/configure
/depcomp
/install-sh
+/libmagic.pc
/libtool
/ltmain.sh
/m4
+2021-03-30 20:21 Christos Zoulas <christos@zoulas.com>
+
+ * release 5.40
+
+2021-02-05 16:31 Christos Zoulas <christos@zoulas.com>
+
+ * PR/234: Add limit to the number of bytes to scan for encoding
+ * PR/230: Fix /T (trim flag) for regex
+
+2021-02-01 12:31 Christos Zoulas <christos@zoulas.com>
+ * PR/77: Trim trailing separator.
+
+2020-12-17 15:44 Christos Zoulas <christos@zoulas.com>
+
+ * PR/211: Convert system read errors from corrupt ELF
+ files into human readable error messages
+
+2020-12-08 16:24 Christos Zoulas <christos@zoulas.com>
+
+ * fix multithreaded decompression file descriptor issue
+ by using close-on-exec (Denys Vlasenko)
+
+2020-06-27 11:58 Christos Zoulas <christos@zoulas.com>
+
+ * Exclude surrogate pairs from utf-8 detection (Michael Liu)
+
+2020-06-25 12:53 Christos Zoulas <christos@zoulas.com>
+
+ * Include # to the list of ignored format chars (Werner Fink)
+
2020-06-14 20:02 Christos Zoulas <christos@zoulas.com>
* release 5.39
## README for file(1) Command and the libmagic(3) library ##
- @(#) $File: README,v 1.59 2019/09/19 01:04:01 christos Exp $
+ @(#) $File: README,v 1.61 2020/10/08 23:20:14 christos Exp $
Mailing List: file@astron.com
-Mailing List archives: http://mailman.astron.com/pipermail/file/
-Bug tracker: http://bugs.astron.com/
+Mailing List archives: https://mailman.astron.com/pipermail/file/
+Bug tracker: https://bugs.astron.com/
E-mail: christos@astron.com
Build Status: https://travis-ci.org/file/file
src/ascmagic.c - third & last set of tests, based on hardwired assumptions.
src/asctime_r.c - replacement for OS's that don't have it.
src/asprintf.c - replacement for OS's that don't have it.
-src/asctime_r.c - replacement for OS's that don't have it.
-src/asprintf.c - replacement for OS's that don't have it.
src/buffer.c - buffer handling functions.
src/cdf.[ch] - parser for Microsoft Compound Document Files
src/cdf_time.c - time converter for CDF.
# How to get started developing
-@(#) $File: README.DEVELOPER,v 1.7 2019/09/12 16:03:37 christos Exp $
+@(#) $File: README.DEVELOPER,v 1.8 2021/03/31 00:23:26 christos Exp $
## Auto files
After checking out the source, run the following:
autoreconf -f -i
+ make distclean
./configure --disable-silent-rules
make -j4
make -C tests check
dnl Process this file with autoconf to produce a configure script.
-AC_INIT([file],[5.39],[christos@astron.com])
+AC_INIT([file],[5.40],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
fi])
dnl Checks for functions
-AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem)
+AC_CHECK_FUNCS(strndup mkstemp mkostemp utimes utime wcwidth strtof newlocale uselocale freelocale memmem pipe2)
dnl Provide implementation of some required functions if necessary
AC_REPLACE_FUNCS(getopt_long asprintf vasprintf strlcpy strlcat getline ctime_r asctime_r localtime_r gmtime_r pread strcasestr fmtcheck dprintf)
-.\" $File: file.man,v 1.140 2020/06/07 17:41:07 christos Exp $
-.Dd June 7, 2020
+.\" $File: file.man,v 1.144 2021/02/05 22:08:31 christos Exp $
+.Dd February 5, 2021
.Dt FILE __CSECTION__
.Os
.Sh NAME
Exceptions are well-known file formats (core files, tar archives)
that are known to contain binary data.
When modifying magic files or the program itself, make sure to
-.Em "preserve these keywords" .
+.Em preserve these keywords .
Users depend on knowing that all the readable files in a directory
have the word
.Dq text
.In exec.h
in the standard include directory.
These files have a
-.Dq "magic number"
+.Dq magic number
stored in a particular place
near the beginning of the file that tells the
.Tn UNIX
operating system
that the file is a binary executable, and which of several types thereof.
The concept of a
-.Dq "magic"
+.Dq magic number
has been applied by extension to data files.
Any file with some invariant identifier at a small fixed
offset into the file can usually be described in this way.
.Sh OPTIONS
.Bl -tag -width indent
.It Fl Fl apple
-Causes the file command to output the file type and creator code as
+Causes the
+.Nm
+command to output the file type and creator code as
used by older MacOS versions.
The code consists of eight letters,
the first describing the file type, the latter the creator.
Cause a checking printout of the parsed form of the magic file.
This is usually used in conjunction with the
.Fl m
-flag to debug a new magic file before installing it.
+option to debug a new magic file before installing it.
.It Fl d
Prints internal debugging information to stderr.
.It Fl E
but ignore tests that
.Nm
does not know about.
-This is intended for compatilibity with older versions of
+This is intended for compatibility with older versions of
.Nm .
.It Fl Fl extension
Print a slash-separated list of valid extensions for the file type found.
instead of:
.Dq Fl f Ar namefile Fl F Ar @ .
.It Fl h , Fl Fl no-dereference
-option causes symlinks not to be followed
+This option causes symlinks not to be followed
(on systems that support symbolic links).
This is the default if the environment variable
.Dv POSIXLY_CORRECT
is not defined.
.It Fl i , Fl Fl mime
-Causes the file command to output mime type strings rather than the more
+Causes the
+.Nm
+command to output mime type strings rather than the more
traditional human readable ones.
Thus it may say
.Sq text/plain; charset=us-ascii
.Fl k
option).
.It Fl L , Fl Fl dereference
-option causes symlinks to be followed, as the like-named option in
+This option causes symlinks to be followed, as the like-named option in
.Xr ls 1
(on systems that support symbolic links).
This is the default if the environment variable
.It Li elf_notes Ta 256 Ta max ELF notes processed
.It Li elf_phnum Ta 2048 Ta max ELF program sections processed
.It Li elf_shnum Ta 32768 Ta max ELF sections processed
+.It Li encoding Ta 65536 Ta max number of bytes to scan for encoding evaluation
.It Li indir Ta 50 Ta recursion limit for indirect magic
.It Li name Ta 50 Ta use count limit for name/use magic
.It Li regex Ta 8192 Ta length limit for regex searches
.Pa ( https://github.com/seccomp/libseccomp )
is available, the
.Fl S
-flag disables sandboxing which is enabled by default.
-This option is needed for file to execute external decompressing programs,
+option disables sandboxing which is enabled by default.
+This option is needed for
+.Nm
+to execute external decompressing programs,
i.e. when the
.Fl z
-flag is specified and the built-in decompressors are not available.
+option is specified and the built-in decompressors are not available.
On systems where sandboxing is not available, this option has no effect.
.It Fl v , Fl Fl version
Print the version of the program and exit.
.Sh EXAMPLES
.Bd -literal -offset indent
$ file file.c file /dev/{wd0a,hda}
-file.c: C program text
-file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
- dynamically linked (uses shared libs), stripped
+file.c: C program text
+file: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
+ dynamically linked (uses shared libs), stripped
/dev/wd0a: block special (0/0)
/dev/hda: block special (3/0)
/dev/hda10: empty
$ file -i file.c file /dev/{wd0a,hda}
-file.c: text/x-c
-file: application/x-executable
+file.c: text/x-c
+file: application/x-executable
/dev/hda: application/x-not-regular-file
/dev/wd0a: application/x-not-regular-file
as a delimiter, so that spaces in pattern strings must be escaped.
For example,
.Bd -literal -offset indent
-\*[Gt]10 string language impress\ (imPRESS data)
+\*[Gt]10 string language impress\ (imPRESS data)
.Ed
.Pp
in an existing magic file would have to be changed to
To enable execution of external decompressors, one needs to disable
sandboxing using the
.Fl S
-flag.
+option.
.Sh MAGIC DIRECTORY
The magic file entries have been collected from various sources,
mainly USENET, and contributed by various authors.
and centralize.
.Pp
Some of the encoding logic is hard-coded in encoding.c and can be moved
-to the magic files if we had a !:charset annotation
+to the magic files if we had a !:charset annotation.
.Pp
Continue to squash all magic bugs.
See Debian BTS for a good source.
.Dv HOWMANY
variable in file.h), then we don't seek to that offset, but we give up.
It would be better if buffer managements was done when the file descriptor
-is available so move around the file.
-One must be careful though because this has performance (and thus security
-considerations).
+is available so we can seek around the file.
+One must be careful though because this has performance and thus security
+considerations, because one can slow down things by repeateadly seeking.
+.Pp
+There is support now for keeping separate buffers and having offsets from
+the end of the file, but the internal buffer management still needs an
+overhaul.
.Sh AVAILABILITY
You can obtain the original author's latest version by anonymous FTP
on
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: aes,v 1.1 2020/08/18 21:20:22 christos Exp $
+#
+# aes: magic file for AES encrypted files
+
+# Summary: AES Crypt Encrypted Data File
+# From: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
+# Reference: https://www.aescrypt.com/aes_file_format.html
+0 string AES
+>3 ubyte <3 AES encrypted data, version %u
+#!:mime application/aes
+!:mime application/x-aes-encrypted
+!:ext aes
+# For Version 2 the encrypted file can have text tags
+>>3 ubyte =2
+# length of an extension identifier and contents like: 0 24 33 38
+#>>5 ubeshort x \b, tag length %u
+#>>5 pstring/H x '%s'
+# standard extension tags like CREATED_BY
+>>>7 string CREATED_BY \b, created by
+# software product, manufacturer like "SharpAESCrypt v1.3.3.0" "aescrypt (Windows GUI) 3.10" ...
+>>>>&1 string x "%s"
+# TODO: more other tags
+# tag CREATED_DATE like YYYY-MM-DD
+# tag CREATED_TIME like HH:MM:SS
+#
+
#------------------------------------------------------------------------------
-# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $
+# $File: amigaos,v 1.18 2020/08/02 16:42:00 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
0 string/c @database AmigaGuide file
# Amiga disk types
+# display information like volume name of root block on Amiga (floppy) disk
+0 name adf-rootblock
+# block primary type = T_HEADER (value 2)
+>0x000 ubelong !2 \b, type %u
+# header_key; unused in rootblock (value 0)
+>0x004 ubelong !0 \b, header_key %u
+# high_seq; unused (value 0)
+>0x008 ubelong !0 \b, high_seq %u
+# ht_size; hash table size; 0x48 for flopies
+>0x00c ubelong !0x48 \b, hash table size 0x%x
+# bm_flag; bitmap flag, -1 means VALID
+>0x138 belong !-1 \b, bitmap flag 0x%x
+# bm_ext; first bitmap extension block (Hard disks only)
+>0x1A0 ubelong !0 \b, bitmap extension block 0x%x
+# name_len; volume name length; diskname[30]; volume name
+>0x1B0 pstring >\0 \b, "%s"
+# first directory cache block for FFS; otherwise 0
+>0x1F8 ubelong !0 \b, directory cache block 0x%x
+# block secondary type = ST_ROOT (value 1)
+>0x1FC ubelong !1 \b, sec_type 0x%x
#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
-0 string DOS\0 Amiga DOS disk
-0 string DOS\1 Amiga FFS disk
-0 string DOS\2 Amiga Inter DOS disk
-0 string DOS\3 Amiga Inter FFS disk
-0 string DOS\4 Amiga Fastdir DOS disk
-0 string DOS\5 Amiga Fastdir FFS disk
+# URL: http://fileformats.archiveteam.org/wiki/ADF_(Amiga)
+# https://en.wikipedia.org/wiki/Amiga_Fast_File_System
+# Reference: http://lclevy.free.fr/adflib/adf_info.html
+# Update: Joerg Jenderek
+# Note: created by ADFOpus.exe
+# and verified by `unadf -l TURBO_SILVER_SV.ADF`
+0 string DOS
+# skip DOS Client Message Files like IPXODI.MSG DOSRQSTR.MSG
+>3 ubyte <8 Amiga
+# https://reposcope.com/mimetype/application/x-amiga-disk-format
+!:mime application/x-amiga-disk-format
+!:ext adf
+>>3 ubyte 0 DOS disk
+>>3 ubyte 1 FFS disk
+>>3 ubyte 2 Inter DOS disk
+>>3 ubyte 3 Inter FFS disk
+# For Fastdir mode the international mode is also enabled,
+>>3 ubyte 4 Fastdir DOS disk
+>>3 ubyte 5 Fastdir FFS dis
+# called by TrID "Amiga Disk image File (OFS+INTL+DIRC)"
+>>3 ubyte 6 Inter Fastdir DOS disk
+# called by TrID "Amiga Disk image File (FFS+INTL+DIRC)"
+>>3 ubyte 7 Inter Fastdir FFS disk
+# but according to Wikipedia variants with long name support
+#>>3 ubyte 6 long name DOS disk
+#>>3 ubyte 7 long name FFS disk
+# DOES NOT only work! Partly for file size ~< FILE_BYTES_MAX=1 MiB defined in ../../src/file.h
+#>>-0 offset x \b, %lld bytes
+# Correct file size, but next lines are NOT executed
+#>>-0 offset 901120 (DD 880 KiB floppy)
+# 880 KiB Double Density floppy disk by characteristic hash table size 0x48 and T_HEADER=2
+>>0x6E00C ubelong 0x48
+>>>0x6E000 ubelong 2 (DD 880 KiB)
+# 1760 KiB High Density floppy disk (1802240 bytes) by characteristic hash table size 0x48
+>>0xDC00C ubelong 0x48
+>>>0xDC000 ubelong 2 (HD 1760 KiB)
+# Chksum; special block checksum like: 0 0x44ccf4c0 0x51f32cac 0xe33d0e7d ...
+#>>4 ubelong x \b, CRC 0x%x
+# Rootblock: 0 880 (often for DD and HD) 1146049280 (IMAGINE_1_0_DISK_01.ADF TURBO_SILVER_SV.ADF)
+>>8 ubelong >0 \b, probably root block %d
+# bootblock code
+>>12 quad !0 \b, bootable
+# assembler instructions: lea exp(pc),a1; moveq 25h,d0; jsr -552(a6)
+>>>12 ubequad =0x43fa003e70254eae AmigaDOS 3.0
+>>>12 default x
+>>>>12 ubequad !0x43fa003e70254eae 0x%llx..
+# 880 KiB Double Density floppy disk (901120 bytes)
+>>0x6E00C ubelong 0x48
+>>>0x6E000 ubelong 2
+>>>>0x6E000 use adf-rootblock
+# 1760 KiB High Density floppy disk (1802240 bytes)
+>>0xDC00C ubelong 0x48
+>>>0xDC000 ubelong 2
+>>>>0xDC000 use adf-rootblock
+# 1 MiB hard disc by test for T_HEADER=2 and header_key=0=high_seq
+>>0x80000 ubelong 2
+>>>0x80004 quad 0
+>>>>0x80000 use adf-rootblock
+# 2 MiB hard disc; only works if in ../../src/file.h FILE_BYTES_MAX is raised to 2 MiB
+#>>0x100000 ubelong x 2 MiB TEST
+#>>0x100000 ubelong 2 \b, 2 MiB hard disc rootblock
+#>>>0x100000 use adf-rootblock
0 string KICK Kickstart disk
# From: Alex Beregszaszi <alex@fsn.hu>
#------------------------------------------------------------
-# $File: android,v 1.16 2019/11/15 21:03:14 christos Exp $
+# $File: android,v 1.18 2021/02/23 00:51:10 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
# flags
>>>0x0C ulelong&0x00000002 2 \b+RW
# partition ID:
-# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
+# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~kernel,RECOVER,misc;7~RECOVER
# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
>>>0x08 ulelong x (0x%x)
# filename
0 lelong 0xd0b5b1c4 Android cryptfs footer
>4 leshort x \b, version: %d
>6 leshort x \b.%d
+
+# Android Vdex format
+# From https://android.googlesource.com/\
+# platform/art/+/master/runtime/vdex_file.h
+0 string vdex Android vdex file,
+>4 string >000 verifier deps version: %s,
+>8 string >000 dex section version: %s,
+>12 lelong >0 number of dex files: %d,
+>16 lelong >0 verifier deps size: %d
+
+# Android Vdex format, dexfile is currently being updated
+# by android system
+# From https://android.googlesource.com/\
+# platform/art/+/master/dex2oat/dex2oat.cc
+0 string wdex Android vdex file, being processed by dex2oat,
+>4 string >000 verifier deps version: %s,
+>8 string >000 dex section version: %s,
+>12 lelong >0 number of dex files: %d,
+>16 lelong >0 verifier deps size: %d
#------------------------------------------------------------------------------
-# $File: animation,v 1.77 2020/04/26 15:23:43 christos Exp $
+# $File: animation,v 1.85 2021/03/14 16:36:53 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
!:mime application/x-quicktime-player
4 string/W jP JPEG 2000 image
!:mime image/jp2
+
+#### MP4 ####
# https://www.ftyps.com/ with local additions
+# https://cconcolato.github.io/mp4ra/filetype.html
4 string ftyp ISO Media
# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec
>>11 byte 0x63 \b C.S0050-0-B V1.0
>8 string 3ge \b, MPEG v4 system, 3GPP
!:mime video/3gpp
->>11 byte 6 \b, Release 6 MBMS Extended Presentations
->>11 byte 7 \b, Release 7 MBMS Extended Presentations
+>>11 byte 6 \b, Release %d MBMS Extended Presentations
+>>11 byte 7 \b, Release %d MBMS Extended Presentations
+>>11 byte 9 \b, Release %d MBMS Extended Presentations
+>8 string 3gf \b, MPEG v4 system, 3GPP
+>>11 byte 9 \b, Release %d File-delivery profile
>8 string 3gg \b, MPEG v4 system, 3GPP
!:mime video/3gpp
->>11 byte 6 \b, Release 6 General Profile
+>>11 byte 6 \b, Release %d General Profile
+>>11 byte 9 \b, Release %d General Profile
+>8 string 3gh \b, MPEG v4 system, 3GPP
+!:mime video/3gpp
+>>11 byte 9 \b, Release %d Adaptive Streaming Profile
+>8 string 3gm \b, MPEG v4 system, 3GPP
+!:mime video/3gpp
+>>11 byte 9 \b, Release %d Media Segment Profile
>8 string 3gp \b, MPEG v4 system, 3GPP
!:mime video/3gpp
>>11 byte 1 \b, Release %d (non existent)
>>11 byte 5 \b, Release %d
>>11 byte 6 \b, Release %d
>>11 byte 7 \b, Release %d Streaming Servers
+>8 string 3gr \b, MPEG v4 system, 3GPP
+!:mime video/3gpp
+>>11 byte 6 \b, Release %d Progressive Download Profile
+>>11 byte 9 \b, Release %d Progressive Download Profile
>8 string 3gs \b, MPEG v4 system, 3GPP
!:mime video/3gpp
+>>11 byte 6 \b, Release %d Streaming Servers
>>11 byte 7 \b, Release %d Streaming Servers
+>>11 byte 9 \b, Release %d Streaming Servers
+>8 string 3gt \b, MPEG v4 system, 3GPP
+!:mime video/3gpp
+>>11 byte 8 \b, Release %d Media Stream Recording Profile
+>>11 byte 9 \b, Release %d Media Stream Recording Profile
+>8 string ARRI \b, MPEG v4 system, ARRI Digital Camera
+!:mime video/mp4
>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
!:mime video/mp4
+>8 string bbxm \b, Blinkbox Master File: H.264 video/16-bit LE LPCM audio
+!:mime video/mp4
>8 string/W qt \b, Apple QuickTime movie
!:mime video/quicktime
>8 string CAEP \b, Canon Digital Camera
>8 string caqv \b, Casio Digital Camera
>8 string CDes \b, Convergent Design
+>8 string caaa \b, CMAF Media Profile - AAC Adaptive Audio
+>8 string caac \b, CMAF Media Profile - AAC Core
+>8 string caqv \b, Casio Digital Camera Casio
+>8 string ccea \b, CMAF Supplemental Data - CEA-608/708
+>8 string ccff \b, Common container file format
+>8 string cfhd \b, CMAF Media Profile - AVC HD
+>8 string cfsd \b, CMAF Media Profile - AVC SD
+>8 string chd1 \b, CMAF Media Profile - HEVC HDR10
+>8 string chdf \b, CMAF Media Profile - AVC HDHF
+>8 string chhd \b, CMAF Media Profile - HEVC HHD8
+>8 string chh1 \b, CMAF Media Profile - HEVC HHD10
+>8 string clg1 \b, CMAF Media Profile - HEVC HLG10
+>8 string cmfc \b, CMAF Track Format
+>8 string cmff \b, CMAF Fragment Format
+>8 string cmfl \b, CMAF Chunk Format
+>8 string cmfs \b, CMAF Segment Format
+>8 string cud1 \b, CMAF Media Profile - HEVC UHD10
+>8 string cud8 \b, CMAF Media Profile - HEVC UHD8
+>8 string cwvt \b, CMAF Media Profile - WebVTT
>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
!:mime video/mp4
+>8 string dby1 \b, MP4 files with Dolby content
+>8 string dsms \b, Media Segment DASH conformant
+>8 string dts1 \b, MP4 track file with audio codecs dtsc dtsh or dtse
+>8 string dts2 \b, MP4 track file with audio codec dtsx
+>8 string dts3 \b, MP4 track file with audio codec dtsy
+>8 string dxo$20 \b, DxO ONE camera
>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec
>8 string dmpf \b, Digital Media Project
>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4)
>8 string dvr1 \b, DVB (.DVB) over RTP
!:mime video/vnd.dvb.file
>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream
+>8 string emsg \b, Event message box present
!:mime video/vnd.dvb.file
>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V)
!:mime video/mp4
!:mime audio/mp4
>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B)
!:mime audio/mp4
+>8 string ifrm \b, Apple iFrame Specification, Version 8.1 Jan 2013
+>8 string im1i \b, CMAF Media Profile - IMSC1 Image
+>8 string im1t \b, CMAF Media Profile - IMSC1 Text
>8 string isc2 \b, ISMACryp 2.0 Encrypted File
# ?/enc-isoff-generic
->8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005]
+>8 string iso \b, MP4 Base Media
!:mime video/mp4
->8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003]
+>>11 string m v1 [ISO 14496-12:2003]
+>>11 string 2 v2 [ISO 14496-12:2005]
+>>11 string 4 v4
+>>11 string 5 v5
+>>11 string 6 v6
+>8 string isml \b, MP4 Base Media v2 [ISO 14496-12:2005]
!:mime video/mp4
+>8 string J2P0 \b, JPEG2000 Profile 0
+>8 string J2P1 \b, JPEG2000 Profile 1
>8 string/W jp2 \b, JPEG 2000
!:mime image/jp2
>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent)
>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
!:mime image/jpm
+>8 string jpsi \b, The JPSearch data interchange format
>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
!:mime image/jpx
>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones
!:mime video/3gpp2
+>8 string LCAG \b, Leica digital camera
+>8 string lmsg \b, Last Media Segment indicator for ISO base media file format.
>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
!:mime audio/x-m4a
>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
!:mime video/mj2
>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile
+>8 string MFSM \b, Media File for Samsung video Metadata
+>8 string MGSV \b, Sony Home and Mobile Multimedia Platform (HMMP)
!:mime video/mj2
>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
!:mime video/mp4
>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
>8 string mp7t \b, MPEG v4 system, MPEG v7 XML
>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
+>8 string mpuf \b, Compliance with the MMT Processing Unit format
+>8 string msdh \b, Media Segment conforming to ISO base media file format.
+>8 string msix \b, Media Segment conforming to ISO base media file format.
>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
!:mime video/mp4
>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3]
>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
!:mime video/quicktime
>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP
-!:mime video/mp4
+!:mime audio/mp4
>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
!:mime audio/mp4
>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile
>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
!:mime video/mp4
>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
+>8 string niko \b, Nikon Digital Camera
!:mime video/mp4
>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
>8 string pana \b, Panasonic Digital Camera
+>8 string piff \b, Protected Interoperable File Format
+>8 string pnvi ]b, Panasonic Video Intercom
>8 string qt \b, Apple QuickTime (.MOV/QT)
!:mime video/quicktime
# HEIF image format
!:mime image/heif-sequence
>8 string avcs \b, HEIF Image Sequence AVC
!:mime image/heif-sequence
-
+# AVIF image format
+# see https://aomediacodec.github.io/av1-avif/
+>8 string avif \b, AVIF Image
+!:mime image/avif
+>8 string avis \b, AVIF Image Sequence
+!:mime image/avif
+>8 string risx \b, Representation Index Segment for MPEG-2 TS Segments
>8 string ROSS \b, Ross Video
>8 string sdv \b, SD Memory Card Video
>8 string ssc1 \b, Samsung stereo, single stream (patent pending)
>8 string ssc2 \b, Samsung stereo, dual stream (patent pending)
+>8 string SEAU \b, Sony Home and Mobile Multimedia Platform (HMMP)
+>8 string SEBK \b, Sony Home and Mobile Multimedia Platform (HMMP)
+>8 string senv \b, Video contents Sony Entertainment Network
+>8 string sims \b, Media Segment for Sub-Indexed Media Segment format
+>8 string sisx \b, Single Index Segment forindex MPEG-2 TS
+>8 string ssss \b, Subsegment Index Segment used to index MPEG-2 Segments
+>8 string uvvu \b, UltraViolet file brand for DECE Common Format
# MPEG sequences
# Scans for all common MPEG header start codes
0 belong&0xFFFFFF00 0x00000100
>3 byte 0xBA MPEG sequence
!:mime video/mpeg
+# http://fileformats.archiveteam.org/wiki/Enhanced_VOB
+# https://reposcope.com/mimetype/video/mpeg
+!:ext vob/evo/mpg/mpeg
>>4 byte &0x40 \b, v2, program multiplex
>>4 byte ^0x40 \b, v1, system multiplex
>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header)
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio
-# From: "Stefan A. Haubenthal" <polluks@web.de>
+# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/VOB
0 string DVDVIDEO-VTS Video title set,
+!:mime video/x-ifo
+!:ext ifo/bup
>0x21 byte x v%x
0 string DVDVIDEO-VMG Video manager,
+!:mime video/x-ifo
+!:ext ifo/bup
>0x21 byte x v%x
+# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
+0 string xMovieSetter MovieSetter movie
+0 string xSceneEditor MovieSetter movie
+
# From: Behan Webster <behanw@websterwood.com>
# NuppelVideo used by Mythtv (*.nuv)
# Note: there are two identical stanzas here differing only in the
# From: David Korth <gerbilsoft@gerbilsoft.com>
0 string CRID
>32 string @UTF Scaleform video
+
+# http://www.jerrysguide.com/tips/demystify-tvs-file-format.html
+0 string TVS\015\012
+>&0 string Version\040 TeamViewer Session File
+>>&0 string x \b, version %s
#------------------------------------------------------------------------------
-# $File: archive,v 1.138 2020/06/07 23:29:26 christos Exp $
+# $File: archive,v 1.145 2021/01/03 20:58:47 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
!:ext deb/udeb/ipk
# This should not happen
>14 default x Unknown Debian package
-# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted
+# NL terminated version; for most Debian cases this is 2.0 or 2.1 for split
>68 string >\0 (format %s)
#>68 string !2.0\n
#>>68 string x (format %.3s)
>>>>>>>&-1 ubyte !0x2f
# display 4th character of file name extension like a of lzma
>>>>>>>>&-1 ubyte x \b%c
-# splitted debian package case
+# split debian package case
>68 string =2.1\n
# dpkg-1.18.25/dpkg-split/info.c
# NL terminated ASCII package name like ckermit
# URL: https://wiki.68kmla.org/DiskCopy_4.2_format_specification
# reference: http://nulib.com/library/FTN.e00005.htm
0x52 ubeshort 0x0100
-# test for disk size equal or above 400k
->0x40 ubelong >409599 Apple DiskCopy 4.2 image
+# test for disk image size equal or above 400k
+>0x40 ubelong >409599
+# test also for disk image size equal or below 1440k to skip
+# windows7en.mbr UNICODE.DAT
+>>0x40 ubelong <1474561
+# To skip Flags$StringJoiner.class with size 00106A61h test also for only 4 disk image sizes
+# 00064000 for 400k GCR disks
+# 000c8000 for 800k GCR disks
+# 000b4000 for 720k MFM disks
+# 00168000 for 1440k MFM disks
+>>>0x40 ubelong&0xffE03fFF 0
+>>>>0 use dc42-floppy
+# display information of Apple DiskCopy 4.2 floppy image
+0 name dc42-floppy
+# image pascal name padded with NULs like Microsoft Mail
+>00 pstring/B x Apple DiskCopy 4.2 image %s
#!:mime application/octet-stream
+!:mime application/x-dc42-floppy-image
!:apple dCpydImg
!:ext image/dc42
-# image pascal name padded with NULs like Microsoft Mail
->>00 pstring/B x %s
# data size in bytes like 409600
->>0x40 ubelong x \b, %u bytes
+>0x40 ubelong x \b, %u bytes
+# for debugging purpose size in hexadecimal
+#>0x40 ubelong x (0x%8.8x)
# tag size in bytes
->>0x44 ubelong >0 \b, 0x%x tag size
+>0x44 ubelong >0 \b, 0x%x tag size
# data checksum
-#>>0x48 ubelong x \b, 0x%x checksum
+#>0x48 ubelong x \b, 0x%x checksum
# tag checksum
-#>>0x4c ubelong x \b, 0x%x tag checksum
+#>0x4c ubelong x \b, 0x%x tag checksum
# disk encoding
->>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
->>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
->>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
->>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
->>0x50 ubyte >3 \b, 0x%x encoding
+>0x50 ubyte 0 \b, GCR CLV ssdd (400k)
+>0x50 ubyte 1 \b, GCR CLV dsdd (800k)
+>0x50 ubyte 2 \b, MFM CAV dsdd (720k)
+>0x50 ubyte 3 \b, MFM CAV dshd (1440k)
+>0x50 ubyte >3 \b, 0x%x encoding
# format byte
->>0x51 ubyte x \b, 0x%x format
-#>>0x54 ubequad x \b, data 0x%16.16llx
+>0x51 ubyte x \b, 0x%x format
+#>0x54 ubequad x \b, data 0x%16.16llx
# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
0 string ESP ESP archive data
# ZPack
>>>>>>3 regex \^lh[456] LHa (2.x) archive data
>>>>>>>2 string -lh5 \b
# https://en.wikipedia.org/wiki/BIOS
-# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
+# Some mainboard BIOS like Award use LHa compression. So archives with unusual extension are found like
# bios.rom , kd7_v14.bin, 1010.004, ...
!:ext lha/lzh/rom/bin
# missing -lh?- variants (Joe Jared)
>>>>4 beshort x \b, at least
>>>>4 use zipversion
>>>>4 beshort x to extract
+>>>>8 beshort x \b, compression method=
+>>>>8 use zipcompression
>>>>0x161 string WINZIP \b, WinZIP self-extracting
# StarView Metafile
>>0x2A string >\0 : %s
# DR-DOS 7.03 Packed File *.??_
-0 string Packed\ File\ Personal NetWare Packed File
->12 string x \b, was "%.12s"
+# Reference: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
+# Note: unpacked by PNUNPACK.EXE
+0 string Packed\ File\
+# by looking for Control-Z skip ASCII text starting with Packed File
+>0x18 ubyte 0x1a Personal NetWare Packed File
+!:mime application/x-novell-compress
+!:ext ??_
+>>12 string x \b, was "%.12s"
+# 1 or 2
+#>>0x19 ubyte x \b, at 0x19 %u
+>>0x1b ulelong x with %u bytes
# EET archive
# From: Tilman Sauerbeck <tilman@code-monkey.de>
# path[CXBTFFile[MaximumPathLength=256]
>>9 string x \b, 1st %s
+# ALZIP archive
+# by Hyungjun Park <hyungjun.park@worksmobile.com>, Hajin Jang <hajin_jang@worksmobile.com>
+# http://kippler.com/win/unalz/
+# https://salsa.debian.org/l10n-korean-team/unalz
+0 string ALZ\001 ALZ archive data
+!:ext alz
+
+# https://cf-aldn.altools.co.kr/setup/EGG_Specification.zip
+0 string EGGA EGG archive data,
+!:ext egg
+>5 byte x version %u
+>4 byte x \b.%u
+>>0x0E ulelong =0x08E28222
+>>0x0E ulelong =0x24F5A262 \b, split
+>>0x0E ulelong =0x24E5A060 \b, solid
+>>0x0E default x \b, unknown
+
+# PAQ9A archive
+# URL: http://mattmahoney.net/dc/#paq9a
+# Note: Line 1186 of paq9a.cpp gives the magic bytes
+0 string pQ9\001 PAQ9A archive
#------------------------------------------------------------------------------
-# $File: audio,v 1.118 2019/11/19 05:30:07 christos Exp $
+# $File: audio,v 1.120 2021/02/23 00:51:10 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
>0 string >\0 Composer: "%s"
0 string AMF AMF Module
>4 string >\0 Title: "%s"
-0 string MODINFO1 Open Cubic Player Module Inforation MDZ
+0 string MODINFO1 Open Cubic Player Module Information MDZ
0 string Extended\40Instrument: Fast Tracker II Instrument
# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
>>8 ubyte&0x0F >0 \b%d
#Get soundchips
>>8 ubyte x \b, soundchip(s)=
->>0x0C ulelong >0 SN76489,
->>0x10 ulelong >0 YM2413,
->>0x2C ulelong >0 YM2612,
->>0x30 ulelong >0 YM2151,
+>>0x0C ulelong >0 SN76489 (PSG),
+>>0x10 ulelong >0 YM2413 (OPLL),
+>>0x2C ulelong >0 YM2612 (OPN2),
+>>0x30 ulelong >0 YM2151 (OPM),
>>0x38 ulelong >0 Sega PCM,
>>0x34 ulelong >0xC
->>>0x40 ulelong >0 RF5C68,
+>>>0x40 ulelong >0 RF5C68 (PCM),
>>0x34 ulelong >0x10
->>>0x44 ulelong >0 YM2203,
+>>>0x44 ulelong >0 YM2203 (OPN),
>>0x34 ulelong >0x14
->>>0x48 ulelong >0 YM2608,
+>>>0x48 ulelong >0 YM2608 (OPNA),
>>0x34 ulelong >0x18
->>>0x4C lelong >0 YM2610,
->>>0x4C lelong <0 YM2610B,
+>>>0x4C lelong >0 YM2610 (OPNB),
+>>>0x4C lelong <0 YM2610B (OPNB+2FM),
>>0x34 ulelong >0x1C
->>>0x50 ulelong >0 YM3812,
+>>>0x50 ulelong >0 YM3812 (OPL2),
>>0x34 ulelong >0x20
->>>0x54 ulelong >0 YM3526,
+>>>0x54 ulelong >0 YM3526 (OPL),
>>0x34 ulelong >0x24
->>>0x58 ulelong >0 Y8950,
+>>>0x58 ulelong >0 Y8950 (MSX-Audio),
>>0x34 ulelong >0x28
->>>0x5C ulelong >0 YMF262,
+>>>0x5C ulelong >0 YMF262 (OPL3),
>>0x34 ulelong >0x2C
->>>0x60 ulelong >0 YMF278B,
+>>>0x60 ulelong >0 YMF278B (OPL4),
>>0x34 ulelong >0x30
->>>0x64 ulelong >0 YMF271,
+>>>0x64 ulelong >0 YMF271 (OPX),
>>0x34 ulelong >0x34
->>>0x68 ulelong >0 YMZ280B,
+>>>0x68 ulelong >0 YMZ280B (PCMD8),
>>0x34 ulelong >0x38
->>>0x6C ulelong >0 RF5C164,
+>>>0x6C ulelong >0 RF5C164 (PCM),
>>0x34 ulelong >0x3C
>>>0x70 ulelong >0 PWM,
>>0x34 ulelong >0x40
>>0x34 ulelong >0x54
>>>0x88 ulelong >0 MultiPCM,
>>0x34 ulelong >0x58
->>>0x8C ulelong >0 uPD7759,
+>>>0x8C ulelong >0 uPD7759 (ADPCM Speech),
>>0x34 ulelong >0x5C
->>>0x90 ulelong >0 OKIM6258,
+>>>0x90 ulelong >0 OKIM6258 (ADPCM Speech),
>>0x34 ulelong >0x64
->>>0x98 ulelong >0 OKIM6295,
+>>>0x98 ulelong >0 OKIM6295 (ADPCM),
>>0x34 ulelong >0x68
>>>0x9C ulelong >0 K051649,
>>0x34 ulelong >0x6C
>>0x34 ulelong >0x94
>>>0xC8 ulelong >0 SAA1099,
>>0x34 ulelong >0x98
->>>0xCC ulelong >0 ES5503,
+>>>0xCC ulelong >0 ES5503 (DOC),
>>0x34 ulelong >0x9C
->>>0xD0 lelong >0 ES5505,
->>>0xD0 lelong <0 ES5506,
+>>>0xD0 lelong >0 ES5505 (OTIS),
+>>>0xD0 lelong <0 ES5506 (OTTO),
>>0x34 ulelong >0xA4
>>>0xD8 ulelong >0 X1-010,
>>0x34 ulelong >0xA8
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: avm,v 1.1 2020/08/28 20:37:58 christos Exp $
+# avm: file(1) magic for avm files; this is not use
+
+# Summary: FRITZ!Box router configuration backup
+# From: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Fritz!Box
+# Reference: http://www.mengelke.de/Projekte/FritzBoxTools2
+# Note: only tested with models 4040 and 6490 Cable (lgi)
+0 string ****\ FRITZ!Box\ FRITZ!Box configuration backup
+#!:mime text/plain
+!:mime application/x-avm-export
+!:ext export
+# router model name like "4040" , "6490 Cable (lgi)" followed by " CONFIGURATION EXPORT"
+>15 string x of %-.4s
+# on 2nd line hashed password
+#>41 search/54 Password= \b, password
+# on 3rd line firmware version like: 141.06.24 141.06.50 141.07.10 ... 155.06.83
+>41 search/172 FirmwareVersion= \b, firmware version
+>>&0 string x %s
+# on 5th line oem like: avme lgi
+>41 search/285 OEM= \b, oem
+>>&0 string x %s
+# on 7th line language like: de en
+>41 search/305 Language= \b, language
+>>&0 string x %s
+# on 10th line cfg file name like: /var/tmp.cfg
+>41 search/349 tmp.cfg
+# on 11th line date inside c-comment like: Thu Jun 4 22:25:19 2015
+>>&4 string x \b, %s
+#
+
0 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows
!:mime biosig/ates
#
-0 string ATF\x09 Biosig/Axon Text fomrat
+0 string ATF\x09 Biosig/Axon Text format
!:mime biosig/atf
#
0 string ADU1 Biosig/Axona file format
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: bm,v 1.2 2021/03/14 16:56:51 christos Exp $
