--- /dev/null
+autom4te.cache
+Makefile
+Makefile.in
+aclocal.m4
+config.guess
+config.h.in
+config.sub
+config.*.lineno
+configure
+configure.lineno
+depcomp
+install-sh
+ltmain.sh
+missing
+config.h
+config.log
+config.status
+libtool
+stamp-h1
+file-*.tar.gz
+.libs
+compile
+.git
+.gitignore
+.config_*.cache
--- /dev/null
+*~
+*.[oa]
+*.l[ao]
+
+.deps
+.libs
+
+Makefile
+Makefile.in
+
+/aclocal.m4
+/autom4te.cache
+/compile
+/config.cache
+/config.guess
+/config.h
+/config.h.in
+/config.log
+/config.status
+/config.sub
+/configure
+/depcomp
+/install-sh
+/libtool
+/ltmain.sh
+/m4
+/missing
+/stamp-h1
+
+/doc/file.1
+/doc/libmagic.3
+/doc/magic.4
+
+/magic/magic.mgc
+
+/src/file
+/src/magic.h
+
+/tests/test
--- /dev/null
+# $File: .travis.yml,v 1.7 2016/04/26 16:24:43 glen Exp $
+
+language: c
+
+os:
+ - linux
+ - osx
+
+compiler:
+ - gcc
+ - clang
+
+before_install:
+ - if [ "$TRAVIS_OS_NAME" = "linux" ]; then sudo apt-get update -qq; fi
+ - if [ "$TRAVIS_OS_NAME" = "linux" ]; then sudo apt-get install -qq automake libtool make python zlib1g-dev; fi
+
+script:
+ - autoreconf -f -i
+ - ./configure --disable-silent-rules
+ - make -j4
+ - make -C tests check
+
+notifications:
+ email:
+ recipients:
+ - file-tests@mx.gw.com
+ on_success: change
+ on_failure: always
+2019-12-16 21:11 Christos Zoulas <christos@zoulas.com>
+
+ * release 5.38
+
+2019-12-15 22:13 Christos Zoulas <christos@zoulas.com>
+ Document changes since the previous release:
+ - Always accept -S (no sandbox) even if we don't support sandboxing
+ - More syscalls elided for sandboxiing
+ - For ELF dynamic means having an interpreter not just PT_DYNAMIC
+ - Check for large ELF session header offset
+ - When saving and restoring a locale, keep the locale name in our
+ own storage.
+ - Add a flag to disable CSV file detection.
+ - Don't pass NULL/0 to memset to appease sanitizers.
+ - Avoid spurious prints when looks for extensions or apple strings
+ in fsmagic.
+ - Add builtin decompressors for xz and and bzip.
+ - Add a limit for the number of CDF elements.
+ - More checks for overflow in CDF.
+
2019-05-14 22:26 Christos Zoulas <christos@zoulas.com>
* release 5.37
## README for file(1) Command and the libmagic(3) library ##
- @(#) $File: README,v 1.57 2019/02/06 00:20:56 christos Exp $
+ @(#) $File: README,v 1.59 2019/09/19 01:04:01 christos Exp $
Mailing List: file@astron.com
Mailing List archives: http://mailman.astron.com/pipermail/file/
https://github.com/file/file
+We are continuously being fuzzed by OSS-FUZZ:
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:file
+
The major changes for 5.x are CDF file parsing, indirect magic, name/use
(recursion) and overhaul in mime and ascii encoding handling.
src/getline.c - replacement for OS's that don't have it.
src/getopt_long.c - replacement for OS's that don't have it.
src/gmtime_r.c - replacement for OS's that don't have it.
+src/is_csv.c - knows about Comma Separated Value file format (RFC 4180).
src/is_json.c - knows about JavaScript Object Notation format (RFC 8259).
src/is_tar.c, tar.h - knows about Tape ARchive format (courtesy John Gilmore).
src/localtime_r.c - replacement for OS's that don't have it.
# How to get started developing
-@(#) $File: README.DEVELOPER,v 1.5 2014/03/10 12:38:08 kim Exp $
+@(#) $File: README.DEVELOPER,v 1.7 2019/09/12 16:03:37 christos Exp $
## Auto files
automake \
libtool \
+### Mac OS X (HomeBrew)
+
+ brew install autoconf automake libtool
+
+Tested with:
+ autoconf 2.69
+ automake 1.16.1
+ libtool 2.4.6
dnl Process this file with autoconf to produce a configure script.
-AC_INIT([file],[5.37],[christos@astron.com])
+AC_INIT([file],[5.38],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
[AS_HELP_STRING([--disable-zlib], [disable zlib compression support @<:@default=auto@:>@])])
AC_MSG_RESULT($enable_zlib)
+AC_MSG_CHECKING(for bzlib support)
+AC_ARG_ENABLE([bzlib],
+[AS_HELP_STRING([--disable-bzlib], [disable bz2lib compression support @<:@default=auto@:>@])])
+AC_MSG_RESULT($enable_bzlib)
+
+AC_MSG_CHECKING(for xzlib support)
+AC_ARG_ENABLE([xzlib],
+[AS_HELP_STRING([--disable-xzlib], [disable liblzma/xz compression support @<:@default=auto@:>@])])
+AC_MSG_RESULT($enable_xzlib)
+
AC_MSG_CHECKING(for libseccomp support)
AC_ARG_ENABLE([libseccomp],
[AS_HELP_STRING([--disable-libseccomp], [disable libseccomp sandboxing @<:@default=auto@:>@])])
if test "$enable_zlib" != "no"; then
AC_CHECK_HEADERS(zlib.h)
fi
+if test "$enable_bzlib" != "no"; then
+ AC_CHECK_HEADERS(bzlib.h)
+fi
+if test "$enable_xzlib" != "no"; then
+ AC_CHECK_HEADERS(lzma.h)
+fi
AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[#include <signal.h>])
dnl Checks for typedefs, structures, and compiler characteristics.
-AC_C_CONST
AC_TYPE_OFF_T
AC_TYPE_SIZE_T
AC_CHECK_MEMBERS([struct stat.st_rdev])
if test "$enable_zlib" != "no"; then
AC_CHECK_LIB(z, gzopen)
fi
+if test "$enable_bzlib" != "no"; then
+ AC_CHECK_LIB(bz2, BZ2_bzCompressInit)
+fi
+if test "$enable_xzlib" != "no"; then
+ AC_CHECK_LIB(lzma, lzma_stream_decoder)
+fi
if test "$enable_libseccomp" != "no"; then
AC_CHECK_LIB(seccomp, seccomp_init)
fi
if test "$ac_cv_header_zlib_h$ac_cv_lib_z_gzopen" = "yesyes"; then
AC_DEFINE([ZLIBSUPPORT], 1, [Enable zlib compression support])
fi
+if test "$enable_bzlib" = "yes"; then
+ if test "$ac_cv_header_bzlib_h$ac_cv_lib_bz2_BZ2_bzCompressInit" != "yesyes"; then
+ AC_MSG_ERROR([bzlib support requested but not found])
+ fi
+fi
+if test "$ac_cv_header_bzlib_h$ac_cv_lib_bz2_BZ2_bzCompressInit" = "yesyes"; then
+ AC_DEFINE([BZLIBSUPPORT], 1, [Enable bzlib compression support])
+fi
+if test "$enable_xzlib" = "yes"; then
+ if test "$ac_cv_header_lzma_h$ac_cv_lib_lzma_lzma_stream_decoder" != "yesyes"; then
+ AC_MSG_ERROR([xzlib support requested but not found])
+ fi
+fi
+if test "$ac_cv_header_lzma_h$ac_cv_lib_lzma_lzma_stream_decoder" = "yesyes"; then
+ AC_DEFINE([XZLIBSUPPORT], 1, [Enable xzlib compression support])
+fi
AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile tests/Makefile doc/Makefile python/Makefile])
AC_OUTPUT
-.\" $File: file.man,v 1.135 2019/03/03 02:32:40 christos Exp $
-.Dd February 18, 2019
+.\" $File: file.man,v 1.138 2019/10/15 18:00:40 christos Exp $
+.Dd July 13, 2019
.Dt FILE __CSECTION__
.Os
.Sh NAME
Prints details of Compound Document Files.
.It compress
Checks for, and looks inside, compressed files.
+.It csv
+Checks Comma Separated Value files.
.It elf
Prints ELF file details, provided soft magic tests are enabled and the
elf magic is found.
option) comes first.
.It Fl l , Fl Fl list
Shows a list of patterns and their strength sorted descending by
-.Xr magic 4
+.Xr magic __FSECTION__
strength
which is used for the matching (see also the
.Fl k
is available, the
.Fl S
flag disables sandboxing which is enabled by default.
-This option is needed for file to execute external descompressing programs,
+This option is needed for file to execute external decompressing programs,
i.e. when the
.Fl z
flag is specified and the built-in decompressors are not available.
+On systems where sandboxing is not available, this option has no effect.
.It Fl v , Fl Fl version
Print the version of the program and exit.
.It Fl z , Fl Fl uncompress
-.\" $File: libmagic.man,v 1.44 2018/09/09 20:33:28 christos Exp $
+.\" $File: libmagic.man,v 1.45 2019/06/08 22:16:24 christos Exp $
.\"
.\" Copyright (c) Christos Zoulas 2003, 2018.
.\" All Rights Reserved.
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd August 18, 2018
+.Dd June 8, 2019
.Dt LIBMAGIC 3
.Os
.Sh NAME
.It Dv MAGIC_NO_CHECK_TOKENS
Don't look for known tokens inside ascii files.
.It Dv MAGIC_NO_CHECK_JSON
-Don't example JSON files.
+Don't examine JSON files.
+.It Dv MAGIC_NO_CHECK_CSV
+Don't examine CSV files.
.El
.Pp
The
-.\" $File: magic.man,v 1.96 2019/01/21 14:56:53 christos Exp $
+.\" $File: magic.man,v 1.97 2019/11/15 21:03:14 christos Exp $
.Dd January 21, 2019
.Dt MAGIC __FSECTION__
.Os
The first direct offset of the magic entry (at continuation level 0),
in which case it is interpreted an offset from end end of the file
going backwards.
-This works only when a file descriptor to the file is a available and it
+This works only when a file descriptor to the file is available and it
is a regular file.
.It
A continuation offset relative to the end of the last up-level field
.It Dv date
A four-byte value interpreted as a UNIX date.
.It Dv qdate
-A eight-byte value interpreted as a UNIX date.
+An eight-byte value interpreted as a UNIX date.
.It Dv ldate
A four-byte value interpreted as a UNIX-style date, but interpreted as
local time rather than UTC.
#------------------------------------------------------------
-# $File: android,v 1.12 2019/04/19 00:42:27 christos Exp $
+# $File: android,v 1.16 2019/11/15 21:03:14 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
# Android bootimg format
# From https://android.googlesource.com/\
# platform/system/core/+/master/mkbootimg/bootimg.h
+# https://github.com/djrbliss/loki/blob/master/loki.h#L43
0 string ANDROID! Android bootimg
->1024 string LOKI\01 \b, LOKI'd
+>1024 string LOKI \b, LOKI'd
+>>1028 lelong 0 \b (boot)
+>>1028 lelong 1 \b (recovery)
>8 lelong >0 \b, kernel
>>12 lelong >0 \b (0x%x)
>16 lelong >0 \b, ramdisk
0 string/b ANDROID\ BACKUP\n Android Backup
# maybe look for some more characteristics like linefeed '\n' or version
#>16 string \n
-# No mime-type defined offically
+# No mime-type defined officially
!:mime application/x-google-ab
!:ext ab
# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2)
# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
0 lelong 0x00080003 Android binary XML
+
+# Android cryptfs footer
+# From https://android.googlesource.com/\
+# platform/system/vold/+/refs/heads/master/cryptfs.h
+0 lelong 0xd0b5b1c4 Android cryptfs footer
+>4 leshort x \b, version: %d
+>6 leshort x \b.%d
#------------------------------------------------------------------------------
-# $File: animation,v 1.71 2019/04/19 00:42:27 christos Exp $
+# $File: animation,v 1.74 2019/10/29 01:06:20 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
# modified by Joerg Jenderek
# GRR the original test are too common for many DOS files
# so don't accept as MP3 until we've tested the rate
+# But also beat GEMDOS fonts
0 beshort&0xFFFE 0xFFFA
# rates
->2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps
-!:mime audio/mpeg
->2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps
+>2 byte&0xF0 !0
+>>2 byte&0xF0 !0xF0 MPEG ADTS, layer III, v1
+!:strength +20
!:mime audio/mpeg
+>2 byte&0xF0 0x10 \b, 32 kbps
+>2 byte&0xF0 0x20 \b, 40 kbps
+>2 byte&0xF0 0x30 \b, 48 kbps
+>2 byte&0xF0 0x40 \b, 56 kbps
+>2 byte&0xF0 0x50 \b, 64 kbps
+>2 byte&0xF0 0x60 \b, 80 kbps
+>2 byte&0xF0 0x70 \b, 96 kbps
+>2 byte&0xF0 0x80 \b, 112 kbps
+>2 byte&0xF0 0x90 \b, 128 kbps
+>2 byte&0xF0 0xA0 \b, 160 kbps
+>2 byte&0xF0 0xB0 \b, 192 kbps
+>2 byte&0xF0 0xC0 \b, 224 kbps
+>2 byte&0xF0 0xD0 \b, 256 kbps
+>2 byte&0xF0 0xE0 \b, 320 kbps
# timing
->2 byte&0x0C 0x00 \b, 44.1 kHz
->2 byte&0x0C 0x04 \b, 48 kHz
->2 byte&0x0C 0x08 \b, 32 kHz
+>2 byte&0x0C 0x00 \b, 44.1 kHz
+>2 byte&0x0C 0x04 \b, 48 kHz
+>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
->3 byte&0xC0 0x00 \b, Stereo
->3 byte&0xC0 0x40 \b, JntStereo
->3 byte&0xC0 0x80 \b, 2x Monaural
->3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+>3 byte&0xC0 0x00 \b, Stereo
+>3 byte&0xC0 0x40 \b, JntStereo
+>3 byte&0xC0 0x80 \b, 2x Monaural
+>3 byte&0xC0 0xC0 \b, Monaural
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M1A
0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
# Vivo video (Wolfram Kleff)
3 string \x0D\x0AVersion:Vivo Vivo video data
+# ABC (alembic.io 3d models)
+0 string 0gawa ABC 3d model
+
# VRML (Virtual Reality Modelling Language)
0 string/w #VRML\ V1.0\ ascii VRML 1 file
!:mime model/vrml
# Extension: .bik
# URL: https://wiki.multimedia.cx/index.php?title=Bink_Container
# From: <hoehle@users.sourceforge.net> 2008-07-18
-0 string BIK Bink Video
->3 regex =[a-z] rev.%s
+0 name bik
#>4 ulelong x size %d
>20 ulelong x \b, %d
>24 ulelong x \bx%d
#>>51 byte&0x10 0 FFT
#>>51 byte&0x10 !0 DCT
+0 string BIK
+>3 regex =[bdfghi] Bink Video rev.%s
+>>0 use bik
+
+0 string KB2
+>3 regex =[adfghi] Bink Video 2 rev.%s
+>>0 use bik
+
# Type: NUT Container
# URL: https://wiki.multimedia.cx/index.php?title=NUT
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
#------------------------------------------------------------------------------
-# $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $
+# $File: apple,v 1.44 2019/10/18 15:21:02 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
>>>>0xb06 pstring x \b, Volume %s:
>>>>0xb0e leshort x \b, %u Blocks
>>>>0xb10 leshort x \b, %u Files
+#
+# Diversi Dos boot loader?
+0 string \x01\xA8\xAD\x81\xC0\xEE\x09\x08\xAD
+>0x11001 string \x11\x0F\x03 Apple Diversi Dos Image
+>>0x11006 byte x \b, Volume %u
+>>0x11034 byte x \b, %u Tracks
+>>0x11035 byte x \b, %u Sectors
+>>0x11036 leshort x \b, %u bytes per sector
# Type: Apple Emulator 2IMG format
# From: Radek Vokal <rvokal@redhat.com>
# Update: Greg Wildman <greg@apple2.org.za>
-0 string 2IMG Apple ][ 2IMG Disk Image
->4 clear x
->4 string XGS! \b, XGS
->4 string CTKG \b, Catakig
->4 string ShIm \b, Sheppy's ImageMaker
->4 string SHEP \b, Sheppy's ImageMaker
->4 string WOOF \b, Sweet 16
->4 string B2TR \b, Bernie ][ the Rescue
->4 string \!nfc \b, ASIMOV2
->4 string \>BD\< \b, Brutal Deluxe's Cadius
->4 string CdrP \b, CiderPress
->4 string Vi][ \b, Virtual ][
->4 string PRFS \b, ProFUSE
->4 string FISH \b, FishWings
->4 string RVLW \b, Revival for Windows
->4 default x
->>4 string x \b, Creator tag "%-4.4s"
->0xc byte 00 \b, DOS 3.3 sector order
->>0x10 byte 00 \b, Volume 254
->>0x10 byte&0x7f x \b, Volume %u
->0xc byte 01 \b, ProDOS sector order
->>0x14 short x \b, %u Blocks
->0xc byte 02 \b, NIB data
+0 string 2IMG Apple ][ 2IMG Disk Image
+>4 clear x
+>4 string XGS! \b, XGS
+>4 string CTKG \b, Catakig
+>4 string ShIm \b, Sheppy's ImageMaker
+>4 string SHEP \b, Sheppy's ImageMaker
+>4 string WOOF \b, Sweet 16
+>4 string B2TR \b, Bernie ][ the Rescue
+>4 string \!nfc \b, ASIMOV2
+>4 string \>BD\< \b, Brutal Deluxe's Cadius
+>4 string CdrP \b, CiderPress
+>4 string Vi][ \b, Virtual ][
+>4 string PRFS \b, ProFUSE
+>4 string FISH \b, FishWings
+>4 string RVLW \b, Revival for Windows
+>4 default x
+>>4 string x \b, Creator tag "%-4.4s"
+>0xc byte 00 \b, DOS 3.3 sector order
+>>0x10 byte 00 \b, Volume 254
+>>0x10 byte&0x7f x \b, Volume %u
+>0xc byte 01 \b, ProDOS sector order
+# Detect Volume Directory block ($02) + 2mg header offset
+>>0x440 string \x00\x00\x03\x00
+>>>0x444 byte &0xF0
+>>>>0x445 string x \b, Volume /%s
+>>>>0x469 leshort x \b, %u Blocks
+>0xc byte 02 \b, NIB data
# magic for Newton PDA package formats
# from Ruda Moura <ruda@helllabs.org>
#------------------------------------------------------------------------------
-# $File: archive,v 1.129 2019/05/09 18:58:02 christos Exp $
+# $File: archive,v 1.133 2019/11/15 21:03:14 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
# NL terminated original package length
>>>>>&1 string x \b, unsplitted size %s
# NL terminated part length
->>>>>>&1 string x \b, part lenght %s
+>>>>>>&1 string x \b, part length %s
# NL terminated package part like n/m
>>>>>>>&1 string x \b, part %s
# NL terminated package architecture like armhf since dpkg 1.16.1 or later
# skip keyword with low entropy
>12 default x TTComp archive, binary, 4K dictionary
# (version 5.25) labeled the above entry as "TTComp archive data"
+# From: Joerg Jenderek
+# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification
+# reference: http://nulib.com/library/FTN.e00005.htm
+0x52 ubeshort 0x0100
+# test for disk size equal or above 400k
+>0x40 ubelong >409599 Apple DiskCopy 4.2 image
+#!:mime application/octet-stream
+!:apple dCpydImg
+!:ext image/dc42
+# image pascal name padded with NULs like Microsoft Mail
+>>00 pstring/B x %s
+# data size in bytes like 409600
+>>0x40 ubelong x \b, %u bytes
+# tag size in bytes
+>>0x44 ubelong >0 \b, 0x%x tag size
+# data checksum
+#>>0x48 ubelong x \b, 0x%x checksum
+# tag checksum
+#>>0x4c ubelong x \b, 0x%x tag checksum
+# disk encoding
+>>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
+>>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
+>>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
+>>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
+>>0x50 ubyte >3 \b, 0x%x encoding
+# format byte
+>>0x51 ubyte x \b, 0x%x format
+#>>0x54 ubequad x \b, data 0x%16.16llx
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
0 string ESP ESP archive data
# ZPack
>>50 string epub+zip EPUB document
!:mime application/epub+zip
+# From: Joerg Jenderek
+# URL: http://en.wikipedia.org/wiki/CorelDRAW
+# NOTE: version; til 2 WL-based; from 3 til 13 by ./riff; from 14 zip based
+>>50 string x-vnd.corel. Corel
+>>>62 string draw.document+zip Draw drawing, version 14-16
+!:mime application/x-vnd.corel.draw.document+zip
+!:ext cdr
+>>>62 string draw.template+zip Draw template, version 14-16
+!:mime application/x-vnd.corel.draw.template+zip
+!:ext cdrt
+>>>62 string zcf.draw.document+zip Draw drawing, version 17-21
+!:mime application/x-vnd.corel.zcf.draw.document+zip
+!:ext cdr
+>>>62 string zcf.draw.template+zip Draw template, version 17-21
+!:mime application/x-vnd.corel.zcf.draw.template+zip
+!:ext cdt/cdrt
+
# Catch other ZIP-with-mimetype formats
# In a ZIP file, the bytes immediately after a member's contents are
# always "PK". The 2 regex rules here print the "mimetype" member's
# contents up to the first 'P'. Luckily, most MIME types don't contain
# any capital 'P's. This is a kludge.
# (mimetype contains "application/<OTHER>")
->>50 string !epub+zip
->>>50 string !vnd.oasis.opendocument.
->>>>50 string !vnd.sun.xml.
->>>>>50 string !vnd.kde.
->>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
+>>50 default x Zip data
+>>>38 regex [!-OQ-~]+ (MIME type "%s"?)
!:mime application/zip
# (mimetype contents other than "application/*")
>26 string \x8\0\0\0mimetype
# Durval Menezes, <jmgthbfile at durval dot com>
0 string d13:announce-list BitTorrent file
!:mime application/x-bittorrent
+0 string d7:comment BitTorrent file
+!:mime application/x-bittorrent
+0 string d4:info BitTorrent file
+!:mime application/x-bittorrent
# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
0 beshort 0x0e0f Atari MSA archive data
#------------------------------------------------------------------------------
-# $File: audio,v 1.111 2019/05/08 18:02:45 christos Exp $
+# $File: audio,v 1.118 2019/11/19 05:30:07 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
0x2c string SCRM ScreamTracker III Module sound data
>0 string >\0 Title: "%s"
+!:mime audio/x-s3m
+
+# .stm before it got above .s3m extension
+0x16 string \!Scream\! ScreamTracker Module sound data
+>0 string >\0 Title: "%s"
# Gravis UltraSound patches
# From <ache@nagual.ru>
>21 byte x \b.%u
>20 byte x \b.%u
+0 string CC2x CheeseCutter 2 song
+
0 string RAWADATA RdosPlay RAW
1068 string RoR AMUSIC Adlib Tracker
1 string [licq] LICQ configuration file
# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
-0 string ICE! SNDH Atari ST music
+# NOTE: Most SNDH music is packed using ICE, which has
+# magic numbers "ICE!" and "Ice!". Some SNDH music is
+# not packed, so we check for both packed and unpacked.
