+2017-03-17 20:32 Christos Zoulas <christos@zoulas.com>
+
+ * remove trailing spaces from magic files
+ * refactor is_tar
+ * better bounds checks for cdf
+
2017-02-10 12:24 Christos Zoulas <christos@zoulas.com>
* release 5.30
dnl Process this file with autoconf to produce a configure script.
-AC_INIT([file],[5.30],[christos@astron.com])
+AC_INIT([file],[5.31],[christos@astron.com])
AM_INIT_AUTOMAKE([subdir-objects foreign])
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
-.\" $File: magic.man,v 1.89 2016/10/25 20:33:30 christos Exp $
-.Dd February 8, 2017
+.\" $File: magic.man,v 1.90 2017/02/08 21:52:03 christos Exp $
+.Dd February 12, 2017
.Dt MAGIC __FSECTION__
.Os
.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
.It B
A byte length (default).
.It H
-A 2 byte big endian length.
+A 4 byte big endian length.
.It h
-A 2 byte big little length.
+A 2 byte big endian length.
.It L
-A 4 byte big endian length.
+A 4 byte little endian length.
.It l
-A 4 byte big little length.
+A 2 byte little endian length.
.It J
The length includes itself in its count.
.El
--- /dev/null
+# Copyright 2016 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+FROM gcr.io/oss-fuzz-base/base-builder
+MAINTAINER mike.aizatsky@gmail.com
+RUN apt-get install -y make autoconf automake libtool shtool
+RUN git clone --depth 1 https://github.com/file/file.git
+WORKDIR file/fuzz
--- /dev/null
+#!/bin/bash -eu
+# Copyright 2016 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+: ${SRC:=.}
+: ${OUT:=.}
+: ${CC:=cc}
+: ${CFLAGS:=-O -DHAVE_CONFIG_H -Wall}
+
+#(cd .. && autoreconf -i && ./configure --enable-static && make V=1 all)
+
+"$CC" $CFLAGS -I../src/ -I.. \
+ "$SRC/magic_fuzzer.c" -o "$OUT/magic_fuzzer" \
+ -lFuzzingEngine ../src/.libs/libmagic.a
+
+cp ../magic/magic.mgc "$OUT/magic.mgc"
--- /dev/null
+/*
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice immediately at the beginning of the file, without modification,
+ * this list of conditions, and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * LLVM fuzzing integration.
+ */
+
+#include "file.h"
+
+#ifndef lint
+FILE_RCSID("@(#)$File: magic_fuzzer.c,v 1.1 2017/04/24 19:41:34 christos Exp $")
+#endif /* lint */
+
+#include "magic.h"
+#include <libgen.h>
+#include <stdlib.h>
+#include <err.h>
+
+int LLVMFuzzerInitialize(int *, char ***);
+int LLVMFuzzerTestOneInput(const uint8_t *, size_t);
+
+static magic_t magic;
+
+int
+LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+ char dfile[MAXPATHLEN], mfile[MAXPATHLEN];
+
+ magic = magic_open(MAGIC_NONE);
+ if (magic == NULL) {
+ warn("magic_open");
+ return -1;
+ }
+
+ // Poor man's strlcpy(3), to avoid potentially destructive dirname(3)
+ snprintf(dfile, sizeof(dfile), "%s", (*argv)[0]);
+ snprintf(mfile, sizeof(mfile), "%s/magic", dirname(dfile));
+
+ if (magic_load(magic, mfile) == -1) {
+ warnx("magic_load: %s", magic_error(magic));
+ return -1;
+ }
+
+ return 0;
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+ if (size == 0)
+ return 0;
+
+ magic_buffer(magic, data, size);
+ return 0;
+}
--- /dev/null
+homepage: "http://www.darwinsys.com/file/"
+primary_contact: "zoulasc@gmail.com"
+sanitizers:
+ - address
+ - memory
+ - undefined
#------------------------------------------------------------------------------
-# $File: adventure,v 1.14 2012/06/21 01:32:26 christos Exp $
+# $File: adventure,v 1.16 2017/03/17 21:35:28 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
!:mime application/x-tads
# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
-# "TADS2 save\n\r\032\0" and the interpreter version.
+# "TADS2 save\n\r\032\0" and the interpreter version.
0 string TADS2\ save/g TADS
>12 belong !0x0A0D1A00 saved game data, CORRUPTED
>12 belong 0x0A0D1A00
# edited by David Griffith <dave@661.org>
# Danny Milosavljevic <danny.milo@gmx.net>
# These are ADRIFT (adventure game standard) game files, extension .taf
-# Checked from source at (http://www.adrift.co/) and various taf files
+# Checked from source at (http://www.adrift.co/) and various taf files
# found at the Interactive Fiction Archive (http://ifarchive.org/)
0 belong 0x3C423FC9
>4 belong 0x6A87C2CF Adrift game file version
#------------------------------------------------------------------------------
-# $File$
+# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
# amanda: file(1) magic for amanda file format
#
-0 string AMANDA:\ AMANDA
+0 string AMANDA:\ AMANDA
>8 string TAPESTART\ DATE tape header file,
>>23 string X
>>>25 string >\ Unused %s
#------------------------------------------------------------------------------
-# $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $
+# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
# amigaos: file(1) magic for AmigaOS binary formats:
#
0 belong 0x000003e7 AmigaOS object/library data
#
0 beshort 0xe310 Amiga Workbench
->2 beshort 1
+>2 beshort 1
>>48 byte 1 disk icon
>>48 byte 2 drawer icon
>>48 byte 3 tool icon
0 string/c @database AmigaGuide file
# Amiga disk types
-#
+#
0 string RDSK Rigid Disk Block
>160 string x on %.24s
0 string DOS\0 Amiga DOS disk
#------------------------------------------------------------
-# $File: android,v 1.8 2015/03/19 18:04:37 christos Exp $
+# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
# Various android related magic entries
#------------------------------------------------------------
# http://forum.xda-developers.com/showthread.php?t=816449
# Partition Information Table for Samsung's smartphone with Android
# used by flash software Odin
-0 ulelong 0x12349876
+0 ulelong 0x12349876
# 1st pit entry marker
->0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
+>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# minimal 13 and maximal 18 PIT entries found
>>4 ulelong <128 Partition Information Table for Samsung smartphone
>>>4 ulelong x \b, %d entries
0 name PIT-entry
# garbage value implies end of pit entries
->0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
+>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000
# skip empty partition name
->>0x24 ubyte !0
+>>0x24 ubyte !0
# partition name
>>>0x24 string >\0 %-.32s
# flags
>>>0x08 ulelong x (0x%x)
# filename
>>>0x44 string >\0 "%-.64s"
-#>>>0x18 ulelong >0
+#>>>0x18 ulelong >0
# blocksize in 512 byte units ?
#>>>>0x18 ulelong x \b, %db
# partition size in blocks ?
#------------------------------------------------------------------------------
-# $File: animation,v 1.58 2016/07/03 14:13:11 christos Exp $
+# $File: animation,v 1.61 2017/04/01 18:26:03 christos Exp $
# animation: file(1) magic for animation/movie formats
#
# animation formats
!:mime image/jp2
# http://www.ftyps.com/ with local additions
4 string ftyp ISO Media
+# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
+>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec
+>>96 string x \b, Audio "%.4s"
+>>118 beshort x at %dHz
+>>140 string x \b, Video "%.4s"
+>>168 beshort x %d
+>>170 beshort x \bx%d
>8 string 3g2 \b, MPEG v4 system, 3GPP2
!:mime video/3gpp2
>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
# MPEG sequences
# Scans for all common MPEG header start codes
-0 belong 0x00000001
+0 belong 0x00000001
>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video
>>5 byte 66 \b, baseline
>>5 byte 77 \b, main
>>5 byte 88 \b, extended
>>7 byte x \b @ L %u
-0 belong&0xFFFFFF00 0x00000100
+0 belong&0xFFFFFF00 0x00000100
>3 byte 0xBA MPEG sequence
!:mime video/mpeg
>>4 byte &0x40 \b, v2, program multiplex
# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
-#0 beshort&0xFFFE 0xFFFE
-#>2 ubyte&0xF0 >0x0F
+#0 beshort&0xFFFE 0xFFFE
+#>2 ubyte&0xF0 >0x0F
#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
## rate
#>>>2 byte&0xF0 0x10 \b, 32 kbps
# MP2, M2A
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
!:mime audio/mpeg
-# rate
+# rate
>2 byte&0xF0 0x10 \b, 8 kbps
->2 byte&0xF0 0x20 \b, 16 kbps
+>2 byte&0xF0 0x20 \b, 16 kbps
>2 byte&0xF0 0x30 \b, 24 kbps
>2 byte&0xF0 0x40 \b, 32 kbps
>2 byte&0xF0 0x50 \b, 40 kbps
# MP3, M25A
0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
!:mime audio/mpeg
-# rate
+# rate
>2 byte&0xF0 0x10 \b, 8 kbps
>2 byte&0xF0 0x20 \b, 16 kbps
>2 byte&0xF0 0x30 \b, 24 kbps
--- /dev/null
+
+#------------------------------------------------------------------------------
+# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
+# apache: file(1) magic for Apache Big Data formats
+
+# Avro files
+0 string Obj Apache Avro
+>3 byte x version %d
+
+# ORC files
+# Important information is in file footer, which we can't index to :(
+0 string ORC Apache ORC
+
+# Parquet files
+0 string PAR1 Apache Parquet
+
+# Hive RC files
+0 string RCF Apache Hive RC file
+>3 byte x version %d
+
+# Sequence files (and the careless first version of RC file)
+
+0 string SEQ
+>3 byte <6 Apache Hadoop Sequence file version %d
+>3 byte >6 Apache Hadoop Sequence file version %d
+>3 byte =6
+>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0
+>>3 default x Apache Hadoop Sequence file version 6
#------------------------------------------------------------------------------
-# $File: apple,v 1.34 2016/07/18 19:23:38 christos Exp $
+# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $
# apple: file(1) magic for Apple file formats
#
0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
# AppleWorks word processor:
# URL: https://en.wikipedia.org/wiki/AppleWorks
# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# NOTE:
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.
# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
# the newer AppleWorks is from claris with extension CWK
-4 string O
+4 string O
# test for unused bits of zoom- , paginated-boolean bytes
->84 ubequad ^0x00Fe00000000Fe00
+>84 ubequad ^0x00Fe00000000Fe00
# look for tabstop definitions "=" no tab, "|" no tab
# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
# unofficial "!" other , "\x8a" other
!:ext awp
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
>>>183 ubyte 30 3.0
->>>183 ubyte !30
+>>>183 ubyte !30
>>>>183 ubyte !0 0x%x
-# usual tabstop start sequence "=====<"
+# usual tabstop start sequence "=====<"
>>>5 string x \b, tabstop ruler "%6.6s"
# tabstop ruler
#>>>5 string >\0 \b, tabstops "%-79s"
# contains any mail-merge commands
>>>92 byte&0x01 >0 \b, with mail merge
# left margin in 1/10 inches ( normally 0 or 10 )
->>>91 ubyte >0
+>>>91 ubyte >0
>>>>91 ubyte x \b, %d/10 inch left margin
# AppleWorks database:
# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
#0 belong&0xff00ff 0x80000 Applesoft BASIC program data
-0 belong&0x00ff00ff 0x00080000
+0 belong&0x00ff00ff 0x00080000
# assuming that line number must be positive
>2 leshort >0 Applesoft BASIC program data, first line number %d
#>2 leshort x \b, first line number %d
# ORCA/EZ assembler:
-#
+#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
-# Note there might be some problems with the "VAX COFF executable"
-# entry. Note this entry should be placed before the mac filesystem section,
+# Note there might be some problems with the "VAX COFF executable"
+# entry. Note this entry should be placed before the mac filesystem section,
# particularly the "Apple Partition data" entry.
#
-# The intended meaning of these tests is, that the file is only of the
+# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn't then it is not of that type.
#
#0 long 0x7801730d
#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
#
-# Note that this entry is recognized correctly by the "Apple Partition
+# Note that this entry is recognized correctly by the "Apple Partition
# data" entry - however since this entry is more specific - this
# information seems to be more useful.
#0 long 0x45520200
# Apple disk partition stuff
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# "ER" is APPLE_DRVR_MAP_MAGIC signature
0 beshort 0x4552
# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
>>10 ubeshort x \b, devid %u
# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
->>12 ubelong >0
+>>12 ubelong >0
>>>12 ubelong x \b, driver data %u
# number of driver descriptors sbDrvrCount <= 61
# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
# >>500 use apple-driver-map
# number of partitions is always same in every partition (map block count)
#>>0x0204 ubelong x \b, %u partitions
->>0x0204 ubelong >0 \b, contains[@0x200]:
+>>0x0204 ubelong >0 \b, contains[@0x200]:
>>>0x0200 use apple-apm
->>0x0204 ubelong >1 \b, contains[@0x400]:
+>>0x0204 ubelong >1 \b, contains[@0x400]:
>>>0x0400 use apple-apm
->>0x0204 ubelong >2 \b, contains[@0x600]:
+>>0x0204 ubelong >2 \b, contains[@0x600]:
>>>0x0600 use apple-apm
->>0x0204 ubelong >3 \b, contains[@0x800]:
+>>0x0204 ubelong >3 \b, contains[@0x800]:
>>>0x0800 use apple-apm
->>0x0204 ubelong >4 \b, contains[@0xA00]:
+>>0x0204 ubelong >4 \b, contains[@0xA00]:
>>>0x0A00 use apple-apm
->>0x0204 ubelong >5 \b, contains[@0xC00]:
+>>0x0204 ubelong >5 \b, contains[@0xC00]:
>>>0x0C00 use apple-apm
->>0x0204 ubelong >6 \b, contains[@0xE00]:
+>>0x0204 ubelong >6 \b, contains[@0xE00]:
>>>0x0E00 use apple-apm
->>0x0204 ubelong >7 \b, contains[@0x1000]:
+>>0x0204 ubelong >7 \b, contains[@0x1000]:
>>>0x1000 use apple-apm
# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
0 name apple-driver-map
->0 ubequad !0
-# descBlock first block of driver
+>0 ubequad !0
+# descBlock first block of driver
>>0 ubelong x \b, driver start block %u
# descSize driver size in blocks
>>4 ubeshort x \b, size %u
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
# for apple partition map stored as a single file
-0 belong 0x504d0000
+0 belong 0x504d0000
# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
#!:strength +0
>0 use apple-apm
0 name appleworks
>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document
>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document
->0 default x
+>0 default x
>>0 belong x AppleWorks/ClarisWorks CWK Document
>0 byte x \b, version %d
>30 beshort x \b, %d
#------------------------------------------------------------------------------
-# $File: archive,v 1.103 2016/05/05 17:07:40 christos Exp $
+# $File: archive,v 1.107 2017/03/20 19:51:15 christos Exp $
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
# Update: Joerg Jenderek
# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
-0 string \0\6
+0 string \0\6
# look for first keyword of Panorama database *.pan
->12 search/261 DESIGN
+>12 search/261 DESIGN
# skip keyword with low entropy
>12 default x TTComp archive, binary, 4K dictionary
# (version 5.25) labeled the above entry as "TTComp archive data"
0 string SZ\x0a\4 SZip archive data
# XPack DiskImage
# *.XDI updated by Joerg Jenderek Sep 2015
-# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
+# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
# GRR: this test is still too general as it catches also text files starting with jm
-0 string jm
+0 string jm
# only found examples with this additional characteristic 2 bytes
>2 string \x2\x4 Xpack DiskImage archive data
#!:ext xdi
# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
# created by XPA32.EXE version 1.0.2 for Windows
>0 string xpa\0\1 \b32 archive data
-# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
+# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
>3 ubeshort !0x0001 \bck archive data
# XPack Single Data
# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
#
# check 1st character of method id like -lz4- -lh5- or -pm2-
>2 string -
# check 5th character of method id
->>6 string -
+>>6 string -
# check header level 0 1 2 3
->>>20 ubyte <4
+>>>20 ubyte <4
# check 2nd, 3th and 4th character of method id
->>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b
+>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b\040
!:mime application/x-lzh-compressed
# creator type "LHA "
-!:apple ????LHA
+!:apple ????LHA
# display archive type name like "LHa/LZS archive data" or "LArc archive"
->>>>>2 string -lz \b
+>>>>>2 string -lz \b\040
!:ext lzs
# already known -lzs- -lz4- -lz5- with old names
>>>>>>2 string -lzs LHa/LZS archive data
# missing -lz?- with wikipedia names
>>>>>>3 regex \^lz[2378] LArc archive
# display archive type name like "LHa (2.x) archive data"
->>>>>2 string -lh \b
+>>>>>2 string -lh \b
# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data
# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
# FOOBAR archiver use ".foo" as name extension instead usual one
# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
->>>>>>>2 string -lh1 \b
+>>>>>>>2 string -lh1 \b\040
!:ext lha/lzh/ice
>>>>>>3 regex \^lh[23d] LHa 2.x? archive data
>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data
>>>>>>3 regex \^lh[456] LHa (2.x) archive data
->>>>>>>2 string -lh5 \b
+>>>>>>>2 string -lh5 \b\040
# https://en.wikipedia.org/wiki/BIOS
# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
# bios.rom , kd7_v14.bin, 1010.004, ...
# UNLHA32 2.67a
>>>>>>2 string -lhx LHa (UNLHA32) archive
# lha archives with standard file name extensions ".lha" ".lzh"
->>>>>>3 regex !\^(lh1|lh5) \b
+>>>>>>3 regex !\^(lh1|lh5) \b\040
!:ext lha/lzh
# this should not happen if all -lh variants are described
>>>>>>2 default x LHa (unknown) archive
# check and display information of lharc header
0 name lharc-header
# header size 0x4 , 0x1b-0x61
->0 ubyte x
+>0 ubyte x
# compressed data size != compressed file size
#>7 ulelong x \b, data size %d
-# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
+# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
#>19 ubyte x \b, 19_0x%x
# level identifier 0 1 2 3
#>20 ubyte x \b, level %d
# time stamp
#>15 ubelong x DATE 0x%8.8x
# OS ID for level 1
->20 ubyte 1
+>20 ubyte 1
# 0x20 types find for *.rom files
>>(21.b+24) ubyte <0x21 \b, 0x%x OS
# ascii type like M for MSDOS
>>(21.b+24) ubyte >0x20 \b, '%c' OS
# OS ID for level 2
->20 ubyte 2
+>20 ubyte 2
#>>23 ubyte x \b, OS ID 0x%x
>>23 ubyte <0x21 \b, 0x%x OS
>>23 ubyte >0x20 \b, '%c' OS
# filename only for level 0 and 1
->20 ubyte <2
+>20 ubyte <2
# length of filename
>>21 ubyte >0 \b, with
# filename
#
#2 string -lh0- LHarc 1.x/ARX archive data [lh0]
#!:mime application/x-lharc
-2 string -lh0-
+2 string -lh0-
>0 use lharc-file
#2 string -lh1- LHarc 1.x/ARX archive data [lh1]
#!:mime application/x-lharc
-2 string -lh1-
+2 string -lh1-
>0 use lharc-file
# NEW -lz2- ... -lz8-
-2 string -lz2-
+2 string -lz2-
>0 use lharc-file
-2 string -lz3-
+2 string -lz3-
>0 use lharc-file
-2 string -lz4-
+2 string -lz4-
>0 use lharc-file
-2 string -lz5-
+2 string -lz5-
>0 use lharc-file
-2 string -lz7-
+2 string -lz7-
>0 use lharc-file
-2 string -lz8-
+2 string -lz8-
>0 use lharc-file
# [never seen any but the last; -lh4- reported in comp.compression:]
#2 string -lzs- LHa/LZS archive data [lzs]
-2 string -lzs-
+2 string -lzs-
>0 use lharc-file
# According to wikipedia and others such a version does not exist
#2 string -lh\40- LHa 2.x? archive data [lh ]
#2 string -lhd- LHa 2.x? archive data [lhd]
-2 string -lhd-
+2 string -lhd-
>0 use lharc-file
#2 string -lh2- LHa 2.x? archive data [lh2]
-2 string -lh2-
+2 string -lh2-
>0 use lharc-file
#2 string -lh3- LHa 2.x? archive data [lh3]
-2 string -lh3-
+2 string -lh3-
>0 use lharc-file
#2 string -lh4- LHa (2.x) archive data [lh4]
-2 string -lh4-
+2 string -lh4-
>0 use lharc-file
#2 string -lh5- LHa (2.x) archive data [lh5]
-2 string -lh5-
+2 string -lh5-
>0 use lharc-file
#2 string -lh6- LHa (2.x) archive data [lh6]
-2 string -lh6-
+2 string -lh6-
>0 use lharc-file
#2 string -lh7- LHa (2.x)/LHark archive data [lh7]
-2 string -lh7-
+2 string -lh7-
# !:mime application/x-lha
# >20 byte x - header level %d
>0 use lharc-file
# NEW -lh8- ... -lhe- , -lhx-
-2 string -lh8-
+2 string -lh8-
>0 use lharc-file
-2 string -lh9-
+2 string -lh9-
>0 use lharc-file
-2 string -lha-
+2 string -lha-
>0 use lharc-file
-2 string -lhb-
+2 string -lhb-
>0 use lharc-file
-2 string -lhc-
+2 string -lhc-
>0 use lharc-file
-2 string -lhe-
+2 string -lhe-
>0 use lharc-file
-2 string -lhx-
+2 string -lhx-
>0 use lharc-file
# taken from idarc [JW]
2 string -lZ PUT archive data
# already done by LHarc magics
-# this should never happen if all sub types of LZS archive are identified
+# this should never happen if all sub types of LZS archive are identified
#2 string -lz LZS archive data
2 string -sw1- Swag archive data
0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
#
# PMA (CP/M derivative of LHA)
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
#
#2 string -pm0- PMarc archive data [pm0]
-2 string -pm0-
+2 string -pm0-
>0 use lharc-file
#2 string -pm1- PMarc archive data [pm1]
-2 string -pm1-
+2 string -pm1-
>0 use lharc-file
#2 string -pm2- PMarc archive data [pm2]
-2 string -pm2-
+2 string -pm2-
>0 use lharc-file
2 string -pms- PMarc SFX archive (CP/M, DOS)
#!:mime application/x-foobar-exec
>3 ubyte 0 \b, no compression
>3 ubyte 2 \b, fast compression (Z1)
>3 ubyte 3 \b, medium compression (Z2)
->3 ubyte >3
+>3 ubyte >3
>>3 ubyte <11 \b, compression (Z%d-1)
->2 ubyte&0x08 0x00
+>2 ubyte&0x08 0x00
# ~ 30 byte password field only for *.gho
>>12 ubequad !0 \b, password protected
->>44 ubyte !1
+>>44 ubyte !1
# 1~Image All, sector-by-sector only for *.gho
>>>10 ubyte 1 \b, sector copy
# 1~Image Boot track only for *.gho
# optional image description only *.gho
>>0xff string >\0 "%-.254s"
# look for DOS sector end sequence
->0xE08 search/7776 \x55\xAA
->>&-512 indirect x \b; contains
+>0xE08 search/7776 \x55\xAA
+>>&-512 indirect x \b; contains
# Google Chrome extensions
# https://developer.chrome.com/extensions/crx
0 string Cr24 Google Chrome extension
!:mime application/x-chrome-extension
>4 ulong x \b, version %u
+
+# SeqBox - Sequenced container
+# ext: sbx, seqbox
+# Marco Pontello marcopon@gmail.com
+# reference: https://github.com/MarcoPon/SeqBox
+0 string SBx SeqBox,
+>3 byte x version %d
#------------------------------------------------------------------------------
-# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $
+# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
#>18 beshort &00040000 and MAU hardware required
#>22 beshort >0 - version %d
#
-# core file for 3b2
+# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
>364 string >\0 of '%s'
#------------------------------------------------------------------------------
-# $File: audio,v 1.75 2016/02/08 17:30:11 christos Exp $
+# $File: audio,v 1.79 2017/03/17 22:20:22 christos Exp $
# audio: file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
>>5 byte &0x40 \b, extended header
>>5 byte &0x20 \b, experimental
>>5 byte &0x10 \b, footer present
->(6.I+10) indirect x \b, contains:
+>(6.I+10) indirect x \b, contains:
# NSF (NES sound file) magic
0 string NESM\x1a NES Sound File
>122 byte&0x1 =0 NTSC
# NSFE (Extended NES sound file) magic
-# http://slickproductions.org/docs/NSF/nsfespec.txt
+# http://slickproductions.org/docs/NSF/nsfespec.txt
# From: David Pflug <david@pflug.email>
0 string NSFE Extended NES Sound File
>48 search/0x1000 auth
# From Fabio R. Schmidlin <frs@pop.com.br>
# VGM music file
-0 string Vgm\
+0 string Vgm\040
>9 ubyte >0 VGM Video Game Music dump v
>>9 ubyte/16 >0 \b%d
>>9 ubyte&0x0F x \b%d
# URL: http://www.garmin.com/
# Reference: http://turboccc.wikispaces.com/share/view/28622555
# NOTE: there exist 2 other Garmin VPM formats
-0 string AUDIMG
+0 string AUDIMG
# skip text files starting with string "AUDIMG"
>13 ubyte <13 Garmin Voice Processing Module
!:mime audio/x-vpm-wav-garmin
# second of release (0-59)
>>9 ubyte x \b:%.2d
# if you select a language like german on your garmin device
-# you can only select voice modules with correponding language byte ID like 1
+# you can only select voice modules with correponding language byte ID like 1
>>18 ubyte x \b, language ID %d
# pointer to 1st audio WAV sample
->>16 uleshort >0
+>>16 uleshort >0
>>>(16.s) ulelong >0 \b, at offset 0x%x
# WAV length
>>>>(16.s+4) ulelong >0 %d Bytes
# look for magic
->>>>>(&-8.l) string RIFF
+>>>>>(&-8.l) string RIFF
# determine type by ./riff
->>>>>>&-4 indirect x \b
+>>>>>>&-4 indirect x \b
# 2 - ~ 131 WAV samples following same way
+# From Martin Mueller Skarbiniks Pedersen
+0 string GDM
+>0x3 byte 0xFE General Digital Music.
+>0x4 string >\0 title: "%s"
+>0x24 string >\0 musician: "%s"
+>>0x44 beshort 0x0D0A
+>>>0x46 byte 0x1A
+>>>>0x47 string GMFS Version
+>>>>0x4B byte x %d.
+>>>>0x4C byte x \b%02d
+>>>>0x4D beshort 0x000 (2GDM v
+>>>>0x4F byte x \b%d.
+>>>>>0x50 byte x \b%d)
+
+0 string MTM Multitracker
+>0x3 byte/16 x Version %d.
+>0x3 byte&0x0F x \b%02d
+>>0x4 string >\0 title: "%s"
+
+0 string HVL
+>3 byte <2 Hively Tracker Song
+>3 byte 0 1 module data
+>3 byte 1 2 module data
+
+0 string MO3
+>3 ubyte <6 MOdule with MP3
+>>3 byte 0 Version 0 (With MP3 and lossless)
+>>3 byte 1 Version 1 (With ogg and lossless)
+>>3 byte 3 Version 2.2
+>>3 byte 4 (With no LAME header)
+>>3 byte 5 Version 2.4
+
+0 string ADRVPACK AProSys module
+
+# ftp://ftp.modland.com/pub/documents/format_documentation/\
+# Art%20Of%20Noise%20(.aon).txt
+0 string AON
+>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)"
+>0x2e string NAME Art of Noise Tracker Song
+>3 string <9
+>3 string 4 (4 voices)
+>3 string 8 (8 voices)
+>>0x36 string >\0 Title: "%s"
+
+0 string FAR
+>0x2c byte 0x0d
+>0x2d byte 0x0a
+>0x2e byte 0x1a
+>>0x3 byte 0xFE Farandole Tracker Song
+>>>0x31 byte/16 x Version %d.