+# bm: file(1) magic for "Birtual Machine", cf. https://github.com/tsoding/bm
+
+0 string bm\001\244 Birtual Machine
+>4 leshort x \b, version %d
+>6 lelong x \b, program size %u
+>14 lelong x \b, memory size %u
+>22 lelong x \b, memory capacity %u
# Office for Information Security (Bundesamt fuer Sicherheit in der
# Informationstechnik).
-# Extension: .xia
-0 string XIA1 Chiasmus encrypted data
+# https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html
+0 string XIA1\r Chiasmus Encrypted data
+!:ext xia
-# Extension: .xis
0 string XIS Chiasmus key
+!:ext xis
#------------------------------------------------------------------------------
-# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $
+# $File: c64,v 1.8 2020/12/20 16:17:43 christos Exp $
# c64: file(1) magic for various commodore 64 related files
#
# From: Dirk Jagdmann <doj@cubic.org>
>68 string >\0 \b (C) %s
>100 byte >0 \b, %u subsong(s)
+# CBM BASIC (cc65 compiled)
+0 leshort 0x0801
+>2 leshort 0x080b
+>6 string \x9e CBM BASIC
+>7 string >\0 \b, SYS %s
#------------------------------------------------------------------------------
-# $File: cad,v 1.23 2020/05/30 23:58:07 christos Exp $
+# $File: cad,v 1.25 2021/02/23 00:51:10 christos Exp $
# autocad: file(1) magic for cad files
#
#>0 ubyte &0x40 \b, reserved
# type of element 9~TCB 8~Digitizer setup 5~Group Data Elements
#>1 ubyte&0x7F x \b, type %u
-# words to follow in element: 17H~CEL libray 2FEh~DGN 9FEh,DFEh~CIT
+# words to follow in element: 17H~CEL library 2FEh~DGN 9FEh,DFEh~CIT
#>2 uleshort x \b, words 0x%4.4x to follow
# test for 3 reserved 0 bytes in CIT or "conversion" in ViewInfo structure (DGN CEL)
#>508 ubelong x \b, RESERVED %8.8x
# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
0 string AC1012 DWG AutoDesk AutoCAD Release 13
!:mime image/vnd.dwg
+0 string AC1013 DWG AutoDesk AutoCAD Release 13c3
+!:mime image/vnd.dwg
0 string AC1014 DWG AutoDesk AutoCAD Release 14
!:mime image/vnd.dwg
-0 string AC1015 DWG AutoDesk AutoCAD 2000/2002
+0 string AC1015 DWG AutoDesk AutoCAD 2000
!:mime image/vnd.dwg
# A new version of AutoCAD DWG
!:mime image/vnd.dwg
# From GNU LibreDWG
-0 string AC1032 DWG AutoDesk AutoCAD 2018/2019
+0 string AC1032 DWG AutoDesk AutoCAD 2018/2019/2020
+!:mime image/vnd.dwg
+0 string AC1035 DWG AutoDesk AutoCAD 2021
!:mime image/vnd.dwg
# KOMPAS 2D drawing from ASCON
>>>>&1 search/8192 AC1006 \b, R10
>>>>&1 search/8192 AC1009 \b, R11/R12
>>>>&1 search/8192 AC1012 \b, R13
+>>>>&1 search/8192 AC1013 \b, R13c3
>>>>&1 search/8192 AC1014 \b, R14
>>>>&1 search/8192 AC1015 \b, version 2000
>>>>&1 search/8192 AC1018 \b, version 2004
>>>>&1 search/8192 AC1021 \b, version 2007
>>>>&1 search/8192 AC1024 \b, version 2010
+>>>>&1 search/8192 AC1027 \b, version 2013
+>>>>&1 search/8192 AC1032 \b, version 2018
+>>>>&1 search/8192 AC1035 \b, version 2021
# The Sketchup 3D model format https://www.sketchup.com/
0 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model
#------------------------------------------------------------------------------
-# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $
+# $File: cafebabe,v 1.26 2020/12/12 20:01:47 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# might add another one or two as time goes by...
#
### JAVA START ###
+# Reference: http://en.wikipedia.org/wiki/Java_class_file
+# Update: Joerg Jenderek
0 belong 0xcafebabe
->4 belong >30 compiled Java class data,
+>4 ubelong >30 compiled Java class data,
!:mime application/x-java-applet
->>6 beshort x version %d.
->>4 beshort x \b%d
+#!:mime application/java-byte-code
+!:ext class
+>>6 ubeshort x version %d.
+>>4 ubeshort x \b%d
+# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
+#>>4 ubelong x (0x%8.8x)
# Which is which?
+# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
+#>>4 belong 0x002b (Java 0.?)
#>>4 belong 0x032d (Java 1.0)
#>>4 belong 0x032d (Java 1.1)
>>4 belong 0x002e (Java 1.2)
>>4 belong 0x0032 (Java 1.6)
>>4 belong 0x0033 (Java 1.7)
>>4 belong 0x0034 (Java 1.8)
+>>4 belong 0x0035 (Java SE 9)
+>>4 belong 0x0036 (Java SE 10)
+>>4 belong 0x0037 (Java SE 11)
+>>4 belong 0x0038 (Java SE 12)
+>>4 belong 0x0039 (Java SE 13)
+>>4 belong 0x003A (Java SE 14)
+# pool count unequal zero
+#>>8 beshort x \b, pool count 0x%x
+# pool table
+#>>10 ubequad x \b, pool 0x%16.16llx...
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
### JAVA END ###
### MACH-O START ###
+# URL: https://en.wikipedia.org/wiki/Mach-O
0 name mach-o \b [
+# for debugging purpose CPU type as hexadecimal
+#>0 ubequad x CPU=%16.16llx
+# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
>0 use mach-o-cpu \b
+# for debugging purpose print offset to 1st mach_header like:
+# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
+#>8 ubelong x at 0x%x offset
>(8.L) indirect x \b:
>0 belong x \b]
+# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
+# include/mach-o/fat.h
+# include/mach/machine.h
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
>>8 use mach-o \b
->4 belong >1
->>4 belong <20 Mach-O universal binary with %d architectures:
+# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
+>4 ubelong >1
+>>4 ubelong <20 Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8 use mach-o \b
->>4 belong >1
->>>28 use mach-o \b
->>4 belong >2
->>>48 use mach-o \b
->>4 belong >3
->>>68 use mach-o \b
->>4 belong >4
->>>88 use mach-o \b
->>4 belong >5
->>>108 use mach-o \b
+>>>4 ubelong >1
+>>>>28 use mach-o \b
+>>>4 ubelong >2
+>>>>48 use mach-o \b
+>>>4 ubelong >3
+>>>>68 use mach-o \b
+>>>4 ubelong >4
+>>>>88 use mach-o \b
+>>>4 ubelong >5
+>>>>108 use mach-o \b
### MACH-O END ###
#------------------------------------------------------------------------------
-# $File$
+# $File: citrus,v 1.5 2021/01/04 19:48:31 christos Exp $
# citrus locale declaration
#
0 string RuneCT Citrus locale declaration for LC_CTYPE
+0 string CtrsME Citrus locale declaration for LC_MESSAGES
+0 string CtrsMO Citrus locale declaration for LC_MONETARY
+0 string CtrsNU Citrus locale declaration for LC_NUMERIC
+0 string CtrsTI Citrus locale declaration for LC_TIME
#------------------------------------------------------------------------------
-# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
+# $File: clipper,v 1.9 2020/12/15 23:57:27 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
>54 byte 2 -Cssw
>54 byte 3 -Cspw
>54 byte 4 -Cscb
-4 string pipe CLIPPER instruction trace
-4 string prof CLIPPER instruction profile
+#4 string pipe CLIPPER instruction trace
+#4 string prof CLIPPER instruction profile
#------------------------------------------------------------------------------
-# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $
+# $File: coff,v 1.4 2021/02/10 00:37:02 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
#
-# by Joerg Jenderek at Oct 2015
+# by Joerg Jenderek at Oct 2015, Feb 2021
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
0 name display-coff
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 uleshort&0x8E80 0
->>0 clear x
+# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
+>>2 uleshort >0
+# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
+>>>2 uleshort <4207
+>>>>0 clear x
# f_magic - magic number
# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
->>0 uleshort 0x014C Intel 80386
+>>>>0 uleshort 0x014C Intel 80386
# Hitachi SH big-endian COFF (./hitachi-sh)
->>0 uleshort 0x0500 Hitachi SH big-endian
+>>>>0 uleshort 0x0500 Hitachi SH big-endian
# Hitachi SH little-endian COFF (./hitachi-sh)
->>0 uleshort 0x0550 Hitachi SH little-endian
+>>>>0 uleshort 0x0550 Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
-#>>0 uleshort 0x01DF
+#>>>>0 uleshort 0x01DF
# MS Windows COFF Intel Itanium, AMD64
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
->>0 uleshort 0x0200 Intel ia64
->>0 uleshort 0x8664 Intel amd64
+>>>>0 uleshort 0x0200 Intel ia64
+>>>>0 uleshort 0x8664 Intel amd64
# TODO for other COFFs
-#>>0 uleshort 0xABCD COFF_TEMPLATE
->>0 default x
->>>0 uleshort x type 0x%04x
->>0 uleshort x COFF
+#>>>>0 uleshort 0xABCD COFF_TEMPLATE
+>>>>0 default x
+>>>>>0 uleshort x type 0x%04x
+>>>>0 uleshort x COFF
# F_EXEC flag bit
->>18 leshort ^0x0002 object file
-#!:mime application/x-coff
-#!:ext cof/o/obj/lib
->>18 leshort &0x0002 executable
+>>>>18 leshort ^0x0002 object file
+!:mime application/x-coff
+!:ext o/obj/lib
+# no cof sample found
+#!:ext cof/o/obj/lib
+>>>>18 leshort &0x0002 executable
#!:mime application/x-coffexec
# F_RELFLG flag bit,static object
->>18 leshort &0x0001 \b, no relocation info
+>>>>18 leshort &0x0001 \b, no relocation info
# F_LNNO flag bit
->>18 leshort &0x0004 \b, no line number info
+>>>>18 leshort &0x0004 \b, no line number info
# F_LSYMS flag bit
->>18 leshort &0x0008 \b, stripped
->>18 leshort ^0x0008 \b, not stripped
+>>>>18 leshort &0x0008 \b, stripped
+>>>>18 leshort ^0x0008 \b, not stripped
# flags in other COFF versions
#0x0010 F_FDPR_PROF
#0x0020 F_FDPR_OPTI
#0x0040 F_DSA
# F_AR32WR flag bit
-#>>>18 leshort &0x0100 \b, 32 bit little endian
+#>>>>18 leshort &0x0100 \b, 32 bit little endian
#0x1000 F_DYNLOAD
#0x2000 F_SHROBJ
#0x4000 F_LOADONLY
-# f_nscns - number of sections
->>2 uleshort <2 \b, %d section
->>2 uleshort >1 \b, %d sections
-# f_timdat - file time & date stamp only for little endian
-#>>4 date x \b, %s
+# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124
+>>>>2 uleshort <2 \b, %u section
+>>>>2 uleshort >1 \b, %u sections
# f_symptr - symbol table pointer, only for not stripped
->>8 ulelong >0 \b, symbol offset=0x%x
+# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0
+>>>>8 ulelong >0 \b, symbol offset=0x%x
# f_nsyms - number of symbols, only for not stripped
->>12 ulelong >0 \b, %d symbols
-# f_opthdr - optional header size
->>16 uleshort >0 \b, optional header size %d
+# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
+>>>>12 ulelong >0 \b, %d symbols
+# f_opthdr - optional header size. An object file should have a value of 0
+>>>>16 uleshort >0 \b, optional header size %u
+# f_timdat - file time & date stamp only for little endian
+>>>>4 ledate >0 \b, created %s
# at offset 20 can be optional header, extra bytes FILHSZ-20 because
# do not rely on sizeof(FILHDR) to give the correct size for header.
# or first section header
# additional variables for other COFF files
+>>>>16 uleshort =0
+# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
+>>>>>20 string x \b, 1st section name "%.8s"
# >20 beshort 0407 (impure)
# >20 beshort 0410 (pure)
# >20 beshort 0413 (demand paged)
#------------------------------------------------------------------------------
-# $File: compress,v 1.79 2020/05/30 23:53:04 christos Exp $
+# $File: compress,v 1.80 2021/03/15 17:49:24 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
>>5 lequad !0xffffffffffffffff non-streamed, size %lld
# http://tukaani.org/xz/xz-file-format.txt
-0 ustring \xFD7zXZ\x00 XZ compressed data
+0 ustring \xFD7zXZ\x00 XZ compressed data, checksum
+>7 byte&0xf 0x0 NONE
+>7 byte&0xf 0x1 CRC32
+>7 byte&0xf 0x4 CRC64
+>7 byte&0xf 0xa SHA-256
+
!:strength * 2
!:mime application/x-xz
#------------------------------------------------------------------------------
-# $File: console,v 1.55 2020/04/19 17:30:55 christos Exp $
+# $File: console,v 1.62 2021/02/05 21:51:06 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
>0x14c byte x (Rev.%02u)
# Machine type. (SGB, CGB, SGB+CGB)
+# Old licensee code 0x33 is required for SGB, but not CGB.
>0x14b byte 0x33
>>0x146 byte 0x03
>>>0x143 byte&0x80 0x80 [SGB+CGB]
>>>0x143 byte&0xC0 0x80 [CGB]
>>>0x143 byte&0xC0 0xC0 [CGB ONLY]
>0x14b byte !0x33
+>>0x143 byte&0xC0 0x80 [CGB]
+>>0x143 byte&0xC0 0xC0 [CGB ONLY]
# Mapper.
>0x147 byte 0x00 [ROM ONLY]
# RAM size.
>0x149 byte 1 \b, RAM: 16Kbit
>0x149 byte 2 \b, RAM: 64Kbit
->0x149 byte 3 \b, RAM: 128Kbit
+>0x149 byte 3 \b, RAM: 256Kbit
>0x149 byte 4 \b, RAM: 1Mbit
>0x149 byte 5 \b, RAM: 512Kbit
# Reference: https://3dbrew.org/wiki/3DSX_Format
0 string 3DSX Nintendo 3DS Homebrew Application (3DSX)
+# Type: Nintendo 3DS Banner Model Data.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# Reference: https://3dbrew.org/wiki/CBMD
+0 string CBMD\0\0\0\0 Nintendo 3DS Banner Model Data
+
#------------------------------------------------------------------------------
# a7800: file(1) magic for the Atari 7800 raw ROM format.
# From: David Korth <gerbilsoft@gerbilsoft.com>
>0x2C byte >0x20 Nintendo Badge Arcade badge set:
>>0x2C string x "%.48s"
>>0x24 ulelong x \b, set ID: %u
+
+#------------------------------------------------------------------------------
+# sufami: file(1) magic for Sufami Turbo ROM images.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor
+0 string BANDAI\ SFC-ADX
+>0x10 string !SFC-ADX\ BACKUP Sufami Turbo ROM image:
+>>0x10 string/T x "%.14s"
+>>0x30 byte x \b, ID %02X
+>>0x31 byte x \b%02X
+>>0x32 byte x \b%02X
+>>0x33 ubyte >0 \b, series index %u
+>>0x34 ubyte 0 [SlowROM]
+>>0x34 ubyte 1 [FastROM]
+>>0x35 ubyte 1 [SRAM]
+>>0x35 ubyte 3 [Special]
+
+# Type: Nintendo GameCube/Wii disc image (RVZ format)
+0 string RVZ\001 Nintendo
+>0x48 belong 1 GameCube
+!:mime application/x-gamecube-rom
+>0x48 belong 2 Wii
+!:mime application/x-wii-rom
+>0x48 default x GameCube/Wii
+>0x48 belong x disc image (RVZ format):
+>>0x58 use nintendo-gcn-disc-common
+
#------------------------------------------------------------------------------
-# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $
+# $File: coverage,v 1.3 2021/02/23 00:51:10 christos Exp $
# xoverage: file(1) magic for test coverage data
# File formats used to store test coverage data
# Coverage reports generated by gcov
-# i.e. source code annoted with coverage information
+# i.e. source code annotated with coverage information
0 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: crypto,v 1.2 2021/03/27 20:15:53 christos Exp $
+# crypto: file(1) magic for crypto formats
+#
#------------------------------------------------------------------------------
-# $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $
+# $File: database,v 1.61 2021/02/23 00:51:10 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
# Number of next available block for appending data
#>0 lelong =0 \b, next free block index %u
>0 lelong !0 \b, next free block index %u
-# no positiv block length
+# no positive block length
#>20 uleshort =0 \b, block length %u
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated by \032\032
>0 lelong x dBase IV DBT
!:mime application/x-dbt
!:ext dbt
-# 8 character shorted main name of coresponding dBASE IV DBF file
+# 8 character shorted main name of corresponding dBASE IV DBF file
>8 ubelong >0x20000000
# skip unusual like for angest.dbt
>>20 uleshort >0
#------------------------------------------------------------------------------
-# $File: der,v 1.3 2020/02/16 20:45:21 christos Exp $
+# $File: der,v 1.4 2021/03/14 17:12:04 christos Exp $
# der: file(1) magic for DER encoded files
#
0 der seq
>&0 der seq
->>&0 der eoc Certificate
->>>&0 der int1=02 \b, Version=3
+>>&0 der eoc
+>>>&0 der int1=02 Certificate, Version=3
+>>>&0 der int1=x Certificate, Version=%s
>>&0 der int9=x \b, Serial=%s
>>&0 der seq
>>>&0 der obj_id9=2a864886f70d01010b
#------------------------------------------------------------------------------
-# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
+# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $
# diff: file(1) magic for diff(1) output
#
0 search/1 diff\040 diff output text
!:mime text/x-diff
-0 search/1 ***\040 diff output text
+0 search/1 ***\040
+>&0 search/1024 \n---\040 context diff output text
!:mime text/x-diff
0 search/1 Only\040in\040 diff output text
!:mime text/x-diff
!:mime text/x-diff
# bsdiff: file(1) magic for bsdiff(1) output
-0 string/b BSDIFF40 bsdiff(1) patch file
+0 string/b BSDIFF40 bsdiff(1) patch file
# unified diff
0 search/4096 ---\040
->&0 search/1024 \n
->>&0 search/1 +++\040
->>>&0 search/1024 \n
->>>>&0 search/1 @@ unified diff output text
+>&0 search/1024 \n
+>>&0 search/1 +++\040
+>>>&0 search/1024 \n
+>>>>&0 search/1 @@ unified diff output text
!:mime text/x-diff
!:strength + 90
#------------------------------------------------------------------------------
-# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
+# $File: editors,v 1.12 2020/10/11 20:28:07 christos Exp $
# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
+# updated by Osman Surkatty
0 string VimCrypt~ Vim encrypted file data
+>9 string 01! with zip cryptmethod
+>9 string 02! with blowfish cryptmethod
+>9 string 03! with blowfish2 cryptmethod
0 name vimnanoswap
>67 byte 0
#------------------------------------------------------------------------------
-# $File: elf,v 1.80 2020/02/12 22:17:33 christos Exp $
+# $File: elf,v 1.85 2021/03/27 20:18:38 christos Exp $
# elf: file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
>2 leshort 0x0214 2.0
>0 leshort &0x0008 (LP64)
+0 name elf-riscv
+>0 lelong&0x00000001 0x00000001 RVC,
+>0 lelong&0x00000008 0x00000008 RVE,
+>0 lelong&0x00000006 0x00000000 soft-float ABI,
+>0 lelong&0x00000006 0x00000002 single-float ABI,
+>0 lelong&0x00000006 0x00000004 double-float ABI,
+>0 lelong&0x00000006 0x00000006 quad-float ABI,
+
0 name elf-le
>16 leshort 0 no file type,
!:mime application/octet-stream
# Core file detection is not reliable.
#>>>(0x38+0xcc) string >\0 of '%s'
#>>>(0x38+0x10) lelong >0 (signal %d),
->16 leshort &0xff00 processor-specific,
+>16 leshort &0xff00
+>>18 leshort !8 processor-specific,
+>>18 leshort 8
+>>>16 leshort 0xFF80 PlayStation 2 IOP module,
+!:mime application/x-sharedlib
+>>>16 leshort !0xFF80 processor-specific,
>18 clear x
>18 leshort 0 no machine,
>18 leshort 1 AT&T WE32100,
>18 leshort 19 Intel 80960,
>18 leshort 20 PowerPC or cisco 4500,
>18 leshort 21 64-bit PowerPC or cisco 7500,
+>>48 lelong 0 Unspecified or Power ELF V1 ABI,
+>>48 lelong 1 Power ELF V1 ABI,
+>>48 lelong 2 OpenPOWER ELF V2 ABI,
>18 leshort 22 IBM S/390,
>18 leshort 23 Cell SPU,
>18 leshort 24 cisco SVIP,
>18 leshort 90 Matsushita MN10200,
>18 leshort 91 picoJava,
>18 leshort 92 OpenRISC,
->18 leshort 93 ARC Cores Tangent-A5,
+>18 leshort 93 Synopsys ARCompact ARC700 cores,
>18 leshort 94 Tensilica Xtensa,
>18 leshort 95 Alphamosaic VideoCore,
>18 leshort 96 Thompson Multimedia,
>18 leshort 140 TI TMS320C6000 DSP family,
>18 leshort 141 TI TMS320C2000 DSP family,
>18 leshort 142 TI TMS320C55x DSP family,
+>18 leshort 144 TI Programmable Realtime Unit
>18 leshort 160 STMicroelectronics 64bit VLIW DSP,
>18 leshort 161 Cypress M8C,
>18 leshort 162 Renesas R32C series,
>18 leshort 189 Xilinx MicroBlaze 32-bit RISC,
>18 leshort 190 NVIDIA CUDA architecture,
>18 leshort 191 Tilera TILE-Gx,
+>18 leshort 195 Synopsys ARCv2/HS3x/HS4x cores,
>18 leshort 197 Renesas RL78 family,
>18 leshort 199 Renesas 78K0R,
>18 leshort 200 Freescale 56800EX,
>18 leshort 217 iCelero CoolEngine,
>18 leshort 218 Nanoradio Optimized RISC,
>18 leshort 243 UCB RISC-V,
+# only for 32-bit
+>>4 byte 1
+>>>36 use elf-riscv
+# only for 64-bit
+>>4 byte 2
+>>>48 use elf-riscv
+>18 leshort 244 Lanai 32-bit processor,
+>18 leshort 245 CEVA Processor Architecture Family,
+>18 leshort 246 CEVA X2 Processor Family,
>18 leshort 247 eBPF,
->18 leshort 251 NEC VE,
+>18 leshort 248 Graphcore Intelligent Processing Unit,
+>18 leshort 249 Imagination Technologies,
+>18 leshort 250 Netronome Flow Processor,
+>18 leshort 251 NEC Vector Engine,
+>18 leshort 252 C-SKY processor family,
+>18 leshort 253 Synopsys ARCv3 64-bit ISA/HS6x cores,
+>18 leshort 254 MOS Technology MCS 6502 processor,
+>18 leshort 255 Synopsys ARCv3 32-bit,
+>18 leshort 256 Kalray VLIW core of the MPPA family,
+>18 leshort 257 WDC 65816/65C816,
+>18 leshort 258 Loongson Loongarch,
+>18 leshort 259 ChipON KungFu32,
>18 leshort 0x1057 AVR (unofficial),
>18 leshort 0x1059 MSP430 (unofficial),
>18 leshort 0x1223 Adapteva Epiphany (unofficial),
#------------------------------------------------------------------------------
-# $File: filesystems,v 1.133 2020/05/17 19:32:00 christos Exp $
+# $File: filesystems,v 1.140 2021/02/23 00:51:10 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
# for sector sizes with 512 or more Bytes
>0x1FE leshort 0xAA55 DOS/MBR boot sector
+# ExFAT
+3 string/w =EXFAT
+>0x1FE leshort 0xAA55
+>>0x6E ubyte 1
+>>>0x6F ubyte 0x80
+>>>0 ubyte 0xEB DOS/MBR boot sector,
+>>>0x69 ubyte x ExFAT Filesystem version %d.
+>>>0x68 ubyte x \b%d
+>>>0x6d ubyte x \b, (1<<%d) sectors per cluster
+>>>0x48 ulequad x \b, sectors %lld
+>>>0x64 ulelong x \b, serial number 0x%x
+
# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
# only for sector sizes with 512 or more Bytes
0x1FE leshort 0xAA55 DOS/MBR boot sector
# updated by Joerg Jenderek at Oct 2008
# variables according to grub-0.97/stage1/stage1.S or
# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
-# usual values are marked with comments to get only informations of strange GRUB loaders
+# usual values are marked with comments to get only information of strange GRUB loaders
>342 search/60 \0Geom\0
#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
>>0x41 ubyte <2
# mbr partition table entries updated by Joerg Jenderek at Sep 2013
# skip Norton Utilities disc image data
>3 string !IHISK
-# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
+# skip Linux style boot sector starting with assembler instructions mov 0x7c0,ax;
>>0 belong !0xb8c0078e
# not Linux kernel
>>>514 string !HdrS
>>>>>0 ubelong&0xFD000000 !0xE9000000
# skip FSInfosector
>>>>>>0 string !RRaA
-# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
+# skip 3rd sector of MS x86 bootloader with assembler instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
>>>>>>>0 ubequad !0xfa660fb64610668b
# skip 13rd sector of MS x86 bootloader
# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
# grub-1.94/kern/i386/pc/startup.S
# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data
-# usual values are marked with comments to get only informations of strange GRUB loaders
+# usual values are marked with comments to get only information of strange GRUB loaders
0x200 uleshort 0x70EA
# found only version 3.{1,2}
>0x206 ubeshort >0x0300
0 ulelong&0x804000E9 0x000000E9
!:strength +60
# mtools-3.9.8/msdos.h
-# usual values are marked with comments to get only informations of strange FAT systems
+# usual values are marked with comments to get only information of strange FAT systems
# valid sectorsize must be a power of 2 from 32 to 32768
>11 uleshort&0x001f 0
>>11 uleshort <32769
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
>>>>>>>>37 ubyte >0 \b, reserved 0x%x
#>>>>>>>>37 ubyte =0 \b, reserved 0x%x
-# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
+# extended boot signature value is 0x80 for NTFS, 0x28 or 0x29 for others
>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>>>38 ubyte&0xFE =0x28
>>>>>>>>>39 ulelong x \b, serial number 0x%x
# The next line is not necessary because the MBR staff is done looking for boot signature
>0x1FE leshort 0xAA55 (DOS/MBR boot sector)
# "application id" which appears to be used as a volume label
->32808 string/T >\0 '%s'
+>32808 string/T >\0 '%.32s'
>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
!:mime application/x-iso9660-image
32777 string CDROM High Sierra CD-ROM filesystem data
+# "application id" which appears to be used as a volume label
+>32816 string/T >\0 '%.32s'
+
# CDROM Filesystems
# https://en.wikipedia.org/wiki/ISO_9660
>0x400 pstring x serial: %s
#>0x500 pstring x unknown: %s
!:ext imgc
+
+# http://martin.hinner.info/fs/bfs/bfs-structure.html
+0 lelong 0x1BADFACE SCO UnixWare BFS filesystem
+
+# https://arstechnica.com/information-technology/2018/07/the-beos-filesystem/
+32 lelong 0x42465331 BE/OS BFS1 filesystem
+>36 lelong x \b, byte order %d
+>40 lelong x \b, block size %d
+>44 lelong x \b, block shift %d
+>48 lequad x \b, total blocks %lld
+>56 lequad x \b, used blocks %lld
+
+
+0 name next
+>0 lelong x \b, size %d
+>4 string x \b, label %s
+
+# https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3\
+# /IONeXTPartitionScheme.h
+0 string NeXT NeXT version 1 disklabel
+>12 use next
+0 string dlV1 NeXT version 2 disklabel
+>12 use next
+0 string dlV2 NeXT version 3 disklabel
+>12 use next
#------------------------------------------------------------------------------
-# $File: fonts,v 1.43 2019/07/16 11:11:31 christos Exp $
+# $File: fonts,v 1.45 2021/01/03 21:00:11 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
0 string %!PS-AdobeFont-1. PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
+>26 string >\0 (%s)
0 string %!FontType1 PostScript Type 1 font program data
6 string %!FontType1 PostScript Type 1 font program data
0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text
>10 leshort x \b%d
>40 string x %s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/CPI
+# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html
0 belong 0xff464f4e DOS code page font data collection
+!:mime font/x-dos-cpi
+!:ext cpi
+0 string \x7fDRFONT DR-DOS code page font data collection
+!:mime font/x-drdos-cpi
+!:ext cpi
7 belong 0x00454741 DOS code page font data
7 belong 0x00564944 DOS code page font data (from Linux?)