+12 string SNDH SNDH Atari ST music
+0 belong&0xFFDFDFFF 0x49434521
+>14 search/40 NDH SNDH Atari ST music
+>14 search/40 TITL SNDH Atari ST music
0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
>>>>0x78 ubyte 0x03 AY-3-8930,
>>>>0x78 ubyte 0x10 YM2149,
>>>>0x78 ubyte 0x11 YM3439,
+>>>>0x78 ubyte 0x12 YMZ284,
+>>>>0x78 ubyte 0x13 YMZ294,
# VGM 1.61
>>0x34 ulelong >0x4C
>>>0x80 ulelong >0 DMG,
# Used for audio rips for various consoles.
# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format
# Added by David Korth <gerbilsoft@gerbilsoft.com>
-0 string PSF Portable Sound Format
+0 string PSF
+>3 byte 0x01
+>3 byte 0x02
+>3 byte 0x11
+>3 byte 0x12
+>3 byte 0x13
+>3 byte 0x21
+>3 byte 0x22
+>3 byte 0x23
+>3 byte 0x41
+>>0 string PSF Portable Sound Format
!:mime audio/x-psf
->3 byte 0x01 (Sony PlayStation)
->3 byte 0x02 (Sony PlayStation 2)
->3 byte 0x11 (Sega Saturn)
->3 byte 0x12 (Sega Dreamcast)
->3 byte 0x13 (Sega Mega Drive)
->3 byte 0x21 (Nintendo 64)
->3 byte 0x22 (Game Boy Advance)
->3 byte 0x23 (Super NES)
->3 byte 0x41 (Capcom QSound)
+>>>3 byte 0x01 (Sony PlayStation)
+>>>3 byte 0x02 (Sony PlayStation 2)
+>>>3 byte 0x11 (Sega Saturn)
+>>>3 byte 0x12 (Sega Dreamcast)
+>>>3 byte 0x13 (Sega Mega Drive)
+>>>3 byte 0x21 (Nintendo 64)
+>>>3 byte 0x22 (Game Boy Advance)
+>>>3 byte 0x23 (Super NES)
+>>>3 byte 0x41 (Capcom QSound)
# Atari 8-bit SAP audio format
# http://asap.sourceforge.net/sap-format.html
-# Chiasmus is a encryption standard developed by the German Federal
+# Chiasmus is an encryption standard developed by the German Federal
# Office for Information Security (Bundesamt fuer Sicherheit in der
# Informationstechnik).
#------------------------------------------------------------------------------
-# $File: c-lang,v 1.27 2019/02/27 16:46:23 christos Exp $
+# $File: c-lang,v 1.28 2019/11/15 21:03:14 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
# The strength is to beat standard HTML
!:mime text/x-bcpl
# C
-# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
+# Check for class if include is found, otherwise class is beaten by include because of lowered strength
0 search/8192 #include
>0 regex \^#include C
>>0 regex \^class[[:space:]]+
#------------------------------------------------------------------------------
-# $File: cad,v 1.19 2019/04/19 00:42:27 christos Exp $
+# $File: cad,v 1.20 2019/08/10 13:34:17 christos Exp $
# autocad: file(1) magic for cad files
#
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
-0 string \010\011\376 Microstation
->3 string \002
->>30 string \026\105 DGNFile
->>30 string \034\105 DGNFile
->>30 string \073\107 DGNFile
->>30 string \073\110 DGNFile
->>30 string \106\107 DGNFile
->>30 string \110\103 DGNFile
->>30 string \120\104 DGNFile
->>30 string \172\104 DGNFile
->>30 string \172\105 DGNFile
->>30 string \172\106 DGNFile
->>30 string \234\106 DGNFile
->>30 string \273\105 DGNFile
->>30 string \306\106 DGNFile
->>30 string \310\104 DGNFile
->>30 string \341\104 DGNFile
->>30 string \372\103 DGNFile
->>30 string \372\104 DGNFile
->>30 string \372\106 DGNFile
->>30 string \376\103 DGNFile
->4 string \030\000\000 CITFile
->4 string \030\000\003 CITFile
+#
+# URL: https://en.wikipedia.org/wiki/MicroStation
+# reference: http://dgnlib.maptools.org/dgn.html
+# http://dgnlib.maptools.org/dl/ref18.pdf
+# Update: Joerg Jenderek
+# Note: verfied by command like `dgndump seed2d_b.dgn`
+# test for level 8 and type 5 or 9
+0 beshort&0x3F73 0x0801
+# level of element like 8
+#>0 ubyte&0x3F x \b, level %u
+#>0 ubyte &0x80 \b, complex
+#>0 ubyte &0x40 \b, reserved
+# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements
+#>1 ubyte&0x7F x \b, type %u
+# words to follow in element: 17H~CEL libray 2FEh~DGN 9FEh,DFEh~CIT
+#>2 uleshort x \b, words 0x%4.4x to follow
+# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL)
+#>508 ubelong x \b, RESERVED %8.8x
+>508 ubelong&0xFFffFF00 =0
+# test for level 8 and type 9 for INGR raster image
+>>0 beshort 0x0809
+# test for length of 1st element is multiple of blocks a 512 bytes
+>>>2 ubyte 0xfe
+>>>>0 use ingr-image
+# test for DGN or CEL by jump words (uleshort) forward to next element
+>(2.s*2) ulong x
+# 2nd element type: 8~Digitizer~DesiGNfile 1~library cell header other~CIT
+#>>&1 ubyte&0x7F x \b, 2nd type %u
+# DGN
+>>&1 ubyte&0x7F 8
+>>>2 uleshort =0x02FE Bentley/Intergraph Microstation CAD drawing
+!:mime application/x-bentley-dgn
+!:ext dgn
+# The 0x40 bit of this byte is 1 if the file is 3D, otherwise 0
+>>>>1214 ubyte &0x40 3D
+>>>>1214 ubyte ^0x40 2D
+# 2 chars for name of subunits like ft FT in IN mu m mm '\0 '\040
+>>>>1120 string x \b, units %-.2s
+# 2 chars for name of master unit like IN in ML SU tn th TH HU mm "\0 "\040 \0\0
+>>>>1122 string >\0 %-.2s
+#>>>>1120 ubelong x \b, units 0x%8.8x
+# element range low,high x y z like xlow=0 08010000h 01080000h
+#>>>>4 ubelong !0 \b, xlow %8.8x
+#>>>>8 ubelong !0 \b, ylow %8.8x
+#>>>>12 ubelong !0 \b, zlow %8.8x
+#>>>>16 ubelong !0 \b, xhigh %8.8x
+#>>>>20 ubelong !0 \b, yhigh %8.8x
+#>>>>24 ubelong !0 \b, zhigh %8.8x
+# graphic group number; all other elements in that group have same non-0 number
+#>>>>28 leshort x \b, grphgrp 0x%4.4x
+# words to optional attribute linkage
+#>>>>30 ubyte x \b, attindx \%o
+#>>>>31 ubyte x \b\%o
+# >>30 string \026\105 DGNFile
+# >>30 string \034\105 DGNFile
+# >>30 string \073\107 DGNFile
+# >>30 string \073\110 DGNFile
+# >>30 string \106\107 DGNFile
+# >>30 string \110\103 DGNFile
+# >>30 string \120\104 DGNFile
+# >>30 string \172\104 DGNFile
+# >>30 string \172\105 DGNFile
+# >>30 string \172\106 DGNFile
+# >>30 string \234\106 DGNFile
+# >>30 string \273\105 DGNFile
+# >>30 string \306\106 DGNFile
+# >>30 string \310\104 DGNFile
+# >>30 string \341\104 DGNFile
+# >>30 string \372\103 DGNFile
+# >>30 string \372\104 DGNFile
+# >>30 string \372\106 DGNFile
+# >>30 string \376\103 DGNFile
+# elements properties indicator
+#>>>>32 uleshort !0 \b, properties 0x%4.4x
+# class 0~Primary
+#>>>>>32 uleshort&0x000F !0 \b, class 0x%4.4x
+# Symbology
+#>>>>>34 uleshort x \b, Symbology 0x%4.4x
+# test for 2nd element type 1~library cell header
+>>&1 ubyte&0x7F 1
+# test for 1st element with level 8 and type 5 for cell library
+>>>0 beshort 0x0805 Bentley/Intergraph Microstation CAD cell library
+!:mime application/x-bentley-cel
+!:ext cel
+#
+# URL: http://fileformats.archiveteam.org/wiki/Intergraph_Raster
+# reference: https://web.archive.org/web/20140903185431/
+# http://oreilly.com/www/centers/gff/formats/ingr/index.htm
+# note: verfied by command like `nconvert -fullinfo LONGLAT.CIT`
+# display information for intergraph raster bitmap
+0 name ingr-image
+# in 5.37 "Microstation CITFile" "Bentley/Intergraph MicroStation CIT raster CAD"
+# DataTypeCode indicates format, depth of the pixel data and used compression
+>4 uleshort x Intergraph raster image
+>>4 uleshort 0x0009 \b, Run-Length Encoded 1-bit
+!:mime image/x-intergraph-rle
+!:ext rel
+>>4 uleshort 0x0018 \b, CCITT Group 4 1-bit
+!:mime image/x-intergraph-cit
+!:ext cit
+>>4 uleshort 27 \b, Adaptive RLE RGB
+!:mime image/x-intergraph-rgb
+!:ext rgb
+>>4 default x
+>>>4 uleshort x \b, Type %u
+!:mime image/x-intergraph
+# TODO:
+#>4 uleshort 0 \b, no data
+# ...
+#>4 uleshort 0x0045 \b, Continuous Tone CMKY (Uncompressed)
+# ApplicationType: 0~generic raster image 3~drawing, scanning
+# 8~I/IMAGE and MicroStation Imager 9~ModelView
+>6 uleshort !0 \b, ApplicationType %u
+#>6 uleshort x \b, ApplicationType %u
+# XViewOrigin; Raster grid data X origin
+#>8 ulequad !0 \b, XViewOrigin %llx
+# PixelsPerLine is the number of pixels in a scan line of bitmapp
+>184 ulelong x \b, %u x
+# NumberOfLines is height of the raster data in scanlines
+>188 ulelong x %u
+# DeviceResolution; resolution of scanning device
+# positive indicates number of micros between lines; negative indicates DPI
+#>192 leshort x \b, DeviceResolution %d
+# ScanlineOrient indicates the origin and the orientation of the scan lines
+#>194 ubyte x \b, ScanlineOrient %x
+>194 ubyte x \b, orientation
+>194 ubyte &0x01 right
+>194 ubyte ^0x01 left
+>194 ubyte &0x02 down
+>194 ubyte ^0x02 top
+>194 ubyte &0x04 horizontal
+>194 ubyte ^0x04 vertical
+# ScannableFlag; Scanline indexing method used
+#>195 ubyte !0 \b, ScannableFlag 0x%x
+# RotationAngle; Rotation angle of raster data
+#>196 ubequad !0 \b, RotationAngle 0x%llx
+# SkewAngle; Skew angle of raster data
+#>204 ubequad !0 \b, SkewAngle %llx
+# DataTypeModifier; Additional raster data format info
+#>212 uleshort !0 \b, DataTypeModifier 0x%4.4x
+# DesignFile[66]; Name of the design file
+>214 string >\0 \b, DesignFile %-.66s
+# DatabaseFile[66]; Name of the database file
+>280 string >\0 \b, DatabaseFile %-.66s
+# ParentGridFile[66]; Name of parent grid file
+>346 string >\0 \b, ParentGridFile %-.66s
+# FileDescription[80]; Text description of file and contents
+>412 string >\0 \b, FileDescription %-.80s
+# MinValue
+#>492 ubequad !0 \b, MinValue 0x%llx
+# MaxValue
+#>500 ubequad !0 \b, MaxValue 0x%llx
+# Reserved[3]; Unused (always 0)
+#>508 ubelong&0xFFffFF00 x \b, RESERVED %8.8x
+# GridFileVersion; Grid File Version like 2 3
+#>511 ubyte x \b, GridFileVersion %x
# AutoCAD
# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg
# Phillip Griffith <phillip dot griffith at gmail dot com>
# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
#
-0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
-0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
-0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
-0 beshort 0x0809 Bentley/Intergraph MicroStation
->0x02 byte 0xfe
->>0x04 beshort 0x1800 CIT raster CAD
# 3DS (3d Studio files)
0 leshort 0x4d4d
#------------------------------------------------------------------------------
-# $File: commands,v 1.60 2019/04/19 00:42:27 christos Exp $
+# $File: commands,v 1.61 2019/10/30 03:16:43 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
!:mime text/x-shellscript
+0 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable
+!:mime text/x-shellscript
+
0 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable
!:mime text/x-shellscript
0 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable
#------------------------------------------------------------------------------
-# $File: compress,v 1.75 2019/04/19 00:42:27 christos Exp $
+# $File: compress,v 1.77 2019/10/08 20:25:13 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
>>>13 string 09 \b, version 9
# other gzipped binary like gzipped tar, VirtualBox extension package,...
>>10 default x gzip compressed data
+!:mime application/gzip
>>>0 use gzip-info
# size of the original (uncompressed) input data modulo 2^32
>>>-4 ulelong x \b, original size modulo 2^32 %u
# gzipped TAR or VirtualBox extension package
-!:mime application/gzip
#!:mime application/x-compressed-tar
#!:mime application/x-virtualbox-vbox-extpack
# https://www.w3.org/TR/SVG/mimereg.html
# Zstandard compressed data
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0 lelong 0xFD2FB522 Zstandard compressed data (v0.2)
-!:mime application/x-zstd
+!:mime application/zstd
0 lelong 0xFD2FB523 Zstandard compressed data (v0.3)
-!:mime application/x-zstd
+!:mime application/zstd
0 lelong 0xFD2FB524 Zstandard compressed data (v0.4)
-!:mime application/x-zstd
+!:mime application/zstd
0 lelong 0xFD2FB525 Zstandard compressed data (v0.5)
-!:mime application/x-zstd
+!:mime application/zstd
0 lelong 0xFD2FB526 Zstandard compressed data (v0.6)
-!:mime application/x-zstd
+!:mime application/zstd
0 lelong 0xFD2FB527 Zstandard compressed data (v0.7)
-!:mime application/x-zstd
+!:mime application/zstd
>4 use zstd-dictionary-id
0 lelong 0xFD2FB528 Zstandard compressed data (v0.8+)
-!:mime application/x-zstd
+!:mime application/zstd
>4 use zstd-dictionary-id
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0 lelong 0xEC30A437 Zstandard dictionary
-!:mime application/x-zstd-dictionary
+!:mime application/x-std-dictionary
>4 lelong x (ID %u)
# AFX compressed files (Wolfram Kleff)
#------------------------------------------------------------------------------
-# $File: console,v 1.45 2019/04/19 00:42:27 christos Exp $
+# $File: console,v 1.49 2019/05/27 01:33:32 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
0 string XBEH Microsoft Xbox executable
+!:mime audio/x-xbox-executable
+!:ext xbe
# expect base address of 0x10000
>0x0104 ulelong =0x10000
>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s"
0 name xbox-360-xex-execution-id
>(0.L+0xC) byte x (%c
>(0.L+0xD) byte x \b%c
->(0.L+0xE) beshort x \b-%04u)
+>(0.L+0xE) beshort x \b-%04u, media ID:
+>(0.L) belong x %08X)
+
+# Region code (part of Security Info)
+0 name xbox-360-xex-region-code
+>0 ubelong 0xFFFFFFFF \b, all regions
+>0 ubelong !0xFFFFFFFF
+>>0 ubelong >0 (regions:
+>>0 ubelong&0x000000FF 0x000000FF USA
+>>0 ubelong&0x00000100 0x00000100 Japan
+>>0 ubelong&0x00000200 0x00000200 China
+>>0 ubelong&0x0000FC00 0x0000FC00 Asia
+>>0 ubelong&0x00FF0000 0x00FF0000 PAL
+>>0 ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ]
+>>0 ubelong&0x00FF0000 0x00010000 AU/NZ
+>>0 ubelong&0xFF000000 0xFF000000 Other
+>>0 ubelong >0 \b)
0 string XEX2 Microsoft Xbox 360 executable
+!:mime audio/x-xbox360-executable
+!:ext xex
>0x18 search/0x100 \x00\x04\x00\x06
>>&0 use xbox-360-xex-execution-id
->(0x010.L+0x178) ubelong 0xFFFFFFFF \b, all regions
->(0x010.L+0x178) ubelong !0xFFFFFFFF
->>(0x010.L+0x178) ubelong >0 (regions:
->>(0x010.L+0x178) ubelong&0x000000FF 0x000000FF USA
->>(0x010.L+0x178) ubelong&0x00000100 0x00000100 Japan
->>(0x010.L+0x178) ubelong&0x00000200 0x00000200 China
->>(0x010.L+0x178) ubelong&0x0000FC00 0x0000FC00 Asia
->>(0x010.L+0x178) ubelong&0x00FF0000 0x00FF0000 PAL
->>(0x010.L+0x178) ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ]
->>(0x010.L+0x178) ubelong&0x00FF0000 0x00010000 AU/NZ
->>(0x010.L+0x178) ubelong&0xFF000000 0xFF000000 Other
->>(0x010.L+0x178) ubelong >0 \b)
+>(0x010.L+0x178) use xbox-360-xex-region-code
+0 string XEX1 Microsoft Xbox 360 executable (XEX1)
+!:mime audio/x-xbox360-executable
+!:ext xex
+>0x18 search/0x100 \x00\x04\x00\x06
+>>&0 use xbox-360-xex-execution-id
+>(0x010.L+0x154) use xbox-360-xex-region-code
+
+#------------------------------------------------------------------------------
+# Microsoft Xbox 360 packages
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - https://free60project.github.io/wiki/STFS.html
+# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h
+# TODO: More information for console-signed packages.
+
+0 name xbox-360-package
+>0x360 byte x (%c
+>0x361 byte x \b%c
+>0x362 beshort x \b-%04u, media ID:
+>0x354 belong x %08X)
+>0x344 belong x \b, content type:
+>>0x344 belong 0x1 Saved Game
+>>0x344 belong 0x2 Marketplace Content
+>>0x344 belong 0x3 Publisher
+>>0x344 belong 0x1000 Xbox 360 Title
+>>0x344 belong 0x2000 IPTV Pause Buffer
+>>0x344 belong 0x4000 Installed Game
+>>0x344 belong 0x5000 Original Xbox Game
+>>0x344 belong 0x9000 Avatar Item
+>>0x344 belong 0x10000 Profile
+>>0x344 belong 0x20000 Gamer Picture
+>>0x344 belong 0x30000 Theme
+>>0x344 belong 0x40000 Cache File
+>>0x344 belong 0x50000 Storage Download
+>>0x344 belong 0x60000 Xbox Saved Game
+>>0x344 belong 0x70000 Xbox Download
+>>0x344 belong 0x80000 Game Demo
+>>0x344 belong 0x90000 Video
+>>0x344 belong 0xA0000 Game
+>>0x344 belong 0xB0000 Installer
+>>0x344 belong 0xC0000 Game Trailer
+>>0x344 belong 0xD0000 Arcade Title
+>>0x344 belong 0xE0000 XNA
+>>0x344 belong 0xF0000 License Store
+>>0x344 belong 0x100000 Movie
+>>0x344 belong 0x200000 TV
+>>0x344 belong 0x300000 Music Video
+>>0x344 belong 0x400000 Game Video
+>>0x344 belong 0x500000 Podcast Video
+>>0x344 belong 0x600000 Viral Video
+>>0x344 belong 0x2000000 Community Game
+
+0 string CON\x20 Microsoft Xbox 360 package (console-signed)
+>0 use xbox-360-package
+0 string PIRS Microsoft Xbox 360 package (non-Xbox Live)
+>0 use xbox-360-package
+0 string LIVE Microsoft Xbox 360 package (Xbox Live)
+>0 use xbox-360-package
# Atari Lynx cartridge dump (EXE/BLL header)
# From: "Stefan A. Haubenthal" <polluks@web.de>
#------------------------------------------------------------------------------
-# $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $
+# $File: database,v 1.56 2019/06/14 20:12:00 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
# updated by Joerg Jenderek at Feb 2013
# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
-# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
0 ubelong&0x0000FFFF <0x00000C20
# skip Infocom game Z-machine
# next free block index is positive
>>>0 ulelong >0
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
->>>>17 ubelong&0xFFfdFE00 0x00000000
+>>>>17 ubelong&0xFFfdFEff 0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
>>>>>20 ubelong&0xFF01209B 0x00000000
# dBASE III
>>>>>>>>>6 ubeshort >0
# skip emacs.PIF
>>>>>>>>>>4 ushort 0
->>>>>>>>>>>0 use foxpro-memo-print
+# check for valid FoxPro field type
+>>>>>>>>>>>512 ubelong <3
+>>>>>>>>>>>>0 use foxpro-memo-print
# dBASE III DBT , garbage
->>>>>>>>>6 ubeshort 0
-# skip MM*DD*.bin by test for for reserved NULL byte
->>>>>>>>>>510 ubeshort 0
-# skip TK-DOS11.img image by looking for memo text
->>>>>>>>>>>512 ubelong <0xfeffff03
-# skip EFI executables by looking for memo text
->>>>>>>>>>>>512 ubelong >0x1F202020
->>>>>>>>>>>>>513 ubyte >0
+# skip WORD1XW.DOC with improbably high free block index
+>>>>>>>>>0 lelong <2205083
# unusual dBASE III DBT like adressen.dbt
->>>>>>>>>>>>>>0 use dbase3-memo-print
+>>>>>>>>>>0 use dbase3-memo-print
# dBASE III DBT like angest.dbt, or garbage PCX DBF
>>>>>>>>8 ubelong !0
# skip PCX and some DBF by test for for reserved NULL bytes
>>>>>>>>>510 ubeshort 0
-# skip some DBF by test of invalid version
->>>>>>>>>>0 ubyte >5
->>>>>>>>>>>0 ubyte <48
->>>>>>>>>>>>0 use dbase3-memo-print
+# skip AI070GEP.EPS with improbably high free block index
+>>>>>>>>>>0 lelong <458766
+>>>>>>>>>>>0 use dbase3-memo-print
# dBASE IV DBT with positive block size
>>>>>>>20 uleshort >0
# dBASE IV DBT with valid block length like 512, 1024
# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
->>>>>>>>20 uleshort&0x800f 0
+# skip also 3600h 3E00h size
+>>>>>>>>20 uleshort&0xE00f 0
>>>>>>>>>0 use dbase4-memo-print
# Print the information of dBase III DBT memo file
0 name dbase3-memo-print
>0 ubyte x dBase III DBT
+!:mime application/x-dbt
+!:ext dbt
# instead 3 as version number 0 for unusual examples like biblio.dbt
>16 ubyte !3 \b, version number %u
# Number of next available block for appending data
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated by \032\032
>512 string >\0 \b, 1st item "%s"
+# https://www.clicketyclick.dk/databases/xbase/format/dbt.html
# Print the information of dBase IV DBT memo file
0 name dbase4-memo-print
>0 lelong x dBase IV DBT
# length of memo field
>>4 lelong x \b, field length %d
>>>8 string >\0 \b, 1st used item "%s"
+# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
# Print the information of FoxPro FPT memo file
0 name foxpro-memo-print
>0 belong x FoxPro FPT
+!:mime application/x-fpt
+!:ext fpt
# Size of blocks for FoxPro ( 64,256 )
>6 ubeshort x \b, blocks size %u
# next available block
#------------------------------------------------------------------------------
-# $File: elf,v 1.77 2019/01/16 19:33:35 christos Exp $
+# $File: elf,v 1.79 2019/12/16 04:24:01 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
>0 lelong&0x3 2 relaxed memory ordering,
0 name elf-pa-risc
->2 leshort 0x0208 1.0
+>2 leshort 0x020b 1.0
>2 leshort 0x0210 1.1
>2 leshort 0x0214 2.0
>0 leshort &0x0008 (LP64)
!:mime application/x-object
>16 leshort 2 executable,
!:mime application/x-executable
->16 leshort 3 ${x?pie executable:shared object},
-
-!:mime application/x-${x?pie-executable:sharedlib}
+>16 leshort 3 shared object,
+!:mime application/x-sharedlib
>16 leshort 4 core file,
!:mime application/x-coredump
# OS-specific
-# $File: espressif,v 1.1 2018/11/20 18:57:17 christos Exp $
+# $File: espressif,v 1.2 2019/11/15 21:03:14 christos Exp $
# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
# URL: https://github.com/arendst/Sonoff-Tasmota/
# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/
#
# cfg_holder=4617=0x1209
0 uleshort 4617
-# remainig settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
+# remaining settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e
>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266)
!:mime application/x-tasmota-dmp
!:ext dmp
#------------------------------------------------------------------------------
-# $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $
+# $File: filesystems,v 1.131 2019/11/15 23:49:38 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
>0x10040 lelong 2 yura hash
>0x10040 lelong 3 r5 hash
-# JFFS - russell@coker.com.au
-0 lelong 0x34383931 Linux Journalled Flash File system, little endian
-0 belong 0x34383931 Linux Journalled Flash File system, big endian
-
# EST flat binary format (which isn't, but anyway)
# From: Mark Brown <broonie@sirena.org.uk>
0 string ESTFBINR EST flat binary
>29 byte 23 \bDesignWare ARC,
>29 byte 24 \bx86_64,
>29 byte 25 \bXtensa,
+>29 byte 26 \bRISC-V,
>30 byte 0 Invalid Image
>30 byte 1 Standalone Program
>30 byte 2 OS Kernel Image
# JFFS2 file system
0 leshort 0x1984 Linux old jffs2 filesystem data little endian
+0 beshort 0x1984 Linux old jffs2 filesystem data big endian
0 leshort 0x1985 Linux jffs2 filesystem data little endian
+0 beshort 0x1985 Linux jffs2 filesystem data big endian
# Squashfs
-0 string sqsh Squashfs filesystem, big endian,
+0 name squashfs
>28 beshort x version %d.