+>>>0x31 byte&0x0F x \b%02d
+>>>>0x4 string >\0 \b, title: "%s"
#------------------------------------------------------------------------------
-# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $
+# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
# blackberry: file(1) magic for BlackBerry file formats
#
-5 belong 0
+5 belong 0
>8 belong 010010010 BlackBerry RIM ETP file
>>22 string x \b for %s
#------------------------------------------------------------------------------
-# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $
+# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
# blender: file(1) magic for Blender 3D related files
#
-# Native format rule v1.2. For questions use the developers list
+# Native format rule v1.2. For questions use the developers list
# http://lists.blender.org/mailman/listinfo/bf-committers
-# GLOB chunk was moved near start and provides subversion info since 2.42
+# GLOB chunk was moved near start and provides subversion info since 2.42
0 string =BLENDER Blender3D,
>7 string =_ saved as 32-bits
#------------------------------------------------------------------------------
-# $File: c-lang,v 1.23 2016/05/21 14:28:27 christos Exp $
+# $File: c-lang,v 1.25 2017/03/17 21:35:28 christos Exp $
# c-lang: file(1) magic for C and related languages programs
#
# The strength is to beat standard HTML
!:strength +25
!:mime text/x-objective-c
-# From: Mikhail Teterin <mi@aldan.algebra.com>
+# From: Mikhail Teterin <mi@aldan.algebra.com>
0 string cscope cscope reference data
>7 string x version %.2s
# We skip the path here, because it is often long (so file will
#------------------------------------------------------------------------------
-# $File: cad,v 1.12 2013/07/04 15:24:37 christos Exp $
+# $File: cad,v 1.14 2017/03/17 21:35:28 christos Exp $
# autocad: file(1) magic for cad files
#
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
-#
+#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
>4 string \030\000\000 CITFile
>4 string \030\000\003 CITFile
-# AutoCAD
+# AutoCAD
# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
# and http://www.iana.org/assignments/media-types/image/vnd.dwg
0 string MC0.0 DWG AutoDesk AutoCAD Release 1.0
0 string AC1027 DWG AutoDesk AutoCAD 2013/2014
!:mime image/vnd.dwg
-# KOMPAS 2D drawing from ASCON
+# KOMPAS 2D drawing from ASCON
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
# gathered nor specification
# ASCON http://ascon.net/main/ in English,
# http://ascon.ru/ main site in Russian
-# Extension is CDW for drawing and FRW for fragment of drawing
+# Extension is CDW for drawing and FRW for fragment of drawing
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321, http://vkontakte.ru/id16076543)
# From:
# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
# (in russian) and my experiments
0 string KF
->2 belong 0x4E00000C Kompas drawing 12.0 SP1
->2 belong 0x4D00000C Kompas drawing 12.0
->2 belong 0x3200000B Kompas drawing 11.0 SP1
->2 belong 0x3100000B Kompas drawing 11.0
->2 belong 0x2310000A Kompas drawing 10.0 SP1
->2 belong 0x2110000A Kompas drawing 10.0
->2 belong 0x08000009 Kompas drawing 9.0 SP1
->2 belong 0x05000009 Kompas drawing 9.0
->2 belong 0x33010008 Kompas drawing 8+
->2 belong 0x1A000008 Kompas drawing 8.0
->2 belong 0x2C010107 Kompas drawing 7+
->2 belong 0x05000007 Kompas drawing 7.0
->2 belong 0x32000006 Kompas drawing 6+
->2 belong 0x09000006 Kompas drawing 6.0
->2 belong 0x5C009005 Kompas drawing 5.11R03
->2 belong 0x54009005 Kompas drawing 5.11R02
->2 belong 0x51009005 Kompas drawing 5.11R01
->2 belong 0x22009005 Kompas drawing 5.10R03
->2 belong 0x22009005 Kompas drawing 5.10R02 mar
->2 belong 0x21009005 Kompas drawing 5.10R02 febr
->2 belong 0x19009005 Kompas drawing 5.10R01
->2 belong 0xF4008005 Kompas drawing 5.9R01.003
->2 belong 0x1C008005 Kompas drawing 5.9R01.002
->2 belong 0x11008005 Kompas drawing 5.8R01.003
+>2 belong 0x4E00000C Kompas drawing 12.0 SP1
+>2 belong 0x4D00000C Kompas drawing 12.0
+>2 belong 0x3200000B Kompas drawing 11.0 SP1
+>2 belong 0x3100000B Kompas drawing 11.0
+>2 belong 0x2310000A Kompas drawing 10.0 SP1
+>2 belong 0x2110000A Kompas drawing 10.0
+>2 belong 0x08000009 Kompas drawing 9.0 SP1
+>2 belong 0x05000009 Kompas drawing 9.0
+>2 belong 0x33010008 Kompas drawing 8+
+>2 belong 0x1A000008 Kompas drawing 8.0
+>2 belong 0x2C010107 Kompas drawing 7+
+>2 belong 0x05000007 Kompas drawing 7.0
+>2 belong 0x32000006 Kompas drawing 6+
+>2 belong 0x09000006 Kompas drawing 6.0
+>2 belong 0x5C009005 Kompas drawing 5.11R03
+>2 belong 0x54009005 Kompas drawing 5.11R02
+>2 belong 0x51009005 Kompas drawing 5.11R01
+>2 belong 0x22009005 Kompas drawing 5.10R03
+>2 belong 0x22009005 Kompas drawing 5.10R02 mar
+>2 belong 0x21009005 Kompas drawing 5.10R02 febr
+>2 belong 0x19009005 Kompas drawing 5.10R01
+>2 belong 0xF4008005 Kompas drawing 5.9R01.003
+>2 belong 0x1C008005 Kompas drawing 5.9R01.002
+>2 belong 0x11008005 Kompas drawing 5.8R01.003
# CAD: file(1) magic for computer aided design files
# Phillip Griffith <phillip dot griffith at gmail dot com>
#------------------------------------------------------------------------------
-# $File: cafebabe,v 1.20 2015/05/29 14:21:58 christos Exp $
+# $File: cafebabe,v 1.22 2017/03/17 21:35:28 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same "magic" sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
-# version and the short at offset 6 is the JVM major version. Since there are only
-# only 18 labeled Mach-O architectures at current, and the first released
+# version and the short at offset 6 is the JVM major version. Since there are only
+# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack). Let's not use 18, because the Mach-O people
0 name mach-o \b [
>0 use mach-o-cpu \b
->(8.L) indirect \b:
+>(8.L) indirect \b:
>0 belong x \b]
0 belong 0xcafebabe
#------------------------------------------------------------------------------
-# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $
+# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
-# >18 short !074000,000000 C1 R1
+# >18 short !074000,000000 C1 R1
# >18 short !074000,004000 C2 R1
# >18 short !074000,010000 C3 R1
# >18 short !074000,074000 TEST
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
-# >18 short&074000 000000 C1 R1
+# >18 short&074000 000000 C1 R1
# >18 short&074000 004000 C2 R1
# >18 short&074000 010000 C3 R1
# >18 short&074000 074000 TEST
>12 long >0 not stripped
>22 short >0 - version %d
0 short 0577 CLIPPER COFF executable
->18 short&074000 000000 C1 R1
+>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>18 short&074000 010000 C3 R1
>18 short&074000 074000 TEST
#------------------------------------------------------------------------------
-# $File:$
+# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
# mips,motorola,msdos,osf1,sharc,varied.out,vax
0 name display-coff
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
->18 uleshort&0x8E80 0
+>18 uleshort&0x8E80 0
>>0 clear x
# f_magic - magic number
# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
# Hitachi SH little-endian COFF (./hitachi-sh)
>>0 uleshort 0x0550 Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
-#>>0 uleshort 0x01DF
+#>>0 uleshort 0x01DF
# TODO for other COFFs
#>>0 uleshort 0xABCD COFF_TEMPLATE
>>0 default x
>>18 leshort &0x0008 \b, stripped
>>18 leshort ^0x0008 \b, not stripped
# flags in other COFF versions
-#0x0010 F_FDPR_PROF
+#0x0010 F_FDPR_PROF
#0x0020 F_FDPR_OPTI
#0x0040 F_DSA
# F_AR32WR flag bit
#>>>18 leshort &0x0100 \b, 32 bit little endian
-#0x1000 F_DYNLOAD
+#0x1000 F_DYNLOAD
#0x2000 F_SHROBJ
#0x4000 F_LOADONLY
# f_nscns - number of sections
>>8 ulelong >0 \b, symbol offset=0x%x
# f_nsyms - number of symbols, only for not stripped
>>12 ulelong >0 \b, %d symbols
-# f_opthdr - optional header size
+# f_opthdr - optional header size
>>16 uleshort >0 \b, optional header size %d
# at offset 20 can be optional header, extra bytes FILHSZ-20 because
# do not rely on sizeof(FILHDR) to give the correct size for header.
#------------------------------------------------------------------------------
-# $File: commands,v 1.55 2016/07/10 12:44:24 christos Exp $
+# $File: commands,v 1.57 2017/04/04 20:34:24 christos Exp $
# commands: file(1) magic for various shells and interpreters
#
#0 string/w : shell archive or script for antique kernel text
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
-0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk or perl script text
+0 regex/4096 =^[A-Za-z0-9_]{0,100}BEGIN[A-Za-z0-9_]{0,100}[{] awk or perl script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
#------------------------------------------------------------------------------
-# $File: compress,v 1.65 2015/12/04 20:48:03 christos Exp $
+# $File: compress,v 1.67 2017/03/17 21:35:28 christos Exp $
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
# Zlib https://www.ietf.org/rfc/rfc6713.txt
0 string/b x
->0 beshort%31 =0
+>0 beshort%31 =0
>>0 byte&0xf =8
>>>0 byte&0x80 =0 zlib compressed data
!:mime application/zlib
#------------------------------------------------------------------------------
-# $File: console,v 1.28 2017/01/22 22:02:15 christos Exp $
+# $File: console,v 1.30 2017/03/17 21:35:28 christos Exp $
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
# Too simple - MPi
-#0 beshort 0x4142 MSX game cartridge dump
+#0 beshort 0x4142 MSX game cartridge dump
#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
# Double-check that the image type matches too, 0x8008 conflicts with
# 8 character OMF-86 object file headers.
-0 beshort 0x8008
+0 beshort 0x8008
>6 string BS93 Lynx homebrew cartridge
>>2 beshort x \b, RAM start $%04x
>6 string LYNX Lynx cartridge
# is the offset 12 or the offset 16 correct?
# GBS (Game Boy Sound) magic
# ftp://ftp.modland.com/pub/documents/format_documentation/\
-# Gameboy%20Sound%20System%20(.gbs).txt
+# Gameboy%20Sound%20System%20(.gbs).txt
0 string GBS Nintendo Gameboy Music/Audio Data
#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
>16 string >\0 ("%s" by
# SNES9x .smv "movie" file format.
0 string SMV\x1A SNES9x input recording
>0x4 lelong x \b, version %d
-# version 4 is latest so far
+# version 4 is latest so far
>0x4 lelong <5
>>0x8 ledate x \b, recorded at %s
>>0xc lelong >0 \b, rerecorded %d times
#------------------------------------------------------------------------------
-# $File: cups,v 1.3 2014/05/28 19:50:41 christos Exp $
+# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
# Cups: file(1) magic for the cups raster file format
# From: Laurent Martelli <martellilaurent@gmail.com>
# http://www.cups.org/documentation.php/spec-raster.html
>404 lelong 20 ColorSpace=AdobeRGB
# Cups Raster image format, Big Endian
-0 string RaS
+0 string RaS
>3 string t Cups Raster version 1, Big Endian
>3 string 2 Cups Raster version 2, Big Endian
>3 string 3 Cups Raster version 3, Big Endian
# Cups Raster image format, Little Endian
-1 string SaR
+1 string SaR
>0 string t Cups Raster version 1, Little Endian
>0 string 2 Cups Raster version 2, Little Endian
>0 string 3 Cups Raster version 3, Little Endian
#------------------------------------------------------------------------------
-# $File: database,v 1.48 2016/04/14 20:34:28 christos Exp $
+# $File: database,v 1.51 2017/04/28 16:28:16 christos Exp $
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
# From Max Bowsher.
12 long 0x00040988 Berkeley DB
>16 long >0 (Log, version %d, native byte-order)
-12 belong 0x00040988 Berkeley DB
+12 belong 0x00040988 Berkeley DB
>16 belong >0 (Log, version %d, big-endian)
12 lelong 0x00040988 Berkeley DB
>16 lelong >0 (Log, version %d, little-endian)
>>>12 long !0 32bit aligned
>>>>12 bedouble 8.642135e+130 big-endian
>>>>>20 long 0 64bit long
->>>>>20 long !0 32bit long
+>>>>>20 long !0 32bit long
>>>>12 ledouble 8.642135e+130 little-endian
>>>>>24 long 0 64bit long
>>>>>24 long !0 32bit long (i386)
# XXX: Weak magic.
# Alex Ott <ott@jet.msk.su>
## Paradox file formats
-#2 leshort 0x0800 Paradox
-#>0x39 byte 3 v. 3.0
-#>0x39 byte 4 v. 3.5
-#>0x39 byte 9 v. 4.x
-#>0x39 byte 10 v. 5.x
-#>0x39 byte 11 v. 5.x
-#>0x39 byte 12 v. 7.x
-#>>0x04 byte 0 indexed .DB data file
-#>>0x04 byte 1 primary index .PX file
-#>>0x04 byte 2 non-indexed .DB data file
-#>>0x04 byte 3 non-incrementing secondary index .Xnn file
-#>>0x04 byte 4 secondary index .Ynn file
-#>>0x04 byte 5 incrementing secondary index .Xnn file
-#>>0x04 byte 6 non-incrementing secondary index .XGn file
-#>>0x04 byte 7 secondary index .YGn file
-#>>>0x04 byte 8 incrementing secondary index .XGn file
+#2 leshort 0x0800 Paradox
+#>0x39 byte 3 v. 3.0
+#>0x39 byte 4 v. 3.5
+#>0x39 byte 9 v. 4.x
+#>0x39 byte 10 v. 5.x
+#>0x39 byte 11 v. 5.x
+#>0x39 byte 12 v. 7.x
+#>>0x04 byte 0 indexed .DB data file
+#>>0x04 byte 1 primary index .PX file
+#>>0x04 byte 2 non-indexed .DB data file
+#>>0x04 byte 3 non-incrementing secondary index .Xnn file
+#>>0x04 byte 4 secondary index .Ynn file
+#>>0x04 byte 5 incrementing secondary index .Xnn file
+#>>0x04 byte 6 non-incrementing secondary index .XGn file
+#>>0x04 byte 7 secondary index .YGn file
+#>>>0x04 byte 8 incrementing secondary index .XGn file
## XBase database files
# updated by Joerg Jenderek at Feb 2013
# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
-0 ubelong&0x0000FFFF <0x00000C20
+0 ubelong&0x0000FFFF <0x00000C20
# skip Infocom game Z-machine
->2 ubyte >0
+>2 ubyte >0
# skip Androids *.xml
->>3 ubyte >0
->>>3 ubyte <32
+>>3 ubyte >0
+>>>3 ubyte <32
# 1 < version VV
->>>>0 ubyte >1
+>>>>0 ubyte >1
# skip HELP.CA3 by test for reserved byte ( NULL )
->>>>>27 ubyte 0
+>>>>>27 ubyte 0
# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
#>>>>>30 ubeshort x 30NULL?%x
-# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
->>>>>>24 ubelong&0xffFFFFff >0x01302000
+# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
+>>>>>>24 ubelong&0xffFFFFff >0x01302000
# .DBF or .MDX
->>>>>>24 ubelong&0xffFFFFff <0x01302001
+>>>>>>24 ubelong&0xffFFFFff <0x01302001
# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
->>>>>>>24 ubelong&0xffFFFFff =0
+>>>>>>>24 ubelong&0xffFFFFff =0
# test for 2 reserved NULL bytes,transaction and encryption byte flag
->>>>>>>>12 ubelong&0xFFFFfEfE 0
+>>>>>>>>12 ubelong&0xFFFFfEfE 0
# test for MDX flag
->>>>>>>>>28 ubyte x
->>>>>>>>>28 ubyte&0xf8 0
+>>>>>>>>>28 ubyte x
+>>>>>>>>>28 ubyte&0xf8 0
# header size >= 32
->>>>>>>>>>8 uleshort >31
+>>>>>>>>>>8 uleshort >31
# skip PIC15736.PCX by test for language driver name or field name
->>>>>>>>>>>32 ubyte >0
+>>>>>>>>>>>32 ubyte >0
#!:mime application/x-dbf; charset=unknown-8bit ??
#!:mime application/x-dbase
>>>>>>>>>>>>0 use xbase-type
>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
# 1st record offset + 1 = header size
->>>>>>>>>>>>8 uleshort >0
->>>>>>>>>>>>(8.s+1) ubyte >0
+>>>>>>>>>>>>8 uleshort >0
+>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
->>>>>>>>>>>>>(8.s+1) ubyte >0
+>>>>>>>>>>>>>(8.s+1) ubyte >0
>>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
-# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
->>>>>>>24 ubelong&0x0133f7ff >0
+# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
+>>>>>>>24 ubelong&0x0133f7ff >0
# test for reserved NULL byte
->>>>>>>>47 ubyte 0
+>>>>>>>>47 ubyte 0
# test for valid TAG key format (0x10 or 0)
->>>>>>>>>559 ubyte&0xeF 0
+>>>>>>>>>559 ubyte&0xeF 0
# test MM <= 12
->>>>>>>>>>45 ubeshort <0x0C20
->>>>>>>>>>>45 ubyte >0
->>>>>>>>>>>>46 ubyte <32
->>>>>>>>>>>>>46 ubyte >0
+>>>>>>>>>>45 ubeshort <0x0C20
+>>>>>>>>>>>45 ubyte >0
+>>>>>>>>>>>>46 ubyte <32
+>>>>>>>>>>>>>46 ubyte >0
#!:mime application/x-mdx
>>>>>>>>>>>>>>0 use xbase-type
>>>>>>>>>>>>>>0 ubyte x \b MDX
# 2nd tag name
#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
#
-# Print the xBase names of different version variants
+# Print the xBase names of different version variants
0 name xbase-type
->0 ubyte <2
+>0 ubyte <2
# 1 < version
->0 ubyte >1
+>0 ubyte >1
>>0 ubyte 0x02 FoxBase
# FoxBase+/dBaseIII+, no memo
>>0 ubyte 0x03 FoxBase+/dBase III
# dBASE IV with SQL table, with memo .DBT
>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
!:mime application/x-dbf
-# HiPer-Six format;Clipper SIX, with SMT memo file
+# HiPer-Six format;Clipper SIX, with SMT memo file
>>0 ubyte 0xE5 Clipper SIX with memo
!:mime application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
# test and print the date of xBase .DBF .MDX
0 name xbase-date
# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
->0 ubelong x
->1 ubyte <13
->>1 ubyte >0
->>>2 ubyte >0
->>>>2 ubyte <32
->>>>>0 ubyte x
+>0 ubelong x
+>1 ubyte <13
+>>1 ubyte >0
+>>>2 ubyte >0
+>>>>2 ubyte <32
+>>>>>0 ubyte x
# YY is interpreted as 20YY or 19YY
>>>>>>0 ubyte <100 \b %.2d
# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
# dBase memo files .DBT or .FPT
# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
-16 ubyte <4
->16 ubyte !2
->>16 ubyte !1
+16 ubyte <4
+>16 ubyte !2
+>>16 ubyte !1
# next free block index is positive
->>>0 ulelong >0
+>>>0 ulelong >0
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
->>>>17 ubelong&0xFFfdFE00 0x00000000
+>>>>17 ubelong&0xFFfdFE00 0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
->>>>>20 ubelong&0xFF01209B 0x00000000
+>>>>>20 ubelong&0xFF01209B 0x00000000
# dBASE III
->>>>>>16 ubyte 3
+>>>>>>16 ubyte 3
# dBASE III DBT
>>>>>>>0 use dbase3-memo-print
# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
->>>>>>16 ubyte 0
+>>>>>>16 ubyte 0
# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
->>>>>>>20 uleshort 0
+>>>>>>>20 uleshort 0
# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
->>>>>>>>8 ulong =0
->>>>>>>>>6 ubeshort >0
+>>>>>>>>8 ulong =0
+>>>>>>>>>6 ubeshort >0
# skip emacs.PIF
->>>>>>>>>>4 ushort 0
+>>>>>>>>>>4 ushort 0
>>>>>>>>>>>0 use foxpro-memo-print
# dBASE III DBT , garbage
->>>>>>>>>6 ubeshort 0
+>>>>>>>>>6 ubeshort 0
# skip MM*DD*.bin by test for for reserved NULL byte
->>>>>>>>>>510 ubeshort 0
+>>>>>>>>>>510 ubeshort 0
# skip TK-DOS11.img image by looking for memo text
->>>>>>>>>>>512 ubelong <0xfeffff03
+>>>>>>>>>>>512 ubelong <0xfeffff03
# skip EFI executables by looking for memo text
->>>>>>>>>>>>512 ubelong >0x1F202020
->>>>>>>>>>>>>513 ubyte >0
+>>>>>>>>>>>>512 ubelong >0x1F202020
+>>>>>>>>>>>>>513 ubyte >0
# unusual dBASE III DBT like adressen.dbt
>>>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE III DBT like angest.dbt, or garbage PCX DBF
->>>>>>>>8 ubelong !0
+>>>>>>>>8 ubelong !0
# skip PCX and some DBF by test for for reserved NULL bytes
->>>>>>>>>510 ubeshort 0
+>>>>>>>>>510 ubeshort 0
# skip some DBF by test of invalid version
->>>>>>>>>>0 ubyte >5
->>>>>>>>>>>0 ubyte <48
+>>>>>>>>>>0 ubyte >5
+>>>>>>>>>>>0 ubyte <48
>>>>>>>>>>>>0 use dbase3-memo-print
# dBASE IV DBT with positive block size
->>>>>>>20 uleshort >0
-# dBASE IV DBT with valid block length like 512, 1024
+>>>>>>>20 uleshort >0
+# dBASE IV DBT with valid block length like 512, 1024
# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
->>>>>>>>20 uleshort&0x800f 0
+>>>>>>>>20 uleshort&0x800f 0
>>>>>>>>>0 use dbase4-memo-print
-# Print the information of dBase III DBT memo file
+# Print the information of dBase III DBT memo file
0 name dbase3-memo-print
>0 ubyte x dBase III DBT
# instead 3 as version number 0 for unusual examples like biblio.dbt
>20 uleshort !0 \b, block length %u
# dBase III memo field terminated by \032\032
>512 string >\0 \b, 1st item "%s"
-# Print the information of dBase IV DBT memo file
+# Print the information of dBase IV DBT memo file
0 name dbase4-memo-print
>0 lelong x dBase IV DBT
!:mime application/x-dbt
!:ext dbt
# 8 character shorted main name of coresponding dBASE IV DBF file
->8 ubelong >0x20000000
+>8 ubelong >0x20000000
# skip unusual like for angest.dbt
->>20 uleshort >0
+>>20 uleshort >0
>>>8 string >\0 \b of %-.8s.DBF
# value 0 implies 512 as size
#>4 ulelong =0 \b, blocks size %u
# size of blocks not reliable like 0x2020204C in angest.dbt
->4 ulelong !0
+>4 ulelong !0
>>4 ulelong&0x0000003f 0 \b, blocks size %u
# dBase IV DBT with positive block length (found 512 , 1024)
>20 uleshort >0 \b, block length %u
# next available block
#>0 lelong =0 \b, next free block index %u
>0 lelong !0 \b, next free block index %u
->20 uleshort >0
->>(20.s) ubelong x
+>20 uleshort >0
+>>(20.s) ubelong x
>>>&-4 use dbase4-memofield-print
# unusual dBase IV DBT without block length (implies 512 as length)
->20 uleshort =0
->>512 ubelong x
+>20 uleshort =0
+>>512 ubelong x
>>>&-4 use dbase4-memofield-print
-# Print the information of dBase IV memo field
+# Print the information of dBase IV memo field
0 name dbase4-memofield-print
# free dBase IV memo field
->0 ubelong !0xFFFF0800
+>0 ubelong !0xFFFF0800
>>0 lelong x \b, next free block %u
>>4 lelong x \b, next used block %u
# used dBase IV memo field
->0 ubelong =0xFFFF0800
+>0 ubelong =0xFFFF0800
# length of memo field
>>4 lelong x \b, field length %d
>>>8 string >\0 \b, 1st used item "%s"
-# Print the information of FoxPro FPT memo file
+# Print the information of FoxPro FPT memo file
0 name foxpro-memo-print
>0 belong x FoxPro FPT
# Size of blocks for FoxPro ( 64,256 )
# next available block
#>0 belong =0 \b, next free block index %u
>0 belong !0 \b, next free block index %u
-# field type ( 0~picture, 1~memo, 2~object )
+# field type ( 0~picture, 1~memo, 2~object )
>512 ubelong <3 \b, field type %u
# length of memo field
->512 ubelong 1
+>512 ubelong 1
>>516 belong >0 \b, field length %d
>>>520 string >\0 \b, 1st item "%s"
-# TODO:
+# TODO:
# DBASE index file *.NDX
# DBASE Compound Index file *.CDX
# dBASE IV Printer Driver *.PRF
# Reference: https://github.com/libyal/libesedb/archive/master.zip
# libesedb-master/documentation/
# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
-# Note: also known as "JET Blue". Used by numerous Windows components such as
+# Note: also known as "JET Blue". Used by numerous Windows components such as
# Windows Search, Mail, Exchange and Active Directory.
-4 ubelong 0xefcdab89
+4 ubelong 0xefcdab89
# unknown1
>132 ubelong 0 Extensible storage engine
!:mime application/x-ms-ese
# From: Joerg Jenderek
# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
-8 string sdbf
->7 ubyte 0
+8 string sdbf
+>7 ubyte 0
# TAG_TYPE_LIST+TAG_INDEXES
>>12 uleshort 0x7802 Windows application compatibility Shim DataBase
# version? 2 3
# Reference: http://www.provue.com/Panorama/
# From: Joerg Jenderek
# NOTE: test only versions 4 and 6.0 with Windows
-# length of Panorama database name
-5 ubyte >0
+# length of Panorama database name
+5 ubyte >0
# look after database name for "some" null bits
->(5.B+7) ubelong&0xF3ffF000 0
+>(5.B+7) ubelong&0xF3ffF000 0
# look for first keyword
>>&1 search/2 DESIGN Panorama database
#!:mime application/x-panorama-database
# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
0 string MBSTV\040 MUIbase DB
>6 string x version %s
+
+#
+# CDB database
+0 string NBCDB\012 NetBSD Constant Database
+>7 byte x \b, version %d
+>8 string x \b, for '%s'
+>24 lelong x \b, datasize %d
+>28 lelong x \b, entries %d
+>32 lelong x \b, index %d
+>36 lelong x \b, seed %#x
#------------------------------------------------------------------------------
-# $File: compress,v 1.65 2015/12/04 20:48:03 christos Exp $
+# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
# der: file(1) magic for DER encoded files
#
# Key Pairs
0 der seq
->&0 der int1=00
+>&0 der int1=00
>&0 der int65=x
>&0 der int3=010001 DER Encoded Key Pair, 512 bits
0 der seq
->&0 der int1=00
+>&0 der int1=00
>&0 der int129=x
>&0 der int3=010001 DER Encoded Key Pair, 1024 bits
0 der seq
->&0 der int1=00
+>&0 der int1=00
>&0 der int257=x
>&0 der int3=010001 DER Encoded Key Pair, 2048 bits
0 der seq
->&0 der int1=00
+>&0 der int1=00
>&0 der int513=x
>&0 der int3=010001 DER Encoded Key Pair, 4096 bits
0 der seq
->&0 der int1=00
+>&0 der int1=00
>&0 der int1025=x
>&0 der int3=010001 DER Encoded Key Pair, 8192 bits
0 der seq
->&0 der int1=00
+>&0 der int1=00
>&0 der int2049=x
>&0 der int3=010001 DER Encoded Key Pair, 16k bits
0 der seq
->&0 der int1=00
+>&0 der int1=00
>&0 der int4097=x
>&0 der int3=010001 DER Encoded Key Pair, 32k bits
#------------------------------------------------------------------------------
-# $File: diff,v 1.13 2012/06/16 14:43:36 christos Exp $
+# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
# diff: file(1) magic for diff(1) output
#
-0 search/1 diff\ diff output text
+0 search/1 diff\040 diff output text
!:mime text/x-diff
-0 search/1 ***\ diff output text
+0 search/1 ***\040 diff output text
!:mime text/x-diff
-0 search/1 Only\ in\ diff output text
+0 search/1 Only\040in\040 diff output text
!:mime text/x-diff
-0 search/1 Common\ subdirectories:\ diff output text
+0 search/1 Common\040subdirectories:\040 diff output text
!:mime text/x-diff
0 search/1 Index: RCS/CVS diff output text
# unified diff
-0 search/4096 ---\
+0 search/4096 ---\040
>&0 search/1024 \n
->>&0 search/1 +++\
+>>&0 search/1 +++\040
>>>&0 search/1024 \n
>>>>&0 search/1 @@ unified diff output text
!:mime text/x-diff
#------------------------------------------------------------------------------
-# $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $
+# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
# from http://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
>5 byte&0x07 = 0x04 \b, dialogue (D)
>5 byte&0x07 = 0x05 \b, commentary (C)
>5 byte&0x07 = 0x06 \b, emergency (E)
->5 beshort&0x07e0 0x0720 \b, voiceover (VO)
+>5 beshort&0x07e0 0x0720 \b, voiceover (VO)
>5 beshort&0x07e0 >0x0720 \b, karaoke
# acmod
>6 byte&0xe0 = 0x00 1+1 front,
#------------------------------------------------------------------------------
-# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $
+# $File: dump,v 1.14 2017/03/17 21:35:28 christos Exp $
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
>824 string >\0 Host %s,
>888 belong >0 Flags %x
-24 belong 60012 new-fs dump file (big endian),
+24 belong 60012 new-fs dump file (big endian),
>0 use new-dump-be
-24 belong 60011 old-fs dump file (big endian),
+24 belong 60011 old-fs dump file (big endian),
>0 use old-dump-be
-24 lelong 60012 new-fs dump file (little endian),
+24 lelong 60012 new-fs dump file (little endian),
>0 use \^new-dump-be
-24 lelong 60011 old-fs dump file (little endian),
+24 lelong 60011 old-fs dump file (little endian),
>0 use \^old-dump-be
-24 belong 0x19540119 new-fs dump file (ufs2, big endian),
+24 belong 0x19540119 new-fs dump file (ufs2, big endian),
>0 use ufs2-dump-be
-24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
+24 lelong 0x19540119 new-fs dump file (ufs2, little endian),
>0 use \^ufs2-dump-be
18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
#------------------------------------------------------------------------------
-# $File: dyadic,v 1.6 2014/06/01 19:14:42 christos Exp $
+# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
# updated by Joerg Jenderek at Oct 2013
# .DIN Dyalog APL Input Table
# .DOT Dyalog APL Output Table
# .DFT Dyalog APL Format File
-0 ubeshort&0xFF60 0xaa00
+0 ubeshort&0xFF60 0xaa00
# skip biblio.dbt
->1 byte !4
+>1 byte !4
# real Dyalog APL have non zero version numbers like 7.3 or 13.4
>>2 ubeshort >0x0000 Dyalog APL
>>>1 byte 0x00 aplcore
#------------------------------------------------------------------------------
-# $File: editors,v 1.9 2016/07/18 11:55:11 christos Exp $
-# T602 editor documents
+# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
+# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
>4 string 0 Kamenicky
>4 string 2 KOI8-CS
>4 string >2 unknown encoding
-# Vi IMproved Encrypted file
+# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
0 string VimCrypt~ Vim encrypted file data
#------------------------------------------------------------------------------
-# $File: filesystems,v 1.115 2016/12/01 15:34:44 christos Exp $
+# $File: filesystems,v 1.120 2017/03/24 19:29:26 christos Exp $
# filesystems: file(1) magic for different filesystems
#
-0 name partid
+0 name partid
>0 ubyte 0x00 Unused
>0 ubyte 0x01 12-bit FAT
>0 ubyte 0x02 XENIX /
0 string \366\366\366\366 PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
-0774 beshort 0xdabe
+0774 beshort 0xdabe
# modified by Joerg Jenderek, because original test
# succeeds for Cabinet archive dao360.dl_ with negative blocks
>0770 long >0 Sun disk label
# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
0 string SBMBAKUP_ Smart Boot Manager backup file
>9 string x \b, version %-5.5s
->>14 string =_
+>>14 string =_
>>>15 string x %-.1s
>>>>16 string =_ \b.
>>>>>17 string x \b%-.1s
>>>>>>18 string =_ \b.
>>>>>>>19 string x \b%-.1s
->>>22 ubyte 0
+>>>22 ubyte 0
>>>>21 ubyte x \b, from drive 0x%x
->>>22 ubyte >0
+>>>22 ubyte >0
>>>>21 string x \b, from drive %s
->>>535 search/17 \x55\xAA
->>>>&-512 indirect x \b; contains
+>>>535 search/17 \x55\xAA
+>>>>&-512 indirect x \b; contains
# updated by Joerg Jenderek at Nov 2012
# DOS Emulator image is 128 byte, null right padded header + harddisc image
-0 string DOSEMU\0
->0x27E leshort 0xAA55
+0 string DOSEMU\0
+>0x27E leshort 0xAA55
#offset is 128
->>19 ubyte 128
+>>19 ubyte 128
>>>(19.b-1) ubyte 0x0 DOS Emulator image
>>>>7 ulelong >0 \b, %u heads
>>>>11 ulelong >0 \b, %d sectors/track
>>>>15 ulelong >0 \b, %d cylinders
->>>>128 indirect x \b; contains
+>>>>128 indirect x \b; contains
# added by Joerg Jenderek at Nov 2012
# http://www.thenakedpc.com/articles/v04/08/0408-05.html
# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
0 string PNCIHISK\0 Norton Utilities disc image data
# real x86 boot sector with jump instruction
->509 search/1026 \x55\xAA\xeb
->>&-1 indirect x \b; contains
+>509 search/1026 \x55\xAA\xeb
+>>&-1 indirect x \b; contains
# http://file-extension.net/seeker/file_extension_dat
0 string PNCIUNDO Norton Disk Doctor UnDo file
#
# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
# for any allowed sector sizes
-30 search/481 \x55\xAA
+30 search/481 \x55\xAA
# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
!:strength +65
# for sector sizes < 512 Bytes
->11 uleshort <512
+>11 uleshort <512
>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
# for sector sizes with 512 or more Bytes
>0x1FE leshort 0xAA55 DOS/MBR boot sector
>2 string OSBS OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
-# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
+# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR
# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
->>8 ubequad 0x8bf45007501ffbfc
+>>8 ubequad 0x8bf45007501ffbfc
# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
>>>0x16 ubyte 0xF3 \b,DOS 2
>>>>219 regex Author\ -\ Author:
# found "David Litton" , "A Pehrsson "
>>>>>&0 string x "%s"
->>>0x16 ubyte 0xF2
+>>>0x16 ubyte 0xF2
# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3
>>>>>>(0x79.b) string >\0 "%s"
# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b
->>8 ubequad 0x5007501ffcbe1b7c
+>>8 ubequad 0x5007501ffcbe1b7c
# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
>>>24 ubequad 0xf3a4cbbebe07b104 9M
# "Invalid partition table" nn=0x10F for english version
>>>>(0x1b7.b+0x100) string >\0 "%s"
# Microsoft Windows Vista or 7
# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
->>8 ubequad 0xc08ed8be007cbf00
+>>8 ubequad 0xc08ed8be007cbf00
# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
# assembler instructions: jnz 0729;cmp ebx,"TCPA"
>>>0xEC ubequad 0x753b6681fb544350 Vista
# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x
# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
->>0xDA uleshort 0
+>>0xDA uleshort 0
>>>0xDC ulelong >0 \b, created
# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
>>>>0xDC ubyte x with driveID 0x%x
-# hours, minutes and seconds
+# hours, minutes and seconds
>>>>0xDf ubyte x at %x
>>>>0xDe ubyte x \b:%x
>>>>0xDd ubyte x \b:%x
# special case for Microsoft MS-DOS 3.21 spanish
-# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
->0 ubequad 0xfab830008ed0bc00
-# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
+# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
+>0 ubequad 0xfab830008ed0bc00
+# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish
# Microsoft MBR IPL end
# dr-dos with some upper-, lowercase variants
->0x9D string Invalid\ partition\ table$
->>181 string No\ Operating\ System$
+>0x9D string Invalid\ partition\ table$
+>>181 string No\ Operating\ System$
>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
->0x9D string Invalid\ partition\ table$
->>181 string No\ operating\ system$
+>0x9D string Invalid\ partition\ table$
+>>181 string No\ operating\ system$
>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
->342 string Invalid\ partition\ table$
->>366 string No\ operating\ system$
+>342 string Invalid\ partition\ table$
+>>366 string No\ operating\ system$
>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
->295 string NEWLDR\0
->>302 string Bad\ PT\ $
->>>310 string No\ OS\ $
->>>>317 string OS\ load\ err$
->>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
->>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
->>>>>>>387 string Copyright\ (c)\ 1984,1998
+>295 string NEWLDR\0
+>>302 string Bad\ PT\ $
+>>>310 string No\ OS\ $
+>>>>317 string OS\ load\ err$
+>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
+>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
+>>>>>>>387 string Copyright\ (c)\ 1984,1998
>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
#
# tests for different MS-DOS Master Boot Records (MBR) moved and merged
#>0x145 string Default:\ F \b, FREE-DOS MBR
#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR
>0x145 search/7 Default:\ F \b, FREE-DOS MBR
-#>>313 string F0\ .\ .\ .
