>0 string/b x , Magic: %s
+
+# There are currently 2 Versions: "1" and "2".
+# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
+>4 belong 1 (v1)
+
+# Using the existence of the Backing File Offset to determine whether
+# to read Backing File Information
+>>12 belong >0 \b, has backing file (
+# Note that this isn't a null-terminated string; the length is actually
+# (16.L). Assuming a null-terminated string happens to work usually, but it
+# may spew junk until it reaches a \0 in some cases.
+>>>(12.L) string >\0 \bpath %s
+
+# Modification time of the Backing File
+# Really useful if you want to know if your backing
+# file is still usable together with this image
+>>>>20 bedate >0 \b, mtime %s)
+>>>>20 default x \b)
+
+# Size is stored in bytes in a big-endian u64.
+>>24 bequad x \b, %lld bytes
+
+# 1 for AES encryption, 0 for none.
+>>36 belong 1 \b, AES-encrypted
+
+# http://www.gnome.org/~markmc/qcow-image-format.html
+>4 belong 2 (v2)
+# Using the existence of the Backing File Offset to determine whether
+# to read Backing File Information
+>>8 bequad >0 \b, has backing file
+# Note that this isn't a null-terminated string; the length is actually
+# (16.L). Assuming a null-terminated string happens to work usually, but it
+# may spew junk until it reaches a \0 in some cases. Also, since there's no
+# .Q modifier, we just use the bottom four bytes as an offset. Note that if
+# the file is over 4G, and the backing file path is stored after the first 4G,
+# the wrong filename will be printed. (This should be (8.Q), when that syntax
+# is introduced.)
+>>>(12.L) string >\0 (path %s)
+>>24 bequad x \b, %lld bytes
+>>32 belong 1 \b, AES-encrypted
+
+>4 belong 3 (v3)
+# Using the existence of the Backing File Offset to determine whether
+# to read Backing File Information
+>>8 bequad >0 \b, has backing file
+# Note that this isn't a null-terminated string; the length is actually
+# (16.L). Assuming a null-terminated string happens to work usually, but it
+# may spew junk until it reaches a \0 in some cases. Also, since there's no
+# .Q modifier, we just use the bottom four bytes as an offset. Note that if
+# the file is over 4G, and the backing file path is stored after the first 4G,
+# the wrong filename will be printed. (This should be (8.Q), when that syntax
+# is introduced.)
+>>>(12.L) string >\0 (path %s)
+>>24 bequad x \b, %lld bytes
+>>32 belong 1 \b, AES-encrypted
+
+>4 default x (unknown version)
+
+0 string/b QEVM QEMU suspend to disk image
+
+# QEMU QED Image
+# http://wiki.qemu.org/Features/QED/Specification
+0 string/b QED\0 QEMU QED Image
+
+# VDI Image
+# Sun xVM VirtualBox Disk Image
+# From: Richard W.M. Jones <rich@annexia.org>
+# VirtualBox Disk Image
+0x40 ulelong 0xbeda107f VirtualBox Disk Image
+>0x44 uleshort >0 \b, major %u
+>0x46 uleshort >0 \b, minor %u
+>0 string >\0 (%s)
+>368 lequad x \b, %lld bytes
+
+0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image,
+>32 string x type %s,
+>48 string x subtype %s
+
+0 lelong 0x02468ace Bochs Sparse disk image
+
#------------------------------------------------------------------------------
-# $File: vms,v 1.7 2013/03/09 22:36:00 christos Exp $
+# $File: vms,v 1.9 2014/08/17 13:47:59 christos Exp $
# vms: file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
#------------------------------------------------------------------------------
-# $File: vorbis,v 1.16 2009/09/19 16:28:13 christos Exp $
+# $File: vorbis,v 1.20 2014/09/23 16:35:08 christos Exp $
# vorbis: file(1) magic for Ogg/Vorbis files
#
# From Felix von Leitner <leitner@fefe.de>
# --- Ogg Framing ---
#0 search/1000 OggS Ogg data
0 string OggS Ogg data
-!:mime application/ogg
>4 byte !0 UNKNOWN REVISION %u
##>4 byte 0 revision 0
>4 byte 0
# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
>>28 string \x7fFLAC \b, FLAC audio
# non-Vorbis content: Theora
+!:mime audio/ogg
>>28 string \x80theora \b, Theora video
+!:mime video/ogg
# non-Vorbis content: Kate
->>28 string \x80kate\0\0\0\0 \b, Kate
+>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text)
+!:mime application/ogg
>>>37 ubyte x v%u
>>>38 ubyte x \b.%u,
>>>40 byte 0 utf8 encoding,
>>>76 string \0 no category set
# non-Vorbis content: Skeleton
>>28 string fishead\0 \b, Skeleton
+!:mime video/ogg
>>>36 short x v%u
>>>40 short x \b.%u
# non-Vorbis content: Speex
>>28 string Speex\ \ \ \b, Speex audio
+!:mime audio/ogg
# non-Vorbis content: OGM
>>28 string \x01video\0\0\0 \b, OGM video
+!:mime video/ogg
>>>37 string/c div3 (DivX 3)
>>>37 string/c divx (DivX 4)
>>>37 string/c dx50 (DivX 5)
>>>37 string/c xvid (XviD)
# --- First vorbis packet - general header ---
>>28 string \x01vorbis \b, Vorbis audio,
->>>35 lelong !0 UNKNOWN VERSION %lu,
+!:mime audio/ogg
+>>>35 lelong !0 UNKNOWN VERSION %u,
##>>>35 lelong 0 version 0,
>>>35 lelong 0
>>>>39 ubyte 1 mono,
>>>>39 ubyte 2 stereo,
>>>>39 ubyte >2 %u channels,
->>>>40 lelong x %lu Hz
+>>>>40 lelong x %u Hz
# Minimal, nominal and maximal bitrates specified when encoding
>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
# The above tests if at least one of these is specified:
# Vorbis 1.0 uses 0 instead of -1.
>>>>>>52 lelong !0
>>>>>>>52 lelong !-1000
->>>>>>>>52 lelong x <%lu
+>>>>>>>>52 lelong x <%u
>>>>>48 lelong !-1
->>>>>>48 lelong x ~%lu
+>>>>>>48 lelong x ~%u
>>>>>44 lelong !-1
>>>>>>44 lelong !-1000
>>>>>>>44 lelong !0
->>>>>>>>44 lelong x >%lu
+>>>>>>>>44 lelong x >%u
>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
# -- Second vorbis header packet - the comments
# A kludge to read the vendor string. It's a counted string, not a
#------------------------------------------------------------------------------
-# $File: windows,v 1.6 2013/04/19 20:12:29 christos Exp $
+# $File: windows,v 1.10 2014/09/24 19:52:46 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
>>0xf88 lelong 1 \b, full dump
>>0xf88 lelong 2 \b, kernel dump
>>0xf88 lelong 3 \b, small dump
->>0x068 lelong x \b, %ld pages
+>>0x068 lelong x \b, %d pages
>4 string DU64 MS Windows 64bit crash dump
>>0xf98 lelong 1 \b, full dump
>>0xf98 lelong 2 \b, kernel dump
>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
-# emtpy ,comment , section , unicode line
-0 regex/s \\`(\r\n|;|[[]|\xFF\xFE)
+# empty ,comment , section
+# PR/383: remove unicode BOM because it is not portable across regex impls
+0 regex/s \\`(\\r\\n|;|[[])
# left bracket in section line
>&0 search/8192 [
# http://en.wikipedia.org/wiki/Autorun.inf
#------------------------------------------------------------------------------
-# $File: xilinx,v 1.6 2013/11/19 23:15:13 christos Exp $
+# $File: xilinx,v 1.7 2014/04/30 21:41:02 christos Exp $
# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
# Xilinx-Magic@RevRagnarok.com
# Got the info from FPGA-FAQ 0026
# Then 'e'
>>>>>>>>>>>&1 string e
# And length of data
->>>>>>>>>>>>&0 belong x - data length 0x%lx
+>>>>>>>>>>>>&0 belong x - data length 0x%x
# Raw bitstream files
0 long 0xffffffff
#------------------------------------------------------------------------------
-# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $
+# $File: xwindows,v 1.9 2014/04/30 21:41:02 christos Exp $
# xwindows: file(1) magic for various X/Window system file formats.
# Compiled X Keymap
# Jaleo XFS files
0 long 395726 Jaleo XFS file
->4 long x - version %ld
->8 long x - [%ld -
->20 long x \b%ldx
->24 long x \b%ldx
+>4 long x - version %d
+>8 long x - [%d -
+>20 long x \b%dx
+>24 long x \b%dx
>28 long 1008 \bYUV422]
>28 long 1000 \bRGB24]
# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
0 string Xcur Xcursor data
!:mime image/x-xcursor
->10 leshort x version %hd
->>8 leshort x \b.%hd
+>10 leshort x version %d
+>>8 leshort x \b.%d
# Big-endian values
8 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
->20 belong x version %lu,
+>20 belong x version %u,
>32 belong 0 type: NONE,
>32 belong 1 type: META,
>32 belong 2 type: ZFS,
>32 belong 3 type: ZVOL,
>32 belong 4 type: OTHER,
>32 belong 5 type: ANY,
->32 belong >5 type: UNKNOWN (%lu),
+>32 belong >5 type: UNKNOWN (%u),
>40 byte x destination GUID: %02X
>41 byte x %02X
>42 byte x %02X
# Little-endian values
8 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine),
->16 lelong x version %lu,
+>16 lelong x version %u,
>32 lelong 0 type: NONE,
>32 lelong 1 type: META,
>32 lelong 2 type: ZFS,
>32 lelong 3 type: ZVOL,
>32 lelong 4 type: OTHER,
>32 lelong 5 type: ANY,
->32 lelong >5 type: UNKNOWN (%lu),
+>32 lelong >5 type: UNKNOWN (%u),
>47 byte x destination GUID: %02X
>46 byte x %02X
>45 byte x %02X
#
-# $File: Makefile.am,v 1.96 2014/03/07 17:25:17 christos Exp $
+# $File: Makefile.am,v 1.99 2014/08/04 06:26:16 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
$(MAGIC_FRAGMENT_DIR)/magic \
$(MAGIC_FRAGMENT_DIR)/mail.news \
$(MAGIC_FRAGMENT_DIR)/make \
+$(MAGIC_FRAGMENT_DIR)/map \
$(MAGIC_FRAGMENT_DIR)/maple \
$(MAGIC_FRAGMENT_DIR)/marc21 \
$(MAGIC_FRAGMENT_DIR)/mathcad \
$(MAGIC_FRAGMENT_DIR)/mcrypt \
$(MAGIC_FRAGMENT_DIR)/mercurial \
$(MAGIC_FRAGMENT_DIR)/metastore \
+$(MAGIC_FRAGMENT_DIR)/meteorological \
$(MAGIC_FRAGMENT_DIR)/mime \
$(MAGIC_FRAGMENT_DIR)/mips \
$(MAGIC_FRAGMENT_DIR)/mirage \
$(MAGIC_FRAGMENT_DIR)/python \
$(MAGIC_FRAGMENT_DIR)/revision \
$(MAGIC_FRAGMENT_DIR)/riff \
-$(MAGIC_FRAGMENT_DIR)/rinex \
$(MAGIC_FRAGMENT_DIR)/rpm \
$(MAGIC_FRAGMENT_DIR)/rtf \
$(MAGIC_FRAGMENT_DIR)/ruby \
$(MAGIC_FRAGMENT_DIR)/selinux \
$(MAGIC_FRAGMENT_DIR)/sendmail \
$(MAGIC_FRAGMENT_DIR)/sequent \
+$(MAGIC_FRAGMENT_DIR)/sereal \
$(MAGIC_FRAGMENT_DIR)/sgi \
$(MAGIC_FRAGMENT_DIR)/sgml \
$(MAGIC_FRAGMENT_DIR)/sharc \
top_srcdir = @top_srcdir@
#
-# $File: Makefile.am,v 1.96 2014/03/07 17:25:17 christos Exp $
+# $File: Makefile.am,v 1.99 2014/08/04 06:26:16 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
$(MAGIC_FRAGMENT_DIR)/magic \
$(MAGIC_FRAGMENT_DIR)/mail.news \
$(MAGIC_FRAGMENT_DIR)/make \
+$(MAGIC_FRAGMENT_DIR)/map \
$(MAGIC_FRAGMENT_DIR)/maple \
$(MAGIC_FRAGMENT_DIR)/marc21 \
$(MAGIC_FRAGMENT_DIR)/mathcad \
$(MAGIC_FRAGMENT_DIR)/mcrypt \
$(MAGIC_FRAGMENT_DIR)/mercurial \
$(MAGIC_FRAGMENT_DIR)/metastore \
+$(MAGIC_FRAGMENT_DIR)/meteorological \
$(MAGIC_FRAGMENT_DIR)/mime \
$(MAGIC_FRAGMENT_DIR)/mips \
$(MAGIC_FRAGMENT_DIR)/mirage \
$(MAGIC_FRAGMENT_DIR)/python \
$(MAGIC_FRAGMENT_DIR)/revision \
$(MAGIC_FRAGMENT_DIR)/riff \
-$(MAGIC_FRAGMENT_DIR)/rinex \
$(MAGIC_FRAGMENT_DIR)/rpm \
$(MAGIC_FRAGMENT_DIR)/rtf \
$(MAGIC_FRAGMENT_DIR)/ruby \
$(MAGIC_FRAGMENT_DIR)/selinux \
$(MAGIC_FRAGMENT_DIR)/sendmail \
$(MAGIC_FRAGMENT_DIR)/sequent \
+$(MAGIC_FRAGMENT_DIR)/sereal \
$(MAGIC_FRAGMENT_DIR)/sgi \
$(MAGIC_FRAGMENT_DIR)/sgml \
$(MAGIC_FRAGMENT_DIR)/sharc \
from ctypes import *
from ctypes.util import find_library
+
def _init():
"""
Loads the shared library through ctypes and returns a library
- L{ctypes.CDLL} instance
+ L{ctypes.CDLL} instance
"""
return ctypes.cdll.LoadLibrary(find_library('magic'))
MAGIC_NO_CHECK_BUILTIN = NO_CHECK_BUILTIN = 4173824
+
class magic_set(Structure):
pass
magic_set._fields_ = []
_errno.restype = c_int
_errno.argtypes = [magic_t]
+
class Magic(object):
def __init__(self, ms):
self._magic_t = ms
as a filename or None if an error occurred and the MAGIC_ERROR flag
is set. A call to errno() will return the numeric error code.