->30 beshort x \b%d,
+>30 beshort x \b%d,
+>20 beshort 0 uncompressed,
+>20 beshort 1 zlib
+>20 beshort 2 lzma
+>20 beshort 3 lzo
+>20 beshort 4 xz
+>20 beshort 5 lz4
+>20 beshort 6 zstd
+>20 beshort >0 compressed,
>28 beshort <3
>>8 belong x %d bytes,
>28 beshort >2
->>28 beshort <4
+>>28 beshort <4
>>>63 bequad x %lld bytes,
->>28 beshort >3
+>>28 beshort >3
>>>40 bequad x %lld bytes,
#>>67 belong x %d bytes,
>4 belong x %d inodes,
>28 beshort <2
>>32 beshort x blocksize: %d bytes,
>28 beshort >1
->>28 beshort <4
+>>28 beshort <4
>>>51 belong x blocksize: %d bytes,
->>28 beshort >3
+>>28 beshort >3
>>>12 belong x blocksize: %d bytes,
->28 beshort <4
+>28 beshort <4
>>39 bedate x created: %s
->28 beshort >3
+>28 beshort >3
>>8 bedate x created: %s
+
+0 string sqsh Squashfs filesystem, big endian,
+>0 use squashfs
+
0 string hsqs Squashfs filesystem, little endian,
->28 leshort x version %d.
->30 leshort x \b%d,
->28 leshort <3
->>8 lelong x %d bytes,
->28 leshort >2
->>28 leshort <4
->>>63 lequad x %lld bytes,
->>28 leshort >3
->>>40 lequad x %lld bytes,
-#>>63 lelong x %d bytes,
->4 lelong x %d inodes,
->28 leshort <2
->>32 leshort x blocksize: %d bytes,
->28 leshort >1
->>28 leshort <4
->>>51 lelong x blocksize: %d bytes,
->>28 leshort >3
->>>12 lelong x blocksize: %d bytes,
->28 leshort <4
->>39 ledate x created: %s
->28 leshort >3
->>8 ledate x created: %s
+>0 use ^squashfs
# AFS Dump Magic
# From: Ty Sarna <tsarna@sarna.org>
#------------------------------------------------------------------------------
-# $File: fonts,v 1.41 2019/05/05 16:44:04 christos Exp $
+# $File: fonts,v 1.43 2019/07/16 11:11:31 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt
#
# usual case with lightening mask and skewing mask 5555h~UU
-62 ulelong 0x55555555
->0 use gdos-font
+#62 ulelong 0x55555555
+# skip cl8m8ocofedso.testfile by looking for face size lower/equal 72
+#>2 uleshort <73
+#>>0 use gdos-font
# BOX18.GFT COWBOY30.GFT ROYALK30.GFT
-62 ulelong 0
+#62 ulelong 0
# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size
->2 uleshort >2
-# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 48
->>2 uleshort <49
-# skip MS Windows ICO ./msdos by looking for valid face name
->>>4 ubeshort >0x1F00
-# skip DOS executable BACKM212.COM by looking for horizontal offset table after header
-#>>>>68 ulelong >87 OFFSET_OK
->>>>0 use gdos-font
+#>2 uleshort >2
+# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72
+#>>2 uleshort <73
+# skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE
+#>>>4 ulelong >0x001F1f1F
+# skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data
+#>>>>76 ulelong >83
+#>>>>>0 use gdos-font
0 name gdos-font
>0 uleshort x GEM GDOS font
!:mime application/x-font-gdos
# also .eps found like AA070GEP.EPS AI360GEP.EPS
!:ext fnt/gtf
-# font name like University Bold
+# font name like Big&Tall, Celtic #s, Courier, University Bold, WYE
>4 string x %.32s
-# face size in points 3-48
+# face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT
>2 uleshort x %u
# face ID (must be unique)
>0 uleshort x \b, ID 0x%4.4x
-# lowest character index in face (usually 32 for disk-loaded fonts).
-#>36 uleshort x \b, low character index %u
-# width of the widest character
+# lowest character index in face (4 but usually 32 for disk-loaded fonts)
+#>36 uleshort !32 \b, unusual character index %u
+# width of the widest character like 0 8 10 12 16 24 32
#>50 uleshort x \b, %u char width
-# width of the widest character cell
+# width of the widest character cell like 8 11 12 14 15 16 33 67
#>52 uleshort x \b, %u cell width
-# thickening size
+# thickening size in pixel like 0 1 2 3 4 5 6 7 8
#>58 uleshort x \b, %u thick
# lightening mask to eliminate pixels, usually 5555h
>62 uleshort !0x5555 \b, lightening mask 0x%x
# skewing mask to determine when to perform additional rotation when skewing, usually 5555h
>64 uleshort !0x5555 \b, skewing mask 0x%x
-# offset to horizontal offset table 58h~88 5eh
-#>68 ulelong >88 \b, 0x%x horizontal table offset
-# offset character offset table
+# offset to optional horizontal offset table 0 58h~88 5eh 252h
+#>68 ulelong x \b, 0x%x horizontal table offset
+# offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h
#>72 ulelong x \b, 0x%x coffset
-# offset to font data
-#>72 ulelong x \b, 0x%x foffset
-# form width in bytes
+# offset to font data like 116h 118h 158 20Ah 20Eh
+>76 ulelong x \b, 0x%x foffset
+# form width in bytes like 58 67 156 190 227 317 345
#>80 uleshort x \b, %u fwidth
-# pointer to the next font, set by GDOS after loading
+# form height in bytes like 4 8 11 17 26 56 70 90 120 146 150
+#>82 uleshort x \b, %u fheight
+# pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h
#>84 ulelong x \b, 0x%x noffset
# downloadable fonts for browser (prints type) anthon@mnt.org
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: forth,v 1.1 2019/06/06 19:14:20 christos Exp $
+# forth: file(1) magic for various Forth environments
+# From: Lubomir Rintel <lkundrak@v3.sk>
+#
+
+# Has a FORTH stack diagram and something that looks very much like a FORTH
+# multi-line word definition. Probably a FORTH source.
+0 regex \[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)
+>0 regex \^:\[[:space:]]
+>>0 regex \^;$ FORTH program
+!:mime text/x-forth
+
+# Inline word definition complete with a stack diagram
+0 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program
+!:mime text/x-forth
+
+# Various dictionary images used by OpenFirware FORTH environent
+
+0 lelong 0xe1a00000
+>8 lelong 0xe1a00000 ARM OpenFirmware FORTH Dictionary,
+>>24 lelong x Text length: %d bytes,
+>>28 lelong x Data length: %d bytes,
+>>32 lelong x Text Relocation Table length: %d bytes,
+>>36 lelong x Data Relocation Table length: %d bytes,
+>>40 lelong x Entry Point: 0x%08X,
+>>44 lelong x BSS length: %d bytes
+
+0 string MP
+>28 lelong 1 x86 OpenFirmware FORTH Dictionary,
+>>4 leshort x %d blocks
+>>2 leshort x + %d bytes,
+>>6 leshort x %d relocations,
+>>8 leshort x Header length: %d paragraphs,
+>>10 leshort x Data Size: %d
+>>12 leshort x - %d 4K pages,
+>>14 lelong x Initial Stack Pointer: 0x%08X,
+>>20 lelong x Entry Point: 0x%08X,
+>>24 lelong x First Relocation Item: %d,
+>>26 lelong x Overlay Number: %d,
+>>18 leshort x Checksum: 0x%08X
+
+0 belong 0x48000020 PowerPC OpenFirmware FORTH Dictionary,
+>4 belong x Text length: %d bytes,
+>8 belong x Data length: %d bytes,
+>12 belong x BSS length: %d bytes,
+>16 belong x Symbol Table length: %d bytes,
+>20 belong x Entry Point: 0x%08X,
+>24 belong x Text Relocation Table length: %d bytes,
+>28 belong x Data Relocation Table length: %d bytes
+
+0 lelong 0x10000007 MIPS OpenFirmware FORTH Dictionary,
+>4 lelong x Text length: %d bytes,
+>8 lelong x Data length: %d bytes,
+>12 lelong x BSS length: %d bytes,
+>16 lelong x Symbol Table length: %d bytes,
+>20 lelong x Entry Point: 0x%08X,
+>24 lelong x Text Relocation Table length: %d bytes,
+>28 lelong x Data Relocation Table length: %d bytes
+
+# Dictionary images used by minimal C FORTH environments, any platform,
+# using native byte order.
+
+# Weak.
+#0 short 0x5820 cForth 16-bit Dictionary,
+#>2 short x Serial: 0x%08X,
+#>4 short x Dictionary Start: 0x%08X,
+#>6 short x Dictionary Size: %d bytes,
+#>8 short x User Area Start: 0x%08X,
+#>10 short x User Area Size: %d bytes,
+#>12 short x Entry Point: 0x%08X
+
+0 long 0x581120 cForth 32-bit Dictionary,
+>4 long x Serial: 0x%08X,
+>8 long x Dictionary Start: 0x%08X,
+>12 long x Dictionary Size: %d bytes,
+>16 long x User Area Start: 0x%08X,
+>20 long x User Area Size: %d bytes,
+>24 long x Entry Point: 0x%08X
#------------------------------------------------------------------------------
-# $File: frame,v 1.12 2009/09/19 16:28:09 christos Exp $
+# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $
# frame: file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
>11 string 2.0 (2.0
>11 string 1.0 (1.0
>14 byte x %c)
+# URL: http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format
+# Reference: https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf
+# Update: Joerg Jenderek 2019 Nov
0 string \<MIFFile FrameMaker MIF (ASCII) file
-!:mime application/x-mif
->9 string 4.0 (4.0)
->9 string 3.0 (3.0)
->9 string 2.0 (2.0)
->9 string 1.0 (1.x)
+# https://www.iana.org/assignments/media-types/application/vnd.mif
+!:mime application/vnd.mif
+# mif most but also find bookTOC.framemif
+!:ext mif/framemif
+# followed by space~20h
+#>8 ubyte 0x20 \b, space before version
+# 3 characters of version number of the MIF language like 1.0, 2.0 ... 2015 ...
+>9 string x (%.3s
+# if not greater sign then display 4th character of version
+>12 ubyte =0x3e \b)
+>12 ubyte !0x3e \b%c)
+# comment starting with # shows the name+version number of generating program
+>13 search/3 #
+>>&0 string x "%s"
0 search/1 \<MakerDictionary FrameMaker Dictionary text
!:mime application/x-mif
>17 string 3.0 (3.0)
#------------------------------------------------------------------------------
-# $File: games,v 1.17 2019/04/19 00:42:27 christos Exp $
+# $File: games,v 1.18 2019/11/10 19:19:58 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
>12 lelong !0 \b, names: %i
>28 lelong !0 \b, imports: %i
>20 lelong !0 \b, exports: %i
+
+0 string ESVG
+>4 lelong 0x00160000
+>10 string TOC\020 Empire Deluxe for DOS saved game
#------------------------------------------------------------------------------
-# $File: gimp,v 1.8 2013/12/21 14:29:45 christos Exp $
+# $File: gimp,v 1.10 2019/10/15 18:19:40 christos Exp $
# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
# by Federico Mena <federico@nuclecu.unam.mx>
0 string/t GIMP\ Gradient GIMP gradient data
+#!:mime text/plain
+!:mime text/x-gimp-ggr
+!:ext ggr
# GIMP palette (.gpl)
# From: Markus Heidelberg <markus.heidelberg@web.de>
0 string/t GIMP\ Palette GIMP palette data
+# URL: https://docs.gimp.org/en/gimp-concepts-palettes.html
+# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Palette
+#!:mime text/plain
+!:mime text/x-gimp-gpl
+!:ext gpl
#------------------------------------------------------------------------------
# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
+# URL: https://en.wikipedia.org/wiki/XCF_(file_format)
+# Reference: https://gitlab.gnome.org/GNOME/gimp/blob/master/devel-docs/xcf.txt
0 string gimp\ xcf GIMP XCF image data,
!:mime image/x-xcf
+!:ext xcf
>9 string file version 0,
>9 string v version
>>10 string >\0 %s,
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
+# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Pattern
20 string GPAT GIMP pattern data,
>24 string x %s
+!:mime image/x-gimp-pat
+!:ext pat
#------------------------------------------------------------------------------
# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed
# ('Bucky' LaDieu, nega@vt.edu)
20 string GIMP GIMP brush data
+# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Brush
+!:mime image/x-gimp-gbr
+# some sources also list gpb
+!:ext gbr
+
+# From: Joerg Jenderek
+# URL: https://docs.gimp.org/en/gimp-using-animated-brushes.html
+# Reference: http://fileformats.archiveteam.org/wiki/GIMP_Animated_Brush
+# share\gimp\2.0\brushes\Legacy\confetti.gih
+0 search/21/b \040ncells: GIMP animated brush data
+!:mime image/x-gimp-gih
+!:ext gih
# GIMP Curves File
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
0 string #\040GIMP\040Curves\040File GIMP curve file
+#!:mime text/plain
+!:mime text/x-gimp-curve
+!:ext /txt
+
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: git,v 1.1 2019/10/04 18:46:29 christos Exp $
+# git: file(1) magic for Git objects
+
+0 string blob\040
+>5 regex [0-9]+ Git blob %s
+
+0 string tree\040
+>5 regex [0-9]+ Git tree %s
+
+0 string commit\040
+>7 regex [0-9]+ Git commit %s
#------------------------------------------------------------------------------
-# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $
+# $File: icc,v 1.6 2019/11/15 21:03:14 christos Exp $
# icc: file(1) magic for International Color Consortium file formats
#
!:mime application/vnd.iccprofile
# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
>>>8 ubyte =2
-# do not use empty message text to a avoid error like
+# do not use empty message text to avoid error like
# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file.exe: could not find any valid magic files!
>>>>9 ubyte !0 \ble
#------------------------------------------------------------------------------
-# $File: images,v 1.160 2019/04/19 00:42:27 christos Exp $
+# $File: images,v 1.171 2019/11/23 16:19:47 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
>12 lelong >0 %d-bit
# Magick Image File Format
-0 string id=ImageMagick MIFF image data
+# URL: https://imagemagick.org/script/miff.php
+# Reference: http://fileformats.archiveteam.org/wiki/MIFF
+# Update: Joerg Jenderek
+# http://www.nationalarchives.gov.uk/pronom/fmt/930
+0 search/256/bc id=imagemagick
+# skip bad ASCII text by following new line~0x0A or space~0x20 character
+#>&0 ubyte x \b, next character 0x%x
+# called by TriD ImageMagick Machine independent File Format bitmap
+>&0 ubyte&0xD5 0 MIFF image data
+# https://reposcope.com/mimetype/image/miff
+#!:mime image/miff
+!:mime image/x-miff
+!:ext miff/mif
+# examples with standard file(1) magic
+#>>0 string =id=ImageMagick with standard magic
+# examples with unusual file(1) magic like
+>>0 string !id=ImageMagick starting with
+# start with comment (brace) like http://samples.fileformat.info/.../AQUARIUM.MIF
+>>>0 ubyte =0x7b comment
+# skip second character which is often a newline and show comment
+>>>>2 string x "%s"
+# does not start with comment, probably letters with other case like Id=ImageMagick
+# ImageMagick-7.0.9-2/Magick++/demo/smile_anim.miff
+>>>0 ubyte !0x7b
+>>>>0 string >\0 '%-.14s'
# Artisan
0 long 1123028772 Artisan image data
# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
# 28bitmap_information_header.29
+# Note: variant starting direct with DIB header see
+# http://fileformats.archiveteam.org/wiki/BMP
+# verified by ImageMagick version 6.8.9-8 command `identify *.dib`
+0 leshort 40
+# skip bad samples like GAME by looking for valid number of color planes
+>12 uleshort 1 Device independent bitmap graphic
+!:mime image/bmp
+!:apple ????BMPp
+!:ext dib
+>>4 lelong x \b, %d x
+>>8 lelong x %d x
+>>14 leshort x %d
+# number of color planes (must be 1)
+#>>12 uleshort >1 \b, %u color planes
+# compression method: 0~no 1~RLE 8-bit/pixel 3~Huffman 1D
+#>>16 ulelong 3 \b, Huffman 1D compression
+>>16 ulelong >0 \b, %u compression
+# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
+>>20 ulelong x \b, image size %u
+# horizontal and vertical resolution of the image (pixel per metre, signed integer)
+>>24 lelong >0 \b, resolution %d x
+>>>28 lelong x %d px/m
+# number of colors in palette, or 0 to default to 2**n
+#>>32 ulelong >0 \b, %u colors
+# number of important colors used, or 0 when every color is important
+>>36 ulelong >0 \b, %u important colors
0 string BM
>14 leshort 12 PC bitmap, OS/2 1.x format
!:mime image/x-ms-bmp
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 64 PC bitmap, OS/2 2.x format
-!:mime image/x-ms-bmp
->>18 leshort x \b, %d x
->>20 leshort x %d
->14 leshort 40 PC bitmap, Windows 3.x format
-!:mime image/x-ms-bmp
+!:mime image/bmp
+!:apple ????BMPp
+!:ext bmp
+# image width and height fields are unsigned integers for OS/2
+>>18 ulelong x \b, %u x
+>>22 ulelong x %u
+# number of bits per pixel (color depth); found 1 4 8
+>>28 uleshort >1 x %u
+# x, y coordinates of the hotspot
+>>6 uleshort >0 \b, hotspot %ux
+>>>8 uleshort x \b%u
+>>26 uleshort >1 \b, %u color planes
+# cbSize; size of file or headers
+>>2 ulelong x \b, cbSize %u
+#>>2 ulelong x \b, cbSize 0x%x
+# offBits; offset to bitmap data like 56h 5Eh 8Eh 43Eh
+>>10 ulelong x \b, bits offset %u
+#>>10 ulelong x \b, bits offset 0x%x
+#>>(10.l) ubequad !0 \b, bits 0x%16.16llx
+# BITMAPV2INFOHEADER adds RGB bit masks
+>14 leshort 52 PC bitmap, Adobe Photoshop
+!:mime image/bmp
+!:apple ????BMPp
+!:ext bmp
+>>18 lelong x \b, %d x
+>>22 lelong x %d x
+>>28 leshort x %d
+# BITMAPV3INFOHEADER adds alpha channel bit mask
+>14 leshort 56 PC bitmap, Adobe Photoshop with alpha channel mask
+!:mime image/bmp
+!:apple ????BMPp
+!:ext bmp
>>18 lelong x \b, %d x
>>22 lelong x %d x
>>28 leshort x %d
+>14 leshort 40
+# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib
+>>(2.l-4) ulong x PC bitmap, Windows 3.x format
+!:mime image/bmp
+!:apple ????BMPp
+>>>18 lelong x \b, %d x
+>>>22 lelong x %d
+# 320 x 400 https://en.wikipedia.org/wiki/LOGO.SYS
+>>>18 ulequad =0x0000019000000140 x
+!:ext bmp/sys
+>>>18 ulequad !0x0000019000000140
+# compression method 2~RLE 4-bit/pixel implies also extension rle
+>>>>30 ulelong 2 x
+!:ext bmp/rle
+>>>>30 default x x
+!:ext bmp
+# number of bits per pixel (color depth); found 1 2 4 8 16 24 32
+>>>28 leshort x %d
+# x, y coordinates of the hotspot; there is no hotspot in bitmaps, so values 0
+#>>>6 uleshort >0 \b, hotspot %ux
+#>>>>8 uleshort x \b%u
+# number of color planes (must be 1), except badplanes.bmp for testing
+#>>>26 uleshort >1 \b, %u color planes
+# compression method: 0~no 1~RLE 8-bit/pixel 2~RLE 4-bit/pixel 3~Huffman 1D 6~RGBA bit field masks
+#>>>30 ulelong 3 \b, Huffman 1D compression
+>>>30 ulelong >0 \b, %u compression
+# image size is the size of raw bitmap; a dummy 0 can be given for BI_RGB bitmaps
+>>>34 ulelong >0 \b, image size %u
+# horizontal and vertical resolution of the image (pixel per metre, signed integer)
+>>>38 lelong >0 \b, resolution %d x
+>>>>42 lelong x %d px/m
+# number of colors in palette 16 256, or 0 to default to 2**n
+#>>>46 ulelong >0 \b, %u colors
+# number of important colors used, or 0 when every color is important
+>>>50 ulelong >0 \b, %u important colors
+# cbSize; often size of file
+>>>2 ulelong x \b, cbSize %u
+#>>>2 ulelong x \b, cbSize 0x%x
+# offBits; offset to bitmap data like 36h 76h BEh 236h 406h 436h 4E6h
+>>>10 ulelong x \b, bits offset %u
+#>>>10 ulelong x \b, bits offset 0x%x
+#>>>(10.l) ubequad !0 \b, bits 0x%16.16llxd
>14 leshort 124 PC bitmap, Windows 98/2000 and newer format
!:mime image/x-ms-bmp
>>18 lelong x \b, %d x
>>18 lelong x \b, %d x
>>22 lelong x %d x
>>28 leshort x %d
-# Too simple - MPi
-#0 string IC PC icon data
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/OS/2_Icon
+# Reference: http://www.fileformat.info
+# /format/os2bmp/spec/902d5c253f2a43ada39c2b81034f27fd/view.htm
+# Note: verified by command like `deark -l -d3 OS2MEMU.ICO`
+0 string IC
+# skip Lotus smart icon *.smi by looking for valid hotspot coordinates
+>6 ulelong&0xFF00FF00 =0 OS/2 icon
+# jump 4 bytes before end of header/file and test for accessibility
+#>>(2.l-4) ubelong x End of header is OK!