-#>>>322 string disk\ 1
-#>>>>382 string FAT3
->64 string no\ active\ partition\ found
+#>>313 string F0\ .\ .\ .
+#>>>322 string disk\ 1
+#>>>>382 string FAT3
+>64 string no\ active\ partition\ found
>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
# Ranish Partition Manager http://www.ranish.com/part/
->387 search/4 \0\ Error!\r
->>378 search/7 Virus!
->>>397 search/4 Booting\
+>387 search/4 \0\ Error!\r
+>>378 search/7 Virus!
+>>>397 search/4 Booting\040
>>>>408 search/4 HD1/\0 \b, Ranish MBR (
>>>>>416 string Writing\ changes... \b2.37
>>>>>>438 ubyte x \b,0x%x dots
#
# SYSLINUX MBR moved
# http://www.acronis.de/
->362 string MBR\ Error\ \0\r
->>376 string ress\ any\ key\ to\
+>362 string MBR\ Error\ \0\r
+>>376 string ress\ any\ key\ to\040
>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
->309 string No\ bootable\ partition\ found\r
+>309 string No\ bootable\ partition\ found\r
>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
->349 string No\ bootable\ partition\ found\r
+>349 string No\ bootable\ partition\ found\r
>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
# bootloader, bootmanager
->0x40 string SBML
+>0x40 string SBML
# label with 11 characters of FAT 12 bit filesystem
->>43 string SMART\ BTMGR
+>>43 string SMART\ BTMGR
>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager
# OEM-ID not always "SBM"
-#>>>>3 strings SBM
+#>>>>3 strings SBM
>>>>6 string >\0 \b, version %s
>382 string XOSLLOADXCF \b, eXtended Operating System Loader
>6 string LILO \b, LInux i386 boot LOader
# variables according to grub-0.97/stage1/stage1.S or
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
->342 search/60 \0Geom\0
+>342 search/60 \0Geom\0
#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0
->>0x41 ubyte <2
+>>0x41 ubyte <2
>>>0x3E ubyte >2 \b; GRand Unified Bootloader
-# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
+# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
>>>>0x3E ubyte x \b, stage1 version 0x%x
#If it is 0xFF, use a drive passed by BIOS
>>>>0x40 ubyte <0xFF \b, boot drive 0x%x
>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>>385 string GRUB\ \0 \b, GRUB version 0.97
# unknown version
->>>343 string Geom\0Read\0\ Error\0
+>>>343 string Geom\0Read\0\ Error\0
>>>>321 string Loading\ stage1.5 \b, GRUB version x.y
>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
>>>>374 string GRUB\ \0 \b, GRUB version n.m
# SYSLINUX bootloader moved
>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
# http://www.bcdwb.de/bcdw/index_e.htm
->3 string BCDL
+>3 string BCDL
>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
# mbr partition table entries updated by Joerg Jenderek at Sep 2013
# skip Norton Utilities disc image data
->3 string !IHISK
+>3 string !IHISK
# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
->>0 belong !0xb8c0078e
-# not Linux kernel
->>>514 string !HdrS
+>>0 belong !0xb8c0078e
+# not Linux kernel
+>>>514 string !HdrS
# not BeOS
->>>>422 string !Be\ Boot\ Loader
-# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
->>>>>0 ubelong&0xFD000000 =0xE9000000
+>>>>422 string !Be\ Boot\ Loader
+# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
+>>>>>0 ubelong&0xFD000000 =0xE9000000
# AdvanceMAME mbr
->>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
+>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e
>>>>>>>446 use partition-table
# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
->>>>>0 ubelong&0xFD000000 !0xE9000000
+>>>>>0 ubelong&0xFD000000 !0xE9000000
# skip FSInfosector
->>>>>>0 string !RRaA
+>>>>>>0 string !RRaA
# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
->>>>>>>0 ubequad !0xfa660fb64610668b
+>>>>>>>0 ubequad !0xfa660fb64610668b
# skip 13rd sector of MS x86 bootloader
->>>>>>>>0 ubequad !0x660fb64610668b4e
+>>>>>>>>0 ubequad !0x660fb64610668b4e
# skip sector starting with DOS new line
->>>>>>>>>0 string !\r\n
+>>>>>>>>>0 string !\r\n
# allowed active flag 0,80h-FFh
->>>>>>>>>>446 ubyte 0
+>>>>>>>>>>446 ubyte 0
>>>>>>>>>>>446 use partition-table
->>>>>>>>>>446 ubyte >0x7F
+>>>>>>>>>>446 ubyte >0x7F
>>>>>>>>>>>446 use partition-table
# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
# mbr partition table entries end
# http://www.acronis.de/
#FAT label=ACRONIS\ SZ
#OEM-ID=BOOTWIZ0
->442 string Non-system\ disk,\
+>442 string Non-system\ disk,\040
>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
# updated by Joerg Jenderek at Nov 2012, Sep 2013
# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
# display 1 space
->>>447 ubyte x \b
+>>>447 ubyte x \b
>>>477 use DOS-filename
#
->185 string FDBOOT\ Version\
->>204 string \rNo\ Systemdisk.\
->>>220 string Booting\ from\ harddisk.\n\r
->>>245 string Cannot\ load\ from\ harddisk.\n\r
->>>>273 string Insert\ Systemdisk\
+>185 string FDBOOT\ Version\040
+>>204 string \rNo\ Systemdisk.\040
+>>>220 string Booting\ from\ harddisk.\n\r
+>>>245 string Cannot\ load\ from\ harddisk.\n\r
+>>>>273 string Insert\ Systemdisk\040
>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
>>>>>>200 string >\0 \b, version %-3s
->242 string Bootsector\ from\ C.H.\ Hochst\204
+>242 string Bootsector\ from\ C.H.\ Hochst\204
# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c
# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
->242 search/127 Bootsector\ from\ C.H.\ Hochst
->>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
+>242 search/127 Bootsector\ from\ C.H.\ Hochst
+>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk
# followed by variants with point,CR-NL or NL-CR
->>>208 search/261 Cannot\ load\ from\ harddisk.
+>>>208 search/261 Cannot\ load\ from\ harddisk.
# followed by variants CR-NL or NL-CR
->>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
+>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key.
# followed by variants with point,CR-NL or NL-CR
>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader
# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
>>>>>>&0 string x \b, version %-4.4s
->(1.b+2) ubyte 0xe
->>(1.b+3) ubyte 0x1f
->>>(1.b+4) ubyte 0xbe
+>(1.b+2) ubyte 0xe
+>>(1.b+3) ubyte 0x1f
+>>>(1.b+4) ubyte 0xbe
# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
->>>>(1.b+5) ubyte&0xd3 0x53
->>>>>(1.b+6) ubyte 0x7c
+>>>>(1.b+5) ubyte&0xd3 0x53
+>>>>>(1.b+6) ubyte 0x7c
# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
->>>>>>(1.b+7) ubyte 0xac
->>>>>>>(1.b+8) ubyte 0x22
->>>>>>>>(1.b+9) ubyte 0xc0
->>>>>>>>>(1.b+10) ubyte 0x74
->>>>>>>>>>(1.b+11) ubyte 0x0b
->>>>>>>>>>>(1.b+12) ubyte 0x56
+>>>>>>(1.b+7) ubyte 0xac
+>>>>>>>(1.b+8) ubyte 0x22
+>>>>>>>>(1.b+9) ubyte 0xc0
+>>>>>>>>>(1.b+10) ubyte 0x74
+>>>>>>>>>>(1.b+11) ubyte 0x0b
+>>>>>>>>>>>(1.b+12) ubyte 0x56
>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
# FAT1X version
->>>>>>>>>>>>>(1.b+5) ubyte 0x5b
+>>>>>>>>>>>>>(1.b+5) ubyte 0x5b
>>>>>>>>>>>>>>0x5b string >\0 "%-s"
# FAT32 version
->>>>>>>>>>>>>(1.b+5) ubyte 0x77
+>>>>>>>>>>>>>(1.b+5) ubyte 0x77
>>>>>>>>>>>>>>0x77 string >\0 "%-s"
>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display
-#>>244 string from\ dosemu-freedos-*-bin.tgz\r
-#>>>170 string Sorry,\ could\ not\ load\ an\
-#>>>>195 string operating\ system.\r\n
+#>>244 string from\ dosemu-freedos-*-bin.tgz\r
+#>>>170 string Sorry,\ could\ not\ load\ an\040
+#>>>>195 string operating\ system.\r\n
#
->103 string This\ is\ not\ a\ bootable\ disk.\
->>132 string Please\ insert\ a\ bootable\
->>>157 string floppy\ and\r\n
+>103 string This\ is\ not\ a\ bootable\ disk.\040
+>>132 string Please\ insert\ a\ bootable\040
+>>>157 string floppy\ and\r\n
>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
#
->66 string Solaris\ Boot\ Sector
->>99 string Incomplete\ MDBoot\ load.
+>66 string Solaris\ Boot\ Sector
+>>99 string Incomplete\ MDBoot\ load.
>>>89 string Version \b, Sun Solaris Bootloader
>>>>97 byte x version %c
#
->408 string OS/2\ !!\ SYS01475\r\0
->>429 string OS/2\ !!\ SYS02025\r\0
->>>450 string OS/2\ !!\ SYS02027\r\0
+>408 string OS/2\ !!\ SYS01475\r\0
+>>429 string OS/2\ !!\ SYS02025\r\0
+>>>450 string OS/2\ !!\ SYS02027\r\0
>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
#
->409 string OS/2\ !!\ SYS01475\r\0
->>430 string OS/2\ !!\ SYS02025\r\0
->>>451 string OS/2\ !!\ SYS02027\r\0
+>409 string OS/2\ !!\ SYS01475\r\0
+>>430 string OS/2\ !!\ SYS02025\r\0
+>>>451 string OS/2\ !!\ SYS02027\r\0
>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
->112 string This\ disk\ is\ not\ bootable\r
->>142 string If\ you\ wish\ to\ make\ it\ bootable
->>>176 string run\ the\ DOS\ program\ SYS\
->>>200 string after\ the\r
->>>>216 string system\ has\ been\ loaded\r\n
->>>>>242 string Please\ insert\ a\ DOS\ diskette\
->>>>>271 string into\r\n\ the\ drive\ and\
+>112 string This\ disk\ is\ not\ bootable\r
+>>142 string If\ you\ wish\ to\ make\ it\ bootable
+>>>176 string run\ the\ DOS\ program\ SYS\040
+>>>200 string after\ the\r
+>>>>216 string system\ has\ been\ loaded\r\n
+>>>>>242 string Please\ insert\ a\ DOS\ diskette\040
+>>>>>271 string into\r\n\ the\ drive\ and\040
>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
# XP
->430 string NTLDR\ is\ missing\xFF\r\n
->>449 string Disk\ error\xFF\r\n
+>430 string NTLDR\ is\ missing\xFF\r\n
+>>449 string Disk\ error\xFF\r\n
>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
#
->>>>371 ubyte >0x20
->>>>>368 ubyte&0xDF >0
+>>>>371 ubyte >0x20
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
#
->430 string NTLDR\ nicht\ gefunden\xFF\r\n
->>453 string Datentr\204gerfehler\xFF\r\n
+>430 string NTLDR\ nicht\ gefunden\xFF\r\n
+>>453 string Datentr\204gerfehler\xFF\r\n
>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
# offset variant
->>>>379 string \0
->>>>>368 ubyte&0xDF >0
+>>>>379 string \0
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
#
->430 string NTLDR\ fehlt\xFF\r\n
->>444 string Datentr\204gerfehler\xFF\r\n
+>430 string NTLDR\ fehlt\xFF\r\n
+>>444 string Datentr\204gerfehler\xFF\r\n
>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
# variant
->>>>371 ubyte >0x20
->>>>>368 ubyte&0xDF >0
+>>>>371 ubyte >0x20
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
#
->430 string NTLDR\ fehlt\xFF\r\n
->>444 string Medienfehler\xFF\r\n
+>430 string NTLDR\ fehlt\xFF\r\n
+>>444 string Medienfehler\xFF\r\n
>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
->>>>371 ubyte >0x20
->>>>>368 ubyte&0xDF >0
+>>>>371 ubyte >0x20
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
# variant
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
#
->430 string Datentr\204ger\ entfernen\xFF\r\n
->>454 string Medienfehler\xFF\r\n
+>430 string Datentr\204ger\ entfernen\xFF\r\n
+>>454 string Medienfehler\xFF\r\n
>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
->>>>379 string \0
->>>>>368 ubyte&0xDF >0
+>>>>379 string \0
+>>>>>368 ubyte&0xDF >0
>>>>>>368 string x %-.5s
->>>>>>>373 ubyte&0xDF >0
+>>>>>>>373 ubyte&0xDF >0
>>>>>>>>373 string x \b%-.3s
->>>>>>376 ubyte&0xDF >0
+>>>>>>376 ubyte&0xDF >0
>>>>>>>376 string x \b.%-.3s
# variant
->>>>417 ubyte&0xDF >0
+>>>>417 ubyte&0xDF >0
>>>>>417 string x %-.5s
->>>>>>422 ubyte&0xDF >0
+>>>>>>422 ubyte&0xDF >0
>>>>>>>422 string x \b%-.3s
->>>>>425 ubyte&0xDF >0
+>>>>>425 ubyte&0xDF >0
>>>>>>425 string >\ \b.%-.3s
#
-#>3 string NTFS\ \ \ \
->389 string Fehler\ beim\ Lesen\
+#>3 string NTFS\ \ \ \040
+>389 string Fehler\ beim\ Lesen\040
>>407 string des\ Datentr\204gers
->>>426 string NTLDR\ fehlt
+>>>426 string NTLDR\ fehlt
>>>>440 string NTLDR\ ist\ komprimiert
>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
-#>3 string NTFS\ \ \ \
+#>3 string NTFS\ \ \ \040
>313 string A\ disk\ read\ error\ occurred.\r
->>345 string A\ kernel\ file\ is\ missing\
->>>370 string from\ the\ disk.\r
->>>>484 string NTLDR\ is\ compressed
->>>>>429 string Insert\ a\ system\ diskette\
+>>345 string A\ kernel\ file\ is\ missing\040
+>>>370 string from\ the\ disk.\r
+>>>>484 string NTLDR\ is\ compressed
+>>>>>429 string Insert\ a\ system\ diskette\040
>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
# DOS loader variants different languages,offsets
>472 ubyte&0xDF >0
->>389 string Invalid\ system\ disk\xFF\r\n
->>>411 string Disk\ I/O\ error
->>>>428 string Replace\ the\ disk,\ and\
+>>389 string Invalid\ system\ disk\xFF\r\n
+>>>411 string Disk\ I/O\ error
+>>>>428 string Replace\ the\ disk,\ and\040
>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
#IO.SYS
->>>>>>472 ubyte&0xDF >0
+>>>>>>472 ubyte&0xDF >0
>>>>>>>472 string x \b %-.2s
->>>>>>>>474 ubyte&0xDF >0
+>>>>>>>>474 ubyte&0xDF >0
>>>>>>>>>474 string x \b%-.5s
->>>>>>>>>>479 ubyte&0xDF >0
+>>>>>>>>>>479 ubyte&0xDF >0
>>>>>>>>>>>479 string x \b%-.1s
->>>>>>>480 ubyte&0xDF >0
+>>>>>>>480 ubyte&0xDF >0
>>>>>>>>480 string x \b.%-.3s
#MSDOS.SYS
>>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>>483 string x \b%-.5s
->>>>>>>>>488 ubyte&0xDF >0
+>>>>>>>>>488 ubyte&0xDF >0
>>>>>>>>>>488 string x \b%-.3s
->>>>>>>>491 ubyte&0xDF >0
+>>>>>>>>491 ubyte&0xDF >0
>>>>>>>>>491 string x \b.%-.3s
#
->>390 string Invalid\ system\ disk\xFF\r\n
->>>412 string Disk\ I/O\ error\xFF\r\n
->>>>429 string Replace\ the\ disk,\ and\
+>>390 string Invalid\ system\ disk\xFF\r\n
+>>>412 string Disk\ I/O\ error\xFF\r\n
+>>>>429 string Replace\ the\ disk,\ and\040
>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
->>388 string Ungueltiges\ System\ \xFF\r\n
->>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
->>>>427 string Datentraeger\ wechseln\ und\
+>>388 string Ungueltiges\ System\ \xFF\r\n
+>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>427 string Datentraeger\ wechseln\ und\040
>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
#WINBOOT.SYS only not spaces (0xDF)
->>>>>>497 ubyte&0xDF >0
+>>>>>>497 ubyte&0xDF >0
>>>>>>>497 string x %-.5s
->>>>>>>>502 ubyte&0xDF >0
+>>>>>>>>502 ubyte&0xDF >0
>>>>>>>>>502 string x \b%-.1s
->>>>>>>>>>503 ubyte&0xDF >0
+>>>>>>>>>>503 ubyte&0xDF >0
>>>>>>>>>>>503 string x \b%-.1s
->>>>>>>>>>>>504 ubyte&0xDF >0
+>>>>>>>>>>>>504 ubyte&0xDF >0
>>>>>>>>>>>>>504 string x \b%-.1s
->>>>>>505 ubyte&0xDF >0
+>>>>>>505 ubyte&0xDF >0
>>>>>>>505 string x \b.%-.3s
#IO.SYS
>>>>>>472 ubyte&0xDF >0 or
>>>>>>>472 string x \b %-.2s
->>>>>>>>474 ubyte&0xDF >0
+>>>>>>>>474 ubyte&0xDF >0
>>>>>>>>>474 string x \b%-.5s
->>>>>>>>>>479 ubyte&0xDF >0
+>>>>>>>>>>479 ubyte&0xDF >0
>>>>>>>>>>>479 string x \b%-.1s
->>>>>>>480 ubyte&0xDF >0
+>>>>>>>480 ubyte&0xDF >0
>>>>>>>>480 string x \b.%-.3s
#MSDOS.SYS
>>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>>483 string x \b%-.5s
->>>>>>>>>488 ubyte&0xDF >0
+>>>>>>>>>488 ubyte&0xDF >0
>>>>>>>>>>488 string x \b%-.3s
->>>>>>>>491 ubyte&0xDF >0
+>>>>>>>>491 ubyte&0xDF >0
>>>>>>>>>491 string x \b.%-.3s
#
->>390 string Ungueltiges\ System\ \xFF\r\n
->>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
->>>>429 string Datentraeger\ wechseln\ und\
+>>390 string Ungueltiges\ System\ \xFF\r\n
+>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>429 string Datentraeger\ wechseln\ und\040
>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
#WINBOOT.SYS only not spaces (0xDF)
->>>>>>497 ubyte&0xDF >0
+>>>>>>497 ubyte&0xDF >0
>>>>>>>497 string x %-.7s
->>>>>>>>504 ubyte&0xDF >0
+>>>>>>>>504 ubyte&0xDF >0
>>>>>>>>>504 string x \b%-.1s
->>>>>>505 ubyte&0xDF >0
+>>>>>>505 ubyte&0xDF >0
>>>>>>>505 string x \b.%-.3s
#IO.SYS
>>>>>>472 ubyte&0xDF >0 or
>>>>>>>472 string x \b %-.2s
->>>>>>>>474 ubyte&0xDF >0
+>>>>>>>>474 ubyte&0xDF >0
>>>>>>>>>474 string x \b%-.6s
->>>>>>>480 ubyte&0xDF >0
+>>>>>>>480 ubyte&0xDF >0
>>>>>>>>480 string x \b.%-.3s
#MSDOS.SYS
>>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>>483 string x \b%-.5s
->>>>>>>>>488 ubyte&0xDF >0
+>>>>>>>>>488 ubyte&0xDF >0
>>>>>>>>>>488 string x \b%-.3s
->>>>>>>>491 ubyte&0xDF >0
+>>>>>>>>491 ubyte&0xDF >0
>>>>>>>>>491 string x \b.%-.3s
#
->>389 string Ungueltiges\ System\ \xFF\r\n
->>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
->>>>428 string Datentraeger\ wechseln\ und\
+>>389 string Ungueltiges\ System\ \xFF\r\n
+>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>428 string Datentraeger\ wechseln\ und\040
>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
>>>>>>472 string x %-.2s
->>>>>>>474 ubyte&0xDF >0
+>>>>>>>474 ubyte&0xDF >0
>>>>>>>>474 string x \b%-.5s
->>>>>>>>479 ubyte&0xDF >0
+>>>>>>>>479 ubyte&0xDF >0
>>>>>>>>>479 string x \b%-.1s
->>>>>>480 ubyte&0xDF >0
+>>>>>>480 ubyte&0xDF >0
>>>>>>>480 string x \b.%-.3s
>>>>>>483 ubyte&0xDF >0 \b+
>>>>>>>483 string x \b%-.5s
->>>>>>>488 ubyte&0xDF >0
+>>>>>>>488 ubyte&0xDF >0
>>>>>>>>488 string x \b%-.2s
->>>>>>>>490 ubyte&0xDF >0
+>>>>>>>>490 ubyte&0xDF >0
>>>>>>>>>490 string x \b%-.1s
->>>>>>>491 ubyte&0xDF >0
+>>>>>>>491 ubyte&0xDF >0
>>>>>>>>491 string x \b.%-.3s
>479 ubyte&0xDF >0
->>416 string Kein\ System\ oder\
->>>433 string Laufwerksfehler
+>>416 string Kein\ System\ oder\040
+>>>433 string Laufwerksfehler
>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
#IO.SYS
>>>>>479 string x \b %-.2s
->>>>>>481 ubyte&0xDF >0
+>>>>>>481 ubyte&0xDF >0
>>>>>>>481 string x \b%-.6s
->>>>>487 ubyte&0xDF >0
+>>>>>487 ubyte&0xDF >0
>>>>>>487 string x \b.%-.3s
#MSDOS.SYS
>>>>>>490 ubyte&0xDF >0 \b+
>>>>>>>490 string x \b%-.5s
->>>>>>>>495 ubyte&0xDF >0
+>>>>>>>>495 ubyte&0xDF >0
>>>>>>>>>495 string x \b%-.3s
->>>>>>>498 ubyte&0xDF >0
+>>>>>>>498 ubyte&0xDF >0
>>>>>>>>498 string x \b.%-.3s
#
->376 search/41 Non-System\ disk\ or\
->>395 search/41 disk\ error\r
->>>407 search/41 Replace\ and\
+>376 search/41 Non-System\ disk\ or\040
+>>395 search/41 disk\ error\r
+>>>407 search/41 Replace\ and\040
>>>>419 search/41 press\ \b,
>>>>419 search/41 strike\ \b, old
>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader
#449 Disk\ Boot\ failure\r MS 3.21
#466 Boot\ Failure\r MS 3.30
->>>>>468 search/18 \0
+>>>>>468 search/18 \0
#IO.SYS,IBMBIO.COM
>>>>>>&0 string x \b %-.2s
->>>>>>>&-20 ubyte&0xDF >0
+>>>>>>>&-20 ubyte&0xDF >0
>>>>>>>>&-1 string x \b%-.4s
->>>>>>>>>&-16 ubyte&0xDF >0
+>>>>>>>>>&-16 ubyte&0xDF >0
>>>>>>>>>>&-1 string x \b%-.2s
>>>>>>&8 ubyte&0xDF >0 \b.
>>>>>>>&-1 string x \b%-.3s
#MSDOS.SYS,IBMDOS.COM
>>>>>>&11 ubyte&0xDF >0 \b+
>>>>>>>&-1 string x \b%-.5s
->>>>>>>>&-6 ubyte&0xDF >0
+>>>>>>>>&-6 ubyte&0xDF >0
>>>>>>>>>&-1 string x \b%-.1s
->>>>>>>>>>&-5 ubyte&0xDF >0
+>>>>>>>>>>&-5 ubyte&0xDF >0
>>>>>>>>>>>&-1 string x \b%-.2s
>>>>>>>&7 ubyte&0xDF >0 \b.
>>>>>>>>&-1 string x \b%-.3s
>441 string Cannot\ load\ from\ harddisk.\n\r
->>469 string Insert\ Systemdisk\
+>>469 string Insert\ Systemdisk\040
>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader
-#>43 string \224R-LOADER\ \ SYS =label
+#>43 string \224R-LOADER\ \ SYS =label
>54 string SYS
>>324 string VASKK
>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
#
->98 string Press\ a\ key\ to\ retry\0\r
->>120 string Cannot\ find\ file\ \0\r
->>>139 string Disk\ read\ error\0\r
+>98 string Press\ a\ key\ to\ retry\0\r
+>>120 string Cannot\ find\ file\ \0\r
+>>>139 string Disk\ read\ error\0\r
>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader
#DRBIOS.SYS
->>>>>44 ubyte&0xDF >0
+>>>>>44 ubyte&0xDF >0
>>>>>>44 string x \b %-.6s
->>>>>>>50 ubyte&0xDF >0
+>>>>>>>50 ubyte&0xDF >0
>>>>>>>>50 string x \b%-.2s
->>>>>>52 ubyte&0xDF >0
+>>>>>>52 ubyte&0xDF >0
>>>>>>>52 string x \b.%-.3s
#
->70 string IBMBIO\ \ COM
->>472 string Cannot\ load\ DOS!\
+>70 string IBMBIO\ \ COM
+>>472 string Cannot\ load\ DOS!\040
>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
->>471 string Cannot\ load\ DOS\
+>>471 string Cannot\ load\ DOS\040
>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
#??
->444 string KERNEL\ \ SYS
+>444 string KERNEL\ \ SYS
>>314 string BOOT\ error! \b, FREE-DOS Bootloader
->499 string KERNEL\ \ SYS
+>499 string KERNEL\ \ SYS
>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
->449 string KERNEL\ \ SYS
+>449 string KERNEL\ \ SYS
>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
#
->449 string Loading\ FreeDOS
+>449 string Loading\ FreeDOS
>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
#
>331 string Error!.0 \b, FREE-DOS 1.0 bootloader
#
->125 string Loading\ FreeDOS...\r
+>125 string Loading\ FreeDOS...\r
>>311 string BOOT\ error!\r \b, FREE-DOS bootloader
->>>441 ubyte&0xDF >0
+>>>441 ubyte&0xDF >0
>>>>441 string x \b %-.6s
->>>>>447 ubyte&0xDF >0
+>>>>>447 ubyte&0xDF >0
>>>>>>447 string x \b%-.1s
->>>>>>>448 ubyte&0xDF >0
+>>>>>>>448 ubyte&0xDF >0
>>>>>>>>448 string x \b%-.1s
->>>>449 ubyte&0xDF >0
+>>>>449 ubyte&0xDF >0
>>>>>449 string x \b.%-.3s
->124 string FreeDOS\0
+>124 string FreeDOS\0
>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
->336 string Error!\
+>336 string Error!\040
>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
->>>497 ubyte&0xDF >0
+>>>497 ubyte&0xDF >0
>>>>497 string x \b %-.6s
->>>>>503 ubyte&0xDF >0
+>>>>>503 ubyte&0xDF >0
>>>>>>503 string x \b%-.1s
->>>>>>>504 ubyte&0xDF >0
+>>>>>>>504 ubyte&0xDF >0
>>>>>>>>504 string x \b%-.1s
->>>>505 ubyte&0xDF >0
+>>>>505 ubyte&0xDF >0
>>>>>505 string x \b.%-.3s
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
# OEM-ID=Visopsys
->478 ulelong 0
->>(1.b+326) string I/O\ Error\ reading\
->>>(1.b+344) string Visopsys\ loader\r
+>478 ulelong 0
+>>(1.b+326) string I/O\ Error\ reading\040
+>>>(1.b+344) string Visopsys\ loader\r
>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
# http://alexfru.chat.ru/epm.html#bootprog
->494 ubyte >0x4D
->>495 string >E
->>>495 string <S
+>494 ubyte >0x4D
+>>495 string >E
+>>>495 string <S
#OEM-ID is not reliable
->>>>3 string BootProg
+>>>>3 string BootProg
# It just looks for a program file name at the root directory
# and loads corresponding file with following execution.
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
->>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
+>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
>>>>>499 use DOS-filename
#If the boot sector fails to read any other sector,
#it prints a very short message ("RE") to the screen and hangs the computer.
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
->0 string RRaA
+>0 string RRaA
>>0x1E4 string rrAa \b, FSInfosector
#>>0x1FC uleshort =0 SHOULD BE ZERO
>>>0x1E8 ulelong <0xffffffff \b, %u free clusters
>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u
# updated by Joerg Jenderek at Sep 2007
->3 ubyte 0
+>3 ubyte 0
#no active flag
->>446 ubyte 0
+>>446 ubyte 0
# partition 1 not empty
->>>450 ubyte >0
+>>>450 ubyte >0
# partitions 3,4 empty
->>>>482 ubyte 0
->>>>>498 ubyte 0
+>>>>482 ubyte 0
+>>>>>498 ubyte 0
# partition 2 ID=0,5,15
->>>>>>466 ubyte <0x10
+>>>>>>466 ubyte <0x10
>>>>>>>466 ubyte 0x05 \b, extended partition table
>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
0 name DOS-filename
-# space=0x20 (00100000b) means empty
->0 ubyte&0xDF >0
+# space=0x20 (00100000b) means empty
+>0 ubyte&0xDF >0
>>0 ubyte x \b%c
->>>1 ubyte&0xDF >0
+>>>1 ubyte&0xDF >0
>>>>1 ubyte x \b%c
->>>>>2 ubyte&0xDF >0
+>>>>>2 ubyte&0xDF >0
>>>>>>2 ubyte x \b%c
->>>>>>>3 ubyte&0xDF >0
+>>>>>>>3 ubyte&0xDF >0
>>>>>>>>3 ubyte x \b%c
->>>>>>>>>4 ubyte&0xDF >0
+>>>>>>>>>4 ubyte&0xDF >0
>>>>>>>>>>4 ubyte x \b%c
->>>>>>>>>>>5 ubyte&0xDF >0
+>>>>>>>>>>>5 ubyte&0xDF >0
>>>>>>>>>>>>5 ubyte x \b%c
->>>>>>>>>>>>>6 ubyte&0xDF >0
+>>>>>>>>>>>>>6 ubyte&0xDF >0
>>>>>>>>>>>>>>6 ubyte x \b%c
->>>>>>>>>>>>>>>7 ubyte&0xDF >0
+>>>>>>>>>>>>>>>7 ubyte&0xDF >0
>>>>>>>>>>>>>>>>7 ubyte x \b%c
# DOS filename extension
>>8 ubyte&0xDF >0 \b.