"""
- try: # attempt python3 approach first
- bi = bytes(filename, 'utf-8')
+ try: # attempt python3 approach first
+ if isinstance(filename, bytes):
+ bi = filename
+ else:
+ bi = bytes(filename, 'utf-8')
return str(_file(self._magic_t, bi), 'utf-8')
except:
return _file(self._magic_t, filename.encode('utf-8'))
as a buffer or None if an error occurred and the MAGIC_ERROR flag
is set. A call to errno() will return the numeric error code.
"""
- try: # attempt python3 approach first
+ try: # attempt python3 approach first
return str(_buffer(self._magic_t, buf, len(buf)), 'utf-8')
except:
return _buffer(self._magic_t, buf, len(buf))
Returns a textual explanation of the last error or None
if there was no error.
"""
- try: # attempt python3 approach first
+ try: # attempt python3 approach first
return str(_error(self._magic_t), 'utf-8')
except:
return _error(self._magic_t)
-
+
def setflags(self, flags):
"""
- Set flags on the magic object which determine how magic checking behaves;
- a bitwise OR of the flags described in libmagic(3), but without the MAGIC_
- prefix.
+ Set flags on the magic object which determine how magic checking
+ behaves; a bitwise OR of the flags described in libmagic(3), but
+ without the MAGIC_ prefix.
Returns -1 on systems that don't support utime(2) or utimes(2)
when PRESERVE_ATIME is set.
def load(self, filename=None):
"""
- Must be called to load entries in the colon separated list of database files
- passed as argument or the default database file if no argument before
- any magic queries can be performed.
-
+ Must be called to load entries in the colon separated list of database
+ files passed as argument or the default database file if no argument
+ before any magic queries can be performed.
+
Returns 0 on success and -1 on failure.
"""
return _load(self._magic_t, filename)
Returns 0 on success and -1 on failure.
"""
return _list(self._magic_t, dbs)
-
+
def errno(self):
"""
Returns a numeric error code. If return value is 0, an internal
"""
return _errno(self._magic_t)
+
def open(flags):
"""
Returns a magic object on success and None on failure.
bin_PROGRAMS = file$(EXEEXT)
subdir = src
DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am ctime_r.c \
- vasprintf.c pread.c strlcpy.c fmtcheck.c asctime_r.c \
- strcasestr.c strlcat.c getopt_long.c asprintf.c getline.c \
+ getline.c strcasestr.c strlcat.c getopt_long.c asctime_r.c \
+ fmtcheck.c vasprintf.c pread.c strlcpy.c asprintf.c \
$(top_srcdir)/depcomp $(include_HEADERS)
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: apprentice.c,v 1.202 2014/03/14 18:48:11 christos Exp $")
+FILE_RCSID("@(#)$File: apprentice.c,v 1.216 2014/09/24 19:49:07 christos Exp $")
#endif /* lint */
#include "magic.h"
#define ALLOC_CHUNK (size_t)10
#define ALLOC_INCR (size_t)200
+#define MAP_TYPE_MMAP 0
+#define MAP_TYPE_MALLOC 1
+#define MAP_TYPE_USER 2
+
struct magic_entry {
struct magic *mp;
uint32_t cont_count;
struct magic_map {
void *p;
size_t len;
+ int type;
struct magic *magic[MAGIC_SETS];
uint32_t nmagic[MAGIC_SETS];
};
private uint32_t swap4(uint32_t);
private uint64_t swap8(uint64_t);
private char *mkdbname(struct magic_set *, const char *, int);
+private struct magic_map *apprentice_buf(struct magic_set *, struct magic *,
+ size_t);
private struct magic_map *apprentice_map(struct magic_set *, const char *);
+private int check_buffer(struct magic_set *, struct magic_map *, const char *);
private void apprentice_unmap(struct magic_map *);
private int apprentice_compile(struct magic_set *, struct magic_map *,
const char *);
private int
apprentice_1(struct magic_set *ms, const char *fn, int action)
{
- struct mlist *ml;
struct magic_map *map;
+#ifndef COMPILE_ONLY
+ struct mlist *ml;
size_t i;
+#endif
if (magicsize != FILE_MAGICSIZE) {
file_error(ms, 0, "magic element size %lu != %lu",
if (action == FILE_LIST) {
for (i = 0; i < MAGIC_SETS; i++) {
- printf("Set %zu:\nBinary patterns:\n", i);
+ printf("Set %" SIZE_T_FORMAT "u:\nBinary patterns:\n",
+ i);
apprentice_list(ms->mlist[i], BINTEST);
printf("Text patterns:\n");
apprentice_list(ms->mlist[i], TEXTTEST);
}
}
-
- return 0;
#endif /* COMPILE_ONLY */
+ return 0;
}
protected void
{
if (map == NULL)
return;
- if (map->p == NULL)
- return;
+ if (map->p != NULL && map->type != MAP_TYPE_USER) {
#ifdef QUICK
- if (map->len)
- (void)munmap(map->p, map->len);
- else
+ if (map->type == MAP_TYPE_MMAP)
+ (void)munmap(map->p, map->len);
+ else
#endif
free(map->p);
+ } else {
+ uint32_t j;
+ for (j = 0; j < MAGIC_SETS; j++)
+ free(map->magic[j]);
+ }
free(map);
}
free(ml);
}
+#ifndef COMPILE_ONLY
+/* void **bufs: an array of compiled magic files */
+protected int
+buffer_apprentice(struct magic_set *ms, struct magic **bufs,
+ size_t *sizes, size_t nbufs)
+{
+ size_t i;
+ struct mlist *ml;
+ struct magic_map *map;
+
+ if (nbufs == 0)
+ return -1;
+
+ if (ms->mlist[0] != NULL)
+ file_reset(ms);
+
+ init_file_tables();
+
+ for (i = 0; i < MAGIC_SETS; i++) {
+ mlist_free(ms->mlist[i]);
+ if ((ms->mlist[i] = mlist_alloc()) == NULL) {
+ file_oomem(ms, sizeof(*ms->mlist[i]));
+ if (i != 0) {
+ --i;
+ do
+ mlist_free(ms->mlist[i]);
+ while (i != 0);
+ }
+ return -1;
+ }
+ }
+
+ for (i = 0; i < nbufs; i++) {
+ map = apprentice_buf(ms, bufs[i], sizes[i]);
+ if (map == NULL)
+ return -1;
+
+ for (i = 0; i < MAGIC_SETS; i++) {
+ if (add_mlist(ms->mlist[i], map, i) == -1) {
+ file_oomem(ms, sizeof(*ml));
+ apprentice_unmap(map);
+ return -1;
+ }
+ }
+ }
+
+ return 0;
+}
+#endif
+
/* const char *fn: list of magic files and directories */
protected int
file_apprentice(struct magic_set *ms, const char *fn, int action)
break;
default:
- val = 0;
(void)fprintf(stderr, "Bad type %d\n", m->type);
abort();
}
magic_entry_free(mset[j].me, mset[j].count);
if (errs) {
- for (j = 0; j < MAGIC_SETS; j++) {
- if (map->magic[j])
- free(map->magic[j]);
- }
- free(map);
+ apprentice_unmap(map);
return NULL;
}
return map;
if ((ms->flags & MAGIC_CHECK) == 0)
return 0;
- if (m->type != FILE_PSTRING && (m->str_flags & PSTRING_LEN) != 0) {
+ if ((m->type != FILE_REGEX || (m->str_flags & REGEX_LINE_COUNT) == 0) &&
+ (m->type != FILE_PSTRING && (m->str_flags & PSTRING_LEN) != 0)) {
file_magwarn(ms,
"'/BHhLl' modifiers are only allowed for pascal strings\n");
return -1;
*/
m->type = get_standard_integer_type(l, &l);
}
- // It's unsigned.
+ /* It's unsigned. */
if (m->type != FILE_INVALID)
m->flag |= UNSIGNED;
} else {
m->str_flags = (m->str_flags & ~PSTRING_LEN) | PSTRING_4_BE;
break;
case CHAR_PSTRING_4_LE:
- if (m->type != FILE_PSTRING)
+ switch (m->type) {
+ case FILE_PSTRING:
+ case FILE_REGEX:
+ break;
+ default:
goto bad;
+ }
m->str_flags = (m->str_flags & ~PSTRING_LEN) | PSTRING_4_LE;
break;
case CHAR_PSTRING_LENGTH_INCLUDES_ITSELF:
}
private int
+goodchar(unsigned char x, const char *extra)
+{
+ return (isascii(x) && isalnum(x)) || strchr(extra, x);
+}
+
+private int
parse_extra(struct magic_set *ms, struct magic_entry *me, const char *line,
- off_t off, size_t len, const char *name, int nt)
+ off_t off, size_t len, const char *name, const char *extra, int nt)
{
size_t i;
const char *l = line;
}
EATAB;
- for (i = 0; *l && ((isascii((unsigned char)*l) &&
- isalnum((unsigned char)*l)) || strchr("-+/.", *l)) &&
- i < len; buf[i++] = *l++)
+ for (i = 0; *l && i < len && goodchar(*l, extra); buf[i++] = *l++)
continue;
if (i == len && *l) {
file_magwarn(ms, "%s type `%s' truncated %"
SIZE_T_FORMAT "u", name, line, i);
} else {
+ if (!isspace((unsigned char)*l) && !goodchar(*l, extra))
+ file_magwarn(ms, "%s type `%s' has bad char '%c'",
+ name, line, *l);
if (nt)
buf[i] = '\0';
}
if (i > 0)
return 0;
- else
- return -1;
+
+ file_magerror(ms, "Bad magic entry '%s'", line);
+ return -1;
}
/*
struct magic *m = &me->mp[0];
return parse_extra(ms, me, line, offsetof(struct magic, apple),
- sizeof(m->apple), "APPLE", 0);
+ sizeof(m->apple), "APPLE", "!+-./", 0);
}
/*
struct magic *m = &me->mp[0];
return parse_extra(ms, me, line, offsetof(struct magic, mimetype),
- sizeof(m->mimetype), "MIME", 1);
+ sizeof(m->mimetype), "MIME", "+-/.", 1);
}
private int
check_format_type(const char *ptr, int type)
{
- int quad = 0;
+ int quad = 0, h;
if (*ptr == '\0') {
/* Missing format string; bad */
return -1;
}
- switch (type) {
+ switch (file_formats[type]) {
case FILE_FMT_QUAD:
quad = 1;
/*FALLTHROUGH*/
case FILE_FMT_NUM:
+ if (quad == 0) {
+ switch (type) {
+ case FILE_BYTE:
+ h = 2;
+ break;
+ case FILE_SHORT:
+ case FILE_BESHORT:
+ case FILE_LESHORT:
+ h = 1;
+ break;
+ case FILE_LONG:
+ case FILE_BELONG:
+ case FILE_LELONG:
+ case FILE_MELONG:
+ case FILE_LEID3:
+ case FILE_BEID3:
+ case FILE_INDIRECT:
+ h = 0;
+ break;
+ default:
+ abort();
+ }
+ } else
+ h = 0;
if (*ptr == '-')
ptr++;
if (*ptr == '.')