4098 string DOSFONT DOSFONT2 encrypted font data
#------------------------------------------------------------------------------
-# $File: forth,v 1.1 2019/06/06 19:14:20 christos Exp $
+# $File: forth,v 1.3 2020/12/12 20:01:47 christos Exp $
# forth: file(1) magic for various Forth environments
# From: Lubomir Rintel <lkundrak@v3.sk>
#
0 regex \^:[[:space:]].*[[:space:]]\\(([[:space:]].*)?\ --\ (.*[[:space:]])?\\)[[:space:]].*[[:space:]];$ FORTH program
!:mime text/x-forth
-# Various dictionary images used by OpenFirware FORTH environent
+# Various dictionary images used by OpenFirware FORTH environment
0 lelong 0xe1a00000
->8 lelong 0xe1a00000 ARM OpenFirmware FORTH Dictionary,
->>24 lelong x Text length: %d bytes,
->>28 lelong x Data length: %d bytes,
->>32 lelong x Text Relocation Table length: %d bytes,
->>36 lelong x Data Relocation Table length: %d bytes,
->>40 lelong x Entry Point: 0x%08X,
->>44 lelong x BSS length: %d bytes
+>8 lelong 0xe1a00000
+# skip raspberry pi kernel image kernel7.img by checking for positive text length
+>>24 lelong >0 ARM OpenFirmware FORTH Dictionary,
+>>>24 lelong x Text length: %d bytes,
+>>>28 lelong x Data length: %d bytes,
+>>>32 lelong x Text Relocation Table length: %d bytes,
+>>>36 lelong x Data Relocation Table length: %d bytes,
+>>>40 lelong x Entry Point: 0x%08X,
+>>>44 lelong x BSS length: %d bytes
0 string MP
>28 lelong 1 x86 OpenFirmware FORTH Dictionary,
#------------------------------------------------------------------------------
-# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $
+# $File: fsav,v 1.21 2021/02/23 00:51:10 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
# file: could not find any valid magic files! (No error)
>>10 default x (with buildtime)
#>>10 default x
-# clamtmp is used for temporily database like update process
+# clamtmp is used for temporarily database like update process
# for pure tar database only cld extension found
!:ext cld/cvd/clamtmp/cud
>511 default x file
>>>512 use tar-file
# not pure tar
>>1012 quad !0
-# one space at the end of text and then handles gziped archives by ./compress
+# one space at the end of text and then handles gzipped archives by ./compress
>>>512 string \037\213 \b, with
>>>>512 indirect x
#------------------------------------------------------------------------------
-# $File: games,v 1.20 2020/02/01 16:32:33 christos Exp $
+# $File: games,v 1.22 2021/02/23 00:51:10 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
# Summary: NetImmerse game engine file
# Extension .nif
# Created by: Abel Cheung <abelcheung@gmail.com>
-0 string NetImmerse\ File\ Format,\ Versio
+0 string NetImmerse\ File\ Format,\ Version
>&0 string n\ NetImmerse game engine file
>>&0 regex [0-9a-z.]+ \b, version %s
>>12 regex [0-9a-z.]+ saved by game version %s
0 string CIV6 Sid Meier's Civilization VI saved game
+
+# https://syzygy-tables.info/
+# From Michel Van den Bergh
+0 string \327f\f\245 Syzygy DTZ tablebase
+!:mime application/syzygy
+0 string q\350#] Syzygy WDL tablebase
+!:mime application/syzygy
#------------------------------------------------------------------------------
-# $File: git,v 1.1 2019/10/04 18:46:29 christos Exp $
+# $File: git,v 1.2 2020/08/09 16:57:15 christos Exp $
# git: file(1) magic for Git objects
0 string blob\040
->5 regex [0-9]+ Git blob %s
+>5 regex [0-9a-f]+ Git blob %s
0 string tree\040
->5 regex [0-9]+ Git tree %s
+>5 regex [0-9a-f]+ Git tree %s
0 string commit\040
->7 regex [0-9]+ Git commit %s
+>7 regex [0-9a-f]+ Git commit %s
#------------------------------------------------------------------------------
-# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $
+# $File: gnome,v 1.7 2020/06/23 16:17:08 christos Exp $
# GNOME related files
# Contributed by Josh Triplett
0 string GOBJ\nMETADATA\r\n\032 G-IR binary database
>16 byte x \b, v%d
>17 byte x \b.%d
->20 leshort x \b, %d entries
->22 leshort x \b/%d local
+>20 short x \b, %d entries
+>22 short x \b/%d local
#------------------------------------------------------------------------------
-# $File: gnu,v 1.22 2020/04/09 19:11:58 christos Exp $
+# $File: gnu,v 1.23 2021/02/23 00:51:10 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
#>20 ulelong x \b, %u hash
#>20 ulelong >1 \bes
#>24 ulelong x at 0x%x
-# for revsion x.0 offset of table with originals is 1Ch if directly after header
+# for revision x.0 offset of table with originals is 1Ch if directly after header
>4 ulelong&0x0000FFff =0
>>12 ulelong !0x1C \b, at 0x%x string table
# but for x.1 table offset i found is 30h. That means directly after bigger header
# 0th string length seems to be always 0
#>(12.l) ulelong x \b, %u chars
#>>&0 ulelong x at 0x%x
-# if 1st string length positiv inspect offset and string
+# if 1st string length positive inspect offset and string
#>(12.l+8) ulelong >0 \b, %u chars
#>>&0 ulelong x at 0x%x
-# if 2nd string length positiv inspect offset and string
+# if 2nd string length positive inspect offset and string
# >(12.l+16) ulelong >0 \b, %u chars
# >>&0 ulelong x at 0x%x
# skip newline byte
#------------------------------------------------------------------------------
-# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
+# $File: gpt,v 1.5 2020/12/12 20:01:47 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
# This is kept separate, so that MBR partitions are not reported as well.
# (use -k if you do want them as well)
-# First, detect the MBR partiton table
+# First, detect the MBR partition table
# If more than one GPT protective MBR partition exists, don't print anything
# (the other MBR detection code will then just print the MBR partition table)
0x1FE leshort 0xAA55
#------------------------------------------------------------------------------
-# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $
+# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
>18 ubeshort&0x8E80 0
# use big endian variant of subroutine to display name+variables+flags
-# for common object formated files
+# for common object formatted files
>>0 use \^display-coff
!:strength -10
# test for unused flag bits in f_flags
>18 uleshort&0x8E80 0
# use little endian variant of subroutine to
-# display name+variables+flags for common object formated files
+# display name+variables+flags for common object formatted files
>>0 use display-coff
!:strength -10
#------------------------------------------------------------------------------
-# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
+# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %d
+
+# NETDATA (https://en.wikipedia.org/wiki/NETDATA)
+# -\INMR01 In EBCDIC
+0 string \x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1 IBM NETDATA file
#------------------------------------------------------------------------------
-# $File: iff,v 1.13 2011/09/06 11:00:06 christos Exp $
+# $File: iff,v 1.17 2021/02/23 01:07:32 christos Exp $
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
>8 string ANIM \b, ANIM animation
>8 string YAFA \b, YAFA animation
>8 string SSA\ \b, SSA super smooth animation
+>8 string FANT \b, Fantavision animation
>8 string ACBM \b, ACBM continuous image
>8 string FAXX \b, FAXX fax image
+>8 string STFX \b, ST-Fax image
# other formats
>8 string FTXT \b, FTXT formatted text
>8 string CTLG \b, CTLG message catalog
>8 string PTCH \b, PTCH binary patch
>8 string AMFF \b, AMFF AmigaMetaFile format
>8 string WZRD \b, WZRD StormWIZARD resource
->8 string DOC\ \b, DOC desktop publishing document
+>8 string DOC\040 \b, DOC desktop publishing document
+>8 string SWRT \b, SWRT Final Copy/Writer document
+>8 string WORD \b, ProWrite document
+>8 string WTXT \b, WTXT Wordworth document
+>8 string WOWO \b, WOWO Wordworth document
>8 string WVQA \b, Westwood Studios VQA Multimedia,
>>24 leshort x %d video frames,
>>26 leshort x %d x
#------------------------------------------------------------------------------
-# $File: images,v 1.181 2020/05/30 23:49:03 christos Exp $
+# $File: images,v 1.194 2021/02/09 22:59:38 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
# Conflict with MPEG sequences.
!:strength -40
# Prevent conflicts with CRI ADX.
->(2.S-2) belong !0x28632943
+#>(2.S-2) belong !0x28632943
+# above line does not work for rgb32_top_left_rle.tga
+# skip some MPEG sequence *.vob and some CRI ADX audio with improbable interleave bits
+>17 ubyte&0xC0 !0xC0
# skip more garbage like *.iso by looking for positive image type
>>2 ubyte >0
# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
>>>2 ubyte <34
+# skip some MPEG sequence *.vob HV001T01.EVO winnicki.mpg with unacceptable alpha channel depth 11
+>>>>17 ubyte&0x0F !11
# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
->>>>16 ubyte 1
->>>>>0 use tga-image
->>>>16 ubyte 8
->>>>>0 use tga-image
->>>>16 ubyte 15
->>>>>0 use tga-image
->>>>16 ubyte 16
->>>>>0 use tga-image
->>>>16 ubyte 24
->>>>>0 use tga-image
->>>>16 ubyte 32
->>>>>0 use tga-image
+>>>>>16 ubyte 1
+>>>>>>0 use tga-image
+>>>>>16 ubyte 8
+>>>>>>0 use tga-image
+>>>>>16 ubyte 15
+>>>>>>0 use tga-image
+>>>>>16 ubyte 16
+>>>>>>0 use tga-image
+>>>>>16 ubyte 24
+>>>>>>0 use tga-image
+>>>>>16 ubyte 32
+>>>>>>0 use tga-image
# display tga bitmap image information
0 name tga-image
>2 ubyte <34 Targa image data
# Y origin of image. 0 normal; positive for top
>10 uleshort >0 +%d
# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
+# alpha depth like: 1 8
>17 ubyte&0x0F >0 - %d-bit alpha
# bits 5-4 give direction. normal bottom left
>17 ubyte &0x20 - top
## EndOfTGA
# PBMPLUS images
+# URL: https://en.wikipedia.org/wiki/Netpbm
# The next byte following the magic is always whitespace.
-# strength is changed to try these patterns before "x86 boot sector"
+# adding 65 to strength so that Netpbm images comes before "x86 boot sector" or
+# "DOS/MBR boot sector" identified by ./filesystems is probably not needed
+# because files are different
0 name netpbm
>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data
>>&0 regex =[0-9]{1,50} \b, size = %s x
>>>&0 regex =[0-9]{1,50} \b %s
0 search/1 P1
->0 regex/4 P1[\040\t\f\r\n]
->>0 use netpbm
->>0 string x \b, bitmap
-!:strength + 65
+# test for whitespace after 2 byte magic
+>2 regex/2 [\040\t\f\r\n]
+# skip DROID x-fmt-164-signature-id-583.pbm with ten 0 digits
+>>3 string !000000000
+>>>0 use netpbm
+>>>0 string x \b, bitmap
+#!:strength + 65
!:mime image/x-portable-bitmap
+!:ext pbm
+# check for character # starting a comment line
+>>>3 ubyte =0x23
+>>>>4 string x %s
0 search/1 P2
>0 regex/4 P2[\040\t\f\r\n]
>>0 use netpbm
>>0 string x \b, greymap
-!:strength + 65
-!:mime image/x-portable-greymap
+#!:strength + 65
+# american spelling gray
+!:mime image/x-portable-graymap
+!:ext pgm
0 search/1 P3
>0 regex/4 P3[\040\t\f\r\n]
>>0 use netpbm
>>0 string x \b, pixmap
-!:strength + 65
+#!:strength + 65
!:mime image/x-portable-pixmap
+!:ext ppm
0 string P4
>0 regex/4 P4[\040\t\f\r\n]
>>0 use netpbm
>>0 string x \b, rawbits, bitmap
-!:strength + 65
+#!:strength + 65
!:mime image/x-portable-bitmap
+!:ext pbm
0 string P5
>0 regex/4 P5[\040\t\f\r\n]
>>0 use netpbm
>>0 string x \b, rawbits, greymap
-!:strength + 65
+#!:strength + 65
!:mime image/x-portable-greymap
+!:ext pgm
0 string P6
>0 regex/4 P6[\040\t\f\r\n]
>>0 use netpbm
>>0 string x \b, rawbits, pixmap
-!:strength + 65
+#!:strength + 65
!:mime image/x-portable-pixmap
+!:ext ppm/pnm
-0 string P7 Netpbm PAM image file
-!:mime image/x-portable-pixmap
+# URL: https://en.wikipedia.org/wiki/Netpbm#PAM_graphics_format
+# Reference: http://fileformats.archiveteam.org/wiki/Portable_Arbitrary_Map
+# Update: Joerg Jenderek
+0 string P7
+# skip DROID fmt-405-signature-id-589.pam by looking for character like New Line
+>2 ubyte !0xAB
+#>2 ubyte =0x0A
+>>3 search/256/b WIDTH Netpbm PAM image file, size =
+!:mime image/x-portable-arbitrarymap
+!:ext pam
+>>>&1 string x %s
+>>>3 search/256/b HEIGHT x
+>>>>&1 string x %s
+# at offset 2 a New Line character (0xA) should appear
+>>>2 ubyte !0x0A \b, 0x%x at offset 2 instead new line
# From: bryanh@giraffe-data.com (Bryan Henderson)
0 string \117\072 Solitaire Image Recorder format
>10 byte x \b, version %d.
>11 byte x \b%d
+# Fujifilm RAF RAW image files with embedded JPEG data and compressed
+# or uncompressed CFA RAW data. Byte order: Big Endian.
+# URL: https://libopenraw.freedesktop.org/formats/raf/
+0 string FUJIFILMCCD-RAW Fujifilm RAF raw image data
+!:mime image/x-fuji-raf
+
# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed. The TIFF specification recommends testing for it.
0 string MM\x00\x2a TIFF image data, big-endian
!:strength +70
!:mime image/tiff
+!:ext tif,tiff
>(4.L) use \^tiff_ifd
0 string II\x2a\x00 TIFF image data, little-endian
!:mime image/tiff
!:strength +70
+!:ext tif,tiff
>(4.l) use tiff_ifd
0 name tiff_ifd
!:strength +80
!:mime image/gif
!:apple 8BIMGIFf
+!:ext gif
>4 string 7a \b, version 8%s,
>4 string 9a \b, version 8%s,
>6 leshort >0 %d x
0 leshort 40
# skip bad samples like GAME by looking for valid number of color planes
>12 uleshort 1 Device independent bitmap graphic
-!:mime image/bmp
+!:mime image/x-ms-bmp
!:apple ????BMPp
!:ext dib
>>4 lelong x \b, %d x
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 64 PC bitmap, OS/2 2.x format
-!:mime image/bmp
+!:mime image/x-ms-bmp
!:apple ????BMPp
!:ext bmp
# image width and height fields are unsigned integers for OS/2
#>>(10.l) ubequad !0 \b, bits 0x%16.16llx
# BITMAPV2INFOHEADER adds RGB bit masks
>14 leshort 52 PC bitmap, Adobe Photoshop
-!:mime image/bmp
+!:mime image/x-ms-bmp
!:apple ????BMPp
!:ext bmp
>>18 lelong x \b, %d x
>>28 leshort x %d
# BITMAPV3INFOHEADER adds alpha channel bit mask
>14 leshort 56 PC bitmap, Adobe Photoshop with alpha channel mask
-!:mime image/bmp
+!:mime image/x-ms-bmp
!:apple ????BMPp
!:ext bmp
>>18 lelong x \b, %d x
>>28 leshort x %d
>14 leshort 40
# jump 4 bytes before end of file/header to skip fmt-116-signature-id-118.dib
->>(2.l-4) ulong x PC bitmap, Windows 3.x format
-!:mime image/bmp
+# broken for large bitmaps
+#>>(2.l-4) ulong x PC bitmap, Windows 3.x format
+>>14 leshort 40 PC bitmap, Windows 3.x format
+!:mime image/x-ms-bmp
!:apple ????BMPp
>>>18 lelong x \b, %d x
>>>22 lelong x %d
# URL: http://fileformats.archiveteam.org/wiki/OS/2_Pointer
# Reference: http://www.fileformat.info/format/os2bmp/egff.htm
0 string CP
+# skip many Corel Photo-Paint image "CPT9FILE" by checking for positive bits offset
+>10 ulelong >0
# skip CPU-Z Report by checking for valid dib header sizes 12 or 64
->14 ulelong <65 OS/2
+>>14 ulelong =12
+>>>0 use os2-ptr
+>>14 ulelong =64
+>>>0 use os2-ptr
+# display information of OS/2 pointer bitmaps
+0 name os2-ptr
+>14 ulelong x OS/2
# http://extension.nirsoft.net/PTR
!:mime image/x-ibm-pointer
!:ext ptr
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string 8BPS Adobe Photoshop Image
!:mime image/vnd.adobe.photoshop
+!:ext psd
>4 beshort 2 (PSB)
>18 belong x \b, %d x
>14 belong x %d,
>12 beshort > 1 \bs
# XV thumbnail indicator (ThMO)
+# URL: https://en.wikipedia.org/wiki/Xv_(software)
+# Reference: http://fileformats.archiveteam.org/wiki/XV_thumbnail
+# Update: Joerg Jenderek
0 string P7\ 332 XV thumbnail image data
+#0 string P7\ 332 XV "thumbnail file" (icon) data
+!:mime image/x-xv-thumbnail
+# thumbnail .xvpic/foo.bar for graphic foo.bar
+!:ext p7/gif/tif/xpm/jpg
# NITF is defined by United States MIL-STD-2500A
0 string NITF National Imagery Transmission Format
0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
-# "thumbnail file" (icon)
-# descended from "xv", but in use by other applications as well (Wolfram Kleff)
-0 string P7\ 332 XV "thumbnail file" (icon) data
-
# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
0 string KiSS KISS/GS
>4 byte 16 color
# http://www.xara.com/ for Windows and as GPL application for Linux
0 string XARA\243\243 Xara graphics file
+# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery
+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bmf-corel.trid.xml
+# Note: called "Corel Binary Material Format" by TrID and
+# "Corel Flow" by XnView
+0 string @CorelBMF\n\rCorel\040Corporation Corel GALLERY Clipart
+!:mime image/x-corel-bmf
+!:ext bmf
+
# https://www.cartesianinc.com/Tech/
+# Reference: http://fileformats.archiveteam.org/wiki/Cartesian_Perceptual_Compression
0 string CPC\262 Cartesian Perceptual Compression image
!:mime image/x-cpi
+!:ext cpi/cpc
# From Albert Cahalan <acahalan@gmail.com>
# puredigital used it for the CVS disposable camcorder
# Supercompression enum.
0 name khronos-ktx2-supercompression
->0 lelong 1 Basis Universal
+>0 lelong 1 BasisLZ
>0 lelong 2 Zstandard
+>0 lelong 3 ZLIB
# Vulkan format identifier.
# NOTE: Formats prohibited from KTX2 are commented out.
>4 byte 0 Apple QuickTake 150 Raw Image
>4 byte >0 Apple QuickTake 200 Raw Image
>0 use quicktake
+
+# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/Corel_Photo-Paint_image
+# Reference: http://blog.argasinski.eu/wp-content/uploads/2011/08/cpt-specification-0.01.pdf
+0 string CPT
+>4 string FILE Corel Photo-Paint image, version
+# version like 7, 9 or 8
+>>3 ubyte x %c,
+!:mime image/x-corel-cpt
+!:ext cpt
+# if blocks_array_offset available jump blockNumber*8 bytes
+>>0x34 ulelong >0
+>>>(0x28.l*8) ubyte x
+# jump additional stored blocks_array_offset bytes forward to object block
+>>>>&(0x34.l-1) ulelong x %u
+# object height in pixels
+>>>>>&0 ulelong x x %u
+# if no blocks_array_offset available jump blockNumber*8 bytes
+>>0x34 ulelong =0
+>>>(0x28.l*8) ubyte x
+# jump additional 0x13C bytes forward to object block
+>>>>&0x13B ulelong x %u
+>>>>>&0 ulelong x x %u
+# image color model used
+>>0x8 ulelong x
+>>>0x8 ulelong 0x1 RGB 24 bits
+>>>0x8 ulelong 0x3 CMYK 24 bits
+>>>0x8 ulelong 0x5 greyscale 8 bits
+>>>0x8 ulelong 0x6 black and white 1 bit
+>>>0x8 ulelong 0xA RGB 8 bits
+# palette_length number of colors * 3 in case of 8-bit RGB paletted image
+# 0 otherwise. Allowed values: 0 or [1..256] * 3
+#>>0xC ulelong >0 \b, palette length %u
+>>>>0xC ulelong/3 <256 \b, %u colors
+>>>0x8 ulelong 0xB LAB
+>>>0x8 ulelong 0xC RGB 48 bits
+>>>0x8 ulelong 0xE greyscale 16 bits
+# this should not happen
+>>>0x8 default x color model
+>>>>0x8 ulelong x 0x%x
+# bit 1 in CPT file flags: UCS-2 file comment present
+>>0x31 ubyte &0x02
+# look for comment marker
+>>>0x100 search/0xc9d \4\2\0\0
+# UCS-2 file comment
+>>>>&0 lestring16 x "%s"
+# if no UCS-2 is present show ANSI file comment[112] if available
+>>0x31 ubyte&0x02 =0
+>>>0x3C string >\0 "%-.112s"
+# reserved seems to be always 0
+#>>0x10 ulelong >0 \b, reserved1 %u
+# horizontal real dpi = dpi_h * 25.4 / 10**6
+>>0x18 ulelong x \b, %u micro dots/mm
+# image vertical DPI in CPT DPI unit
+#>>0x1C ulelong x \b, %u micro dots/mm
+# reserved seems to be always 0
+#>>0x20 ulelong >0 \b, reserved2 %u
+#>>0x24 ulelong >0 \b, reserved3 %u
+# blocks_count; number of CPT_Block blocks. Allowed values: > 0
+>>0x28 ulelong x \b, %u block
+# plural s
+>>0x28 ulelong !1 \bs
+# CPT file flags
+# lower byte of CPT file flags: 0x94~CPT9FILE 0x01~often CPT7FILE 0x8C~CPT8FILE
+#>>0x30 ubyte x \b, lower flags 0x%x
+# upper byte of CPT file flags:
+#>>0x31 ubyte >0 \b, upper flags 0x%x
+# bit 2 in CPT file flags: unknown
+#>>0x31 ubyte &0x04 \b, with UNKNOWN
+# bits 3-7 in CPT file flags: unknown, seem to be often 0
+# show unusual flag combinations
+>>0x31 ubyte&0xFC >0
+>>>0x30 uleshort x \b, flags 0x%4.4x
+# reserved seems to be always 0
+#>>0x32 uleshort >0 \b, reserved4 0x%x
+# blocks_array_offset is always 0 for CPT7 and CPT8 files created by PP7-PP8
+# typical values like: 13Ch 154h 43Ch 4F0h DA8h
+>>0x34 ulelong x \b, array offset 0x%x
+# reserved seems to be often 0
+>>0x38 ulelong >0 \b, reserved5 0x%x
+# possible next master block
+#>>0x100 ubequad !0 \b, next block=0x%llx...
+# bit 0: ICC profile block present
+>>0x31 ubyte &0x01 \b, with ICC profile
+# check for characteristic string acsp of color profile for DEBUGGING
+#>>>0x178 string x icc=%.4s
+# display ICC/ICM color profile by ./icc
+#>>>0x154 use color-profile
+
+# Type: Crunch compressed texture.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - https://github.com/BinomialLLC/crunch/blob/44c8402e24441c7524ca364941fd224ab3b971e9/inc/crn_decomp.h#L267
+0 ubelong 0x4878004A Crunch compressed texture:
+>0x0C ubeshort x %u x
+>0x0E ubeshort x %u
+>0x12 ubyte 0 \b, DXT1
+>0x12 ubyte 1 \b, DXT3
+>0x12 ubyte 2 \b, DXT5
+>0x12 ubyte 3 \b, DXT5 CCxY
+>0x12 ubyte 4 \b, DXT5 xGxR
+>0x12 ubyte 5 \b, DXT5 xGBR
+>0x12 ubyte 6 \b, DXT5 AGBR
+>0x12 ubyte 7 \b, DXn XY
+>0x12 ubyte 8 \b, DXn YX
+>0x12 ubyte 9 \b, DXT5 Alpha
+>0x12 ubyte 10 \b, ETC1
+>0x10 ubyte >1 \b, %u images
+>0x11 ubyte >1 \b, %u faces
+# TODO: Flags at 0x13? (ubeshort)
+
+# Type: BasisLZ compressed texture.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - https://github.com/BinomialLLC/basis_universal/blob/master/spec/basis_spec.txt
+0 uleshort 0x4273
+>0x04 uleshort 0x4D BasisLZ
+>>0x02 uleshort x v%x compressed texture:
+>>0x14 ubyte 0 ETC1S
+>>0x14 ubyte 1 UASTC 4x4
+>>0x0E ulelong&0xFFFFFF >1 \b, %u slices
+>>0x11 ulelong&0xFFFFFF >1 \b, %u images
+>>0x15 uleshort&0x02 2 \b, Y-flipped
+
+# MIME registration: https://www.iana.org/assignments/media-types/model/e57
+# Sample files: http://www.libe57.org/data.html
+# Reference implementation: http://www.libe57.org/
+# https://www.ri.cmu.edu/pub_files/2011/1/2011-huber-e57-v3.pdf
+0 string ASTM-E57 ASTM E57 three-dimensional model
+!:mime model/e57
+!:ext e57
#------------------------------------------------------------------------------
-# $File: intel,v 1.18 2020/04/18 16:19:03 christos Exp $
+# $File: intel,v 1.19 2020/12/12 20:01:47 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514
-# use subroutine to display name+flags+variables for common object formated files
+# use subroutine to display name+flags+variables for common object formatted files
>0 use display-coff
#>12 lelong >0 not stripped
# no hint found, that at offset 22 is version
#------------------------------------------------------------------------------
-# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $
+# $File: jpeg,v 1.33 2021/03/21 15:04:50 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
>>4 lelong%2 0 JPEG-XR
!:mime image/jxr
!:ext jxr
+
+# JPEG XL
+# From: Ian Tester
+0 string \xff\x0a JPEG XL codestream
+!:mime image/jxl
+!:ext jxl
+
+# JPEG XL (transcoded JPEG file)
+0 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container
+!:mime image/jxl
+!:ext jxl
--- /dev/null
+#------------------------------------------------------------------------------
+# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $
+#
+
+# Magic file patterns for use with file(1) for the
+# LAMMPS molecular dynamics simulation software.
+# https://lammps.sandia.gov
+#
+# Updated: 2021-03-14 by akohlmey@gmail.com
+
+# Binary restart file for the LAMMPS MD code
+0 string LammpS\ RestartT LAMMPS binary restart file
+>0x14 long x (rev %d),
+>>0x20 string x Version %s,
+>>>0x10 lelong 0x0001 Little Endian
+>>>0x10 lelong 0x1000 Big Endian
+
+# Atom style binary dump file for the LAMMPS MD code
+# written on a little endian machine
+0 lequad -8
+>0x08 string DUMPATOM LAMMPS atom style binary dump
+>>0x14 long x (rev %d),
+>>>0x10 lelong 0x0001 Little Endian,
+>>>>0x18 lequad x First time step: %lld
+
+# written on a big endian machine
+0 bequad -8
+>0x08 string DUMPATOM LAMMPS atom style binary dump
+>>0x14 belong x (rev %d),
+>>>0x10 lelong 0x1000 Big Endian,
+>>>>0x18 bequad x First time step: %lld
+
+# Atom style binary dump file for the LAMMPS MD code
+# written on a little endian machine
+0 lequad -10
+>0x08 string DUMPCUSTOM LAMMPS custom style binary dump
+>>0x16 lelong x (rev %d),
+>>>0x12 lelong 0x0001 Little Endian,
+>>>>0x1a lequad x First time step: %lld
+
+# written on a big endian machine
+0 bequad -10
+>0x08 string DUMPCUSTOM LAMMPS custom style binary dump
+>>0x16 belong x (rev %d),
+>>>0x12 lelong 0x1000 Big Endian,
+>>>>0x1a bequad x First time step: %lld
+
+# LAMMPS log file
+0 string LAMMPS\ ( LAMMPS log file
+>8 regex/16 [0-9]+\ [A-Za-z]+\ [0-9]+ written by version %s
+
+# Data file written either by LAMMPS, msi2lmp or VMD/TopoTools
+0 string LAMMPS\ data\ file LAMMPS data file
+>0x12 string CGCMM\ style written by TopoTools
+>0x12 string msi2lmp written by msi2lmp
+>0x11 string via\ write_data written by LAMMPS
+
+# LAMMPS data file written by OVITO
+0 string #\ LAMMPS\ data\ file LAMMPS data file
+>0x13 string written\ by\ OVITO written by OVITO
+
+# LAMMPS text mode dump file
+0 string ITEM:\ TIMESTEP LAMMPS text mode dump,
+>15 regex/16 [0-9]+ First time step: %s
#------------------------------------------------------------------------------
-# $File$
+# $File: lif,v 1.9 2021/02/26 03:13:48 christos Exp $
# lif: file(1) magic for lif
#
# (Daniel Quinlan <quinlan@yggdrasil.com>)
#
-0 beshort 0x8000 lif file
+# Modified by: Joerg Jenderek
+# URL: https://www.hp9845.net/9845/projects/hpdir/
+# https://github.com/bug400/lifutils
+# Reference: https://www.hp9845.net/9845/downloads/manuals/LIF_excerpt_64941-90906_flpRef_Jan84.pdf
+# Note: called by TrID "HP Logical Interchange Format disk image"
+0 beshort 0x8000
+# GRR: line above is too general as it catches also compressed DEGAS low-res bitmap *.pc1
+# skip many compressed DEGAS low-res bitmap *.pc1 by test for unused bytes
+>14 beshort =0
+# skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number
+>>20 ubeshort <0x0100
+# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name
+#>>>2 ubelong >0x2020201F
+>>>0 use lif-file
+0 name lif-file
+# LIF ID
+>0 beshort x lif file
+!:mime application/x-lif-disk
+# lif used by Tony Duell LIF utilities; enhanced version by Joachim Siebold use also dat; hpi used by hpdir
+!:ext lif/hpi/dat
+# volume label; A-Z 0-9 _ ; default are 6 spaces
+>2 string x "%.6s"
+# version number; 0 for systems without extensions or 1 for model 64000
+>20 ubeshort x \b, version %u
+# LIF identifier; 010000 for system 3000
+>12 beshort !0x1000 \b, LIF identifier 0x%x
+# directory start address in units like: 2
+>8 ubelong x \b, directory
+>8 ubelong !2 start address %u
+# length of directory like: 2 4 7 10 12 14 (for model 64000) 16 18 20 24 30 50 57 77 80
+>16 ubelong x length %u
+# level 1 extensions
+>20 beshort =0
+>>24 ubequad !0 \b, for extensions 0x%llx...
+>20 beshort >0
+>>24 ubequad !0 \b, extensions 0x%llx...
+# word 21-126 reserved for extensions and future use; set to nil
+>42 ubequad !0 \b, RESERVED 0x%llx
+# lif first file name for standard directory; 0xffff... means uninitialized
+>8 ubelong 2
+>>512 string <\xff\xff \b, 1st file %-.10s
+
#------------------------------------------------------------------------------
-# $File: linux,v 1.72 2020/06/07 21:56:13 christos Exp $
+# $File: linux,v 1.77 2021/02/24 23:05:02 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# From: Kevin Cernekee <cernekee@gmail.com>
# Update: Joerg Jenderek
0x24 lelong 0x016f2818 Linux kernel ARM boot executable zImage
-# There are three posible situations: LE, BE with LE bootloader and pure BE.
+# There are three possible situations: LE, BE with LE bootloader and pure BE.
# In order to aid telling these apart a new endian flag was added. In order
# to support kernels before the flag and BE with LE bootloader was added we'll
# do a negative check against the BE variant of the flag when we see a LE magic.
>0x30 belong !0x04030201 (little-endian)
->0x30 belong 0x04030201 (big-endian)
# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
!:ext img/bin
+>0x30 belong 0x04030201 (big-endian)
0x24 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
############################################################################
# Documentation/devicetree/booting-without-of.txt
# From Christoph Biedl
0 belong 0xd00dfeed
-# structure and strings must be within blob
+# structure must be within blob, strings are omitted to handle devicetrees > 1M
>&(8.L) byte x
->>&(12.L) byte x
->>>20 belong >1 Device Tree Blob version %d
->>>>4 belong x \b, size=%d
->>>>20 belong >1
->>>>>28 belong x \b, boot CPU=%d
->>>>20 belong >2
->>>>>32 belong x \b, string block size=%d
->>>>20 belong >16
->>>>>36 belong x \b, DT structure block size=%d
+>>20 belong >1 Device Tree Blob version %d
+>>>4 belong x \b, size=%d
+>>>20 belong >1
+>>>>28 belong x \b, boot CPU=%d
+>>>20 belong >2
+>>>>32 belong x \b, string block size=%d
+>>>20 belong >16
+>>>>36 belong x \b, DT structure block size=%d
# glibc locale archive as defined in glibc locale/locarchive.h
0 lelong 0xde020109 locale archive
0 search/1024 /dts-v1/ Device Tree File (v1)
# beat c code
!:strength +14
+
+
+# e2fsck undo file
+# David Gilman <davidgilman1@gmail.com>
+0 string E2UNDO02 e2fsck undo file, version 2
+>44 lelong x \b, undo file is
+>>44 lelong&1 0 not finished
+>>44 lelong&1 1 finished
+>48 lelong x \b, undo file features:
+>>48 lelong&1 0 lacks filesystem offset
+>>48 lelong&1 1 has filesystem offset
+>>>64 lequad x at 0x%llx
+
+# ansible vault (does not really belong here)
+0 string $ANSIBLE_VAULT; Ansible Vault
+>&0 regex [0-9]*\.[0-9]* \b, version %s
+>>&0 string ;
+>>>&0 regex [A-Z0-9]* \b, encryption %s
#------------------------------------------------------------------------------
-# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $
+# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
!:apple EMAxTEXT
!:ext elc
+# Files produced by GNU/Emacs pdumper
+0 string DUMPEDGNUEMACS GNU/Emacs pdumper image
+
# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27)
0 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: locoscript,v 1.1 2021/01/03 20:56:25 christos Exp $
+# locoscript: file(1) magic for LocoScript documents and related files
+#
+# See http://fileformats.archiveteam.org/wiki/LocoScript
+0 string JOY\x01\x01 LocoScript 1 document
+0 string JOY\x01\x02 LocoScript 2 document
+0 string JOY\x01\x04 LocoScript 3 document
+0 string JOY\x01\x06 LocoScript 4 document
+0 string DOC\x01\x01 LocoScript PC document
+0 string DOC\x01\x03 LocoScript Professional document
#------------------------------------------------------------------------------
-# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $
+# $File: lua,v 1.8 2020/10/08 23:23:56 christos Exp $
# lua: file(1) magic for Lua scripting language
# URL: https://www.lua.org/
# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
# Lua bytecode
0 string \033Lua Lua bytecode,
+# 2.4 uses 0x23 as its version byte because it shares the format
+# with 2.3 (which was never released publicly).
+>4 byte 0x23 version 2.4
+>4 byte 0x25 version 2.5/3.0
+>4 byte 0x31 version 3.1
+>4 byte 0x32 version 3.2
+>4 byte 0x40 version 4.0
>4 byte 0x50 version 5.0
>4 byte 0x51 version 5.1
>4 byte 0x52 version 5.2
+>4 byte 0x53 version 5.3
+>4 byte 0x54 version 5.4
#------------------------------------------------------------
-# $File: mach,v 1.22 2015/10/15 16:54:01 christos Exp $
+# $File: mach,v 1.28 2020/12/12 20:01:47 christos Exp $
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file "cafebabe".
# it's also separate from the "64-bit libraries" bit in the
# upper 8 bits of the CPU subtype
+# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
+# include/mach-o/loader.h
+# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
0 name mach-o-cpu
->0 belong&0x01000000 0
+>0 belong&0xff000000 0
#
# 32-bit ABIs.
#
>>>4 belong&0x00ffffff 6 \b_604
>>>4 belong&0x00ffffff 7 \b_604e
>>>4 belong&0x00ffffff 8 \b_620
->>>4 belong&0x00ffffff 9 \b_650
+>>>4 belong&0x00ffffff 9 \b_750
>>>4 belong&0x00ffffff 10 \b_7400
>>>4 belong&0x00ffffff 11 \b_7450
>>>4 belong&0x00ffffff 100 \b_970
>>>4 belong&0x00ffffff >100 subarchitecture=%d
>>0 belong&0x00ffffff >18 architecture=%d
->0 belong&0x01000000 0x01000000
+>0 belong&0xff000000 0x01000000
#
# 64-bit ABIs.
#
>>0 belong&0x00ffffff 12 arm64
>>>4 belong&0x00ffffff 0
>>>4 belong&0x00ffffff 1 \bv8
+>>>4 belong&0x00ffffff 2 \be
+>>>>7 ubyte&0xff >0 (caps:
+>>>>7 ubyte&0xff <0x80 0x%02x
+>>>>7 ubyte&0xc0 0x80 PAC
+>>>>>7 ubyte&0x3f x \b%02d
+>>>>7 ubyte&0xc0 0xc0 PAK
+>>>>>7 ubyte&0x3f x \b%02d
+>>>>7 ubyte&0xff x \b)
+>>>4 belong&0x00ffffff >2 subarchitecture=%d
>>0 belong&0x00ffffff 13 64-bit architecture=%d
>>0 belong&0x00ffffff 14 64-bit architecture=%d
>>0 belong&0x00ffffff 15 64-bit architecture=%d
>>>4 belong&0x00ffffff 100 \b_970
>>>4 belong&0x00ffffff >100 subarchitecture=%d
>>0 belong&0x00ffffff >18 64-bit architecture=%d
-
+>0 belong&0xff000000 0x02000000
+#
+# 64_32-bit ABIs.