>>>8 ubyte x \b%c
->>>>9 ubyte&0xDF >0
+>>>>9 ubyte&0xDF >0
>>>>>9 ubyte x \b%c
->>>>>>10 ubyte&0xDF >0
+>>>>>>10 ubyte&0xDF >0
>>>>>>>10 ubyte x \b%c
# Print 2 following DOS filenames from directory entry form
# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
0 name 2xDOS-filename
# display 1 space
->0 ubyte x \b
+>0 ubyte x \b
>0 use DOS-filename
>11 ubyte x \b+
>11 use DOS-filename
# partition type ID > 0
>4 ubyte >0
# active flag 0
->>0 ubyte 0
+>>0 ubyte 0
>>>0 use partition-entry
-# active flag 0x80, 0x81, ...
->>0 ubyte >0x7F
+# active flag 0x80, 0x81, ...
+>>0 ubyte >0x7F
>>>0 use partition-entry
# Print entry of partition table
0 name partition-entry
# sector
>1 ubyte&0x3F x \b,%u
-# FATX
+# FATX
0 string FATX FATX filesystem data
# romfs filesystems - Juan Cespedes <cespedes@debian.org>
# http://syslinux.zytor.com/iso.php
# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
-0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
+0 ulequad&0x909000007cc0eafa 0x909000007c40eafa
>631 search/689 ISOLINUX\ isolinux Loader
>>&0 string x (version %-4.4s)
# http://syslinux.zytor.com/pxe.php
>11 string x (version %-4.4s)
# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
-0 ulelong&0x80909bEB 0x009018EB
+0 ulelong&0x80909bEB 0x009018EB
# OEM-ID not always "SYSLINUX"
->434 search/47 Boot\ failed
-# followed by \r\n\0 or :\
+>434 search/47 Boot\ failed
+# followed by \r\n\0 or :\
>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older)
>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9)
->459 search/30 Boot\ error\r\n\0
+>459 search/30 Boot\ error\r\n\0
>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer)
# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
# assembler instructions: mov di,0600h;mov cx,0100h
-16 search/4 \xbf\x00\x06\xb9\x00\x01
+16 search/4 \xbf\x00\x06\xb9\x00\x01
# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
!:strength +36
->94 search/249 Missing\ operating\ system
+>94 search/249 Missing\ operating\ system
# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
# skip Ranish MBR
->>408 search/4 HD1/\0
->>408 default x
+>>408 search/4 HD1/\0
+>>408 default x
>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR
# followed by "ing " or space
->>>>292 search/98 error
+>>>>292 search/98 error
>>>>>&0 string \r (version 3.35 or older)
>>>>>&0 string .\r (version 3.52 or newer)
>>>>>&0 default x (version 3.36-3.51 )
>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR
->>156 search/10 \0Boot\ partition\ not\ found\r\n
+>>156 search/10 \0Boot\ partition\ not\ found\r\n
>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older)
->>174 search/10 \0Missing\ OS\r\n
+>>174 search/10 \0Missing\ OS\r\n
>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer)
# SYSLINUX END
# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax,
-0 ubequad 0x31c08ed0bc007c8e
+0 ubequad 0x31c08ed0bc007c8e
# mbr_bootsel magic before partition table not reliable with small ipl fragments
-#>444 uleshort 0xb5e1
->0004 uleshort x
+#>444 uleshort 0xb5e1
+>0004 uleshort x
# ERRorTeXT
>>181 search/166 Error\ \0\r\n NetBSD mbr
# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x
# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector
-# BOOT_EXTENDED definitions contains assembler instructions:
+# BOOT_EXTENDED definitions contains assembler instructions:
# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended
# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO
# not TERSE_ERROR
->>>196 search/106 No\ active\ partition\0
->>>>&0 string Disk\ read\ error\0
+>>>196 search/106 No\ active\ partition\0
+>>>>&0 string Disk\ read\ error\0
>>>>>&0 string No\ operating\ system\0 \b,verbose
# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS
# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13
>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check
# assembler instructions: movw nametab,bx
->>>0x26 search/21 \xBB\x94\x07
+>>>0x26 search/21 \xBB\x94\x07
# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
->>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
->>>>>181 search/166 Error\ \0
+>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94
+>>>>>181 search/166 Error\ \0
# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
>>>>>>&3 string x \b,"%s"
>>>446 use partition-table
# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
# assembler instructions: jmp short 0x58;nop;ASCII
-0 ubequad&0xeb58908000000000 0xeb58900000000000
+0 ubequad&0xeb58908000000000 0xeb58900000000000
# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
->(1.b+2) ubequad 0xfa31c08ed88ec08e
+>(1.b+2) ubequad 0xfa31c08ed88ec08e
# Error messages at end of code
->>376 string No\ operating\ system\r\n\0
->>>398 string Disk\ error\r\n\0FDD\0HDD\0
+>>376 string No\ operating\ system\r\n\0
+>>>398 string Disk\ error\r\n\0FDD\0HDD\0
>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr
-# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
+# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
-0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
+0 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC
# pointer to the data starting with Neil Turton signature string
->(0x1BC.s) string NDTmbr
+>(0x1BC.s) string NDTmbr
>>&-14 string 1234F\0 Turton mbr (
# parameters also viewed by install-mbr --list
>>>(0x1BC.s+7) ubyte x \b%u<=
#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x
# for older versions
->>>(0x1BC.s+9) ubyte <2
+>>>(0x1BC.s+9) ubyte <2
#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds
>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x
->>>>(0x1BC.s+13) ubyte >1
+>>>>(0x1BC.s+13) ubyte >1
# 1st hard disc
#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x
# not 1st hard disc
>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x
# for version >= 2 maximal timeout can be 65534
->>>(0x1BC.s+9) ubyte >1
+>>>(0x1BC.s+9) ubyte >1
#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds
>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds
# floppy A: or B:
>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x
->>>>(0x1BC.s+14) ubyte >1
+>>>>(0x1BC.s+14) ubyte >1
# 1st hard disc
#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x
# not 1st hard disc
# grub-1.94/kern/i386/pc/startup.S
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
-0x200 uleshort 0x70EA
+0x200 uleshort 0x70EA
# found only version 3.{1,2}
->0x206 ubeshort >0x0300
+>0x206 ubeshort >0x0300
# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
->>0x212 ubyte >0x29
->>>0x213 ubyte >0x29
+>>0x212 ubyte >0x29
+>>>0x213 ubyte >0x29
# not iso9660_stage1_5
-#>>>0 ulelong&0x00BE5652 0x00BE5652
+#>>>0 ulelong&0x00BE5652 0x00BE5652
>>>>0x213 ubyte >0x29 GRand Unified Bootloader
# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
>>>>0x217 ubyte 0xFF stage1_5
#>>>>0x208 ulelong =0xffffff \b, %lu (default)
>>>>0x208 ulelong >0xffffff \b, installed partition %u
# GRUB 0.5.95 unofficial
->>>>0x20C ulelong&0x2E300000 0x2E300000
+>>>>0x20C ulelong&0x2E300000 0x2E300000
# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
>>>>>0x20C ubyte x \b, identifier 0x%x
#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
# GRUB version as string
>>>>>0x20E string >\0 \b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
->>>>>>0x215 ulong 0xffffffff
+>>>>>>0x215 ulong 0xffffffff
>>>>>>>0x219 string >\0 \b, configuration file %-s
->>>>>>0x215 ulong !0xffffffff
+>>>>>>0x215 ulong !0xffffffff
>>>>>>>0x215 string >\0 \b, configuration file %-s
# newer GRUB versions
->>>>0x20C ulelong&0x2E300000 !0x2E300000
+>>>>0x20C ulelong&0x2E300000 !0x2E300000
##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
>>>>>0x20C ulelong >0 \b, saved entry %d
# for 1.94 contains kernel image size
# for 0.93,0.94,0.96,0.97
-# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
+# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
>>>>>0x210 ubyte x \b, identifier 0x%x
# The flag for LBA forcing is in most cases 0
#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
# GRUB version as string
>>>>>0x212 string >\0 \b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
->>>>>0x217 ulong 0xffffffff
+>>>>>0x217 ulong 0xffffffff
>>>>>>0x21b string >\0 \b, configuration file %-s
->>>>>0x217 ulong !0xffffffff
+>>>>>0x217 ulong !0xffffffff
>>>>>>0x217 string >\0 \b, configuration file %-s
# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize must be a power of 2 from 32 to 32768
->11 uleshort&0x001f 0
->>11 uleshort <32769
->>>11 uleshort >31
->>>>21 ubyte&0xf0 0xF0
+>11 uleshort&0x001f 0
+>>11 uleshort <32769
+>>>11 uleshort >31
+>>>>21 ubyte&0xf0 0xF0
>>>>>0 ubyte 0xEB DOS/MBR boot sector
>>>>>>1 ubyte x \b, code offset 0x%x+2
->>>>>0 ubyte 0xE9
+>>>>>0 ubyte 0xE9
>>>>>>1 uleshort x \b, code offset 0x%x+3
>>>>>3 string >\0 \b, OEM-ID "%-.8s"
#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
>>>>>13 ubyte >1 \b, sectors/cluster %u
#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
# for lazy FAT32 implementation like Transcend digital photo frame PF830
->>>>>82 string/c fat32
+>>>>>82 string/c fat32
>>>>>>14 uleshort !32 \b, reserved sectors %u
#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
->>>>>82 string/c !fat32
+>>>>>82 string/c !fat32
>>>>>>14 uleshort >1 \b, reserved sectors %u
#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
>>>>>16 ubyte >0
>>>>>17 uleshort >0 \b, root entries %u
#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32)
->>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
+>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32)
>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
>>>>>26 ubyte =1 \b, heads %u
# valid only for sector sizes with more then 32 Bytes
->>>>>11 uleshort >32
+>>>>>11 uleshort >32
# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
# skip for values 2,2Ah,70h,73h,DFh
# and continue for extended boot signature values 0,28h,29h,80h
->>>>>>38 ubyte&0x56 =0
+>>>>>>38 ubyte&0x56 =0
>>>>>>>28 ulelong >0 \b, hidden sectors %u
#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
->>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
+>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
-# FAT<32 bit specific
->>>>>>>82 string/c !fat32
+# FAT<32 bit specific
+>>>>>>>82 string/c !fat32
#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
->>>>>>>>36 ubyte !0x80
+>>>>>>>>36 ubyte !0x80
>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
# VGA-copy CRC or
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
# otherwise FAT is 16 bit.
# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
->>>>>82 string/c !fat32
+>>>>>82 string/c !fat32
>>>>>>54 string FAT12 \b, FAT (12 bit)
>>>>>>54 string FAT16 \b, FAT (16 bit)
->>>>>>54 default x
+>>>>>>54 default x
# determinate FAT bit size by media descriptor
# small floppies implies FAT12
>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor)
# with media descriptor F0h floppy or maybe superfloppy with FAT16
->>>>>>>21 ubyte =0xF0
+>>>>>>>21 ubyte =0xF0
# superfloppy (many sectors) implies FAT16
>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors)
# no superfloppy with media descriptor F0h implies FAT12
>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors)
# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
->>>>>>>21 ubyte =0xF8
+>>>>>>>21 ubyte =0xF8
# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry)
# hard disc with FAT12 or FAT16
>>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
->>>>>>>21 ubyte =0xFA
+>>>>>>>21 ubyte =0xFA
# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry)
# RAM disc with FAT12 or FAT16 or Tandy hard disc
# 0 or 0xFFFF instead of usual 6 means no backup sector
>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector
>>>>>>50 uleshort =0 \b, no Backup boot sector
-#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
->>>>>>50 default x
+#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
+>>>>>>50 default x
>>>>>>>50 uleshort x \b, Backup boot sector %u
# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
>>>>>>52 ulelong >0 \b, reserved1 0x%x
>>>>>>56 ulelong >0 \b, reserved2 0x%x
>>>>>>60 ulelong >0 \b, reserved3 0x%x
-# same structure as FAT1X
+# same structure as FAT1X
#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
->>>>>>64 ubyte !0x80
+>>>>>>64 ubyte !0x80
>>>>>>>64 ubyte >0 \b, physical drive 0x%x
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
>>>>>>65 ubyte >0 \b, reserved 0x%x
>>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
>>>>>>>71 string =NO\ NAME \b, unlabeled
# additional tests for floppy image added by Joerg Jenderek
-# no fixed disk
->>>>>21 ubyte !0xF8
+# no fixed disk
+>>>>>21 ubyte !0xF8
# floppy media with 12 bit FAT
->>>>>>54 string !FAT16
+>>>>>>54 string !FAT16
# test for FAT after bootsector
>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT
# floppy image
# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
# 0 FATs
->>>>>16 ubyte =0
+>>>>>16 ubyte =0
# 0 root entries
->>>>>>17 uleshort =0
+>>>>>>17 uleshort =0
# 0 DOS sectors
->>>>>>>19 uleshort =0
+>>>>>>>19 uleshort =0
# 0 sectors/FAT
# dos < 4.0 BootSector value found is 0x80
#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x)
>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld
>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld
# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
-# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
->>>>>>>>>64 lelong <256
+# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
+>>>>>>>>>64 lelong <256
>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d
>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i)
# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
# Values 128 to 255 represent index block sizes of 2^(256-N) byte
->>>>>>>>>68 ulelong <256
+>>>>>>>>>68 ulelong <256
>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d
#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d)
>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i)
>>>>>>>>>72 ulequad x \b, serial number 0%llx
>>>>>>>>>80 ulelong >0 \b, checksum 0x%x
#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual)
->>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
->>>>>>>>>>&-92 indirect x \b; contains
+>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090
+>>>>>>>>>>&-92 indirect x \b; contains
# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
# unused assembler instructions JMP y2;NOP;NOP
-0x056 ulelong&0xFFFF0FFF 0x909002EB
+0x056 ulelong&0xFFFF0FFF 0x909002EB
# unicode loadername terminated by CTRL-D
->(0.s*2) ulelong&0xFFFFFF00 0x00040000
+>(0.s*2) ulelong&0xFFFFFF00 0x00040000
# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s
->>0x12 string $
+>>0x12 string $
>>>0x0c lestring16 x \b%-2.2s
### DOS,NTFS boot sectors end
+# ntfsclone-image is a special save format for NTFS volumes,
+# created and restored by the ntfsclone program
+0 string \0ntfsclone-image ntfsclone image,
+>0x10 byte x version %d.
+>0x11 byte x \b%d,
+>0x12 lelong x cluster size %d,
+>0x16 lequad x device size %lld,
+>0x1e lequad x %lld total clusters,
+>0x26 lequad x %lld clusters in use
+
9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
>8404 string x last mounted on %s,
#>9504 ledate x last checked at %s,
>&-1248 belong 0 TIME optimization
>&-1248 belong 1 SPACE optimization
+0 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian),
+>0x90 lelong+1 x volume %d
+>0x94 lelong x (of %d),
+>0x50 string x name %s,
+>0x98 ulelong x version %u,
+>0xa0 ulelong x flags 0x%x
+
# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
# volume label and UUID Russell Coker
# FE 250K 8-inch, 1-sided, single-density
# FD 500K 8-inch, 2-sided, single-density
# FE 1.2 MB 8-inch, 2-sided, double-density
-# F8 ----- Fixed disk
+# F8 ----- Fixed disk
#
# FC xxxK Apricot 70x1x9 boot disk.
#
# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
# Too Weak.
-#512 ubelong&0xE0ffff00 0xE0ffff00
+#512 ubelong&0xE0ffff00 0xE0ffff00
# without valid Media descriptor in place of BPB, cases with are done at other places
#>21 ubyte <0xE5 floppy with old FAT filesystem
# but valid Media descriptor at begin of FAT
#>>512 ubyte =0xfb 640k
#>>512 ubyte =0xfc 180k
# look like an an old DOS directory entry
-#>>>0xA0E ubequad 0
-#>>>>0xA00 ubequad !0
+#>>>0xA0E ubequad 0
+#>>>>0xA00 ubequad !0
#!:mime application/x-ima
-#>>512 ubyte =0xfd
+#>>512 ubyte =0xfd
# look for 2nd FAT at different location to distinguish between 360k and 500k
#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k
#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k
-#>>>0xA0E ubequad 0
+#>>>0xA0E ubequad 0
#!:mime application/x-ima
-#>>512 ubyte =0xfe
+#>>512 ubyte =0xfe
#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k
-#>>>>0x60E ubequad 0
-#>>>>>0x600 ubequad !0
+#>>>>0x60E ubequad 0
+#>>>>>0x600 ubequad !0
#!:mime application/x-ima
#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k
#>>512 ubyte =0xff 320k
-#>>>0x60E ubequad 0
-#>>>>0x600 ubequad !0
+#>>>0x60E ubequad 0
+#>>>>0x600 ubequad !0
#!:mime application/x-ima
#>>512 ubyte x \b, Media descriptor 0x%x
# without x86 jump instruction
-#>>0 ulelong&0x804000E9 !0x000000E9
-# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
+#>>0 ulelong&0x804000E9 !0x000000E9
+# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader
# IOSYS.COM+MSDOS.COM
#>>>>0xc4 use 2xDOS-filename
-#>>0 ulelong&0x804000E9 =0x000000E9
+#>>0 ulelong&0x804000E9 =0x000000E9
# only x86 short jump instruction found
#>>>0 ubyte =0xEB
#>>>>1 ubyte x \b, code offset 0x%x+2
# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
-# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
-#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
+# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
+#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader
# ibmbio.com+ibmdos.com
#>>>>>0x176 use DOS-filename
#>>>>>0x181 ubyte x \b+
#>>>>>0x182 use DOS-filename
# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
-# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
-#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
+# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
+#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader
# ibmbio.com+ibmdos.com
#>>>>>0x18b use DOS-filename
#>>>>>0x196 ubyte x \b+
#>>>>>0x197 use DOS-filename
# http://en.wikipedia.org/wiki/Zenith_Data_Systems
-# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
+# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
#>>>>>0x20 use 2xDOS-filename
# http://en.wikipedia.org/wiki/Corona_Data_Systems
-# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
+# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
#>>>>>0x69 use 2xDOS-filename
-# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
+# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader
# defect IO.SYS+MSDOS.SYS ?
#>>>>>0x162 use 2xDOS-filename
>>8 ledate x created: %s
# AFS Dump Magic
-# From: Ty Sarna <tsarna@sarna.org>
+# From: Ty Sarna <tsarna@sarna.org>
0 string \x01\xb3\xa1\x13\x22 AFS Dump
>&0 belong x (v%d)
>>&0 byte 0x76
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
0 string *dvdisaster* dvdisaster error correction file
-# xfs metadump image
+# xfs metadump image
# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
# but can we do the << ? For now it's always 512 (0x200) anyway.
0 string XFSM
0 string td\000 floppy image data (TeleDisk, compressed)
0 string TD\000 floppy image data (TeleDisk)
-0 string CQ\024 floppy image data (CopyQM,
->16 leshort x %d sectors,
+0 string CQ\024 floppy image data (CopyQM,
+>16 leshort x %d sectors,
>18 leshort x %d heads.)
0 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk)
#------------------------------------------------------------------------------
-# $File: fonts,v 1.33 2016/09/14 01:26:26 christos Exp $
+# $File: fonts,v 1.35 2017/03/17 21:35:28 christos Exp $
# fonts: file(1) magic for font data
#
0 search/1 FONT ASCII vfont text
# URL: https://en.wikipedia.org/wiki/PostScript_fonts
# Reference: http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
# Modified by: Joerg Jenderek
-# Note: moved from ./msdos magic
-# dfVersion 256=0100h
-0 uleshort 0x0100
+# Note: moved from ./msdos magic
+# dfVersion 256=0100h
+0 uleshort 0x0100
# GRR: line above is too general as it catches also TrueType font,
# raw G3 data FAX, WhatsApp encrypted and Panorama database
# dfType 129=0081h
->66 uleshort 0x0081
+>66 uleshort 0x0081
# dfVertRes 300=012Ch not needed as additional test
-#>>70 uleshort 0x012c
+#>>70 uleshort 0x012c
# dfHorizRes 300=012Ch
-#>>>72 uleshort 0x012c
+#>>>72 uleshort 0x012c
# dfDriverInfo points to postscript information section
>>(101.l) string/c Postscript Printer Font Metrics
# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
#>>>6 string >\060 - %-.60s
# dfDriverInfo
->>>139 ulelong >0
+>>>139 ulelong >0
# often abbreviated and same as filename
>>>>(139.l) string x %s
# dfSize
>>>2 ulelong x \b, %d bytes
# dfFace 210=D2h 9Eh
->>>105 ulelong >0
+>>>105 ulelong >0
# Windows font name
>>>>(105.l) string x \b, %s
# dfItalic
#>104 belong 00000004 X11 SNF font data, MSB first
!:mime application/x-font-sfn
# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
-0 lelong 00000004
+0 lelong 00000004
>104 lelong 00000004 X11 SNF font data, LSB first
!:mime application/x-font-sfn
# From: Joerg Jenderek
# URL: http://grub.gibibit.com/New_font_format
# Reference: util/grub-mkfont.c
-# include/grub/fontformat.h
+# include/grub/fontformat.h
# FONT_FORMAT_SECTION_NAMES_FILE
-0 string FILE
+0 string FILE
# FONT_FORMAT_PFF2_MAGIC
->8 string PFF2
+>8 string PFF2
# leng 4 only at the moment
->>4 ubelong 4
+>>4 ubelong 4
# FONT_FORMAT_SECTION_NAMES_FONT_NAME
>>>12 string NAME GRUB2 font
!:mime application/x-font-pf2
!:ext pf2
# length of font_name
->>>>16 ubelong >0
+>>>>16 ubelong >0
# font_name
>>>>>20 string >\0 "%-s"
0 string OTTO OpenType font data
!:mime application/vnd.ms-opentype
-# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
-0 string SplineFontDB: Spline Font Database
+# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
+0 string SplineFontDB: Spline Font Database
!:mime application/vnd.font-fontforge-sfd
>14 string x version %s
#------------------------------------------------------------------------------
-# $File: fsav,v 1.12 2013/03/23 14:15:30 christos Exp $
+# $File: fsav,v 1.14 2017/03/17 21:35:28 christos Exp $
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
#>>>>10 byte 11 \b12-
#>>>>9 ubyte >0 \b%02d)
# ftp://ftp.f-prot.com/pub/sign2.zip
-#0 ubyte 0x62
-#>1 ubyte 0xF5
-#>>2 ubyte 0x1
-#>>>3 ubyte 0x1
-#>>>>4 ubyte 0x0e
+#0 ubyte 0x62
+#>1 ubyte 0xF5
+#>>2 ubyte 0x1
+#>>>3 ubyte 0x1
+#>>>>4 ubyte 0x0e
#>>>>>13 ubyte >0 fsav virus signatures
#>>>>>>11 ubyte x size 0x%02x
#>>>>>>12 ubyte x \b%02x
# .cvd files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped tarball files
-0 string ClamAV-VDB:
+0 string ClamAV-VDB:
>11 string >\0 Clam AntiVirus database %-.23s
->>34 string :
->>>35 string !: \b, version
+>>34 string :
+>>>35 string !: \b, version
>>>>35 string x \b%-.1s
->>>>>36 string !:
+>>>>>36 string !:
>>>>>>36 string x \b%-.1s
->>>>>>>37 string !:
+>>>>>>>37 string !:
>>>>>>>>37 string x \b%-.1s
->>>>>>>>>38 string !:
+>>>>>>>>>38 string !:
>>>>>>>>>>38 string x \b%-.1s
>512 string \037\213 \b, gzipped
>769 string ustar\0 \b, tarred
#------------------------------------------------------------------------------
-# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $
+# $File: games,v 1.15 2017/03/17 21:35:28 christos Exp $
# games: file(1) for games
# Fabio Bonelli <fabiobonelli@libero.it>
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
-#>61 string x level %s
+#>61 string x level %s
#0 string 5\x0a Quake I save
# Summary: NetImmerse game engine file
# Extension .nif
# Created by: Abel Cheung <abelcheung@gmail.com>
-0 string NetImmerse\ File\ Format,\ Versio
+0 string NetImmerse\ File\ Format,\ Versio
>&0 string n\ NetImmerse game engine file
>>&0 regex [0-9a-z.]+ \b, version %s
#------------------------------------------------------------------------------
-# $File: geo,v 1.2 2013/01/02 15:27:53 christos Exp $
+# $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $
# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
######################################################################
4 beshort 0x2002 GeoSwath RDF
0 string Start:- GeoSwatch auf text file
-# Seabeam 2100
+# Seabeam 2100
# mbsystem code mb41
0 string SB2100 SeaBeam 2100 multibeam sonar
0 string SB2100DR SeaBeam 2100 DR multibeam sonar
#------------------------------------------------------------------------------
-# $File: gnu,v 1.16 2015/04/19 22:59:25 christos Exp $
+# $File: gnu,v 1.18 2017/03/17 21:35:28 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
# they will ordinarily reported as "compressed", but at least -z helps
39 string =<gmr:Workbook Gnumeric spreadsheet
-# From: James Youngman <jay@gnu.org>
+# From: James Youngman <jay@gnu.org>
# gnu find magic
0 string \0LOCATE GNU findutils locate database data
>7 string >\0 \b, format %s
#------------------------------------------------------------------------------
-# $File: gpt,v 1.2 2014/04/28 12:04:50 christos Exp $
+# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>0 use gpt-mbr-type
>>>>>>>>>>>>>>&-8 use gpt-table
->>>>>>>>>>>>>>0 ubyte x of 8192 bytes
+>>>>>>>>>>>>>>0 ubyte x of 8192 bytes
>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART
>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table
>>>>>>>>>>>>>>>0 use gpt-mbr-type
##>(8.l*8192) string EFI\ PART
##>>(8.l*8192) use gpt-mbr-type
##>>&-8 use gpt-table
-##>>0 ubyte x of 8192 bytes
+##>>0 ubyte x of 8192 bytes
##>(8.l*8192) string !EFI\ PART
##>>(8.l*4096) string EFI\ PART GPT partition table
##>>>0 use gpt-mbr-type
>>486 ulelong !1 \b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 4
>498 ubyte 0xee
->>502 ulelong 1
+>>502 ulelong 1
>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR)
>>502 ulelong !1 \b (nonstandard: not at LBA 1)
#------------------------------------------------------------------------------
-# $File: images,v 1.118 2016/11/08 02:58:21 christos Exp $
+# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
# gpu: file(1) magic for GPU input files
# Standard Portable Intermediate Representation (SPIR)
0 lelong 0x07230203 Khronos SPIR-V binary, little-endian
>4 lelong x \b, version 0x%08x
>8 lelong x \b, generator 0x%08x
+
+# Vulkan Trace file
+# Documentation:
+# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
+# vktrace_trace_packet_identifiers.h
+# Typical file extension: .vktrace
+
+8 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian
+>0 leshort x \b, version %d
+
+8 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian
+>0 beshort x \b, version %d
#------------------------------------------------------------------------------
-# $File$
+# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
# gringotts: file(1) magic for Gringotts
# http://devel.pluto.linux.it/projects/Gringotts/
# author: Germano Rizzo <mano@pluto.linux.it>
#file format 1
>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
#file format 2
->3 string 2 v.2, MCRYPT S2K,
+>3 string 2 v.2, MCRYPT S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
->>8 byte&0x70 0x20 TWOFISH crypt,
+>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,
>>8 byte&0x03 0x02 lvl.6
>>8 byte&0x03 0x03 lvl.9
#file format 3
->3 string 3 v.3, OpenPGP S2K,
+>3 string 3 v.3, OpenPGP S2K,
>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
>>8 byte&0x70 0x10 SERPENT crypt,
->>8 byte&0x70 0x20 TWOFISH crypt,
+>>8 byte&0x70 0x20 TWOFISH crypt,
>>8 byte&0x70 0x30 CAST-256 crypt,
>>8 byte&0x70 0x40 SAFER+ crypt,
>>8 byte&0x70 0x50 LOKI97 crypt,
#------------------------------------------------------------------------------
-# $File: hitachi-sh,v 1.6 2013/01/29 19:31:33 christos Exp $
+# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
-# below test line conflicts with 2nd NTFS filesystem sector
+# below test line conflicts with 2nd NTFS filesystem sector
# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
-0 beshort 0x0500
+0 beshort 0x0500
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
->18 ubeshort&0x8E80 0
+>18 ubeshort&0x8E80 0
# use big endian variant of subroutine to display name+variables+flags
-# for common object formated files
+# for common object formated files
>>0 use \^display-coff
-0 leshort 0x0550
+0 leshort 0x0550
# test for unused flag bits in f_flags
->18 uleshort&0x8E80 0
-# use little endian variant of subroutine to
-# display name+variables+flags for common object formated files
+>18 uleshort&0x8E80 0
+# use little endian variant of subroutine to
+# display name+variables+flags for common object formated files
>>0 use display-coff
#------------------------------------------------------------------------------
-# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $
+# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
-# 0 short 0535 370 sysV executable
+# 0 short 0535 370 sysV executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
-# 0 short 0530 370 sysV pure executable
+# 0 short 0530 370 sysV pure executable
# >12 long >0 not stripped
# >22 short >0 - version %d
# >30 long >0 - 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
-0 beshort 0537 370 XA sysV executable
+0 beshort 0537 370 XA sysV executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format
-0 beshort 0532 370 XA sysV pure executable
+0 beshort 0532 370 XA sysV pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %d
>30 belong >0 - 5.2 format
#------------------------------------------------------------------------------
-# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $
+# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
0 beshort 0x01f7 64-bit XCOFF executable or object module
>20 belong 0 not stripped
# GRR: this test is still too general as it catches also many FATs of DOS filesystems
-4 belong &0x0feeddb0
+4 belong &0x0feeddb0
# real core dump could not be 32-bit and 64-bit together
>7 byte&0x03 !3 AIX core file
>>1 byte &0x01 fulldump
#------------------------------------------------------------------------------
-# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
+# $File: icc,v 1.4 2017/03/17 22:20:22 christos Exp $
# icc: file(1) magic for International Color Consortium file formats
#
#
# check and display ICC/ICM color profile
0 name color-profile
->36 string acsp
+>36 string acsp
# skip ASCII like Cognacspirit.txt by month <= 12
->>26 ubeshort <13
+>>26 ubeshort <13
# platform/operating system. Only 5 mentioned
#
#>>>40 string x (%.4s)
!:mime application/vnd.iccprofile
# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
->>>8 ubyte =2
+>>>8 ubyte =2
# do not use empty message text to a avoid error like
# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file.exe: could not find any valid magic files!