}
switch (*ptr++) {
+#ifdef STRICT_FORMAT /* "long" formats are int formats for us */
+ /* so don't accept the 'l' modifier */
case 'l':
switch (*ptr++) {
case 'i':
case 'o':
case 'x':
case 'X':
- return 0;
+ return h != 0 ? -1 : 0;
default:
return -1;
}
+ /*
+ * Don't accept h and hh modifiers. They make writing
+ * magic entries more complicated, for very little benefit
+ */
case 'h':
+ if (h-- <= 0)
+ return -1;
switch (*ptr++) {
case 'h':
+ if (h-- <= 0)
+ return -1;
switch (*ptr++) {
case 'i':
case 'd':
default:
return -1;
}
+ case 'i':
case 'd':
- return 0;
+ case 'u':
+ case 'o':
+ case 'x':
+ case 'X':
+ return h != 0 ? -1 : 0;
default:
return -1;
}
-
- case 'i':
+#endif
case 'c':
+ return h != 2 ? -1 : 0;
+ case 'i':
case 'd':
case 'u':
case 'o':
case 'x':
case 'X':
+#ifdef STRICT_FORMAT
+ return h != 0 ? -1 : 0;
+#else
return 0;
-
+#endif
default:
return -1;
}
}
ptr++;
- if (check_format_type(ptr, file_formats[m->type]) == -1) {
+ if (check_format_type(ptr, m->type) == -1) {
/*
* TODO: this error message is unhelpful if the format
* string is not one character long
m->value.s);
return -1;
}
+ if (m->type == FILE_REGEX) {
+ file_regex_t rx;
+ int rc = file_regcomp(&rx, m->value.s, REG_EXTENDED);
+ if (rc) {
+ if (ms->flags & MAGIC_CHECK)
+ file_regerror(&rx, rc, ms);
+ }
+ file_regfree(&rx);
+ return rc ? -1 : 0;
+ }
return 0;
case FILE_FLOAT:
case FILE_BEFLOAT:
}
/*
+ * handle a buffer containging a compiled file.
+ */
+private struct magic_map *
+apprentice_buf(struct magic_set *ms, struct magic *buf, size_t len)
+{
+ struct magic_map *map;
+
+ if ((map = CAST(struct magic_map *, calloc(1, sizeof(*map)))) == NULL) {
+ file_oomem(ms, sizeof(*map));
+ return NULL;
+ }
+ map->len = len;
+ map->p = buf;
+ map->type = MAP_TYPE_USER;
+ if (check_buffer(ms, map, "buffer") != 0) {
+ apprentice_unmap(map);
+ return NULL;
+ }
+ return map;
+}
+
+/*
* handle a compiled file.
*/
{
int fd;
struct stat st;
- uint32_t *ptr;
- uint32_t version, entries, nentries;
- int needsbyteswap;
char *dbname = NULL;
struct magic_map *map;
- size_t i;
fd = -1;
if ((map = CAST(struct magic_map *, calloc(1, sizeof(*map)))) == NULL) {
file_error(ms, errno, "cannot map `%s'", dbname);
goto error;
}
+ map->type = MAP_TYPE_MMAP;
#else
if ((map->p = CAST(void *, malloc(map->len))) == NULL) {
file_oomem(ms, map->len);
file_badread(ms);
goto error;
}
- map->len = 0;
+ map->type = MAP_TYPE_MALLOC;
#define RET 1
#endif
(void)close(fd);
fd = -1;
+
+ if (check_buffer(ms, map, dbname) != 0)
+ goto error;
+
+ free(dbname);
+ return map;
+
+error:
+ if (fd != -1)
+ (void)close(fd);
+ apprentice_unmap(map);
+ free(dbname);
+ return NULL;
+}
+
+private int
+check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
+{
+ uint32_t *ptr;
+ uint32_t entries, nentries;
+ uint32_t version;
+ int i, needsbyteswap;
+
ptr = CAST(uint32_t *, map->p);
if (*ptr != MAGICNO) {
if (swap4(*ptr) != MAGICNO) {
file_error(ms, 0, "bad magic in `%s'", dbname);
- goto error;
+ return -1;
}
needsbyteswap = 1;
} else
file_error(ms, 0, "File %s supports only version %d magic "
"files. `%s' is version %d", VERSION,
VERSIONNO, dbname, version);
- goto error;
+ return -1;
}
- entries = (uint32_t)(st.st_size / sizeof(struct magic));
- if ((off_t)(entries * sizeof(struct magic)) != st.st_size) {
- file_error(ms, 0, "Size of `%s' %llu is not a multiple of %zu",
- dbname, (unsigned long long)st.st_size,
- sizeof(struct magic));
- goto error;
+ entries = (uint32_t)(map->len / sizeof(struct magic));
+ if ((entries * sizeof(struct magic)) != map->len) {
+ file_error(ms, 0, "Size of `%s' %" SIZE_T_FORMAT "u is not "
+ "a multiple of %" SIZE_T_FORMAT "u",
+ dbname, map->len, sizeof(struct magic));
+ return -1;
}
map->magic[0] = CAST(struct magic *, map->p) + 1;
nentries = 0;
if (entries != nentries + 1) {
file_error(ms, 0, "Inconsistent entries in `%s' %u != %u",
dbname, entries, nentries + 1);
- goto error;
+ return -1;
}
if (needsbyteswap)
for (i = 0; i < MAGIC_SETS; i++)
byteswap(map->magic[i], map->nmagic[i]);
- free(dbname);
- return map;
-
-error:
- if (fd != -1)
- (void)close(fd);
- apprentice_unmap(map);
- free(dbname);
- return NULL;
+ return 0;
}
-private const uint32_t ar[] = {
- MAGICNO, VERSIONNO
-};
-
/*
* handle an mmaped file.
*/
char *dbname;
int rv = -1;
uint32_t i;
+ union {
+ struct magic m;
+ uint32_t h[2 + MAGIC_SETS];
+ } hdr;
dbname = mkdbname(ms, fn, 1);
file_error(ms, errno, "cannot open `%s'", dbname);
goto out;
}
+ memset(&hdr, 0, sizeof(hdr));
+ hdr.h[0] = MAGICNO;
+ hdr.h[1] = VERSIONNO;
+ memcpy(hdr.h + 2, map->nmagic, nm);
- if (write(fd, ar, sizeof(ar)) != (ssize_t)sizeof(ar)) {
- file_error(ms, errno, "error writing `%s'", dbname);
- goto out;
- }
-
- if (write(fd, map->nmagic, nm) != (ssize_t)nm) {
+ if (write(fd, &hdr, sizeof(hdr)) != (ssize_t)sizeof(hdr)) {
file_error(ms, errno, "error writing `%s'", dbname);
goto out;
}
- assert(nm + sizeof(ar) < m);
-
- if (lseek(fd, (off_t)m, SEEK_SET) != (off_t)m) {
- file_error(ms, errno, "error seeking `%s'", dbname);
- goto out;
- }
-
for (i = 0; i < MAGIC_SETS; i++) {
len = m * map->nmagic[i];
if (write(fd, map->magic[i], len) != (ssize_t)len) {
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.55 2014/02/27 23:26:17 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.67 2014/09/24 19:49:07 christos Exp $")
#endif
#include <assert.h>
#define CDF_TOLE8(x) ((uint64_t)(NEED_SWAP ? _cdf_tole8(x) : (uint64_t)(x)))
#define CDF_TOLE4(x) ((uint32_t)(NEED_SWAP ? _cdf_tole4(x) : (uint32_t)(x)))
#define CDF_TOLE2(x) ((uint16_t)(NEED_SWAP ? _cdf_tole2(x) : (uint16_t)(x)))
+#define CDF_TOLE(x) (sizeof(x) == 2 ? CDF_TOLE2(x) : (sizeof(x) == 4 ? \
+ CDF_TOLE4(x) : CDF_TOLE8(x)))
#define CDF_GETUINT32(x, y) cdf_getuint32(x, y)
{
const char *b = (const char *)sst->sst_tab;
const char *e = ((const char *)p) + tail;
+ size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+ CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
(void)&line;
- if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
+ if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
return 0;
DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
" > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
- CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+ ss * sst->sst_len, ss, sst->sst_len));
errno = EFTYPE;
return -1;
}
size_t ss = CDF_SHORT_SEC_SIZE(h);
size_t pos = CDF_SHORT_SEC_POS(h, id);
assert(ss == len);
- if (pos > CDF_SEC_SIZE(h) * sst->sst_len) {
+ if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
SIZE_T_FORMAT "u\n",
- pos, CDF_SEC_SIZE(h) * sst->sst_len));
+ pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
return -1;
}
(void)memcpy(((char *)buf) + offs,
cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
{
size_t i, j;
- cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+ cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+ / sizeof(maxsector));
DPRINTF(("Chain:"));
for (j = i = 0; sid >= 0; i++, j++) {
errno = EFTYPE;
return (size_t)-1;
}
- if (sid > maxsector) {
- DPRINTF(("Sector %d > %d\n", sid, maxsector));
+ if (sid >= maxsector) {
+ DPRINTF(("Sector %d >= %d\n", sid, maxsector));
errno = EFTYPE;
return (size_t)-1;
}
sid = CDF_TOLE4((uint32_t)sat->sat_tab[sid]);
}
+ if (i == 0) {
+ DPRINTF((" none, sid: %d\n", sid));
+ return (size_t)-1;
+
+ }
DPRINTF(("\n"));
return i;
}
const cdf_sat_t *sat, const cdf_sat_t *ssat, const cdf_stream_t *sst,
const cdf_dir_t *dir, cdf_stream_t *scn)
{
+ return cdf_read_user_stream(info, h, sat, ssat, sst, dir,
+ "\05SummaryInformation", scn);
+}
+
+int
+cdf_read_user_stream(const cdf_info_t *info, const cdf_header_t *h,
+ const cdf_sat_t *sat, const cdf_sat_t *ssat, const cdf_stream_t *sst,
+ const cdf_dir_t *dir, const char *name, cdf_stream_t *scn)
+{
size_t i;
const cdf_directory_t *d;
- static const char name[] = "\05SummaryInformation";
+ size_t name_len = strlen(name) + 1;
for (i = dir->dir_len; i > 0; i--)
if (dir->dir_tab[i - 1].d_type == CDF_DIR_TYPE_USER_STREAM &&
- cdf_namecmp(name, dir->dir_tab[i - 1].d_name, sizeof(name))
+ cdf_namecmp(name, dir->dir_tab[i - 1].d_name, name_len)
== 0)
break;
if (i == 0) {
- DPRINTF(("Cannot find summary information section\n"));
+ DPRINTF(("Cannot find user stream `%s'\n", name));
errno = ESRCH;
return -1;
}
if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
goto out;
for (i = 0; i < sh.sh_properties; i++) {
- size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+ size_t tail = (i << 1) + 1;
+ if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+ __LINE__) == -1)
+ goto out;
+ size_t ofs = CDF_GETUINT32(p, tail);
q = (const uint8_t *)(const void *)
((const char *)(const void *)p + ofs
- 2 * sizeof(uint32_t));
+ if (q < p) {
+ DPRINTF(("Wrapped around %p < %p\n", q, p));
+ goto out;
+ }
if (q > e) {
DPRINTF(("Ran of the end %p > %p\n", q, e));
goto out;
i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
if (inp[i].pi_type & CDF_VECTOR) {
nelements = CDF_GETUINT32(q, 1);
+ if (nelements == 0) {
+ DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+ goto out;
+ }
o = 2;
} else {
nelements = 1;
}
DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
nelements));
- for (j = 0; j < nelements; j++, i++) {
+ for (j = 0; j < nelements && i < sh.sh_properties;
+ j++, i++)
+ {
uint32_t l = CDF_GETUINT32(q, o);
inp[i].pi_str.s_len = l;
inp[i].pi_str.s_buf = (const char *)
cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count)
{
- size_t i, maxcount;
+ size_t maxcount;
const cdf_summary_info_header_t *si =
CAST(const cdf_summary_info_header_t *, sst->sst_tab);
const cdf_section_declaration_t *sd =
ssi->si_os = CDF_TOLE2(si->si_os);
ssi->si_class = si->si_class;
cdf_swap_class(&ssi->si_class);
- ssi->si_count = CDF_TOLE2(si->si_count);
+ ssi->si_count = CDF_TOLE4(si->si_count);
*count = 0;
maxcount = 0;
*info = NULL;
- for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
- if (i >= CDF_LOOP_LIMIT) {
- DPRINTF(("Unpack summary info loop limit"));
- errno = EFTYPE;
- return -1;
- }
- if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset),
- info, count, &maxcount) == -1) {
- return -1;
- }
- }