+#
+>>0 belong&0x00ffffff 0 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 1 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 2 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 3 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 4 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 5 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 6 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 7 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 8 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 9 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 10 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 11 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 12 64_32-bit arm
+>>>4 belong&0x00ffffff 0
+>>>4 belong&0x00ffffff 1 \bv8
+>>>4 belong&0x00ffffff >1 subarchitecture=%d
+>>0 belong&0x00ffffff 13 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 14 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 15 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 16 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 17 64_32-bit architecture=%d
+>>0 belong&0x00ffffff 18 64_32-bit architecture=%d
+>>0 belong&0x00ffffff >18 64_32-bit architecture=%d
0 name mach-o-be
>0 byte 0xcf 64-bit
>4 use mach-o-cpu
>12 belong 1 object
+# GRR: Does not work for Mach-O with 2 architectures; instead display oo
+#!:ext o
+!:ext o/
>12 belong 2 executable
+# the executables normally have no file extension like perl,
+# but exceptions like perl5.18 perl5.16
+!:ext 16/18/
>12 belong 3 fixed virtual memory shared library
>12 belong 4 core
>12 belong 5 preload executable
>12 belong 6 dynamically linked shared library
+# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib
+#!:ext dylib
+!:ext dylib/
>12 belong 7 dynamic linker
>12 belong 8 bundle
+# normally name extension bundle; but exceptions like: AMDil_r700.dylib
+!:ext bundle/dylib/
>12 belong 9 dynamically linked shared library stub
>12 belong 10 dSYM companion file
>12 belong 11 kext bundle
>12 belong >11
>>12 belong x filetype=%d
>24 belong >0 \b, flags:<
->>24 belong &0x0000001 \bNOUNDEFS
->>24 belong &0x0000002 \b|INCRLINK
->>24 belong &0x0000004 \b|DYLDLINK
->>24 belong &0x0000008 \b|BINDATLOAD
->>24 belong &0x0000010 \b|PREBOUND
->>24 belong &0x0000020 \b|SPLIT_SEGS
->>24 belong &0x0000040 \b|LAZY_INIT
->>24 belong &0x0000080 \b|TWOLEVEL
->>24 belong &0x0000100 \b|FORCE_FLAT
->>24 belong &0x0000200 \b|NOMULTIDEFS
->>24 belong &0x0000400 \b|NOFIXPREBINDING
->>24 belong &0x0000800 \b|PREBINDABLE
->>24 belong &0x0001000 \b|ALLMODSBOUND
->>24 belong &0x0002000 \b|SUBSECTIONS_VIA_SYMBOLS
->>24 belong &0x0004000 \b|CANONICAL
->>24 belong &0x0008000 \b|WEAK_DEFINES
->>24 belong &0x0010000 \b|BINDS_TO_WEAK
->>24 belong &0x0020000 \b|ALLOW_STACK_EXECUTION
->>24 belong &0x0040000 \b|ROOT_SAFE
->>24 belong &0x0080000 \b|SETUID_SAFE
->>24 belong &0x0100000 \b|NO_REEXPORTED_DYLIBS
->>24 belong &0x0200000 \b|PIE
->>24 belong &0x0400000 \b|DEAD_STRIPPABLE_DYLIB
->>24 belong &0x0800000 \b|HAS_TLV_DESCRIPTORS
->>24 belong &0x1000000 \b|NO_HEAP_EXECUTION
->>24 belong &0x2000000 \b|APP_EXTENSION_SAFE
+>>24 belong &0x00000001 \bNOUNDEFS
+>>24 belong &0x00000002 \b|INCRLINK
+>>24 belong &0x00000004 \b|DYLDLINK
+>>24 belong &0x00000008 \b|BINDATLOAD
+>>24 belong &0x00000010 \b|PREBOUND
+>>24 belong &0x00000020 \b|SPLIT_SEGS
+>>24 belong &0x00000040 \b|LAZY_INIT
+>>24 belong &0x00000080 \b|TWOLEVEL
+>>24 belong &0x00000100 \b|FORCE_FLAT
+>>24 belong &0x00000200 \b|NOMULTIDEFS
+>>24 belong &0x00000400 \b|NOFIXPREBINDING
+>>24 belong &0x00000800 \b|PREBINDABLE
+>>24 belong &0x00001000 \b|ALLMODSBOUND
+>>24 belong &0x00002000 \b|SUBSECTIONS_VIA_SYMBOLS
+>>24 belong &0x00004000 \b|CANONICAL
+>>24 belong &0x00008000 \b|WEAK_DEFINES
+>>24 belong &0x00010000 \b|BINDS_TO_WEAK
+>>24 belong &0x00020000 \b|ALLOW_STACK_EXECUTION
+>>24 belong &0x00040000 \b|ROOT_SAFE
+>>24 belong &0x00080000 \b|SETUID_SAFE
+>>24 belong &0x00100000 \b|NO_REEXPORTED_DYLIBS
+>>24 belong &0x00200000 \b|PIE
+>>24 belong &0x00400000 \b|DEAD_STRIPPABLE_DYLIB
+>>24 belong &0x00800000 \b|HAS_TLV_DESCRIPTORS
+>>24 belong &0x01000000 \b|NO_HEAP_EXECUTION
+>>24 belong &0x02000000 \b|APP_EXTENSION_SAFE
+>>24 belong &0x04000000 \b|NLIST_OUTOFSYNC_WITH_DYLDINFO
+>>24 belong &0x08000000 \b|SIM_SUPPORT
+>>24 belong &0x80000000 \b|DYLIB_IN_CACHE
>>24 belong x \b>
#
#------------------------------------------------------------------------------
-# $File: macintosh,v 1.30 2019/12/14 20:40:26 christos Exp $
+# $File: macintosh,v 1.31 2020/12/12 20:01:47 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
0 search/2652/b (This\ file\
>&0 use binhex
0 name binhex
-# keep splitted search string format similar like in version 5.37
+# keep split search string format similar like in version 5.37
>0 string must\ be\ converted\ with\ BinHex\ BinHex binary text, version
# http://www.macdisk.com/binhexen.php3
!:apple BNHQTEXT
#------------------------------------------------------------------------------
-# $File: mail.news,v 1.25 2019/06/21 20:06:05 christos Exp $
+# $File: mail.news,v 1.26 2021/03/21 14:37:03 christos Exp $
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
>12 belong =1 version 1, big-endian
>12 lelong =1 version 1, little-endian
>12 belong x version %d, network-endian
+
+# Dovecot mail server, version 2.2 and later.
+# Dovecot mailing list: dovecot@dovecot.org
+# File format spec: https://wiki.dovecot.org/Design/Dcrypt/#File_format
+# From: Stephen Gildea
+0 string CRYPTED\003\007 Dovecot encrypted message
+>9 byte xu \b, dcrypt version %d
#------------------------------------------------------------------------------
-# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
+# $File: mathematica,v 1.11 2021/02/23 00:51:10 christos Exp $
# mathematica: file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
!:ext mb
# .ma
-# multiple possibilites:
+# multiple possibilities:
0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
#>41 string >\0 %s
#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
#>675 string >\0 %s #doesn't work well
-# there may be 'cr' instread of 'nl' in some does this matter?
+# there may be 'cr' instead of 'nl' in some does this matter?
# generic:
0 string (*^\r\r::[\011 Mathematica notebook version 2.x
#------------------------------------------------------------------------------
-# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $
+# $File: measure,v 1.3 2021/03/25 17:30:10 christos Exp $
# measure: file(1) magic for measurement data
# DIY-Thermocam raw data
>>9600 default x (Lepton 2.x),
>>>9600 use diy-thermocam-parser
+# Becker & Hickl Photon Counting (PMS) data file
+# format documentation: https://www.becker-hickl.com/wp-content/uploads/2018/11/opm-pms400-v01.pdf (page 57)
+(0x02.l) string *IDENTIFICATION Becker & Hickl PMS Data File
+>0x12 short x (%d data blocks)
+!:ext sdt
#------------------------------------------------------------------------------
-# $File: mozilla,v 1.10 2019/04/19 00:42:27 christos Exp $
+# $File: mozilla,v 1.11 2020/12/12 20:01:47 christos Exp $
# mozilla: file(1) magic for Mozilla XUL fastload files
# (XUL.mfasl and XPC.mfasl)
# URL: https://www.mozilla.org/
# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/
# dejsonlz4-master\src\dejsonlz4.c
# Note: mostly JSON compressed with a non-standard LZ4 header
-# can be unpacked by dejsonlz4 but not lz4 programm.
+# can be unpacked by dejsonlz4 but not lz4 program.
0 string mozLz40\0 Mozilla lz4 compressed data
!:mime application/x-lz4+json
# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks
#------------------------------------------------------------------------------
-# $File: msdos,v 1.137 2020/03/20 17:20:19 christos Exp $
+# $File: msdos,v 1.145 2021/02/23 00:51:10 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
# Tests for various EXE types.
#
-# Many of the compressed formats were extraced from IDARC 1.23 source code.
+# Many of the compressed formats were extracted from IDARC 1.23 source code.
#
0 string/b MZ
# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
!:mime application/x-dosexec
# Windows and later versions of DOS will allow .EXEs to be named with a .COM
# extension, mostly for compatibility's sake.
-!:ext exe/com
+# URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM
+# Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml
+!:ext exe/com/vlm
# These traditional tests usually work but not always. When test quality support is
# implemented these can be turned on.
#>>0x18 leshort 0x1c (Borland compiler)
>>>&1 string x for DOS, Win or OS/2, emx %s
>>&(&0x42.l-3) byte x
>>>&0x26 string UPX \b, UPX compressed
-# and yet another guess: small .text, and after large .data is unusal, could be 32lite
+# and yet another guess: small .text, and after large .data is unusual, could be 32lite
>>&0x2c search/0xa0 .text
>>>&0x0b lelong <0x2000
>>>>&0 lelong >0x6000 \b, 32lite compressed
0 string \xffKEYB\ \ \ \0\0\0\0
>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
-# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
+# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017,Aug 2020
+# URL: http://fileformats.archiveteam.org/wiki/DOS_device_driver
+# Reference: http://www.delorie.com/djgpp/doc/rbinter/it/46/16.html
# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
0 ulequad&0x07a0ffffffff 0xffffffff
->0 use msdos-driver
+# skip OS/2 INI ./os2
+>4 ubelong !0x14000000
+>>0 use msdos-driver
0 name msdos-driver DOS executable (
#!:mime application/octet-stream
!:mime application/x-dosdriver
# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
-!:ext sys/dev/bin
->40 search/7 UPX! \bUPX compressed
+# and IBM Token-Ring adapter IBMTOK.DOS. Why and when DOS instead SYS is used?
+# PROTMAN.DOS ELNKPL.DOS
+!:ext sys/dev/bin/dos
+# 1 space char after "UPX compressed" to get phrase like "UPX compressed character device"
+>40 search/7 UPX! \bUPX compressed\040
# DOS device driver attributes
>4 uleshort&0x8000 0x0000 \bblock device driver
# character device
>4 uleshort&0x8000 0x8000 \b
->>4 uleshort&0x0008 0x0008 \bclock
+# 1 space char after "clock" to get phrase like "clock character device driver CLOCK$"
+>>4 uleshort&0x0008 0x0008 \bclock\040
# fast video output by int 29h
->>4 uleshort&0x0010 0x0010 \bfast
+# 1 space char after "fast" to get phrase like "fast standard input/output character device driver"
+>>4 uleshort&0x0010 0x0010 \bfast\040
# standard input/output device
->>4 uleshort&0x0003 >0 \bstandard
+# 1 space char after "standard" to get phrase like "standard input/output character device driver"
+>>4 uleshort&0x0003 >0 \bstandard\040
>>>4 uleshort&0x0001 0x0001 \binput
>>>4 uleshort&0x0003 0x0003 \b/
->>>4 uleshort&0x0002 0x0002 \boutput
+# 1 space char after "output" to get phrase like "input/output character device driver"
+>>>4 uleshort&0x0002 0x0002 \boutput\040
>>4 uleshort&0x8000 0x8000 \bcharacter device driver
>0 ubyte x
# upx compressed device driver has garbage instead of real in name field of header
>>40 search/7 UPX!
>>40 default x
# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
->>>12 ubyte >0x2E \b
+# 1 space char before device driver name to get phrase like "device driver PROTMAN$"
+>>>12 ubyte >0x2E \b\040
>>>>10 ubyte >0x20
>>>>>10 ubyte !0x2E
>>>>>>10 ubyte !0x2A \b%c
>4 uleshort&0x8000 0x0000
>>4 uleshort&0x4842 >0 \bsupport
>0 ubyte x \b)
+>0 ulelong !0xffffffff with pointer 0x%x
# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
0 ulequad 0x0513c00000000012
>0 use msdos-driver
>0 use msdos-driver
0 ulequad 0x007f00000000ffff
>0 use msdos-driver
+# https://www.uwe-sieber.de/files/cfg_echo.zip
0 ulequad 0x001600000000ffff
>0 use msdos-driver
# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
>0 use msdos-driver
0 ulequad 0x07bd08c2ffffffff
>0 use msdos-driver
+# 3Com EtherLink 3C501 CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\ELNK.DOS
+0 ulequad 0x027ac0c0ffffffff
+>0 use msdos-driver
+# IBM Streamer CID\SERVER\IBMLS\IBM500D1\DLSNETDR.ZIP\IBMMPC.DOS
+0 ulequad 0x00228880ffffffff
+>0 use msdos-driver
# updated by Joerg Jenderek
# GRR: line below too general as it catches also
# syslinux version (4.x)
# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
>>>1 lelong 0x21CD4CFe \b, relocatable)
-# remaining are DOS COM executables starting with assembler instruction MOV
-# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
-# MS-DOS SYS.COM RESTART.COM
-# SYSLINUX.COM (version 1.40 - 2.13)
-# GFXBOOT.COM (version 3.75)
-# COPYBS.COM POWEROFF.COM INT18.COM
->>1 default x COM executable for DOS
-!:mime application/x-dosexec
-#!:mime application/x-ms-dos-executable
-#!:mime application/x-msdos-program
-!:ext com
-
+# Hajin Jang <hajin_jang@worksmobile.com>:
+# Disable simplest COM signature to prevent false positive on some EUC-KR text files.
+## remaining are DOS COM executables starting with assembler instruction MOV
+## like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
+## MS-DOS SYS.COM RESTART.COM
+## SYSLINUX.COM (version 1.40 - 2.13)
+## GFXBOOT.COM (version 3.75)
+## COPYBS.COM POWEROFF.COM INT18.COM
+#>>1 default x COM executable for DOS
+#!:mime application/x-dosexec
+##!:mime application/x-ms-dos-executable
+##!:mime application/x-msdos-program
+#!:ext com
+
+# URL: https://en.wikipedia.org/wiki/UPX
+# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/
+# src/stub/src/i086-dos16.com.S
+# Update: Joerg Jenderek
+# assembler instructions: cmp sp, offset sp_limit
0 string/b \x81\xfc
+#>2 uleshort x \b, sp_limit=0x%x
+# assembler instructions: jump above +2; int 0x20; mov cx, offset bytes_to_copy
>4 string \x77\x02\xcd\x20\xb9
->>36 string UPX! FREE-DOS executable (COM), UPX compressed
+#>9 uleshort x \b, [bytes_to_copy]=0x%x
+# at different offsets assembler instructions: push di; jump decomp_start_n2b
+>0x1e search/3 \x57\xe9
+#>>&0 uleshort x \b, decomp_start_n2b=0x%x
+# src/stub/src/include/header.S; UPX_MAGIC_LE32
+>>&2 string UPX! FREE-DOS executable (COM), UPX
!:mime application/x-dosexec
+# UPX compressed *.CPI; See ./fonts
+>>>&21 string =FONT compressed DOS code page font
+!:ext cpx
+>>>&21 string !FONT compressed
!:ext com
+# compressed size?
+#>>>&14 uleshort+152 x \b, %u bytes
+# uncompressed len
+>>>&12 uleshort x \b, uncompressed %u bytes
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
!:mime application/x-dosexec
!:ext com
-# added by Joerg Jenderek at Oct 2008
-# GRR search is not working
-#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed
-34 string UPX! FREE-DOS executable (COM), UPX compressed
-!:mime application/x-dosexec
-!:ext com
-35 string UPX! FREE-DOS executable (COM), UPX compressed
-!:mime application/x-dosexec
-!:ext com
# GRR search is not working
#2 search/28 \xcd\x21 COM executable for MS-DOS
#WHICHFAT.cOM
!:strength -1
# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
>7 ubyte 0
-# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
+# skip Windows cursors with image width 256 and keep Lotus with positive opcode
>>6 ubyte >0 Lotus
# !:mime application/x-123
!:mime application/vnd.lotus-1-2-3
>>>>4 uleshort x \b, revision 0x%x
# 2nd record for most worksheets describes cells range
>>>6 use lotus-cells
-# 3nd record for most japan worksheets describes cells range
+# 3rd record for most japan worksheets describes cells range
>>>(8.s+10) use lotus-cells
# check and then display Lotus worksheet cells range
0 name lotus-cells
# PNG header (\x89PNG)
>(12.l) ubelong =0x89504e47
# 1 space char after "with" to get phrase "with PNG image" by magic in ./images
->>&-4 indirect x \b with
+>>&-4 indirect x \b with\040
# DIB image
>(12.l) ubelong !0x89504e47
#>>&-4 use dib-image
0 string NG\0\001
# only value 0x100 found at offset 2
>2 ulelong 0x00000100 Norton Guide
+!:mime application/x-norton-guide
+# often like NORTON.NG but some times like NC.HLP
+!:ext ng/hlp
# Title[40]
>>8 string >\0 "%-.40s"
#>>6 uleshort x \b, MenuCount=%u
>>48 string >\0 \b, %-.66s
>>114 string >\0 %-.66s
+# URL: https://en.wikipedia.org/wiki/Norton_Commander
+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/msg-nc-eng.trid.xml
+# From: Joerg Jenderek
+# Note: Message file is used by executable with same main name.
+# Only tested with version 5.50 (english) and 2.01 (Windows)
+0 string Abort
+# \0 or i
+#>5 ubyte x %x
+# skip ASCII Abort text by looking for error message like in NCVIEW.MSG
+>6 search/7089 Non-DOS\ disk Norton Commander module message
+!:mime application/x-norton-msg
+!:ext msg
+
+# URL: http://www.antonis.de/dos/dos-tuts/mpdostip/html/nwdostip.htm
+# Reference: https://mark0.net/download/triddefs_xml.7z/defs/m/msg-netware-dos.trid.xml
+# From: Joerg Jenderek
+0 string DOS\ Client\ Message\ File: Novell DOS client message
+#!:mime application/octet-stream
+#!:mime application/x-novell-msg
+!:ext msg
+# look for second letter instead space character
+>26 ubyte >0x20
+# digit 1 or often main or program name like: IPXODI.COM TASKID pnwtrap DOSRqstr
+>>25 ubyte !0x20 %c
+>>>26 ubyte !0x20 \b%c
+>>>>27 ubyte !0x20 \b%c
+>>>>>28 ubyte !0x20 \b%c
+>>>>>>29 ubyte !0x20 \b%c
+>>>>>>>30 ubyte !0x20 \b%c
+>>>>>>>>31 ubyte !0x20 \b%c
+>>>>>>>>>32 ubyte !0x20 \b%c
+>>>>>>>>>>33 ubyte !0x20 \b%c
+>>>>>>>>>>>34 ubyte !0x20 \b%c
+>>>>>>>>>>>>35 ubyte !0x20 \b%c
+>>>>>>>>>>>>>36 ubyte !0x20 \b%c
+# followed by string like: 0 v.10 V1.20
+#
+# followed by ,\040Tran\040
+>28 search/14 ,\040Tran\040
+# probably translated version string like: 0 v1.00
+>>&0 string x \b, tran version %s
+# followed by Ctrl-J Ctrl-Z
+>>>&0 ubyte !0xa \b, terminated by 0x%2.2x
+>>>>&0 ubyte x \b%2.2x
+# Ctrl-Z
+>0x65 ubyte !0x1A \b, at 0x65 0x%x
+# one
+>0x66 ubyte !0x01 \b, at 0x66 0x%x
+# URL: https://en.wikipedia.org/wiki/NetWare
+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dat-novell-msg.trid.xml
+# ftp://ftp.iitb.ac.in/LDP/en/NLM-HOWTO/NLM-HOWTO-single.html
+# From: Joerg Jenderek
+0 string Novell\ Message\ Librarian\ Data\ File Novell message librarian data
+#>35 string Version\ 1.00
+#>49 string COPYRIGHT\ (c)\ 1985\ by\ Novell,\ Inc.
+#>83 string \ \ All\ Rights\ Reserved
+#!:mime application/octet-stream
+#!:mime application/x-novell-msg
+!:ext msg
+#!:ext msg/dat
# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of https://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
>>0x2c search/211/c .swf\0 skin
!:ext ims
-# member anim.im3 implies IncrediMail animation like in letter_fold.ima
+# member anim.im3 implies IncrediMail animation like in letter_fold.ima
>>0x2c search/92/c anim.im3\0 animation
!:ext ima
# other IncrediMail cab archive
!:mime application/vnd.ms-cab-compressed
!:ext msu
>>>&-1 default x
-# look at point charcter of 1st archive member name for file name extension
+# look at point character of 1st archive member name for file name extension
>>>>&-1 search/255 .
# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
#>8 ubequad x \b, abReserve 0x%llx
# display member structure CFFILE information like member name of cabinet
0 name cab-file
-# cbFile is uncompressed size of file in bytes
+# cbFile is uncompressed size of file in bytes
#>0 ulelong x \b, cbFile %u
# uoffFolderStart is uncompressed offset of file in folder
#>4 ulelong >0 \b, uoffFolderStart 0x%x
# but sometimes garbage according to Ralf Quint. So can not be used as test
#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
-# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
+# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
>>>>>5 ubyte&0x8C 0x0C
# ./msdos (version 5.30) labeled the entry as
# "DOS 2.0 backed up file %s, split file, sequence %d" or
# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*'
# file: line 1169: Bad magic entry ' *'
# after header original file content
->>>>>>128 indirect x \b;
+>>>>>>128 indirect x \b;\040
# DOS backup 3.3 to 5.x
#------------------------------------------------------------------------------
-# $File: msooxml,v 1.13 2019/11/27 13:12:55 christos Exp $
+# $File: msooxml,v 1.15 2020/09/05 22:59:14 christos Exp $
# msooxml: file(1) magic for Microsoft Office XML
# From: Ralf Brown <ralf.brown@gmail.com>
!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
>0 string xl/ Microsoft Excel 2007+
!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
-0 string visio/ Microsoft Visio 2013+
+>0 string visio/ Microsoft Visio 2013+
!:mime application/vnd.ms-visio.drawing.main+xml
# start by checking for ZIP local file header signature
!:strength +10
# make sure the first file is correct
>0x1E use msooxml
->0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
+>0x1E default x
+>>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps
# skip to the second local file header
# since some documents include a 520-byte extra field following the file
# header, we need to scan for the next header
->>(18.l+49) search/6000 PK\003\004
+>>>(18.l+49) search/6000 PK\003\004
# now skip to the *third* local file header; again, we need to scan due to a
# 520-byte extra field following the file header
->>>&26 search/6000 PK\003\004
+>>>>&26 search/6000 PK\003\004
# and check the subdirectory name to determine which type of OOXML
# file we have. Correct the mimetype with the registered ones:
# https://technet.microsoft.com/en-us/library/cc179224.aspx
->>>>&26 use msooxml
->>>>&26 default x
+>>>>>&26 use msooxml
+>>>>>&26 default x
# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
->>>>>&26 search/6000 PK\003\004
->>>>>>&26 use msooxml
->>>>>>&26 default x Microsoft OOXML
+>>>>>>&26 search/6000 PK\003\004
+>>>>>>>&26 use msooxml
+>>>>>>>&26 default x Microsoft OOXML
>>>>>&26 default x Microsoft OOXML
#------------------------------------------------------------------------------
-# $File$
+# $File: netware,v 1.5 2020/09/04 16:30:51 christos Exp $
# netware: file(1) magic for NetWare Loadable Modules (NLMs)
# From: Mads Martin Joergensen <mmj@suse.de>
+# URL: https://en.wikipedia.org/wiki/NetWare_Loadable_Module
0 string NetWare\ Loadable\ Module NetWare Loadable Module
+#!:mime application/octet-stream
+!:ext nlm
+
#------------------------------------------------------------------------------
-# $File: ole2compounddocs,v 1.8 2020/03/28 23:10:30 christos Exp $
+# $File: ole2compounddocs,v 1.10 2021/02/23 00:51:10 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.
>>>>256 lestring16 Thumbnail : Corel PrintHouse image
!:mime application/x-corel-cph
!:ext cph
+# URL: http://fileformats.archiveteam.org/wiki/Corel_Gallery
+# Note: format since Gallery 2; sometimes called Corel Multimedia Manager Album
+# third directory entry name _INFO_
+>>>>256 lestring16 _INFO_ : Corel Gallery
+# second directory entry name _ITEM_ or _DATA_
+# later directory entry names: _ALBUM_ _THUMBNAIL_
+#!:mime application/x-ole-storage
+!:mime application/x-corel-gal
+!:ext gal
#
# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)
# Note: "HWP Document File" signature found in FileHeader
>>>>128 lestring16 Current\ User : SoftMaker
# third directory entry name SMNativeObjData
>>>>>256 lestring16 SMNativeObjData
-# 5th directory entry nane PowerPoint
+# 5th directory entry name PowerPoint
>>>>>>512 lestring16 PowerPoint PowerPoint presentation or template
!:mime application/vnd.ms-powerpoint
!:ext ppt/pps/pot
>>>>>>128 lestring16 Pictures with pictures
# remaining null clsid
>>>>128 default x : UNKNOWN
+# second directory entry name like VisioDocument Control000
+>>>>>128 lestring16 x with names %.20s
+# third directory entry like WordDocument
+>>>>>256 lestring16 x %.20s
+# forth
+>>>>>384 lestring16 x %.20s
!:mime application/x-ole-storage
# look for known clsid GUID
# - Visio documents
!:mime application/vnd.ms-excel
# https://www.macdisk.com/macsigen.php XLS5 for Excel 5
!:apple ????XLS9
-# 3nd directory entry name
+# 3rd directory entry name
>>>>256 lestring16 _VBA_PROJECT_CUR addin
!:ext xla/
# 4th directory entry name
#------------------------------------------------------------------------------
-# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
+# $File: os2,v 1.11 2020/08/30 16:22:20 christos Exp $
# os2: file(1) magic for OS/2 files
#
#>5 string >\ (Local file) <%s>
# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
+# URL: http://fileformats.archiveteam.org/wiki/INF/HLP_(OS/2)
+# Reference: http://www.edm2.com/0308/inf.html
# Carl Hauser (chauser.parc@xerox.com) and
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
# int16 unknown2; // unknown purpose
#
0 string HSP\x01\x9b\x00 OS/2 INF
+!:mime application/x-os2-inf
+!:ext inf
>107 string >0 (%s)
0 string HSP\x10\x9b\x00 OS/2 HLP
+!:mime application/x-os2-hlp
+!:ext hlp
>107 string >0 (%s)
+# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/MSG_(OS/2)
+# Reference: https://github.com/OS2World/UTIL-SYSTEM-MKMSGF/blob/master/mkmsgf.h
+# Note: created by MKMSGF.EXE. Text source can be recreated by E_MSGF
+# example like OS001H.MSG
+0 string \xffMKMSGF\0 OS/2 help message
+!:mime application/x-os2-msg
+!:ext msg
+# identifier[3] like: DOS NET REX SYS ...
+>8 string x '%.3s'
+# msgnumber: number of messages
+>11 uleshort x \b, %u messages
+# firstmsgnumber; number of the first message like: some times 0 often 1 169 1000 3502
+>13 uleshort >1 \b, 1st number %u
+# offset16bit; 1~Index table has 16-bit offsets (files<64k) 0~Index table has 32-bit offsets
+>15 ubyte =0 \b, 32-bit
+#>15 ubyte =1 \b, 16-bit
+# version; file version: 2~new 0~old
+>16 uleshort !2 \b, version %u
+# indextaboffset; offset of index table: 1F~after header 0~no index table for version 0?
+>18 uleshort >0
+>>18 uleshort !0x1f \b, at 0x%x index
+# 32-bit offset
+>>15 ubyte =0
+# offset with message table
+>>>(18.s) ulelong x \b, at 0x%x
+# 1st message
+# http://www.os2museum.com/files/docs/os210ptk/os2-1.0-ptk-tools-1988.pdf
+# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
+>>>>(&-4.l) ubyte x %c-type
+>>>>>&0 string x %s
+# 16-bit offset
+>>15 ubyte =1
+# msgnum; message number
+>>>(18.s) uleshort x \b, number %u
+# msgindex; offset of message from begin of file
+>>>(18.s+2) uleshort x at 0x%x
+# message type E H I P W ?
+>>>>(&-2.s) ubyte x %c-type
+# skip newline carriage return
+>>>>>&0 ubeshort =0x0D0a
+>>>>>>&0 string x %s
+>>>>>&0 ubeshort !0x0D0a
+>>>>>>&-2 string x %s
+# for version 0 index table apparently at offset 1F
+>16 uleshort 0
+>>15 ubyte 1
+# 1st message 16-bit
+>>>0x1F uleshort x \b, at 0x%x
+# message type: E~Error H~Help I~Information P~Prompt W~Warning ?
+>>>>(0x1F.s) ubyte x %c-type
+>>>>>&0 string x %s
+# 2nd message 16-bit
+>>>0x21 uleshort x \b, at 0x%x
+>>>>(0x21.s) ubyte x %c-type
+>>>>>&0 string x %s
+# 3rd message 16-bit
+>>>0x23 uleshort x \b, at 0x%x
+>>>>(0x23.s) ubyte x %c-type
+>>>>>&0 string x %s
+# version 0 32-bit
+>>15 ubyte 0
+# 1st message 32-bit
+>>>0x1f ulelong x \b, at 0x%x
+>>>>(0x1F.l) ubyte x %c-type
+>>>>>&0 string x %s
+# 2nd message 32-bit
+>>>0x23 ulelong x \b, at 0x%x
+>>>>(0x23.l) ubyte x %c-type
+>>>>>&0 string x %s
+# 3rd message 32-bit
+>>>0x27 ulelong x \b, AT 0x%x
+>>>>(0x27.l) ubyte x %c-type
+>>>>>&0 string x %s
+# countryinfo; offset of country info block: 0 for version 0
+>20 uleshort !0 \b, at 0x%x countryinfo
+# nextcoutryinfo
+>>22 uleshort >0 \b, at 0x%x next
+# reserved[5]; Must be 0
+>>25 ulelong !0 \b, RESERVED 0x%x
+>>(20.s) use os2-msg-info
+# display country info block of MKMSGF message file
+0 name os2-msg-info
+# bytesperchar; bytes per char: 1~SBCS 2~DBCS
+>0 ubyte >1 \b, %u bytes/char
+# reserved; Not known
+>1 uleshort !0 \b, reserved 0x%x
+# langfamilyID; language family ID like: 0~? 1~Arabic ... 7~German ... 9~English ... 34~Slovene
+>3 uleshort >0 \b, language %u
+# langversionID; like: 7_1~German 7_2~Swiss German 12_1~French 12_3~Canadian French
+>>5 uleshort x \b_%u
+# langfamilyID too high. This should not happen
+>3 uleshort >34 (invalid language)
+# codepagesnumber; number of codepages like: 1 2 ... 16
+>7 uleshort x \b, %u code page
+# plural s
+>7 uleshort >1 \bs
+# too many number of codepages. This should not happen
+>7 uleshort >16 (Too many)
+# codepages[16]; codepages list like 437 850 ...
+>7 uleshort <17
+# 1st code page
+>>9 uleshort >0 %u
+# possible 2nd code page number
+>>>7 uleshort >1
+>>>>11 uleshort x %u
+# filename[260]; name of file like: dbaseos2.msg dde4c01e.msg os2ldr.mgr xdfh.msg ...
+>41 string x \b, %s
+
# OS/2 INI (this is a guess)
0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
+!:mime application/x-os2-ini
+!:ext ini
+
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: pcjr,v 1.1 2021/01/09 15:09:58 christos Exp $
+# pcjr: file(1) magic for PCjr Cartridge image file format
+# From: Francis Laniel <laniel_francis@privacyrequired.com>
+0 string PCjr
+>0x80 beshort 0x55aa PCjr Cartridge image
+>0x200 beshort 0x55aa PCjr Cartridge image
#------------------------------------------------------------------------------
-# $File: pdf,v 1.12 2020/01/30 01:48:44 christos Exp $
+# $File: pdf,v 1.15 2020/08/23 00:30:45 christos Exp $
# pdf: file(1) magic for Portable Document Format
#
0 name pdf
+>8 search /Count
+>>&0 regex [0-9]+ \b, %s pages
>8 search/512 /Filter/FlateDecode/ (password protected)
0 string %PDF- PDF document
!:mime application/pdf
!:strength +60
+!:ext pdf
>5 byte x \b, version %c
>7 byte x \b.%c
>0 use pdf
0 string \012%PDF- PDF document
!:mime application/pdf
!:strength +60
+!:ext pdf
>6 byte x \b, version %c
>8 byte x \b.%c
>0 use pdf
0 string \xef\xbb\xbf%PDF- PDF document (UTF-8)
!:mime application/pdf
!:strength +60
+!:ext pdf
>6 byte x \b, version %c
>8 byte x \b.%c
>0 use pdf
0 string %FDF- FDF document
!:mime application/vnd.fdf
!:strength +60
+!:ext pdf
>5 byte x \b, version %c
>7 byte x \b.%c
0 search/256 %PDF- PDF document
!:mime application/pdf
!:strength +60
+!:ext pdf
>&0 byte x \b, version %c
>&2 byte x \b.%c
>0 use pdf
#------------------------------------------------------------------------------
-# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
+# $File: pgf,v 1.3 2021/02/23 00:51:10 christos Exp $
# pgf: file(1) magic for Progressive Graphics File (PGF)
#
# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
>>20 byte 1 gray scale,
>>20 byte 2 indexed color,
>>20 byte 3 RGB color,
->>20 byte 4 CYMK color,
+>>20 byte 4 CMYK color,
>>20 byte 5 HSL color,
>>20 byte 6 HSB color,
>>20 byte 7 multi-channel,
>>20 byte 10 gray scale 16,
>>20 byte 11 RGB color 48,
>>20 byte 12 LAB color 48,
->>20 byte 13 CYMK color 64,
+>>20 byte 13 CMYK color 64,
>>20 byte 14 deep multi-channel,
>>20 byte 15 duo tone 16,
>>20 byte 17 RGBA color,
#------------------------------------------------------------------------------
-# $File: pgp,v 1.21 2020/03/20 17:11:05 christos Exp $
+# $File: pgp,v 1.24 2020/10/14 21:07:29 christos Exp $
# pgp: file(1) magic for Pretty Good Privacy
+
+# Handling of binary PGP keys is in pgp-binary-keys.
# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
#
-# Update: Joerg Jenderek
-# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP`
-#0 byte 0x99 MAYBE PGP 0x99
-0 byte 0x99
-# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length
-# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh
-#>1 ubeshort x \b, body length 0x%.4x
-# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number
-#>3 ubyte x \b, V=%u
-#>3 ubyte <5 VERSION OK
->3 ubyte <5
-# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet
-#>>(1.S+3) ubyte x \b, next packet type 0x%x
-# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1)
-#>>(1.S+3) ubyte >0x7F TYPE OK,
->>(1.S+3) ubyte >0x7F
-# old versions 2,3 implies Pretty Good Privacy
->>>3 ubyte <4 PGP key public ring (v%u)
-!:mime application/pgp-keys
-!:ext pgp/ASD
->>>>4 beldate x created %s
-# days that this key is valid. If this number is zero, then it does not expire
->>>>8 ubeshort >0 \b, %u days valid
->>>>8 ubeshort =0 \b, not expire
-# display key algorithm 1~RSA (Encrypt or Sign)
->>>>10 use key_algo
-# Multiprecision Integers (MPI) size
->>>>11 ubeshort x %u bits
-# MPI
->>>>13 ubequad x MPI=0x%16.16llx...
-# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG)
->>>3 ubyte >3 PGP/GPG key public ring (v%u)
-!:mime application/pgp-keys
-!:ext pgp/gpg/pkr/asd
->>>>4 beldate x created %s
-# display key algorithm 17~DSA
->>>>8 use key_algo
-# Multiprecision Integers (MPI) size
->>>>9 ubeshort x %u bits
->>>>11 ubequad x MPI=0x%16.16llx...