# eleven device classes
>>>12 string x \b-%.4s device
# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
->>>52 string >\
+>>>52 string >\040
# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
->>>>52 ubelong !0x6e6f6e65
+>>>>52 ubelong !0x6e6f6e65
# device manufacturer field like "HP " "IBM " EPSO
>>>>>48 string x \b, %.2s
>>>>>50 string >\ \b%.1s
# profile size
>>>0 ubelong x \b, %u bytes
# skip invalid date 0 like in linearSRGB.icc
->>>24 ubequad !0
+>>>24 ubequad !0
# datetime dd-mm-yyyy hh:mm:ss
>>>>28 ubeshort x \b, %u
# month <= 12
# tag table
# 6 <= tags count <= 43
#>>>128 ubelong >43 \b, %u tags
->>>128 ubelong x
+>>>128 ubelong x
# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
->>>>132 search/508 cprt
+>>>>132 search/508 cprt
# but no copyright tag in linearSRGB.icc
# beneath /System/Library/Frameworks/WebKit.framework/
# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
#>>>140 ubelong x 0x%x len
# 2nd tag,...
# look also for profileDescriptionTag "desc"
->>>132 search/508 desc
+>>>132 search/508 desc
# look further for TextDescriptionType "desc" signature
->>>>(&0.L) string =desc
+>>>>(&0.L) string =desc
>>>>>&4 pstring/l x "%s"
# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
->>>>(&0.L) string =mluc
->>>>>&(&8.L) ubequad x
+>>>>(&0.L) string =mluc
+>>>>>&(&8.L) ubequad x
>>>>>>&4 bestring16 x '%s'
# Any other profile.
# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
# and use "acsp" for everything else and dump the "primary platform"
# string in those cases?
-36 string acsp
+36 string acsp
>0 use color-profile
#------------------------------------------------------------------------------
-# $File: images,v 1.120 2016/11/25 01:54:24 christos Exp $
+# $File: images,v 1.123 2017/04/04 20:34:24 christos Exp $
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
# XPM bitmaps)
#
# test of Color Map Type 0~no 1~color map
# and Image Type 1 2 3 9 10 11 32 33
# and Color Map Entry Size 0 15 16 24 32
-0 ubequad&0x00FeC400000000C0 0
+0 ubequad&0x00FeC400000000C0 0
# skip more garbage by looking for positive image type
->2 ubyte >0
+>2 ubyte >0
# skip some compiled terminfo by looking for image type less equal 33
->>2 ubyte <34
+>>2 ubyte <34
# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel sizes 15 16 24 32
->>>16 ubyte <33
+>>>16 ubyte <33
# skip more by looking for pixel size 0Fh 10h 18h 20h
->>>>16 ubyte&0xC0 0x00
+>>>>16 ubyte&0xC0 0x00
# skip 260-16.ico by looking for no color map
->>>>>1 ubyte 0
+>>>>>1 ubyte 0
# implies no first map entry
->>>>>>3 uleshort 0
+>>>>>>3 uleshort 0
>>>>>>>0 use tga-image
# Color Map
>>>>>1 belong&0xfff7ffff 0x01010000
>14 uleshort =0 65536
# Image Pixel Size 15 16 24 32
>16 ubyte x x %d
-# X origin of image. 0 normal
+# X origin of image. 0 normal
>8 uleshort >0 +%d
# Y origin of image. 0 normal; positive for top
>10 uleshort >0 +%d
>17 ubyte &0x10 - right
#>17 ubyte ^0x10 - left
# some info say other bits 6-7 should be zero
-# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
+# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
#>17 ubyte&0xC0 0x00 - no interleave
>17 ubyte&0xC0 0x40 - interleave
>17 ubyte&0xC0 0x80 - four way interleave
>17 ubyte&0xC0 0xC0 - reserved
-# positive length implies identification field
->0 ubyte >0
+# positive length implies identification field
+>0 ubyte >0
>>18 string x "%s"
# last 18 bytes of newer tga file footer signature
->18 search/4261301/s TRUEVISION-XFILE.\0
+>18 search/4261301/s TRUEVISION-XFILE.\0
# extension area offset if not 0
->>&-8 ulelong >0
+>>&-8 ulelong >0
# length of the extension area. normal 495 for version 2.0
->>>(&-4.l) uleshort 0x01EF
+>>>(&-4.l) uleshort 0x01EF
# AuthorName[41]
>>>>&0 string >\0 - author "%-.40s"
# Comment[324]=4 * 80 null terminated
>>>>&41 string >\0 - comment "%-.80s"
# date
->>>>&365 ubequad&0xffffFFFFffff0000 !0
+>>>>&365 ubequad&0xffffFFFFffff0000 !0
# Day
>>>>>&-6 uleshort x %d
# Month
# Year
>>>>>&-4 uleshort x \b-%d
# time
->>>>&371 ubequad&0xffffFFFFffff0000 !0
+>>>>&371 ubequad&0xffffFFFFffff0000 !0
# hour
>>>>>&-8 uleshort x %d
# minutes
# JobName[41]
>>>>&377 string >\0 - job "%-.40s"
# JobHour Jobminute Jobsecond
->>>>&418 ubequad&0xffffFFFFffff0000 !0
+>>>>&418 ubequad&0xffffFFFFffff0000 !0
>>>>>&-8 uleshort x %d
>>>>>&-6 uleshort x \b:%.2d
>>>>>&-4 uleshort x \b:%.2d
# SoftwareId[41]
>>>>&424 string >\0 - %-.40s
# SoftwareVersionNumber
->>>>&424 ubyte >0
+>>>>&424 ubyte >0
>>>>>&40 uleshort/100 x %d
>>>>>&40 uleshort%100 x \b.%d
# VersionLetter
# KeyColor
>>>>&468 ulelong >0 - keycolor 0x%8.8x
# Denominator of Pixel ratio. 0~no pixel aspect
->>>>&474 uleshort >0
+>>>>&474 uleshort >0
# Numerator
>>>>>&-4 uleshort >0 - aspect %d
>>>>>&-2 uleshort x \b/%d
# Denominator of Gamma ratio. 0~no Gamma value
->>>>&478 uleshort >0
+>>>>&478 uleshort >0
# Numerator
>>>>>&-4 uleshort >0 - gamma %d
>>>>>&-2 uleshort x \b/%d
-# ColorOffset
+# ColorOffset
#>>>>&480 ulelong x - col offset 0x%8.8x
# StampOffset
#>>>>&484 ulelong x - stamp offset 0x%8.8x
>>&0 regex =[0-9]{1,50} \b, size = %s x
>>>&0 regex =[0-9]{1,50} \b %s
-0 search/1 P1
->0 regex/4 P1\\s
+0 search/1 P1
+>0 regex/4 P1[A-Za-z0-9_]
>>0 use netpbm
>>>0 string x \b, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
-0 search/1 P2
->0 regex/4 P2\\s
+0 search/1 P2
+>0 regex/4 P2[A-Za-z0-9_]
>>0 use netpbm
>>>0 string x \b, greymap
!:strength + 45
!:mime image/x-portable-greymap
0 search/1 P3
->0 regex/4 P3\\s
+>0 regex/4 P3[A-Za-z0-9_]
>>0 use netpbm
>>>0 string x \b, pixmap
!:strength + 45
!:mime image/x-portable-pixmap
-0 string P4
->0 regex/4 P4\\s
+0 string P4
+>0 regex/4 P4[A-Za-z0-9_]
>>0 use netpbm
>>>0 string x \b, rawbits, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
-0 string P5
->0 regex/4 P5\\s
+0 string P5
+>0 regex/4 P5[A-Za-z0-9_]
>>0 use netpbm
>>>0 string x \b, rawbits, greymap
!:strength + 45
!:mime image/x-portable-greymap
-0 string P6
->0 regex/4 P6\\s
+0 string P6
+>0 regex/4 P6[A-Za-z0-9_]
>>0 use netpbm
>>>0 string x \b, rawbits, pixmap
!:strength + 45
>>>8 leshort 0x8765 \bJBIG
>>>8 leshort 0x8798 \bJPEG2000
>>>8 leshort 0x8799 \bNikon NEF Compressed
->>>8 default x
+>>>8 default x
>>>>8 leshort x \b(unknown 0x%x)
>>>12 use tiff_entry
>0 leshort 0x106 \b, PhotometricIntepretation=
!:mime image/x-unknown
#
# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
-#
+#
0 string FGF95a FGF image (GIF+deflate beta)
!:mime image/x-unknown
#
# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
# (best; not yet implemented):
-#
+#
0 string PBF PBF image (deflate compression)
!:mime image/x-unknown
# http://www.blackfiveservices.co.uk/awbmtools.shtml
# http://biosgfx.narod.ru/v3/
# http://biosgfx.narod.ru/abr-2/
-0 string AWBM
+0 string AWBM
>4 leshort <1981 Award BIOS bitmap
!:mime image/x-award-bmp
# image width is a multiple of 4
->>4 leshort&0x0003 0
+>>4 leshort&0x0003 0
>>>4 leshort x \b, %d
>>>6 leshort x x %d
>>4 leshort&0x0003 >0 \b,
->>>4 leshort&0x0003 =1
+>>>4 leshort&0x0003 =1
>>>>4 leshort x %d+3
->>>4 leshort&0x0003 =2
+>>>4 leshort&0x0003 =2
>>>>4 leshort x %d+2
->>>4 leshort&0x0003 =3
+>>>4 leshort&0x0003 =3
>>>>4 leshort x %d+1
>>>6 leshort x x %d
# at offset 8 starts imagedata followed by "RGB " marker
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
-0 ubelong&0xffF8fe00 0x0a000000
-# for PCX bit depth > 0
->3 ubyte >0
+0 ubelong&0xffF8fe00 0x0a000000
+# for PCX bit depth > 0
+>3 ubyte >0
# test for valid versions
->>1 ubyte <6
+>>1 ubyte <6
>>>1 ubyte !1 PCX
!:mime image/x-pcx
#!:mime image/pcx
# Update: Joerg Jenderek
# See http://fileformats.archiveteam.org/wiki/GEM_Raster
# For variations, also see:
-# http://www.seasip.info/Gem/ff_img.html (Ventura)
+# http://www.seasip.info/Gem/ff_img.html (Ventura)
# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
0 beshort 0x0001
# header_size
->2 beshort 0x0008
+>2 beshort 0x0008
>>0 use gem_info
->2 beshort 0x0009
+>2 beshort 0x0009
>>0 use gem_info
# no example for NOSIG
->2 beshort 24
+>2 beshort 24
>>0 use gem_info
# no example for HYPERPAINT
->2 beshort 25
+>2 beshort 25
>>0 use gem_info
-16 string XIMG\0
+16 string XIMG\0
>0 use gem_info
# no example
-16 string STTT\0\x10
+16 string STTT\0\x10
>0 use gem_info
# no example or description
-16 string TIMG\0
+16 string TIMG\0
>0 use gem_info
0 name gem_info
# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
!:mime image/x-gem
# header_size 24 25 27 59 779 words for colored bitmaps
->>2 beshort >9
+>>2 beshort >9
>>>16 string STTT\0\x10 STTT
>>>16 string TIMG\0 TIMG
# HYPERPAINT or NOSIG variant
->>>16 string \0\x80
+>>>16 string \0\x80
>>>>2 beshort =24 NOSIG
>>>>2 beshort !24 HYPERPAINT
# NOSIG or XIMG variant
->>>16 default x
+>>>16 default x
>>>>16 string !XIMG\0 NOSIG
>>16 string =XIMG\0 XIMG Image data
!:ext img/ximg
# updated by: Joerg Jenderek
# URL: http://techmods.net/nuvi/
0 string GARMIN\ BITMAP\ 01 Garmin Bitmap file
-# extension is also used for
+# extension is also used for
# Sony SRF raw image (image/x-sony-srf)
# SRF map
# Terragen Surface Map (http://www.planetside.co.uk/terragen)
!:mime image/x-icns
!:apple ????icns
!:ext icns
->4 ubelong >0
+>4 ubelong >0
# file size
>>4 ubelong x \b, %d bytes
# icon type
#------------------------------------------------------------------------------
-# $File: intel,v 1.13 2015/09/30 20:32:35 christos Exp $
+# $File: intel,v 1.15 2017/03/17 21:35:28 christos Exp $
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
-0 leshort =0514
-# use subroutine to display name+flags+variables for common object formated files
+0 leshort =0514
+# use subroutine to display name+flags+variables for common object formated files
>0 use display-coff
#>12 lelong >0 not stripped
# no hint found, that at offset 22 is version
#------------------------------------------------------------------------------
-# $File: isz,v 1.2 2014/04/28 12:04:50 christos Exp $
-# ISO Zipped file format
+# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
+# ISO Zipped file format
# http://www.ezbsystems.com/isz/iszspec.txt
0 string IsZ! ISO Zipped file
>4 byte x \b, header size %u
#------------------------------------------------------------------------------
-# $File: jpeg,v 1.29 2015/04/10 15:36:02 christos Exp $
+# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
>>5 beshort x \b%d
>>9 byte x \b, frames %d
->0 beshort 0xFFC1
+>0 beshort 0xFFC1
>>(2.S+2) use jpeg_segment
>>4 byte x \b, extended sequential, precision %d
>>7 beshort x \b, %dx
>>5 beshort x \b%d
>>9 byte x \b, frames %d
->0 beshort 0xFFC2
+>0 beshort 0xFFC2
>>(2.S+2) use jpeg_segment
>>4 byte x \b, progressive, precision %d
>>7 beshort x \b, %dx
>0 beshort 0xFFC4
>>(2.S+2) use jpeg_segment
->0 beshort 0xFFE1
+>0 beshort 0xFFE1
# Recursion handled by FFE0
#>>(2.S+2) use jpeg_segment
>>4 string Exif \b, Exif Standard: [
->>>10 indirect/r x
+>>>10 indirect/r x
>>>10 string x \b]
# Application specific markers
#------------------------------------------------------------------------------
-# $File: map,v 1.1 2014/06/03 18:22:25 christos Exp $
+# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
# kerberos: MIT kerberos file binary formats
#
>>>>>&0 bedate x \b, date=%s
>>>>>>&0 byte x \b, kvno=%u
#>>>>>>>&0 pstring/H x
-#>>>>>>>>&0 belong x
+#>>>>>>>>&0 belong x
#>>>>>>>>>>&0 use keytab_entry
0 belong 0x05020000 Kerberos Keytab file
#------------------------------------------------------------------------------
-# $File: kml,v 1.2 2009/09/19 16:28:10 christos Exp $
+# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
# Type: Google KML, formerly Keyhole Markup Language
# Future development of this format has been handed
# over to the Open Geospatial Consortium.
# http://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string/t \<?xml
->20 search/400 \ xmlns=
+>20 search/400 \ xmlns=
>>&0 regex ['"]http://earth.google.com/kml Google KML document
!:mime application/vnd.google-earth.kml+xml
>>>&1 string 2.0' \b, version 2.0
>>>&1 string/t 2.2 \b, version 2.2
#------------------------------------------------------------------------------
-# Type: Google KML Archive (ZIP based)
+# Type: Google KML Archive (ZIP based)
# http://code.google.com/apis/kml/documentation/kml_tut.html
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
0 string PK\003\004
#------------------------------------------------------------------------------
-# $File: linux,v 1.62 2015/05/03 13:06:36 christos Exp $
+# $File: linux,v 1.64 2017/03/17 21:35:28 christos Exp $
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
############################################################################
# Linux 8086 executable
0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
->5 string .
+>5 string .
>>4 string >\0 \b, libc version %s
0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
>2 byte&0x40 !0 \b, A_PURE
>2 byte&0x80 !0 \b, A_TOVLY
>28 long !0 \b, not stripped
->37 string .
+>37 string .
>>36 string >\0 \b, libc version %s
# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
>24 lelong x %d symbols
>28 lelong x %d ocons
-# Linux Logical Volume Manager (LVM)
+# Linux Logical Volume Manager (LVM)
# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
#
# System ID, UUID and volume group name are 128 bytes long
>>&0x20 lequad x \b, size: %lld
0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
->&(&-12.l-0x21) byte x
+>&(&-12.l-0x21) byte x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0 string >\x2f \b, UUID: %.6s
>>&0x6 string >\x2f \b-%.4s
# Summary: Xen saved domain file
# Created by: Radek Vokal <rvokal@redhat.com>
0 string LinuxGuestRecord Xen saved domain
->20 search/256 (name
+>20 search/256 (name
>>&1 string x (name %s)
# Type: Xen, the virtual machine monitor
>>0x1046 ubeshort x \b%04x
# Linux device tree:
-# File format description can be found in the Linux kernel sources at
+# File format description can be found in the Linux kernel sources at
# Documentation/devicetree/booting-without-of.txt
# From Christoph Biedl
0 belong 0xd00dfeed
#------------------------------------------------------------------------------
-# $File: lisp,v 1.23 2009/09/19 16:28:10 christos Exp $
+# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
# updated by Joerg Jenderek
# GRR: This lot is too weak
-#0 string ;;
+#0 string ;;
# windows INF files often begin with semicolon and use CRLF as line end
# lisp files are mainly created on unix system with LF as line end
#>2 search/4096 !\r Lisp/Scheme program text
# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# Emacs 18 - this is always correct, but not very magical.
-0 string \012(
+0 string \012(
# look for emacs lisp keywords
# GRR: split regex because it is too long or get error like
# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
# Emacs 19+ - ver. recognition added by Ian Springer
# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
# - Chris Chittleborough <cchittleborough@yahoo.com.au>
-# Update: Joerg Jenderek
-0 string ;ELC
+# Update: Joerg Jenderek
+0 string ;ELC
# version\0\0\0
>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data
# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
-!:mime application/x-elc
+!:mime application/x-elc
!:apple EMAxTEXT
!:ext elc
0 long 0x70768BD2 CLISP memory image data
0 long 0xD28B7670 CLISP memory image data, other endian
-#.com and .bin for MIT scheme
+#.com and .bin for MIT scheme
0 string \372\372\372\372 MIT scheme (library?)
# From: David Allouche <david@allouche.net>
#------------------------------------------------------------------------------
-# $File: macintosh,v 1.25 2014/09/03 13:34:16 christos Exp $
+# $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
# and that 74 will be 0. So something like
-#
+#
# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
-#
+#
# >73 byte&0x01 0x01 \b, inited
# >73 byte&0x02 0x02 \b, changed
# >73 byte&0x04 0x04 \b, busy
>0x9C string INDEX data file index
>0x9C string VIEW data view
-# spss magic for SPSS system and portable files,
+# spss magic for SPSS system and portable files,
# from Bruce Foster (bef@nwu.edu).
0 long 0xc1e2c3c9 SPSS Portable File
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...
-# The boot block signature, according to IM:Files, is
+# The boot block signature, according to IM:Files, is
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
# *.hfs updated by Joerg Jenderek
# http://en.wikipedia.org/wiki/Hierarchical_File_System
# "BD" gives many false positives
-0x400 beshort 0x4244
+0x400 beshort 0x4244
# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
# first block of volume bit map (always 3)
->0x40e ubeshort 0x0003
+>0x40e ubeshort 0x0003
# maximal length of volume name is 27
>>0x424 ubyte <28 Macintosh HFS data
!:mime application/x-apple-diskimage
#>0x230 string x first type: %s,
#>0x210 string x name: %s,
#>0x254 belong x number of blocks: %d,
-#>0x400 beshort 0x504D
+#>0x400 beshort 0x504D
#>>0x430 string x second type: %s,
#>>0x410 string x name: %s,
#>>0x454 belong x number of blocks: %d,
-#>>0x800 beshort 0x504D
+#>>0x800 beshort 0x504D
#>>>0x830 string x third type: %s,
#>>>0x810 string x name: %s,
#>>>0x854 belong x number of blocks: %d,
-#>>>0xa00 beshort 0x504D
+#>>>0xa00 beshort 0x504D
#>>>>0xa30 string x fourth type: %s,
#>>>>0xa10 string x name: %s,
#>>>>0xa54 belong x number of blocks: %d
#------------------------------------------------------------------------------
-# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $
+# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
# maple: file(1) magic for maple files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Maple V release 4, a multi-purpose math program
# no magic for these :-(
# they are compiled indexes for maple files
-# .hdb
+# .hdb
0 string \000\004\000\000 Maple help database
# .mhp
# from byte 4 it is either 'nul E' or 'soh R'
# I think 'nul E' means a file that was saved as a different name
# a sort of revision marking
-# 'soh R' means new
+# 'soh R' means new
>4 string \000\105 An old revision
>4 string \001\122 The latest save
# marc21: file(1) magic for MARC 21 Format
#
# Kevin Ford (kefo@loc.gov)
-#
+#
# MARC21 formats are for the representation and communication
# of bibliographic and related information in machine-readable
# form. For more info, see http://www.loc.gov/marc/
# leader position 20-21 must be 45
-20 string 45
+# and 22-23 also 00 so far, but we check that later.
+20 string 45
+>0 search/2048 \x1e
# leader starts with 5 digits, followed by codes specific to MARC format
->0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
+>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic
!:mime application/marc
->0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
+>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority
!:mime application/marc
->0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
+>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings
!:mime application/marc
-0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
+>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification
!:mime application/marc
->0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
+>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community
!:mime application/marc
# leader position 22-23, should be "00" but is it?
->0 regex/1l (^.{21})([^0]{2}) (non-conforming)
+>>0 regex/1l (^.{21})([^0]{2}) (non-conforming)
!:mime application/marc
#------------------------------------------------------------------------------
-# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
+# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
# mathematica: file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
-#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
+#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
# >71... is optional
>88 string >\0 from %s
0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
# .ml files These are menu resources I think
-# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
+# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
# how to put that into a magic rule?
4 string \ A~ MAthematica .ml file
#------------------------------------------------------------------------------
-# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $
+# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
# metastore: file(1) magic for metastore files
# From: Thomas Wissen
# see http://david.hardeman.nu/software.php#metastore
-0 string MeTaSt00r3 Metastore data file,
+0 string MeTaSt00r3 Metastore data file,
>10 bequad x version %0llx
#------------------------------------------------------------------------------
-# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $
+# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
# rinex: file(1) magic for RINEX files
# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
>>&32 string x \b, date %15.15s
>>5 string x \b, version %6.6s
!:mime rinex/meteorological
->80 search/256 XXRINEXN RINEX Data, Navigation
+>80 search/256 XXRINEXN RINEX Data, Navigation
>>&32 string x \b, date %15.15s
>>5 string x \b, version %6.6s
!:mime rinex/navigation
#------------------------------------------------------------------------------
-# $File: isz,v 1.3 2014/04/30 21:41:02 christos Exp $
-# Micro Focus COBOL data files.
+# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
+# Micro Focus COBOL data files.
# http://documentation.microfocus.com/help/index.jsp?topic=\
# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
#------------------------------------------------------------------------------
-# $File: mime,v 1.5 2009/09/19 16:28:10 christos Exp $
+# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
# mime: file(1) magic for MIME encoded files
#
-0 string/t Content-Type:\
+0 string/t Content-Type:\040
>14 string >\0 %s
0 string/t Content-Type:
>13 string >\0 %s
#-----------------------------------------------------------------------------
-# $File: misctools,v 1.15 2015/04/15 18:29:30 christos Exp $
+# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
# misctools: file(1) magic for miscellaneous UNIX tools.
#
0 search/1 %%!! X-Post-It-Note text
#!:mime text/x-vcard
!:mime text/vcard
# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
->12 search/14000/c VERSION:
+>12 search/14000/c VERSION:
# VERSION 2.1 , 3.0 or 4.0
>>&0 string x \b, version %-.3s
>12 ulelong !0x20 \b, 0x%8.8x RVA
# CheckSum 0
>16 ulelong !0 \b, CheckSum 0x%8.8x
-# Reserved or TimeDateStamp
+# Reserved or TimeDateStamp
>20 ledate x \b, %s
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
#------------------------------------------------------------------------------
-# $File: modem,v 1.6 2015/02/14 17:35:47 christos Exp $
+# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
# modem: file(1) magic for modem programs
#
# From: Florian La Roche <florian@knorke.saar.de>
# URL: https://de.wikipedia.org/wiki/Fax
# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
-0 short 0x0100
+0 short 0x0100
# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
->2 search/9 \0\0
+>2 search/9 \0\0
# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
->2 default x
+>2 default x
# skip IRCAM file (VAX big-endian) ./audio
->>0 belong !0x0001a364
+>>0 belong !0x0001a364
# skip GEM Image data ./images
->>>2 beshort !0x0008
+>>>2 beshort !0x0008
# look for first keyword of Panorama database *.pan
->>>>11 search/262 \x06DESIGN
+>>>>11 search/262 \x06DESIGN
# skip Panorama database
->>>>11 default x
+>>>>11 default x
# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
->>>>>27118 search/1864 DreamWorld
->>>>>27118 default x
+>>>>>27118 search/1864 DreamWorld
+>>>>>27118 default x
# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
->>>>>>8 ubequad !0x2e01010454010203
+>>>>>>8 ubequad !0x2e01010454010203
# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded
# version 5.25 labeled the entry above "raw G3 data, byte-padded"
!:ext g3
# unusual image starting with black pixel
#0 short 0x1300 raw G3 (Group 3) FAX
-0 short 0x1400
+0 short 0x1400
# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
->2 search/9 \0\0
+>2 search/9 \0\0
# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
>2 default x raw G3 (Group 3) FAX
# version 5.25 labeled the above entry as "raw G3 data"
#------------------------------------------------------------------------------
-# $File: mozilla,v 1.5 2015/01/24 15:48:42 christos Exp $
-# mozilla: file(1) magic for Mozilla XUL fastload files
+# $File: mozilla,v 1.7 2017/03/17 21:35:28 christos Exp $
+# mozilla: file(1) magic for Mozilla XUL fastload files
# (XUL.mfasl and XPC.mfasl)
# URL: http://www.mozilla.org/
# From: Josh Triplett <josh@freedesktop.org>
#------------------------------------------------------------------------------
-# $File: msdos,v 1.114 2016/11/08 23:52:10 christos Exp $
+# $File: msdos,v 1.118 2017/05/20 19:55:27 christos Exp $
# msdos: file(1) magic for MS-DOS files
#
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
# updated by Joerg Jenderek at Oct 2008,Apr 2011
-0 string/t @
+0 string/t @
>1 string/cW \ echo\ off DOS batch file text
!:mime text/x-msdos-batch
>1 string/cW echo\ off DOS batch file text
>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
>>(8.s*16) string emx
>>>&1 string x for DOS, Win or OS/2, emx %s
->>&(&0x42.l-3) byte x
+>>&(&0x42.l-3) byte x
>>>&0x26 string UPX \b, UPX compressed
# and yet another guess: small .text, and after large .data is unusal, could be 32lite
>>&0x2c search/0xa0 .text
>(8.s*16) string $WdX \b, WDos/X DOS extender
# By now an executable type should have been printed out. The executable
-# may be a self-uncompressing archive, so look for evidence of that and
-# print it out.
+# may be a self-uncompressing archive, so look for evidence of that and
+# print it out.
#
# Some signatures below from Greg Roelofs, newt@uchicago.edu.
#
# Skip to the end of the EXE. This will usually work fine in the PE case
# because the MZ image is hardcoded into the toolchain and almost certainly
# won't match any of these signatures.
->(4.s*512) long x
->>&(2.s-517) byte x
+>(4.s*512) long x
+>>&(2.s-517) byte x
>>>&0 string PK\3\4 \b, ZIP self-extracting archive
>>>&0 string Rar! \b, RAR self-extracting archive
>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
# only version=0x100 found
>3 uleshort x \b, version 0x%x
# length of string containing author,info and special characters
->6 ubyte >0
+>6 ubyte >0
#>>6 pstring x \b, name=%s
>>7 string >\0 \b, author=%-.14s
>>7 search/254 \xff \b, info=
#>>>&0 string x \b%-s
>>>&0 string x \b%-.15s
-# for FreeDOS *.KL files
+# for FreeDOS *.KL files
0 string/b KLF FreeDOS KEYBoard Layout file
# only version=0x100 or 0x101 found
>3 uleshort x \b, version 0x%x
# stringlength
->5 ubyte >0
+>5 ubyte >0
>>8 string x \b, name=%-.2s
-0 string \xffKEYB\ \ \ \0\0\0\0
+0 string \xffKEYB\ \ \ \0\0\0\0
>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file
-# DOS device driver updated by Joerg Jenderek at May 2011
-# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
-0 ulequad&0x07a0ffffffff 0xffffffff DOS executable (
->40 search/7 UPX! \bUPX compressed
+# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
+# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
+0 ulequad&0x07a0ffffffff 0xffffffff
+>0 use msdos-driver
+0 name msdos-driver DOS executable (
+#!:mime application/octet-stream
+!:mime application/x-dosdriver
+# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
+!:ext sys/dev/bin
+>40 search/7 UPX! \bUPX compressed
# DOS device driver attributes
>4 uleshort&0x8000 0x0000 \bblock device driver
# character device
>4 uleshort&0x8000 0x8000 \b
->>4 uleshort&0x0008 0x0008 \bclock
+>>4 uleshort&0x0008 0x0008 \bclock
# fast video output by int 29h
->>4 uleshort&0x0010 0x0010 \bfast
+>>4 uleshort&0x0010 0x0010 \bfast
# standard input/output device
->>4 uleshort&0x0003 >0 \bstandard
+>>4 uleshort&0x0003 >0 \bstandard
>>>4 uleshort&0x0001 0x0001 \binput
>>>4 uleshort&0x0003 0x0003 \b/
->>>4 uleshort&0x0002 0x0002 \boutput
+>>>4 uleshort&0x0002 0x0002 \boutput
>>4 uleshort&0x8000 0x8000 \bcharacter device driver
->0 ubyte x
+>0 ubyte x
# upx compressed device driver has garbage instead of real in name field of header
->>40 search/7 UPX!
->>40 default x
+>>40 search/7 UPX!