+!:mime image/x-os2-ico
+!:ext ico
+# cbSize; size of header or file in bytes like 1ah 120h 420h
+>>2 ulelong x \b, cbSize %u
+# xHotspot, yHotspot; coordinates of the hotspot for icons like 16 32
+>>6 uleshort x \b, hotspot %ux
+>>8 uleshort x \b%u
+# offBits; offset in bytes to the beginning of the bit-map pel data like 20h
+>>10 ulelong x \b, bits offset %u
+#>>(10.l) ubequad x \b, bits 0x%16.16llx
#0 string PI PC pointer image data
#0 string CI PC color icon data
+0 string CI
+# test also for valid dib header sizes 12 or 64
+>14 ulelong <65 OS/2
+# test also for valid hotspot coordinates
+#>>6 ulelong&0xFE00FE00 =0 OS/2
+!:mime image/x-os2-ico
+!:ext ico
+>>14 ulelong 12 1.x color icon
+# image width and height fields are unsigned integers for OS/2
+>>>18 uleshort x %u x
+# stored height = 2 * real height
+>>>20 uleshort/2 x %u
+# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
+>>>24 uleshort >1 x %u
+# color planes; must be 1
+#>>>22 uleshort >1 \b, %u color planes
+>>14 ulelong 64 2.x color icon
+# image width and height
+>>>18 ulelong x %u x
+# stored height = 2 * real height
+>>>22 ulelong/2 x %u
+# number of bits per pixel (color depth). only 1 found
+>>>28 uleshort >1 x %u
+#>>>26 uleshort >1 \b, %u color planes
+# compression method: 0~no 3~Huffman 1D
+>>>30 ulelong 3 \b, Huffman 1D compression
+#>>>30 ulelong >0 \b, %u compression
+# xHotspot, yHotspot; coordinates of the hotspot like 0 1 16 20 32 33 63 64
+>>6 uleshort x \b, hotspot %ux
+>>8 uleshort x \b%u
+# cbSize; size of header or maybe file in bytes like 1Ah 4Eh 84Eh
+>>2 ulelong x \b, cbSize %u
+#>>2 ulelong x \b, cbSize %x
+# offBits; offset to bitmap data (pixel array) like E4h 3Ah 66h 6Ah 33Ah 4A4h
+>>10 ulelong x \b, bits offset %u
+#>>10 ulelong x \b, bits offset 0x%x
+#>>(10.l) ubequad !0 \b, bits 0x%16.16llx
+# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
+#>>14 ulelong x \b, dib header size %u
#0 string CP PC color pointer image data
+# URL: http://fileformats.archiveteam.org/wiki/OS/2_Pointer
+# Reference: http://www.fileformat.info/format/os2bmp/egff.htm
+0 string CP
+# skip CPU-Z Report by checking for valid dib header sizes 12 or 64
+>14 ulelong <65 OS/2
+# http://extension.nirsoft.net/PTR
+!:mime image/x-ibm-pointer
+!:ext ptr
+>>14 ulelong 12 1.x color pointer
+# image width and height fields are unsigned integers for OS/2
+>>>18 uleshort x %u x
+# stored height = 2 * real height
+>>>20 uleshort/2 x %u
+# number of bits per pixel (color depth). Typical 32 24 16 8 4 but only 1 found
+>>>24 uleshort >1 x %u
+# color planes; must be 1
+#>>>22 uleshort >1 \b, %u color planes
+>>14 ulelong 64 2.x color pointer
+# image width and height
+>>>18 ulelong x %u x
+# stored height = 2 * real height
+>>>22 ulelong/2 x %u
+# number of bits per pixel (color depth). only 1 found
+>>>28 uleshort >1 x %u
+#>>>26 uleshort >1 \b, %u color planes
+# compression method: 0~no 3~Huffman 1D
+>>>30 ulelong 3 \b, Huffman 1D compression
+#>>>30 ulelong >0 \b, %u compression
+# xHotspot, yHotspot; coordinates of the hotspot like 0 3 4 8 15 16 23 27 31
+>>6 uleshort x \b, hotspot %ux
+>>8 uleshort x \b%u
+# cbSize; size of header or maybe file in bytes like 1Ah 4Eh
+>>2 ulelong x \b, cbSize %u
+#>>2 ulelong x \b, cbSize %x
+# offBits; offset to bitmap data (pixel array) like 6Ah A4h E4h 4A4h
+>>10 ulelong x \b, bits offset %u
+#>>10 ulelong x \b, bits offset 0x%x
+#>>(10.l) ubequad !0 \b, bits 0x%16.16llx
+# dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
+#>>14 ulelong x \b, dib header size %u
# Conflicts with other entries [BABYL]
+# URL: http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array
+# Note: container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM"
#0 string BA PC bitmap array data
+0 string BA
+# skip old Emacs RMAIL BABYL ./mail.news by checking for low header size
+>2 ulelong <0x004c5942 OS/2 graphic array
+!:mime image/x-os2-graphics
+#!:apple ????BMPf
+# cbSize; size of header like 28h 5Ch
+>>2 ulelong x \b, cbSize %u
+#>>2 ulelong x \b, cbSize 0x%x
+# offNext; offset to data like 0 48h F2h 4Eh 64h C6h D2h D6h DAh E6h EAh 348h
+>>6 ulelong >0 \b, data offset %u
+#>>6 ulelong >0 \b, data offset 0x%x
+#>>(6.l) ubequad !0 \b, data 0x%16.16llx
+# dimensions of the intended device like 640 x 480 for VGA or 1024 x 768
+>>10 uleshort >0 \b, display %u
+>>>12 uleshort >0 x %u
+# usType of first array element
+#>>14 string x \b, usType %2.2s
+# 1 space char after "1st"
+# no *.bga examples found https://www.openwith.org/file-extensions/bga/1342
+>>14 string BM \b; 1st
+!:ext bmp/bga
+>>14 string CI \b; 1st
+!:ext ico
+>>14 string CP \b; 1st
+!:ext ico
+>>14 string IC \b; 1st
+!:ext ico
+# no white-black pointer found
+#>>14 string PT \b; 1st
+#!:ext
+>>14 indirect x
# XPM icons (Greg Roelofs, newt@uchicago.edu)
0 search/1 /*\ XPM\ */ X pixmap image text
0 string XPR0 Microsoft Xbox XPR0 texture
>0x19 byte x \b, format:
>>0x19 use xbox-xpr-pixel-format
+
+# ILDA Image Data Transfer Format
+# https://www.ilda.com/resources/StandardsDocs/ILDA_IDTF14_rev011.pdf
+#
+# Updated by Chuck Hein (laser@geekdude.com)
+#
+0 string ILDA ILDA Image Data Transfer Format
+>7 byte 0x00 3D Coordinates with Indexed Color
+>7 byte 0x01 2D Coordinates with Indexed Color
+>7 byte 0x02 Color Palette
+>7 byte 0x04 3D Coordinates with True Color
+>7 byte 0x05 2D Coordinates with True Color
+>8 string >0 \b, palette %s
+>16 string >0 \b, company %s
+>24 beshort >0 \b, number of records %d
+>>26 beshort x \b, palette number %d
+>>28 beshort >0 \b, number of frames %d
+>>30 byte >0 \b, projector number %d
+
+# Dropbox "lepton" compressed jpeg format
+# https://github.com/dropbox/lepton
+0 belong&0xfffff0ff 0xcf84005a Lepton image file
+>2 byte x (version %d)
#------------------------------------------------------------------------------
-# $File: $
+# $File: javascript,v 1.2 2019/08/05 10:34:26 christos Exp $
# javascript: magic for javascript and node.js scripts.
#
0 search/1/w #!/bin/node Node.js script text executable
!:mime application/javascript
0 search/1 #!/usr/bin/env\ nodejs Node.js script text executable
!:mime application/javascript
+# Hermes by Facebook https://hermesengine.dev/
+# https://github.com/facebook/hermes/blob/master/include/hermes/\
+# BCGen/HBC/BytecodeFileFormat.h#L24
+0 lequad 0x1F1903C103BC1FC6 Hermes JavaScript bytecode
+>8 lelong x \b, version %d
#------------------------------------------------------------------------------
-# $File: kml,v 1.5 2019/04/19 00:42:27 christos Exp $
+# $File: kml,v 1.6 2019/05/21 04:50:10 christos Exp $
# Type: Google KML, formerly Keyhole Markup Language
# Future development of this format has been handed
# over to the Open Geospatial Consortium.
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string/t \<?xml
>20 search/400 \ xmlns=
->>&0 regex ['"]https://earth.google.com/kml Google KML document
+>>&0 regex ['"]http://earth.google.com/kml Google KML document
!:mime application/vnd.google-earth.kml+xml
>>>&1 string 2.0' \b, version 2.0
>>>&1 string 2.1' \b, version 2.1
# Open Geospatial Consortium.
# https://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
->>&0 regex ['"]https://www.opengis.net/kml OpenGIS KML document
+>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
!:mime application/vnd.google-earth.kml+xml
>>>&1 string/t 2.2 \b, version 2.2
#------------------------------------------------------------------------------
-# $File: linux,v 1.67 2019/04/19 00:42:27 christos Exp $
+# $File: linux,v 1.68 2019/09/11 21:20:56 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
>207 string >\0 \b, version %s
>272 string >\0 \b, machine %s
>337 string >\0 \b, domain %s
+
+# Device Tree files
+0 search/1024 /dts-v1/ Device Tree File (v1)
+# beat c code
+!:strength +14
#------------------------------------------------------------------------------
-# $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $
+# $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
-11 string must\ be\ converted\ with\ BinHex BinHex binary text
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/BinHex
+# Reference: http://fileformats.archiveteam.org/wiki/BinHex
+# Note: only tested with version 4.0 and hqx extension
+# Any text/binary before the characteristic comment sentence is to be ignored like in
+# http://ftp.vim.org/pub/ftp/ftp/infomac/disk/mac-update-40b7.hqx
+0 search/1602 (This\ file\
+>&0 use binhex
+# http://ftp.vim.org/pub/ftp/ftp/infomac/_Disk_&_File/zap-res-forks-101.hqx
+0 search/2652/b (This\ file\
+>&0 use binhex
+0 name binhex
+# keep splitted search string format similar like in version 5.37
+>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version
+# http://www.macdisk.com/binhexen.php3
+!:apple BNHQTEXT
+# http://www.faqs.org/faqs/macintosh/comm-faq/part1/
+>>&0 string 1.0 1.0
+!:mime application/mac-binhex
+!:ext hex
+>>&0 string 2.0 2.0
+!:mime application/mac-binhex
+!:ext hcx
+# BinHex 3.0 never existed
+>>&0 string 4.0 4.0
!:mime application/mac-binhex40
->41 string x \b, version %.3s
+!:ext hqx
+# BinHex 5.0 also MacBinary I
+>>&0 string 5.0 5.0
+!:mime application/mac-binhex40
+!:ext hqx
+# this should never happen
+>>&0 default x
+>>>&0 string x %.3s
+!:mime application/mac-binhex
+!:ext hqx
# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@tuns.ca)
#------------------------------------------------------------------------------
-# $File: mail.news,v 1.24 2019/04/19 00:42:27 christos Exp $
+# $File: mail.news,v 1.25 2019/06/21 20:06:05 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
!:mime message/rfc822
0 string/t Article saved news text
!:mime message/news
-0 string/t BABYL Emacs RMAIL text
+# Reference: http://quimby.gnus.org/notes/BABYL
+# Update: Joerg Jenderek
+# Note: used by Rmail in Emacs version 22 and before
+# is not text because of characters like Control-L Control-_
+0 string/b BABYL\ OPTIONS: Emacs RMAIL
+#0 string/t BABYL Emacs RMAIL text
+# https://reposcope.com/mimetype/message/x-gnu-rmail
+!:mime message/x-gnu-rmail
+# ~/RMAIL
+!:ext /
0 string/t Received: RFC 822 mail text
!:mime message/rfc822
0 string/t MIME-Version: MIME entity text
#------------------------------------------------------------------------------
-# $File: map,v 1.7 2019/04/30 04:02:04 christos Exp $
+# $File: map,v 1.8 2019/12/01 22:46:23 christos Exp $
# map: file(1) magic for Map data
#
# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh
>>0 uleshort x \b, header length 0x%x
+# URL: https://www.memotech.franken.de/FileFormats/
+# Reference: https://www.memotech.franken.de/FileFormats/Garmin_RGN_Format.pdf
+# From: Joerg Jenderek
+0 string KpGr Garmin update
+# format version like: 0064h~1.0
+>0x4 uleshort !0x0064
+>>4 uleshort/100 x \b, version %u
+>>4 uleshort%100 x \b.%u
+# 1st Garmin entry
+>6 use garmin-entry
+# 2nd Garmin entry
+>(0x6.l+10) ubyte x
+>>&0 use garmin-entry
+# 3rd entry
+>(0x6.l+10) ubyte x
+>>&(&0.l+4) ubyte x
+>>>&0 use garmin-entry
+# look again at version to use default clause
+>0x4 uleshort x
+# test for region content by looking for
+# Garmin *.srf by ./images with normal builder name "SQA" or longer "hales"
+# 1 space after equal sign
+>>0x3a search/5/s GARMIN\ BITMAP \b=
+!:mime image/x-garmin-exe
+!:ext exe
+>>>&0 indirect x
+# if not bitmap *.srf then region; 1 space after equal sign
+>>0x3a default x \b=
+!:mime application/x-garmin-rgn
+!:ext rgn
+# recursiv embedded
+>>>0x3a search/5/s KpGrd
+>>>>&0 indirect x
+# look for ZIP or JAR archive by ./archive and ./zip
+>>>0x3a search/5/s PK\003\004
+>>>>&0 indirect x
+# TODO: other garmin RGN record content like foo
+#>>0x3a search/5/s bar BAR
+# display information of Garmin RGN record
+0 name garmin-entry
+# record length: 2 for Data, for Application often 1Bh sometimes 1Dh, "big" for Region
+#>0 ulelong x \b, length 0x%x
+# data record (ID='D') with version content like 0064h~1.0
+>4 ubyte =0x44
+>>5 uleshort !0x0064 \b; Data
+>>>5 uleshort/100 x \b, version %u
+>>>5 uleshort%100 x \b.%u
+# Application Record (ID='A')
+>4 ubyte =0x41 \b; App
+# version content like 00c8h~2.0
+>>5 uleshort !0x00C8
+>>>5 uleshort/100 x \b, version %u
+>>>5 uleshort%100 x \b.%u
+# builder name like: SQA sqa build hales
+>>7 string x \b, build by %s
+# build date like: Oct 25 1999, Oct 1 2008, Feb 23 2009, Dec 15 2009
+>>>&1 string x %s
+# build time like: 11:26:12, 11:45:54, 14:16:13, 18:23:01
+>>>>&1 string x %s
+# region record (ID='R')
+>4 ubyte =0x52 \b; Region
+# region ID:14~fw_all.bin: 78~ZIP, RGN or SRF bitmap; 148~ZIP or JAR; 249~display firmware; 251~WiFi or GCD firmware; 255~ZIP
+>>5 uleshort x ID=%u
+# delay in ms: like 0, 500
+>>7 ulelong !0 \b, %u ms
+# region size (is record length - 10)
+#>>11 ulelong x \b, length 0x%x
+# region content like:
+# "KpGr"~recursiv embedded,"GARMIN BITMAP"~Garmin Bitmap *.srf, "PK"~ZIP archive
+#>>15 string x \b, content "%s"
+>>15 ubequad x \b, content 0x%llx...
+# This does NOT WORK!
+#>>15 indirect x \b; contains
+>4 default x \b; other
+# garmin Record ID Identifies the record content like: D A R
+>>4 ubyte x ID '%c'
+
# TOM TOM GPS watches ttbin files:
# https://github.com/ryanbinns/ttwatch/tree/master/ttbin
# From: Daniel Lenski
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: modulefile,v 1.1 2019/10/15 18:04:40 christos Exp $
+# modulefile: file(1) magic for user's environment modulefile
+# URL: http://modules.sourceforge.net/
+# Reference: https://modules.readthedocs.io/en/stable/modulefile.html
+# From: Xavier Delaruelle <xavier.delaruelle@cea.fr>
+0 string #%Module modulefile
+!:mime text/x-modulefile
#------------------------------------------------------------------------------
-# $File: msdos,v 1.128 2019/04/19 00:42:27 christos Exp $
+# $File: msdos,v 1.134 2019/10/18 15:16:18 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
#>>0x18 leshort 0x1c (Borland compiler)
#>>0x18 leshort 0x1e (MS compiler)
-# If the relocation table is 0x40 or more bytes into the file, it's definitely
-# not a DOS EXE.
->0x18 leshort >0x3f
-
# Maybe it's a PE?
->>(0x3c.l) string PE\0\0 PE
+>(0x3c.l) string PE\0\0 PE
!:mime application/x-dosexec
->>>(0x3c.l+24) leshort 0x010b \b32 executable
->>>(0x3c.l+24) leshort 0x020b \b32+ executable
->>>(0x3c.l+24) leshort 0x0107 ROM image
->>>(0x3c.l+24) default x Unknown PE signature
->>>>&0 leshort x 0x%x
->>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
->>>(0x3c.l+92) leshort 1
+>>(0x3c.l+24) leshort 0x010b \b32 executable
+>>(0x3c.l+24) leshort 0x020b \b32+ executable
+>>(0x3c.l+24) leshort 0x0107 ROM image
+>>(0x3c.l+24) default x Unknown PE signature
+>>>&0 leshort x 0x%x
+>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
+>>(0x3c.l+92) leshort 1
# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
# drivers in Windows/System32/drivers/*.sys.
->>>>(0x3c.l+22) leshort&0x2000 >0 (native)
+>>>(0x3c.l+22) leshort&0x2000 >0 (native)
!:ext dll/sys
->>>>(0x3c.l+22) leshort&0x2000 0 (native)
+>>>(0x3c.l+22) leshort&0x2000 0 (native)
!:ext exe/sys
->>>(0x3c.l+92) leshort 2
->>>>(0x3c.l+22) leshort&0x2000 >0 (GUI)
+>>(0x3c.l+92) leshort 2
+>>>(0x3c.l+22) leshort&0x2000 >0 (GUI)
# These could probably be at least partially distinguished from one another by
# looking for specific exported functions.
# CPL: Control Panel item
# AX: DirectShow source filter
# IME: Input method editor
!:ext dll/cpl/tlb/ocx/acm/ax/ime
->>>>(0x3c.l+22) leshort&0x2000 0 (GUI)
+>>>(0x3c.l+22) leshort&0x2000 0 (GUI)