-
-0 beshort 0x9501 PGP key security ring
-!:mime application/x-pgp-keyring
-0 beshort 0x9500 PGP key security ring
-!:mime application/x-pgp-keyring
0 beshort 0xa600 PGP encrypted data
#!:mime application/pgp-encrypted
#0 string -----BEGIN\040PGP text/PGP armored data
# we branch into the proper key size
# signatures defined as x{keysize}
->0 name pgpkey
+0 name pgpkey
>0 string \x01\xd8 1024b
>>2 use x1024
>0 string \x01\xeb 1024b
# PGP RSA (e=65537) secret (sub-)key header
-0 byte 0x95 PGP Secret Key -
->1 use pgpkey
0 byte 0x97 PGP Secret Sub-key -
>1 use pgpkey
0 byte 0x9d
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: pgp-binary-keys,v 1.1 2020/10/14 21:07:29 christos Exp $
+# pgp-binary-keys: This file handles pgp binary keys.
+#
+# An PGP certificate or message doesn't have a fixed header. Instead,
+# they are sequences of packets:
+#
+# https://tools.ietf.org/html/rfc4880#section-4.3
+#
+# whose order conforms to a grammar:
+#
+# https://tools.ietf.org/html/rfc4880#section-11
+#
+# Happily most packets have a few fields that are constrained, which
+# allow us to fingerprint them with relatively high certainty.
+#
+# A PGP packet is described by a single byte: the so-called CTB. The
+# high-bit is always set. If bit 6 is set, then it is a so-called
+# new-style CTB; if bit 6 is clear, then it is a so-called old-style
+# CTB. Old-style CTBs have only four bits of type information; bits
+# 1-0 are used to describe the length. New-style CTBs have 6 bits of
+# type information.
+#
+# Following the CTB is the packet's length in bytes. If we blindly
+# advance the file cursor by this amount past the end of the length
+# information we come to the next packet.
+#
+# Data Structures
+# ===============
+#
+# New Style CTB
+# -------------
+#
+# https://tools.ietf.org/html/rfc4880#section-4.2.2
+#
+# 76543210
+# ||\----/
+# || tag
+# |always 1
+# always 1
+#
+# Tag bits 7 and 6 set
+# 0 0xC0 -- Reserved - a packet tag MUST NOT have this value
+# 1 0xC1 -- Public-Key Encrypted Session Key Packet
+# 2 0xC2 -- Signature Packet
+# 3 0xC3 -- Symmetric-Key Encrypted Session Key Packet
+# 4 0xC4 -- One-Pass Signature Packet
+# 5 0xC5 -- Secret-Key Packet
+# 6 0xC6 -- Public-Key Packet
+# 7 0xC7 -- Secret-Subkey Packet
+# 8 0xC8 -- Compressed Data Packet
+# 9 0xC9 -- Symmetrically Encrypted Data Packet
+# 10 0xCA -- Marker Packet
+# 11 0xCB -- Literal Data Packet
+# 12 0xCC -- Trust Packet
+# 13 0xCD -- User ID Packet
+# 14 0xCE -- Public-Subkey Packet
+# 17 0xD1 -- User Attribute Packet
+# 18 0xD2 -- Sym. Encrypted and Integrity Protected Data Packet
+# 19 0xD3 -- Modification Detection Code Packet
+# 60 to 63 -- Private or Experimental Values
+#
+# The CTB is followed by the length header, which is densely encoded:
+#
+# if length[0] is:
+# 0..191: one byte length (length[0])
+# 192..223: two byte length ((length[0] - 192) * 256 + length[2] + 192
+# 224..254: four byte length (big endian interpretation of length[1..5])
+# 255: partial body encoding
+#
+# The partial body encoding is similar to HTTP's chunk encoding. It
+# is only allowed for container packets (SEIP, Compressed Data and
+# Literal).
+#
+# Old Style CTB
+# -------------
+#
+# https://tools.ietf.org/html/rfc4880#section-4.2.1
+#
+# CTB:
+#
+# 76543210
+# ||\--/\/
+# || | length encoding
+# || tag
+# |always 0
+# always 1
+#
+# Tag:
+#
+# Tag bit 7 set, bits 6, 1, 0 clear
+# 0 0x80 -- Reserved - a packet tag MUST NOT have this value
+# 1 0x84 -- Public-Key Encrypted Session Key Packet
+# 2 0x88 -- Signature Packet
+# 3 0x8C -- Symmetric-Key Encrypted Session Key Packet
+# 4 0x90 -- One-Pass Signature Packet
+# 5 0x94 -- Secret-Key Packet
+# 6 0x98 -- Public-Key Packet
+# 7 0x9C -- Secret-Subkey Packet
+# 8 0xA0 -- Compressed Data Packet
+# 9 0xA4 -- Symmetrically Encrypted Data Packet
+# 10 0xA8 -- Marker Packet
+# 11 0xAC -- Literal Data Packet
+# 12 0xB0 -- Trust Packet
+# 13 0xB4 -- User ID Packet
+# 14 0xB8 -- Public-Subkey Packet
+#
+# Length encoding:
+#
+# Value
+# 0 1 byte length (following byte is the length)
+# 1 2 byte length (following two bytes are the length)
+# 2 4 byte length (following four bytes are the length)
+# 3 indeterminate length: natural end of packet, e.g., EOF
+#
+# An indeterminate length is only allowed for container packets
+# (SEIP, Compressed Data and Literal).
+#
+# Certificates
+# ------------
+#
+# We check the first three packets to determine if a sequence of
+# OpenPGP packets is likely to be a certificate. The grammar allows
+# the following prefixes:
+#
+# [Primary Key] [SIG] (EOF or another certificate)
+# [Primary Key] [SIG] [User ID] [SIG]...
+# [Primary Key] [SIG] [User Attribute] [SIG]...
+# [Primary Key] [SIG] [Subkey] [SIG]...
+# [Primary Key] [User ID] [SIG]...
+# [Primary Key] [User Attribute] [SIG]...
+# [Primary Key] [Subkey] [SIG]...
+#
+# Any number of marker packets are also allowed between each packet,
+# but they are not normally used and we don't currently check for
+# them.
+#
+# The keys and subkeys may be public or private.
+#
+
+# Key packets and signature packets are versioned. There are two
+# packet versions that we need to worry about in practice: v3 and v4.
+# v4 packets were introduced in RFC 2440, which was published in 1998.
+# It also deprecated v3 packets. There are no actively used v3
+# certificates (GnuPG removed the code to support them in November
+# 2014). But there are v3 keys lying around and it is useful to
+# identify them. The next version of OpenPGP will introduce v5 keys.
+# The document has not yet been standardized so changes are still
+# possible. But, for our purposes, it appears that v5 data structures
+# will be identical to v4 data structures modulo the version number.
+#
+# https://tools.ietf.org/html/rfc2440
+# https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html
+# https://www.ietf.org/id/draft-ietf-openpgp-rfc4880bis-09.html#name-key-material-packet
+
+
+
+
+# The first packet has to be a public key or a secret key.
+#
+# New-Style Public Key
+0 ubyte =0xC6 OpenPGP Public Key
+>&0 use primary_key_length_new
+# New-Style Secret Key
+0 ubyte =0xC5 OpenPGP Secret Key
+>&0 use primary_key_length_new
+# Old-Style Public Key
+0 ubyte&0xFC =0x98 OpenPGP Public Key
+>&-1 use primary_key_length_old
+# Old-Style Secret Key
+0 ubyte&0xFC =0x94 OpenPGP Secret Key
+>&-1 use primary_key_length_old
+
+# Parse the length, check the packet's body and finally advance to the
+# next packet.
+
+# There are 4 different new-style length encodings, but the partial
+# body encoding is only acceptable for the SEIP, Compressed Data, and
+# Literal packets, which isn't valid for any packets in a certificate
+# so we ignore it.
+0 name primary_key_length_new
+>&0 ubyte <192
+#>>&0 ubyte x (1 byte length encoding, %d bytes)
+>>&0 use pgp_binary_key_pk_check
+>>>&(&-1.B) use sig_or_component_1
+>&0 ubyte >191
+>>&-1 ubyte <225
+# offset = ((offset[0] - 192) << 8) + offset[1] + 192 (for the length header)
+# raw - (192 * 256 - 192)
+# = 48960
+#>>>&0 ubeshort x (2 byte length encoding, %d bytes)
+>>>&1 use pgp_binary_key_pk_check
+>>>>&(&-2.S-48960) use sig_or_component_1
+>&0 ubyte =255
+#>>&0 belong x (5 byte length encoding, %d bytes)
+>>&4 use pgp_binary_key_pk_check
+>>>&(&-4.L) use sig_or_component_1
+# Partial body encoding (only valid for container packets).
+# >&0 ubyte >224
+# >>&0 ubyte <255 partial body encoding
+
+# There are 4 different old-style length encodings, but the
+# indeterminate length encoding is only acceptable for the SEIP,
+# Compressed Data, and Literal packets, which isn't valid for any
+# packets in a certificate.
+0 name primary_key_length_old
+#>&0 ubyte x (ctb: %x)
+>&0 ubyte&0x3 =0
+#>>&0 ubyte x (1 byte length encoding, %d bytes)
+>>&1 use pgp_binary_key_pk_check
+>>>&(&-1.B) use sig_or_component_1
+>&0 ubyte&0x3 =1
+#>>&0 ubeshort x (2 byte length encoding, %d bytes)
+>>&2 use pgp_binary_key_pk_check
+>>>&(&-2.S) use sig_or_component_1
+>&0 ubyte&0x3 =2
+#>>&0 ubelong x (4 byte length encoding, %d bytes)
+>>&4 use pgp_binary_key_pk_check
+>>>&(&-4.L) use sig_or_component_1
+
+# Check the Key.
+#
+# https://tools.ietf.org/html/rfc4880#section-5.5.2
+0 name pgp_binary_key_pk_check
+# Valid versions are: 2, 3, 4. 5 is proposed in RFC 4880bis.
+# Anticipate a v6 / v7 format that like v5 is compatible with v4.
+# key format in a decade or so :D.
+>&0 ubyte >1
+>>&-1 ubyte <8
+>>>&-1 byte x Version %d
+# Check that keys were created after 1990.
+# (1990 - 1970) * 365.2524 * 24 * 60 * 60 = 631156147
+>>>&0 bedate >631156147 \b, Created %s
+>>>>&-5 ubyte >3
+>>>>>&4 use pgp_binary_key_algo
+>>>>&-5 ubyte <4
+>>>>>&6 use pgp_binary_key_algo
+
+# Print out the key's algorithm and the number of bits, if this is
+# relevant (ECC keys are a fixed size).
+0 name pgp_binary_key_algo
+>0 clear x
+>&0 ubyte =1 \b, RSA (Encrypt or Sign,
+>>&0 ubeshort x \b %d bits)
+>&0 ubyte =2 \b, RSA (Encrypt,
+>>&0 ubeshort x \b %d bits)
+>&0 ubyte =3 \b, RSA (Sign,
+>>&0 ubeshort x \b %d bits)
+>&0 ubyte =16 \b, El Gamal (Encrypt,
+>>&0 ubeshort x \b %d bits)
+>&0 ubyte =17 \b, DSA
+>>&0 ubeshort x \b (%d bits)
+>&0 ubyte =18 \b, ECDH
+>&0 ubyte =19 \b, ECDSA
+>&0 ubyte =20 \b, El Gamal (Encrypt or Sign,
+>>&0 ubeshort x \b %d bits)
+>&0 ubyte =22 \b, EdDSA
+>&0 default x
+>>&0 ubyte x \b, Unknown Algorithm (0x%x)
+
+# Match all possible second packets.
+0 name sig_or_component_1
+#>0 ubyte x (ctb: %x)
+>&0 ubyte =0xC2
+>>0 ubyte x \b; Signature
+>>&0 use sig_or_component_1_length_new
+>&0 ubyte =0xCD
+>>0 ubyte x \b; User ID
+>>&0 use sig_or_component_1_length_new
+>&0 ubyte =0xCE
+>>0 ubyte x \b; Public Subkey
+>>&0 use sig_or_component_1_length_new
+>&0 ubyte =0xC7
+>>0 ubyte x \b; Secret Subkey
+>>&0 use sig_or_component_1_length_new
+>&0 ubyte =0xD1
+>>0 ubyte x \b; User Attribute
+>>&0 use sig_or_component_1_length_new
+>&0 ubyte&0xFC =0x88
+>>0 ubyte x \b; Signature
+>>&-1 use sig_or_component_1_length_old
+>&0 ubyte&0xFC =0xB4
+>>0 ubyte x \b; User ID
+>>&-1 use sig_or_component_1_length_old
+>&0 ubyte&0xFC =0xB8
+>>0 ubyte x \b; Public Subkey
+>>&-1 use sig_or_component_1_length_old
+>&0 ubyte&0xFC =0x9C
+>>0 ubyte x \b; Secret Subkey
+>>&-1 use sig_or_component_1_length_old
+
+# Copy of 'primary_key_length_new', but calls cert_packet_3.
+0 name sig_or_component_1_length_new
+>&0 ubyte <192
+#>>&0 ubyte x (1 byte new length encoding, %d bytes)
+>>&(&-1.B) use cert_packet_3
+>&0 ubyte >191
+>>&-1 ubyte <225
+# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header)
+# raw - (192 * 256 - 192 - 1)
+# = 48959
+#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes)
+>>>&(&-1.S-48959) use cert_packet_3
+>&0 ubyte =255
+#>>&0 belong x (5 byte new length encoding, %d bytes)
+>>&(&-4.L) use cert_packet_3
+# Partial body encoding (only valid for container packets).
+# >&0 ubyte >224
+# >>&0 ubyte <255 partial body encoding
+
+0 name sig_or_component_1_length_old
+#>&0 ubyte x (ctb: %x)
+>&0 ubyte&0x3 =0
+#>>&0 ubyte x (1 byte old length encoding, %d bytes)
+>>&(&0.B+1) use cert_packet_3
+>&0 ubyte&0x3 =1
+#>>&0 ubeshort x (2 byte old length encoding, %d bytes)
+>>&(&0.S+2) use cert_packet_3
+>&0 ubyte&0x3 =2
+#>>&0 ubelong x (4 byte old length encoding, %d bytes)
+>>&(&0.L+4) use cert_packet_3
+
+# Copy of above.
+0 name cert_packet_3
+#>0 ubyte x (ctb: %x)
+>&0 ubyte =0xC2
+>>0 ubyte x \b; Signature
+>>&0 use cert_packet_3_length_new
+>&0 ubyte =0xCD
+>>0 ubyte x \b; User ID
+>>&0 use cert_packet_3_length_new
+>&0 ubyte =0xCE
+>>0 ubyte x \b; Public Subkey
+>>&0 use cert_packet_3_length_new
+>&0 ubyte =0xC7
+>>0 ubyte x \b; Secret Subkey
+>>&0 use cert_packet_3_length_new
+>&0 ubyte =0xD1
+>>0 ubyte x \b; User Attribute
+>>&0 use cert_packet_3_length_new
+>&0 ubyte&0xFC =0x88
+>>0 ubyte x \b; Signature
+>>&-1 use cert_packet_3_length_old
+>&0 ubyte&0xFC =0xB4
+>>0 ubyte x \b; User ID
+>>&-1 use cert_packet_3_length_old
+>&0 ubyte&0xFC =0xB8
+>>0 ubyte x \b; Public Subkey
+>>&-1 use cert_packet_3_length_old
+>&0 ubyte&0xFC =0x9C
+>>0 ubyte x \b; Secret Subkey
+>>&-1 use cert_packet_3_length_old
+
+# Copy of above.
+0 name cert_packet_3_length_new
+>&0 ubyte <192
+#>>&0 ubyte x (1 byte new length encoding, %d bytes)
+>>&(&-1.B) use pgp_binary_keys_end
+>&0 ubyte >191
+>>&-1 ubyte <225
+# offset = ((offset[0] - 192) << 8) + offset[1] + 192 + 1 (for the length header)
+# raw - (192 * 256 - 192 - 1)
+# = 48959
+#>>>&-1 ubeshort x (2 byte new length encoding, %d bytes)
+>>>&(&-1.S-48959) use pgp_binary_keys_end
+>&0 ubyte =255
+#>>&0 belong x (5 byte new length encoding, %d bytes)
+>>&(&-4.L) use pgp_binary_keys_end
+
+0 name cert_packet_3_length_old
+#>&0 ubyte x (ctb: %x)
+>&0 ubyte&0x3 =0
+#>>&0 ubyte x (1 byte old length encoding, %d bytes)
+>>&(&0.B+1) use pgp_binary_keys_end
+>&0 ubyte&0x3 =1
+#>>&0 ubeshort x (2 byte old length encoding, %d bytes)
+>>&(&0.S+2) use pgp_binary_keys_end
+>&0 ubyte&0x3 =2
+#>>&0 ubelong x (4 byte old length encoding, %d bytes)
+>>&(&0.L+4) use pgp_binary_keys_end
+
+# We managed to parse the first three packets of the certificate. Declare
+# victory.
+0 name pgp_binary_keys_end
+>0 byte x \b; OpenPGP Certificate
+!:mime application/pgp-keys
+!:ext pgp/gpg/pkr/asd
#------------------------------------------------------------------------------
-# $File: riff,v 1.35 2020/06/05 17:15:03 christos Exp $
+# $File: riff,v 1.42 2020/07/17 19:18:56 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
# https://www.seanet.com/users/matts/riffmci/riffmci.htm
# http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf
+# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
#
# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
0 name riff-wave
->0 leshort 1 \b, Microsoft PCM
+>0 leshort 0x01 \b, Microsoft PCM
>>14 leshort >0
>>>14 leshort <1024 \b, %d bit
->0 leshort 2 \b, Microsoft ADPCM
->0 leshort 6 \b, ITU G.711 A-law
->0 leshort 7 \b, ITU G.711 mu-law
->0 leshort 8 \b, Microsoft DTS
->0 leshort 17 \b, IMA ADPCM
->0 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
->0 leshort 49 \b, GSM 6.10
->0 leshort 64 \b, ITU G.721 ADPCM
->0 leshort 80 \b, MPEG
->0 leshort 85 \b, MPEG Layer 3
+>0 leshort 0x02 \b, Microsoft ADPCM
+>0 leshort 0x03 \b, IEEE Float
+>0 leshort 0x04 \b, Compaq VSELP
+>0 leshort 0x05 \b, IBM CVSD
+>0 leshort 0x06 \b, ITU G.711 A-law
+>0 leshort 0x07 \b, ITU G.711 mu-law
+>0 leshort 0x08 \b, Microsoft DTS
+>0 leshort 0x10 \b, OKI ADPCM
+>0 leshort 0x11 \b, IMA ADPCM
+>0 leshort 0x12 \b, MediaSpace ADPCM
+>0 leshort 0x13 \b, Sierra ADPCM
+>0 leshort 0x14 \b, ITU G.723 ADPCM (Yamaha)
+>0 leshort 0x15 \b, DSP Solutions DIGISTD
+>0 leshort 0x16 \b, DSP Solutions DIGIFIX
+>0 leshort 0x17 \b, Dialogic OKI ADPCM
+>0 leshort 0x18 \b, MediaVision ADPCM
+>0 leshort 0x19 \b, HP CU
+>0 leshort 0x20 \b, Yamaha ADPCM
+>0 leshort 0x21 \b, Speech Compression SONARC
+>0 leshort 0x22 \b, DSP Group True Speech
+>0 leshort 0x23 \b, Echo Speech EchoSC1
+>0 leshort 0x24 \b, AudioFile AF36
+>0 leshort 0x25 \b, APTX
+>0 leshort 0x26 \b, AudioFile AF10
+>0 leshort 0x27 \b, Prosody 1612
+>0 leshort 0x28 \b, LRC
+>0 leshort 0x30 \b, Dolby AC2
+>0 leshort 0x31 \b, GSM 6.10
+>0 leshort 0x32 \b, MSN Audio
+>0 leshort 0x33 \b, Antex ADPCME
+>0 leshort 0x34 \b, Control Res VQLPC
+>0 leshort 0x35 \b, Digireal
+>0 leshort 0x36 \b, DigiADPCM
+>0 leshort 0x37 \b, Control Res CR10
+>0 leshort 0x38 \b, NMS VBXADPCM
+>0 leshort 0x39 \b, Roland RDAC
+>0 leshort 0x3A \b, Echo Speech EchoSC3
+>0 leshort 0x3B \b, Rockwell ADPCM
+>0 leshort 0x3C \b, Rockwell Digitalk
+>0 leshort 0x3D \b, Xebec
+>0 leshort 0x40 \b, ITU G.721 ADPCM
+>0 leshort 0x41 \b, ITU G.728 CELP
+>0 leshort 0x42 \b, MSG723
+>0 leshort 0x50 \b, MPEG
+>0 leshort 0x52 \b, RT24
+>0 leshort 0x53 \b, PAC
+>0 leshort 0x55 \b, MPEG Layer 3
+>0 leshort 0x59 \b, Lucent G.723
+>0 leshort 0x60 \b, Cirrus
+>0 leshort 0x61 \b, ESPCM
+>0 leshort 0x62 \b, Voxware
+>0 leshort 0x63 \b, Canopus Atrac
+>0 leshort 0x64 \b, ITU G.726 ADPCM
+>0 leshort 0x65 \b, ITU G.722 ADPCM
+>0 leshort 0x66 \b, DSAT
+>0 leshort 0x67 \b, DSAT Display
+>0 leshort 0x69 \b, Voxware Byte Aligned
+>0 leshort 0x70 \b, Voxware AC8
+>0 leshort 0x71 \b, Voxware AC10
+>0 leshort 0x72 \b, Voxware AC16
+>0 leshort 0x73 \b, Voxware AC20
+>0 leshort 0x74 \b, Voxware MetaVoice
+>0 leshort 0x75 \b, Voxware MetaSound
+>0 leshort 0x76 \b, Voxware RT29HW
+>0 leshort 0x77 \b, Voxware VR12
+>0 leshort 0x78 \b, Voxware VR18
+>0 leshort 0x79 \b, Voxware TQ40
+>0 leshort 0x80 \b, Softsound
+>0 leshort 0x81 \b, Voxware TQ60
+>0 leshort 0x82 \b, MSRT24
+>0 leshort 0x83 \b, ITU G.729A
+>0 leshort 0x84 \b, MVI MV12
+>0 leshort 0x85 \b, DF G.726
+>0 leshort 0x86 \b, DF GSM610
+>0 leshort 0x88 \b, ISIAudio
+>0 leshort 0x89 \b, Onlive
+>0 leshort 0x91 \b, SBC24
+>0 leshort 0x92 \b, Dolby AC3 S/PDIF
+>0 leshort 0x97 \b, ZyXEL ADPCM
+>0 leshort 0x98 \b, Philips LPCBB
+>0 leshort 0x99 \b, Packed
+>0 leshort 0x100 \b, Rhetorex ADPCM
+>0 leshort 0x101 \b, BeCubed Software IRAT
+>0 leshort 0x111 \b, Vivo G.723
+>0 leshort 0x112 \b, Vivo Siren
+>0 leshort 0x123 \b, Digital G.723
+>0 leshort 0x200 \b, Creative ADPCM
+>0 leshort 0x202 \b, Creative FastSpeech8
+>0 leshort 0x203 \b, Creative FastSpeech10
+>0 leshort 0x220 \b, Quarterdeck
+>0 leshort 0x300 \b, FM Towns Snd
+>0 leshort 0x400 \b, BTV Digital
+>0 leshort 0x680 \b, VME VMPCM
+>0 leshort 0x1000 \b, OLIGSM
+>0 leshort 0x1001 \b, OLIADPCM
+>0 leshort 0x1002 \b, OLICELP
+>0 leshort 0x1003 \b, OLISBC
+>0 leshort 0x1004 \b, OLIOPR
+>0 leshort 0x1100 \b, LH Codec
+>0 leshort 0x1400 \b, Norris
+>0 leshort 0x1401 \b, ISIAudio
+>0 leshort 0x1500 \b, Soundspace Music Compression
+>0 leshort 0x2000 \b, AC3 DVM
>0 leshort 0x2001 \b, DTS
>2 leshort =1 \b, mono
>2 leshort =2 \b, stereo
# try to find "fmt "
0 name riff-walk
>0 string fmt\x20
->>4 lelong <0x80
+>>4 lelong >15
>>>8 use riff-wave
>0 string LIST
>>&(4.l+4) use riff-walk
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format
# Reference: https://worms2d.info/Palette_file
+# WAVE/AVI codec registry: https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
>8 string PAL\ \b, palette
!:mime application/x-riff
# color palette by Microsoft Corporation
>>>>&16 ubelong x \b, extra bytes
>>>>>&-4 ubelong >0 0x%8.8x
# RIFF Device Independent Bitmap format
+# URL: http://fileformats.archiveteam.org/wiki/RDIB
>8 string RDIB \b, device-independent bitmap
+!:ext rdi/dib
>>16 string BM
>>>30 leshort 12 \b, OS/2 1.x format
>>>>34 leshort x \b, %d x
>>>>38 lelong x %d x
>>>>44 leshort x %d
# RIFF MIDI format
+# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDI
>8 string RMID \b, MIDI
+# http://extension.nirsoft.net/rmi
+!:mime audio/mid
+#!:mime audio/x-rmid
+!:ext rmi
# RIFF Multimedia Movie File format
+# URL: http://fileformats.archiveteam.org/wiki/RIFF_Multimedia_Movie
>8 string RMMP \b, multimedia movie
+!:mime video/x-mmm
+!:ext mmm
# RIFF wrapper for MP3
>8 string RMP3 \b, MPEG Layer 3 audio
+#!:mime audio/x-rmp3
# Microsoft WAVE format (*.wav)
+# URL: http://fileformats.archiveteam.org/wiki/WAV
>8 string WAVE \b, WAVE audio
+#!:mime audio/vnd.wave
!:mime audio/x-wav
+# https://www.macdisk.com/macsigen.php
+#!:apple ????WAVE
+!:ext wav/wave
>>12 string >\0
>>>12 use riff-walk
# Update: Joerg Jenderek
# pattern created by newer software start with RIFF type PAT
>8 string PAT
>>0 use corel-draw
+# From: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Corel_Designer
+# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer
+>8 string DES
+>>8 string !DESC
+>>>0 use corel-des
+# Corel Draw templates with version 12.5 or Corel Designer illustration 12
+>>8 string =DESC
+# MORE TESTS NEEDED HERE!
+#>>>0 use corel-des
+#>>>0 use corel-draw
>8 string NUNDROOT \b, Steinberg CuBase
# AVI == Audio Video Interleave
+# Reference: http://fileformats.archiveteam.org/wiki/AVI
>8 string AVI\040 \b, AVI
+# https://reposcope.com/mimetype/video/x-msvideo
!:mime video/x-msvideo
+# https://www.iana.org/assignments/wave-avi-codec-registry/wave-avi-codec-registry.xml
+#!:mime video/vnd.avi
+!:ext avi/divx
>>12 string LIST
>>>20 string hdrlavih
>>>>&36 lelong x \b, %u x
# skip past vids strh
>>>>>>(104.l+108) string strf
>>>>>>>(104.l+132) lelong 1 RLE 8bpp
+>>>>>>>(104.l+132) string/c anim Intel RDX
+>>>>>>>(104.l+132) string/c aur2 AuraVision Aura 2
+>>>>>>>(104.l+132) string/c aura AuraVision Aura
+>>>>>>>(104.l+132) string/c bt20 Brooktree MediaStream
+>>>>>>>(104.l+132) string/c btcv Brooktree Composite Video
+>>>>>>>(104.l+132) string/c cc12 Intel YUV12
+>>>>>>>(104.l+132) string/c cdvc Canopus DV
+>>>>>>>(104.l+132) string/c cham Winnov Caviara Cham
+>>>>>>>(104.l+132) string/c cljr Proprietary YUV 4 pixels
+>>>>>>>(104.l+132) string/c cmyk Common Data Format in Printing
+>>>>>>>(104.l+132) string/c cpla Weitek 4:2:0 YUV Planar
>>>>>>>(104.l+132) string/c cvid Cinepak
+>>>>>>>(104.l+132) string/c cwlt Microsoft Color WLT DIB
+>>>>>>>(104.l+132) string/c cyuv Creative Labs YUV
+>>>>>>>(104.l+132) string/c d261 H.261
+>>>>>>>(104.l+132) string/c d263 H.263
+>>>>>>>(104.l+132) string/c duck TrueMotion 1.0
+>>>>>>>(104.l+132) string/c dve2 DVE-2 Videoconferencing
+>>>>>>>(104.l+132) string/c fljp Field Encoded Motion JPEG
+>>>>>>>(104.l+132) string/c fvf1 Fractal Video Frame
+>>>>>>>(104.l+132) string/c gwlt Microsoft Greyscale WLT DIB
+>>>>>>>(104.l+132) string/c h260 H.260
+>>>>>>>(104.l+132) string/c h261 H.261
+>>>>>>>(104.l+132) string/c h262 H.262
+>>>>>>>(104.l+132) string/c h263 H.263
+>>>>>>>(104.l+132) string/c h264 H.264
+>>>>>>>(104.l+132) string/c h265 H.265
+>>>>>>>(104.l+132) string/c h266 H.266
+>>>>>>>(104.l+132) string/c h267 H.267
+>>>>>>>(104.l+132) string/c h268 H.268
+>>>>>>>(104.l+132) string/c h269 H.269
>>>>>>>(104.l+132) string/c i263 Intel I.263
->>>>>>>(104.l+132) string/c iv32 Indeo 3.2
->>>>>>>(104.l+132) string/c iv41 Indeo 4.1
->>>>>>>(104.l+132) string/c iv50 Indeo 5.0
+>>>>>>>(104.l+132) string/c i420 Intel Indeo 4
+>>>>>>>(104.l+132) string/c ian Intel RDX
+>>>>>>>(104.l+132) string/c iclb CellB Videoconferencing Codec
+>>>>>>>(104.l+132) string/c ilvc Intel Layered Video
+>>>>>>>(104.l+132) string/c ilvr ITU-T H.263+
+>>>>>>>(104.l+132) string/c iraw Intel YUV Uncompressed
+>>>>>>>(104.l+132) string/c iv30 Intel Indeo 3
+>>>>>>>(104.l+132) string/c iv31 Intel Indeo 3.1
+>>>>>>>(104.l+132) string/c iv32 Intel Indeo 3.2
+>>>>>>>(104.l+132) string/c iv33 Intel Indeo 3.3
+>>>>>>>(104.l+132) string/c iv34 Intel Indeo 3.4
+>>>>>>>(104.l+132) string/c iv35 Intel Indeo 3.5
+>>>>>>>(104.l+132) string/c iv36 Intel Indeo 3.6
+>>>>>>>(104.l+132) string/c iv37 Intel Indeo 3.7
+>>>>>>>(104.l+132) string/c iv38 Intel Indeo 3.8
+>>>>>>>(104.l+132) string/c iv39 Intel Indeo 3.9
+>>>>>>>(104.l+132) string/c iv40 Intel Indeo 4.0
+>>>>>>>(104.l+132) string/c iv41 Intel Indeo 4.1
+>>>>>>>(104.l+132) string/c iv42 Intel Indeo 4.2
+>>>>>>>(104.l+132) string/c iv43 Intel Indeo 4.3
+>>>>>>>(104.l+132) string/c iv44 Intel Indeo 4.4
+>>>>>>>(104.l+132) string/c iv45 Intel Indeo 4.5
+>>>>>>>(104.l+132) string/c iv46 Intel Indeo 4.6
+>>>>>>>(104.l+132) string/c iv47 Intel Indeo 4.7
+>>>>>>>(104.l+132) string/c iv48 Intel Indeo 4.8
+>>>>>>>(104.l+132) string/c iv49 Intel Indeo 4.9
+>>>>>>>(104.l+132) string/c iv50 Intel Indeo 5.0
+>>>>>>>(104.l+132) string/c mpeg MPEG 1 Video Frame
+>>>>>>>(104.l+132) string/c mjpg Motion JPEG
>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
+>>>>>>>(104.l+132) string/c mrca MR Codec
+>>>>>>>(104.l+132) string/c mrle Run Length Encoding
+>>>>>>>(104.l+132) string/c msvc Microsoft Video 1
+>>>>>>>(104.l+132) string/c phmo Photomotion
+>>>>>>>(104.l+132) string/c qpeq QPEG 1.1 Format Video
+>>>>>>>(104.l+132) string/c rgbt RGBT
+>>>>>>>(104.l+132) string/c rle4 Run Length Encoded 4
+>>>>>>>(104.l+132) string/c rle8 Run Length Encoded 8
+>>>>>>>(104.l+132) string/c rt21 Intel Indeo 2.1
+>>>>>>>(104.l+132) string/c rvx Intel RDX
+>>>>>>>(104.l+132) string/c sdcc Sun Digital Camera Codec
+>>>>>>>(104.l+132) string/c sfmc Crystal Net SFM Codec
+>>>>>>>(104.l+132) string/c smsc SMSC
+>>>>>>>(104.l+132) string/c smsd SMSD
+>>>>>>>(104.l+132) string/c splc Splash Studios ACM Audio Codec
+>>>>>>>(104.l+132) string/c sqz2 Microsoft VXtreme Video Codec
+>>>>>>>(104.l+132) string/c sv10 Sorenson Video R1
+>>>>>>>(104.l+132) string/c tlms TeraLogic Motion Intraframe Codec A
+>>>>>>>(104.l+132) string/c tlst TeraLogic Motion Intraframe Codec B
+>>>>>>>(104.l+132) string/c tm20 TrueMotion 2.0
+>>>>>>>(104.l+132) string/c tmic TeraLogic Motion Intraframe Codec 2
+>>>>>>>(104.l+132) string/c tmot TrueMotion Video Compression
+>>>>>>>(104.l+132) string/c tr20 TrueMotion RT 2.0
+>>>>>>>(104.l+132) string/c ulti Ultimotion
+>>>>>>>(104.l+132) string/c uyvy UYVY 4:2:2 byte ordering
+>>>>>>>(104.l+132) string/c v422 24-bit YUV 4:2:2 format
+>>>>>>>(104.l+132) string/c v655 16-bit YUV 4:2:2 format
+>>>>>>>(104.l+132) string/c vcr1 ATI VCR 1.0
+>>>>>>>(104.l+132) string/c vcr2 ATI VCR 2.0
+>>>>>>>(104.l+132) string/c vcr3 ATI VCR 3.0
+>>>>>>>(104.l+132) string/c vcr4 ATI VCR 4.0
+>>>>>>>(104.l+132) string/c vcr5 ATI VCR 5.0
+>>>>>>>(104.l+132) string/c vcr6 ATI VCR 6.0
+>>>>>>>(104.l+132) string/c vcr7 ATI VCR 7.0
+>>>>>>>(104.l+132) string/c vcr8 ATI VCR 8.0
+>>>>>>>(104.l+132) string/c vcr9 ATI VCR 9.0
+>>>>>>>(104.l+132) string/c vdct Video Maker Pro DIB
+>>>>>>>(104.l+132) string/c vids YUV 4:2:2 CCIR 601 for V422
+>>>>>>>(104.l+132) string/c vivo Vivo H.263
+>>>>>>>(104.l+132) string/c vixl VIXL
+>>>>>>>(104.l+132) string/c vlv1 VLCAP.DRV
+>>>>>>>(104.l+132) string/c wbvc W9960
+>>>>>>>(104.l+132) string/c x263 mmioFOURCC('X','2','6','3')
+>>>>>>>(104.l+132) string/c xlv0 XL Video Decoder
+>>>>>>>(104.l+132) string/c y211 YUV 2:1:1 Packed
+>>>>>>>(104.l+132) string/c y411 YUV 4:1:1 Packed
+>>>>>>>(104.l+132) string/c y41b YUV 4:1:1 Planar
+>>>>>>>(104.l+132) string/c y41p PC1 4:1:1
+>>>>>>>(104.l+132) string/c y41t PC1 4:1:1 with transparency
+>>>>>>>(104.l+132) string/c y42b YUV 4:2:2 Planar
+>>>>>>>(104.l+132) string/c y42t PC1 4:2:2 with transparency
+>>>>>>>(104.l+132) string/c yc12 Intel YUV12 Codec
+>>>>>>>(104.l+132) string/c yuv8 Winnov Caviar YUV8
+>>>>>>>(104.l+132) string/c yuv9 YUV9
+>>>>>>>(104.l+132) string/c yuy2 YUY2 4:2:2 byte ordering packed
+>>>>>>>(104.l+132) string/c yuyv BI_YUYV, Canopus
>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
->>>>>>>(104.l+132) string/c mjpg Motion JPEG
>>>>>>>(104.l+132) string/c div3 DivX 3
>>>>>>>>112 string/c div3 Low-Motion
>>>>>>>>112 string/c div4 Fast-Motion
>>>>>>>>(92.l+190) leshort 2 (stereo,
>>>>>>>>(92.l+190) leshort >2 (%d channels,
>>>>>>>>(92.l+192) lelong x %d Hz)
+# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/VDR_(VirtualDub)
+# Reference: http://sourceforge.net/projects/virtualdub/files/virtualdub-win/
+# 1.10.4.35491/VirtualDub-1.10.4-src.7z/src/vdremote/Main.cpp
+# VirtualDub link handler
+>8 string VDRM \b, VirtualDub link
+!:mime video/x-vdr
+!:ext vdr
+>>12 string PATH \b, PATH
+# remote-path to video file
+>>16 pstring/l x %s
# Animated Cursor format
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/Windows_Animated_Cursor
+# Reference: https://www.gdgsoft.com/anituner/help/aniformat.htm
>8 string ACON \b, animated cursor
+!:mime application/x-navi-animation
+# http://extension.nirsoft.net/ani
+#!:mime image/ani
+!:ext ani
+# INAM tag followed by length of title
+>>24 string INAM
+>>>28 pstring/l x "%s"
+# IART tag followed by length of author
+>>>(28.l+32) ubelong 0x49415254
+>>>>&0 pstring/l x %s
# SoundFont 2 <mpruett@sgi.com>
->8 string sfbk SoundFont/Bank
+# URL: http://fileformats.archiveteam.org/wiki/SoundFont_2.0
+>8 string sfbk \b, SoundFont/Bank
+!:mime audio/x-sfbk
+!:ext sf2
# MPEG-1 wrapped in a RIFF, apparently
+# URL: http://file.fyicenter.com/17_Video_.DAT_File_Extension_for_VCD_Files.html
>8 string CDXA \b, wrapped MPEG-1 (CDXA)
+!:mime video/x-cdxa
+!:ext mpg/dat
+# URL: http://fileformats.archiveteam.org/wiki/4X_IMA_ADPCM
>8 string 4XMV \b, 4X Movie file
+!:mime video/x-4xmv
+!:ext 4xm/4xa
# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV
>8 string AMV\040 \b, AMV
+# http://fileformats.archiveteam.org/wiki/MTV_Video_(.AMV)
+!:mime video/x-amv
+!:ext amv
+#!:ext amv/mtv
+# URL: http://fileformats.archiveteam.org/wiki/WebP
>8 string WEBP \b, Web/P image
!:mime image/webp
+!:ext webp
>>12 use riff-walk
# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/RIFF_MIDS
+>8 string MIDS \b, MIDI Stream
+!:mime audio/x-mids
+!:ext mds
+# From: Joerg Jenderek
+# URL: http://mark0.net/soft-trid-e.html
+# Reference: http://fileformats.archiveteam.org/wiki/Trd_(TRID)
+>8 string TRID \b, TrID defs package
+!:mime application/x-trid-trd
+!:ext trd
+# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/CorelDRAW
# Reference: http://fileformats.archiveteam.org/wiki/CorelDRAW
# Note: Since version 3 CorelDraw Pictures are RIFF based
>16 ulelong 0x10
>>34 ubyte x %u
>>>33 ubyte >0 \b.%u
+# display information of RIFF based Corel Design formats
+0 name corel-des
+# display second chunk for debugging
+#>8 string x \b, [8]=%.8s
+>12 string x \b, Corel DESIGNER
+!:mime image/x-corel-des
+#!:mime application/x-vnd.corel.designer.document
+# used by Corel Designer with newer versions since 16
+>12 string =fver graphics (root.dat)
+!:ext dat
+# used by Corel Designer templates with older versions with vrsn tag
+>12 string !fver
+# used by Corel Designer with versions 14-15
+>>11 string >D graphics (riffData.cdr)
+!:ext cdr
+# used by Corel Designer with versions 10-12
+>>11 string <E graphics
+!:ext des
+# version indicated by last ASCII char of second chunk tag
+>11 string x \b, version '%-.1s'
+# but vrsn short content is not always version indicator
+# exceptions: 'A'~11.4 'B'~12 'C'~12.5
+>11 string >D
+>>0 use corel-version
+# for debugging purpose display next chunk like: DISP LIST
+#>>22 string x \b, 4th "%-4.4s"
+#>>26 ulelong x \b, 4th SIZE 0x%x
+# for debugging purpose display 5th chunk like: LIST osfp
+#>>(26.l+30) string x \b, 5th "%-4.4s"