+>>40 default x
# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
->>>12 ubyte >0x27 \b
->>>>10 ubyte >0x20
->>>>>10 ubyte !0x2E
+>>>12 ubyte >0x2E \b
+>>>>10 ubyte >0x20
+>>>>>10 ubyte !0x2E
>>>>>>10 ubyte !0x2A \b%c
->>>>11 ubyte >0x20
+>>>>11 ubyte >0x20
>>>>>11 ubyte !0x2E \b%c
->>>>12 ubyte >0x20
->>>>>12 ubyte !0x39
+>>>>12 ubyte >0x20
+>>>>>12 ubyte !0x39
>>>>>>12 ubyte !0x2E \b%c
->>>13 ubyte >0x20
+>>>13 ubyte >0x20
>>>>13 ubyte !0x2E \b%c
->>>>14 ubyte >0x20
+>>>>14 ubyte >0x20
>>>>>14 ubyte !0x2E \b%c
->>>>15 ubyte >0x20
+>>>>15 ubyte >0x20
>>>>>15 ubyte !0x2E \b%c
->>>>16 ubyte >0x20
->>>>>16 ubyte !0x2E
+>>>>16 ubyte >0x20
+>>>>>16 ubyte !0x2E
>>>>>>16 ubyte <0xCB \b%c
->>>>17 ubyte >0x20
->>>>>17 ubyte !0x2E
+>>>>17 ubyte >0x20
+>>>>>17 ubyte !0x2E
>>>>>>17 ubyte <0x90 \b%c
# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
->>>4 uleshort&0x8000 0x8000
->>>>12 ubyte <0x2F
+>>>12 ubyte <0x2F
# they have their real name at offset 22
->>>>>22 string >\0 \b%-.5s
->4 uleshort&0x8000 0x0000
+# also block device drivers like DUMBDRV.SYS
+>>>>22 string >\056 %-.6s
+>4 uleshort&0x8000 0x0000
# 32 bit sector addressing ( > 32 MB) for block devices
>>4 uleshort&0x0002 0x0002 \b,32-bit sector-
# support by driver functions 13h, 17h, 18h
# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
>4 uleshort&0x0800 0x0800 \b,close media-
# output until busy support by int 10h for character device driver
->4 uleshort&0x8000 0x8000
+>4 uleshort&0x8000 0x8000
>>4 uleshort&0x2000 0x2000 \b,until busy-
# direct read/write support by driver functions 03h,0Ch
>4 uleshort&0x4000 0x4000 \b,control strings-
->4 uleshort&0x8000 0x8000
+>4 uleshort&0x8000 0x8000
>>4 uleshort&0x6840 >0 \bsupport
->4 uleshort&0x8000 0x0000
+>4 uleshort&0x8000 0x0000
>>4 uleshort&0x4842 >0 \bsupport
>0 ubyte x \b)
-# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
-# Too weak, matches files that only contain 0's
-#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable (
-#>4 uleshort&0x8000 0x8000 \bcharacter device driver
-#>>10 string x %-.8s
-#>4 uleshort&0x4000 0x4000 \b,control strings-support)
+# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
+0 ulequad 0x0513c00000000012
+>0 use msdos-driver
+# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
+0 ulequad 0x32f28000ffff0016
+>0 use msdos-driver
+0 ulequad 0x007f00000000ffff
+>0 use msdos-driver
+0 ulequad 0x001600000000ffff
+>0 use msdos-driver
+# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
+0 ulequad 0x0bf708c2ffffffff
+>0 use msdos-driver
+0 ulequad 0x07bd08c2ffffffff
+>0 use msdos-driver
# updated by Joerg Jenderek
-# GRR: line below too general as it catches also
+# GRR: line below too general as it catches also
# rt.lib DYADISKS.PIC and many more
# start with assembler instruction MOV
-0 ubyte 0x8c
+0 ubyte 0x8c
# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
->4 string !O====
+>4 string !O====
# skip some unknown basic binaries like RocketRnger.SHR
->>5 string !MAIN
+>>5 string !MAIN
# skip "GPG symmetrically encrypted data" ./gnu
-# skip "PGP symmetric key encrypted data" ./pgp
+# skip "PGP symmetric key encrypted data" ./pgp
# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
>>>4 ubyte >13 DOS executable (COM, 0x8C-variant)
# the remaining files should be DOS *.COM executables
# updated by Joerg Jenderek at Oct 2008
0 ulelong 0xffff10eb DR-DOS executable (COM)
# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
-0 ubeshort&0xeb8d >0xeb00
+0 ubeshort&0xeb8d >0xeb00
# DR-DOS STACKER.COM SCREATE.SYS missed
0 name msdos-com
# updated by Joerg Jenderek at Oct 2008,2015
# following line is too general
-0 ubyte 0xb8
+0 ubyte 0xb8
# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
->0 string !\xb8\xc0\x07\x8e
+>0 string !\xb8\xc0\x07\x8e
# modified by Joerg Jenderek
# syslinux COM32 or COM32R executable
>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT
#!:mime application/x-msdos-program
!:ext com
-0 string/b \x81\xfc
->4 string \x77\x02\xcd\x20\xb9
+0 string/b \x81\xfc
+>4 string \x77\x02\xcd\x20\xb9
>>36 string UPX! FREE-DOS executable (COM), UPX compressed
252 string Must\ have\ DOS\ version DR-DOS executable (COM)
# added by Joerg Jenderek at Oct 2008
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
5 string \xcd\x21 COM executable for DOS
#DELTMP.COm HASFAT32.cOM
-7 string \xcd\x21
+7 string \xcd\x21
>0 byte !0xb8 COM executable for DOS
#COMP.cOM MORE.COm
-10 string \xcd\x21
+10 string \xcd\x21
>5 string !\xcd\x21 COM executable for DOS
#comecho.com
13 string \xcd\x21 COM executable for DOS
# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
# Note: newer Lotus versions >2 use longer BOF record
# record type (BeginningOfFile=0000h) + length (001Ah)
-0 belong 0x00001a00
+0 belong 0x00001a00
# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
-#>18 uleshort&0x73E0 0
+#>18 uleshort&0x73E0 0
# Lotus Multi Byte Character Set (LMBCS=1-31)
->20 ubyte >0
+>20 ubyte >0
>>20 ubyte <32 Lotus 1-2-3
#!:mime application/x-123
!:mime application/vnd.lotus-1-2-3
!:ext fXX
# main revision number
>>>>4 uleshort x \b, revision 0x%x
->>>6 uleshort =0x0004 \b, cell range
+>>>6 uleshort =0x0004 \b, cell range
# active cellcoord range (start row, page,column ; end row, page, column)
# start values normally 0~1st sheet A1
->>>>8 ulelong !0
+>>>>8 ulelong !0
>>>>>10 ubyte >0 \b%d*
>>>>>8 uleshort x \b%d,
>>>>>11 ubyte x \b%d-
>>>>20 ubyte >1 \b, character set 0x%x
# flags
>>>>21 ubyte x \b, flags 0x%x
->>>6 uleshort !0x0004
+>>>6 uleshort !0x0004
# record type (FONTNAME=00AEh)
->>>>30 search/29 \0\xAE
+>>>>30 search/29 \0\xAE
# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
>>>>>&4 string >\0 \b, 1st font "%s"
#
# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
# record type (BeginningOfFile=0000h) + length (0002h)
-0 belong 0x00000200
+0 belong 0x00000200
# GRR: line above is too general as it catches also MS Windows CURsor
# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
!:strength -1
# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
->7 ubyte 0
+>7 ubyte 0
# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
>>6 ubyte >0 Lotus
# !:mime application/x-123
# check and then display Lotus worksheet cells range
0 name lotus-cells
# look for type (RANGE=0006h) + length (0008h) at record begin
->0 ubelong 0x06000800 \b, cell range
+>0 ubelong 0x06000800 \b, cell range
# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
->>4 ulong !0
+>>4 ulong !0
>>>4 uleshort x \b%d,
>>>6 uleshort x \b%d-
# end of cell range
# Note: similiar to Windows CURsor. container for BMP (only DIB part) or PNG
0 belong 0x00000100
>9 byte 0
->>0 byte x
+>>0 byte x
>>0 use cur-ico-dir
>9 ubyte 0xff
->>0 byte x
+>>0 byte x
>>0 use cur-ico-dir
# displays number of icons and information for icon or cursor
0 name cur-ico-dir
# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
->18 ulelong &0x00000006
+>18 ulelong &0x00000006
# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
>>(18.l) ulelong x MS Windows
>>>0 ubelong 0x00000100 icon resource
# 1st icon
>>>>0x06 use ico-entry
# 2nd icon
->>>>4 uleshort >1
+>>>>4 uleshort >1
>>>>>0x16 use ico-entry
>>>0 ubelong 0x00000200 cursor resource
#!:mime image/x-cur
# offset of PNG or DIB image
#>12 ulelong x \b, offset 0x%x
# PNG header (\x89PNG)
->(12.l) ubelong =0x89504e47
->>&-4 indirect x \b with
+>(12.l) ubelong =0x89504e47
+>>&-4 indirect x \b with
# DIB image
->(12.l) ubelong !0x89504e47
+>(12.l) ubelong !0x89504e47
#>>&-4 use dib-image
# Windows non-animated cursors
>>0 use cur-ico-dir
# .chr files
-0 string/b PK\010\010BGI Borland font
+0 string/b PK\010\010BGI Borland font
>4 string >\0 %s
# then there is a copyright notice
# .bgi files
-0 string/b pk\010\010BGI Borland device
+0 string/b pk\010\010BGI Borland device
>4 string >\0 %s
# then there is a copyright notice
0 lelong 0x08086b70 TurboC BGI file
0 lelong 0x08084b50 TurboC Font file
-# Debian#712046: The magic below identifies "Delphi compiled form data".
+# Debian#712046: The magic below identifies "Delphi compiled form data".
# An additional source of information is available at:
# http://www.woodmann.com/fravia/dafix_t1.htm
0 string TPF0
# tests for DBase files moved, updated and merged to database
0 string PMCC Windows 3.x .GRP file
-1 string RDC-meg MegaDots
+1 string RDC-meg MegaDots
>8 byte >0x2F version %c
>9 byte >0x2F \b.%c file
0 lelong 0x4C
#>0x181 leshort x \b, offset %x
#>0x183 leshort x \b, offsetdata %x
#>0x185 leshort x \b, section length %x
->0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
->>&0x5e ubyte >0
+>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0
+>>&0x5e ubyte >0
>>>&-1 string <PIFMGR.DLL \b, icon=%s
#>>>&-1 string PIFMGR.DLL \b, icon=%s
>>>&-1 string >PIFMGR.DLL \b, icon=%s
->>&0xF0 ubyte >0
+>>&0xF0 ubyte >0
>>>&-1 string <Terminal \b, font=%.32s
#>>>&-1 string =Terminal \b, font=%.32s
>>>&-1 string >Terminal \b, font=%.32s
->>&0x110 ubyte >0
+>>&0x110 ubyte >0
>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s
#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s
>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s
>>>20 long >0 TIFF starts at byte %d
>>>>24 long >0 length %d
-# TNEF magic From "Joomy" <joomy@se-ed.net>
+# TNEF magic From "Joomy" <joomy@se-ed.net>
# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
0 leshort 0x223e9f78 TNEF
!:mime application/vnd.ms-tnef
# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
# of http://www.davep.org/norton-guides/ng2h-105.tgz
# http://en.wikipedia.org/wiki/Norton_Guides
-0 string NG\0\001
+0 string NG\0\001
# only value 0x100 found at offset 2
>2 ulelong 0x00000100 Norton Guide
# Title[40]
>>48 string >\0 \b, %-.66s
>>114 string >\0 %-.66s
-# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
+# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of http://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
0 ulelong 0x48443408 4DOS help file
# Windows Enhanced Metafile (EMF)
-# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
+# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
# for further information.
0 ulelong 1
>40 string \ EMF Windows Enhanced Metafile (EMF) image data
0 string/b MSWIM\000\000\000 Windows imaging (WIM) image
0 string/b WLPWM\000\000\000 Windows imaging (WIM) image, wimlib pipable format
-# The second byte of these signatures is a file version; I don't know what,
+# The second byte of these signatures is a file version; I don't know what,
# if anything, produced files with version numbers 0-2.
# From: John Elliott <johne@seasip.demon.co.uk>
0 string \xfc\x03\x00 Mallard BASIC program data (v1.11)
# backed up file
+# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
+# by looking for trailing nul of maximal file name string
+0x52 ubyte 0
+# test for flag byte: FFh~complete file, 00h~split file
+# FFh -127 = -1 -127 = -128
+# 00h -127 = 0 -127 = -127
+>0 byte-127 <-126
# plausibility check for file name length
-0x53 ubyte-1 <80
-# actually 54 nul bytes
->0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
->>0x5 string x DOS 2.0 backed up file %s,
->>0 ubyte 0xff complete file
->>0 ubyte !0xff
->>>1 ushort x split file, sequence %d
+>>0x53 ubyte-1 <78
+# looking for terminating nul of file name string
+>>>(0x53.b+4) ubyte 0
+# looking if last char of string is valid DOS file name
+>>>>(0x53.b+3) ubyte >0x1F
+# actually 44 nul bytes
+# but sometimes garbage according to Ralf Quint. So can not be used as test
+#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
+# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
+>>>>>5 ubyte&0x8C 0x0C
+# ./msdos (version 5.30) labeled the entry as
+# "DOS 2.0 backed up file %s, split file, sequence %d" or
+# "DOS 2.0 backed up file %s, complete file"
+>>>>>>0 ubyte x DOS 2.0-3.2 backed up
+#>>>>>>0 ubyte 0xff complete
+>>>>>>0 ubyte 0
+>>>>>>>1 uleshort x sequence %d of
+# full file name with path but without drive letter and colon stored from 0x05 til 0x52
+>>>>>>0x5 string x file %s
+# backup name is original filename
+#!:ext *
+# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*'
+# file: line 1169: Bad magic entry ' *'
+# after header original file content
+>>>>>>128 indirect x \b;
# DOS backup 3.3 to 5.x
#------------------------------------------------------------------------------
-# $File: msvc,v 1.5 2009/09/19 16:28:11 christos Exp $
+# $File: msvc,v 1.8 2017/03/17 22:20:22 christos Exp $
# msvc: file(1) magic for msvc
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Microsoft visual C
-#
+#
# I have version 1.0
# .aps
# Summary: Symbol Table / Debug info used by Microsoft compilers
# URL: https://en.wikipedia.org/wiki/Program_database
# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
# info does only applies partly for older files like msvbvm50.pdb about year 2001
-0 string Microsoft\ C/C++\
+0 string Microsoft\ C/C++\040
# "Microsoft Program DataBase" by TrID
>24 search/14 \r\n\x1A MSVC program database
!:mime application/x-ms-pdb
>>16 regex \([0-9.]+\) ver %s
#>>>0x38 search/128123456 /LinkInfo \b with linkinfo
# "MSF 7.00" variant
->>0x1e leshort 0
+>>0x1e leshort 0
# PageSize 400h 1000h
>>>0x20 lelong x \b, %d
# Page Count
>>>0x28 lelong x \b*%d bytes
# "program database 2.00" variant
->>0x1e leshort !0
+>>0x1e leshort !0
# PageSize 400h
>>>0x2c lelong x \b, %d
# Page Count for msoo-dll.pdb 4379h
############## MSX Music file formats ##############
# Gigamix MGSDRV music file
-0 string/b MGS MSX Gigamix MGSDRV3 music file,
+0 string/b MGS MSX Gigamix MGSDRV3 music file,
>6 ubeshort 0x0D0A
>>3 byte x \bv%c
>>4 byte x \b.%c
>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+)
>>0xF byte&0x02 0x02 \b, soundchips: SN76489
>>>0xF byte&0x04 0x04 stereo
->>0xF byte&0x01 0x01 \b,
+>>0xF byte&0x01 0x01 \b,
>>>0xF byte&0x18 0x00 \bYM2413
>>>0xF byte&0x18 0x08 \bYM2413, Y8950
>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo
4 uleshort 0x0900
>0xF byte 1
>>0x14 byte 0
->>>0x1E string \ \ \
+>>>0x1E string \040\040\040
>>>>0x23 byte 1
>>>>>0x25 byte 0
>>>>>>0x15 string >\x30
# ------------------------------------------------------------------------
-# $File$
+# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
# mup: file(1) magic for Mup (Music Publisher) input file.
#
# From: Abel Cheung <abel (@) oaka.org>
#
0 search/1 //!Mup Mup music publication program input text
>6 string -Arkkra (Arkkra)
->>13 string -
->>>16 string .
+>>13 string -
+>>>16 string .
>>>>14 string x \b, need V%.4s
->>>15 string .
+>>>15 string .
>>>>14 string x \b, need V%.3s
->6 string -
->>9 string .
+>6 string -
+>>9 string .
>>>7 string x \b, need V%.4s
->>8 string .
+>>8 string .
>>>7 string x \b, need V%.3s
#------------------------------------------------------------------------------
-# nasa: file(1) magic
+# nasa: file(1) magic
# From: Barry Carter <carter.barry@gmail.com>
0 string DAF/SPK NASA SPICE file (binary format)
#------------------------------------------------------------------------------
-# $File: netbsd,v 1.22 2014/12/08 20:53:52 christos Exp $
+# $File: netbsd,v 1.24 2017/03/17 21:35:28 christos Exp $
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
#
0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>32 lelong !0 (signal %d)
0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>32 belong !0 (signal %d)
0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>32 belong !0 (signal %d)
0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>12 string >\0 from '%s'
0 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>32 belong !0 (signal %d)
0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>32 lelong !0 (signal %d)
0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>32 lelong !0 (signal %d)
0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>32 lelong !0 (signal %d)
# NetBSD/alpha does not support (and has never supported) a.out objects,
-# so no rules are provided for them. NetBSD/alpha ELF objects are
+# so no rules are provided for them. NetBSD/alpha ELF objects are
# dealt with in "elf".
0 lelong 0x00070185 ECOFF NetBSD/alpha binary
>10 leshort 0x0001 not stripped
>32 lelong !0 (signal %d)
0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
->0 byte &0x80
+>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
#------------------------------------------------------------------------------
-# $File: netscape,v 1.6 2009/09/19 16:28:11 christos Exp $
+# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
# netscape: file(1) magic for Netscape files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# version 3 and 4 I think
# .snm Caches
0 string #\ Netscape\ folder\ cache Netscape folder cache
0 string \000\036\204\220\000 Netscape folder cache
-# .n2p
-# Net 2 Phone
+# .n2p
+# Net 2 Phone
#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
0 string SX961999 Net2phone
#------------------------------------------------------------------------------
-# $File: nitpicker,v 1.5 2014/04/28 12:04:50 christos Exp $
+# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
# nitpicker: file(1) magic for Flowfiles.
# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
-0 string NPFF NItpicker Flow File
+0 string NPFF NItpicker Flow File
>4 byte x V%d.
>5 byte x %d
>6 bedate x started: %s
#------------------------------------------------------------------------------
-# $File: os2,v 1.8 2015/01/05 00:17:13 christos Exp $
+# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
# os2: file(1) magic for OS/2 files
#
#>5 string >\ (Local file) <%s>
# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
-# Carl Hauser (chauser.parc@xerox.com) and
+# Carl Hauser (chauser.parc@xerox.com) and
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
#
# // bit 0: set if INF style file
# // bit 4: set if HLP style file
# // patching this byte allows reading HLP files
-# // using the VIEW command, while help files
+# // using the VIEW command, while help files
# // seem to work with INF settings here as well.
# int16 hdrsize; // total size of header
# int16 unknown2; // unknown purpose
-#
+#
0 string HSP\x01\x9b\x00 OS/2 INF
>107 string >0 (%s)
0 string HSP\x10\x9b\x00 OS/2 HLP
#------------------------------------------------------------------------------
-# $File: os9,v 1.6 2009/09/19 16:28:11 christos Exp $
+# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>>>0x1A ubyte&0xEF 0
>>>>0x1B ubyte&0x8F 0
->>>>>0x1B ubyte&70 <0x40
+>>>>>0x1B ubyte&70 <0x40
>>>>>>0x1C ulelong >0x21
>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
>>>>>>>>0x1B ubyte 0 \b, media=2D
# http://www.jisyo.com/viewer/faq/maki_tech.htm
0 string/b MAKI01 Maki-chan v1.
>6 ubyte|0x20 x \b%c image
->8 ubelong >0x40404040 \b, system ID:
+>8 ubelong >0x40404040 \b, system ID:
>>8 byte x %c
>>9 byte x \b%c
>>10 byte x \b%c
#------------------------------------------------------------------------------
-# $File: pdp,v 1.9 2013/04/19 20:11:43 christos Exp $
+# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
# updated by Joerg Jenderek at Mar 2013
# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
-0 leshort 0401
-# skip *.PNF with WinDirPathOffset 58h
+0 leshort 0401
+# skip *.PNF with WinDirPathOffset 58h
>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp
# skip *.PNF with high byte of InfVersionDatumCount zero
#>>15 byte !0 PDP-11 UNIX/RT ldp
#------------------------------------------------------------------------------
-# $File: perl,v 1.24 2015/03/27 17:58:58 christos Exp $
+# $File: perl,v 1.25 2016/06/07 23:28:37 rrt Exp $
# perl: file(1) magic for Larry Wall's perl language.
#
# The `eval' lines recognizes an outrageously clever hack.
# by Dmitry V. Levin and Alexey Tourbin
# check the first line
-0 search/1024 package
+0 search/8192 package
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
-!:strength + 10
+!:strength + 40
# not 'p', check other lines
-0 search/1024 !p
+0 search/8192 !p
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
-!:strength + 10
+!:strength + 75
# Perl POD documents
# From: Tom Hukins <tom@eborcom.com>
#------------------------------------------------------------------------------
-# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
+# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
# pgf: file(1) magic for Progressive Graphics File (PGF)
#
# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
>>20 byte 19 RGB color 12,
>>20 byte 20 RGB color 16,
>>20 byte 255 unknown format,
->>20 default x format
+>>20 default x format
>>>20 byte x \b %d,
>>21 byte x %d bpc
# PGFPostHeader
#------------------------------------------------------------------------------
-# $File: pgp,v 1.12 2016/10/07 20:22:12 christos Exp $
+# $File: pgp,v 1.14 2017/03/17 21:35:28 christos Exp $
# pgp: file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
#
>0 byte 0x30
>>1 byte&0xc0 0x00 Unused [0%x]
>>1 byte&0xc0 0x40 User Attribute
->>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data
+>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data
>>1 byte&0xc0 0xc0 Modification Detection Code
# magic signatures to detect PGP crypto material (from stef)
>0 byte 19 ECDSA
>0 byte 20 ElGamal (Encrypt or Sign)
>0 byte 21 Diffie-Hellman
->0 default x
+>0 default x
>>0 ubyte <22 unknown (pub %d)
# this should never happen
>>0 ubyte >21 invalid (%d)
>1 use pgpkey
0 byte 0x97 PGP Secret Sub-key -
>1 use pgpkey
-0 byte 0x9d
+0 byte 0x9d
# Update: Joerg Jenderek
# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
->1 ubeshort >0
+>1 ubeshort >0
#>1 ubeshort x \b, body length 0x%x
# next packet type often 88h,89h~(tag 2)~Signature Packet
#>>(1.S+3) ubyte x \b, next packet type 0x%x
# skip Dragon.SHR DEMO.INIT by looking for positive version
->>3 ubyte >0
+>>3 ubyte >0
# skip BUISSON.13 GUITAR1 by looking for low version number
>>>3 ubyte <5 PGP Secret Sub-key
# sub-key are normally part of secret key. So it does not occur as standalone file
>>>>3 ubyte x (v%d)
>>>>3 ubyte x -
# old versions 2 or 3 but no real example found
->>>>3 ubyte <4
+>>>>3 ubyte <4
# 2 byte for key bits in version 5.28 look
>>>>>11 ubeshort x %db
>>>>>4 beldate x created on %s -
#>>>>>8 ubeshort x 0x%x
# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
>>>>>10 use key_algo
->>>>>(11.S/8) ubequad x
+>>>>>(11.S/8) ubequad x
# look after first key
>>>>>>&5 use keyend
# new version
->>>>3 ubyte >3
+>>>>3 ubyte >3
>>>>>9 ubeshort x %db
>>>>>4 beldate x created on %s -
# display key algorithm
>>>>>8 use key_algo
->>>>>(9.S/8) ubequad x
+>>>>>(9.S/8) ubequad x
# look after first key for something like s2k
>>>>>>&3 use keyend
#------------------------------------------------------------------------------
-# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $
+# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $
# printer: file(1) magic for printer-formatted files
#
>>>15 string EPS \b, type %s
>>>15 string Query \b, type %s
>>>15 string ExitServer \b, type %s
->>>15 search/1000 %%LanguageLevel:\
+>>>15 search/1000 %%LanguageLevel:\040
>>>>&0 string >\0 \b, Level %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0 string \004%! PostScript document text
>>>16 string EPS \b, type %s
>>>16 string Query \b, type %s
>>>16 string ExitServer \b, type %s
->>>16 search/1000 %%LanguageLevel:\
+>>>16 search/1000 %%LanguageLevel:\040
>>>>&0 string >\0 \b, Level %s
0 string \033%-12345X%!PS PostScript document
# HP Printer Job Language
0 string \033%-12345X@PJL HP Printer Job Language data
# HP Printer Job Language
-# The header found on Win95 HP plot files is the "Silliest Thing possible"
+# The header found on Win95 HP plot files is the "Silliest Thing possible"
# (TM)
# Every driver puts the language at some random position, with random case
# (LANGUAGE and Language)
# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
-#
+#
0 string \033%-12345X@PJL HP Printer Job Language data
->&0 string >\0 %s
->>&0 string >\0 %s
->>>&0 string >\0 %s
->>>>&0 string >\0 %s
+>&0 string >\0 %s
+>>&0 string >\0 %s
+>>>&0 string >\0 %s
+>>>>&0 string >\0 %s
#>15 string \ ENTER\ LANGUAGE\ =
#>31 string PostScript PostScript
#------------------------------------------------------------------------------
# HP LaserJet 1000 series downloadable firmware file
-0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
+0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
# From: Paolo <oopla@users.sf.net>
-# Epson ESC/Page, ESC/PageColor
+# Epson ESC/Page, ESC/PageColor
0 string \x1b\x01@EJL Epson ESC/Page language printer data
#------------------------------------------------------------------------------
-# $File$
+# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
# project: file(1) magic for Project management
-#
+#
# Magic strings for ftnchek project files. Alexander Mai
0 string FTNCHEK_\ P project file for ftnchek
>10 string 1 version 2.7
#------------------------------------------------------------------------------
-# $File: psdbms,v 1.6 2009/09/19 16:28:11 christos Exp $
+# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
# psdbms: file(1) magic for psdatabase
#
# Update: Joerg Jenderek
# GRR: line below too general as it catches also some Panorama database *.pan ,
# AppleWorks word processor
-0 belong&0xff00ffff 0x56000000
+0 belong&0xff00ffff 0x56000000
# assume version starts with digit
>1 regex/s =^[0-9] ps database
>>1 string >\0 version %s
#------------------------------------------------------------------------------
-# $File: python,v 1.28 2015/09/16 22:19:54 christos Exp $
+# $File: python,v 1.31 2017/04/11 14:59:28 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
# from module.submodule import func1, func2
-0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
+0 regex \^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$ Python script text executable
+!:strength + 15
!:mime text/x-python
# def __init__ (self, ...):
0 search/4096 def\ __init__
>&0 search/64 self Python script text executable
+!:strength + 15
!:mime text/x-python
# comments
# except: or finally:
# block
0 search/4096 try:
->&0 regex \^\\s*except.*: Python script text executable
+>&0 regex \^[A-Za-z0-9_]*except.*: Python script text executable
+!:strength + 15
!:mime text/x-python
>&0 search/4096 finally: Python script text executable
!:mime text/x-python
0 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
>&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
!:mime text/x-python
+!:strength + 15
#------------------------------------------------------------------------------
-# $File: riff,v 1.30 2014/09/23 17:02:12 christos Exp $
+# $File: riff,v 1.32 2017/03/17 21:35:28 christos Exp $
# riff: file(1) magic for RIFF format
# See
#
>>18 leshort x \b, %d entries
# RIFF Device Independent Bitmap format
>8 string RDIB \b, device-independent bitmap
->>16 string BM
+>>16 string BM
>>>30 leshort 12 \b, OS/2 1.x format
>>>>34 leshort x \b, %d x
>>>>36 leshort x %d
>8 string sfbk SoundFont/Bank
# MPEG-1 wrapped in a RIFF, apparently
>8 string CDXA \b, wrapped MPEG-1 (CDXA)
->8 string 4XMV \b, 4X Movie file
+>8 string 4XMV \b, 4X Movie file
# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
->8 string AMV\040 \b, AMV
+>8 string AMV\040 \b, AMV
>8 string WEBP \b, Web/P image
!:mime image/webp
>>12 use riff-walk
>>18 beshort x \b, %d entries
# RIFF Device Independent Bitmap format
>8 string RDIB \b, device-independent bitmap
->>16 string BM
+>>16 string BM
>>>30 beshort 12 \b, OS/2 1.x format
>>>>34 beshort x \b, %d x
>>>>36 beshort x %d
#------------------------------------------------------------------------------
# Sony Wave64
# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
-# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
+# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
0 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data
# 128 bit + total file size (64 bits) so 24 bytes
# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
#------------------------------------------------------------------------------
-# $File$
+# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
# sccs: file(1) magic for SCCS archives
#
# SCCS archive structure:
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
-# and we don't have regular expression matching yet.
+# and we don't have regular expression matching yet.
# Hence the following official kludge:
8 string \001s\ SCCS archive data
#------------------------------------------------------------------------------
-# $File: scientific,v 1.9 2014/06/03 19:01:34 christos Exp $
-# scientific: file(1) magic for scientific formats
+# $File: scientific,v 1.12 2017/03/17 22:20:22 christos Exp $
+# scientific: file(1) magic for scientific formats
#
# From: Joe Krahn <krahn@niehs.nih.gov>
# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
# uppercase letters. However, examples have been seen without the date string,
# e.g., the example on the chemime site.
-0 string HEADER\ \ \ \
+0 string HEADER\ \ \ \040
>&0 regex/1l \^.{40}
>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
>>>&0 regex/1ls [A-Z0-9]{4}.{14}$
#------------------------------------------------------------------------------
-# $File: sendmail,v 1.7 2009/09/19 16:28:12 christos Exp $
+# $File: sendmail,v 1.9 2017/03/17 21:35:28 christos Exp $
# sendmail: file(1) magic for sendmail config files
#
# XXX - byte order?
#
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# GRR: this test is too general as it catches also
# READ.ME.FIRST.AWP Sendmail frozen configuration
# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
# Email_23_f217153422.ts Sendmail frozen configuration
# - version \330jK\354
-0 byte 046
+0 byte 046
# http://www.sendmail.com/sm/open_source/docs/older_release_notes/
# freezed configuration file (dbm format?) created from sendmal.cf with -bz
# by older sendmail. til version 8.6 support for frozen configuration files is removed
# valid version numbers look like "7.14.4" and should be simliar to output of commands
-# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
+# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration
# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
!:ext fc
>>16 string >\0 - version %s
-0 short 0x271c
+0 short 0x271c
# look for valid version number
>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration
!:ext fc
#------------------------------------------------------------------------------
-# $File: sequent,v 1.11 2014/06/02 19:27:54 christos Exp $
+# $File: sequent,v 1.13 2017/03/17 21:35:28 christos Exp $
# sequent: file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
#0 leshort 0x42eb SYMMETRY i386 standalone executable
-0 leshort 0x42eb
+0 leshort 0x42eb
# skip unlike negative version
->124 lelong >-1
+>124 lelong >-1
# assuming version 28867614 is very low probable
>>124 lelong !28867614 SYMMETRY i386 standalone executable
>>>16 lelong >0 not stripped
#------------------------------------------------------------------------
-# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
# file(1) magic for sharc files
#
-# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
+# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
# FutureGroove Music (dsp@futuregroove.de)
#------------------------------------------------------------------------
#------------------------------------------------------------------------------
-# $File$
-# Sketch Drawings: http://sketch.sourceforge.net/
+# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
+# Sketch Drawings: http://sketch.sourceforge.net/
# From: Edwin Mons <e@ik.nu>
0 search/1 ##Sketch Sketch document text
#------------------------------------------------------------------------------
-# $File: sql,v 1.19 2016/07/04 15:20:01 christos Exp $
+# $File: sql,v 1.21 2017/03/17 21:35:28 christos Exp $
# sql: file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
>>3 byte x Version %d
#------------------------------------------------------------------------------
-# iRiver H Series database file
+# iRiver H Series database file
# From Ken Guest <ken@linux.ie>
# As observed from iRivNavi.iDB and unencoded firmware
#
0 string PSDB\0 Panasonic channel list DataBase
!:ext db/bin
#!:mime application/x-db-svl-panasonic
->126 string SQLite\ format\ 3
+>126 string SQLite\ format\ 3
#!:mime application/x-panasonic-sqlite3
->>&-15 indirect x \b; contains
+>>&-15 indirect x \b; contains
# H2 Database from http://www.h2database.com/
0 string --\ H2\ 0.5/B\ --\ \n H2 Database file
#------------------------------------------------------------------------
-# $File: sysex,v 1.7 2013/09/16 15:12:42 christos Exp $
+# $File: sysex,v 1.9 2017/03/17 21:35:28 christos Exp $
# sysex: file(1) magic for MIDI sysex files
#
# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
>1 belong&0xffffff00 0x00011d00 Nemesys
>1 belong&0xffffff00 0x00011e00 DBX
>1 belong&0xffffff00 0x00011f00 Syndyne
->1 belong&0xffffff00 0x00012000 Bitheadz
+>1 belong&0xffffff00 0x00012000 Bitheadz
>1 belong&0xffffff00 0x00012100 Cakewalk
>1 belong&0xffffff00 0x00012200 Staccato
>1 belong&0xffffff00 0x00012300 National Semicon.
#------------------------------------------------------------------------------
-# $File: terminfo,v 1.6 2009/09/19 16:28:12 christos Exp $
+# $File: terminfo,v 1.9 2017/04/28 16:28:58 christos Exp $
# terminfo: file(1) magic for terminfo
#
-# XXX - byte order for screen images?
+# URL: http://invisible-island.net/ncurses/man/term.5.html
+# URL: http://invisible-island.net/ncurses/man/scr_dump.5.html
#
-# URL: https://en.wikipedia.org/wiki/Terminfo
-# Reference: ncurses-5.9/ncurses/tinfo/write_entry.c
-# Update: Joerg Jenderek
-#
-# GRR: line below too general as it catches also
+# Workaround for Targa image type by Joerg Jenderek
+# GRR: line below too general as it catches also
# Targa image type 1 with 26 long identification field
# and HELP.DSK
-0 string \032\001
+0 string \032\001
# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
->16 ubyte >32
+>16 ubyte >32
# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s"
!:mime application/x-terminfo
# no extension
-#!:ext
-0 short 0433 Curses screen image
-0 short 0434 Curses screen image
+#!:ext
+#
+# While the compiled terminfo uses little-endian format irregardless of
+# platform, SystemV screen dumps do not. They came later, and that detail was
+# overlooked.