+ if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info,
+ count, &maxcount) == -1)
+ return -1;
return 0;
}
+#define extract_catalog_field(f, l) \
+ memcpy(&ce[i].f, b + (l), sizeof(ce[i].f)); \
+ ce[i].f = CDF_TOLE(ce[i].f)
+
+int
+cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
+ cdf_catalog_t **cat)
+{
+ size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+ CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
+ const char *b = CAST(const char *, sst->sst_tab);
+ const char *eb = b + ss * sst->sst_len;
+ size_t nr, i, k;
+ cdf_catalog_entry_t *ce;
+ uint16_t reclen;
+ const uint16_t *np;
+
+ for (nr = 0; b < eb; nr++) {
+ memcpy(&reclen, b, sizeof(reclen));
+ reclen = CDF_TOLE2(reclen);
+ if (reclen == 0)
+ break;
+ b += reclen;
+ }
+ *cat = CAST(cdf_catalog_t *,
+ malloc(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
+ (*cat)->cat_num = nr;
+ ce = (*cat)->cat_e;
+ b = CAST(const char *, sst->sst_tab);
+ for (i = 0; i < nr; i++) {
+ extract_catalog_field(ce_namlen, 0);
+ extract_catalog_field(ce_num, 2);
+ extract_catalog_field(ce_timestamp, 6);
+ reclen = ce[i].ce_namlen;
+ ce[i].ce_namlen =
+ sizeof(ce[i].ce_name) / sizeof(ce[i].ce_name[0]) - 1;
+ if (ce[i].ce_namlen > reclen - 14)
+ ce[i].ce_namlen = reclen - 14;
+ np = CAST(const uint16_t *, (b + 16));
+ for (k = 0; k < ce[i].ce_namlen; k++) {
+ ce[i].ce_name[k] = np[k];
+ CDF_TOLE2(ce[i].ce_name[k]);
+ }
+ ce[i].ce_name[ce[i].ce_namlen] = 0;
+ b += reclen;
+ }
+ return 0;
+}
int
cdf_print_classid(char *buf, size_t buflen, const cdf_classid_t *id)
return len;
}
+char *
+cdf_u16tos8(char *buf, size_t len, const uint16_t *p)
+{
+ size_t i;
+ for (i = 0; i < len && p[i]; i++)
+ buf[i] = (char)p[i];
+ buf[i] = '\0';
+ return buf;
+}
#ifdef CDF_DEBUG
void
for (i = 0; i < __arraycount(h->h_master_sat); i++) {
if (h->h_master_sat[i] == CDF_SECID_FREE)
break;
- (void)fprintf(stderr, "%35.35s[%.3zu] = %d\n",
+ (void)fprintf(stderr, "%35.35s[%.3" SIZE_T_FORMAT "u] = %d\n",
"master_sat", i, h->h_master_sat[i]);
}
}
return;
(void)fprintf(stderr, "Endian: %x\n", ssi.si_byte_order);
(void)fprintf(stderr, "Os Version %d.%d\n", ssi.si_os_version & 0xff,
- ssi.si_os_version >> 8);
+ ssi.si_os_version >> 8);
(void)fprintf(stderr, "Os %d\n", ssi.si_os);
cdf_print_classid(buf, sizeof(buf), &ssi.si_class);
(void)fprintf(stderr, "Class %s\n", buf);
free(info);
}
+
+void
+cdf_dump_catalog(const cdf_header_t *h, const cdf_stream_t *sst)
+{
+ cdf_catalog_t *cat;
+ cdf_unpack_catalog(h, sst, &cat);
+ const cdf_catalog_entry_t *ce = cat->cat_e;
+ struct timespec ts;
+ char tbuf[64], sbuf[256];
+ size_t i;
+
+ printf("Catalog:\n");
+ for (i = 0; i < cat->cat_num; i++) {
+ cdf_timestamp_to_timespec(&ts, ce[i].ce_timestamp);
+ printf("\t%d %s %s", ce[i].ce_num,
+ cdf_u16tos8(sbuf, ce[i].ce_namlen, ce[i].ce_name),
+ cdf_ctime(&ts.tv_sec, tbuf));
+ }
+ free(cat);
+}
+
#endif
#ifdef TEST
cdf_stream_t sst, scn;
cdf_dir_t dir;
cdf_info_t info;
+ const cdf_directory_t *root;
if (argc < 2) {
(void)fprintf(stderr, "Usage: %s <filename>\n", getprogname());
if (cdf_read_dir(&info, &h, &sat, &dir) == -1)
err(1, "Cannot read dir");
- if (cdf_read_short_stream(&info, &h, &sat, &dir, &sst) == -1)
+ if (cdf_read_short_stream(&info, &h, &sat, &dir, &sst, &root)
+ == -1)
err(1, "Cannot read short stream");
#ifdef CDF_DEBUG
cdf_dump_stream(&h, &sst);
if (cdf_read_summary_info(&info, &h, &sat, &ssat, &sst, &dir,
&scn) == -1)
- err(1, "Cannot read summary info");
+ warn("Cannot read summary info");
+#ifdef CDF_DEBUG
+ else
+ cdf_dump_summary_info(&h, &scn);
+#endif
+ if (cdf_read_catalog(&info, &h, &sat, &ssat, &sst, &dir,
+ &scn) == -1)
+ warn("Cannot read catalog");
#ifdef CDF_DEBUG
- cdf_dump_summary_info(&h, &scn);
+ else
+ cdf_dump_catalog(&h, &scn);
#endif
(void)close(info.i_fd);
size_t i_len;
} cdf_info_t;
+
+typedef struct {
+ uint16_t ce_namlen;
+ uint32_t ce_num;
+ uint64_t ce_timestamp;
+ uint16_t ce_name[256];
+} cdf_catalog_entry_t;
+
+typedef struct {
+ size_t cat_num;
+ cdf_catalog_entry_t cat_e[0];
+} cdf_catalog_t;
+
struct timespec;
int cdf_timestamp_to_timespec(struct timespec *, cdf_timestamp_t);
int cdf_timespec_to_timestamp(cdf_timestamp_t *, const struct timespec *);
const cdf_directory_t **);
int cdf_read_property_info(const cdf_stream_t *, const cdf_header_t *, uint32_t,
cdf_property_info_t **, size_t *, size_t *);
+int cdf_read_user_stream(const cdf_info_t *, const cdf_header_t *,
+ const cdf_sat_t *, const cdf_sat_t *, const cdf_stream_t *,
+ const cdf_dir_t *, const char *, cdf_stream_t *);
+#define cdf_read_catalog(info, header, sat, ssat, stream, dir, scn) \
+ cdf_read_user_stream(info, header, sat, ssat, stream, dir, "Catalog", \
+ scn)
+#define cdf_read_encrypted_package(info, header, sat, ssat, stream, dir, scn) \
+ cdf_read_user_stream(info, header, sat, ssat, stream, dir, \
+ "EncryptedPackage", scn)
int cdf_read_summary_info(const cdf_info_t *, const cdf_header_t *,
const cdf_sat_t *, const cdf_sat_t *, const cdf_stream_t *,
const cdf_dir_t *, cdf_stream_t *);
int cdf_unpack_summary_info(const cdf_stream_t *, const cdf_header_t *,
cdf_summary_info_header_t *, cdf_property_info_t **, size_t *);
+int cdf_unpack_catalog(const cdf_header_t *, const cdf_stream_t *,
+ cdf_catalog_t **);
int cdf_print_classid(char *, size_t, const cdf_classid_t *);
int cdf_print_property_name(char *, size_t, uint32_t);
int cdf_print_elapsed_time(char *, size_t, cdf_timestamp_t);
uint32_t cdf_tole4(uint32_t);
uint64_t cdf_tole8(uint64_t);
char *cdf_ctime(const time_t *, char *);
+char *cdf_u16tos8(char *, size_t, const uint16_t *);
#ifdef CDF_DEBUG
void cdf_dump_header(const cdf_header_t *);
const cdf_sat_t *, const cdf_stream_t *, const cdf_dir_t *);
void cdf_dump_property_info(const cdf_property_info_t *, size_t);
void cdf_dump_summary_info(const cdf_header_t *, const cdf_stream_t *);
+void cdf_dump_catalog(const cdf_header_t *, const cdf_stream_t *);
#endif
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: cdf_time.c,v 1.13 2014/02/25 20:52:02 christos Exp $")
+FILE_RCSID("@(#)$File: cdf_time.c,v 1.15 2014/05/14 23:15:42 christos Exp $")
#endif
#include <time.h>
tm.tm_hour = (int)(t % 24);
t /= 24;
- // XXX: Approx
+ /* XXX: Approx */
tm.tm_year = (int)(CDF_BASE_YEAR + (t / 365));
rdays = cdf_getdays(tm.tm_year);
char *ptr = ctime_r(sec, buf);
if (ptr != NULL)
return buf;
- (void)snprintf(buf, 26, "*Bad* 0x%16.16llx\n", (long long)*sec);
+ (void)snprintf(buf, 26, "*Bad* 0x%16.16" INT64_T_FORMAT "x\n",
+ (long long)*sec);
return buf;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: encoding.c,v 1.9 2013/11/19 20:45:50 christos Exp $")
+FILE_RCSID("@(#)$File: encoding.c,v 1.10 2014/09/11 12:08:52 christos Exp $")
#endif /* lint */
#include "magic.h"
*code_mime = "utf-8";
} else if (file_looks_utf8(buf, nbytes, *ubuf, ulen) > 1) {
DPRINTF(("utf8 %" SIZE_T_FORMAT "u\n", *ulen));
- *code = "UTF-8 Unicode (with BOM)";
*code = "UTF-8 Unicode";
*code_mime = "utf-8";
} else if ((ucs_type = looks_ucs16(buf, nbytes, *ubuf, ulen)) != 0) {
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: file.c,v 1.153 2014/02/11 15:41:04 christos Exp $")
+FILE_RCSID("@(#)$File: file.c,v 1.154 2014/09/10 18:41:51 christos Exp $")
#endif /* lint */
#include "magic.h"
#ifdef HAVE_UNISTD_H
#include <unistd.h> /* for read() */
#endif
-#ifdef HAVE_LOCALE_H
-#include <locale.h>
-#endif
#ifdef HAVE_WCHAR_H
#include <wchar.h>
#endif
*/
/*
* file.h - definitions for file(1) program
- * @(#)$File: file.h,v 1.149 2014/03/15 21:47:40 christos Exp $
+ * @(#)$File: file.h,v 1.154 2014/09/10 18:41:51 christos Exp $
*/
#ifndef __file_h__
#define private static
-#if HAVE_VISIBILITY
+#if HAVE_VISIBILITY && !defined(WIN32)
#define public __attribute__ ((__visibility__("default")))
#ifndef protected
#define protected __attribute__ ((__visibility__("hidden")))
#define MAXstring 64 /* max len of "string" types */
#define MAGICNO 0xF11E041C
-#define VERSIONNO 11
+#define VERSIONNO 12
#define FILE_MAGICSIZE 248
#define FILE_LOAD 0
#define PSTRING_2_LE BIT(9)
#define PSTRING_4_BE BIT(10)
#define PSTRING_4_LE BIT(11)
+#define REGEX_LINE_COUNT BIT(11)
#define PSTRING_LEN \
(PSTRING_1_BE|PSTRING_2_LE|PSTRING_2_BE|PSTRING_4_LE|PSTRING_4_BE)
#define PSTRING_LENGTH_INCLUDES_ITSELF BIT(12)
protected int file_softmagic(struct magic_set *, const unsigned char *, size_t,
size_t, int, int);
protected int file_apprentice(struct magic_set *, const char *, int);
+protected int buffer_apprentice(struct magic_set *, struct magic **,
+ size_t *, size_t);
protected int file_magicfind(struct magic_set *, const char *, struct mlist *);
protected uint64_t file_signextend(struct magic_set *, struct magic *,
uint64_t);
size_t);
#endif /* __EMX__ */
+#if defined(HAVE_LOCALE_H)
+#include <locale.h>
+#endif
+
+typedef struct {
+ const char *pat;
+#if defined(HAVE_NEWLOCALE) && defined(HAVE_USELOCALE) && defined(HAVE_FREELOCALE)
+#define USE_C_LOCALE
+ locale_t old_lc_ctype;
+ locale_t c_lc_ctype;
+#endif
+ int rc;
+ regex_t rx;
+} file_regex_t;
+
+protected int file_regcomp(file_regex_t *, const char *, int);
+protected int file_regexec(file_regex_t *, const char *, size_t, regmatch_t *,
+ int);
+protected void file_regfree(file_regex_t *);
+protected void file_regerror(file_regex_t *, int, struct magic_set *);
#ifndef COMPILE_ONLY
extern const char *file_names[];
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: fsmagic.c,v 1.71 2013/12/01 18:01:07 christos Exp $")
+FILE_RCSID("@(#)$File: fsmagic.c,v 1.73 2014/05/14 23:15:42 christos Exp $")
#endif /* lint */
#include "magic.h"
#ifdef major /* Might be defined in sys/types.h. */
# define HAVE_MAJOR
#endif
-
+#ifdef WIN32
+# define WIN32_LEAN_AND_MEAN
+# include <windows.h>
+#endif
+
#ifndef HAVE_MAJOR
# define major(dev) (((dev) >> 8) & 0xff)
# define minor(dev) ((dev) & 0xff)
#endif
ret = stat(fn, sb); /* don't merge into if; see "ret =" above */
+#ifdef WIN32
+ {
+ HANDLE hFile = CreateFile(fn, 0, FILE_SHARE_DELETE |
+ FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0,
+ NULL);
+ if (hFile != INVALID_HANDLE_VALUE) {
+ /*
+ * Stat failed, but we can still open it - assume it's
+ * a block device, if nothing else.