+>4 ulelong+8 x \b, %u bytes
#
# XXX - some of the below may only appear in little-endian form.
#
#------------------------------------------------------------------------------
-# $File: rtf,v 1.8 2020/05/17 19:28:49 christos Exp $
+# $File: rtf,v 1.9 2020/12/12 20:01:47 christos Exp $
# rtf: file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#>6 search/105 \\ansi \b, ANSI
>6 search/502 \\ansi \b, ANSI
>6 default x \b, unknown character set
-# look for explict codepage keyword
+# look for explicit codepage keyword
# "Burow, Steffanie - Im Tal des Schneeleoparden.rtf"
#>5 search/110 \\ansicpg
>5 search/500 \\ansicpg
#------------------------------------------------------------------------------
-# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
+# $File: sccs,v 1.8 2020/06/20 21:32:52 christos Exp $
# sccs: file(1) magic for SCCS archives
#
-# SCCS archive structure:
+# SCCS v4 archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
-# and we don't have regular expression matching yet.
-# Hence the following official kludge:
-8 string \001s\ SCCS archive data
+# Fortunately we have regular expression matching:
+0 string \001h
+>2 regex [0-9][0-9][0-9][0-9][0-9]$
+>>8 string \001s\040 SCCS v4 archive data
+>2 string V6,sum= SCCS v6 archive data
#------------------------------------------------------------------------------
-# $File: sgml,v 1.41 2020/06/07 18:16:43 christos Exp $
+# $File: sgml,v 1.42 2020/12/12 20:01:47 christos Exp $
# Type: SVG Vectorial Graphics
# From: Noel Torres <tecnico@ejerciciosresueltos.com>
0 string \<?xml\ version=
# sgml: file(1) magic for Standard Generalized Markup Language
# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
-# adapted to string extens
tions by Anthon van der Neut <anthon@mnt.org)
+# adapted to string extensions by Anthon van der Neut <anthon@mnt.org)
0 search/4096/cWt \<!doctype\ html HTML document text
!:mime text/html
!:strength + 5
#------------------------------------------------------------------------------
-# $File: sniffer,v 1.28 2020/03/13 16:47:29 christos Exp $
+# $File: sniffer,v 1.29 2021/03/13 18:51:51 christos Exp $
# sniffer: file(1) magic for packet capture files
#
# From: guy@alum.mit.edu (Guy Harris)
>20 belong&0x03FFFFFF 282 (Broadcom tag (prepended)
>20 belong&0x03FFFFFF 284 (Marvell DSA
>20 belong&0x03FFFFFF 285 (Marvell EDSA
+>20 belong&0x03FFFFFF 286 (ELEE lawful intercept
+>20 belong&0x03FFFFFF 287 (Z-Wave serial
+>20 belong&0x03FFFFFF 288 (USB 2.0
+>20 belong&0x03FFFFFF 289 (ATSC ALP
+>20 belong&0x03FFFFFF 290 (Event Tracing for Windows
# print default match
>20 default x
>>20 belong x (linktype#%u
#------------------------------------------------------------------------------
-# $File: sosi,v 1.1 2019/05/20 17:25:09 christos Exp $
+# $File: sosi,v 1.2 2021/02/23 00:51:10 christos Exp $
# SOSI
# Summary: Systematic Organization of Spatial Information
# Long description: Norwegian text based map format
# version and a separator.
#
# FIXME figure out how to accept any of [space], [tab], [newline] and
-# [carrige return] as separators, not only line end.
+# [carriage return] as separators, not only line end.
# Not searching for full "OMR=C3=85DE" to match also for non-UTF-8
# character sets
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: statistics,v 1.2 2020/10/08 17:51:53 christos Exp $
+# statistics: file(1) magic for statistics related software
+#
+
+# From Remy Rampin
+
+# Stata is a statistical software tool that was created in 1985. While I
+# don't personally use it, data files in its native (proprietary) format
+# are common (.dta files).
+#
+# Because they are so common, especially in statistical and social
+# sciences, Stata files and SPSS files can be opened by a lot of modern
+# software, for example Python's pandas package provides built-in
+# support for them (read_stata() and read_spss()).
+#
+# I noticed that the magic database includes an entry for SPSS files but
+# not Stata files. Stata files for Stata 13 and newer (formats 117, 118,
+# and 119) always begin with the string "<stata_dta><header>" as per
+# https://www.stata.com/help.cgi?dta#definition
+#
+# The format version number always follows, for example:
+# <stata_dta><header><release>117</release>
+# <stata_dta><header><release>118</release>
+#
+# Therefore the following line would do the trick:
+# 0 string <stata_dta><header> Stata Data File
+#
+# (I'm sure the version number could be captured as well but I did not
+# manage this without a regex)
+#
+# Unfortunately the previous formats (created by Stata before 13, which
+# was released 2013) are harder to recognize. Format 115 starts with the
+# four bytes 0x73010100 or 0x73020100, format 114 with 0x72010100 or
+# 0x72020100, format 113 with 0x71010101 or 0x71020101.
+#
+# For additional reference, the Library of Congress website has an entry
+# for the Stata Data File Format 118:
+# https://www.loc.gov/preservation/digital/formats/fdd/fdd000471.shtml
+#
+# Example of those files can be found on Zenodo:
+# https://zenodo.org/search?page=1&size=20&q=&file_type=dta
+0 string \<stata_dta\>\<header\>\<release\> Stata Data File
+>&0 regex [0-9]* (Release %s)
#------------------------------------------------------------------------------
-# $File: terminfo,v 1.11 2019/04/19 00:42:27 christos Exp $
+# $File: terminfo,v 1.12 2021/02/23 00:51:10 christos Exp $
# terminfo: file(1) magic for terminfo
#
# URL: https://invisible-island.net/ncurses/man/term.5.html
>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled 32-bit terminfo entry "%-s"
!:mime application/x-terminfo2
#
-# While the compiled terminfo uses little-endian format irregardless of
+# While the compiled terminfo uses little-endian format regardless of
# platform, SystemV screen dumps do not. They came later, and that detail was
# overlooked.
#
#------------------------------------------------------------------------------
-# $File$
+# $File: timezone,v 1.12 2020/12/28 15:59:23 christos Exp $
# timezone: file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
>20 belong 1 \b, 1 gmt time flag
>20 belong >1 \b, %d gmt time flags
>24 belong 0 \b, no std time flags
->20 belong 1 \b, 1 std time flag
+>24 belong 1 \b, 1 std time flag
>24 belong >1 \b, %d std time flags
>28 belong 0 \b, no leap seconds
>28 belong 1 \b, 1 leap second
>32 belong 0 \b, no transition times
>32 belong 1 \b, 1 transition time
>32 belong >1 \b, %d transition times
->36 belong 0 \b, no abbreviation chars
->36 belong 1 \b, 1 abbreviation char
->36 belong >1 \b, %d abbreviation chars
+>36 belong 0 \b, no local time types
+>36 belong 1 \b, 1 local time type
+>36 belong >1 \b, %d local time types
+>40 belong 0 \b, no abbreviation chars
+>40 belong 1 \b, 1 abbreviation char
+>40 belong >1 \b, %d abbreviation chars
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
#------------------------------------------------------------------------------
-# $File: tplink,v 1.5 2020/03/28 23:14:26 christos Exp $
+# $File: tplink,v 1.6 2020/12/12 20:01:47 christos Exp $
# tplink: File magic for openwrt firmware files
# URL: https://wiki.openwrt.org/doc/techref/header
#>(0x88.L) ubequad x \b, file system 0x%llx
# bootloader data offset
>0x90 ubelong !0 \b, at 0x%x
-# bootloader data length only resonable if bootloader offset not null
+# bootloader data length only reasonable if bootloader offset not null
>>0x94 ubelong !0 %u bytes
# pad[354] should be 354 null bytes.
#>0x9E ubequad !0 \b, padding 0x%llx
#------------------------------------------------------------------------------
-# $File: virtual,v 1.12 2020/02/15 01:20:15 christos Exp $
+# $File: virtual,v 1.13 2021/02/23 00:51:10 christos Exp $
# From: James Nobis <quel@quelrod.net>
# Microsoft hard disk images for:
# Virtual Server
# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk)
# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/
# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
-0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC
+0 string connectix Microsoft Disk Image, Virtual Server or Virtual PC
# alternative shorter names
-#0 string conectix Microsoft Virtual Hard Disk image
-#0 string conectix Microsoft Virtual HD image
+#0 string connectix Microsoft Virtual Hard Disk image
+#0 string connectix Microsoft Virtual HD image
!:mime application/x-virtualbox-vhd
!:ext vhd
# Features is a bit field used to indicate specific feature support
#------------------------------------------------------------------------------
-# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $
+# $File: vorbis,v 1.26 2020/08/22 18:30:55 christos Exp $
# vorbis: file(1) magic for Ogg/Vorbis files
#
# From Felix von Leitner <leitner@fefe.de>
>>>>>>(84.b+117) string 20140122 (1.3.4)
>>>>>>(84.b+117) string 20150105 (1.3.5)
-# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5
+# non-Vorbis content: Opus https://tools.ietf.org/html/rfc7845#section-5
>>28 string OpusHead \b, Opus audio,
!:mime audio/ogg
>>>36 ubyte >0x0F UNKNOWN VERSION %u,
->>>36 ubyte &0x0F version 0.%d
+>>>36 ubyte&0x0F !0 version 0.%u,
>>>>46 ubyte >1
>>>>>46 ubyte !255 unknown channel mapping family %u,
>>>>>37 ubyte x %u channels
>>>>>37 ubyte 6 5.1 surround
>>>>>37 ubyte 7 6.1 surround
>>>>>37 ubyte 8 7.1 surround
->>>>40 lelong !0 \b, %u Hz
+>>>>40 lelong !0 \b, %u Hz (Input Sample Rate)
\ No newline at end of file
#------------------------------------------------------------------------------
-# $File: windows,v 1.31 2020/03/15 16:44:37 christos Exp $
+# $File: windows,v 1.36 2021/02/05 22:29:07 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
>>&0 regex/c \^(options)]\r\n Microsoft HTML Help Project
!:mime text/plain
!:ext hhp
+# From: Joerg Jenderek
+# URL: https://documentation.basis.com/BASISHelp/WebHelp/b3odbc/obdcdriv_character_translation.htm
+# Reference: https://www.garykessler.net/library/file_sigs.html
+# Note: stored in directory %WINDIR%\SysWOW64 or %WINDIR%\system
+>>&0 regex/c \^(Windows\ Latin) Windows codepage translator
+!:mime text/plain
+!:ext cpx
# unknown keyword after opening bracket
>>&0 default x
#>>>&0 string/c x UNKNOWN [%s
>>>>>&0 ubyte x
# characters, digits, underscore and white space followed by right bracket
# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT
->>>>>>&-1 regex \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s
+>>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s
# NETDEF.INF multiarc.ini
#!:mime application/x-setupscript
!:mime application/x-wine-extension-ini
# directory like C:\Program Files\GIMP 2
>>>>&0 lestring16 x \b, %-.42s
+# URL: https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller
+# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas
+# From: Joerg Jenderek
+0 string Inno\ Setup\ Messages\ (
+# null padded til 0x40 boundary
+>0x38 quad 0 InnoSetup messages
+!:mime application/x-innosetup-msg
+# unins000.msg, unins001.msg, ...
+!:ext msg
+# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0
+>>0x15 string x \b, version %.5s
+# look for 6th char of version string or terminating right parentheses
+>>>0x1a ubyte !0x29 \b%c
+# NumMessages
+>>0x40 ulelong x \b, %u messages
+# TotalSize: Cardinal;
+#>>0x44 ulelong x \b, TotalSize %u
+# NotTotalSize: Cardinal;
+#>>0x48 ulelong x \b, NotTotalSize %u
+# CRCMessages: Longint;
+#>>0x4C ulelong x \b, CRC 0x%x
+>>0x40 ulelong x
+# (u) after version means unicoded messages
+>>>0x1c search/2 (u) (UTF-16),
+>>>>0x50 lestring16 x %s
+# ASCII coded message
+>>>0x1c default x (ASCII),
+>>>>0x50 string x %s
+
# Windows Imaging (WIM) Image
-# Update: Joerg Jenderek at Mar 2019
+# Update: Joerg Jenderek at Mar 2019, 2021
# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format
+# http://fileformats.archiveteam.org/wiki/Windows_Imaging_Format
# Reference: https://download.microsoft.com/download/f/e/f/
# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf
# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header`
# TO avoid in file version 5.36 error like
# Magdir/windows, 760: Warning: Current entry does not yet have a description
# file: could not find any valid magic files! (No error)
-# splitted WIM
+# split WIM
>16 ulelong &0x00000008 (SWM
!:ext swm
# usPartNumber; 1, unless the file was split into multiple parts
>>40 uleshort x \b %u
# usTotalParts; The total number of WIM file parts in a spanned set
>>42 uleshort x \b of %u) image
-# non splitted WIM
+# non split WIM
>16 ulelong ^0x00000008
# https://wimlib.net/man1/wimmount.html
# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension
>>12 ulelong 3584 (ESD) image
!:ext esd
->>12 ulelong !3584 (WIM) image
-!:ext wim
+>>12 ulelong !3584 (
+# look for archive member RunTime.xml like in Microsoft.Windows.Cosa.Desktop.Client.ppkg
+>>>156 search/68233/s RunTime.xml \bWindows provisioning package)
+!:ext ppkg
+# if is is not a Windows provisioning package, then it is a WIM
+>>>156 default x \bWIM) image
+# second disk image part created by Microsoft's RecoveryDrive.exe has name Reconstruct.WIM2
+!:ext wim/wim2
>0 string/b WLPWM\000\000\000 \b, wimlib pipable format
# cbSize size of the WIM header in bytes like 208
#>8 ulelong x \b, headersize %u
#------------------------------------------------------------------------------
-# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
+# $File: xenix,v 1.12 2021/02/23 00:51:10 christos Exp $
# xenix: file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# GRR: line above is too general as it catches also Extensible storage engine DataBase
# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
>1 uleshort <1022
-# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
+# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length
>>1 uleshort >0
-# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
+# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length
>>>3 ubyte >0
# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft)
#------------------------------------------------------------------------------
-# $File: zip,v 1.4 2020/03/03 13:46:52 christos Exp $
+# $File: zip,v 1.6 2021/02/05 22:55:36 christos Exp $
# zip: file(1) magic for zip files; this is not use
# Note the version of magic in archive is currently stronger, this is
# just an example until negative offsets are supported better
# Zip Central Directory record
0 name zipcd
>0 string PK\001\002 Zip archive data
+!:mime application/zip
>>4 leshort x \b, made by
>>4 use zipversion
>>4 use ziphost
>>10 use zipcompression
# URL: https://en.wikipedia.org/wiki/Zip_(file_format)
-# reference: https://pkware.cachefly.net/webdocs/APPNOTE/APPNOTE-6.3.6.TXT
+# reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT (Version: 6.3.9)
# Zip known compressions
0 name zipcompression
>0 leshort 0 \bstore
#>0 leshort 13 \bReserved by PKWARE
>0 leshort 14 \blzma
#>0 leshort 15 \bReserved by PKWARE
->0 leshort 16 \bCMPSC Compression
+>0 leshort 16 \bCMPSC (IBM z/OS)
#>0 leshort 17 \bReserved by PKWARE
>0 leshort 18 \bIBM TERSE
->0 leshort 19 \bIBM LZ77
-# https://support.winzip.com/hc/en-us/articles/115012122828-Compression-method-used-for-this-file-is-94
+>0 leshort 19 \bIBM LZ77 (z/Architecture)
+>0 leshort 20 \bZstd (deprecated)
+>0 leshort 93 \bZstd
>0 leshort 94 \bMP3
>0 leshort 95 \bxz
>0 leshort 96 \bJpeg
#
-# $File: Makefile.am,v 1.157 2020/05/21 16:22:47 christos Exp $
+# $File: Makefile.am,v 1.166 2021/03/14 16:24:18 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
$(MAGIC_FRAGMENT_DIR)/acorn \
$(MAGIC_FRAGMENT_DIR)/adi \
$(MAGIC_FRAGMENT_DIR)/adventure \
+$(MAGIC_FRAGMENT_DIR)/aes \
$(MAGIC_FRAGMENT_DIR)/algol68 \
$(MAGIC_FRAGMENT_DIR)/allegro \
$(MAGIC_FRAGMENT_DIR)/alliant \
$(MAGIC_FRAGMENT_DIR)/asterix \
$(MAGIC_FRAGMENT_DIR)/att3b \
$(MAGIC_FRAGMENT_DIR)/audio \
+$(MAGIC_FRAGMENT_DIR)/avm \
$(MAGIC_FRAGMENT_DIR)/basis \
$(MAGIC_FRAGMENT_DIR)/beetle \
$(MAGIC_FRAGMENT_DIR)/ber \
$(MAGIC_FRAGMENT_DIR)/blcr \
$(MAGIC_FRAGMENT_DIR)/blender \
$(MAGIC_FRAGMENT_DIR)/blit \
+$(MAGIC_FRAGMENT_DIR)/bm \
$(MAGIC_FRAGMENT_DIR)/bout \
$(MAGIC_FRAGMENT_DIR)/bsdi \
$(MAGIC_FRAGMENT_DIR)/bsi \
$(MAGIC_FRAGMENT_DIR)/convex \
$(MAGIC_FRAGMENT_DIR)/coverage \
$(MAGIC_FRAGMENT_DIR)/cracklib \
+$(MAGIC_FRAGMENT_DIR)/crypto \
$(MAGIC_FRAGMENT_DIR)/ctags \
$(MAGIC_FRAGMENT_DIR)/ctf \
$(MAGIC_FRAGMENT_DIR)/cubemap \
$(MAGIC_FRAGMENT_DIR)/kerberos \
$(MAGIC_FRAGMENT_DIR)/kicad \
$(MAGIC_FRAGMENT_DIR)/kml \
+$(MAGIC_FRAGMENT_DIR)/lammps \
$(MAGIC_FRAGMENT_DIR)/lecter \
$(MAGIC_FRAGMENT_DIR)/lex \
$(MAGIC_FRAGMENT_DIR)/lif \
$(MAGIC_FRAGMENT_DIR)/linux \
$(MAGIC_FRAGMENT_DIR)/lisp \
$(MAGIC_FRAGMENT_DIR)/llvm \
+$(MAGIC_FRAGMENT_DIR)/locoscript \
$(MAGIC_FRAGMENT_DIR)/lua \
$(MAGIC_FRAGMENT_DIR)/luks \
$(MAGIC_FRAGMENT_DIR)/m4 \
$(MAGIC_FRAGMENT_DIR)/pbm \
$(MAGIC_FRAGMENT_DIR)/pc88 \
$(MAGIC_FRAGMENT_DIR)/pc98 \
+$(MAGIC_FRAGMENT_DIR)/pcjr \
$(MAGIC_FRAGMENT_DIR)/pdf \
$(MAGIC_FRAGMENT_DIR)/pdp \
$(MAGIC_FRAGMENT_DIR)/perl \
$(MAGIC_FRAGMENT_DIR)/pgf \
$(MAGIC_FRAGMENT_DIR)/pgp \
+$(MAGIC_FRAGMENT_DIR)/pgp-binary-keys \
$(MAGIC_FRAGMENT_DIR)/pkgadd \
$(MAGIC_FRAGMENT_DIR)/plan9 \
$(MAGIC_FRAGMENT_DIR)/plus5 \
$(MAGIC_FRAGMENT_DIR)/sql \
$(MAGIC_FRAGMENT_DIR)/ssh \
$(MAGIC_FRAGMENT_DIR)/ssl \
+$(MAGIC_FRAGMENT_DIR)/statistics \
$(MAGIC_FRAGMENT_DIR)/sun \
$(MAGIC_FRAGMENT_DIR)/sylk \
$(MAGIC_FRAGMENT_DIR)/symbos \
MAGIC_NO_CHECK_BUILTIN = NO_CHECK_BUILTIN = 4173824
+MAGIC_PARAM_INDIR_MAX = PARAM_INDIR_MAX = 0
+MAGIC_PARAM_NAME_MAX = PARAM_NAME_MAX = 1
+MAGIC_PARAM_ELF_PHNUM_MAX = PARAM_ELF_PHNUM_MAX = 2
+MAGIC_PARAM_ELF_SHNUM_MAX = PARAM_ELF_SHNUM_MAX = 3
+MAGIC_PARAM_ELF_NOTES_MAX = PARAM_ELF_NOTES_MAX = 4
+MAGIC_PARAM_REGEX_MAX = PARAM_REGEX_MAX = 5
+MAGIC_PARAM_BYTES_MAX = PARAM_BYTES_MAX = 6
+
FileMagic = namedtuple('FileMagic', ('mime_type', 'encoding', 'name'))
_errno.restype = c_int
_errno.argtypes = [magic_t]
+_getparam = _libraries['magic'].magic_getparam
+_getparam.restype = c_int
+_getparam.argtypes = [magic_t, c_int, c_void_p]
+
+_setparam = _libraries['magic'].magic_setparam
+_setparam.restype = c_int
+_setparam.argtypes = [magic_t, c_int, c_void_p]
+
class Magic(object):
def __init__(self, ms):
"""
return _errno(self._magic_t)
+ def getparam(self, param):
+ """
+ Returns the param value if successful and -1 if the parameter
+ was unknown.
+ """
+ v = c_int()
+ i = _getparam(self._magic_t, param, byref(v))
+ if i == -1:
+ return -1
+ return v.value
+
+ def setparam(self, param, value):
+ """
+ Returns 0 if successful and -1 if the parameter was unknown.
+ """
+ v = c_int(value)
+ return _setparam(self._magic_t, param, byref(v))
+
def open(flags):
"""
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: apprentice.c,v 1.297 2020/05/09 18:57:15 christos Exp $")
+FILE_RCSID("@(#)$File: apprentice.c,v 1.301 2021/02/23 00:51:11 christos Exp $")
#endif /* lint */
#include "magic.h"
ms->elf_notes_max = FILE_ELF_NOTES_MAX;
ms->regex_max = FILE_REGEX_MAX;
ms->bytes_max = FILE_BYTES_MAX;
+ ms->encoding_max = FILE_ENCODING_MAX;
return ms;
free:
free(ms);
*/
set_last_default(ms, mset[j].me, mset[j].count);
- /* coalesce per file arrays into a single one */
+ /* coalesce per file arrays into a single one, if needed */
+ if (mset[j].count == 0)
+ continue;
+
if (coalesce_entries(ms, mset[j].me, mset[j].count,
&map->magic[j], &map->nmagic[j]) == -1) {
errs++;
return -1;
}
+ if (m->type == FILE_NAME && cont_level != 0) {
+ if (ms->flags & MAGIC_CHECK)
+ file_magwarn(ms, "`name%s' entries can only be "
+ "declared at top level", l);
+ return -1;
+ }
+
/* New-style anding: "0 byte&0x80 =0x80 dynamically linked" */
/* New and improved: ~ & | ^ + - * / % -- exciting, isn't it? */
ull = CAST(uint64_t, strtoull(*p, &ep, 0));
m->value.q = file_signextend(ms, m, ull);
if (*p == ep) {
- file_magwarn(ms, "Unparseable number `%s'", *p);
+ file_magwarn(ms, "Unparsable number `%s'", *p);
} else {
size_t ts = typesize(m->type);
uint64_t x;
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: ascmagic.c,v 1.107 2020/06/08 19:58:36 christos Exp $")
+FILE_RCSID("@(#)$File: ascmagic.c,v 1.109 2021/02/05 23:01:40 christos Exp $")
#endif /* lint */
#include "magic.h"
#define ISSPC(x) ((x) == ' ' || (x) == '\t' || (x) == '\r' || (x) == '\n' \
|| (x) == 0x85 || (x) == '\f')
-private unsigned char *encode_utf8(unsigned char *, size_t, unichar *, size_t);
+private unsigned char *encode_utf8(unsigned char *, size_t, file_unichar_t *,
+ size_t);
private size_t trim_nuls(const unsigned char *, size_t);
/*
protected int
file_ascmagic(struct magic_set *ms, const struct buffer *b, int text)
{
- unichar *ubuf = NULL;
+ file_unichar_t *ubuf = NULL;
size_t ulen = 0;
int rv = 1;
struct buffer bb;
}
protected int
-file_ascmagic_with_encoding(struct magic_set *ms,
- const struct buffer *b, unichar *ubuf, size_t ulen, const char *code,
- const char *type, int text)
+file_ascmagic_with_encoding(struct magic_set *ms, const struct buffer *b,
+ file_unichar_t *ubuf, size_t ulen, const char *code, const char *type,
+ int text)
{
struct buffer bb;
const unsigned char *buf = CAST(const unsigned char *, b->fbuf);
int executable = 0;
size_t last_line_end = CAST(size_t, -1);
- int has_long_lines = 0;
+ size_t has_long_lines = 0;
nbytes = trim_nuls(buf, nbytes);
}
/* If this line is _longer_ than MAXLINELEN, remember it. */
- if (i > last_line_end + MAXLINELEN)
- has_long_lines = 1;
+ if (i > last_line_end + MAXLINELEN) {
+ size_t ll = i - last_line_end;
+ if (ll > has_long_lines)
+ has_long_lines = ll;
+ }
if (ubuf[i] == '\033')
has_escapes = 1;
goto done;
if (has_long_lines)
- if (file_printf(ms, ", with very long lines") == -1)
+ if (file_printf(ms, ", with very long lines (%zu)",
+ has_long_lines) == -1)
goto done;
/*
if (file_printf(ms, ", with") == -1)
goto done;
- if (n_crlf == 0 && n_cr == 0 && n_nel == 0 && n_lf == 0) {
+ if (n_crlf == 0 && n_cr == 0 &&
+ n_nel == 0 && n_lf == 0) {
if (file_printf(ms, " no") == -1)
goto done;
} else {
* after end of string, or NULL if an invalid character is found.
*/
private unsigned char *
-encode_utf8(unsigned char *buf, size_t len, unichar *ubuf, size_t ulen)
+encode_utf8(unsigned char *buf, size_t len, file_unichar_t *ubuf, size_t ulen)
{
size_t i;
unsigned char *end = buf + len;
if (end - buf < 1)
return NULL;
*buf++ = CAST(unsigned char, ubuf[i]);
- } else if (ubuf[i] <= 0x7ff) {
+ continue;
+ }
+ if (ubuf[i] <= 0x7ff) {
if (end - buf < 2)
return NULL;
*buf++ = CAST(unsigned char, (ubuf[i] >> 6) + 0xc0);
- *buf++ = CAST(unsigned char, (ubuf[i] & 0x3f) + 0x80);
- } else if (ubuf[i] <= 0xffff) {
+ goto out1;
+ }
+ if (ubuf[i] <= 0xffff) {
if (end - buf < 3)
return NULL;
*buf++ = CAST(unsigned char, (ubuf[i] >> 12) + 0xe0);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 6) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, (ubuf[i] & 0x3f) + 0x80);
- } else if (ubuf[i] <= 0x1fffff) {
+ goto out2;
+ }
+ if (ubuf[i] <= 0x1fffff) {
if (end - buf < 4)
return NULL;
*buf++ = CAST(unsigned char, (ubuf[i] >> 18) + 0xf0);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 12) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 6) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, (ubuf[i] & 0x3f) + 0x80);
- } else if (ubuf[i] <= 0x3ffffff) {
+ goto out3;
+ }
+ if (ubuf[i] <= 0x3ffffff) {
if (end - buf < 5)
return NULL;
*buf++ = CAST(unsigned char, (ubuf[i] >> 24) + 0xf8);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 18) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 12) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 6) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, (ubuf[i] & 0x3f) + 0x80);
- } else if (ubuf[i] <= 0x7fffffff) {
+ goto out4;
+ }
+ if (ubuf[i] <= 0x7fffffff) {
if (end - buf < 6)
return NULL;
*buf++ = CAST(unsigned char, (ubuf[i] >> 30) + 0xfc);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 24) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 18) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 12) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, ((ubuf[i] >> 6) & 0x3f) + 0x80);
- *buf++ = CAST(unsigned char, (ubuf[i] & 0x3f) + 0x80);
- } else /* Invalid character */
- return NULL;
+ goto out5;
+ }
+ /* Invalid character */
+ return NULL;
+ out5: *buf++ = CAST(unsigned char, ((ubuf[i] >> 24) & 0x3f) + 0x80);
+ out4: *buf++ = CAST(unsigned char, ((ubuf[i] >> 18) & 0x3f) + 0x80);
+ out3: *buf++ = CAST(unsigned char, ((ubuf[i] >> 12) & 0x3f) + 0x80);
+ out2: *buf++ = CAST(unsigned char, ((ubuf[i] >> 6) & 0x3f) + 0x80);
+ out1: *buf++ = CAST(unsigned char, ((ubuf[i] >> 0) & 0x3f) + 0x80);
}
return buf;
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: compress.c,v 1.127 2020/05/31 00:11:06 christos Exp $")
+FILE_RCSID("@(#)$File: compress.c,v 1.129 2020/12/08 21:26:00 christos Exp $")
#endif
#include "magic.h"
#include <bzlib.h>
#endif
-#if defined(HAVE_XZLIB_H) && defined(XZLIBSUPPORT)
+#if defined(HAVE_LZMA_H) && defined(XZLIBSUPPORT)
#define BUILTIN_XZLIB
#include <lzma.h>
#endif
for (i = 0; i < __arraycount(fdp); i++)
fdp[i][0] = fdp[i][1] = -1;
- if ((fd == -1 && pipe(fdp[STDIN_FILENO]) == -1) ||
- pipe(fdp[STDOUT_FILENO]) == -1 || pipe(fdp[STDERR_FILENO]) == -1) {
+ /*
+ * There are multithreaded users who run magic_file()
+ * from dozens of threads. If two parallel magic_file() calls
+ * analyze two large compressed files, both will spawn
+ * an uncompressing child here, which writes out uncompressed data.
+ * We read some portion, then close the pipe, then waitpid() the child.
+ * If uncompressed data is larger, child shound get EPIPE and exit.
+ * However, with *parallel* calls OTHER child may unintentionally
+ * inherit pipe fds, thus keeping pipe open and making writes in
+ * our child block instead of failing with EPIPE!
+ * (For the bug to occur, two threads must mutually inherit their pipes,
+ * and both must have large outputs. Thus it happens not that often).
+ * To avoid this, be sure to create pipes with O_CLOEXEC.