+#
+# AIX and HPUX use the SVr4 big-endian format
+# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
+0 beshort 0433 SVr2 curses screen image, big-endian
+0 beshort 0434 SVr3 curses screen image, big-endian
+0 beshort 0435 SVr4 curses screen image, big-endian
+#
+0 leshort 0433 SVr2 curses screen image, little-endian
+0 leshort 0434 SVr3 curses screen image, little-endian
+0 leshort 0435 SVr4 curses screen image, little-endian
+#
+# Rather than SVr4, Solaris "xcurses" writes this header:
+0 regex \^MAX=[0-9]+,[0-9]+$
+>1 regex \^BEG=[0-9]+,[0-9]+$
+>2 regex \^SCROLL=[0-9]+,[0-9]+$
+>3 regex \^VMIN=[0-9]+$
+>4 regex \^VTIME=[0-9]+$
+>5 regex \^FLAGS=0x[[:xdigit:]]+$
+>6 regex \^FG=[0-9],[0-9]+$
+>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image
+#
+# ncurses5 (and before) did not use a magic number, making screen dumps "data".
+# ncurses6 (2015) uses this format, ignoring byte-order
+0 string \210\210\210\210ncurses ncurses6 screen image
+#
+# PDCurses added this in 2005
+0 string PDC\001 PDCurses screen image
#------------------------------------------------------------------------------
-# $File: vms,v 1.8 2014/08/17 12:58:54 christos Exp $
+# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
# vms: file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
#
# GRR this test is still too general as it catches example adressen.dbt
-0 belong 0x03000000
+0 belong 0x03000000
>8 ubelong 0xec020000 VMS Alpha executable
>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
#------------------------------------------------------------------------------
-# $File$
+# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
# VMware specific files (deducted from version 1.1 and log file entries)
# Anthon van der Neut (anthon@mnt.org)
-0 belong 0x4d52564e VMware nvram
+0 belong 0x4d52564e VMware nvram
#------------------------------------------------------------------------------
-# $File: vorbis,v 1.21 2015/01/06 01:58:09 christos Exp $
+# $File: vorbis,v 1.23 2017/03/17 21:35:28 christos Exp $
# vorbis: file(1) magic for Ogg/Vorbis files
#
# From Felix von Leitner <leitner@fefe.de>
# in a different place, so we must use an indirect offset.
>>>(84.b+85) string \x03vorbis
>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
->>>>>(84.b+120) string >00000000
+>>>>>(84.b+120) string >00000000
# Map to beta version numbers:
>>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
->>>>>(84.b+117) string >00000000
+>>>>>(84.b+117) string >00000000
>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
>>>>>>(84.b+117) string 20020717 (1.0)
>>>>>>(84.b+117) string 20030909 (1.0.1)
!:mime audio/ogg
>>>36 ubyte >0x0F UNKNOWN VERSION %u,
>>>36 ubyte &0x0F version 0.%d
->>>>46 ubyte >1
+>>>>46 ubyte >1
>>>>>46 ubyte !255 unknown channel mapping family %u,
>>>>>37 ubyte x %u channels
>>>>46 ubyte 0
>>>>>37 ubyte 1 mono
>>>>>37 ubyte 2 stereo
->>>>46 ubyte 1
+>>>>46 ubyte 1
>>>>>37 ubyte 1 mono
>>>>>37 ubyte 2 stereo
>>>>>37 ubyte 3 linear surround
--- /dev/null
+#------------------------------------------------------------------------------
+# $File: webassembly,v 1.2 2017/05/02 14:05:29 christos Exp $
+# webassembly: file(1) magic for WebAssembly modules
+#
+# WebAssembly is a virtual architecture developed by a W3C Community
+# Group at http://webassembly.org/. The file extension is .wasm, and
+# the MIME type is application/wasm.
+#
+# http://webassembly.org/docs/binary-encoding/ is the main
+# document describing the binary format.
+# From: Pip Cet <pipcet@gmail.com> and Joel Martin
+
+0 string \0asm WebAssembly (wasm) binary module
+>4 lelong =1 version %#x (MVP)
+>4 lelong >1 version %#x
#------------------------------------------------------------------------------
-# $File: windows,v 1.13 2015/09/23 16:03:03 christos Exp $
+# $File: windows,v 1.16 2017/03/17 22:20:22 christos Exp $
# windows: file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
# Created by: Andreas Schuster (http://computer.forensikblog.de/)
# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
-0 string PAGE
+0 string PAGE
>4 string DUMP MS Windows 32bit crash dump
>>0x05c byte 0 \b, no PAE
>>0x05c byte 1 \b, PAE
# Summary: Old format help files
# URL: https://en.wikipedia.org/wiki/WinHelp
# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek
# Created by: Dirk Jagdmann <doj@cubic.org>
#
# check and then display version and date inside MS Windows HeLP file fragment
0 name help-ver-date
# look for Magic of SYSTEMHEADER
->0 leshort 0x036C
+>0 leshort 0x036C
# version Major 1 for right file fragment
>>4 leshort 1 Windows
# print non empty string above to avoid error message
>>>6 ldate x \b, %s
#
# Magic for HeLP files
-0 lelong 0x00035f3f
+0 lelong 0x00035f3f
# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
# file header magic 0x293B at DirectoryStart+9
>(4.l+9) uleshort 0x293B MS
>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation
!:mime application/x-winhelp
!:ext ann
->>0xD4 string !\x62\x6D\x66\x01\x00
+>>0xD4 string !\x62\x6D\x66\x01\x00
# "GID Help index" by TrID
>>>(4.l+0x65) string =|Pete Windows help Global Index
!:mime application/x-winhelp
!:ext gid
# HeLP Bookmark or
# "Windows HELP File" by TrID
->>>(4.l+0x65) string !|Pete
+>>>(4.l+0x65) string !|Pete
# maybe there exist a cleaner way to detect HeLP fragments
# brute search for Magic 0x036C with matching Major maximal 7 iterations
# discapp.hlp
->>>>16 search/0x49AF/s \x6c\x03
+>>>>16 search/0x49AF/s \x6c\x03
>>>>>&0 use help-ver-date
->>>>>&4 leshort !1
+>>>>>&4 leshort !1
# putty.hlp
->>>>>>&0 search/0x69AF/s \x6c\x03
+>>>>>>&0 search/0x69AF/s \x6c\x03
>>>>>>>&0 use help-ver-date
->>>>>>>&4 leshort !1
->>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>&4 leshort !1
+>>>>>>>>&0 search/0x49AF/s \x6c\x03
>>>>>>>>>&0 use help-ver-date
->>>>>>>>>&4 leshort !1
->>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>&4 leshort !1
+>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
>>>>>>>>>>>&0 use help-ver-date
->>>>>>>>>>>&4 leshort !1
->>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>>>&4 leshort !1
+>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
>>>>>>>>>>>>>&0 use help-ver-date
->>>>>>>>>>>>>&4 leshort !1
->>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>>>>>&4 leshort !1
+>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
>>>>>>>>>>>>>>>&0 use help-ver-date
->>>>>>>>>>>>>>>&4 leshort !1
->>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
+>>>>>>>>>>>>>>>&4 leshort !1
+>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03
# GCC.HLP is detected after 7 iterations
>>>>>>>>>>>>>>>>>&0 use help-ver-date
# this only happens if bigger hlp file is detected after used search iterations
!:mime application/winhelp
!:ext hlp
# repeat search again or following default line does not work
->>>>16 search/0x49AF/s \x6c\x03
+>>>>16 search/0x49AF/s \x6c\x03
# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
>>>>16 default x Windows help Bookmark
!:mime application/x-winhelp
#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx
# start with colon or semicolon for comment line like Back2Life.cnt
-0 regex \^(:|;)
+0 regex \^(:|;)
# look for first keyword Base
->0 search/45 :Base
+>0 search/45 :Base
>>&0 use cnt-name
# only solution to search again from beginning , because relative offsets changes when use is called
->0 search/45 :Base
->0 default x
+>0 search/45 :Base
+>0 default x
# look for other keyword Title like in putty.cnt
->>0 search/45 :Title
+>>0 search/45 :Title
>>>&0 use cnt-name
#
# display mime type and name of Windows help Content source
0 name cnt-name
# skip space at beginning
->0 string \
+>0 string \040
# name without extension and greater character or name with hlp extension
>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s"
!:mime text/plain
# Summary: Hyper terminal
# Extension: .ht
# Created by: unknown
-0 string HyperTerminal\
+0 string HyperTerminal\040
>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile
-# http://ithreats.files.wordpress.com/2009/05/\
+# http://ithreats.files.wordpress.com/2009/05/\040
# lnk_the_windows_shortcut_file_format.pdf
# Summary: Windows shortcut
# Extension: .lnk
# Extension: .reg
# Submitted by: Abel Cheung <abelcheung@gmail.com>
0 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above)
-0 string Windows\ Registry\ Editor\
+0 string Windows\ Registry\ Editor\040
>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above)
# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
# PR/383: remove unicode BOM because it is not portable across regex impls
0 regex/s \\`(\\r\\n|;|[[])
# left bracket in section line
->&0 search/8192 [
+>&0 search/8192 [
# http://en.wikipedia.org/wiki/Autorun.inf
# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
->>&0 regex/c \^(autorun)]\r\n
+>>&0 regex/c \^(autorun)]\r\n
>>>&0 ubyte =0x5b INItialization configuration
!:mime application/x-wine-extension-ini
# From: Pal Tamas <folti@balabit.hu>
# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information
>>&0 regex/c \^(boot\x20loader)] Windows boot.ini
!:mime application/x-wine-extension-ini
->>>&0 ubyte x
+>>>&0 ubyte x
# http://en.wikipedia.org/wiki/CONFIG.SYS
>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS
# http://support.microsoft.com/kb/118579/
>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS
# VERS string unicoded case-independent
->>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
# ION] string unicoded case-independent
->>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
!:mime application/x-setupscript
# STRI string unicoded case-independent
->>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049
+>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049
# NGS] string unicoded case-independent
->>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation
+>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation
!:mime application/x-setupscript
# unknown keyword after opening bracket
->>&0 default x
->>>&0 search/8192 [
+>>&0 default x
+>>>&0 search/8192 [
# version Strings FileIdentification
->>>>&0 string/c version Windows setup INFormation
+>>>>&0 string/c version Windows setup INFormation
!:mime application/x-setupscript
# VERS string unicoded case-independent
->>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
+>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053
# ION] string unicoded case-independent
->>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
+>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation
!:mime application/x-setupscript
# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other
#>>>>&0 default x Generic INItialization configuration
# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
-0 leshort&0xFeFe 0x0000
+0 leshort&0xFeFe 0x0000
!:strength -5
# test for unused null bits in PNF_FLAGs
->4 ulelong&0xFCffFe00 0x00000000
+>4 ulelong&0xFCffFe00 0x00000000
# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
->>68 ulelong >0x57
+>>68 ulelong >0x57
# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF
!:mime application/x-pnf
# currently only found Major Version=1 and Minor Version=1
-#>>>>0 uleshort =0x0101
+#>>>>0 uleshort =0x0101
#>>>>>1 ubyte x \b, version %u
#>>>>>0 ubyte x \b.%u
->>>>0 uleshort !0x0101
+>>>>0 uleshort !0x0101
>>>>>1 ubyte x \b, version %u
>>>>>0 ubyte x \b.%u
# 1 ,2 (windows 98 SE)
#>>>>16 ulelong x \b, InfVersionDataSize 0x%x
# only found positive values lower 0x00ffFFff for InfVersionDataOffset
>>>>20 ulelong x \b, at 0x%x
->>>>4 ulelong&0x00000001 =0x00000001
-# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
+>>>>4 ulelong&0x00000001 =0x00000001
+# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
>>>>>(20.l) lestring16 x "%s"
->>>>4 ulelong&0x00000001 !0x00000001
+>>>>4 ulelong&0x00000001 !0x00000001
>>>>>(20.l) string x "%s"
# FILETIME is number of 100-nanosecond intervals since 1 January 1601
#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx
#>>>>64 ulelong x \b, InfValueBlockSize 0x%x
# WinDirPathOffset
#>>>>68 ulelong x \b, at 0x%x
->>>>68 ulelong >0x57
->>>>>4 ulelong&0x00000001 =0x00000001
->>>>>>(68.l) ubequad =0x43003a005c005700
+>>>>68 ulelong >0x57
+>>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>>(68.l) ubequad =0x43003a005c005700
# normally unicoded C:\Windows
#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
->>>>>>(68.l) ubequad !0x43003a005c005700
+>>>>>>(68.l) ubequad !0x43003a005c005700
>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
# normally ASCII C:\WINDOWS
#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s"
>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s"
-# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
+# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
#>>>>72 ulelong >0 \b, at 0x%x
>>>>72 ulelong >0 \b,
->>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>4 ulelong&0x00000001 =0x00000001
>>>>>>(72.l) lestring16 x OsLoaderPath "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
# seldom C:\ instead empty
>>>>>>(72.l) string x OsLoaderPath "%s"
# 1fdh
# InfSourcePathOffset often 0
#>>>>80 ulelong >0 \b, at 0x%x
>>>>80 ulelong >0 \b,
->>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>4 ulelong&0x00000001 =0x00000001
>>>>>>(80.l) lestring16 x SourcePath "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
>>>>>>(80.l) string >\0 SourcePath "%s"
# OriginalInfNameOffset often 0
#>>>>84 ulelong >0 \b, at 0x%x
>>>>84 ulelong >0 \b,
->>>>>4 ulelong&0x00000001 =0x00000001
+>>>>>4 ulelong&0x00000001 =0x00000001
>>>>>>(84.l) lestring16 x InfName "%s"
->>>>>4 ulelong&0x00000001 !0x00000001
+>>>>>4 ulelong&0x00000001 !0x00000001
>>>>>>(84.l) string >\0 InfName "%s"
# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
# URL: http://en.wikipedia.org/wiki/NTBackup
# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
# Descriptor BloCK name of Microsoft Tape Format
-0 string TAPE
+0 string TAPE
# Format Logical Address is zero
->20 ulequad 0
+>20 ulequad 0
# Reserved for MBC is zero
->>28 uleshort 0
+>>28 uleshort 0
# Control Block ID is zero
->>>36 ulelong 0
+>>>36 ulelong 0
# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive
#!:mime application/x-ntbackup
>>>>>4 ulelong&0x00000004 !0 \b, compressed
# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing
>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit
->>>>>4 ulelong&0x00020000 0
+>>>>>4 ulelong&0x00020000 0
# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape
>>>>>>4 ulelong&0x00010000 !0 \b, with catalog
# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present
# Media Based Catalog Type (1,2)
#>>>>>66 uleshort x \b, catalog type %4.4x
# size of Media Name (66,68,6Eh)
->>>>>68 uleshort >0
+>>>>>68 uleshort >0
# offset of Media Name (5Eh)
->>>>>>70 uleshort >0
+>>>>>>70 uleshort >0
# 0~, 1~ANSI, 2~UNICODE
->>>>>>>48 ubyte 1
+>>>>>>>48 ubyte 1
# size terminated ansi coded string normally followed by "MTF Media Label"
>>>>>>>>(70.s) string >\0 \b, name: %s
->>>>>>>48 ubyte 2
+>>>>>>>48 ubyte 2
# Not null, but size terminated unicoded string
>>>>>>>>(70.s) lestring16 x \b, name: %s
# size of Media Label (104h)
->>>>>72 uleshort >0
+>>>>>72 uleshort >0
# offset of Media Label (C4h,C6h,CCh)
->>>>>74 uleshort >0
->>>>>>48 ubyte 1
+>>>>>74 uleshort >0
+>>>>>>48 ubyte 1
#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
>>>>>>>(74.s) string >\0 \b, label: %s
->>>>>>48 ubyte 2
+>>>>>>48 ubyte 2
>>>>>>>(74.s) lestring16 x \b, label: %s
# size of password name (0,1Ch)
#>>>>>76 uleshort >0 \b, password size %4.4x
# Software Vendor ID (CBEh)
>>>>>86 uleshort x \b, software (0x%x)
# size of Software Name (6Eh)
->>>>>80 uleshort >0
+>>>>>80 uleshort >0
# offset of Software Name (1C8h,1CAh,1D0h)
->>>>>>82 uleshort >0
+>>>>>>82 uleshort >0
# 1~ANSI, 2~UNICODE
->>>>>>>48 ubyte 1
+>>>>>>>48 ubyte 1
>>>>>>>>(82.s) string >\0 \b: %s
->>>>>>>48 ubyte 2
+>>>>>>>48 ubyte 2
# size terminated unicoded coded string normally followed by "SPAD"
>>>>>>>>(82.s) lestring16 x \b: %s
# Format Logical Block Size (512,1024)
#------------------------------------------------------------------------------
-# $File: xenix,v 1.9 2009/09/19 16:28:13 christos Exp $
+# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
# xenix: file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
# Update: Joerg Jenderek
# recordtype~TranslatorHEADerRecord
-0 byte 0x80
+0 byte 0x80
# GRR: line above is too general as it catches also Extensible storage engine DataBase
# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
->1 uleshort <1022
+>1 uleshort <1022
# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
->>1 uleshort >0
+>>1 uleshort >0
# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
->>>3 ubyte >0
+>>>3 ubyte >0
# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft)
#!:mime application/octet-stream
>0x1c byte &0x9 286
>0x1c byte &0xa 386
>0x1f byte <0x040 small model
->0x1f byte =0x048 large model
->0x1f byte =0x049 huge model
+>0x1f byte =0x048 large model
+>0x1f byte =0x049 huge model
>0x1e leshort &0x1 executable
>0x1e leshort ^0x1 object file
>0x1e leshort &0x40 Large Text
#------------------------------------------------------------------------------
-# $File: xilinx,v 1.6 2013/11/19 23:15:13 christos Exp $
+# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
# Xilinx-Magic@RevRagnarok.com
# Got the info from FPGA-FAQ 0026
#
-# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
-# fixes at least reading of bitfiles from Spartan 2, 3, 6.
+# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
+# fixes at least reading of bitfiles from Spartan 2, 3, 6.
# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
#
# First there is the sync header and its length
>>>>&0 pstring/H x - from %s
# And then 'b'
>>>>>&1 string b
-# Then the model / part number:
+# Then the model / part number:
>>>>>>&0 pstring/H x - for %s
# Then 'c'
>>>>>>>&1 string c
>>>>>>>>>>>>&0 belong x - data length 0x%x
# Raw bitstream files
-0 long 0xffffffff
+0 long 0xffffffff
>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN)
#------------------------------------------------------------------------------
-# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $
+# $File: xwindows,v 1.10 2017/03/17 21:35:28 christos Exp $
# xwindows: file(1) magic for various X/Window system file formats.
-# Compiled X Keymap
+# Compiled X Keymap
# XKM (compiled X keymap) files (including version and byte ordering)
1 string mkx Compiled XKB Keymap: lsb,
>0 byte >0 version %d
#
-# $File: Makefile.am,v 1.121 2016/10/30 00:38:01 christos Exp $
+# $File: Makefile.am,v 1.124 2017/04/11 14:52:15 christos Exp $
#
MAGIC_FRAGMENT_BASE = Magdir
MAGIC_DIR = $(top_srcdir)/magic
$(MAGIC_FRAGMENT_DIR)/android \
$(MAGIC_FRAGMENT_DIR)/animation \
$(MAGIC_FRAGMENT_DIR)/aout \
+$(MAGIC_FRAGMENT_DIR)/apache \
$(MAGIC_FRAGMENT_DIR)/apl \
$(MAGIC_FRAGMENT_DIR)/apple \
$(MAGIC_FRAGMENT_DIR)/application \
$(MAGIC_FRAGMENT_DIR)/vxl \
$(MAGIC_FRAGMENT_DIR)/warc \
$(MAGIC_FRAGMENT_DIR)/weak \
+$(MAGIC_FRAGMENT_DIR)/webassembly \
$(MAGIC_FRAGMENT_DIR)/windows \
$(MAGIC_FRAGMENT_DIR)/wireless \
$(MAGIC_FRAGMENT_DIR)/wordprocessors \
"""
_close(self._magic_t)
+ @staticmethod
+ def __tostr(s):
+ if s is None:
+ return None
+ if isinstance(s, str):
+ return s
+ try: # keep Python 2 compatibility
+ return str(s, 'utf-8')
+ except TypeError:
+ return str(s)
+
+ @staticmethod
+ def __tobytes(b):
+ if b is None:
+ return None
+ if isinstance(b, bytes):
+ return b
+ try: # keep Python 2 compatibility
+ return bytes(b, 'utf-8')
+ except TypeError:
+ return bytes(b)
+
def file(self, filename):
"""
Returns a textual description of the contents of the argument passed
as a filename or None if an error occurred and the MAGIC_ERROR flag
- is set. A call to errno() will return the numeric error code.
+ is set. A call to errno() will return the numeric error code.
"""
- if isinstance(filename, bytes):
- bi = filename
- else:
- try: # keep Python 2 compatibility
- bi = bytes(filename, 'utf-8')
- except TypeError:
- bi = bytes(filename)
- r = _file(self._magic_t, bi)
- if isinstance(r, str):
- return r
- else:
- return str(r, 'utf-8')
+ return Magic.__tostr(_file(self._magic_t, Magic.__tobytes(filename)))
def descriptor(self, fd):
"""
- Like the file method, but the argument is a file descriptor.
+ Returns a textual description of the contents of the argument passed
+ as a file descriptor or None if an error occurred and the MAGIC_ERROR
+ flag is set. A call to errno() will return the numeric error code.
"""
- return _descriptor(self._magic_t, fd)
+ return Magic.__tostr(_descriptor(self._magic_t, fd))
def buffer(self, buf):
"""
as a buffer or None if an error occurred and the MAGIC_ERROR flag
is set. A call to errno() will return the numeric error code.
"""
- r = _buffer(self._magic_t, buf, len(buf))
- if isinstance(r, str):
- return r
- else:
- return str(r, 'utf-8')
+ return Magic.__tostr(_buffer(self._magic_t, buf, len(buf)))
def error(self):
"""
Returns a textual explanation of the last error or None
if there was no error.
"""
- e = _error(self._magic_t)
- if isinstance(e, str):
- return e
- else:
- return str(e, 'utf-8')
+ return Magic.__tostr(_error(self._magic_t))
def setflags(self, flags):
"""
Returns 0 on success and -1 on failure.
"""
- return _load(self._magic_t, filename)
+ return _load(self._magic_t, Magic.__tobytes(filename))
def compile(self, dbs):
"""
Compile entries in the colon separated list of database files
passed as argument or the default database file if no argument.
- Returns 0 on success and -1 on failure.
The compiled files created are named from the basename(1) of each file
argument with ".mgc" appended to it.
+
+ Returns 0 on success and -1 on failure.
"""
- return _compile(self._magic_t, dbs)
+ return _compile(self._magic_t, Magic.__tobytes(dbs))
def check(self, dbs):
"""
Check the validity of entries in the colon separated list of
database files passed as argument or the default database file
if no argument.
+
Returns 0 on success and -1 on failure.
"""
- return _check(self._magic_t, dbs)
+ return _check(self._magic_t, Magic.__tobytes(dbs))
def list(self, dbs):
"""
Check the validity of entries in the colon separated list of
database files passed as argument or the default database file
if no argument.
+
Returns 0 on success and -1 on failure.
"""
- return _list(self._magic_t, dbs)
+ return _list(self._magic_t, Magic.__tobytes(dbs))
def errno(self):
"""
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: apprentice.c,v 1.256 2016/11/07 15:36:56 christos Exp $")
+FILE_RCSID("@(#)$File: apprentice.c,v 1.260 2017/04/28 16:27:58 christos Exp $")
#endif /* lint */
#include "magic.h"
break;
case MAP_TYPE_MALLOC:
for (i = 0; i < MAGIC_SETS; i++) {
- if ((char *)map->magic[i] >= (char *)map->p &&
- (char *)map->magic[i] <= (char *)map->p + map->len)
+ void *b = map->magic[i];
+ void *p = map->p;
+ if (CAST(char *, b) >= CAST(char *, p) &&
+ CAST(char *, b) <= CAST(char *, p) + map->len)
continue;
free(map->magic[i]);
}
goto out;
}
while ((d = readdir(dir)) != NULL) {
+ if (d->d_name[0] == '.')
+ continue;
if (asprintf(&mfn, "%s/%s", fn, d->d_name) < 0) {
file_oomem(ms,
strlen(fn) + strlen(d->d_name) + 2);
ptr++;
if (*ptr == '.')