+ */
+ if (ret) {
+ sb->st_mode = S_IFBLK;
+ ret = 0;
+ }
+ switch (GetFileType(hFile)) {
+ case FILE_TYPE_CHAR:
+ sb->st_mode |= S_IFCHR;
+ sb->st_mode &= ~S_IFREG;
+ break;
+ case FILE_TYPE_PIPE:
+ sb->st_mode |= S_IFIFO;
+ sb->st_mode &= ~S_IFREG;
+ break;
+ }
+ CloseHandle(hFile);
+ }
+ }
+#endif
+
if (ret) {
if (ms->flags & MAGIC_ERROR) {
file_error(ms, errno, "cannot stat `%s'", fn);
if (handle_mime(ms, mime, "chardevice") == -1)
return -1;
} else {
-#ifdef HAVE_STAT_ST_RDEV
+#ifdef HAVE_STRUCT_STAT_ST_RDEV
# ifdef dv_unit
if (file_printf(ms, "%scharacter special (%d/%d/%d)",
COMMA, major(sb->st_rdev), dv_unit(sb->st_rdev),
if (handle_mime(ms, mime, "blockdevice") == -1)
return -1;
} else {
-#ifdef HAVE_STAT_ST_RDEV
+#ifdef HAVE_STRUCT_STAT_ST_RDEV
# ifdef dv_unit
if (file_printf(ms, "%sblock special (%d/%d/%d)",
COMMA, major(sb->st_rdev), dv_unit(sb->st_rdev),
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: funcs.c,v 1.70 2014/03/14 19:02:37 christos Exp $")
+FILE_RCSID("@(#)$File: funcs.c,v 1.73 2014/09/10 18:41:51 christos Exp $")
#endif /* lint */
#include "magic.h"
#if defined(HAVE_LIMITS_H)
#include <limits.h>
#endif
-#if defined(HAVE_LOCALE_H)
-#include <locale.h>
-#endif
#ifndef SIZE_MAX
#define SIZE_MAX ((size_t)~0)
if (file_printf(ms, "%s", code_mime) == -1)
rv = -1;
}
+#if HAVE_FORK
done_encoding:
+#endif
free(u8buf);
if (rv)
return rv;
protected int
file_replace(struct magic_set *ms, const char *pat, const char *rep)
{
- regex_t rx;
+ file_regex_t rx;
int rc, rv = -1;
- char *old_lc_ctype;
-
- old_lc_ctype = setlocale(LC_CTYPE, NULL);
- assert(old_lc_ctype != NULL);
- old_lc_ctype = strdup(old_lc_ctype);
- assert(old_lc_ctype != NULL);
- (void)setlocale(LC_CTYPE, "C");
- rc = regcomp(&rx, pat, REG_EXTENDED);
+
+ rc = file_regcomp(&rx, pat, REG_EXTENDED);
if (rc) {
- char errmsg[512];
- (void)regerror(rc, &rx, errmsg, sizeof(errmsg));
- file_magerror(ms, "regex error %d, (%s)", rc, errmsg);
+ file_regerror(&rx, rc, ms);
} else {
regmatch_t rm;
int nm = 0;
- while (regexec(&rx, ms->o.buf, 1, &rm, 0) == 0) {
+ while (file_regexec(&rx, ms->o.buf, 1, &rm, 0) == 0) {
ms->o.buf[rm.rm_so] = '\0';
if (file_printf(ms, "%s%s", rep,
rm.rm_eo != 0 ? ms->o.buf + rm.rm_eo : "") == -1)
goto out;
nm++;
}
- regfree(&rx);
rv = nm;
}
out:
- (void)setlocale(LC_CTYPE, old_lc_ctype);
- free(old_lc_ctype);
+ file_regfree(&rx);
return rv;
}
+
+protected int
+file_regcomp(file_regex_t *rx, const char *pat, int flags)
+{
+#ifdef USE_C_LOCALE
+ rx->c_lc_ctype = newlocale(LC_CTYPE_MASK, "C", 0);
+ assert(rx->c_lc_ctype != NULL);
+ rx->old_lc_ctype = uselocale(rx->c_lc_ctype);
+ assert(rx->old_lc_ctype != NULL);
+#endif
+ rx->pat = pat;
+
+ return rx->rc = regcomp(&rx->rx, pat, flags);
+}
+
+protected int
+file_regexec(file_regex_t *rx, const char *str, size_t nmatch,
+ regmatch_t* pmatch, int eflags)
+{
+ assert(rx->rc == 0);
+ return regexec(&rx->rx, str, nmatch, pmatch, eflags);
+}
+
+protected void
+file_regfree(file_regex_t *rx)
+{
+ if (rx->rc == 0)
+ regfree(&rx->rx);
+#ifdef USE_C_LOCALE
+ (void)uselocale(rx->old_lc_ctype);
+ freelocale(rx->c_lc_ctype);
+#endif
+}
+
+protected void
+file_regerror(file_regex_t *rx, int rc, struct magic_set *ms)
+{
+ char errmsg[512];
+
+ (void)regerror(rc, &rx->rx, errmsg, sizeof(errmsg));
+ file_magerror(ms, "regex error %d for `%s', (%s)", rc, rx->pat,
+ errmsg);
+}
-/* $NetBSD: fgetln.c,v 1.9 2008/04/29 06:53:03 martin Exp $ */
+/* $NetBSD: getline.c,v 1.2 2014/09/16 17:23:50 christos Exp $ */
/*-
* Copyright (c) 2011 The NetBSD Foundation, Inc.
for (ptr = *buf, eptr = *buf + *bufsiz;;) {
int c = fgetc(fp);
if (c == -1) {
- if (feof(fp))
- return ptr == *buf ? -1 : ptr - *buf;
- else
- return -1;
+ if (feof(fp)) {
+ ssize_t diff = (ssize_t)(ptr - *buf);
+ if (diff != 0) {
+ *ptr = '\0';
+ return diff;
+ }
+ }
+ return -1;
}
*ptr++ = c;
if (c == delimiter) {
size_t n = 0;
while ((len = getline(&p, &n, stdin)) != -1)
- (void)printf("%zd %s", len, p);
+ (void)printf("%" SIZE_T_FORMAT "d %s", len, p);
free(p);
return 0;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: magic.c,v 1.81 2013/11/29 15:42:51 christos Exp $")
+FILE_RCSID("@(#)$File: magic.c,v 1.85 2014/08/04 06:19:44 christos Exp $")
#endif /* lint */
#include "magic.h"
free(hmagicpath);
return MAGIC;
#else
- char *hmagicp = hmagicpath;
+ char *hmagicp;
char *tmppath = NULL;
+ hmagicpath = NULL;
#define APPENDPATH() \
do { \
private int
unreadable_info(struct magic_set *ms, mode_t md, const char *file)
{
- /* We cannot open it, but we were able to stat it. */
- if (access(file, W_OK) == 0)
- if (file_printf(ms, "writable, ") == -1)
- return -1;
- if (access(file, X_OK) == 0)
- if (file_printf(ms, "executable, ") == -1)
- return -1;
+ if (file) {
+ /* We cannot open it, but we were able to stat it. */
+ if (access(file, W_OK) == 0)
+ if (file_printf(ms, "writable, ") == -1)
+ return -1;
+ if (access(file, X_OK) == 0)
+ if (file_printf(ms, "executable, ") == -1)
+ return -1;
+ }
if (S_ISREG(md))
if (file_printf(ms, "regular file, ") == -1)
return -1;
return file_apprentice(ms, magicfile, FILE_LOAD);
}
+#ifndef COMPILE_ONLY
+/*
+ * Install a set of compiled magic buffers.
+ */
+public int
+magic_load_buffers(struct magic_set *ms, void **bufs, size_t *sizes,
+ size_t nbufs)
+{
+ if (ms == NULL)
+ return -1;
+ return buffer_apprentice(ms, (struct magic **)bufs, sizes, nbufs);
+}
+#endif
+
public int
magic_compile(struct magic_set *ms, const char *magicfile)
{
int ispipe = 0;
off_t pos = (off_t)-1;
+ if (file_reset(ms) == -1)
+ goto out;
+
/*
* one extra for terminating '\0', and
* some overlapping space for matches near EOF
if ((buf = CAST(unsigned char *, malloc(HOWMANY + SLOP))) == NULL)
return NULL;
- if (file_reset(ms) == -1)
- goto done;
-
switch (file_fsmagic(ms, inname, &sb)) {
case -1: /* error */
goto done;
goto done;
}
+#ifdef WIN32
+ /* Place stdin in binary mode, so EOF (Ctrl+Z) doesn't stop early. */
+ if (fd == STDIN_FILENO)
+ _setmode(STDIN_FILENO, O_BINARY);
+#endif
+
if (inname == NULL) {
if (fstat(fd, &sb) == 0 && S_ISFIFO(sb.st_mode))
ispipe = 1;
errno = 0;
if ((fd = open(inname, flags)) < 0) {
+#ifdef WIN32
+ /*
+ * Can't stat, can't open. It may have been opened in
+ * fsmagic, so if the user doesn't have read permission,
+ * allow it to say so; otherwise an error was probably
+ * displayed in fsmagic.