+ */
+ if ((fd == -1 && file_pipe_closexec(fdp[STDIN_FILENO]) == -1) ||
+ file_pipe_closexec(fdp[STDOUT_FILENO]) == -1 ||
+ file_pipe_closexec(fdp[STDERR_FILENO]) == -1) {
closep(fdp[STDIN_FILENO]);
closep(fdp[STDOUT_FILENO]);
return makeerror(newch, n, "Cannot create pipe, %s",
if (fdp[STDIN_FILENO][1] > 2)
(void) close(fdp[STDIN_FILENO][1]);
}
+ file_clear_closexec(STDIN_FILENO);
+
///FIXME: if one of the fdp[i][j] is 0 or 1, this can bomb spectacularly
if (copydesc(STDOUT_FILENO, fdp[STDOUT_FILENO][1]))
(void) close(fdp[STDOUT_FILENO][1]);
if (fdp[STDOUT_FILENO][0] > 2)
(void) close(fdp[STDOUT_FILENO][0]);
+ file_clear_closexec(STDOUT_FILENO);
if (copydesc(STDERR_FILENO, fdp[STDERR_FILENO][1]))
(void) close(fdp[STDERR_FILENO][1]);
if (fdp[STDERR_FILENO][0] > 2)
(void) close(fdp[STDERR_FILENO][0]);
+ file_clear_closexec(STDERR_FILENO);
(void)execvp(compr[method].argv[0],
RCAST(char *const *, RCAST(intptr_t, compr[method].argv)));
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: der.c,v 1.20 2020/06/07 19:10:37 christos Exp $")
+FILE_RCSID("@(#)$File: der.c,v 1.21 2020/06/15 00:58:10 christos Exp $")
#endif
#else
#define SIZE_T_FORMAT "z"
return snprintf(buf, blen,
"20%c%c-%c%c-%c%c %c%c:%c%c:%c%c GMT", d[0], d[1], d[2],
d[3], d[4], d[5], d[6], d[7], d[8], d[9], d[10], d[11]);
- break;
default:
break;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: encoding.c,v 1.21 2019/06/08 20:49:14 christos Exp $")
+FILE_RCSID("@(#)$File: encoding.c,v 1.27 2021/02/05 21:33:49 christos Exp $")
#endif /* lint */
#include "magic.h"
#include <stdlib.h>
-private int looks_ascii(const unsigned char *, size_t, unichar *, size_t *);
-private int looks_utf8_with_BOM(const unsigned char *, size_t, unichar *,
+private int looks_ascii(const unsigned char *, size_t, file_unichar_t *,
+ size_t *);
+private int looks_utf8_with_BOM(const unsigned char *, size_t, file_unichar_t *,
+ size_t *);
+private int looks_utf7(const unsigned char *, size_t, file_unichar_t *,
+ size_t *);
+private int looks_ucs16(const unsigned char *, size_t, file_unichar_t *,
+ size_t *);
+private int looks_ucs32(const unsigned char *, size_t, file_unichar_t *,
+ size_t *);
+private int looks_latin1(const unsigned char *, size_t, file_unichar_t *,
+ size_t *);
+private int looks_extended(const unsigned char *, size_t, file_unichar_t *,
size_t *);
-private int looks_utf7(const unsigned char *, size_t, unichar *, size_t *);
-private int looks_ucs16(const unsigned char *, size_t, unichar *, size_t *);
-private int looks_ucs32(const unsigned char *, size_t, unichar *, size_t *);
-private int looks_latin1(const unsigned char *, size_t, unichar *, size_t *);
-private int looks_extended(const unsigned char *, size_t, unichar *, size_t *);
private void from_ebcdic(const unsigned char *, size_t, unsigned char *);
#ifdef DEBUG_ENCODING
/*
* Try to determine whether text is in some character code we can
* identify. Each of these tests, if it succeeds, will leave
- * the text converted into one-unichar-per-character Unicode in
+ * the text converted into one-file_unichar_t-per-character Unicode in
* ubuf, and the number of characters converted in ulen.
*/
protected int
-file_encoding(struct magic_set *ms, const struct buffer *b, unichar **ubuf,
- size_t *ulen, const char **code, const char **code_mime, const char **type)
+file_encoding(struct magic_set *ms, const struct buffer *b,
+ file_unichar_t **ubuf, size_t *ulen, const char **code,
+ const char **code_mime, const char **type)
{
const unsigned char *buf = CAST(const unsigned char *, b->fbuf);
size_t nbytes = b->flen;
size_t mlen;
int rv = 1, ucs_type;
unsigned char *nbuf = NULL;
- unichar *udefbuf;
+ file_unichar_t *udefbuf;
size_t udeflen;
if (ubuf == NULL)
*code = "unknown";
*code_mime = "binary";
+ if (nbytes > ms->encoding_max)
+ nbytes = ms->encoding_max;
+
mlen = (nbytes + 1) * sizeof((*ubuf)[0]);
- if ((*ubuf = CAST(unichar *, calloc(CAST(size_t, 1), mlen))) == NULL) {
+ *ubuf = CAST(file_unichar_t *, calloc(CAST(size_t, 1), mlen));
+ if (*ubuf == NULL) {
file_oomem(ms, mlen);
goto done;
}
if (looks_ascii(buf, nbytes, *ubuf, ulen)) {
if (looks_utf7(buf, nbytes, *ubuf, ulen) > 0) {
DPRINTF(("utf-7 %" SIZE_T_FORMAT "u\n", *ulen));
- *code = "UTF-7 Unicode";
+ *code = "Unicode text, UTF-7";
*code_mime = "utf-7";
} else {
DPRINTF(("ascii %" SIZE_T_FORMAT "u\n", *ulen));
}
} else if (looks_utf8_with_BOM(buf, nbytes, *ubuf, ulen) > 0) {
DPRINTF(("utf8/bom %" SIZE_T_FORMAT "u\n", *ulen));
- *code = "UTF-8 Unicode (with BOM)";
+ *code = "Unicode text, UTF-8 (with BOM)";
*code_mime = "utf-8";
} else if (file_looks_utf8(buf, nbytes, *ubuf, ulen) > 1) {
DPRINTF(("utf8 %" SIZE_T_FORMAT "u\n", *ulen));
- *code = "UTF-8 Unicode";
+ *code = "Unicode text, UTF-8";
*code_mime = "utf-8";
} else if ((ucs_type = looks_ucs32(buf, nbytes, *ubuf, ulen)) != 0) {
if (ucs_type == 1) {
- *code = "Little-endian UTF-32 Unicode";
+ *code = "Unicode text, UTF-32, little-endian";
*code_mime = "utf-32le";
} else {
- *code = "Big-endian UTF-32 Unicode";
+ *code = "Unicode text, UTF-32, big-endian";
*code_mime = "utf-32be";
}
DPRINTF(("ucs32 %" SIZE_T_FORMAT "u\n", *ulen));
} else if ((ucs_type = looks_ucs16(buf, nbytes, *ubuf, ulen)) != 0) {
if (ucs_type == 1) {
- *code = "Little-endian UTF-16 Unicode";
+ *code = "Unicode text, UTF-16, little-endian";
*code_mime = "utf-16le";
} else {
- *code = "Big-endian UTF-16 Unicode";
+ *code = "Unicode text, UTF-16, big-endian";
*code_mime = "utf-16be";
}
DPRINTF(("ucs16 %" SIZE_T_FORMAT "u\n", *ulen));
I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I /* 0xfX */
};
-private int
-looks_ascii(const unsigned char *buf, size_t nbytes, unichar *ubuf,
- size_t *ulen)
-{
- size_t i;
-
- *ulen = 0;
-
- for (i = 0; i < nbytes; i++) {
- int t = text_chars[buf[i]];
-
- if (t != T)
- return 0;
-
- ubuf[(*ulen)++] = buf[i];
- }
-
- return 1;
+#define LOOKS(NAME, COND) \
+private int \
+looks_ ## NAME(const unsigned char *buf, size_t nbytes, file_unichar_t *ubuf, \
+ size_t *ulen) \
+{ \
+ size_t i, u; \
+ unsigned char dist[256]; \
+ memset(dist, 0, sizeof(dist)); \
+\
+ *ulen = 0; \
+\
+ for (i = 0; i < nbytes; i++) { \
+ int t = text_chars[buf[i]]; \
+\
+ if (COND) \
+ return 0; \
+\
+ ubuf[(*ulen)++] = buf[i]; \
+ dist[buf[i]]++; \
+ } \
+ u = 0; \
+ for (i = 0; i < __arraycount(dist); i++) { \
+ if (dist[i]) \
+ u++; \
+ } \
+ if (u < 3) \
+ return 0; \
+\
+ return 1; \
}
-private int
-looks_latin1(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen)
-{
- size_t i;
-
- *ulen = 0;
-
- for (i = 0; i < nbytes; i++) {
- int t = text_chars[buf[i]];
-
- if (t != T && t != I)
- return 0;
-
- ubuf[(*ulen)++] = buf[i];
- }
-
- return 1;
-}
-
-private int
-looks_extended(const unsigned char *buf, size_t nbytes, unichar *ubuf,
- size_t *ulen)
-{
- size_t i;
-
- *ulen = 0;
-
- for (i = 0; i < nbytes; i++) {
- int t = text_chars[buf[i]];
-
- if (t != T && t != I && t != X)
- return 0;
-
- ubuf[(*ulen)++] = buf[i];
- }
-
- return 1;
-}
+LOOKS(ascii, t != T)
+LOOKS(latin1, t != T && t != I)
+LOOKS(extended, t != T && t != I && t != X)
/*
* Decide whether some text looks like UTF-8. Returns:
* If ubuf is non-NULL on entry, text is decoded into ubuf, *ulen;
* ubuf must be big enough!
*/
+
+// from: https://golang.org/src/unicode/utf8/utf8.go
+
+#define XX 0xF1 // invalid: size 1
+#define AS 0xF0 // ASCII: size 1
+#define S1 0x02 // accept 0, size 2
+#define S2 0x13 // accept 1, size 3
+#define S3 0x03 // accept 0, size 3
+#define S4 0x23 // accept 2, size 3
+#define S5 0x34 // accept 3, size 4
+#define S6 0x04 // accept 0, size 4
+#define S7 0x44 // accept 4, size 4
+
+#define LOCB 0x80
+#define HICB 0xBF
+
+// first is information about the first byte in a UTF-8 sequence.
+static const uint8_t first[] = {
+ // 1 2 3 4 5 6 7 8 9 A B C D E F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x00-0x0F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x10-0x1F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x20-0x2F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x30-0x3F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x40-0x4F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x50-0x5F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x60-0x6F
+ AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, AS, // 0x70-0x7F
+ // 1 2 3 4 5 6 7 8 9 A B C D E F
+ XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, // 0x80-0x8F
+ XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, // 0x90-0x9F
+ XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, // 0xA0-0xAF
+ XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, // 0xB0-0xBF
+ XX, XX, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, // 0xC0-0xCF
+ S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, S1, // 0xD0-0xDF
+ S2, S3, S3, S3, S3, S3, S3, S3, S3, S3, S3, S3, S3, S4, S3, S3, // 0xE0-0xEF
+ S5, S6, S6, S6, S7, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, XX, // 0xF0-0xFF
+};
+
+// acceptRange gives the range of valid values for the second byte in a UTF-8
+// sequence.
+struct accept_range {
+ uint8_t lo; // lowest value for second byte.
+ uint8_t hi; // highest value for second byte.
+} accept_ranges[16] = {
+// acceptRanges has size 16 to avoid bounds checks in the code that uses it.
+ { LOCB, HICB },
+ { 0xA0, HICB },
+ { LOCB, 0x9F },
+ { 0x90, HICB },
+ { LOCB, 0x8F },
+};
+
protected int
-file_looks_utf8(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen)
+file_looks_utf8(const unsigned char *buf, size_t nbytes, file_unichar_t *ubuf,
+ size_t *ulen)
{
size_t i;
int n;
- unichar c;
+ file_unichar_t c;
int gotone = 0, ctrl = 0;
if (ubuf)
return -1;
} else { /* 11xxxxxx begins UTF-8 */
int following;
+ uint8_t x = first[buf[i]];
+ const struct accept_range *ar = &accept_ranges[x >> 4];
+ if (x == XX)
+ return -1;
if ((buf[i] & 0x20) == 0) { /* 110xxxxx */
c = buf[i] & 0x1f;
if (i >= nbytes)
goto done;
+ if (n == 0 &&
+ (buf[i] < ar->lo || buf[i] > ar->hi))
+ return -1;
+
if ((buf[i] & 0x80) == 0 || (buf[i] & 0x40))
return -1;
* rest of the text.
*/
private int
-looks_utf8_with_BOM(const unsigned char *buf, size_t nbytes, unichar *ubuf,
- size_t *ulen)
+looks_utf8_with_BOM(const unsigned char *buf, size_t nbytes,
+ file_unichar_t *ubuf, size_t *ulen)
{
if (nbytes > 3 && buf[0] == 0xef && buf[1] == 0xbb && buf[2] == 0xbf)
return file_looks_utf8(buf + 3, nbytes - 3, ubuf, ulen);
}
private int
-looks_utf7(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen)
+looks_utf7(const unsigned char *buf, size_t nbytes, file_unichar_t *ubuf,
+ size_t *ulen)
{
if (nbytes > 4 && buf[0] == '+' && buf[1] == '/' && buf[2] == 'v')
switch (buf[3]) {
}
private int
-looks_ucs16(const unsigned char *bf, size_t nbytes, unichar *ubf,
+looks_ucs16(const unsigned char *bf, size_t nbytes, file_unichar_t *ubf,
size_t *ulen)
{
int bigend;
if (bigend)
ubf[(*ulen)++] = bf[i + 1]
- | (CAST(unichar, bf[i]) << 8);
+ | (CAST(file_unichar_t, bf[i]) << 8);
else
ubf[(*ulen)++] = bf[i]
- | (CAST(unichar, bf[i + 1]) << 8);
+ | (CAST(file_unichar_t, bf[i + 1]) << 8);
if (ubf[*ulen - 1] == 0xfffe)
return 0;
}
private int
-looks_ucs32(const unsigned char *bf, size_t nbytes, unichar *ubf,
+looks_ucs32(const unsigned char *bf, size_t nbytes, file_unichar_t *ubf,
size_t *ulen)
{
int bigend;
/* XXX fix to properly handle chars > 65536 */
if (bigend)
- ubf[(*ulen)++] = CAST(unichar, bf[i + 3])
- | (CAST(unichar, bf[i + 2]) << 8)
- | (CAST(unichar, bf[i + 1]) << 16)
- | (CAST(unichar, bf[i]) << 24);
+ ubf[(*ulen)++] = CAST(file_unichar_t, bf[i + 3])
+ | (CAST(file_unichar_t, bf[i + 2]) << 8)
+ | (CAST(file_unichar_t, bf[i + 1]) << 16)
+ | (CAST(file_unichar_t, bf[i]) << 24);
else
- ubf[(*ulen)++] = CAST(unichar, bf[i + 0])
- | (CAST(unichar, bf[i + 1]) << 8)
- | (CAST(unichar, bf[i + 2]) << 16)
- | (CAST(unichar, bf[i + 3]) << 24);
+ ubf[(*ulen)++] = CAST(file_unichar_t, bf[i + 0])
+ | (CAST(file_unichar_t, bf[i + 1]) << 8)
+ | (CAST(file_unichar_t, bf[i + 2]) << 16)
+ | (CAST(file_unichar_t, bf[i + 3]) << 24);
if (ubf[*ulen - 1] == 0xfffe)
return 0;
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: file.c,v 1.187 2020/06/07 17:38:30 christos Exp $")
+FILE_RCSID("@(#)$File: file.c,v 1.189 2021/02/05 21:33:49 christos Exp $")
#endif /* lint */
#include "magic.h"
"max ELF prog sections processed" },
{ "elf_shnum", MAGIC_PARAM_ELF_SHNUM_MAX, 0, 0, FILE_ELF_SHNUM_MAX,
"max ELF sections processed" },
+ { "encoding", MAGIC_PARAM_ENCODING_MAX, 0, 0, FILE_ENCODING_MAX,
+ "max bytes to scan for encoding" },
{ "indir", MAGIC_PARAM_INDIR_MAX, 0, 0, FILE_INDIR_MAX,
"recursion limit for indirection" },
{ "name", MAGIC_PARAM_NAME_MAX, 0, 0, FILE_NAME_MAX,
if (line[len - 1] == '\n')
line[len - 1] = '\0';
e |= process(ms, line, wid);
- if(nobuffer)
- (void)fflush(stdout);
}
free(line);
if (type == NULL) {
(void)printf("ERROR: %s%c", magic_error(ms), c);
- return 1;
} else {
(void)printf("%s%c", type, c);
- return 0;
}
+ if (nobuffer)
+ (void)fflush(stdout);
+ return type == NULL;
}
protected size_t
*/
/*
* file.h - definitions for file(1) program
- * @(#)$File: file.h,v 1.220 2020/06/08 17:38:27 christos Exp $
+ * @(#)$File: file.h,v 1.225 2021/02/05 22:29:07 christos Exp $
*/
#ifndef __file_h__
#define MAX(a,b) (((a) > (b)) ? (a) : (b))
#endif
+#ifndef O_CLOEXEC
+# define O_CLOEXEC 0
+#endif
+
+#ifndef FD_CLOEXEC
+# define FD_CLOEXEC 1
+#endif
+
#define FILE_BADSIZE CAST(size_t, ~0ul)
#define MAXDESC 64 /* max len of text description/MIME type */
#define MAXMIME 80 /* max len of text MIME type */
#endif
};
+struct cont {
+ size_t len;
+ struct level_info *li;
+};
+
#define MAGIC_SETS 2
struct magic_set {
struct mlist *mlist[MAGIC_SETS]; /* list of regular entries */
- struct cont {
- size_t len;
- struct level_info *li;
- } c;
+ struct cont c;
struct out {
char *buf; /* Accumulation buffer */
size_t blen; /* Length of buffer */
uint16_t elf_notes_max;
uint16_t regex_max;
size_t bytes_max; /* number of bytes to read from file */
+ size_t encoding_max; /* bytes to look for encoding */
#ifndef FILE_BYTES_MAX
# define FILE_BYTES_MAX (1024 * 1024) /* how much of the file to look at */
#endif
#define FILE_INDIR_MAX 50
#define FILE_NAME_MAX 50
#define FILE_REGEX_MAX 8192
+#define FILE_ENCODING_MAX (64 * 1024)
};
/* Type for Unicode characters */
-typedef unsigned long unichar;
+typedef unsigned long file_unichar_t;
struct stat;
#define FILE_T_LOCAL 1
protected int file_ascmagic(struct magic_set *, const struct buffer *,
int);
protected int file_ascmagic_with_encoding(struct magic_set *,
- const struct buffer *, unichar *, size_t, const char *, const char *, int);
+ const struct buffer *, file_unichar_t *, size_t, const char *, const char *, int);
protected int file_encoding(struct magic_set *, const struct buffer *,
- unichar **, size_t *, const char **, const char **, const char **);
+ file_unichar_t **, size_t *, const char **, const char **, const char **);
protected int file_is_json(struct magic_set *, const struct buffer *);
protected int file_is_csv(struct magic_set *, const struct buffer *, int);
protected int file_is_tar(struct magic_set *, const struct buffer *);
protected const char *file_getbuffer(struct magic_set *);
protected ssize_t sread(int, void *, size_t, int);
protected int file_check_mem(struct magic_set *, unsigned int);
-protected int file_looks_utf8(const unsigned char *, size_t, unichar *,
+protected int file_looks_utf8(const unsigned char *, size_t, file_unichar_t *,
size_t *);
protected size_t file_pstring_length_size(struct magic_set *,
const struct magic *);
protected int file_os2_apptype(struct magic_set *, const char *, const void *,
size_t);
#endif /* __EMX__ */
+protected int file_pipe_closexec(int *);
+protected int file_clear_closexec(int);
+protected char *file_strtrim(char *);
protected void buffer_init(struct buffer *, int, const struct stat *,
const void *, size_t);
* The first column specifies the short name, if any, or 0 if none.
* The second column specifies the long name.
* The third column specifies whether it takes a parameter.
- * The fourth colums specifies whether is is marked as "default"
+ * The fourth columns specifies whether is is marked as "default"
* if POSIXLY_CORRECT is defined: 1,
* if POSIXLY_CORRECT is not defined: 2.
* The fifth column is the documentation.
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: funcs.c,v 1.115 2020/02/20 15:50:20 christos Exp $")
+FILE_RCSID("@(#)$File: funcs.c,v 1.121 2021/02/05 22:29:07 christos Exp $")
#endif /* lint */
#include "magic.h"
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
+#ifdef HAVE_UNISTD_H
+#include <unistd.h> /* for pipe2() */
+#endif
#if defined(HAVE_WCHAR_H)
#include <wchar.h>
#endif
if (*++p == '%')
continue;
// Skip uninteresting.
- while (strchr("0.'+- ", *p) != NULL)
+ while (strchr("#0.'+- ", *p) != NULL)
p++;
if (*p == '*') {
if (msg)
}
#ifndef COMPILE_ONLY
+#define FILE_SEPARATOR "\n- "
protected int
file_separator(struct magic_set *ms)
{
- return file_printf(ms, "\n- ");
+ return file_printf(ms, FILE_SEPARATOR);
+}
+
+static void
+trim_separator(struct magic_set *ms)
+{
+ size_t l;
+
+ if (ms->o.buf == NULL)
+ return;
+
+ l = strlen(ms->o.buf);
+ if (l < sizeof(FILE_SEPARATOR))
+ return;
+
+ l -= sizeof(FILE_SEPARATOR) - 1;
+ if (strcmp(ms->o.buf + l, FILE_SEPARATOR) != 0)
+ return;
+
+ ms->o.buf[l] = '\0';
}
static int
rv = -1;
}
done:
+ trim_separator(ms);
if ((ms->flags & MAGIC_MIME_ENCODING) != 0) {
if (ms->flags & MAGIC_MIME_TYPE)
if (file_printf(ms, "; charset=") == -1)
protected int
file_parse_guid(const char *s, uint64_t *guid)
{
- struct guid *g = CAST(struct guid *, guid);
+ struct guid *g = CAST(struct guid *, CAST(void *, guid));
return sscanf(s,
"%8x-%4hx-%4hx-%2hhx%2hhx-%2hhx%2hhx%2hhx%2hhx%2hhx%2hhx",
&g->data1, &g->data2, &g->data3, &g->data4[0], &g->data4[1],
protected int
file_print_guid(char *str, size_t len, const uint64_t *guid)
{
- const struct guid *g = CAST(const struct guid *, guid);
+ const struct guid *g = CAST(const struct guid *,
+ CAST(const void *, guid));
return snprintf(str, len, "%.8X-%.4hX-%.4hX-%.2hhX%.2hhX-"
"%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX",
g->data4[2], g->data4[3], g->data4[4], g->data4[5],
g->data4[6], g->data4[7]);
}
+
+protected int
+file_pipe_closexec(int *fds)
+{
+#ifdef HAVE_PIPE2
+ return pipe2(fds, O_CLOEXEC);
+#else
+ if (pipe(fds) == -1)
+ return -1;
+ (void)fcntl(fds[0], F_SETFD, FD_CLOEXEC);
+ (void)fcntl(fds[1], F_SETFD, FD_CLOEXEC);
+ return 0;
+#endif
+}
+
+protected int
+file_clear_closexec(int fd) {
+ return fcntl(fd, F_SETFD, 0);
+}
+
+protected char *
+file_strtrim(char *str)
+{
+ char *last;
+
+ while (isspace(CAST(unsigned char, *str)))
+ str++;
+ last = str;
+ while (*last)
+ last++;
+ --last;
+ while (isspace(CAST(unsigned char, *last)))
+ last--;
+ *++last = '\0';
+ return str;
+}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: is_csv.c,v 1.4 2019/06/26 20:31:31 christos Exp $")
+FILE_RCSID("@(#)$File: is_csv.c,v 1.6 2020/08/09 16:43:36 christos Exp $")
#endif
#include <string.h>
size_t nf = 0, tf = 0, nl = 0;
while (uc < ue) {
- unsigned char c;
- switch (c = *uc++) {
+ switch (*uc++) {
case '"':
// Eat until the matching quote
uc = eatquote(uc, ue);
return 1;
if (mime) {
- if (file_printf(ms, "application/csv") == -1)
+ if (file_printf(ms, "text/csv") == -1)
return -1;
return 1;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: magic.c,v 1.112 2020/06/08 19:44:10 christos Exp $")
+FILE_RCSID("@(#)$File: magic.c,v 1.114 2021/02/05 21:33:49 christos Exp $")
#endif /* lint */
#include "magic.h"
_setmode(STDIN_FILENO, O_BINARY);
#endif
if (inname != NULL) {
- int flags = O_RDONLY|O_BINARY|O_NONBLOCK;
+ int flags = O_RDONLY|O_BINARY|O_NONBLOCK|O_CLOEXEC;
errno = 0;
if ((fd = open(inname, flags)) < 0) {
okstat = stat(inname, &sb) == 0;
rv = 0;
goto done;
}
+#if O_CLOEXEC == 0
+ (void)fcntl(fd, F_SETFD, FD_CLOEXEC);
+#endif
}
if (fd != -1) {
case MAGIC_PARAM_BYTES_MAX:
ms->bytes_max = *CAST(const size_t *, val);
return 0;
+ case MAGIC_PARAM_ENCODING_MAX:
+ ms->encoding_max = *CAST(const size_t *, val);
+ return 0;
default:
errno = EINVAL;
return -1;
case MAGIC_PARAM_BYTES_MAX:
*CAST(size_t *, val) = ms->bytes_max;
return 0;
+ case MAGIC_PARAM_ENCODING_MAX:
+ *CAST(size_t *, val) = ms->encoding_max;
+ return 0;
default:
errno = EINVAL;
return -1;
#define MAGIC_PARAM_ELF_NOTES_MAX 4
#define MAGIC_PARAM_REGEX_MAX 5
#define MAGIC_PARAM_BYTES_MAX 6
+#define MAGIC_PARAM_ENCODING_MAX 7
int magic_setparam(magic_t, int, const void *);
int magic_getparam(magic_t, int, void *);
--- /dev/null
+/*
+ * Copyright (c) Christos Zoulas 2021.
+ * All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice immediately at the beginning of the file, without modification,
+ * this list of conditions, and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+#include <stdlib.h>
+#include <err.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <dlfcn.h>
+#include <magic.h>
+
+void *
+malloc(size_t len)
+{
+ char buf[512];
+ void *(*orig)(size_t) = dlsym(RTLD_NEXT, "malloc");
+ void *p = (*orig)(len);
+ int l = snprintf(buf, sizeof(buf), "malloc %zu %p\n", len, p);
+ write(2, buf, l);
+ return p;
+}
+
+void
+free(void *p)
+{
+ char buf[512];
+ void (*orig)(void *) = dlsym(RTLD_NEXT, "free");
+ (*orig)(p);
+ int l = snprintf(buf, sizeof(buf), "free %p\n", p);
+ write(2, buf, l);
+}
+
+void *
+calloc(size_t len, size_t nitems)
+{
+ char buf[512];
+ void *(*orig)(size_t, size_t) = dlsym(RTLD_NEXT, "calloc");
+ void *p = (*orig)(len, nitems);
+ size_t tot = len * nitems;
+ int l = snprintf(buf, sizeof(buf), "calloc %zu %p\n", tot, p);
+ write(2, buf, l);
+ return p;
+}
+void *
+realloc(void *q, size_t len)
+{
+ char buf[512];
+ void *(*orig)(void *, size_t) = dlsym(RTLD_NEXT, "realloc");
+ void *p = (*orig)(q, len);
+ int l = snprintf(buf, sizeof(buf), "realloc %zu %p\n", len, p);
+ write(2, buf, l);
+ return p;
+}
+
+static void
+usage(void)
+{
+ fprintf(stderr, "Usage: test [-b] <filename>\n");
+ exit(EXIT_FAILURE);
+}
+
+int
+main(int argc, char *argv[])
+{
+ bool buf = false;
+ int c;
+
+ while ((c = getopt(argc, argv, "b")) != -1)
+ switch (c) {
+ case 'b':
+ buf = true;
+ break;
+ default:
+ usage();
+ }
+
+ argc -= optind;
+ argv += optind;
+
+ if (argc == 0)
+ usage();
+
+ magic_t m = magic_open(0);
+ if (m == NULL)
+ err(EXIT_FAILURE, "magic_open");
+
+ magic_load(m, NULL);
+
+ const char *r;
+ if (buf) {
+ int fd = open(argv[0], O_RDONLY);
+ if (fd == -1)
+ err(EXIT_FAILURE, "Cannot open `%s'", argv[0]);
+
+ struct stat st;
+ if (fstat(fd, &st) == -1)
+ err(EXIT_FAILURE, "Cannot stat `%s'", argv[0]);
+ size_t l = (size_t)st.st_size;
+ void *p = mmap(NULL, l, PROT_READ, MAP_FILE | MAP_PRIVATE, fd,
+ (off_t)0);
+ if (p == MAP_FAILED)
+ err(EXIT_FAILURE, "Cannot map `%s'", argv[0]);
+ close(fd);
+ r = magic_buffer(m, p, l);
+ munmap(p, l);
+ } else {
+ r = magic_file(m, argv[0]);
+ }
+ magic_close(m);
+
+ printf("%s\n", r ? r : "(null)");
+
+ return 0;
+}
+++ /dev/null
-#define FILE_VERSION_MAJOR 5
-#define patchlevel 6
-
-/*
- * Patchlevel file for Ian Darwin's MAGIC command.
- * $File: patchlevel.h,v 1.76 2011/01/17 16:40:41 christos Exp $
- *
- * $Log: patchlevel.h,v $
- * Revision 1.77 2011/04/15 22:07:27 christos
- * fix the patchlevel.
- *
- * Revision 1.76 2011/01/17 16:40:41 christos
- * welcome to 5_05
- *
- * Revision 1.75 2010/01/22 21:08:13 christos
- * welcome to 5.04
- *
- * Revision 1.74 2009/05/06 20:32:48 christos
- * welcome to 5.03
- *
- * Revision 1.73 2009/05/04 15:15:13 christos
- * 5.02...
- *
- * Revision 1.72 2009/04/30 21:20:15 christos
- * 5.01 we are almost here.
- *
- * Revision 1.71 2009/01/21 19:09:42 christos
- * file 5.0
- *
- * Revision 1.70 2008/08/30 10:01:01 christos
- * file 4.26
- *
- * Revision 1.69 2008/07/02 15:27:05 christos
- * welcome to 4.25
- *
- * Revision 1.68 2008/03/22 21:39:43 christos
- * file 4.24
- *
- * Revision 1.67 2007/12/28 20:08:40 christos
- * welcome to 4.23.
- *
- * Revision 1.66 2007/12/27 16:38:24 christos
- * welcome to 4.22
- *
- * Revision 1.65 2007/05/24 17:22:27 christos
- * Welcome to 4.21
- *
- * Revision 1.64 2007/03/01 22:14:55 christos
- * welcome to 4.20
- *
- * Revision 1.63 2007/01/12 17:38:28 christos
- * Use File id.
- *
- * Revision 1.62 2006/12/11 21:49:58 christos
- * time for 4.19
- *
- * Revision 1.61 2006/10/31 21:18:09 christos
- * bump
- *
- * Revision 1.60 2006/03/02 22:15:12 christos
- * welcome to 4.17
- *
- * Revision 1.59 2005/10/17 17:15:21 christos
- * welcome to 4.16
- *
- * Revision 1.58 2005/08/18 15:52:56 christos
- * welcome to 4.15
- *
- * Revision 1.57 2005/06/25 15:52:14 christos
- * Welcome to 4.14
- *
- * Revision 1.56 2005/02/09 19:25:13 christos
- * Welcome to 4.13
- *
- * Revision 1.55 2004/11/24 18:57:47 christos
- * Re-do the autoconf stuff once more; passes make dist now.
- *
- * Revision 1.54 2004/11/21 05:52:05 christos
- * ready for 4.11
- *
- * Revision 1.53 2004/07/24 20:40:46 christos
- * welcome to 4.10
- *
- * Revision 1.52 2004/04/07 00:32:25 christos
- * welcome to 4.09
- *
- * Revision 1.51 2004/03/22 21:17:11 christos
- * welcome to 4.08.
- *
- * Revision 1.50 2003/12/23 17:34:04 christos
- * 4.07
- *
- * Revision 1.49 2003/10/15 02:08:27 christos
- * welcome to 4.06
- *
- * Revision 1.48 2003/09/12 19:41:14 christos
- * this is 4.04
- *
- * Revision 1.47 2003/05/23 21:38:21 christos
- * welcome to 4.03
- *
- * Revision 1.46 2003/04/02 18:57:43 christos
- * prepare for 4.02
- *
- * Revision 1.45 2003/03/26 15:37:25 christos
- * - Pass lint
- * - make NULL in magic_file mean stdin
- * - Fix "-" argument to file to pass NULL to magic_file
- * - avoid pointer casts by using memcpy
- * - rename magic_buf -> magic_buffer
- * - keep only the first error
- * - manual page: new sentence, new line
- * - fix typo in api function (magic_buf -> magic_buffer)
- *
- * Revision 1.44 2003/03/23 22:23:31 christos
- * finish librarification.
- *
- * Revision 1.43 2003/03/23 21:16:26 christos
- * update copyrights.
- *
- * Revision 1.42 2003/03/23 04:06:05 christos
- * Library re-organization
- *
- * Revision 1.41 2003/02/27 20:53:45 christos
- * - fix memory allocation problem (Jeff Johnson)
- * - fix stack overflow corruption (David Endler)
- * - fixes from NetBSD source (Antti Kantee)
- * - magic fixes
- *
- * Revision 1.40 2003/02/08 18:33:53 christos
- * - detect inttypes.h too (Dave Love <d.love@dl.ac.uk>)
- * - eliminate unsigned char warnings (Petter Reinholdtsen <pere@hungry.com>)
- * - better elf PT_NOTE handling (Nalin Dahyabhai <nalin@redhat.com>)
- * - add options to format the output differently
- * - much more magic.
- *
- * Revision 1.39 2002/07/03 18:57:52 christos
- * - ansify/c99ize
- * - more magic
- * - better COMPILE_ONLY support.
- * - new magic files.
- * - fix solaris compilation problems.
- *
- * Revision 1.38 2002/05/16 18:45:56 christos
- * - pt_note elf additions from NetBSD
- * - EMX os specific changes (Alexander Mai)
- * - stdint.h detection, acconfig.h fixes (Maciej W. Rozycki, Franz Korntner)
- * - regex file additions (Kim Cromie)
- * - getopt_long support and misc cleanups (Michael Piefel)
- * - many magic fixes and additions
- *
- * Revision 1.37 2001/09/03 14:44:22 christos
- * daylight/tm_isdst detection
- * magic fixes
- * don't eat the whole file if it has only nulls
- *
- * Revision 1.36 2001/07/22 21:04:15 christos
- * - magic fixes
- * - add new operators, pascal strings, UTC date printing, $HOME/.magic
- * [from "Tom N Harris" <telliamed@mac.com>]
- *
- * Revision 1.35 2001/04/24 14:40:25 christos
- * - rename magic file sgi to mips and fix it
- * - add support for building magic.mgc
- * - portability fixes for mmap()
- * - try gzip before uncompress, because uncompress sometimes hangs
- * - be more conservative about pipe reads and writes
- * - many magic fixes
- *
- * Revision 1.34 2001/03/12 05:05:57 christos
- * - new compiled magic format
- * - lots of magic additions
- *
- * Revision 1.33 2000/11/13 00:30:50 christos
- * - wordperfect magic fix: freebsd pr 9388
- * - more msdos fixes from freebsd pr's 20131 and 20812
- * - sas and spss magic [Bruce Foster]
- * - mkinstalldirs [John Fremlin]
- * - sgi opengl fixes [Michael Pruett]
- * - netbsd magic fixes [Ignatios Souvatzis]
- * - audio additions [Michael Pruett]
- * - fix problem with non ansi RCSID [Andreas Ley]
- * - oggs magic [Felix von Leitner]
- * - gmon magic [Eugen Dedu]
- * - TNEF magic [Joomy]
- * - netpbm magic and misc other image stuff [Bryan Henderson]
- *
- * Revision 1.32 2000/08/05 18:24:18 christos
- * Correct indianness detection in elf (Charles Hannum)
- * FreeBSD elf core support (Guy Harris)
- * Use gzip in systems that don't have uncompress (Anthon van der Neut)
- * Internationalization/EBCDIC support (Eric Fisher)
- * Many many magic changes
- *
- * Revision 1.31 2000/05/14 17:58:36 christos
- * - new magic for claris files
- * - new magic for mathematica and maple files
- * - new magic for msvc files
- * - new -k flag to keep going matching all possible entries
- * - add the word executable on #! magic files, and fix the usage of
- * the word script
- * - lots of other magic fixes
- * - fix typo test -> text
- *
- * Revision 1.30 2000/04/11 02:41:17 christos
- * - add support for mime output (-i)
- * - make sure we free memory in case realloc fails
- * - magic fixes
- *
- * Revision 1.29 1999/11/28 20:02:29 christos
- * new string/[Bcb] magic from anthon, and adjustments to the magic files to
- * use it.