# Screen savers typically include code from the scrnsave.lib static library, but
# that's not guaranteed.
!:ext exe/scr
->>>(0x3c.l+92) leshort 3
->>>>(0x3c.l+22) leshort&0x2000 >0 (console)
+>>(0x3c.l+92) leshort 3
+>>>(0x3c.l+22) leshort&0x2000 >0 (console)
!:ext dll/cpl/tlb/ocx/acm/ax/ime
->>>>(0x3c.l+22) leshort&0x2000 0 (console)
+>>>(0x3c.l+22) leshort&0x2000 0 (console)
!:ext exe/com
->>>(0x3c.l+92) leshort 7 (POSIX)
->>>(0x3c.l+92) leshort 9 (Windows CE)
->>>(0x3c.l+92) leshort 10 (EFI application)
->>>(0x3c.l+92) leshort 11 (EFI boot service driver)
->>>(0x3c.l+92) leshort 12 (EFI runtime driver)
->>>(0x3c.l+92) leshort 13 (EFI ROM)
->>>(0x3c.l+92) leshort 14 (XBOX)
->>>(0x3c.l+92) leshort 15 (Windows boot application)
->>>(0x3c.l+92) default x (Unknown subsystem
->>>>&0 leshort x 0x%x)
->>>(0x3c.l+4) leshort 0x14c Intel 80386
->>>(0x3c.l+4) leshort 0x166 MIPS R4000
->>>(0x3c.l+4) leshort 0x168 MIPS R10000
->>>(0x3c.l+4) leshort 0x184 Alpha
->>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3
->>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4
->>>(0x3c.l+4) leshort 0x1c0 ARM
->>>(0x3c.l+4) leshort 0x1c2 ARM Thumb
->>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb
->>>(0x3c.l+4) leshort 0x1f0 PowerPC
->>>(0x3c.l+4) leshort 0x200 Intel Itanium
->>>(0x3c.l+4) leshort 0x266 MIPS16
->>>(0x3c.l+4) leshort 0x268 Motorola 68000
->>>(0x3c.l+4) leshort 0x290 PA-RISC
->>>(0x3c.l+4) leshort 0x366 MIPSIV
->>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU
->>>(0x3c.l+4) leshort 0xebc EFI byte code
->>>(0x3c.l+4) leshort 0x8664 x86-64
->>>(0x3c.l+4) leshort 0xc0ee MSIL
->>>(0x3c.l+4) default x Unknown processor type
->>>>&0 leshort x 0x%x
->>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB)
->>>(0x3c.l+22) leshort&0x1000 >0 system file
->>>(0x3c.l+24) leshort 0x010b
->>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
->>>(0x3c.l+24) leshort 0x020b
->>>>(0x3c.l+248) lelong >0 Mono/.Net assembly
+# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
+>>(0x3c.l+92) leshort 7 (POSIX)
+>>(0x3c.l+92) leshort 9 (Windows CE)
+>>(0x3c.l+92) leshort 10 (EFI application)
+>>(0x3c.l+92) leshort 11 (EFI boot service driver)
+>>(0x3c.l+92) leshort 12 (EFI runtime driver)
+>>(0x3c.l+92) leshort 13 (EFI ROM)
+>>(0x3c.l+92) leshort 14 (XBOX)
+>>(0x3c.l+92) leshort 15 (Windows boot application)
+>>(0x3c.l+92) default x (Unknown subsystem
+>>>&0 leshort x 0x%x)
+>>(0x3c.l+4) leshort 0x14c Intel 80386
+>>(0x3c.l+4) leshort 0x166 MIPS R4000
+>>(0x3c.l+4) leshort 0x168 MIPS R10000
+>>(0x3c.l+4) leshort 0x184 Alpha
+>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3
+>>(0x3c.l+4) leshort 0x1a3 Hitachi SH3 DSP
+>>(0x3c.l+4) leshort 0x1a8 Hitachi SH5
+>>(0x3c.l+4) leshort 0x169 MIPS WCE v2
+>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4
+>>(0x3c.l+4) leshort 0x1c0 ARM
+>>(0x3c.l+4) leshort 0x1c2 ARM Thumb
+>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb
+>>(0x3c.l+4) leshort 0x1d3 Matsushita AM33
+>>(0x3c.l+4) leshort 0x1f0 PowerPC
+>>(0x3c.l+4) leshort 0x1f1 PowerPC with FPU
+>>(0x3c.l+4) leshort 0x200 Intel Itanium
+>>(0x3c.l+4) leshort 0x266 MIPS16
+>>(0x3c.l+4) leshort 0x268 Motorola 68000
+>>(0x3c.l+4) leshort 0x290 PA-RISC
+>>(0x3c.l+4) leshort 0x366 MIPSIV
+>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU
+>>(0x3c.l+4) leshort 0xebc EFI byte code
+>>(0x3c.l+4) leshort 0x5032 RISC-V 32-bit
+>>(0x3c.l+4) leshort 0x5064 RISC-V 64-bit
+>>(0x3c.l+4) leshort 0x5128 RISC-V 128-bit
+>>(0x3c.l+4) leshort 0x9041 Mitsubishi M32R
+>>(0x3c.l+4) leshort 0x8664 x86-64
+>>(0x3c.l+4) leshort 0xaa64 Aarch64
+>>(0x3c.l+4) leshort 0xc0ee MSIL
+>>(0x3c.l+4) default x Unknown processor type
+>>>&0 leshort x 0x%x
+>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB)
+>>(0x3c.l+22) leshort&0x1000 >0 system file
+>>(0x3c.l+24) leshort 0x010b
+>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
+>>(0x3c.l+24) leshort 0x020b
+>>>(0x3c.l+248) lelong >0 Mono/.Net assembly
# hooray, there's a DOS extender using the PE format, with a valid PE
# executable inside (which just prints a message and exits if run in win)
->>>(8.s*16) string 32STUB \b, 32rtm DOS extender
->>>(8.s*16) string !32STUB \b, for MS Windows
->>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
->>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
->>>(0x3c.l+0xf8) search/0x140 UPX2
->>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
->>>(0x3c.l+0xf8) search/0x140 .idata
->>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
->>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
->>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
->>>(0x3c.l+0xf8) search/0x140 .rsrc
->>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
->>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
->>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
->>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
->>>(0x3c.l+0xf8) search/0x140 .data
->>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
->>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
->>>>(0x3c.l+0xf7) byte x
->>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
->>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
->>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
->>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
->>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
->>>0x30 string Inno \b, InnoSetup self-extracting archive
+>>(8.s*16) string 32STUB \b, 32rtm DOS extender
+>>(8.s*16) string !32STUB \b, for MS Windows
+>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
+>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
+>>(0x3c.l+0xf8) search/0x140 UPX2
+>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
+>>(0x3c.l+0xf8) search/0x140 .idata
+>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
+>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
+>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
+>>(0x3c.l+0xf8) search/0x140 .rsrc
+>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
+>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
+>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
+>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
+>>(0x3c.l+0xf8) search/0x140 .data
+>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
+>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
+>>>(0x3c.l+0xf7) byte x
+>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
+>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
+>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
+>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
+>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
+>>0x30 string Inno \b, InnoSetup self-extracting archive
+
+# If the relocation table is 0x40 or more bytes into the file, it's definitely
+# not a DOS EXE.
+>0x18 leshort >0x3f
# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
# must be one of the unusual subformats.
>30 byte 12 (4kB sectors)
# Popular applications
-2080 string Microsoft\ Word\ 6.0\ Document %s
-!:mime application/msword
-2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
-!:mime application/msword
-# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
-2112 string MSWordDoc Microsoft Word document data
-!:mime application/msword
#
-0 belong 0x31be0000 Microsoft Word Document
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/DOC
+# Reference: https://web.archive.org/web/20170206041048/
+# http://www.msxnet.org/word2rtf/formats/ffh-dosword5
+# wIdent+dty
+0 belong 0x31be0000
+# skip droid skeleton like x-fmt-274-signature-id-488.doc
+>128 ubyte >0 Microsoft
+>>96 uleshort =0 Word
!:mime application/msword
+!:apple MSWDWDBN
+# DCX is used in the Unix version.
+!:ext doc/dcx
+>>>0x6E ulequad =0 1.0-4.0
+>>>0x6E ulequad !0 5.0-6.0
+>>>0x6E ulequad x (DOS) Document
+# https://web.archive.org/web/20130831064118/http://msxnet.org/word2rtf/formats/write.txt
+>>96 uleshort !0 Write 3.0 (Windows) Document
+!:mime application/x-mswrite
+!:apple MSWDWDBN
+# sometimes also doc like in splitter.doc srchtest.doc
+!:ext wri/doc
+# wTool must be 0125400 octal
+#>>4 uleshort !0xAB00 \b, wTool %o
+# reserved; must be zero
+#>>6 ulelong !0 \b, reserved %u
+# block pointer to the block containing optional file manager information
+#>>0x1C uleshort x \b, at 0x%x info block
+# jump to File manager information block
+>>(0x1C.s*128) uleshort x
+# test for valid information start; maybe also 0012h
+>>>&-2 uleshort =0x0014
+# Document ASCIIZ name
+>>>>&0x12 string x %s
+# author name
+>>>>>&1 string x \b, author %s
+# reviser name
+>>>>>>&1 string x \b, reviser %s
+# keywords
+>>>>>>>&1 string x \b, keywords %s
+# comment
+>>>>>>>>&1 string x \b, comment %s
+# version number
+>>>>>>>>>&1 string x \b, version %s
+# date of last change MM/DD/YY
+>>>>>>>>>>&1 string x \b, %-.8s
+# creation date MM/DD/YY
+>>>>>>>>>>&9 string x created %-.8s
+# file name of print format like NORMAL.STY
+>>0x1E string >0 \b, formatted by %-.66s
+# count of pages in whole file for write variant; maybe some times wrong
+>>96 uleshort >0 \b, %u pages
+# name of the printer driver like HPLASMS
+>>0x62 string >0 \b, %-.8s printer
+# number of blocks used in the file; seems to be 0 for Word 4.0 and Write 3.0
+>>0x6A uleshort >0 \b, %u blocks
+# bit field for corrected text areas
+#>>0x6C uleshort x \b, 0x%x bit field
+# text of document; some times start with 4 non printable characters like CR LF
+>>128 ubyte x \b,
+>>>128 ubyte >0x1F
+>>>>128 string x %s
+>>>128 ubyte <0x20
+>>>>129 ubyte >0x1F
+>>>>>129 string x %s
+>>>>129 ubyte <0x20
+>>>>>130 ubyte >0x1F
+>>>>>>130 string x %s
+>>>>>130 ubyte <0x20
+>>>>>>131 ubyte >0x1F
+>>>>>>>131 string x %s
+>>>>>>131 ubyte <0x20
+>>>>>>>132 ubyte >0x1F
+>>>>>>>>132 string x %s
+>>>>>>>132 ubyte <0x20
+>>>>>>>>133 ubyte >0x1F
+>>>>>>>>>133 string x %s
#
0 string/b PO^Q` Microsoft Word 6.0 Document
!:mime application/msword
0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
!:mime application/msword
#
-2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
-!:mime application/vnd.ms-excel
-#
0 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document
!:mime application/msword
-2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
-!:mime application/vnd.ms-excel
#
-# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
-2114 string Biff5 Microsoft Excel 5.0 Worksheet
-!:mime application/vnd.ms-excel
-# Italian MS-Excel
-2121 string Biff5 Microsoft Excel 5.0 Worksheet
-!:mime application/vnd.ms-excel
0 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php
+!:apple XCELXLS4
+!:ext xls
#
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
# windows zips files .dmf
0 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
-
-#ico files
-0 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
-
# Windows icons
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
0 string/b \224\246\056 Microsoft Word Document
!:mime application/msword
-512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
-!:mime application/msword
-
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
# Magic type for Dell's BIOS .hdr files
# Dell's .hdr
#------------------------------------------------------------------------------
-# $File: msooxml,v 1.12 2019/04/19 00:42:27 christos Exp $
+# $File: msooxml,v 1.13 2019/11/27 13:12:55 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
>0 string xl/ Microsoft Excel 2007+
!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+0 string visio/ Microsoft Visio 2013+
+!:mime application/vnd.ms-visio.drawing.main+xml
# start by checking for ZIP local file header signature
0 string PK\003\004
#------------------------------------------------------------------------------
-# $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $
+# $File: ole2compounddocs,v 1.7 2019/08/02 18:08:18 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.
+# reference: https://www.openoffice.org/sc/compdocfileformat.pdf
-0 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document
+0 string \320\317\021\340\241\261\032\341
+# https://digital-preservation.github.io/droid/
+# skip droid skeleton like fmt-39-signature-id-128.doc by valid version
+>0x1A ushort !0xABAB OLE 2 Compound Document
+#>0x1C uleshort x \b, endnian 0x%4.4x
+# big endian not tested
+>>0x1C ubeshort =0xfffe \b, big-endian
+>>>546 string jbjb : Microsoft Word Document
+!:mime application/msword
+!:apple MSWDWDBN
+!:ext doc
+# Byte Order 0xFFFE means little-endian found in real world applications
+#>>0x1C uleshort =0xfffe \b, little-endian
+>>0x1C uleshort =0xfffe
+# From: Joerg Jenderek
+# Major Version 3 or 4
+>>>0x1A uleshort x \b, v%u
+# Minor Version 32h=50 3Bh=59 3Eh=62
+>>>0x18 uleshort x \b.%u
+# SecID of first sector of the directory stream is often 1 but high like 3144h
+>>>48 ulelong x \b, SecID 0x%x
+# pointer to root entry only works with standard configuration for SecID ~< 800h
+# Red-Carpet-presentation-1.0-1.sdd sg10.sdv 2000_GA_Annual_Review_Data.xls
+# "ORLEN Factbook 2017.xls" XnView_metadata.doc
+# "Barham, Lisa - Die Shopping-Prinzessinnen.doc" then not recognized
+>>>48 ulelong >0x800 too big for FILE_BYTES_MAX = 1 MiB
+# Sector Shift Exponent 9~512 for major version 3 or C~4096 for major version 4
+>>>0x1E uleshort 0xc \b, blocksize 4096
+# jump to one block (4096 bytes per block) before root storage block
+>>>>(48.l*4096) ubyte x
+>>>>>&4095 use ole2-directory
+#>>>0x1E uleshort 9 \b, blocksize 512
+>>>0x1E uleshort 9
+# jump to one block (512 bytes per block) before root storage block
+# in 5.37 only true for offset ~< FILE_BYTES_MAX=7 MiB defined in ../../src/file.h
+>>>>(48.l*512) ubyte x
+>>>>>&511 use ole2-directory
+# check directory entry structure and display types by GUID
+0 name ole2-directory
+# directory entry name like "Root Entry"
+#>0 lestring16 x \b, 1st %.10s
+# type of the entry; 5~Root storage
+#>66 ubyte x \b, type %x
+# node colour of the entry: 00H ~ Red 01H ~ Black
+#>67 ubyte x \b, color %x
+# the DirIDs of the child nodes. Should both be –1 in the root storage entry
+#>68 bequad !0xffffffffffffffff \b, DirIDs %llx
+# second directory entry name like VisioDocument Control000
+#>128 lestring16 x \b, 2nd %.20s
+# third directory entry like WordDocument
+#>256 lestring16 x \b, 3rd %.20s
+# forth
+#>384 lestring16 x \b, 4th %.10s
+# 5th
+#>512 lestring16 x \b, 5th %.10s
+# 6th
+#>640 lestring16 x \b, 6th %.10s
+# 7th
+#>768 lestring16 x \b, 7th %.10s
+# https://wikileaks.org/ciav7p1/cms/page_13762814.html
+# https://m.blog.naver.com/superman4u/40047693679
+# https://misc.daniel-marschall.de/projects/guid_analysis/guid.txt
+# http://www.windowstricks.in/online-windows-guid-converter
+#>80 ubequad !0 \b, clsid 0x%16.16llx
+#>>88 ubequad x \b%16.16llx
+# test for "Root Entry" inside directory by type 5 value
+>66 ubyte 5
+# look for CLSID GUID 0
+>>88 ubequad 0x0
+>>>80 ubequad 0x0
# - Microstation V8 DGN files (www.bentley.com)
+# URL: https://en.wikipedia.org/wiki/MicroStation
# Last update on 10/23/2006 by Lester Hightower
-> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN
+# 07/24/2019 by Joerg Jenderek
+# Second directory entry name like Dgn~H Dgn~S
+>>>>128 lestring16 Dgn~ : Microstation V8 CAD
+#!:mime application/x-ole-storage
+!:mime application/x-bentley-dgn
+# http://www.q-cad.com/files/samples_cad_files/1344468165.dgn
+!:ext dgn
+#
+# URL: http://fileformats.archiveteam.org/wiki/WordPerfect
+# Second directory entry name PerfectOffice_
+>>>>128 lestring16 PerfectOffice_ : WordPerfect 7-X3 presentations Master, Document or Graphic
+!:mime application/vnd.wordperfect
+# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
+!:apple ????WPC7
+!:ext mst/wpd/wpg
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+# Second directory entry name MatOST_
+>>>>128 lestring16 MatOST : Microsoft Works 3.0 document
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+!:ext wps
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Spreadsheet
+# 3rd directory entry name WksSSWorkBook
+>>>>256 lestring16 WksSSWorkBook : Microsoft Works 6-9 spreadsheet
+!:mime application/vnd.ms-works
+!:apple ????AWSS
+!:ext xlr
+#
+# URL: http://fileformats.archiveteam.org/wiki/XLS
+# what is the difference to {00020820-0000-0000-c000-000000000046} ?
+# Second directory entry name Workbook
+>>>>128 lestring16 Workbook
+>>>>>256 lestring16 !WksSSWorkBook : Microsoft Excel 97-2003 worksheet 0 clsid
+!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
+!:apple ????XLS9
+!:ext xls
+#
+# URL: http://fileformats.archiveteam.org/wiki/PPT
+# Second directory entry name Object1 Object12 Object35
+>>>>128 lestring16 Object : Microsoft PowerPoint 4 presentation
+!:mime application/vnd.ms-powerpoint
+# https://www.macdisk.com/macsigen.php
+!:apple ????PPT3
+!:ext ppt
+#
+# URL: https://www.msoutlook.info/question/164
+# Second directory entry name __CollDataStm
+>>>>128 lestring16 __CollDataStm : Microsoft Outlook Send Receive Settings
+#!:mime application/vnd.ms-outlook
+!:mime application/x-ms-srs
+# %APPDATA%\Microsoft\Outlook\Outlook.srs
+!:ext srs
+#
+# URL: https://www.file-extensions.org/cag-file-extension
+# Second directory entry name Category
+>>>>128 lestring16 Category : Microsoft Clip Art Gallery
+#!:mime application/x-ole-storage
+!:mime application/x-ms-cag
+!:apple MScgCGdb
+!:ext cag/
+#
+# URL: https://www.filesuffix.com/de/extension/rra
+# 3rd directory entry name StrIndex_StringTable
+>>>>256 lestring16 StrIndex_StringTable : Windows temporarily installer
+#!:mime application/x-ole-storage
+!:mime application/x-ms-rra
+!:ext rra
+#
+# URL: https://www.forensicswiki.org/wiki/Jump_Lists
+# 3rd directory entry name DestList
+>>>>256 lestring16 DestList : Windows jump list
+#!:mime application/x-ole-storage
+!:mime application/x-ms-jumplist
+# %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
+!:ext automaticDestinations-ms
+#
+# URL: https://en.wikipedia.org/wiki/Windows_thumbnail_cache
+# Second directory entry name 256_
+>>>>128 lestring16 256_ : Windows thumbnail database 256
+#!:mime application/x-ole-storage
+!:mime application/x-ms-thumbnail
+# Thumbs.db
+!:ext db
+>>>>128 lestring16 96_ : Windows thumbnail database 96
+!:mime application/x-ms-thumbnail
+!:ext db
+# 3rd directory entry name Catalog_
+>>>>256 lestring16 Catalog : Windows thumbnail database
+!:mime application/x-ms-thumbnail
+!:ext db
+#
+# URL: https://support.microsoft.com/en-us/help/300887/how-to-use-system-information-msinfo32-command-line-tool-switches
+# Note: older Microsoft Systeminfo (MSInfo Configuration File of msinfo32); newer use xml based
+# Second directory entry name Control000
+>>>>128 lestring16 Control000 : Microsoft old Systeminfo
+#!:mime application/x-ole-storage
+!:mime application/x-ms-info
+!:ext nfo
+#
+# URL: http://fileformats.archiveteam.org/wiki/Corel_Print_House
+# Second directory entry name Thumbnail
+>>>>128 lestring16 Thumbnail : Corel PrintHouse image
+#!:mime application/x-ole-storage
+!:mime application/x-corel-cph
+!:ext cph
+# 3rd directory entry name Thumbnail
+>>>>256 lestring16 Thumbnail : Corel PrintHouse image
+!:mime application/x-corel-cph
+!:ext cph
+#
+# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)
+# Note: "HWP Document File" signature found in FileHeader
+# Second directory entry name FileHeader hint for Thinkfree Office document
+>>>>128 lestring16 FileHeader : Hangul (Korean) 5.0 Word Processor File
+#!:mime application/haansofthwp
+!:mime application/x-hwp
+# https://example-files.online-convert.com/document/hwp/example.hwp
+!:ext hwp
+#
+# URL: https://ask.libreoffice.org/en/question/26303/creating-new-themes-for-the-gallery-not-functioning/
+# Second directory entry name like dd2000 dd2001 dd2036 dd2060 dd2083
+>>>>128 lestring16 dd2 : StarOffice Gallery view
+#!:mime application/x-ole-storage
+!:mime application/x-star-sdv
+!:ext sdv
+# remaining null clsid
+>>>>128 default x : UNKNOWN
+!:mime application/x-ole-storage
+# look for known clsid GUID
# - Visio documents
-# Last update on 10/23/2006 by Lester Hightower
-> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document
-
-# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017
-# Update: Joerg Jenderek
-# from https://filext.com by Derek M Jones <derek@knosof.co.uk>
-# False positive with PPT (also currently this string is too long)
-#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
-#0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document
-#>48 byte 0x1B Excel Document
-#!:mime application/vnd.ms-excel
->546 string bjbj : Microsoft Word Document
+# URL: http://fileformats.archiveteam.org/wiki/Visio
+# Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
+>>88 ubequad 0xc000000000000046 : Microsoft
+>>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template
+!:mime application/vnd.visio
+# VSD~Drawing VSS~Stencil VST~Template
+!:ext vsd/vss/vst
+>>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template
+!:mime application/vnd.visio
+!:ext vsd/vss/vst
+#
+# URL: http://fileformats.archiveteam.org/wiki/Windows_Installer
+>>>80 ubequad 0x84100c0000000000 Windows Installer Package
+!:mime application/x-msi
+#!:mime application/x-ms-win-installer
+!:ext msi
+>>>80 ubequad 0x86100c0000000000 Windows Installer Patch
+# ??
+!:mime application/x-wine-extension-msp
+#!:mime application/x-ms-msp
+!:ext msp
+#
+# URL: http://fileformats.archiveteam.org/wiki/DOC
+>>>80 ubequad 0x0009020000000000 Word 6-95 document or template
!:mime application/msword
-# https://www.macdisk.com/macsigen.php
+# for template MSWDW8TN
!:apple MSWDWDBN
!:ext doc/dot
->546 string jbjb : Microsoft Word Document
+>>>80 ubequad 0x0609020000000000 Word 97-2003 document or template
!:mime application/msword
!:apple MSWDWDBN
-!:ext doc
+# dot for template; no extension on Macintosh
+!:ext doc/dot/
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+>>>80 ubequad 0x0213020000000000 Works 3-4 document or template
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+# ps for template https://filext.com/file-extension/PS bps for backup
+!:ext wps/ps/bps
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
+>>>80 ubequad 0x0313020000000000 Works 3-4 database or template
+!:mime application/vnd.ms-works-db
+# https://www.macdisk.com/macsigen.php
+!:apple ????AWDB
+# db for template www.file-extensions.org/db-file-extension-microsoft-works-data bdb for backup
+!:ext wdb/db/bdb
+#
+# URL: https://en.wikipedia.org/wiki/Microsoft_Excel
+>>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template
+!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php
+!:apple ????XLS5
+# worksheet/addin/template/no extension on Macintosh
+!:ext xls/xla/xlt/
+#
+>>>80 ubequad 0x2008020000000000 Excel 97-2003
+!:mime application/vnd.ms-excel
+# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
+!:apple ????XLS9
+# 3nd directory entry name
+>>>>256 lestring16 _VBA_PROJECT_CUR addin
+!:ext xla/
+# 4th directory entry name
+>>>>384 lestring16 _VBA_PROJECT_CUR addin
+!:ext xla
+#!:ext xla/
+>>>>256 default x worksheet or template
+!:ext xls/xlt
+#!:ext xls/xlt/
+#
+# URL: http://fileformats.archiveteam.org/wiki/OLE2
+>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item
+#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message
+#!:mime application/vnd.ms-outlook
+!:mime application/x-ms-msg
+!:ext msg
+# URL: https://wiki.fileformat.com/email/oft/
+>>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template
+#!:mime application/vnd.ms-outlook
+!:mime application/x-ms-oft
+!:ext oft
+#
+# URL: http://fileformats.archiveteam.org/wiki/PPT
+>>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation
+!:mime application/vnd.ms-powerpoint
+# https://www.macdisk.com/macsigen.php
+!:apple ????PPT3
+!:ext ppt
+#??
+# URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
+>>88 ubequad 0xa29a00aa004a1a72 : Microsoft
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+>>>80 ubequad 0xc2dbcd28e20ace11 Works 4 document
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+!:ext wps
+#
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
+>>>80 ubequad 0xc3dbcd28e20ace11 Works 4 database
+!:mime application/vnd.ms-works-db
+!:apple ????AWDB
+!:ext wdb/bdb
+#??
+>>88 ubequad 0xa40700c04fb932ba : Microsoft
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+>>>80 ubequad 0xb25aa40e0a9ed111 Works 5-6 document
+!:mime application/vnd.ms-works
+!:apple ????AWWP
+!:ext wps
+#??
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
+>>88 ubequad 0x00c0000000000046 : Microsoft
+>>>80 ubequad 0x0112020000000000 Publisher
+!:mime application/vnd.ms-publisher
+!:ext pub
+#
+# URL: http://fileformats.archiveteam.org/wiki/PPT
+#??
+>>88 ubequad 0xa90300aa00510ea3 : Microsoft
+>>>80 ubequad 0x70ae7bea3bfbcd11 PowerPoint 95 presentation
+!:mime application/vnd.ms-powerpoint
+# https://www.macdisk.com/macsigen.php
+!:apple ????PPT3
+!:ext ppt/pot
+#??
+>>88 ubequad 0x86ea00aa00b929e8 : Microsoft
+>>>80 ubequad 0x108d81649b4fcf11 PowerPoint 97-2003 presentation or template
+!:mime application/vnd.ms-powerpoint
+!:apple ????PPT3
+# /autostart/template
+!:ext ppt/pps/pot
+#
+# URL: https://en.wikipedia.org/wiki/Microsoft_Project
+#??
+>>88 ubequad 0xbe1100c04fb6faf1 : Microsoft
+>>>80 ubequad 0x3a8fb774c8c8d111 Project
+!:mime application/vnd.ms-project
+!:ext mpp
+#
+# URL: http://fileformats.archiveteam.org/wiki/SHW_(Corel)
+#???
+>>88 ubequad 0x99ae04021c007002 : WordPerfect
+>>>80 ubequad 0x62fe2e4099191b10 7-X3 presentation
+!:mime application/x-corelpresentations
+#!:mime application/x-shw-viewer
+#!:mime image/x-presentations
+!:ext shw
+#
+# URL: http://www.checkfilename.com/view-details/WordPerfect-Office-X3/RespageIndex/0/sTab/2/
+>>>80 ubequad 0x60fe2e4099191b10 9 Graphic
+#!:mime application/x-wpg
+#!:mime image/x-wordperfect-graphics
+!:mime image/x-wpg
+# https://www.macdisk.com/macsigen.php "WPC2" for Wordperfect 2 *.wpd
+!:apple ????WPC9
+!:ext wpg
+#
+# URL: http://fileformats.archiveteam.org/wiki/StarOffice_binary_formats
+>>88 ubequad 0x996104021c007002 : StarOffice
+>>>80 ubequad 0x407e5cdc5cb31b10 StarWriter 3.0 document or template
+# https://www.openoffice.org/framework/documentation/mimetypes/mimetypes.html
+!:mime application/x-starwriter
+!:ext sdw/vor
+#
+>>>80 ubequad 0xa03f543fa6b61b10 StarCalc 3.0 spreadsheet or template
+!:mime application/x-starcalc
+!:ext sdc/vor
+#
+>>>80 ubequad 0xe0aa10af6db31b10 StarDraw 3.0 drawing or template
+!:mime application/x-starimpress
+#!:mime application/x-stardraw
+# sda ??
+!:ext sdd/sda/vor
+#??
+>>88 ubequad 0x89cb008029e4b0b1 : StarOffice
+>>>80 ubequad 0x41d461633542d011 StarCalc 4.0 spreadsheet or template
+!:mime application/x-starcalc
+!:ext sdc/vor
+#
+>>>80 ubequad 0x61b8a5c6d685d111 StarCalc 5.0 spreadsheet or template
+!:mime application/vnd.stardivision.cal
+!:ext sdc/vor
+#
+>>>80 ubequad 0xc03c2d011642d011 StarImpress 4.0 presentation or template
+!:mime application/x-starimpress
+!:ext sdd/vor
+#??
+>>88 ubequad 0xb12a04021c007002 : StarOffice
+>>>80 ubequad 0x600459d4fd351c10 StarMath 3.0
+!:mime application/x-starmath
+!:ext smf
+#??
+>>88 ubequad 0x8e2c00001b4cc711 : StarOffice
+>>>80 ubequad 0xe0999cfb6d2c1c10 StarChart 3.0
+!:mime application/x-starchart
+!:ext sds
+#??
+>>88 ubequad 0xa45e00a0249d57b1 : StarOffice
+>>>80 ubequad 0xb0e9048b0e42d011 StarWriter 4.0 document or template
+!:mime application/x-starwriter
+!:ext sdw/vor
+#??
+>>88 ubequad 0x89ca008029e4b0b1 : StarOffice
+>>>80 ubequad 0xe1b7b3022542d011 StarMath 4.0
+!:mime application/x-starmath
+!:ext smf
+#
+>>>80 ubequad 0xe0b7b3022542d011 StarChart 4.0
+!:mime application/x-starchart
+!:ext sds
+#??
+>>88 ubequad 0xa53f00a0249d57b1 : StarOffice
+>>>80 ubequad 0x70c90a340de3d011 Master 4.0 document
+!:mime application/x-starwriter-global
+!:ext sgl
+#??
+>>88 ubequad 0x89d0008029e4b0b1 : StarOffice
+>>>80 ubequad 0x40e6b5ffde85d111 StarMath 5.0
+!:mime application/vnd.stardivision.math
+!:ext smf
+#
+>>>80 ubequad 0xa005892ebd85d111 StarDraw 5.0 drawing or template
+!:mime application/vnd.stardivision.draw
+!:ext sda/vor
+#
+>>>80 ubequad 0x21725c56bc85d111 StarImpress 5.0 presentation or template
+!:mime application/vnd.stardivision.impress
+# sda is used for what?
+!:ext sdd/vor/sda
+#
+>>>80 ubequad 0x214388bfdd85d111 StarChart 5.0
+!:mime application/vnd.stardivision.chart
+!:ext sds
+# ??
+>>88 ubequad 0xaab4006097da561a : StarOffice
+>>>80 ubequad 0xd1f90cc2ae85d111 StarWriter 5.0 document or template
+!:mime application/vnd.stardivision.writer
+!:ext sdw/vor
+#
+>>>80 ubequad 0xd3f90cc2ae85d111 Master 5.0 document
+!:mime application/vnd.stardivision.writer-global
+!:ext sgl
+#??
+# URL: http://fileformats.archiveteam.org/wiki/FlashPix
+>>88 ubequad 0x855300aa00a1f95b : Kodak
+>>>80 ubequad 0x0067615654c1ce11 FlashPIX Image
+!:mime image/vnd.fpx
+!:apple ????FPix
+!:ext fpx
+# remaining non null clsid
+>>88 default x : UNKNOWN
+!:mime application/x-ole-storage
+>>>80 ubequad !0 \b, clsid 0x%16.16llx
+>>>88 ubequad x \b%16.16llx
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: openfst,v 1.1 2019/09/30 15:58:24 christos Exp $
+# openfs: file(1) magic for OpenFST (Weighted finite-state tranducer library)
+
+0 long 0x7eb2fdd6 OpenFst binary FST data
+>&0 pstring/l x \b, fst type: %s
+>>&0 pstring/l x \b, arc type: %s
+>>>&0 long x \b, version: %d
+>>>>&20 quad x \b, num states: %lld
+>>>>>&0 quad >0 \b, num arcs: %lld
+
+0 long 0x56515c OpenFst binary FAR data, far type: stlist
+>4 long x \b, version: %d
+
+0 long 0x7eb2f35c OpenFst binary FAR data, far type: sttable
+>4 long x \b, version: %d
--- /dev/null
+
+#------------------------------------------------------------
+# $File: opentimestamps,v 1.1 2019/05/27 01:27:31 christos Exp $
+# OpenTimestamps related magic entries
+# https://opentimestamps.org/
+# https://en.wikipedia.org/wiki/OpenTimestamps
+# "Emanuele Cisbani" <emanuele.cisbani@gmail.com>
+#------------------------------------------------------------
+
+# OpenTimestamps Proof .ots format.
+# Magic is defined here:
+# https://github.com/opentimestamps/python-opentimestamps/\
+# blob/master/opentimestamps/core/timestamp.py#L273
+
+0 string \x00\x4f\x70\x65\x6e\x54\x69\x6d\x65\x73\x74\x61\x6d\x70\x73\x00 OpenTimestamps
+>16 string \x00\x50\x72\x6f\x6f\x66\x00\xbf\x89\xe2\xe8\x84\xe8\x92\x94\x01 Proof
#------------------------------------------------------------------------------
-# $File: pdf,v 1.10 2018/05/23 22:21:01 christos Exp $
+# $File: pdf,v 1.11 2019/09/12 15:53:49 christos Exp $
# pdf: file(1) magic for Portable Document Format
#
>6 byte x \b, version %c
>8 byte x \b.%c
+0 string \xef\xbb\xbf%PDF- PDF document (UTF-8)
+!:mime application/pdf
+!:strength +60
+>6 byte x \b, version %c
+>8 byte x \b.%c
+
# From: Nick Schmalenberger <nick@schmalenberger.us>
# Forms Data Format
0 string %FDF- FDF document
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: pmem,v 1.3 2019/06/13 11:45:44 christos Exp $
+# pmem: file(1) magic for Persistent Memory Development Kit pool files
+#
+0 string PMEM
+>4 string POOLSET Persistent Memory Poolset file
+>>11 search REPLICA with replica
+>4 regex LOG|BLK|OBJ Persistent Memory Pool file, type: %s,
+>>8 lelong >0 version: 0x%x,
+>>12 lelong x compat: 0x%x,
+>>16 lelong x incompat: 0x%x,
+>>20 lelong x ro_compat: 0x%x,
+
+
+>>120 leqldate x crtime: %s,
+>>128 lequad x alignment_desc: 0x%016llx,
+
+>>136 clear x
+>>136 byte 2 machine_class: 64-bit,
+>>136 default x machine_class: unknown
+>>>136 byte x (0x%d),
+
+>>137 clear x
+>>137 byte 1 data: little-endian,
+>>137 byte 2 data: big-endian,
+>>137 default x data: unknown
+>>>137 byte x (0x%d),
+
+>>138 byte !0 reserved[0]: %d,
+>>139 byte !0 reserved[1]: %d,
+>>140 byte !0 reserved[2]: %d,
+>>141 byte !0 reserved[3]: %d,
+
+>>142 clear x
+>>142 leshort 62 machine: x86_64
+>>142 leshort 183 machine: aarch64
+>>142 default x machine: unknown
+>>>142 leshort x (0x%d)
+
+>4 string BLK
+>>4096 lelong x \b, blk.bsize: %d
+
+>4 string OBJ
+>>4096 string >0 \b, obj.layout: '%s'
+>>4096 string <0 \b, obj.layout: NULL
#------------------------------------------------------------------------------
-# $File: python,v 1.36 2019/04/09 18:28:25 christos Exp $
+# $File: python,v 1.37 2019/10/21 19:40:58 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
# From: David Necas <yeti@physics.muni.cz>
# often the module starts with a multiline string
0 string/t """ Python script text executable
-# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
-# that Py_UnicodeFlag is off for Python 2)
+# MAGIC as specified in Python/import.c (1.0 to 3.7)
# two bytes of magic followed by "\r\n" in little endian order
-0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
+0 belong 0x02099900 python 1.0 byte-compiled
+0 belong 0x03099900 python 1.1/1.2 byte-compiled
+0 belong 0x892e0d0a python 1.3 byte-compiled
+0 belong 0x04170d0a python 1.4 byte-compiled
+0 belong 0x994e0d0a python 1.5 byte-compiled
+0 belong 0xfcc40d0a python 1.6 byte-compiled
+0 belong 0xfdc40d0a python 1.6 byte-compiled
0 belong 0x87c60d0a python 2.0 byte-compiled
+0 belong 0x88c60d0a python 2.0 byte-compiled
0 belong 0x2aeb0d0a python 2.1 byte-compiled
+0 belong 0x2beb0d0a python 2.1 byte-compiled
0 belong 0x2ded0d0a python 2.2 byte-compiled
+0 belong 0x2eed0d0a python 2.2 byte-compiled
0 belong 0x3bf20d0a python 2.3 byte-compiled
+0 belong 0x3cf20d0a python 2.3 byte-compiled
0 belong 0x6df20d0a python 2.4 byte-compiled
+0 belong 0x6ef20d0a python 2.4 byte-compiled
0 belong 0xb3f20d0a python 2.5 byte-compiled
+0 belong 0xb4f20d0a python 2.5 byte-compiled
0 belong 0xd1f20d0a python 2.6 byte-compiled
+0 belong 0xd2f20d0a python 2.6 byte-compiled
0 belong 0x03f30d0a python 2.7 byte-compiled
+0 belong 0x04f30d0a python 2.7 byte-compiled
0 belong 0x3b0c0d0a python 3.0 byte-compiled
0 belong 0x4f0c0d0a python 3.1 byte-compiled
0 belong 0x6c0c0d0a python 3.2 byte-compiled
0 belong 0x9e0c0d0a python 3.3 byte-compiled
0 belong 0xee0c0d0a python 3.4 byte-compiled
-0 belong 0x160d0d0a python 3.5.1- byte-compiled
-0 belong 0x170d0d0a python 3.5.2+ byte-compiled
+0 belong 0x160d0d0a python 3.5.2- byte-compiled
+0 belong 0x170d0d0a python 3.5.3+ byte-compiled
0 belong 0x330d0d0a python 3.6 byte-compiled
0 belong 0x420d0d0a python 3.7 byte-compiled
#------------------------------------------------------------------------------
-# $File: rpi,v 1.1 2018/01/01 05:25:17 christos Exp $
+# $File: rpi,v 1.2 2019/10/02 02:07:30 christos Exp $
# rpi: file(1) magic for Raspberry Pi images
-44 lelong 0
>4 lelong 0
>>>>>>>32 lelong 44
>>>>>>>>36 lelong 4
>>>>>>>>>40 string RPTL Raspberry PI kernel image
+
+-56 lelong 0
+>4 lelong 0
+>>8 lelong 1
+>>12 lelong 4
+>>>16 string 283x
+>>>>20 lelong 1
+>>>>>24 lelong 4
+>>>>>>28 string DTOK
+>>>>>>>32 lelong 1
+>>>>>>>>36 lelong 4
+>>>>>>>>>40 string DDTK8
+>>>>>>>>>>48 lelong 4
+>>>>>>>>>>>52 string RPTL Raspberry PI kernel image
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: rst,v 1.2 2019/11/02 18:41:26 christos Exp $
+# rst: ReStructuredText http://docutils.sourceforge.net/rst.html
+0 search/256 \=\=
+!:strength + 30
+>&0 regex/256 \^[\=]+$
+>>&0 search/512 :Author: ReStructuredText file
+>>&0 default x
+>>>&0 regex/512 \^\.\.[A-Za-z] ReStructuredText file
+!:ext rst
#------------------------------------------------------------------------------
-# $File: ruby,v 1.9 2019/04/19 00:42:27 christos Exp $
+# $File: ruby,v 1.10 2019/07/21 09:40:17 christos Exp $
# ruby: file(1) magic for Ruby scripting language
# URL: https://www.ruby-lang.org/
# From: Reuben Thomas <rrt@sc3d.org>
# (modules and such)
# From: Lubomir Rintel <lkundrak@v3.sk>
0 search/8192 require
->0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
+>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+'
>>0 regex def\ [a-z]|\ do$
>>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
!:strength + 30
!:mime text/x-ruby
0 search/8192 require
->0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' Ruby script text
+>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/.]+' Ruby script text
!:mime text/x-ruby
0 search/8192 include
>0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text
#------------------------------------------------------------------------------
-# $File: sgml,v 1.39 2019/04/19 00:42:27 christos Exp $
+# $File: sgml,v 1.40 2019/09/30 15:44:22 christos Exp $
# Type: SVG Vectorial Graphics
# From: Noel Torres <tecnico@ejerciciosresueltos.com>
0 string \<?xml\ version=
>>19 search/4096 \<gnc-v2 GnuCash file
!:mime application/x-gnucash
0 string \<svg SVG Scalable Vector Graphics image
-!:mime image/svg
+!:mime image/svg+xml
# Sitemap file
0 string/t \<?xml\ version=
0 string \<?xml\ version=
>14 regex ['"\ \t]*[0-9.]+['"\ \t]*
>>19 search/4096 \<pef Portable Embosser Format
-!:mime application/x-pef+xml
\ No newline at end of file
+!:mime application/x-pef+xml
#------------------------------------------------------------------------------
-# $File: sniffer,v 1.25 2019/05/05 17:03:41 christos Exp $
+# $File: sniffer,v 1.27 2019/12/08 18:22:24 christos Exp $
# sniffer: file(1) magic for packet capture files
#
# From: guy@alum.mit.edu (Guy Harris)
>20 belong 9 (PPP
>20 belong 10 (FDDI
>20 belong 11 (RFC 1483 ATM
->20 belong 12 (raw IP
+>20 belong 12 (Raw IP
>20 belong 13 (BSD/OS SLIP
>20 belong 14 (BSD/OS PPP
>20 belong 19 (Linux ATM Classical IP
>20 belong 51 (PPP-over-Ethernet
>20 belong 99 (Symantec Enterprise Firewall
>20 belong 100 (RFC 1483 ATM
->20 belong 101 (raw IP
+>20 belong 101 (Raw IP
>20 belong 102 (BSD/OS SLIP
>20 belong 103 (BSD/OS PPP
>20 belong 104 (BSD/OS Cisco HDLC
>20 belong 279 (Elektrobit High Speed Capture and Replay (EBHSCR)
>20 belong 281 (Broadcom tag
>20 belong 282 (Broadcom tag (prepended)
+>20 belong 284 (Marvell DSA
+>20 belong 285 (Marvell EDSA
# print default match
>20 default x
>>20 belong x (linktype#%u
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: sosi,v 1.1 2019/05/20 17:25:09 christos Exp $
+# SOSI
+# Summary: Systematic Organization of Spatial Information
+# Long description: Norwegian text based map format
+# File extension: .sos
+# Full name: Petter Reinholdtsen (pere@hungry.com)
+# Reference: https://en.wikipedia.org/wiki/SOSI
+#
+# Example SOSI files available from
+# https://trac.osgeo.org/gdal/ticket/3638
+# https://nedlasting.geonorge.no/geonorge/Basisdata/N50Kartdata/SOSI/
+# https://nedlasting.geonorge.no/geonorge/Samferdsel/Elveg/SOSI/
+#
+# Start with optional comments (from "!" to the next line end)
+# followed by ".HODE" and end with "\n.SLUTT" followed by an optional
+# separator (any number of " ", "\t", "\n" or "\r"), might have BOM at
+# the start and following ".HODE" near the start there is "..OMR=C3=85DE"
+# (either UTF-8, ISO-8859-1 or some 7 bit Norwegian charset based on
+# ASCII) , "..TRANSPAR", "..TEGNSETT " followed by the charset and a
+# separator, as well as "..SOSI-VERSJON " followed by the format
+# version and a separator.
+#
+# FIXME figure out how to accept any of [space], [tab], [newline] and
+# [carrige return] as separators, not only line end.