+ */
+ if (!okstat && errno == EACCES) {
+ sb.st_mode = S_IFBLK;
+ okstat = 1;
+ }
+#endif
if (okstat &&
unreadable_info(ms, sb.st_mode, inname) == -1)
goto done;
}
} else {
- if ((nbytes = read(fd, (char *)buf, HOWMANY)) == -1) {
- file_error(ms, errno, "cannot read `%s'", inname);
+ /* Windows refuses to read from a big console buffer. */
+ size_t howmany =
+#if defined(WIN32) && HOWMANY > 8 * 1024
+ _isatty(fd) ? 8 * 1024 :
+#endif
+ HOWMANY;
+ if ((nbytes = read(fd, (char *)buf, howmany)) == -1) {
+ if (inname == NULL && fd != STDIN_FILENO)
+ file_error(ms, errno, "cannot read fd %d", fd);
+ else
+ file_error(ms, errno, "cannot read `%s'",
+ inname == NULL ? "/dev/stdin" : inname);
goto done;
}
}
if (pos != (off_t)-1)
(void)lseek(fd, pos, SEEK_SET);
close_and_restore(ms, inname, fd, &sb);
+out:
return rv == 0 ? file_getbuffer(ms) : NULL;
}
#define MAGIC_NO_CHECK_FORTRAN 0x000000 /* Don't check ascii/fortran */
#define MAGIC_NO_CHECK_TROFF 0x000000 /* Don't check ascii/troff */
-#define MAGIC_VERSION 517 /* This implementation */
+#define MAGIC_VERSION 519 /* This implementation */
#ifdef __cplusplus
int magic_version(void);
int magic_load(magic_t, const char *);
+int magic_load_buffers(struct magic_set *, void **, size_t *, size_t);
+
int magic_compile(magic_t, const char *);
int magic_check(magic_t, const char *);
int magic_list(magic_t, const char *);
int magic_version(void);
int magic_load(magic_t, const char *);
+int magic_load_buffers(struct magic_set *, void **, size_t *, size_t);
+
int magic_compile(magic_t, const char *);
int magic_check(magic_t, const char *);
int magic_list(magic_t, const char *);
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: pread.c,v 1.2 2013/04/02 16:23:07 christos Exp $")
+FILE_RCSID("@(#)$File: pread.c,v 1.3 2014/09/15 19:11:25 christos Exp $")
#endif /* lint */
#include <fcntl.h>
#include <unistd.h>
ssize_t
pread(int fd, void *buf, size_t len, off_t off) {
- if (lseek(fd, off, SEEK_SET) == (off_t)-1)
+ off_t old;
+ ssize_t rv;
+
+ if ((old = lseek(fd, off, SEEK_SET)) == -1)
+ return -1;
+
+ if ((rv = read(fd, buf, len)) == -1)
+ return -1;
+
+ if (lseek(fd, old, SEEK_SET) == -1)
return -1;
- return read(fd, buf, len);
+ return rv;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: readcdf.c,v 1.40 2014/03/06 15:23:33 christos Exp $")
+FILE_RCSID("@(#)$File: readcdf.c,v 1.48 2014/09/10 18:41:51 christos Exp $")
#endif
#include <assert.h>
#include <string.h>
#include <time.h>
#include <ctype.h>
-#if defined(HAVE_LOCALE_H)
-#include <locale.h>
-#endif
#include "cdf.h"
#include "magic.h"
const char *mime;
} clsid2mime[] = {
{
- { 0x00000000000c1084LLU, 0x46000000000000c0LLU },
+ { 0x00000000000c1084LLU, 0x46000000000000c0LLU },
"x-msi",
- }
+ },
+ { { 0, 0 },
+ NULL,
+ },
}, clsid2desc[] = {
{
- { 0x00000000000c1084LLU, 0x46000000000000c0LLU },
+ { 0x00000000000c1084LLU, 0x46000000000000c0LLU },
"MSI Installer",
},
+ { { 0, 0 },
+ NULL,
+ },
};
private const char *
{
size_t i;
const char *rv = NULL;
- char *old_lc_ctype;
+#ifdef USE_C_LOCALE
+ locale_t old_lc_ctype, c_lc_ctype;
- old_lc_ctype = setlocale(LC_CTYPE, NULL);
+ c_lc_ctype = newlocale(LC_CTYPE_MASK, "C", 0);
+ assert(c_lc_ctype != NULL);
+ old_lc_ctype = uselocale(c_lc_ctype);
assert(old_lc_ctype != NULL);
- old_lc_ctype = strdup(old_lc_ctype);
- assert(old_lc_ctype != NULL);
- (void)setlocale(LC_CTYPE, "C");
+#endif
for (i = 0; nv[i].pattern != NULL; i++)
if (strcasestr(vbuf, nv[i].pattern) != NULL) {
rv = nv[i].mime;
break;
}
- (void)setlocale(LC_CTYPE, old_lc_ctype);
- free(old_lc_ctype);
+#ifdef USE_C_LOCALE
+ (void)uselocale(old_lc_ctype);
+ freelocale(c_lc_ctype);
+#endif
return rv;
}
private int
cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
- size_t count, const uint64_t clsid[2])
+ size_t count, const cdf_directory_t *root_storage)
{
size_t i;
cdf_timestamp_t tp;
const char *s;
int len;
- if (!NOTMIME(ms))
- str = cdf_clsid_to_mime(clsid, clsid2mime);
+ if (!NOTMIME(ms) && root_storage)
+ str = cdf_clsid_to_mime(root_storage->d_storage_uuid,
+ clsid2mime);
for (i = 0; i < count; i++) {
cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
if (info[i].pi_type == CDF_LENGTH32_WSTRING)
k++;
s = info[i].pi_str.s_buf;
- for (j = 0; j < sizeof(vbuf) && len--;
- j++, s += k) {
+ for (j = 0; j < sizeof(vbuf) && len--; s += k) {
if (*s == '\0')
break;
if (isprint((unsigned char)*s))
- vbuf[j] = *s;
+ vbuf[j++] = *s;
}
if (j == sizeof(vbuf))
--j;
}
private int
+cdf_file_catalog(struct magic_set *ms, const cdf_header_t *h,
+ const cdf_stream_t *sst)
+{
+ cdf_catalog_t *cat;
+ size_t i;
+ char buf[256];
+ cdf_catalog_entry_t *ce;
+
+ if (NOTMIME(ms)) {
+ if (file_printf(ms, "Microsoft Thumbs.db [") == -1)
+ return -1;
+ if (cdf_unpack_catalog(h, sst, &cat) == -1)
+ return -1;
+ ce = cat->cat_e;
+ /* skip first entry since it has a , or paren */
+ for (i = 1; i < cat->cat_num; i++)
+ if (file_printf(ms, "%s%s",
+ cdf_u16tos8(buf, ce[i].ce_namlen, ce[i].ce_name),
+ i == cat->cat_num - 1 ? "]" : ", ") == -1) {
+ free(cat);
+ return -1;
+ }
+ free(cat);
+ } else {
+ if (file_printf(ms, "application/CDFV2") == -1)
+ return -1;
+ }
+ return 1;
+}
+
+private int
cdf_file_summary_info(struct magic_set *ms, const cdf_header_t *h,
- const cdf_stream_t *sst, const uint64_t clsid[2])
+ const cdf_stream_t *sst, const cdf_directory_t *root_storage)
{
cdf_summary_info_header_t si;
cdf_property_info_t *info;
return -2;
break;
}
- str = cdf_clsid_to_mime(clsid, clsid2desc);
- if (str)
- if (file_printf(ms, ", %s", str) == -1)
- return -2;
- }
+ if (root_storage) {
+ str = cdf_clsid_to_mime(root_storage->d_storage_uuid,
+ clsid2desc);
+ if (str) {
+ if (file_printf(ms, ", %s", str) == -1)
+ return -2;
+ }
+ }
+ }
- m = cdf_file_property_info(ms, info, count, clsid);
+ m = cdf_file_property_info(ms, info, count, root_storage);
free(info);
return m == -1 ? -2 : m;
}
#endif
+ if ((i = cdf_read_user_stream(&info, &h, &sat, &ssat, &sst, &dir,
+ "FileHeader", &scn)) != -1) {
+#define HWP5_SIGNATURE "HWP Document File"
+ if (scn.sst_dirlen >= sizeof(HWP5_SIGNATURE) - 1
+ && memcmp(scn.sst_tab, HWP5_SIGNATURE,
+ sizeof(HWP5_SIGNATURE) - 1) == 0) {
+ if (NOTMIME(ms)) {
+ if (file_printf(ms,
+ "Hangul (Korean) Word Processor File 5.x") == -1)
+ return -1;
+ } else {
+ if (file_printf(ms, "application/x-hwp") == -1)
+ return -1;
+ }
+ i = 1;
+ goto out5;
+ } else {
+ free(scn.sst_tab);
+ scn.sst_tab = NULL;
+ scn.sst_len = 0;
+ scn.sst_dirlen = 0;
+ }
+ }
+
if ((i = cdf_read_summary_info(&info, &h, &sat, &ssat, &sst, &dir,
&scn)) == -1) {
if (errno == ESRCH) {
- corrupt = expn;
- expn = "No summary info";
+ if ((i = cdf_read_catalog(&info, &h, &sat, &ssat, &sst,
+ &dir, &scn)) == -1) {
+ corrupt = expn;
+ if ((i = cdf_read_encrypted_package(&info, &h,
+ &sat, &ssat, &sst, &dir, &scn)) == -1)
+ expn = "No summary info";
+ else {
+ expn = "Encrypted";
+ i = -1;
+ }
+ goto out4;
+ }
+#ifdef CDF_DEBUG
+ cdf_dump_catalog(&h, &scn);
+#endif
+ if ((i = cdf_file_catalog(ms, &h, &scn))
+ < 0)
+ expn = "Can't expand catalog";
} else {
expn = "Cannot read summary info";
}
#ifdef CDF_DEBUG
cdf_dump_summary_info(&h, &scn);
#endif
- if ((i = cdf_file_summary_info(ms, &h, &scn,
- root_storage->d_storage_uuid)) < 0)
- expn = "Can't expand summary_info";
+ if ((i = cdf_file_summary_info(ms, &h, &scn, root_storage)) < 0)
+ expn = "Can't expand summary_info";
if (i == 0) {
const char *str = NULL;
i = 1;
}
}
+out5:
free(scn.sst_tab);
out4:
free(sst.sst_tab);
if (file_printf(ms, ", %s%s", corrupt, expn) == -1)
return -1;
} else {
- if (file_printf(ms, "application/CDFV2-corrupt") == -1)
+ if (file_printf(ms, "application/CDFV2-%s",
+ *corrupt ? "corrupt" : "encrypted") == -1)
return -1;
}
i = 1;
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.102 2014/03/11 21:00:13 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.103 2014/05/02 02:25:10 christos Exp $")
#endif
#ifdef BUILTIN_ELF
file_badread(ms);
return -1;
}
+ if (cbuf[0] == 'A') {
+#ifdef notyet
+ char *p = cbuf + 1;
+ uint32_t len, tag;
+ memcpy(&len, p, sizeof(len));
+ p += 4;
+ len = getu32(swap, len);
+ if (memcmp("gnu", p, 3) != 0) {
+ if (file_printf(ms,
+ ", unknown capability %.3s", p)
+ == -1)
+ return -1;
+ break;
+ }
+ p += strlen(p) + 1;
+ tag = *p++;
+ memcpy(&len, p, sizeof(len));
+ p += 4;
+ len = getu32(swap, len);
+ if (tag != 1) {
+ if (file_printf(ms, ", unknown gnu"
+ " capability tag %d", tag)
+ == -1)
+ return -1;
+ break;
+ }
+ // gnu attributes
+#endif
+ break;
+ }
(void)memcpy(xcap_addr, cbuf, xcap_sizeof);
switch (xcap_tag) {
case CA_SUNW_NULL:
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.180 2014/03/15 21:47:40 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.195 2014/09/24 19:49:07 christos Exp $")
#endif /* lint */
#include "magic.h"
-#define F(a, b) fmtcheck((a), (b))
#include <assert.h>
#include <string.h>
#include <ctype.h>
#include <stdlib.h>
#include <time.h>
-#if defined(HAVE_LOCALE_H)
-#include <locale.h>
-#endif
-
private int match(struct magic_set *, struct magic *, uint32_t,
const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
private int32_t moffset(struct magic_set *, struct magic *);
private void mdebug(uint32_t, const char *, size_t);
private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
- const unsigned char *, uint32_t, size_t, size_t);
+ const unsigned char *, uint32_t, size_t, struct magic *);
private int mconvert(struct magic_set *, struct magic *, int);
private int print_sep(struct magic_set *, int);
private int handle_annotation(struct magic_set *, struct magic *);
{
struct mlist *ml;
int rv, printed_something = 0, need_separator = 0;
+
for (ml = ms->mlist[0]->next; ml != ms->mlist[0]; ml = ml->next)
if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, 0, mode,
text, 0, level, &printed_something, &need_separator,
return 0;
}
+#define FILE_FMTDEBUG
+#ifdef FILE_FMTDEBUG
+#define F(a, b, c) file_fmtcheck((a), (b), (c), __FILE__, __LINE__)
+
+private const char * __attribute__((__format_arg__(3)))
+file_fmtcheck(struct magic_set *ms, const struct magic *m, const char *def,
+ const char *file, size_t line)
+{
+ const char *ptr = fmtcheck(m->desc, def);
+ if (ptr == def)
+ file_magerror(ms,
+ "%s, %" SIZE_T_FORMAT "u: format `%s' does not match"
+ " with `%s'", file, line, m->desc, def);
+ return ptr;
+}
+#else
+#define F(a, b, c) fmtcheck((b)->desc, (c))
+#endif
+
/*
* Go through the whole list, stopping if you find a match. Process all
* the continuations of that match before returning.