- *
- * Revision 1.28 1999/10/31 22:11:48 christos
- * - add "char" type for compatibility with HP/UX
- * - recognize HP/UX syntax &=n etc.
- * - include errno.h for CYGWIN
- * - conditionalize the S_IS* macros
- * - revert the SHT_DYNSYM test that broke the linux stripped binaries test
- * - lots of Magdir changes
- *
- * Revision 1.27 1999/02/14 17:21:41 christos
- * Automake support and misc cleanups from Rainer Orth
- * Enable reading character and block special files from Dale R. Worley
- *
- * Revision 1.26 1998/09/12 13:19:39 christos
- * - add support for bi-endian indirect offsets (Richard Verhoeven)
- * - add recognition for bcpl (Joseph Myers)
- * - remove non magic files from Magdir to avoid difficulties building
- * on os2 where files are case independent
- * - magic fixes.
- *
- * Revision 1.25 1998/06/27 14:04:04 christos
- * OLF patch Guy Harris
- * Recognize java/html (debian linux)
- * Const poisoning (debian linux)
- * More magic!
- *
- * Revision 1.24 1998/02/15 23:20:38 christos
- * Autoconf patch: Felix von Leitner <leitner@math.fu-berlin.de>
- * More magic fixes
- * Elf64 fixes
- *
- * Revision 1.23 1997/11/05 16:03:37 christos
- * - correct elf prps offset for SunOS-2.5.1 [guy@netapp.com]
- * - handle 64 bit time_t's correctly [ewt@redhat.com]
- * - new mime style magic [clarosse@netvista.net]
- * - new TI calculator magic [rmcguire@freenet.columbus.oh.us]
- * - new figlet fonts [obrien@freebsd.org]
- * - new cisco magic, and elf fixes [jhawk@bbnplanet.com]
- * - -b flag addition, and x86 filesystem magic [vax@linkhead.paranoia.com]
- * - s/Mpeg/MPEG, header and elf typo fixes [guy@netapp.com]
- * - Windows/NT registry files, audio code [guy@netapp.com]
- * - libGrx graphics lib fonts [guy@netapp.com]
- * - PNG fixes [guy@netapp.com]
- * - more m$ document magic [guy@netapp.com]
- * - PPD files [guy@netapp.com]
- * - archive magic cleanup [guy@netapp.com]
- * - linux kernel magic cleanup [guy@netapp.com]
- * - lecter magic [guy@netapp.com]
- * - vgetty magic [guy@netapp.com]
- * - sniffer additions [guy@netapp.com]
- *
- * Revision 1.22 1997/01/15 17:23:24 christos
- * - add support for elf core files: find the program name under SVR4 [Ken Pizzini]
- * - print strings only up to the first carriage return [various]
- * - freebsd international ascii support [J Wunsch]
- * - magic fixes and additions [Guy Harris]
- * - 64 bit fixes [Larry Schwimmer]
- * - support for both utime and utimes, but don't restore file access times
- * by default [various]
- * - \xXX only takes 2 hex digits, not 3.
- * - re-implement support for core files [Guy Harris]
- *
- * Revision 1.21 1996/10/05 18:15:29 christos
- * Segregate elf stuff and conditionally enable it with -DBUILTIN_ELF
- * More magic fixes
- *
- * Revision 1.20 1996/06/22 22:15:52 christos
- * - support relative offsets of the form >&
- * - fix bug with truncating magic strings that contain \n
- * - file -f - did not read from stdin as documented
- * - support elf file parsing using our own elf support.
- * - as always magdir fixes and additions.
- *
- * Revision 1.19 1995/10/27 23:14:46 christos
- * Ability to parse colon separated list of magic files
- * New LEGAL.NOTICE
- * Various magic file changes
- *
- * Revision 1.18 1995/05/20 22:09:21 christos
- * Passed incorrect argument to eatsize().
- * Use %ld and %lx where appropriate.
- * Remove unused variables
- * ELF support for both big and little endian
- * Fixes for small files again.
- *
- * Revision 1.17 1995/04/28 17:29:13 christos
- * - Incorrect nroff detection fix from der Mouse
- * - Lost and incorrect magic entries.
- * - Added ELF stripped binary detection [in C; ugh]
- * - Look for $MAGIC to find the magic file.
- * - Eat trailing size specifications from numbers i.e. ignore 10L
- * - More fixes for very short files
- *
- * Revision 1.16 1995/03/25 22:06:45 christos
- * - use strtoul() where it exists.
- * - fix sign-extend bug
- * - try to detect tar archives before nroff files, otherwise
- * tar files where the first file starts with a . will not work
- *
- * Revision 1.15 1995/01/21 21:03:35 christos
- * Added CSECTION for the file man page
- * Added version flag -v
- * Fixed bug with -f input flag (from iorio@violet.berkeley.edu)
- * Lots of magic fixes and reorganization...
- *
- * Revision 1.14 1994/05/03 17:58:23 christos
- * changes from mycroft@gnu.ai.mit.edu (Charles Hannum) for unsigned
- *
- * Revision 1.13 1994/01/21 01:27:01 christos
- * Fixed null termination bug from Don Seeley at BSDI in ascmagic.c
- *
- * Revision 1.12 1993/10/27 20:59:05 christos
- * Changed -z flag to understand gzip format too.
- * Moved builtin compression detection to a table, and move
- * the compress magic entry out of the source.
- * Made printing of numbers unsigned, and added the mask to it.
- * Changed the buffer size to 8k, because gzip will refuse to
- * unzip just a few bytes.
- *
- * Revision 1.11 1993/09/24 18:49:06 christos
- * Fixed small bug in softmagic.c introduced by
- * copying the data to be examined out of the input
- * buffer. Changed the Makefile to use sed to create
- * the correct man pages.
- *
- * Revision 1.10 1993/09/23 21:56:23 christos
- * Passed purify. Fixed indirections. Fixed byte order printing.
- * Fixed segmentation faults caused by referencing past the end
- * of the magic buffer. Fixed bus errors caused by referencing
- * unaligned shorts or longs.
- *
- * Revision 1.9 1993/03/24 14:23:40 ian
- * Batch of minor changes from several contributors.
- *
- * Revision 1.8 93/02/19 15:01:26 ian
- * Numerous changes from Guy Harris too numerous to mention but including
- * byte-order independance, fixing "old-style masking", etc. etc. A bugfix
- * for broken symlinks from martin@@d255s004.zfe.siemens.de.
- *
- * Revision 1.7 93/01/05 14:57:27 ian
- * Couple of nits picked by Christos (again, thanks).
- *
- * Revision 1.6 93/01/05 13:51:09 ian
- * Lotsa work on the Magic directory.
- *
- * Revision 1.5 92/09/14 14:54:51 ian
- * Fix a tiny null-pointer bug in previous fix for tar archive + uncompress.
- *
- */
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.173 2020/06/07 22:12:54 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.175 2020/12/17 20:43:37 christos Exp $")
#endif
#ifdef BUILTIN_ELF
size_t offset, len;
unsigned char nbuf[BUFSIZ];
ssize_t bufsize;
- off_t ph_off = off;
+ off_t ph_off = off, offs;
int ph_num = num;
if (ms->flags & MAGIC_MIME)
for ( ; num; num--) {
if (pread(fd, xph_addr, xph_sizeof, off) <
CAST(ssize_t, xph_sizeof)) {
- file_badread(ms);
- return -1;
+ if (file_printf(ms,
+ ", can't read elf program headers at %jd",
+ (intmax_t)off) == -1)
+ return -1;
+ return 0;
}
off += size;
* in the section.
*/
len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf);
- if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) {
- file_badread(ms);
- return -1;
+ offs = xph_offset;
+ if ((bufsize = pread(fd, nbuf, len, offs)) == -1) {
+ if (file_printf(ms, " can't read note section at %jd",
+ (intmax_t)offs) == -1)
+ return -1;
+ return 0;
}
offset = 0;
for (;;) {
for ( ; num; num--) {
if (pread(fd, xph_addr, xph_sizeof, off) <
CAST(ssize_t, xph_sizeof)) {
- file_badread(ms);
- return -1;
+ if (file_printf(ms,
+ ", can't read elf program header at %jd",
+ (intmax_t)off) == -1)
+ return -1;
+ return 0;
+
}
off += xph_sizeof;
fsize, virtaddr);
if (offset < 0 ||
(buflen = pread(fd, buf, CAST(size_t, buflen), offset)) <= 0) {
- file_badread(ms);
+ if (file_printf(ms, ", can't read elf string at %jd",
+ (intmax_t)offset) == -1)
+ return -1;
return 0;
}
private size_t
dodynamic(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
- int clazz, int swap)
+ int clazz, int swap, int *pie, size_t *need)
{
Elf32_Dyn dh32;
Elf64_Dyn dh64;
switch (xdh_tag) {
case DT_FLAGS_1:
+ *pie = 1;
if (xdh_val & DF_1_PIE)
ms->mode |= 0111;
else
ms->mode &= ~0111;
break;
+ case DT_NEEDED:
+ (*need)++;
+ break;
default:
break;
}
int stripped = 1, has_debug_info = 0;
size_t nbadcap = 0;
void *nbuf;
- off_t noff, coff, name_off;
+ off_t noff, coff, name_off, offs;
uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilities */
uint64_t cap_sf1 = 0; /* SunOS 5.x software capabilities */
char name[50];
}
/* Read offset of name section to be able to read section names later */
- if (pread(fd, xsh_addr, xsh_sizeof, CAST(off_t, (off + size * strtab)))
- < CAST(ssize_t, xsh_sizeof)) {
- if (file_printf(ms, ", missing section headers") == -1)
+ offs = CAST(off_t, (off + size * strtab));
+ if (pread(fd, xsh_addr, xsh_sizeof, offs) < CAST(ssize_t, xsh_sizeof)) {
+ if (file_printf(ms, ", missing section headers at %jd",
+ (intmax_t)offs) == -1)
return -1;
return 0;
}
for ( ; num; num--) {
/* Read the name of this section. */
- if ((namesize = pread(fd, name, sizeof(name) - 1,
- name_off + xsh_name)) == -1) {
- file_badread(ms);
- return -1;
+ offs = name_off + xsh_name;
+ if ((namesize = pread(fd, name, sizeof(name) - 1, offs))
+ == -1) {
+ if (file_printf(ms,
+ ", can't read name of elf section at %jd",
+ (intmax_t)offs) == -1)
+ return -1;
+ return 0;
}
name[namesize] = '\0';
if (strcmp(name, ".debug_info") == 0) {
if (pread(fd, xsh_addr, xsh_sizeof, off) <
CAST(ssize_t, xsh_sizeof)) {
- file_badread(ms);
- return -1;
+ if (file_printf(ms, ", can't read elf section at %jd",
+ (intmax_t)off) == -1)
+ return -1;
+ return 0;
}
off += size;
" for note");
return -1;
}
- if (pread(fd, nbuf, xsh_size, xsh_offset) <
+ offs = xsh_offset;
+ if (pread(fd, nbuf, xsh_size, offs) <
CAST(ssize_t, xsh_size)) {
- file_badread(ms);
free(nbuf);
- return -1;
+ if (file_printf(ms,
+ ", can't read elf note at %jd",
+ (intmax_t)offs) == -1)
+ return -1;
+ return 0;
}
noff = 0;
}
/*
- * Look through the program headers of an executable image, searching
- * for a PT_INTERP section; if one is found, it's dynamically linked,
- * otherwise it's statically linked.
+ * Look through the program headers of an executable image, to determine
+ * if it is statically or dynamically linked. If it has a dynamic section,
+ * it is pie, and does not have an interpreter or needed libraries, we
+ * call it static pie.
*/
private int
dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
{
Elf32_Phdr ph32;
Elf64_Phdr ph64;
- const char *linking_style = "statically";
+ const char *linking_style;
unsigned char nbuf[BUFSIZ];
char ibuf[BUFSIZ];
char interp[BUFSIZ];
ssize_t bufsize;
- size_t offset, align, len;
+ size_t offset, align, len, need = 0;
+ int pie = 0, dynamic = 0;
if (num == 0) {
if (file_printf(ms, ", no program header") == -1)
int doread;
if (pread(fd, xph_addr, xph_sizeof, off) <
CAST(ssize_t, xph_sizeof)) {
- file_badread(ms);
- return -1;
+ if (file_printf(ms,
+ ", can't read elf program headers at %jd",
+ (intmax_t)off) == -1)
+ return -1;
+ return 0;
}
off += size;
switch (xph_type) {
case PT_DYNAMIC:
doread = 1;
- linking_style = "dynamically";
break;
case PT_NOTE:
if (sh_num) /* Did this through section headers */
if (doread) {
len = xph_filesz < sizeof(nbuf) ? xph_filesz
: sizeof(nbuf);
- bufsize = pread(fd, nbuf, len, xph_offset);
+ off_t offs = xph_offset;
+ bufsize = pread(fd, nbuf, len, offs);
if (bufsize == -1) {
- file_badread(ms);
- return -1;
+ if (file_printf(ms,
+ ", can't read section at %jd",
+ (intmax_t)offs) == -1)
+ return -1;
+ return 0;
}
} else
len = 0;
/* Things we can determine when we seek */
switch (xph_type) {
case PT_DYNAMIC:
+ dynamic = 1;
offset = 0;
// Let DF_1 determine if we are PIE or not.
ms->mode &= ~0111;
if (offset >= CAST(size_t, bufsize))
break;
offset = dodynamic(ms, nbuf, offset,
- CAST(size_t, bufsize), clazz, swap);
+ CAST(size_t, bufsize), clazz, swap,
+ &pie, &need);
if (offset == 0)
break;
}
break;
case PT_INTERP:
+ need++;
if (ms->flags & MAGIC_MIME)
continue;
if (bufsize && nbuf[0]) {
}
if (ms->flags & MAGIC_MIME)
return 0;
- if (file_printf(ms, ", %s linked", linking_style)
- == -1)
+ if (dynamic) {
+ if (pie && need == 0)
+ linking_style = "static-pie";
+ else
+ linking_style = "dynamically";
+ } else {
+ linking_style = "statically";
+ }
+ if (file_printf(ms, ", %s linked", linking_style) == -1)
return -1;
if (interp[0])
if (file_printf(ms, ", interpreter %s",
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: seccomp.c,v 1.15 2020/05/30 23:56:26 christos Exp $")
+FILE_RCSID("@(#)$File: seccomp.c,v 1.18 2021/03/14 17:01:58 christos Exp $")
#endif /* lint */
#if HAVE_LIBSECCOMP
#include <sys/prctl.h> /* prctl */
#include <sys/ioctl.h>
#include <sys/socket.h>
+#include <termios.h>
#include <fcntl.h>
#include <stdlib.h>
#include <errno.h>
ALLOW_RULE(fcntl64);
ALLOW_RULE(fstat);
ALLOW_RULE(fstat64);
-#ifdef XZLIBSUPPORT
ALLOW_RULE(futex);
-#endif
ALLOW_RULE(getdents);
#ifdef __NR_getdents64
ALLOW_RULE(getdents64);
ALLOW_RULE(rt_sigreturn);
ALLOW_RULE(select);
ALLOW_RULE(stat);
+ ALLOW_RULE(statx);
ALLOW_RULE(stat64);
ALLOW_RULE(sysinfo);
ALLOW_RULE(umask); // Used in file_pipe2file()
ALLOW_RULE(getpid); // Used by glibc in file_pipe2file()
ALLOW_RULE(unlink);
ALLOW_RULE(write);
+ ALLOW_RULE(writev);
#if 0
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.299 2020/06/07 21:58:01 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.309 2021/02/05 22:29:07 christos Exp $")
#endif /* lint */
#include "magic.h"
goto flush;
}
- if (*m->desc)
- *found_match = 1;
-
if ((e = handle_annotation(ms, m, firstline)) != 0)
{
+ *found_match = 1;
*need_separator = 1;
*printed_something = 1;
*returnval = 1;
* If we are going to print something, we'll need to print
* a blank before we print something else.
*/
- if (print && *m->desc) {
- *need_separator = 1;
- *printed_something = 1;
+ if (*m->desc) {
+ *found_match = 1;
*returnval = 1;
- if (print_sep(ms, firstline) == -1)
- return -1;
- if (mprint(ms, m) == -1)
- return -1;
+ if (print) {
+ *need_separator = 1;
+ *printed_something = 1;
+ if (print_sep(ms, firstline) == -1)
+ return -1;
+ if (mprint(ms, m) == -1)
+ return -1;
+ }
}
switch (moffset(ms, m, &bb, &ms->c.li[cont_level].off)) {
} else
ms->c.li[cont_level].got_match = 1;
- if (*m->desc)
- *found_match = 1;
-
if ((e = handle_annotation(ms, m, firstline))
!= 0) {
+ *found_match = 1;
*need_separator = 1;
*printed_something = 1;
*returnval = 1;
return e;
}
+ if (*m->desc) {
+ *found_match = 1;
+ *returnval = 1;
+ }
if (print && *m->desc) {
/*
* This continuation matched. Print
if (file_printf(ms, " ") == -1)
return -1;
}
- *returnval = 1;
*need_separator = 0;
if (mprint(ms, m) == -1)
return -1;
firstline = 0;
}
if (*found_match) {
- if ((ms->flags & MAGIC_CONTINUE) == 0)
- return *returnval; /* don't keep searching */
- // So that we print a separator
- *printed_something = 0;
- firstline = 0;
+ if ((ms->flags & MAGIC_CONTINUE) == 0)
+ goto out;
+ // So that we print a separator
+ *printed_something = 0;
+ firstline = 0;
}
cont_level = 0;
}
+out:
+ /*
+ * If we are not printing (we are doing mime etc.)
+ * and we did not find a mime entry, and we are at 0 level
+ * we want to return 0 so that the default mime printer
+ * takes over and prints "application/octet-stream"
+ */
+ if (! print && ! *printed_something && ! *name_count)
+ return 0;
return *returnval; /* This is hit if -k is set or there is no match */
}
return rv;
}
-#if !defined(HAVE_STRNDUP) || defined(__aiws__)
-# ifdef __aiws__
+#if !defined(HAVE_STRNDUP) || defined(__aiws__) || defined(_AIX)
+# if defined(__aiws__) || defined(_AIX)
# define strndup aix_strndup /* aix is broken */
# endif
char *strndup(const char *, size_t);
else
desc = ebuf;
+#define PRINTER(value, format, stype, utype) \
+ v = file_signextend(ms, m, CAST(uint64_t, value)); \
+ switch (check_fmt(ms, desc)) { \
+ case -1: \
+ return -1; \
+ case 1: \
+ if (m->flag & UNSIGNED) { \
+ (void)snprintf(buf, sizeof(buf), "%" format "u", \
+ CAST(utype, v)); \
+ } else { \
+ (void)snprintf(buf, sizeof(buf), "%" format "d", \
+ CAST(stype, v)); \
+ } \
+ if (file_printf(ms, F(ms, desc, "%s"), buf) == -1) \
+ return -1; \
+ break; \
+ default: \
+ if (m->flag & UNSIGNED) { \
+ if (file_printf(ms, F(ms, desc, "%" format "u"), \
+ CAST(utype, v)) == -1) \
+ return -1; \
+ } else { \
+ if (file_printf(ms, F(ms, desc, "%" format "d"), \
+ CAST(stype, v)) == -1) \
+ return -1; \
+ } \
+ break; \
+ } \
+ t = ms->offset + sizeof(stype); \
+ break
+
switch (m->type) {
case FILE_BYTE:
- v = file_signextend(ms, m, CAST(uint64_t, p->b));
- switch (check_fmt(ms, desc)) {
- case -1:
- return -1;
- case 1:
- (void)snprintf(buf, sizeof(buf), "%d",
- CAST(unsigned char, v));
- if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
- return -1;
- break;
- default:
- if (file_printf(ms, F(ms, desc, "%d"),
- CAST(unsigned char, v)) == -1)
- return -1;
- break;
- }
- t = ms->offset + sizeof(char);
- break;
+ PRINTER(p->b, "", int8_t, uint8_t);
case FILE_SHORT:
case FILE_BESHORT:
case FILE_LESHORT:
- v = file_signextend(ms, m, CAST(uint64_t, p->h));
- switch (check_fmt(ms, desc)) {
- case -1:
- return -1;
- case 1:
- (void)snprintf(buf, sizeof(buf), "%u",
- CAST(unsigned short, v));
- if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
- return -1;
- break;
- default:
- if (file_printf(ms, F(ms, desc, "%u"),
- CAST(unsigned short, v)) == -1)
- return -1;
- break;
- }
- t = ms->offset + sizeof(short);
- break;
+ PRINTER(p->h, "", int16_t, uint16_t);
case FILE_LONG:
case FILE_BELONG:
case FILE_LELONG:
case FILE_MELONG:
- v = file_signextend(ms, m, CAST(uint64_t, p->l));
- switch (check_fmt(ms, desc)) {
- case -1:
- return -1;
- case 1:
- (void)snprintf(buf, sizeof(buf), "%u",
- CAST(uint32_t, v));
- if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
- return -1;
- break;
- default:
- if (file_printf(ms, F(ms, desc, "%u"),
- CAST(uint32_t, v)) == -1)
- return -1;
- break;
- }
- t = ms->offset + sizeof(int32_t);
+ PRINTER(p->l, "", int32_t, uint32_t);
break;
case FILE_QUAD:
case FILE_BEQUAD:
case FILE_LEQUAD:
case FILE_OFFSET:
- v = file_signextend(ms, m, p->q);
- switch (check_fmt(ms, desc)) {
- case -1:
- return -1;
- case 1:
- (void)snprintf(buf, sizeof(buf), "%" INT64_T_FORMAT "u",
- CAST(unsigned long long, v));
- if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
- return -1;
- break;
- default:
- if (file_printf(ms, F(ms, desc, "%" INT64_T_FORMAT "u"),
- CAST(unsigned long long, v)) == -1)
- return -1;
- break;
- }
- t = ms->offset + sizeof(int64_t);
+ PRINTER(p->q, INT64_T_FORMAT, long long, unsigned long long);
break;
case FILE_STRING:
if (*m->value.s == '\0')
str[strcspn(str, "\r\n")] = '\0';
- if (m->str_flags & STRING_TRIM) {
- char *last;
- while (isspace(CAST(unsigned char, *str)))
- str++;
- last = str;
- while (*last)
- last++;
- --last;
- while (isspace(CAST(unsigned char, *last)))
- last--;
- *++last = '\0';
- }
-
+ if (m->str_flags & STRING_TRIM)
+ str = file_strtrim(str);
+
if (file_printf(ms, F(ms, desc, "%s"),
file_printable(sbuf, sizeof(sbuf), str,
sizeof(p->s) - (str - p->s))) == -1)
case FILE_SEARCH:
case FILE_REGEX: {
- char *cp;
+ char *cp, *scp;
int rval;
cp = strndup(RCAST(const char *, ms->search.s),
file_oomem(ms, ms->search.rm_len);
return -1;
}
+ scp = (m->str_flags & STRING_TRIM) ? file_strtrim(cp) : cp;
+
rval = file_printf(ms, F(ms, desc, "%s"),
- file_printable(sbuf, sizeof(sbuf), cp, ms->search.rm_len));
+ file_printable(sbuf, sizeof(sbuf), scp, ms->search.rm_len));
free(cp);
if (rval == -1)
case FILE_DEFAULT:
case FILE_INDIRECT:
case FILE_OFFSET:
+ case FILE_USE:
o = ms->offset;
break;
}
private int
+save_cont(struct magic_set *ms, struct cont *c)
+{
+ size_t len;
+ *c = ms->c;
+ len = c->len * sizeof(*c->li);
+ ms->c.li = CAST(struct level_info *, malloc(len));
+ if (ms->c.li == NULL) {
+ ms->c = *c;
+ return -1;
+ }
+ memcpy(ms->c.li, c->li, len);
+ return 0;
+}
+
+private void
+restore_cont(struct magic_set *ms, struct cont *c)
+{
+ free(ms->c.li);
+ ms->c = *c;
+}
+
+private int
mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
const unsigned char *s, size_t nbytes, size_t o, unsigned int cont_level,
int mode, int text, int flip, uint16_t *indir_count, uint16_t *name_count,
int *printed_something, int *need_separator, int *returnval,
int *found_match)
{
- uint32_t offset = ms->offset;
+ uint32_t eoffset, offset = ms->offset;
struct buffer bb;
intmax_t lhs;
file_pushbuf_t *pb;
- int rv, oneed_separator, in_type;
+ int rv, oneed_separator, in_type, nfound_match;
char *rbuf;
union VALUETYPE *p = &ms->ms_value;
struct mlist ml;
+ struct cont c;
if (*indir_count >= ms->indir_max) {
file_error(ms, 0, "indirect count (%hu) exceeded",
file_error(ms, 0, "cannot find entry `%s'", rbuf);
return -1;
}
- (*name_count)++;
+ if (save_cont(ms, &c) == -1) {
+ file_error(ms, errno, "can't allocate continuation");
+ return -1;
+ }
+
oneed_separator = *need_separator;
if (m->flag & NOSPACE)
*need_separator = 0;
+
+ nfound_match = 0;
+ (*name_count)++;
+ eoffset = ms->eoffset;
rv = match(ms, ml.magic, ml.nmagic, b, offset + o,
mode, text, flip, indir_count, name_count,
- printed_something, need_separator, returnval, found_match);
+ printed_something, need_separator, returnval,
+ &nfound_match);
+ ms->ms_value.q = nfound_match;
(*name_count)--;
+ *found_match |= nfound_match;
+
+ restore_cont(ms, &c);
+
if (rv != 1)
*need_separator = oneed_separator;
+ ms->offset = offset;
+ ms->eoffset = eoffset;
return rv;
case FILE_NAME:
return -1;
break;
}
- case FILE_INDIRECT:
case FILE_USE:
+ return ms->ms_value.q != 0;
case FILE_NAME:
+ case FILE_INDIRECT:
return 1;
case FILE_DER:
matched = der_cmp(ms, m);
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: vasprintf.c,v 1.17 2019/11/15 21:03:14 christos Exp $")
+FILE_RCSID("@(#)$File: vasprintf.c,v 1.19 2021/02/23 00:51:11 christos Exp $")
#endif /* lint */
#include <assert.h>
* structure, which is passed among nearly every sub-functions.
*/
typedef struct {
- const char * src_string; /* current position into intput string */
+ const char * src_string; /* current position into input string */
char * buffer_base; /* output buffer */
char * dest_string; /* current position into output string */
size_t buffer_len; /* length of output buffer */
/*
* Realloc buffer if needed
* Return value: 0 = ok
- * EOF = not enought memory
+ * EOF = not enough memory
*/
static int realloc_buff(xprintf_struct *s, size_t len)
{
{
size_t len;
- len = strcspn(s->src_string, "%"); /* reachs the next '%' or end of input string */
+ len = strcspn(s->src_string, "%"); /* reaches the next '%' or end of input string */
/* note: 'len' is never 0 because the presence of '%' */
/* or end-of-line is checked in the calling function */
if (arg_string == NULL)
return print_it(s, (size_t)6, "(null)", 0);
- /* hand-made strlen() whitch stops when 'prec' is reached. */
+ /* hand-made strlen() which stops when 'prec' is reached. */
/* if 'prec' is -1 then it is never reached. */
string_len = 0;
while (arg_string[string_len] != 0 && (size_t)prec != string_len)
}
/*
- * Read a serie of digits. Stop when non-digit is found.
+ * Read a series of digits. Stop when non-digit is found.
* Return value: the value read (between 0 and 32767).
* Note: no checks are made against overflow. If the string contain a big
* number, then the return value won't be what we want (but, in this case,
zstd-v0.8-23.testfile \
zstd-v0.8-F4.testfile \
zstd-v0.8-FF.testfile \
+pgp-binary-key-v2-phil.testfile \
+pgp-binary-key-v3-lutz.testfile \
+pgp-binary-key-v4-dsa.testfile \
+pgp-binary-key-v4-ecc-no-userid-secret.testfile \
+pgp-binary-key-v4-ecc-secret-key.testfile \
+pgp-binary-key-v4-rsa-key.testfile \
+pgp-binary-key-v4-rsa-no-userid-secret.testfile \
+pgp-binary-key-v4-rsa-secret-key.testfile \
CVE-2014-1943.result \
JW07022A.mp3.result \
escapevel.result \
zstd-v0.8-22.result \
zstd-v0.8-23.result \
zstd-v0.8-F4.result \
-zstd-v0.8-FF.result
+zstd-v0.8-FF.result \
+pgp-binary-key-v2-phil.result \
+pgp-binary-key-v3-lutz.result \
+pgp-binary-key-v4-dsa.result \
+pgp-binary-key-v4-ecc-no-userid-secret.result \
+pgp-binary-key-v4-ecc-secret-key.result \
+pgp-binary-key-v4-rsa-key.result \
+pgp-binary-key-v4-rsa-no-userid-secret.result \
+pgp-binary-key-v4-rsa-secret-key.result
T = $(top_srcdir)/tests
check-local:
--- /dev/null
+Android vdex file, verifier deps version: 021, dex section version: 002, number of dex files: 4, verifier deps size: 106328
\ No newline at end of file
--- /dev/null
+Android vdex file, being processed by dex2oat, verifier deps version: 019, dex section version: 002, number of dex files: 1, verifier deps size: 1016
\ No newline at end of file
--- /dev/null
+PCjr Cartridge image
\ No newline at end of file
--- /dev/null
+OpenPGP Public Key Version 2, Created Fri May 21 05:20:00 1993, RSA (Encrypt or Sign, 1024 bits); User ID; Signature; OpenPGP Certificate
\ No newline at end of file
--- /dev/null
+OpenPGP Public Key Version 3, Created Mon Mar 17 11:14:30 1997, RSA (Encrypt or Sign, 1127 bits); User ID; Signature; OpenPGP Certificate
\ No newline at end of file
--- /dev/null
+OpenPGP Public Key Version 4, Created Mon Apr 7 22:23:01 1997, DSA (1024 bits); User ID; Signature; OpenPGP Certificate
\ No newline at end of file
--- /dev/null
+OpenPGP Secret Key Version 4, Created Wed Aug 26 20:52:13 2020, EdDSA; Signature; Secret Subkey; OpenPGP Certificate
\ No newline at end of file
--- /dev/null
+OpenPGP Secret Key Version 4, Created Sat Aug 22 14:07:46 2020, EdDSA; User ID; Signature; OpenPGP Certificate
\ No newline at end of file
--- /dev/null
+OpenPGP Secret Key Version 4, Created Sat Aug 22 14:05:57 2020, RSA (Encrypt or Sign, 3072 bits); User ID; Signature; OpenPGP Certificate
\ No newline at end of file
--- /dev/null
+OpenPGP Secret Key Version 4, Created Sat Aug 22 20:13:52 2020, RSA (Encrypt or Sign, 3072 bits); Signature; Secret Subkey; OpenPGP Certificate
\ No newline at end of file
--- /dev/null
+OpenPGP Secret Key Version 4, Created Sat Aug 22 14:05:57 2020, RSA (Encrypt or Sign, 3072 bits); User ID; Signature; OpenPGP Certificate
\ No newline at end of file
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <errno.h>
+
#include "magic.h"
+static const char *prog;
+
static void *
xrealloc(void *p, size_t n)
{
p = realloc(p, n);
if (p == NULL) {
- (void)fprintf(stderr, "ERROR slurping file: out of memory\n");
+ (void)fprintf(stderr, "%s ERROR slurping file: %s\n",
+ prog, strerror(errno));
exit(10);
}
return p;
for (c = getc(fp); c != EOF; c = getc(fp)) {
if (s == l + len) {
- l = (char *)xrealloc(l, len * 2);
+ l = xrealloc(l, len * 2);
len *= 2;
}
*s++ = c;
{
struct magic_set *ms;
const char *result;
+ size_t result_len, desired_len;
char *desired;
- size_t desired_len;
- int i;
+ int i, e = EXIT_FAILURE;
FILE *fp;
+
+ prog = strrchr(argv[0], '/');
+ if (prog)
+ prog++;
+ else
+ prog = argv[0];
+
ms = magic_open(MAGIC_NONE);
if (ms == NULL) {
- (void)fprintf(stderr, "ERROR opening MAGIC_NONE: out of memory\n");
- return 10;
+ (void)fprintf(stderr, "%s: ERROR opening MAGIC_NONE: %s\n",
+ prog, strerror(errno));
+ return e;
}
if (magic_load(ms, NULL) == -1) {
- (void)fprintf(stderr, "ERROR loading with NULL file: %s\n",
- magic_error(ms));
- return 11;
+ (void)fprintf(stderr, "%s: ERROR loading with NULL file: %s\n",
+ prog, magic_error(ms));
+ goto bad;
}
- if (argc > 1) {
- if (argc != 3) {
- (void)fprintf(stderr, "Usage: test TEST-FILE RESULT\n");
- } else {
- if ((result = magic_file(ms, argv[1])) == NULL) {
- (void)fprintf(stderr, "ERROR loading file %s: %s\n", argv[1], magic_error(ms));
- return 12;
- } else {
- fp = fopen(argv[2], "r");
- if (fp == NULL) {
- (void)fprintf(stderr, "ERROR opening `%s': ", argv[2]);
- perror(NULL);
- return 13;
- }
- desired = slurp(fp, &desired_len);
- fclose(fp);
- (void)printf("%s: %s\n", argv[1], result);
- if (strcmp(result, desired) != 0) {
- (void)fprintf(stderr, "Error: result was\n%s\nexpected:\n%s\n", result, desired);
- return 1;
- }
- }
- }
+ if (argc == 1) {
+ e = 0;
+ goto bad;
}
+ if (argc != 3) {
+ (void)fprintf(stderr, "Usage: %s TEST-FILE RESULT\n", prog);
+ magic_close(ms);
+ goto bad;
+ }
+ if ((result = magic_file(ms, argv[1])) == NULL) {
+ (void)fprintf(stderr, "%s: ERROR loading file %s: %s\n",
+ prog, argv[1], magic_error(ms));
+ goto bad;
+ }
+ fp = fopen(argv[2], "r");
+ if (fp == NULL) {
+ (void)fprintf(stderr, "%s: ERROR opening `%s': %s",
+ prog, argv[2], strerror(errno));
+ goto bad;
+ }
+ desired = slurp(fp, &desired_len);
+ fclose(fp);
+ (void)printf("%s: %s\n", argv[1], result);
+ if (strcmp(result, desired) != 0) {
+ result_len = strlen(result);
+ (void)fprintf(stderr, "%s: ERROR: result was (len %zu)\n%s\n"
+ "expected (len %zu)\n%s\n", prog, result_len, result,
+ desired_len, desired);
+ goto bad;
+ }
+ e = 0;
+bad:
magic_close(ms);
- return 0;
+ return e;
}
projects / platform / upstream / file.git / commitdiff