+
+# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8
+# character sets
+0 search ..OMR
+>0 search ..TRANSPAR
+>>0 search .HODE SOSI map data
+>>>&0 search ..SOSI-VERSJON
+>>>>&1 string x \b, version %s
+# FIXME could not figure out way to make a match for .SLUTT at the end required
+#>-7 string \n.SLUTT slutt
+#>-8 string \n.SLUTT\n slutt-nl
+#>-9 string \n.SLUTT\r\n slutt-crnl2
+!:mime text/vnd.sosi
+!:ext sos
0 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key
0 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key
0 string ssh-ed25519 OpenSSH ED25519 public key
+
+0 string SSHKRL\n\0
+>8 ubelong 1 OpenSSH key/certificate revocation list, format %u
+>>12 ubequad x \b, version %llx
+>>>20 beqdate x \b, generated %s
+
#------------------------------------------------------------------------------
-# $File$
+# $File: uuencode,v 1.8 2019/12/14 20:40:26 christos Exp $
# uuencode: file(1) magic for ASCII-encoded files
#
# Greg Roelofs, newt@uchicago.edu
0 search/1 Decode\ the\ following\ with\ bdeco bencoded News text
-# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
-# Daniel Quinlan, quinlan@yggdrasil.com
-11 search/1 must\ be\ converted\ with\ BinHex BinHex binary text
->41 search/1 x \b, version %.3s
-
# GRR: handle BASE64
#------------------------------------------------------------------------------
-# $File: varied.script,v 1.12 2019/04/19 00:42:27 christos Exp $
+# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $
# varied.script: file(1) magic for various interpreter scripts
0 string/t #!\ / a
>3 string >\0 %s script text executable
+!:strength / 2
0 string/b #!\ / a
>3 string >\0 %s script executable (binary data)
+!:strength / 2
0 string/t #!\t/ a
>3 string >\0 %s script text executable
+!:strength / 2
0 string/b #!\t/ a
>3 string >\0 %s script executable (binary data)
+!:strength / 2
0 string/t #!/ a
>2 string >\0 %s script text executable
+!:strength / 2
0 string/b #!/ a
>2 string >\0 %s script executable (binary data)
+!:strength / 2
0 string/t #!\ script text executable
>3 string >\0 for %s
+!:strength / 2
0 string/b #!\ script executable
>3 string >\0 for %s (binary data)
+!:strength / 2
# using env
0 string/t #!/usr/bin/env a
#------------------------------------------------------------------------------
-# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $
+# $File: vax,v 1.10 2019/10/04 18:07:46 christos Exp $
# vax: file(1) magic for VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
# The `versions' were commented out, but have been un-commented out.
# (Was the problem just one of endianness?)
#
-0 leshort 0570 VAX COFF executable
->12 lelong >0 not stripped
->22 leshort >0 - version %d
-0 leshort 0575 VAX COFF pure executable
->12 lelong >0 not stripped
->22 leshort >0 - version %d
+0 leshort 0570
+>2 uleshort <100 VAX COFF executable, sections %d
+>>4 ledate x \b, created %s
+>>12 lelong >0 \b, not stripped
+>>22 leshort >0 \b, version %d
+
+0 leshort 0575
+>2 uleshort <100 VAX COFF pure executable, sections %d
+>>4 ledate x \b, created %s
+>>12 lelong >0 \b, not stripped
+>>22 leshort >0 \b, version %d
#------------------------------------------------------------------------------
-# $File: windows,v 1.26 2019/05/01 17:55:25 christos Exp $
+# $File: windows,v 1.29 2019/11/18 03:11:20 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
# 3rd BLOB
>>0x480 string >\0 \b, type %-3.8s
+# Summary: Windows boot status log BOOTSTAT.DAT
+# From: Joerg Jenderek
+# Reference: https://www.geoffchappell.com/notes/windows/boot/bsd.htm
+# Note: mainly refers to older Windows Vista, sometimes
+# BOOTSTAT.DAT only contains nulls or invalid data
+# checking for valid version below 5
+0 ulelong <5
+# skip many ISO images by checking for valid 64 KiB file size
+>8 ulelong =0x00010000
+>>0 use bootstat-dat
+# display information of BOOTSTAT.DAT
+0 name bootstat-dat
+>0 ulelong x Windows boot log
+#!:mime application/octet-stream
+!:mime application/x-ms-dat
+# BOOTSTAT.DAT in BOOT subdirectory
+!:ext dat
+# apparently a version number: 2 for older like Vista, 3, 4 Windows 10
+>0 ulelong >2 \b, version %u
+# apparently the size of the header: often 10h in older Windows, 14h, 18h
+>4 ulelong !0x10 \b, header size 0x%x
+#>4 ulelong !0x10 \b, header size %u
+# apparently the size of the file: always 0x00010000~64KiB
+# the file is acceptable to BOOTMGR only if it is exactly 64 KiB
+>8 ulelong !0x00010000 \b, file size 0x%x
+# size of valid data, in bytes: C8h 50h 172h 5D5Ch
+>0xc ulelong x \b, 0x%x valid bytes
+# skip header and jump to first bootstat entry and display information
+>(0x4.l-1) ubyte x
+>>&0 use bootstat-entry
+# jump to first entry again because pointer are bad after "use"
+>(0x4.l-1) ubyte x
+# by 1st entry size jump to 2nd entry and display information
+>>&(&0x18.l-1) ubyte x
+>>>&0 use bootstat-entry
+# jump to possible 3rd boot entry and display information
+# >(0x4.l-1) ubyte x
+# >>&(&0x18.l-1) ubyte x
+# >>>&(&0x18.l-1) ubyte x
+# >>>>&0 use bootstat-entry
+# display BOOTSTAT.DAT entry
+0 name bootstat-entry
+#>0x00 ubequad x \b, ENTRY %16.16llx
+# size of entry, in bytes: 40h(init) 78h(launced) 9Ch
+#>0x18 ulelong x \b; entry size %u
+>0x18 ulelong x \b; entry size 0x%x
+# time stamp, in seconds
+>0x00 ulelong x \b, 0x%x seconds
+# always zero, significance unknown
+>0x04 ulelong !0 \b, not null %u
+# GUID of event source; but empty if event source is BOOTMGR
+>0x08 ubequad !0 \b, GUID 0x%16.16llx
+>>0x10 ubequad x \b%16.16llx
+# severity code: 1~informational 3~errors
+>0x1C ulelong !1 \b, severity 0x%x
+# apparently a version number: 2
+>0x20 ulelong !2 \b, version %u
+# event identifier 1~log file initialised 11h~boot application launched
+#>0x24 ulelong x \b, event 0x%x
+>0x24 ulelong !1
+>>0x24 ulelong !0x11 \b, event 0x%x
+# entry data; size depends on event identifier
+#>0x28 ubequad x \b, data 0x%16.16llx
+>0x24 ulelong =0x1 \b, Init
+# always 0, significance unknown
+>>0x34 uleshort !0 \b, not null %u
+# always 7, significance unknown
+>>0x36 uleshort !7 \b, not seven %u
+# year
+>>0x28 uleshort x %u
+# month
+>>0x2A uleshort x \b-%u
+# day
+>>0x2C uleshort x \b-%u
+# hour
+>>0x2E uleshort x %u
+# minute
+>>0x30 uleshort x \b:%u
+# second
+>>0x32 uleshort x \b:%u
+# boot application launched
+>0x24 ulelong =0x11 \b, launched
+# type of start: 0 normally, 1 or 2 maybe in a recovery sequence
+>>0x38 uleshort !0 \b, type %u
+# pathname of boot application, as null-terminated Unicode string; typically
+# \Windows\system32\winload.exe \Windows\system32\winload.efi
+>>0x3C lestring16 x %s
+
# Summary: Windows Error Report text files
# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting
# Reference: https://www.nirsoft.net/utils/app_crash_view.html
!:apple ????TEXT
!:ext cnt
#
-# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
+# Windows creates a full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
0 string tfMR MS Windows help Full Text Search index
!:mime application/x-winhelp-fts
!:ext fts
# https://en.wikipedia.org/wiki/CONFIG.SYS
>>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS
# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
-# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYTEM\MSCONFIG.EXE
-# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYTEM\MSCONFIG.EXE
+# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYSTEM\MSCONFIG.EXE
+# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYSTEM\MSCONFIG.EXE
# dos and w40 used in dual booting scene
!:ext sys/dos/w40
# https://support.microsoft.com/kb/118579/
>0x1c string >\0 \b%.7s
# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ...
>0xc0 string x %s
-# AppId[0x80] is simliar to AppName or
+# AppId[0x80] is similar to AppName or
# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
>0x40 ubyte 0x7b
>>0x40 string x %-.38s
#>148 ubequad !0 \b,unused 0x%16.16llx
#
+# From: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Windows_Easy_Transfer
+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mig.trid.xml
+# Note: called "Windows Easy Transfer migration data" by TrID,
+# "Migration Store" or "EasyTransfer file" by Microsoft
+0 string 1giM Windows Easy Transfer migration data
+#!:mime application/octet-stream
+!:mime application/x-ms-mig
+!:ext mig
+>0x18 string =MRTS without password
+# data offset with 1 space at end
+>>0x1c ulelong+0x38 x \b, at 0x%x
+# look for zlib compressed data by ./compress
+>>(0x1c.l+0x38) ubyte x
+>>>&-1 indirect x
+# in password protected examples MRTS comes some bytes further
+>0x18 string !MRTS with password
+# look for first MRTS tag
+>0x18 search/29/b MRTS
+# probably first file name length like 178, ...
+#>>&0 ulelong x \b, 1st length %u
+# URL like File\C:\Users\nutzer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
+>>&20 lestring16 x \b, 1st %-s
+
#------------------------------------------------------------------------------
-# $File: wordprocessors,v 1.20 2019/04/19 00:42:27 christos Exp $
+# $File: wordprocessors,v 1.23 2019/10/25 20:15:49 christos Exp $
# wordprocessors: file(1) magic fo word processors.
#
####### PWP file format used on Smith Corona Personal Word Processors:
>25 byte 0x54 \b, legal
>26 byte 0x46 \b, A4
+# URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
+# reference: http://mark0.net/download/triddefs_xml.7z
+# /defs/w/wps-works-dos.trid.xml
+# From: Joerg Jenderek
+# Note: older non OLE 2 Compound based versions
+0 ubeshort =0x01FE
+>112 ubeshort =0x0100 Microsoft Works 1-3 (DOS) or 2 (Windows) document
+# title like THE GREAT KHAN GAME
+>>0x100 string x %s
+!:mime application/vnd-ms-works
+#!:mime application/x-msworks
+# https://www.macdisk.com/macsigen.php
+!:apple ????AWWP
+!:ext wps
+
# Corel/WordPerfect
0 string \xffWPC
# WordPerfect
# Hangul (Korean) Word Processor File
0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
-# From: Won-Kyu Park <wkpark@kldp.org>
-512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
-!:mime application/x-hwp
# CosmicBook, from Benoit Rouits
0 string CSBK Ted Neslson's CosmicBook hypertext file
# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
0 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file
+
+# From: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/StarOffice
+# Note: used in Star-, Open- and Libre-Office
+# named as soffice.StarConfigFile.6 or OpenOffice.org configuration by others
+0 ubeshort 0x0400
+#>(2.s+8) ubequad x \b, gap 0x%16.16llx
+# test for null value in gap after theme name maybe unreliable
+#>(2.s+9) ubyte 0 \b, 0-byte
+# look for keyword GALRESRV near the end
+# "C:\Program Files (x86)\StarOffice6.0\share\gallery\sg27.thm" Navigation, 238 objects
+#>0 search/8415 GALRESRV \b, GALRESRV found
+# "neues thema6.thm" MorePictures, 315 objects
+#>0 search/19299 GALRESRV \b, GALRESRV FOUND
+#>2 uleshort x \b, name length %u
+# skip file2147.chk by check for positive name length like for sg16.thm "3D"
+>2 uleshort >0 StarOffice Gallery theme
+!:mime application/x-stargallery-thm
+!:ext thm
+# gallery name
+>>2 pstring/h x %s
+# number of objects
+>>(2.s+4) ulelong x \b, %u object
+# plural s
+>>(2.s+4) ulelong !1 \bs
+# if available then display first object name
+>>(2.s+4) ulelong >0
+# partial file name, URL or internal name like "dd2*" of 1st object or RESRV
+>>>(2.s+11) pstring/h x \b, 1st %s
+
#------------------------------------------------------------------------------
-# $File: zip,v 1.2 2019/04/09 18:34:15 christos Exp $
+# $File: zip,v 1.3 2019/07/06 19:25:06 christos Exp $
# zip: file(1) magic for zip files; this is not use
# Note the version of magic in archive is currently stronger, this is
# just an example until negative offsets are supported better
#>10 leshort >1 \b, %d central directories
#>12 lelong x \b, %d central directory bytes
>(16.l) use zipcd
->20 pstring/l >0 \b, %s
+>>20 pstring/l >0 \b, %s
#
-# $File: Makefile.am,v 1.143 2019/05/09 16:24:36 christos Exp $
+# $File: Makefile.am,v 1.151 2019/11/02 18:37:58 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
$(MAGIC_FRAGMENT_DIR)/flash \
$(MAGIC_FRAGMENT_DIR)/flif \
$(MAGIC_FRAGMENT_DIR)/fonts \
+$(MAGIC_FRAGMENT_DIR)/forth \
$(MAGIC_FRAGMENT_DIR)/fortran \
$(MAGIC_FRAGMENT_DIR)/frame \
$(MAGIC_FRAGMENT_DIR)/freebsd \
$(MAGIC_FRAGMENT_DIR)/geo \
$(MAGIC_FRAGMENT_DIR)/geos \
$(MAGIC_FRAGMENT_DIR)/gimp \
+$(MAGIC_FRAGMENT_DIR)/git \
$(MAGIC_FRAGMENT_DIR)/glibc \
$(MAGIC_FRAGMENT_DIR)/gnome \
$(MAGIC_FRAGMENT_DIR)/gnu \
$(MAGIC_FRAGMENT_DIR)/mlssa \
$(MAGIC_FRAGMENT_DIR)/mmdf \
$(MAGIC_FRAGMENT_DIR)/modem \
+$(MAGIC_FRAGMENT_DIR)/modulefile \
$(MAGIC_FRAGMENT_DIR)/motorola \
$(MAGIC_FRAGMENT_DIR)/mozilla \
$(MAGIC_FRAGMENT_DIR)/msdos \
$(MAGIC_FRAGMENT_DIR)/octave \
$(MAGIC_FRAGMENT_DIR)/ole2compounddocs \
$(MAGIC_FRAGMENT_DIR)/olf \
+$(MAGIC_FRAGMENT_DIR)/openfst \
+$(MAGIC_FRAGMENT_DIR)/opentimestamps \
$(MAGIC_FRAGMENT_DIR)/os2 \
$(MAGIC_FRAGMENT_DIR)/os400 \
$(MAGIC_FRAGMENT_DIR)/os9 \
$(MAGIC_FRAGMENT_DIR)/pkgadd \
$(MAGIC_FRAGMENT_DIR)/plan9 \
$(MAGIC_FRAGMENT_DIR)/plus5 \
+$(MAGIC_FRAGMENT_DIR)/pmem \
$(MAGIC_FRAGMENT_DIR)/polyml \
$(MAGIC_FRAGMENT_DIR)/printer \
$(MAGIC_FRAGMENT_DIR)/project \
$(MAGIC_FRAGMENT_DIR)/rpm \
$(MAGIC_FRAGMENT_DIR)/rpmsg \
$(MAGIC_FRAGMENT_DIR)/rtf \
+$(MAGIC_FRAGMENT_DIR)/rst \
$(MAGIC_FRAGMENT_DIR)/ruby \
$(MAGIC_FRAGMENT_DIR)/sc \
$(MAGIC_FRAGMENT_DIR)/sccs \
$(MAGIC_FRAGMENT_DIR)/smile \
$(MAGIC_FRAGMENT_DIR)/sniffer \
$(MAGIC_FRAGMENT_DIR)/softquad \
+$(MAGIC_FRAGMENT_DIR)/sosi \
$(MAGIC_FRAGMENT_DIR)/spec \
$(MAGIC_FRAGMENT_DIR)/spectrum \
$(MAGIC_FRAGMENT_DIR)/sql \
## use bc with sed to convert and format Hz to kHz
stripped_rate="$(LANG=C bc <<< "scale=5; ${samplerate} / 1000" | \
sed 's#[0\.]*$##g')"
- ## only add uniq sample rates (should be neccessary
+ ## only add uniq sample rates (should be necessary
if [[ ! "${stripped_rates[@]}" =~ ${stripped_rate} ]]; then
printf -v line ">>17\tbelong&%#-15x\t%#08x\t%s, %s kHz\n" \
"16777200" \
AM_CFLAGS = $(CFLAG_VISIBILITY) @WARNINGS@
libmagic_la_SOURCES = buffer.c magic.c apprentice.c softmagic.c ascmagic.c \
- encoding.c compress.c is_json.c is_tar.c readelf.c print.c fsmagic.c \
- funcs.c file.h readelf.h tar.h apptype.c der.c der.h \
+ encoding.c compress.c is_csv.c is_json.c is_tar.c readelf.c print.c \
+ fsmagic.c funcs.c file.h readelf.h tar.h apptype.c der.c der.h \
file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h
libmagic_la_LDFLAGS = -no-undefined -version-info 1:0:0
if MINGW
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: apprentice.c,v 1.283 2019/02/20 02:35:27 christos Exp $")
+FILE_RCSID("@(#)$File: apprentice.c,v 1.284 2019/06/29 22:31:04 christos Exp $")
#endif /* lint */
#include "magic.h"
file_magwarn(ms, "offset `%s' invalid", l);
return -1;
}
-#if 0
- if (m->offset < 0 && cont_level != 0 &&
- (m->flag & (OFFADD | INDIROFFADD)) == 0) {
- if (ms->flags & MAGIC_CHECK) {
- file_magwarn(ms,
- "negative direct offset `%s' at level %u",
- l, cont_level);
- }
- return -1;
- }
-#endif
+
l = t;
if (m->flag & INDIR) {
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: ascmagic.c,v 1.104 2019/05/07 02:27:11 christos Exp $")
+FILE_RCSID("@(#)$File: ascmagic.c,v 1.105 2019/06/08 20:49:14 christos Exp $")
#endif /* lint */
#include "magic.h"
#include <string.h>
-#include <memory.h>
#include <ctype.h>
#include <stdlib.h>
#ifdef HAVE_UNISTD_H
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: buffer.c,v 1.6 2019/05/07 02:27:11 christos Exp $")
+FILE_RCSID("@(#)$File: buffer.c,v 1.7 2019/06/10 21:35:26 christos Exp $")
#endif /* lint */
#include "magic.h"
b->eoff = b->st.st_size - b->elen;
if (pread(b->fd, b->ebuf, b->elen, b->eoff) == -1) {
free(b->ebuf);
+ b->ebuf = NULL;
goto out;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.114 2019/02/20 02:35:27 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.116 2019/08/26 14:31:39 christos Exp $")
#endif
#include <assert.h>
#define EFTYPE EINVAL
#endif
+#ifndef SIZE_T_MAX
+#define SIZE_T_MAX CAST(size_t, ~0ULL)
+#endif
+
#include "cdf.h"
#ifdef CDF_DEBUG
const cdf_header_t *h, cdf_secid_t id)
{
size_t ss = CDF_SEC_SIZE(h);
- size_t pos = CDF_SEC_POS(h, id);
+ size_t pos;
+
+ if (SIZE_T_MAX / ss < CAST(size_t, id))
+ return -1;
+
+ pos = CDF_SEC_POS(h, id);
assert(ss == len);
return cdf_read(info, CAST(off_t, pos), RCAST(char *, buf) + offs, len);
}
size_t len, const cdf_header_t *h, cdf_secid_t id)
{
size_t ss = CDF_SHORT_SEC_SIZE(h);
- size_t pos = CDF_SHORT_SEC_POS(h, id);
+ size_t pos;
+
+ if (SIZE_T_MAX / ss < CAST(size_t, id))
+ return -1;
+
+ pos = CDF_SHORT_SEC_POS(h, id);
assert(ss == len);
if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
goto out;
}
nelements = CDF_GETUINT32(q, 1);
- if (nelements == 0) {
- DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+ if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
+ DPRINTF(("CDF_VECTOR with nelements == %"
+ SIZE_T_FORMAT "u\n", nelements));
goto out;
}
slen = 2;
goto out;
inp += nelem;
}
- DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
- nelements));
for (j = 0; j < nelements && i < sh.sh_properties;
j++, i++)
{
typedef int32_t cdf_secid_t;
#define CDF_LOOP_LIMIT 10000
+#define CDF_ELEMENT_LIMIT 100000
#define CDF_SECID_NULL 0
#define CDF_SECID_FREE -1
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: compress.c,v 1.121 2019/05/07 02:27:11 christos Exp $")
+FILE_RCSID("@(#)$File: compress.c,v 1.124 2019/07/21 11:42:09 christos Exp $")
#endif
#include "magic.h"
#include <zlib.h>
#endif
-#if defined(HAVE_BZLIB_H)
+#if defined(HAVE_BZLIB_H) || defined(BZLIBSUPPORT)
#define BUILTIN_BZLIB
#include <bzlib.h>
#endif
+#if defined(HAVE_XZLIB_H) || defined(XZLIBSUPPORT)
+#define BUILTIN_XZLIB
+#include <lzma.h>
+#endif
+
#ifdef DEBUG
int tty = -1;
#define DPRINTF(...) do { \
}
#endif
+static int
+lzmacmp(const unsigned char *buf)
+{
+ if (buf[0] != 0x5d || buf[1] || buf[2])
+ return 0;
+ if (buf[12] && buf[12] != 0xff)
+ return 0;
+ return 1;
+}
+
#define gzip_flags "-cd"
#define lrzip_flags "-do"
#define lzip_flags gzip_flags
private const struct {
const void *magic;
- size_t maglen;
+ int maglen;
const char **argv;
void *unused;
} compr[] = {
- { "\037\235", 2, gzip_args, NULL }, /* compressed */
+#define METH_FROZEN 2
+#define METH_BZIP 7
+#define METH_XZ 9
+#define METH_LZMA 13
+#define METH_ZLIB 14
+ { "\037\235", 2, gzip_args, NULL }, /* 0, compressed */
/* Uncompress can get stuck; so use gzip first if we have it
* Idea from Damien Clark, thanks! */
- { "\037\235", 2, uncompress_args, NULL }, /* compressed */
- { "\037\213", 2, gzip_args, do_zlib }, /* gzipped */
- { "\037\236", 2, gzip_args, NULL }, /* frozen */
- { "\037\240", 2, gzip_args, NULL }, /* SCO LZH */
+ { "\037\235", 2, uncompress_args, NULL }, /* 1, compressed */
+ { "\037\213", 2, gzip_args, do_zlib }, /* 2, gzipped */
+ { "\037\236", 2, gzip_args, NULL }, /* 3, frozen */
+ { "\037\240", 2, gzip_args, NULL }, /* 4, SCO LZH */
/* the standard pack utilities do not accept standard input */
- { "\037\036", 2, gzip_args, NULL }, /* packed */
- { "PK\3\4", 4, gzip_args, NULL }, /* pkzipped, */
+ { "\037\036", 2, gzip_args, NULL }, /* 5, packed */
+ { "PK\3\4", 4, gzip_args, NULL }, /* 6, pkzipped, */
/* ...only first file examined */
- { "BZh", 3, bzip2_args, do_bzlib }, /* bzip2-ed */
- { "LZIP", 4, lzip_args, NULL }, /* lzip-ed */
- { "\3757zXZ\0", 6, xz_args, NULL }, /* XZ Utils */
- { "LRZI", 4, lrzip_args, NULL }, /* LRZIP */
- { "\004\"M\030",4, lz4_args, NULL }, /* LZ4 */
- { "\x28\xB5\x2F\xFD", 4, zstd_args, NULL }, /* zstd */
+ { "BZh", 3, bzip2_args, do_bzlib }, /* 7, bzip2-ed */
+ { "LZIP", 4, lzip_args, NULL }, /* 8, lzip-ed */
+ { "\3757zXZ\0", 6, xz_args, NULL }, /* 9, XZ Utils */
+ { "LRZI", 4, lrzip_args, NULL }, /* 10, LRZIP */
+ { "\004\"M\030",4, lz4_args, NULL }, /* 11, LZ4 */
+ { "\x28\xB5\x2F\xFD", 4, zstd_args, NULL }, /* 12, zstd */
+ { RCAST(const void *, lzmacmp), -13, xz_args, NULL }, /* 13, lzma */
#ifdef ZLIBSUPPORT
- { RCAST(const void *, zlibcmp), 0, zlib_args, NULL }, /* zlib */
+ { RCAST(const void *, zlibcmp), -2, zlib_args, NULL }, /* 14, zlib */
#endif
};
#endif
#ifdef BUILTIN_BZLIB
private int uncompressbzlib(const unsigned char *, unsigned char **, size_t,
- size_t *, int);
+ size_t *);
+#endif
+#ifdef BUILTIN_XZLIB
+private int uncompressxzlib(const unsigned char *, unsigned char **, size_t,
+ size_t *);
#endif
static int makeerror(unsigned char **, size_t *, const char *, ...)