if (file_check_mem(ms, ++cont_level) == -1)
return -1;
- while (magic[magindex+1].cont_level != 0 &&
- ++magindex < nmagic) {
- m = &magic[magindex];
+ while (magindex + 1 < nmagic &&
+ magic[magindex + 1].cont_level != 0) {
+ m = &magic[++magindex];
ms->line = m->lineno; /* for messages */
if (cont_level < m->cont_level)
private int
check_fmt(struct magic_set *ms, struct magic *m)
{
- regex_t rx;
+ file_regex_t rx;
int rc, rv = -1;
- char *old_lc_ctype;
if (strchr(m->desc, '%') == NULL)
return 0;
- old_lc_ctype = setlocale(LC_CTYPE, NULL);
- assert(old_lc_ctype != NULL);
- old_lc_ctype = strdup(old_lc_ctype);
- assert(old_lc_ctype != NULL);
- (void)setlocale(LC_CTYPE, "C");
- rc = regcomp(&rx, "%[-0-9\\.]*s", REG_EXTENDED|REG_NOSUB);
+ rc = file_regcomp(&rx, "%[-0-9\\.]*s", REG_EXTENDED|REG_NOSUB);
if (rc) {
- char errmsg[512];
- (void)regerror(rc, &rx, errmsg, sizeof(errmsg));
- file_magerror(ms, "regex error %d, (%s)", rc, errmsg);
+ file_regerror(&rx, rc, ms);
} else {
- rc = regexec(&rx, m->desc, 0, 0, 0);
- regfree(&rx);
+ rc = file_regexec(&rx, m->desc, 0, 0, 0);
rv = !rc;
}
- (void)setlocale(LC_CTYPE, old_lc_ctype);
- free(old_lc_ctype);
+ file_regfree(&rx);
return rv;
}
case -1:
return -1;
case 1:
- (void)snprintf(buf, sizeof(buf), "%c",
+ (void)snprintf(buf, sizeof(buf), "%d",
(unsigned char)v);
- if (file_printf(ms, F(m->desc, "%s"), buf) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), buf) == -1)
return -1;
break;
default:
- if (file_printf(ms, F(m->desc, "%c"),
+ if (file_printf(ms, F(ms, m, "%d"),
(unsigned char) v) == -1)
return -1;
break;
case -1:
return -1;
case 1:
- (void)snprintf(buf, sizeof(buf), "%hu",
+ (void)snprintf(buf, sizeof(buf), "%u",
(unsigned short)v);
- if (file_printf(ms, F(m->desc, "%s"), buf) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), buf) == -1)
return -1;
break;
default:
- if (file_printf(ms, F(m->desc, "%hu"),
+ if (file_printf(ms, F(ms, m, "%u"),
(unsigned short) v) == -1)
return -1;
break;
case -1:
return -1;
case 1:
- (void)snprintf(buf, sizeof(buf), "%u", (uint32_t)v);
- if (file_printf(ms, F(m->desc, "%s"), buf) == -1)
+ (void)snprintf(buf, sizeof(buf), "%u", (uint32_t) v);
+ if (file_printf(ms, F(ms, m, "%s"), buf) == -1)
return -1;
break;
default:
- if (file_printf(ms, F(m->desc, "%u"),
- (uint32_t) v) == -1)
+ if (file_printf(ms, F(ms, m, "%u"), (uint32_t) v) == -1)
return -1;
break;
}
case -1:
return -1;
case 1:
- (void)snprintf(buf, sizeof(buf), "%llu",
+ (void)snprintf(buf, sizeof(buf), "%" INT64_T_FORMAT "u",
(unsigned long long)v);
- if (file_printf(ms, F(m->desc, "%s"), buf) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), buf) == -1)
return -1;
break;
default:
- if (file_printf(ms, F(m->desc, "%llu"),
+ if (file_printf(ms, F(ms, m, "%" INT64_T_FORMAT "u"),
(unsigned long long) v) == -1)
return -1;
break;
case FILE_BESTRING16:
case FILE_LESTRING16:
if (m->reln == '=' || m->reln == '!') {
- if (file_printf(ms, F(m->desc, "%s"), m->value.s) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), m->value.s) == -1)
return -1;
t = ms->offset + m->vallen;
}
*++last = '\0';
}
- if (file_printf(ms, F(m->desc, "%s"), str) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), str) == -1)
return -1;
if (m->type == FILE_PSTRING)
case FILE_BEDATE:
case FILE_LEDATE:
case FILE_MEDATE:
- if (file_printf(ms, F(m->desc, "%s"),
- file_fmttime(p->l, FILE_T_LOCAL, tbuf)) == -1)
+ if (file_printf(ms, F(ms, m, "%s"),
+ file_fmttime(p->l + m->num_mask, FILE_T_LOCAL, tbuf)) == -1)
return -1;
t = ms->offset + sizeof(uint32_t);
break;
case FILE_BELDATE:
case FILE_LELDATE:
case FILE_MELDATE:
- if (file_printf(ms, F(m->desc, "%s"),
- file_fmttime(p->l, 0, tbuf)) == -1)
+ if (file_printf(ms, F(ms, m, "%s"),
+ file_fmttime(p->l + m->num_mask, 0, tbuf)) == -1)
return -1;
t = ms->offset + sizeof(uint32_t);
break;
case FILE_QDATE:
case FILE_BEQDATE:
case FILE_LEQDATE:
- if (file_printf(ms, F(m->desc, "%s"),
- file_fmttime(p->q, FILE_T_LOCAL, tbuf)) == -1)
+ if (file_printf(ms, F(ms, m, "%s"),
+ file_fmttime(p->q + m->num_mask, FILE_T_LOCAL, tbuf)) == -1)
return -1;
t = ms->offset + sizeof(uint64_t);
break;
case FILE_QLDATE:
case FILE_BEQLDATE:
case FILE_LEQLDATE:
- if (file_printf(ms, F(m->desc, "%s"),
- file_fmttime(p->q, 0, tbuf)) == -1)
+ if (file_printf(ms, F(ms, m, "%s"),
+ file_fmttime(p->q + m->num_mask, 0, tbuf)) == -1)
return -1;
t = ms->offset + sizeof(uint64_t);
break;
case FILE_QWDATE:
case FILE_BEQWDATE:
case FILE_LEQWDATE:
- if (file_printf(ms, F(m->desc, "%s"),
- file_fmttime(p->q, FILE_T_WINDOWS, tbuf)) == -1)
+ if (file_printf(ms, F(ms, m, "%s"),
+ file_fmttime(p->q + m->num_mask, FILE_T_WINDOWS, tbuf)) == -1)
return -1;
t = ms->offset + sizeof(uint64_t);
break;
return -1;
case 1:
(void)snprintf(buf, sizeof(buf), "%g", vf);
- if (file_printf(ms, F(m->desc, "%s"), buf) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), buf) == -1)
return -1;
break;
default:
- if (file_printf(ms, F(m->desc, "%g"), vf) == -1)
+ if (file_printf(ms, F(ms, m, "%g"), vf) == -1)
return -1;
break;
}
return -1;
case 1:
(void)snprintf(buf, sizeof(buf), "%g", vd);
- if (file_printf(ms, F(m->desc, "%s"), buf) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), buf) == -1)
return -1;
break;
default:
- if (file_printf(ms, F(m->desc, "%g"), vd) == -1)
+ if (file_printf(ms, F(ms, m, "%g"), vd) == -1)
return -1;
break;
}
file_oomem(ms, ms->search.rm_len);
return -1;
}
- rval = file_printf(ms, F(m->desc, "%s"), cp);
+ rval = file_printf(ms, F(ms, m, "%s"), cp);
free(cp);
if (rval == -1)
}
case FILE_SEARCH:
- if (file_printf(ms, F(m->desc, "%s"), m->value.s) == -1)
+ if (file_printf(ms, F(ms, m, "%s"), m->value.s) == -1)
return -1;
if ((m->str_flags & REGEX_OFFSET_START))
t = ms->search.offset;
mconvert(struct magic_set *ms, struct magic *m, int flip)
{
union VALUETYPE *p = &ms->ms_value;
+ uint8_t type;
- switch (cvt_flip(m->type, flip)) {
+ switch (type = cvt_flip(m->type, flip)) {
case FILE_BYTE:
cvt_8(p, m);
return 1;
return 1;
}
case FILE_PSTRING: {
- char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+ size_t sz = file_pstring_length_size(m);
+ char *ptr1 = p->s, *ptr2 = ptr1 + sz;
size_t len = file_pstring_get_length(m, ptr1);
- if (len >= sizeof(p->s))
- len = sizeof(p->s) - 1;
+ if (len >= sizeof(p->s)) {
+ /*
+ * The size of the pascal string length (sz)
+ * is 1, 2, or 4. We need at least 1 byte for NUL
+ * termination, but we've already truncated the
+ * string by p->s, so we need to deduct sz.
+ */
+ len = sizeof(p->s) - sz;
+ }
while (len--)
*ptr1++ = *ptr2++;
*ptr1 = '\0';
case FILE_BELDATE:
p->l = (int32_t)
((p->hl[0]<<24)|(p->hl[1]<<16)|(p->hl[2]<<8)|(p->hl[3]));
- cvt_32(p, m);
+ if (type == FILE_BELONG)
+ cvt_32(p, m);
return 1;
case FILE_BEQUAD:
case FILE_BEQDATE:
((uint64_t)p->hq[2]<<40)|((uint64_t)p->hq[3]<<32)|
((uint64_t)p->hq[4]<<24)|((uint64_t)p->hq[5]<<16)|
((uint64_t)p->hq[6]<<8)|((uint64_t)p->hq[7]));
- cvt_64(p, m);
+ if (type == FILE_BEQUAD)
+ cvt_64(p, m);
return 1;
case FILE_LESHORT:
p->h = (short)((p->hs[1]<<8)|(p->hs[0]));
case FILE_LELDATE:
p->l = (int32_t)
((p->hl[3]<<24)|(p->hl[2]<<16)|(p->hl[1]<<8)|(p->hl[0]));
- cvt_32(p, m);
+ if (type == FILE_LELONG)
+ cvt_32(p, m);
return 1;
case FILE_LEQUAD:
case FILE_LEQDATE:
((uint64_t)p->hq[5]<<40)|((uint64_t)p->hq[4]<<32)|
((uint64_t)p->hq[3]<<24)|((uint64_t)p->hq[2]<<16)|
((uint64_t)p->hq[1]<<8)|((uint64_t)p->hq[0]));
- cvt_64(p, m);
+ if (type == FILE_LEQUAD)
+ cvt_64(p, m);
return 1;
case FILE_MELONG:
case FILE_MEDATE:
case FILE_MELDATE:
p->l = (int32_t)
((p->hl[1]<<24)|(p->hl[0]<<16)|(p->hl[3]<<8)|(p->hl[2]));
- cvt_32(p, m);
+ if (type == FILE_MELONG)
+ cvt_32(p, m);
return 1;
case FILE_FLOAT:
cvt_float(p, m);
private void
mdebug(uint32_t offset, const char *str, size_t len)
{
- (void) fprintf(stderr, "mget/%zu @%d: ", len, offset);
+ (void) fprintf(stderr, "mget/%" SIZE_T_FORMAT "u @%d: ", len, offset);
file_showstr(stderr, str, len);
(void) fputc('\n', stderr);
(void) fputc('\n', stderr);
private int
mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
- const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+ const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
{
/*
* Note: FILE_SEARCH and FILE_REGEX do not actually copy
const char *last; /* end of search region */
const char *buf; /* start of search region */
const char *end;
- size_t lines;
+ size_t lines, linecnt, bytecnt;
if (s == NULL) {
ms->search.s_len = 0;
ms->search.s = NULL;
return 0;
}
+
+ if (m->str_flags & REGEX_LINE_COUNT) {
+ linecnt = m->str_range;
+ bytecnt = linecnt * 80;
+ } else {
+ linecnt = 0;
+ bytecnt = m->str_range;
+ }
+
+ if (bytecnt == 0)
+ bytecnt = 8192;
+ if (bytecnt > nbytes)
+ bytecnt = nbytes;
+
buf = RCAST(const char *, s) + offset;
- end = last = RCAST(const char *, s) + nbytes;
+ end = last = RCAST(const char *, s) + bytecnt;
/* mget() guarantees buf <= last */
for (lines = linecnt, b = buf; lines && b < end &&
((b = CAST(const char *,
b++;
}
if (lines)
- last = RCAST(const char *, s) + nbytes;
+ last = RCAST(const char *, s) + bytecnt;
ms->search.s = buf;
ms->search.s_len = last - buf;
int *need_separator, int *returnval)
{
uint32_t soffset, offset = ms->offset;
- uint32_t count = m->str_range;
+ uint32_t lhs;
int rv, oneed_separator, in_type;
char *sbuf, *rbuf;
union VALUETYPE *p = &ms->ms_value;
}
if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
- (uint32_t)nbytes, count) == -1)
+ (uint32_t)nbytes, m) == -1)
return -1;
if ((ms->flags & MAGIC_DEBUG) != 0) {
- fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
- "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- nbytes, count);
+ fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%"
+ SIZE_T_FORMAT "u, " "nbytes=%" SIZE_T_FORMAT "u)\n",
+ m->type, m->flag, offset, o, nbytes);
mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
#ifndef COMPILE_ONLY
file_mdump(m);
case FILE_BESHORT:
if (OFFSET_OOB(nbytes, offset, 2))
return 0;
+ lhs = (p->hs[0] << 8) | p->hs[1];
if (off) {
switch (m->in_op & FILE_OPS_MASK) {
case FILE_OPAND:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) &
- off;
+ offset = lhs & off;
break;
case FILE_OPOR:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) |
- off;
+ offset = lhs | off;
break;
case FILE_OPXOR:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) ^
- off;
+ offset = lhs ^ off;
break;
case FILE_OPADD:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) +
- off;
+ offset = lhs + off;
break;
case FILE_OPMINUS:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) -
- off;
+ offset = lhs - off;
break;
case FILE_OPMULTIPLY:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) *
- off;
+ offset = lhs * off;
break;
case FILE_OPDIVIDE:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) /
- off;
+ offset = lhs / off;
break;
case FILE_OPMODULO:
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1])) %
- off;
+ offset = lhs % off;
break;
}
} else
- offset = (short)((p->hs[0]<<8)|
- (p->hs[1]));
+ offset = lhs;
if (m->in_op & FILE_OPINVERSE)
offset = ~offset;
break;
case FILE_LESHORT:
if (OFFSET_OOB(nbytes, offset, 2))
return 0;
+ lhs = (p->hs[1] << 8) | p->hs[0];
if (off) {
switch (m->in_op & FILE_OPS_MASK) {
case FILE_OPAND:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) &
- off;
+ offset = lhs & off;
break;
case FILE_OPOR:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) |
- off;
+ offset = lhs | off;
break;
case FILE_OPXOR:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) ^
- off;
+ offset = lhs ^ off;
break;
case FILE_OPADD:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) +
- off;
+ offset = lhs + off;
break;
case FILE_OPMINUS:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) -
- off;
+ offset = lhs - off;
break;
case FILE_OPMULTIPLY:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) *
- off;
+ offset = lhs * off;
break;
case FILE_OPDIVIDE:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) /
- off;
+ offset = lhs / off;
break;
case FILE_OPMODULO:
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0])) %
- off;
+ offset = lhs % off;
break;
}
} else
- offset = (short)((p->hs[1]<<8)|
- (p->hs[0]));
+ offset = lhs;
if (m->in_op & FILE_OPINVERSE)
offset = ~offset;
break;
case FILE_BEID3:
if (OFFSET_OOB(nbytes, offset, 4))
return 0;
+ lhs = (p->hl[0] << 24) | (p->hl[1] << 16) |
+ (p->hl[2] << 8) | p->hl[3];
if (off) {
switch (m->in_op & FILE_OPS_MASK) {
case FILE_OPAND:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) &
- off;
+ offset = lhs & off;
break;
case FILE_OPOR:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) |
- off;
+ offset = lhs | off;
break;
case FILE_OPXOR:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) ^
- off;
+ offset = lhs ^ off;
break;
case FILE_OPADD:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) +
- off;
+ offset = lhs + off;
break;
case FILE_OPMINUS:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) -
- off;
+ offset = lhs - off;
break;
case FILE_OPMULTIPLY:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) *
- off;
+ offset = lhs * off;
break;
case FILE_OPDIVIDE:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) /
- off;
+ offset = lhs / off;
break;
case FILE_OPMODULO:
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3])) %
- off;
+ offset = lhs % off;
break;
}
} else
- offset = (int32_t)((p->hl[0]<<24)|
- (p->hl[1]<<16)|
- (p->hl[2]<<8)|
- (p->hl[3]));
+ offset = lhs;
if (m->in_op & FILE_OPINVERSE)
offset = ~offset;
break;
case FILE_LEID3:
if (OFFSET_OOB(nbytes, offset, 4))
return 0;
+ lhs = (p->hl[3] << 24) | (p->hl[2] << 16) |
+ (p->hl[1] << 8) | p->hl[0];
if (off) {
switch (m->in_op & FILE_OPS_MASK) {
case FILE_OPAND:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) &
- off;
+ offset = lhs & off;
break;
case FILE_OPOR:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) |
- off;
+ offset = lhs | off;
break;
case FILE_OPXOR:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) ^
- off;
+ offset = lhs ^ off;
break;
case FILE_OPADD:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) +
- off;
+ offset = lhs + off;
break;
case FILE_OPMINUS:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) -
- off;
+ offset = lhs - off;
break;
case FILE_OPMULTIPLY:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) *
- off;
+ offset = lhs * off;
break;
case FILE_OPDIVIDE:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) /
- off;
+ offset = lhs / off;
break;
case FILE_OPMODULO:
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0])) %
- off;
+ offset = lhs % off;
break;
}
} else
- offset = (int32_t)((p->hl[3]<<24)|
- (p->hl[2]<<16)|
- (p->hl[1]<<8)|
- (p->hl[0]));
+ offset = lhs;
if (m->in_op & FILE_OPINVERSE)
offset = ~offset;
break;
case FILE_MELONG:
if (OFFSET_OOB(nbytes, offset, 4))
return 0;
+ lhs = (p->hl[1] << 24) | (p->hl[0] << 16) |
+ (p->hl[3] << 8) | p->hl[2];
if (off) {
switch (m->in_op & FILE_OPS_MASK) {
case FILE_OPAND:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) &
- off;
+ offset = lhs & off;
break;
case FILE_OPOR:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) |
- off;
+ offset = lhs | off;
break;
case FILE_OPXOR:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) ^
- off;
+ offset = lhs ^ off;
break;
case FILE_OPADD:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) +
- off;
+ offset = lhs + off;
break;
case FILE_OPMINUS:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) -
- off;
+ offset = lhs - off;
break;
case FILE_OPMULTIPLY:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) *
- off;
+ offset = lhs * off;
break;
case FILE_OPDIVIDE:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) /
- off;
+ offset = lhs / off;
break;
case FILE_OPMODULO:
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2])) %
- off;
+ offset = lhs % off;
break;
}
} else
- offset = (int32_t)((p->hl[1]<<24)|
- (p->hl[0]<<16)|
- (p->hl[3]<<8)|
- (p->hl[2]));
+ offset = lhs;
if (m->in_op & FILE_OPINVERSE)
offset = ~offset;
break;
if ((ms->flags & MAGIC_DEBUG) != 0)
fprintf(stderr, "indirect +offs=%u\n", offset);
}
- if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+ if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
return -1;
ms->offset = offset;
ms->offset = soffset;
if (rv == 1) {
if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
- file_printf(ms, F(m->desc, "%u"), offset) == -1) {
+ file_printf(ms, F(ms, m, "%u"), offset) == -1) {
free(rbuf);
return -1;
}
double dl, dv;
int matched;
union VALUETYPE *p = &ms->ms_value;
- char *old_lc_ctype;
switch (m->type) {
case FILE_BYTE:
break;
default:
- matched = 0;
file_magerror(ms, "cannot happen with float: invalid relation `%c'",
m->reln);
return -1;
break;
default:
- matched = 0;
file_magerror(ms, "cannot happen with double: invalid relation `%c'", m->reln);
return -1;
}
if (slen + idx > ms->search.s_len)
break;
- v = file_strncmp(m->value.s, ms->search.s + idx, slen, m->str_flags);
+ v = file_strncmp(m->value.s, ms->search.s + idx, slen,
+ m->str_flags);
if (v == 0) { /* found match */
ms->search.offset += idx;
break;
}
case FILE_REGEX: {
int rc;
- regex_t rx;
- char errmsg[512];
+ file_regex_t rx;
+ const char *search;
if (ms->search.s == NULL)
return 0;
- old_lc_ctype = setlocale(LC_CTYPE, NULL);
- assert(old_lc_ctype != NULL);
- old_lc_ctype = strdup(old_lc_ctype);
- assert(old_lc_ctype != NULL);
- (void)setlocale(LC_CTYPE, "C");
l = 0;
- rc = regcomp(&rx, m->value.s,
+ rc = file_regcomp(&rx, m->value.s,
REG_EXTENDED|REG_NEWLINE|
((m->str_flags & STRING_IGNORE_CASE) ? REG_ICASE : 0));
if (rc) {
- (void)regerror(rc, &rx, errmsg, sizeof(errmsg));
- file_magerror(ms, "regex error %d, (%s)",
- rc, errmsg);
+ file_regerror(&rx, rc, ms);
v = (uint64_t)-1;
- }
- else {
+ } else {
regmatch_t pmatch[1];
+ size_t slen = ms->search.s_len;
#ifndef REG_STARTEND
#define REG_STARTEND 0
- size_t l = ms->search.s_len - 1;
- char c = ms->search.s[l];
- ((char *)(intptr_t)ms->search.s)[l] = '\0';
+ char *copy;
+ if (slen != 0) {
+ copy = malloc(slen);
+ if (copy == NULL) {
+ file_error(ms, errno,
+ "can't allocate %" SIZE_T_FORMAT "u bytes",
+ slen);
+ return -1;
+ }
+ memcpy(copy, ms->search.s, slen);
+ copy[--slen] = '\0';
+ search = copy;
+ } else {
+ search = ms->search.s;
+ copy = NULL;
+ }
#else
+ search = ms->search.s;
pmatch[0].rm_so = 0;
- pmatch[0].rm_eo = ms->search.s_len;
+ pmatch[0].rm_eo = slen;
#endif
- rc = regexec(&rx, (const char *)ms->search.s,
+ rc = file_regexec(&rx, (const char *)search,
1, pmatch, REG_STARTEND);
#if REG_STARTEND == 0
- ((char *)(intptr_t)ms->search.s)[l] = c;
+ free(copy);
#endif
switch (rc) {
case 0:
break;
default:
- (void)regerror(rc, &rx, errmsg, sizeof(errmsg));
- file_magerror(ms, "regexec error %d, (%s)",
- rc, errmsg);
+ file_regerror(&rx, rc, ms);
v = (uint64_t)-1;
break;
}
- regfree(&rx);
}
- (void)setlocale(LC_CTYPE, old_lc_ctype);
- free(old_lc_ctype);
+ file_regfree(&rx);
if (v == (uint64_t)-1)
return -1;
break;
break;
default:
- matched = 0;
file_magerror(ms, "cannot happen: invalid relation `%c'",
m->reln);
return -1;
__RCSID("$NetBSD: strncasecmp.c,v 1.2 2007/06/04 18:19:27 christos Exp $");
#endif /* LIBC_SCCS and not lint */
+#include "file.h"
+
#include <assert.h>
#include <ctype.h>
#include <string.h>
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: vasprintf.c,v 1.10 2012/08/09 16:40:04 christos Exp $")
+FILE_RCSID("@(#)$File: vasprintf.c,v 1.12 2014/05/14 23:09:21 christos Exp $")
#endif /* lint */
#include <assert.h>
*/
static int core(xprintf_struct *s)
{
- size_t len, save_len;
+ size_t save_len;
char *dummy_base;
/* basic checks */
for (;;) {
/* up to end of source string */
if (*(s->src_string) == 0) {
- *(s->dest_string) = 0; /* final 0 */
- len = s->real_len + 1;
+ *(s->dest_string) = '\0'; /* final NUL */
break;
}
/* up to end of dest string */
if (s->real_len >= s->maxlen) {
- (s->buffer_base)[s->maxlen] = 0; /* final 0 */
- len = s->maxlen + 1;
+ (s->buffer_base)[s->maxlen] = '\0'; /* final NUL */
break;
}
}
/* for (v)asnprintf */
dummy_base = s->buffer_base;
- save_len = 0; /* just to avoid a compiler warning */
dummy_base = s->buffer_base + s->real_len;
save_len = s->real_len;
#ifdef __va_copy
__va_copy (s.vargs, vargs);
#else
- memcpy (&s.vargs, vargs, sizeof (va_list));
+ memcpy (&s.vargs, &vargs, sizeof (s.va_args));
#endif /* __va_copy */
#endif /* va_copy */
s.maxlen = (size_t)INT_MAX;
projects / platform / upstream / file.git / commitdiff