for (i = 0; i < ncompr; i++) {
int zm;
- if (nbytes < compr[i].maglen)
+ if (nbytes < CAST(size_t, abs(compr[i].maglen)))
continue;
-#ifdef ZLIBSUPPORT
- if (compr[i].maglen == 0)
+ if (compr[i].maglen < 0) {
zm = (RCAST(int (*)(const unsigned char *),
CCAST(void *, compr[i].magic)))(buf);
- else
-#endif
- zm = memcmp(buf, compr[i].magic, compr[i].maglen) == 0;
+ } else {
+ zm = memcmp(buf, compr[i].magic,
+ CAST(size_t, compr[i].maglen)) == 0;
+ }
if (!zm)
continue;
}
#endif
+#ifdef BUILTIN_BZLIB
+private int
+uncompressbzlib(const unsigned char *old, unsigned char **newch,
+ size_t bytes_max, size_t *n)
+{
+ int rc;
+ bz_stream bz;
+
+ memset(&bz, 0, sizeof(bz));
+ rc = BZ2_bzDecompressInit(&bz, 0, 0);
+ if (rc != BZ_OK)
+ goto err;
+
+ if ((*newch = CAST(unsigned char *, malloc(bytes_max + 1))) == NULL)
+ return makeerror(newch, n, "No buffer, %s", strerror(errno));
+
+ bz.next_in = CCAST(char *, RCAST(const char *, old));
+ bz.avail_in = CAST(uint32_t, *n);
+ bz.next_out = RCAST(char *, *newch);
+ bz.avail_out = CAST(unsigned int, bytes_max);
+
+ rc = BZ2_bzDecompress(&bz);
+ if (rc != BZ_OK && rc != BZ_STREAM_END)
+ goto err;
+
+ /* Assume byte_max is within 32bit */
+ /* assert(bz.total_out_hi32 == 0); */
+ *n = CAST(size_t, bz.total_out_lo32);
+ rc = BZ2_bzDecompressEnd(&bz);
+ if (rc != BZ_OK)
+ goto err;
+
+ /* let's keep the nul-terminate tradition */
+ (*newch)[*n] = '\0';
+
+ return OKDATA;
+err:
+ snprintf(RCAST(char *, *newch), bytes_max, "bunzip error %d", rc);
+ *n = strlen(RCAST(char *, *newch));
+ return ERRDATA;
+}
+#endif
+
+#ifdef BUILTIN_XZLIB
+private int
+uncompressxzlib(const unsigned char *old, unsigned char **newch,
+ size_t bytes_max, size_t *n)
+{
+ int rc;
+ lzma_stream xz;
+
+ memset(&xz, 0, sizeof(xz));
+ rc = lzma_auto_decoder(&xz, UINT64_MAX, 0);
+ if (rc != LZMA_OK)
+ goto err;
+
+ if ((*newch = CAST(unsigned char *, malloc(bytes_max + 1))) == NULL)
+ return makeerror(newch, n, "No buffer, %s", strerror(errno));
+
+ xz.next_in = CCAST(const uint8_t *, old);
+ xz.avail_in = CAST(uint32_t, *n);
+ xz.next_out = RCAST(uint8_t *, *newch);
+ xz.avail_out = CAST(unsigned int, bytes_max);
+
+ rc = lzma_code(&xz, LZMA_RUN);
+ if (rc != LZMA_OK && rc != LZMA_STREAM_END)
+ goto err;
+
+ *n = CAST(size_t, xz.total_out);
+
+ lzma_end(&xz);
+
+ /* let's keep the nul-terminate tradition */
+ (*newch)[*n] = '\0';
+
+ return OKDATA;
+err:
+ snprintf(RCAST(char *, *newch), bytes_max, "unxz error %d", rc);
+ *n = strlen(RCAST(char *, *newch));
+ return ERRDATA;
+}
+#endif
+
+
static int
makeerror(unsigned char **buf, size_t *len, const char *fmt, ...)
{
private const char *
methodname(size_t method)
{
+ switch (method) {
#ifdef BUILTIN_DECOMPRESS
- /* FIXME: This doesn't cope with bzip2 */
- if (method == 2 || compr[method].maglen == 0)
- return "zlib";
+ case METH_FROZEN:
+ case METH_ZLIB:
+ return "zlib";
+#endif
+#ifdef BUILTIN_BZLIB
+ case METH_BZIP:
+ return "bzlib";
#endif
- return compr[method].argv[0];
+#ifdef BUILTIN_XZLIB
+ case METH_XZ:
+ case METH_LZMA:
+ return "xzlib";
+#endif
+ default:
+ return compr[method].argv[0];
+ }
}
private int
size_t i;
ssize_t r;
+ switch (method) {
#ifdef BUILTIN_DECOMPRESS
- /* FIXME: This doesn't cope with bzip2 */
- if (method == 2)
+ case METH_FROZEN:
return uncompressgzipped(old, newch, bytes_max, n);
- if (compr[method].maglen == 0)
+ case METH_ZLIB:
return uncompresszlib(old, newch, bytes_max, n, 1);
#endif
+#ifdef BUILTIN_BZLIB
+ case METH_BZIP:
+ return uncompressbzlib(old, newch, bytes_max, n);
+#endif
+#ifdef BUILTIN_XZLIB
+ case METH_XZ:
+ case METH_LZMA:
+ return uncompressxzlib(old, newch, bytes_max, n);
+#endif
+ default:
+ break;
+ }
+
(void)fflush(stdout);
(void)fflush(stderr);
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: encoding.c,v 1.20 2019/04/15 16:48:41 christos Exp $")
+FILE_RCSID("@(#)$File: encoding.c,v 1.21 2019/06/08 20:49:14 christos Exp $")
#endif /* lint */
#include "magic.h"
#include <string.h>
-#include <memory.h>
#include <stdlib.h>
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: file.c,v 1.181 2019/03/28 20:54:03 christos Exp $")
+FILE_RCSID("@(#)$File: file.c,v 1.184 2019/08/03 11:51:59 christos Exp $")
#endif /* lint */
#include "magic.h"
# define IFLNK_L ""
#endif
-#ifdef HAVE_LIBSECCOMP
-# define SECCOMP_S "S"
-#else
-# define SECCOMP_S ""
-#endif
-
-#define FILE_FLAGS "bcCdE" IFLNK_h "ik" IFLNK_L "lNnprs" SECCOMP_S "vzZ0"
+#define FILE_FLAGS "bcCdE" IFLNK_h "ik" IFLNK_L "lNnprsSvzZ0"
#define OPTSTRING "bcCde:Ef:F:hiklLm:nNpP:rsSvzZ0"
# define USAGE \
{ "ascii", MAGIC_NO_CHECK_ASCII },
{ "cdf", MAGIC_NO_CHECK_CDF },
{ "compress", MAGIC_NO_CHECK_COMPRESS },
+ { "csv", MAGIC_NO_CHECK_CSV },
{ "elf", MAGIC_NO_CHECK_ELF },
{ "encoding", MAGIC_NO_CHECK_ENCODING },
{ "soft", MAGIC_NO_CHECK_SOFT },
case 's':
flags |= MAGIC_DEVICES;
break;
-#ifdef HAVE_LIBSECCOMP
case 'S':
+#ifdef HAVE_LIBSECCOMP
sandbox = 0;
- break;
#endif
+ break;
case 'v':
if (magicfile == NULL)
magicfile = magic_getpath(magicfile, action);
VERSION);
(void)fprintf(stdout, "magic file from %s\n",
magicfile);
+#ifdef HAVE_LIBSECCOMP
+ (void)fprintf(stdout, "seccomp support included\n");
+#endif
return 0;
case 'z':
flags |= MAGIC_COMPRESS;
*/
/*
* file.h - definitions for file(1) program
- * @(#)$File: file.h,v 1.206 2019/05/07 02:27:11 christos Exp $
+ * @(#)$File: file.h,v 1.208 2019/06/26 20:31:31 christos Exp $
*/
#ifndef __file_h__
protected int file_encoding(struct magic_set *, const struct buffer *,
unichar **, size_t *, const char **, const char **, const char **);
protected int file_is_json(struct magic_set *, const struct buffer *);
+protected int file_is_csv(struct magic_set *, const struct buffer *, int);
protected int file_is_tar(struct magic_set *, const struct buffer *);
protected int file_softmagic(struct magic_set *, const struct buffer *,
uint16_t *, uint16_t *, int, int);
* The first column specifies the short name, if any, or 0 if none.
* The second column specifies the long name.
* The third column specifies whether it takes a parameter.
- * The fourth column is the documentation.
+ * The fourth colums specifies whether is is marked as "default"
+ * if POSIXLY_CORRECT is defined: 1,
+ * if POSIXLY_CORRECT is not defined: 2.
+ * The fifth column is the documentation.
*
* N.B. The long options' order must correspond to the code in file.c,
* and OPTSTRING must be kept up-to-date with the short options.
OPT('r', "raw", 0, 0, " don't translate unprintable chars to \\ooo\n")
OPT('s', "special-files", 0, 0, " treat special (block/char devices) files as\n"
" ordinary ones\n")
-#ifdef HAVE_LIBSECCOMP
OPT('S', "no-sandbox", 0, 0, " disable system call sandboxing\n")
-#endif
OPT('C', "compile", 0, 0, " compile file specified by -m\n")
OPT('d', "debug", 0, 0, " print debugging messages\n")
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: fsmagic.c,v 1.80 2019/04/23 18:59:27 christos Exp $")
+FILE_RCSID("@(#)$File: fsmagic.c,v 1.81 2019/07/16 13:30:32 christos Exp $")
#endif /* lint */
#include "magic.h"
if (file_printf(ms, " ") == -1)
return -1;
}
+ /*
+ * If we were looking for extensions or apple (silent) it is not our
+ * job to print here, so don't count this as a match.
+ */
+ if (ret == 1 && silent)
+ return 0;
return ret;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: funcs.c,v 1.104 2019/05/07 02:27:11 christos Exp $")
+FILE_RCSID("@(#)$File: funcs.c,v 1.108 2019/11/09 00:35:46 christos Exp $")
#endif /* lint */
#include "magic.h"
}
}
+ /* Check if we have a CSV file */
+ if ((ms->flags & MAGIC_NO_CHECK_CSV) == 0) {
+ m = file_is_csv(ms, &b, looks_text);
+ if ((ms->flags & MAGIC_DEBUG) != 0)
+ (void)fprintf(stderr, "[try csv %d]\n", m);
+ if (m) {
+ if (checkdone(ms, &rv))
+ goto done;
+ }
+ }
+
/* Check if we have a CDF file */
if ((ms->flags & MAGIC_NO_CHECK_CDF) == 0) {
m = file_trycdf(ms, &b);
rx->old_lc_ctype = uselocale(rx->c_lc_ctype);
assert(rx->old_lc_ctype != NULL);
#else
- rx->old_lc_ctype = setlocale(LC_CTYPE, "C");
+ rx->old_lc_ctype = setlocale(LC_CTYPE, NULL);
+ assert(rx->old_lc_ctype != NULL);
+ rx->old_lc_ctype = strdup(rx->old_lc_ctype);
+ assert(rx->old_lc_ctype != NULL);
+ (void)setlocale(LC_CTYPE, "C");
#endif
rx->pat = pat;
{
assert(rx->rc == 0);
/* XXX: force initialization because glibc does not always do this */
- memset(pmatch, 0, nmatch * sizeof(*pmatch));
+ if (nmatch != 0)
+ memset(pmatch, 0, nmatch * sizeof(*pmatch));
return regexec(&rx->rx, str, nmatch, pmatch, eflags);
}
freelocale(rx->c_lc_ctype);
#else
(void)setlocale(LC_CTYPE, rx->old_lc_ctype);
+ free(rx->old_lc_ctype);
#endif
}
--- /dev/null
+/*-
+ * Copyright (c) 2019 Christos Zoulas
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Parse CSV object serialization format (RFC-4180, RFC-7111)
+ */
+
+#ifndef TEST
+#include "file.h"
+
+#ifndef lint
+FILE_RCSID("@(#)$File: is_csv.c,v 1.4 2019/06/26 20:31:31 christos Exp $")
+#endif
+
+#include <string.h>
+#include "magic.h"
+#else
+#include <sys/types.h>
+#endif
+
+
+#ifdef DEBUG
+#include <stdio.h>
+#define DPRINTF(fmt, ...) printf(fmt, __VA_ARGS__)
+#else
+#define DPRINTF(fmt, ...)
+#endif
+
+/*
+ * if CSV_LINES == 0:
+ * check all the lines in the buffer
+ * otherwise:
+ * check only up-to the number of lines specified
+ *
+ * the last line count is always ignored if it does not end in CRLF
+ */
+#ifndef CSV_LINES
+#define CSV_LINES 10
+#endif
+
+static int csv_parse(const unsigned char *, const unsigned char *);
+
+static const unsigned char *
+eatquote(const unsigned char *uc, const unsigned char *ue)
+{
+ int quote = 0;
+
+ while (uc < ue) {
+ unsigned char c = *uc++;
+ if (c != '"') {
+ // We already got one, done.
+ if (quote) {
+ return --uc;
+ }
+ continue;
+ }
+ if (quote) {
+ // quote-quote escapes
+ quote = 0;
+ continue;
+ }
+ // first quote
+ quote = 1;
+ }
+ return ue;
+}
+
+static int
+csv_parse(const unsigned char *uc, const unsigned char *ue)
+{
+ size_t nf = 0, tf = 0, nl = 0;
+
+ while (uc < ue) {
+ unsigned char c;
+ switch (c = *uc++) {
+ case '"':
+ // Eat until the matching quote
+ uc = eatquote(uc, ue);
+ break;
+ case ',':
+ nf++;
+ break;
+ case '\n':
+ DPRINTF("%zu %zu %zu\n", nl, nf, tf);
+ nl++;
+#if CSV_LINES
+ if (nl == CSV_LINES)
+ return tf != 0 && tf == nf;
+#endif
+ if (tf == 0) {
+ // First time and no fields, give up
+ if (nf == 0)
+ return 0;
+ // First time, set the number of fields
+ tf = nf;
+ } else if (tf != nf) {
+ // Field number mismatch, we are done.
+ return 0;
+ }
+ nf = 0;
+ break;
+ default:
+ break;
+ }
+ }
+ return tf && nl > 2;
+}
+
+#ifndef TEST
+int
+file_is_csv(struct magic_set *ms, const struct buffer *b, int looks_text)
+{
+ const unsigned char *uc = CAST(const unsigned char *, b->fbuf);
+ const unsigned char *ue = uc + b->flen;
+ int mime = ms->flags & MAGIC_MIME;
+
+ if (!looks_text)
+ return 0;
+
+ if ((ms->flags & (MAGIC_APPLE|MAGIC_EXTENSION)) != 0)
+ return 0;
+
+ if (!csv_parse(uc, ue))
+ return 0;
+
+ if (mime == MAGIC_MIME_ENCODING)
+ return 1;
+
+ if (mime) {
+ if (file_printf(ms, "application/csv") == -1)
+ return -1;
+ return 1;
+ }
+
+ if (file_printf(ms, "CSV text") == -1)
+ return -1;
+
+ return 1;
+}
+
+#else
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <err.h>
+
+int
+main(int argc, char *argv[])
+{
+ int fd, rv;
+ struct stat st;
+ unsigned char *p;
+
+ if ((fd = open(argv[1], O_RDONLY)) == -1)
+ err(EXIT_FAILURE, "Can't open `%s'", argv[1]);
+
+ if (fstat(fd, &st) == -1)
+ err(EXIT_FAILURE, "Can't stat `%s'", argv[1]);
+
+ if ((p = malloc(st.st_size)) == NULL)
+ err(EXIT_FAILURE, "Can't allocate %jd bytes",
+ (intmax_t)st.st_size);
+ if (read(fd, p, st.st_size) != st.st_size)
+ err(EXIT_FAILURE, "Can't read %jd bytes",
+ (intmax_t)st.st_size);
+ printf("is csv %d\n", csv_parse(p, p + st.st_size));
+ return 0;
+}
+#endif
#define MAGIC_NO_CHECK_ELF 0x0010000 /* Don't check for elf details */
#define MAGIC_NO_CHECK_TEXT 0x0020000 /* Don't check for text files */
#define MAGIC_NO_CHECK_CDF 0x0040000 /* Don't check for cdf files */
+#define MAGIC_NO_CHECK_CSV 0x0080000 /* Don't check for CSV files */
#define MAGIC_NO_CHECK_TOKENS 0x0100000 /* Don't check tokens */
#define MAGIC_NO_CHECK_ENCODING 0x0200000 /* Don't check text encodings */
#define MAGIC_NO_CHECK_JSON 0x0400000 /* Don't check for JSON files */
MAGIC_NO_CHECK_APPTYPE | \
MAGIC_NO_CHECK_ELF | \
MAGIC_NO_CHECK_TEXT | \
+ MAGIC_NO_CHECK_CSV | \
MAGIC_NO_CHECK_CDF | \
MAGIC_NO_CHECK_TOKENS | \
MAGIC_NO_CHECK_ENCODING | \
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: readcdf.c,v 1.73 2019/03/12 20:43:05 christos Exp $")
+FILE_RCSID("@(#)$File: readcdf.c,v 1.74 2019/09/11 15:46:30 christos Exp $")
#endif
#include <assert.h>
old_lc_ctype = uselocale(c_lc_ctype);
assert(old_lc_ctype != NULL);
#else
- char *old_lc_ctype = setlocale(LC_CTYPE, "C");
+ char *old_lc_ctype = setlocale(LC_CTYPE, NULL);
+ assert(old_lc_ctype != NULL);
+ old_lc_ctype = strdup(old_lc_ctype);
+ assert(old_lc_ctype != NULL);
+ (void)setlocale(LC_CTYPE, "C");
#endif
for (i = 0; nv[i].pattern != NULL; i++)
if (strcasestr(vbuf, nv[i].pattern) != NULL) {
(void)uselocale(old_lc_ctype);
freelocale(c_lc_ctype);
#else
- setlocale(LC_CTYPE, old_lc_ctype);
+ (void)setlocale(LC_CTYPE, old_lc_ctype);
+ free(old_lc_ctype);
#endif
return rv;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.165 2019/05/07 02:27:11 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.168 2019/12/16 03:49:19 christos Exp $")
#endif
#ifdef BUILTIN_ELF
*/
return xnh_sizeof + offset;
}
+ /*XXX: GCC */
+ memset(&nh32, 0, sizeof(nh32));
+ memset(&nh64, 0, sizeof(nh64));
memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
offset += xnh_sizeof;
}
name_off = xsh_offset;
+ if (fsize != SIZE_UNKNOWN && fsize < name_off) {
+ if (file_printf(ms, ", too large section header offset %td",
+ name_off) == -1)
+ return -1;
+ return 0;
+ }
+
for ( ; num; num--) {
/* Read the name of this section. */
if ((namesize = pread(fd, name, sizeof(name) - 1,
/* Things we can determine before we seek */
switch (xph_type) {
case PT_DYNAMIC:
- linking_style = "dynamically";
doread = 1;
break;
case PT_NOTE:
}
/*FALLTHROUGH*/
case PT_INTERP:
+ linking_style = "dynamically";
doread = 1;
break;
default:
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: seccomp.c,v 1.8 2019/02/24 18:12:04 christos Exp $")
+FILE_RCSID("@(#)$File: seccomp.c,v 1.11 2019/07/18 20:32:06 christos Exp $")
#endif /* lint */
#if HAVE_LIBSECCOMP
#include <seccomp.h> /* libseccomp */
#include <sys/prctl.h> /* prctl */
+#include <sys/ioctl.h>
#include <sys/socket.h>
#include <fcntl.h>
#include <stdlib.h>
goto out; \
while (/*CONSTCOND*/0)
-static scmp_filter_ctx ctx;
+#define ALLOW_IOCTL_RULE(param) \
+ do \
+ if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl), 1, \
+ SCMP_CMP(1, SCMP_CMP_EQ, param)) == -1) \
+ goto out; \
+ while (/*CONSTCOND*/0)
+static scmp_filter_ctx ctx;
int
enable_sandbox_basic(void)
ALLOW_RULE(fcntl64);
ALLOW_RULE(fstat);
ALLOW_RULE(fstat64);
+#ifdef XZLIBSUPPORT
+ ALLOW_RULE(futex);
+#endif
ALLOW_RULE(getdents);
#ifdef __NR_getdents64
ALLOW_RULE(getdents64);
#endif
- ALLOW_RULE(ioctl);
+#ifdef FIONREAD
+ // called in src/compress.c under sread
+ ALLOW_IOCTL_RULE(FIONREAD);
+#endif
+#ifdef TIOCGWINSZ
+ // musl libc may call ioctl TIOCGWINSZ when calling stdout
+ ALLOW_IOCTL_RULE(TIOCGWINSZ);
+#endif
ALLOW_RULE(lseek);
ALLOW_RULE(_llseek);
ALLOW_RULE(lstat);
ALLOW_RULE(stat);
ALLOW_RULE(stat64);
ALLOW_RULE(sysinfo);
+ ALLOW_RULE(umask); // Used in file_pipe2file()
ALLOW_RULE(unlink);
ALLOW_RULE(write);
HUGE string, don't use printf!
During the process, some other memory is allocated (1024 bytes minimum)
to handle the output of partial sprintf() calls. If you have only 10000 bytes
-free in memory, you *may* not be able to nprintf() a 8000 bytes-long text.
+free in memory, you *may* not be able to nprintf() an 8000 bytes-long text.
note: if a buffer overflow occurs, exit() is called. This situation should
never appear ... but if you want to be *really* sure, you have to modify the
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: vasprintf.c,v 1.16 2018/10/01 18:45:39 christos Exp $")
+FILE_RCSID("@(#)$File: vasprintf.c,v 1.17 2019/11/15 21:03:14 christos Exp $")
#endif /* lint */
#include <assert.h>
-Audio file with ID3 version 2.2.0, contains:MPEG ADTS, layer III, v1, 96 kbps, 44.1 kHz, Monaural
\ No newline at end of file
+Audio file with ID3 version 2.2.0, contains:MPEG ADTS, layer III, v1, 96 kbps, 44.1 kHz, Monaural
\ No newline at end of file
--- /dev/null
+Audio file with ID3 version 2.4.0, contains:MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, JntStereo
\ No newline at end of file
--- /dev/null
+Adaptive Multi-Rate Codec (GSM telephony)
\ No newline at end of file
desired = slurp(fp, &desired_len);
fclose(fp);
(void)printf("%s: %s\n", argv[1], result);
- if (strcmp(result, desired) != 0) {
+ if (strcmp(result, desired) != 0) {
(void)fprintf(stderr, "Error: result was\n%s\nexpected:\n%s\n", result, desired);
return 1;
- }
+ }
}
}
}
projects / platform / upstream / python3-magic.git / commitdiff