ptr++;
+ if (*ptr == '#')
+ ptr++;
#define CHECKLEN() do { \
for (len = cnt = 0; isdigit((unsigned char)*ptr); ptr++, cnt++) \
len = len * 10 + (*ptr - '0'); \
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.87 2017/02/01 12:38:12 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.106 2017/04/30 17:05:02 christos Exp $")
#endif
#include <assert.h>
CDF_TOLE8(CAST(uint64_t, x))))
#define CDF_GETUINT32(x, y) cdf_getuint32(x, y)
+#define CDF_MALLOC(n) cdf_malloc(__FILE__, __LINE__, (n))
+#define CDF_REALLOC(p, n) cdf_realloc(__FILE__, __LINE__, (p), (n))
+#define CDF_CALLOC(n, u) cdf_calloc(__FILE__, __LINE__, (n), (u))
+
+
+static void *
+cdf_malloc(const char *file __attribute__((__unused__)),
+ size_t line __attribute__((__unused__)), size_t n)
+{
+ DPRINTF(("%s,%zu: %s %zu\n", file, line, __func__, n));
+ return malloc(n);
+}
+
+static void *
+cdf_realloc(const char *file __attribute__((__unused__)),
+ size_t line __attribute__((__unused__)), void *p, size_t n)
+{
+ DPRINTF(("%s,%zu: %s %zu\n", file, line, __func__, n));
+ return realloc(p, n);
+}
+
+static void *
+cdf_calloc(const char *file __attribute__((__unused__)),
+ size_t line __attribute__((__unused__)), size_t n, size_t u)
+{
+ DPRINTF(("%s,%zu: %s %zu %zu\n", file, line, __func__, n, u));
+ return calloc(n, u);
+}
/*
* swap a short
cdf_unpack_header(h, buf);
cdf_swap_header(h);
if (h->h_magic != CDF_MAGIC) {
- DPRINTF(("Bad magic 0x%" INT64_T_FORMAT "x != 0x%"
+ DPRINTF(("Bad magic %#" INT64_T_FORMAT "x != %#"
INT64_T_FORMAT "x\n",
(unsigned long long)h->h_magic,
(unsigned long long)CDF_MAGIC));
goto out;
}
if (h->h_sec_size_p2 > 20) {
- DPRINTF(("Bad sector size 0x%u\n", h->h_sec_size_p2));
+ DPRINTF(("Bad sector size %hu\n", h->h_sec_size_p2));
goto out;
}
if (h->h_short_sec_size_p2 > 20) {
- DPRINTF(("Bad short sector size 0x%u\n",
+ DPRINTF(("Bad short sector size %hu\n",
h->h_short_sec_size_p2));
goto out;
}
if (h->h_master_sat[i] == CDF_SECID_FREE)
break;
-#define CDF_SEC_LIMIT (UINT32_MAX / (4 * ss))
+#define CDF_SEC_LIMIT (UINT32_MAX / (8 * ss))
if ((nsatpersec > 0 &&
h->h_num_sectors_in_master_sat > CDF_SEC_LIMIT / nsatpersec) ||
i > CDF_SEC_LIMIT) {
sat->sat_len = h->h_num_sectors_in_master_sat * nsatpersec + i;
DPRINTF(("sat_len = %" SIZE_T_FORMAT "u ss = %" SIZE_T_FORMAT "u\n",
sat->sat_len, ss));
- if ((sat->sat_tab = CAST(cdf_secid_t *, calloc(sat->sat_len, ss)))
+ if ((sat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(sat->sat_len, ss)))
== NULL)
return -1;
}
}
- if ((msa = CAST(cdf_secid_t *, calloc(1, ss))) == NULL)
+ if ((msa = CAST(cdf_secid_t *, CDF_CALLOC(1, ss))) == NULL)
goto out1;
mid = h->h_secid_first_sector_in_master_sat;
if (scn->sst_len == (size_t)-1)
goto out;
- scn->sst_tab = calloc(scn->sst_len, ss);
+ scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
if (scn->sst_tab == NULL)
return cdf_zero_stream(scn);
if (scn->sst_len == (size_t)-1)
goto out;
- scn->sst_tab = calloc(scn->sst_len, ss);
+ scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
if (scn->sst_tab == NULL)
return cdf_zero_stream(scn);
dir->dir_len = ns * nd;
dir->dir_tab = CAST(cdf_directory_t *,
- calloc(dir->dir_len, sizeof(dir->dir_tab[0])));
+ CDF_CALLOC(dir->dir_len, sizeof(dir->dir_tab[0])));
if (dir->dir_tab == NULL)
return -1;
- if ((buf = CAST(char *, malloc(ss))) == NULL) {
+ if ((buf = CAST(char *, CDF_MALLOC(ss))) == NULL) {
free(dir->dir_tab);
return -1;
}
if (ssat->sat_len == (size_t)-1)
goto out;
- ssat->sat_tab = CAST(cdf_secid_t *, calloc(ssat->sat_len, ss));
+ ssat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(ssat->sat_len, ss));
if (ssat->sat_tab == NULL)
goto out1;
== 0)
break;
if (i > 0)
- return i;
+ return CAST(int, i);
DPRINTF(("Cannot find type %d `%s'\n", type, name));
errno = ESRCH;
return 0;
}
+#define CDF_SHLEN_LIMIT (UINT32_MAX / 8)
+#define CDF_PROP_LIMIT (UINT32_MAX / (8 * sizeof(cdf_property_info_t)))
+
+static const void *
+cdf_offset(const void *p, size_t l)
+{
+ return CAST(const void *, CAST(const uint8_t *, p) + l);
+}
+
+static const uint8_t *
+cdf_get_property_info_pos(const cdf_stream_t *sst, const cdf_header_t *h,
+ const uint8_t *p, const uint8_t *e, size_t i)
+{
+ size_t tail = (i << 1) + 1;
+ size_t ofs;
+ const uint8_t *q;
+
+ if (p >= e) {
+ DPRINTF(("Past end %p < %p\n", e, p));
+ return NULL;
+ }
+ if (cdf_check_stream_offset(sst, h, p, (tail + 1) * sizeof(uint32_t),
+ __LINE__) == -1)
+ return NULL;
+ ofs = CDF_GETUINT32(p, tail);
+ q = CAST(const uint8_t *, cdf_offset(CAST(const void *, p),
+ ofs - 2 * sizeof(uint32_t)));
+
+ if (q < p) {
+ DPRINTF(("Wrapped around %p < %p\n", q, p));
+ return NULL;
+ }
+
+ if (q >= e) {
+ DPRINTF(("Ran off the end %p >= %p\n", q, e));
+ return NULL;
+ }
+ return q;
+}
+
+static cdf_property_info_t *
+cdf_grow_info(cdf_property_info_t **info, size_t *maxcount, size_t incr)
+{
+ cdf_property_info_t *inp;
+ size_t newcount = *maxcount + incr;
+
+ if (newcount > CDF_PROP_LIMIT) {
+ DPRINTF(("exceeded property limit %zu > %zu\n",
+ newcount, CDF_PROP_LIMIT));
+ goto out;
+ }
+ inp = CAST(cdf_property_info_t *,
+ CDF_REALLOC(*info, newcount * sizeof(*inp)));
+ if (inp == NULL)
+ goto out;
+
+ *info = inp;
+ *maxcount = newcount;
+ return inp;
+out:
+ free(*info);
+ *maxcount = 0;
+ *info = NULL;
+ return NULL;
+}
+
+static int
+cdf_copy_info(cdf_property_info_t *inp, const void *p, const void *e,
+ size_t len)
+{
+ if (inp->pi_type & CDF_VECTOR)
+ return 0;
+
+ if ((size_t)(CAST(const char *, e) - CAST(const char *, p)) < len)
+ return 0;
+
+ (void)memcpy(&inp->pi_val, p, len);
+
+ switch (len) {
+ case 2:
+ inp->pi_u16 = CDF_TOLE2(inp->pi_u16);
+ break;
+ case 4:
+ inp->pi_u32 = CDF_TOLE4(inp->pi_u32);
+ break;
+ case 8:
+ inp->pi_u64 = CDF_TOLE8(inp->pi_u64);
+ break;
+ default:
+ abort();
+ }
+ return 1;
+}
+
int
cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
uint32_t offs, cdf_property_info_t **info, size_t *count, size_t *maxcount)
const cdf_section_header_t *shp;
cdf_section_header_t sh;
const uint8_t *p, *q, *e;
- int16_t s16;
- int32_t s32;
- uint32_t u32;
- int64_t s64;
- uint64_t u64;
- cdf_timestamp_t tp;
- size_t i, o, o4, nelements, j;
+ size_t i, o4, nelements, j, slen, left;
cdf_property_info_t *inp;
if (offs > UINT32_MAX / 4) {
errno = EFTYPE;
goto out;
}
- shp = CAST(const cdf_section_header_t *, (const void *)
- ((const char *)sst->sst_tab + offs));
+ shp = CAST(const cdf_section_header_t *,
+ cdf_offset(sst->sst_tab, offs));
if (cdf_check_stream_offset(sst, h, shp, sizeof(*shp), __LINE__) == -1)
goto out;
sh.sh_len = CDF_TOLE4(shp->sh_len);
-#define CDF_SHLEN_LIMIT (UINT32_MAX / 8)
if (sh.sh_len > CDF_SHLEN_LIMIT) {
errno = EFTYPE;
goto out;
}
- sh.sh_properties = CDF_TOLE4(shp->sh_properties);
-#define CDF_PROP_LIMIT (UINT32_MAX / (4 * sizeof(*inp)))
- if (sh.sh_properties > CDF_PROP_LIMIT)
+
+ if (cdf_check_stream_offset(sst, h, shp, sh.sh_len, __LINE__) == -1)
goto out;
+
+ sh.sh_properties = CDF_TOLE4(shp->sh_properties);
DPRINTF(("section len: %u properties %u\n", sh.sh_len,
sh.sh_properties));
- if (*maxcount) {
- if (*maxcount > CDF_PROP_LIMIT)
- goto out;
- *maxcount += sh.sh_properties;
- inp = CAST(cdf_property_info_t *,
- realloc(*info, *maxcount * sizeof(*inp)));
- } else {
- *maxcount = sh.sh_properties;
- inp = CAST(cdf_property_info_t *,
- malloc(*maxcount * sizeof(*inp)));
- }
+ if (sh.sh_properties > CDF_PROP_LIMIT)
+ goto out;
+ inp = cdf_grow_info(info, maxcount, sh.sh_properties);
if (inp == NULL)
- goto out1;
- *info = inp;
+ goto out;
inp += *count;
*count += sh.sh_properties;
- p = CAST(const uint8_t *, (const void *)
- ((const char *)(const void *)sst->sst_tab +
- offs + sizeof(sh)));
- e = CAST(const uint8_t *, (const void *)
- (((const char *)(const void *)shp) + sh.sh_len));
- if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
+ p = CAST(const uint8_t *, cdf_offset(sst->sst_tab, offs + sizeof(sh)));
+ e = CAST(const uint8_t *, cdf_offset(shp, sh.sh_len));
+ if (p >= e || cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
goto out;
+
for (i = 0; i < sh.sh_properties; i++) {
- size_t tail = (i << 1) + 1;
- size_t ofs;
- if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
- __LINE__) == -1)
- goto out;
- ofs = CDF_GETUINT32(p, tail);
- q = (const uint8_t *)(const void *)
- ((const char *)(const void *)p + ofs
- - 2 * sizeof(uint32_t));
- if (q < p) {
- DPRINTF(("Wrapped around %p < %p\n", q, p));
+ if ((q = cdf_get_property_info_pos(sst, h, p, e, i)) == NULL)
goto out;
- }
- if (q >= e) {
- DPRINTF(("Ran of the end %p >= %p\n", q, e));
+ inp[i].pi_id = CDF_GETUINT32(p, i << 1);
+ left = CAST(size_t, e - q);
+ if (left < sizeof(uint32_t)) {
+ DPRINTF(("short info (no type)_\n"));
goto out;
}
- inp[i].pi_id = CDF_GETUINT32(p, i << 1);
inp[i].pi_type = CDF_GETUINT32(q, 0);
- DPRINTF(("%" SIZE_T_FORMAT "u) id=%x type=%x offs=0x%tx,0x%x\n",
+ DPRINTF(("%" SIZE_T_FORMAT "u) id=%#x type=%#x offs=%#tx,%#x\n",
i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
if (inp[i].pi_type & CDF_VECTOR) {
+ if (left < sizeof(uint32_t) * 2) {
+ DPRINTF(("missing CDF_VECTOR length\n"));
+ goto out;
+ }
nelements = CDF_GETUINT32(q, 1);
if (nelements == 0) {
DPRINTF(("CDF_VECTOR with nelements == 0\n"));
goto out;
}
- o = 2;
+ slen = 2;
} else {
nelements = 1;
- o = 1;
+ slen = 1;
}
- o4 = o * sizeof(uint32_t);
+ o4 = slen * sizeof(uint32_t);
if (inp[i].pi_type & (CDF_ARRAY|CDF_BYREF|CDF_RESERVED))
goto unknown;
switch (inp[i].pi_type & CDF_TYPEMASK) {
case CDF_EMPTY:
break;
case CDF_SIGNED16:
- if (inp[i].pi_type & CDF_VECTOR)
+ if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int16_t)))
goto unknown;
- (void)memcpy(&s16, &q[o4], sizeof(s16));
- inp[i].pi_s16 = CDF_TOLE2(s16);
break;
case CDF_SIGNED32:
- if (inp[i].pi_type & CDF_VECTOR)
- goto unknown;
- (void)memcpy(&s32, &q[o4], sizeof(s32));
- inp[i].pi_s32 = CDF_TOLE4((uint32_t)s32);
- break;
case CDF_BOOL:
case CDF_UNSIGNED32:
- if (inp[i].pi_type & CDF_VECTOR)
+ case CDF_FLOAT:
+ if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int32_t)))
goto unknown;
- (void)memcpy(&u32, &q[o4], sizeof(u32));
- inp[i].pi_u32 = CDF_TOLE4(u32);
break;
case CDF_SIGNED64:
- if (inp[i].pi_type & CDF_VECTOR)
- goto unknown;
- (void)memcpy(&s64, &q[o4], sizeof(s64));
- inp[i].pi_s64 = CDF_TOLE8((uint64_t)s64);
- break;
case CDF_UNSIGNED64:
- if (inp[i].pi_type & CDF_VECTOR)
- goto unknown;
- (void)memcpy(&u64, &q[o4], sizeof(u64));
- inp[i].pi_u64 = CDF_TOLE8((uint64_t)u64);
- break;
- case CDF_FLOAT:
- if (inp[i].pi_type & CDF_VECTOR)
- goto unknown;
- (void)memcpy(&u32, &q[o4], sizeof(u32));
- u32 = CDF_TOLE4(u32);
- memcpy(&inp[i].pi_f, &u32, sizeof(inp[i].pi_f));
- break;
case CDF_DOUBLE:
- if (inp[i].pi_type & CDF_VECTOR)
+ case CDF_FILETIME:
+ if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int64_t)))
goto unknown;
- (void)memcpy(&u64, &q[o4], sizeof(u64));
- u64 = CDF_TOLE8((uint64_t)u64);
- memcpy(&inp[i].pi_d, &u64, sizeof(inp[i].pi_d));
break;
case CDF_LENGTH32_STRING:
case CDF_LENGTH32_WSTRING:
if (nelements > 1) {
size_t nelem = inp - *info;
- if (*maxcount > CDF_PROP_LIMIT
- || nelements > CDF_PROP_LIMIT)
- goto out;
- *maxcount += nelements;
- inp = CAST(cdf_property_info_t *,
- realloc(*info, *maxcount * sizeof(*inp)));
+ inp = cdf_grow_info(info, maxcount, nelements);
if (inp == NULL)
- goto out1;
- *info = inp;
- inp = *info + nelem;
+ goto out;
+ inp += nelem;
}
DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
nelements));
for (j = 0; j < nelements && i < sh.sh_properties;
j++, i++)
{
- uint32_t l = CDF_GETUINT32(q, o);
+ uint32_t l;
+
+ if (o4 + sizeof(uint32_t) > left)
+ goto out;
+
+ l = CDF_GETUINT32(q, slen);
+ o4 += sizeof(uint32_t);
+ if (o4 + l > left)
+ goto out;
+
inp[i].pi_str.s_len = l;
- inp[i].pi_str.s_buf = (const char *)
- (const void *)(&q[o4 + sizeof(l)]);
- DPRINTF(("l = %d, r = %" SIZE_T_FORMAT
- "u, s = %s\n", l,
- CDF_ROUND(l, sizeof(l)),
+ inp[i].pi_str.s_buf = CAST(const char *,
+ CAST(const void *, &q[o4]));
+
+ DPRINTF(("o=%zu l=%d(%" SIZE_T_FORMAT
+ "u), t=%zu s=%s\n", o4, l,
+ CDF_ROUND(l, sizeof(l)), left,
inp[i].pi_str.s_buf));
+
if (l & 1)
l++;
- o += l >> 1;
- if (q + o >= e)
- goto out;
- o4 = o * sizeof(uint32_t);
+
+ slen += l >> 1;
+ o4 = slen * sizeof(uint32_t);
}
i--;
break;
- case CDF_FILETIME:
- if (inp[i].pi_type & CDF_VECTOR)
- goto unknown;
- (void)memcpy(&tp, &q[o4], sizeof(tp));
- inp[i].pi_tp = CDF_TOLE8((uint64_t)tp);
- break;
case CDF_CLIPBOARD:
if (inp[i].pi_type & CDF_VECTOR)
goto unknown;
break;
default:
unknown:
- DPRINTF(("Don't know how to deal with %x\n",
+ memset(&inp[i].pi_val, 0, sizeof(inp[i].pi_val));
+ DPRINTF(("Don't know how to deal with %#x\n",
inp[i].pi_type));
break;
}
}
return 0;
out:
- errno = EFTYPE;
-out1:
free(*info);
+ *info = NULL;
+ *count = 0;
+ *maxcount = 0;
+ errno = EFTYPE;
return -1;
}
{
size_t ss = cdf_check_stream(sst, h);
const char *b = CAST(const char *, sst->sst_tab);
- const char *eb = b + ss * sst->sst_len;
+ const char *nb, *eb = b + ss * sst->sst_len;
size_t nr, i, j, k;
cdf_catalog_entry_t *ce;
uint16_t reclen;
return -1;
nr--;
*cat = CAST(cdf_catalog_t *,
- malloc(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
+ CDF_MALLOC(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
if (*cat == NULL)
return -1;
ce = (*cat)->cat_e;
cep->ce_namlen = rlen;
np = CAST(const uint16_t *, CAST(const void *, (b + 16)));
- if (RCAST(const char *, np + cep->ce_namlen) > eb) {
+ nb = CAST(const char *, CAST(const void *,
+ (np + cep->ce_namlen)));
+ if (nb > eb) {
cep->ce_namlen = 0;
break;
}
for (i = 0; i < __arraycount(vn); i++)
if (vn[i].v == p)
return snprintf(buf, bufsiz, "%s", vn[i].n);
- return snprintf(buf, bufsiz, "0x%x", p);
+ return snprintf(buf, bufsiz, "%#x", p);
}
int
h->h_ ## b, 1 << h->h_ ## b)
DUMP("%d", revision);
DUMP("%d", version);
- DUMP("0x%x", byte_order);
+ DUMP("%#x", byte_order);
DUMP2("%d", sec_size_p2);
DUMP2("%d", short_sec_size_p2);
DUMP("%d", num_sectors_in_sat);
d->d_color ? "black" : "red");
(void)fprintf(stderr, "Left child: %d\n", d->d_left_child);
(void)fprintf(stderr, "Right child: %d\n", d->d_right_child);
- (void)fprintf(stderr, "Flags: 0x%x\n", d->d_flags);
+ (void)fprintf(stderr, "Flags: %#x\n", d->d_flags);
cdf_timestamp_to_timespec(&ts, d->d_created);
(void)fprintf(stderr, "Created %s", cdf_ctime(&ts.tv_sec, buf));
cdf_timestamp_to_timespec(&ts, d->d_modified);
(void)fprintf(stderr, "CLIPBOARD %u\n", info[i].pi_u32);
break;
default:
- DPRINTF(("Don't know how to deal with %x\n",
+ DPRINTF(("Don't know how to deal with %#x\n",
info[i].pi_type));
break;
}
(void)&h;
if (cdf_unpack_summary_info(sst, h, &ssi, &info, &count) == -1)
return;
- (void)fprintf(stderr, "Endian: %x\n", ssi.si_byte_order);
+ (void)fprintf(stderr, "Endian: %#x\n", ssi.si_byte_order);
(void)fprintf(stderr, "Os Version %d.%d\n", ssi.si_os_version & 0xff,
ssi.si_os_version >> 8);
(void)fprintf(stderr, "Os %d\n", ssi.si_os);
typedef struct {
void *sst_tab;
- size_t sst_len;
- size_t sst_dirlen;
- size_t sst_ss;
+ size_t sst_len; /* Number of sectors */
+ size_t sst_dirlen; /* Directory sector size */
+ size_t sst_ss; /* Sector size */
} cdf_stream_t;
typedef struct {
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: cdf_time.c,v 1.14 2014/04/17 12:44:01 christos Exp $")
+FILE_RCSID("@(#)$File: cdf_time.c,v 1.16 2017/03/29 15:57:48 christos Exp $")
#endif
#include <time.h>
char *ptr = ctime_r(sec, buf);
if (ptr != NULL)
return buf;
- (void)snprintf(buf, 26, "*Bad* 0x%16.16" INT64_T_FORMAT "x\n",
+ (void)snprintf(buf, 26, "*Bad* %#16.16" INT64_T_FORMAT "x\n",
(long long)*sec);
return buf;
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: compress.c,v 1.100 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: compress.c,v 1.104 2017/03/29 15:57:48 christos Exp $")
#endif
#include "magic.h"
zlibcmp(const unsigned char *buf)
{
unsigned short x = 1;
- unsigned char *s = (unsigned char *)&x;
+ unsigned char *s = CAST(unsigned char *, CAST(void *, &x));
if ((buf[0] & 0xf) != 8 || (buf[0] & 0x80) != 0)
return 0;
z.next_in = CCAST(Bytef *, old);
z.avail_in = CAST(uint32_t, *n);
z.next_out = *newch;
- z.avail_out = bytes_max;
+ z.avail_out = CAST(unsigned int, bytes_max);
z.zalloc = Z_NULL;
z.zfree = Z_NULL;
z.opaque = Z_NULL;
while (isspace((unsigned char)*p))
p++;
n = strlen(p);
- memmove(ubuf, p, n + 1);
+ memmove(ubuf, p, CAST(size_t, n + 1));
}
DPRINTF("Filter error after[[[%s]]]\n", (char *)ubuf);
if (islower(*ubuf))
}
for (i = 0; i < __arraycount(fdp); i++)
- copydesc(i, fdp[i]);
+ copydesc(CAST(int, i), fdp[i]);
(void)execvp(compr[method].argv[0],
(char *const *)(intptr_t)compr[method].argv);
rv = makeerror(newch, n, "Wait failed, %s", strerror(errno));
DPRINTF("Child wait return %#x\n", status);
} else if (!WIFEXITED(status)) {
- DPRINTF("Child not exited (0x%x)\n", status);
+ DPRINTF("Child not exited (%#x)\n", status);
} else if (WEXITSTATUS(status) != 0) {
- DPRINTF("Child exited (0x%d)\n", WEXITSTATUS(status));
+ DPRINTF("Child exited (%#u)\n", WEXITSTATUS(status));
}
closefd(fdp[STDIN_FILENO], 0);
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: der.c,v 1.10 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: der.c,v 1.11 2016/11/07 15:51:23 christos Exp $")
#endif
#endif
if (*p + len >= l)
return DER_BAD;
- return len;
+ return CAST(uint32_t, len);
}
static const char *
#endif
if (m->cont_level != 0) {
if (offs + tlen > nbytes)
- return DER_BAD;
- ms->c.li[m->cont_level - 1].off = offs + tlen;
+ return -1;
+ ms->c.li[m->cont_level - 1].off = CAST(int, offs + tlen);
DPRINTF(("cont_level[%u] = %u\n", m->cont_level - 1,
ms->c.li[m->cont_level - 1].off));
}
- return offs;
+ return CAST(int32_t, offs);
}
int
*/
/*
* file.h - definitions for file(1) program
- * @(#)$File: file.h,v 1.179 2016/07/05 19:20:19 christos Exp $
+ * @(#)$File: file.h,v 1.182 2017/04/07 19:46:44 christos Exp $
*/
#ifndef __file_h__
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#ifdef HAVE_STDINT_H
+#ifndef __STDC_LIMIT_MACROS
+#define __STDC_LIMIT_MACROS
+#endif
#ifdef WIN32
#ifdef _WIN64
#define INT64_T_FORMAT "ll"
#define INTMAX_T_FORMAT "j"
#endif
+#include <stdint.h>
+#endif
#include <stdio.h> /* Include that here, to make sure __P gets defined */
#include <errno.h>
#include <fcntl.h> /* For open and flags */
-#ifdef HAVE_STDINT_H
-#ifndef __STDC_LIMIT_MACROS
-#define __STDC_LIMIT_MACROS
-#endif
-#include <stdint.h>
-#endif
#ifdef HAVE_INTTYPES_H
#include <inttypes.h>
#endif
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: funcs.c,v 1.90 2016/10/19 20:51:17 christos Exp $")
+FILE_RCSID("@(#)$File: funcs.c,v 1.92 2017/04/07 20:10:24 christos Exp $")
#endif /* lint */
#include "magic.h"
regmatch_t* pmatch, int eflags)
{
assert(rx->rc == 0);
+ /* XXX: force initialization because glibc does not always do this */
+ memset(pmatch, 0, nmatch * sizeof(*pmatch));
return regexec(&rx->rx, str, nmatch, pmatch, eflags);
}
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: is_tar.c,v 1.37 2010/11/30 14:58:53 rrt Exp $")
+FILE_RCSID("@(#)$File: is_tar.c,v 1.39 2017/03/17 20:45:01 christos Exp $")
#endif
#include "magic.h"
#define isodigit(c) ( ((c) >= '0') && ((c) <= '7') )
private int is_tar(const unsigned char *, size_t);
-private int from_oct(int, const char *); /* Decode octal number */
+private int from_oct(const char *, size_t); /* Decode octal number */
static const char tartype[][32] = {
"tar archive",
is_tar(const unsigned char *buf, size_t nbytes)
{
const union record *header = (const union record *)(const void *)buf;
- int i;
- int sum, recsum;
- const unsigned char *p;
+ size_t i;
+ int sum, recsum;
+ const unsigned char *p, *ep;
- if (nbytes < sizeof(union record))
+ if (nbytes < sizeof(*header))
return 0;
- recsum = from_oct(8, header->header.chksum);
+ recsum = from_oct(header->header.chksum, sizeof(header->header.chksum));
sum = 0;
p = header->charptr;
- for (i = sizeof(union record); --i >= 0;)
+ ep = header->charptr + sizeof(*header);
+ while (p < ep)
sum += *p++;
/* Adjust checksum to count the "chksum" field as blanks. */
- for (i = sizeof(header->header.chksum); --i >= 0;)
+ for (i = 0; i < sizeof(header->header.chksum); i++)
sum -= header->header.chksum[i];
- sum += ' ' * sizeof header->header.chksum;
+ sum += ' ' * sizeof(header->header.chksum);
if (sum != recsum)
return 0; /* Not a tar archive */
- if (strcmp(header->header.magic, GNUTMAGIC) == 0)
+ if (strncmp(header->header.magic, GNUTMAGIC,
+ sizeof(header->header.magic)) == 0)
return 3; /* GNU Unix Standard tar archive */
- if (strcmp(header->header.magic, TMAGIC) == 0)
+
+ if (strncmp(header->header.magic, TMAGIC,
+ sizeof(header->header.magic)) == 0)
return 2; /* Unix Standard tar archive */
return 1; /* Old fashioned tar archive */
* Result is -1 if the field is invalid (all blank, or non-octal).
*/
private int
-from_oct(int digs, const char *where)
+from_oct(const char *where, size_t digs)
{
int value;
+ if (digs == 0)
+ return -1;
+
while (isspace((unsigned char)*where)) { /* Skip spaces */
where++;
- if (--digs <= 0)
+ if (digs-- == 0)
return -1; /* All blank field */
}
value = 0;
while (digs > 0 && isodigit(*where)) { /* Scan til non-octal */
value = (value << 3) | (*where++ - '0');
- --digs;
+ digs--;
}
if (digs > 0 && *where && !isspace((unsigned char)*where))
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: print.c,v 1.80 2015/07/16 14:28:57 christos Exp $")
+FILE_RCSID("@(#)$File: print.c,v 1.81 2016/01/19 15:09:03 christos Exp $")
#endif /* lint */
#include <string.h>
if (flags & FILE_T_WINDOWS) {
struct timespec ts;
- cdf_timestamp_to_timespec(&ts, v);
+ cdf_timestamp_to_timespec(&ts, CAST(cdf_timestamp_t, v));
t = ts.tv_sec;
} else {
// XXX: perhaps detect and print something if overflow
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: readcdf.c,v 1.62 2016/10/18 16:10:07 christos Exp $")
+FILE_RCSID("@(#)$File: readcdf.c,v 1.65 2017/04/08 20:58:03 christos Exp $")
#endif
#include <assert.h>
struct timespec ts;
char buf[64];
const char *str = NULL;
- const char *s;
+ const char *s, *e;
int len;
if (!NOTMIME(ms) && root_storage)
if (info[i].pi_type == CDF_LENGTH32_WSTRING)
k++;
s = info[i].pi_str.s_buf;
- for (j = 0; j < sizeof(vbuf) && len--; s += k) {
+ e = info[i].pi_str.s_buf + len;
+ for (j = 0; s < e && j < sizeof(vbuf)
+ && len--; s += k) {
if (*s == '\0')
break;
if (isprint((unsigned char)*s))
if ((i = cdf_read_user_stream(&info, &h, &sat, &ssat, &sst, &dir,
"FileHeader", &scn)) != -1) {
#define HWP5_SIGNATURE "HWP Document File"
- if (scn.sst_dirlen >= sizeof(HWP5_SIGNATURE) - 1
+ if (scn.sst_len * scn.sst_ss >= sizeof(HWP5_SIGNATURE) - 1
&& memcmp(scn.sst_tab, HWP5_SIGNATURE,
sizeof(HWP5_SIGNATURE) - 1) == 0) {
if (NOTMIME(ms)) {
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.129 2017/01/18 16:08:25 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.136 2017/03/29 19:09:52 christos Exp $")
#endif
#ifdef BUILTIN_ELF
"NetBSD",
};
-#define FLAGS_DID_CORE 0x001
-#define FLAGS_DID_OS_NOTE 0x002
-#define FLAGS_DID_BUILD_ID 0x004
-#define FLAGS_DID_CORE_STYLE 0x008
-#define FLAGS_DID_NETBSD_PAX 0x010
-#define FLAGS_DID_NETBSD_MARCH 0x020
-#define FLAGS_DID_NETBSD_CMODEL 0x040
-#define FLAGS_DID_NETBSD_UNKNOWN 0x080
-#define FLAGS_IS_CORE 0x100
-#define FLAGS_DID_AUXV 0x200
+#define FLAGS_CORE_STYLE 0x003
+
+#define FLAGS_DID_CORE 0x004
+#define FLAGS_DID_OS_NOTE 0x008
+#define FLAGS_DID_BUILD_ID 0x010
+#define FLAGS_DID_CORE_STYLE 0x020
+#define FLAGS_DID_NETBSD_PAX 0x040
+#define FLAGS_DID_NETBSD_MARCH 0x080
+#define FLAGS_DID_NETBSD_CMODEL 0x100
+#define FLAGS_DID_NETBSD_UNKNOWN 0x200
+#define FLAGS_IS_CORE 0x400
+#define FLAGS_DID_AUXV 0x800
private int
dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
== -1)
return 1;
*flags |= FLAGS_DID_CORE_STYLE;
+ *flags |= os_style;
}
switch (os_style) {
case OS_STYLE_NETBSD:
if (type == NT_NETBSD_CORE_PROCINFO) {
char sbuf[512];
- uint32_t signo;
- /*
- * Extract the program name. It is at
- * offset 0x7c, and is up to 32-bytes,
- * including the terminating NUL.
- */
- if (file_printf(ms, ", from '%.31s'",
+ struct NetBSD_elfcore_procinfo pi;
+ memset(&pi, 0, sizeof(pi));
+ memcpy(&pi, nbuf + doff, descsz);
+
+ if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, "
+ "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",
file_printable(sbuf, sizeof(sbuf),
- (const char *)&nbuf[doff + 0x7c])) == -1)
- return 1;
-
- /*
- * Extract the signal number. It is at
- * offset 0x08.
- */
- (void)memcpy(&signo, &nbuf[doff + 0x08],
- sizeof(signo));
- if (file_printf(ms, " (signal %u)",
- elf_getu32(swap, signo)) == -1)
+ CAST(char *, pi.cpi_name)),
+ elf_getu32(swap, pi.cpi_pid),
+ elf_getu32(swap, pi.cpi_euid),
+ elf_getu32(swap, pi.cpi_egid),
+ elf_getu32(swap, pi.cpi_nlwps),
+ elf_getu32(swap, pi.cpi_siglwp),
+ elf_getu32(swap, pi.cpi_signo),
+ elf_getu32(swap, pi.cpi_sigcode)) == -1)
return 1;
+
*flags |= FLAGS_DID_CORE;
return 1;
}
offset = get_offset_from_virtaddr(ms, swap, clazz, fd, ph_off, ph_num,
fsize, virtaddr);
- if ((buflen = pread(fd, buf, buflen, offset)) <= 0) {
+ if ((buflen = pread(fd, buf, CAST(size_t, buflen), offset)) <= 0) {
file_badread(ms);
return 0;
}
int is_string;
size_t nval;
- if (type != NT_AUXV || (*flags & FLAGS_IS_CORE) == 0)
+ if ((*flags & (FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE)) !=
+ (FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE))
return 0;
+ switch (*flags & FLAGS_CORE_STYLE) {
+ case OS_STYLE_SVR4:
+ if (type != NT_AUXV)
+ return 0;
+ break;
+#ifdef notyet
+ case OS_STYLE_NETBSD:
+ if (type != NT_NETBSD_CORE_AUXV)
+ return 0;
+ break;
+ case OS_STYLE_FREEBSD:
+ if (type != NT_FREEBSD_PROCSTAT_AUXV)
+ return 0;
+ break;
+#endif
+ default:
+ return 0;
+ }
+
*flags |= FLAGS_DID_AUXV;
nval = 0;
}
if (namesz & 0x80000000) {
- (void)file_printf(ms, ", bad note name size 0x%lx",
+ (void)file_printf(ms, ", bad note name size %#lx",
(unsigned long)namesz);
return 0;
}
if (descsz & 0x80000000) {
- (void)file_printf(ms, ", bad note description size 0x%lx",
+ (void)file_printf(ms, ", bad note description size %#lx",
(unsigned long)descsz);
return 0;
}
{
Elf32_Shdr sh32;
Elf64_Shdr sh64;
- int stripped = 1, has_debug_info = 1;
+ int stripped = 1, has_debug_info = 0;
size_t nbadcap = 0;
void *nbuf;
off_t noff, coff, name_off;
if ((uintmax_t)(xsh_size + xsh_offset) >
(uintmax_t)fsize) {
if (file_printf(ms,
- ", note offset/size 0x%" INTMAX_T_FORMAT
- "x+0x%" INTMAX_T_FORMAT "x exceeds"
- " file size 0x%" INTMAX_T_FORMAT "x",
+ ", note offset/size %#" INTMAX_T_FORMAT
+ "x+%#" INTMAX_T_FORMAT "x exceeds"
+ " file size %#" INTMAX_T_FORMAT "x",
(uintmax_t)xsh_offset, (uintmax_t)xsh_size,
(uintmax_t)fsize) == -1)
return -1;
default:
if (file_printf(ms,
", with unknown capability "
- "0x%" INT64_T_FORMAT "x = 0x%"
+ "%#" INT64_T_FORMAT "x = %#"
INT64_T_FORMAT "x",
(unsigned long long)xcap_tag,
(unsigned long long)xcap_val) == -1)
}
}
- if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
- return -1;
if (has_debug_info) {
if (file_printf(ms, ", with debug_info") == -1)
return -1;
}
+ if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
+ return -1;
if (cap_hw1) {
const cap_desc_t *cdp;
switch (mach) {
}
if (cap_hw1)
if (file_printf(ms,
- " unknown hardware capability 0x%"
+ " unknown hardware capability %#"
INT64_T_FORMAT "x",
(unsigned long long)cap_hw1) == -1)
return -1;
} else {
if (file_printf(ms,
- " hardware capability 0x%" INT64_T_FORMAT "x",
+ " hardware capability %#" INT64_T_FORMAT "x",
(unsigned long long)cap_hw1) == -1)
return -1;
}
cap_sf1 &= ~SF1_SUNW_MASK;
if (cap_sf1)
if (file_printf(ms,
- ", with unknown software capability 0x%"
+ ", with unknown software capability %#"
INT64_T_FORMAT "x",
(unsigned long long)cap_sf1) == -1)
return -1;
if (((align = xph_align) & 0x80000000UL) != 0 ||
align < 4) {
if (file_printf(ms,
- ", invalid note alignment 0x%lx",
+ ", invalid note alignment %#lx",
(unsigned long)align) == -1)
return -1;
align = 4;
} Elf64_Shdr;
#define NT_NETBSD_CORE_PROCINFO 1
+#define NT_NETBSD_CORE_AUXV 2
+
+struct NetBSD_elfcore_procinfo {
+ /* Version 1 fields start here. */
+ uint32_t cpi_version; /* our version */
+ uint32_t cpi_cpisize; /* sizeof(this struct) */
+ uint32_t cpi_signo; /* killing signal */
+ uint32_t cpi_sigcode; /* signal code */
+ uint32_t cpi_sigpend[4]; /* pending signals */
+ uint32_t cpi_sigmask[4]; /* blocked signals */
+ uint32_t cpi_sigignore[4]; /* ignored signals */
+ uint32_t cpi_sigcatch[4]; /* caught signals */
+ int32_t cpi_pid; /* process ID */
+ int32_t cpi_ppid; /* parent process ID */
+ int32_t cpi_pgrp; /* process group ID */
+ int32_t cpi_sid; /* session ID */
+ uint32_t cpi_ruid; /* real user ID */
+ uint32_t cpi_euid; /* effective user ID */
+ uint32_t cpi_svuid; /* saved user ID */
+ uint32_t cpi_rgid; /* real group ID */
+ uint32_t cpi_egid; /* effective group ID */
+ uint32_t cpi_svgid; /* saved group ID */
+ uint32_t cpi_nlwps; /* number of LWPs */
+ int8_t cpi_name[32]; /* copy of p->p_comm */
+ /* Add version 2 fields below here. */
+ int32_t cpi_siglwp; /* LWP target of killing signal */
+};
/* Note header in a PT_NOTE section */
typedef struct elf_note {
*/
#define NT_NETBSD_CMODEL 6
+/*
+ * FreeBSD specific notes
+ */
+#define NT_FREEBSD_PROCSTAT_AUXV 16
+
#if !defined(ELFSIZE) && defined(ARCH_ELFSIZE)
#define ELFSIZE ARCH_ELFSIZE
#endif
#include "file.h"
#ifndef lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.242 2016/12/20 22:44:32 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.248 2017/04/21 16:54:57 christos Exp $")
#endif /* lint */
#include "magic.h"
while (magindex < nmagic - 1 &&
magic[magindex + 1].cont_level != 0)
magindex++;
+ cont_level = 0;
continue; /* Skip to next top-level test*/
}
case -1:
case 0:
flush = 1;
+ cont_level--;
break;
default:
break;
mconvert(struct magic_set *ms, struct magic *m, int flip)
{
union VALUETYPE *p = &ms->ms_value;
- uint8_t type;
- switch (type = cvt_flip(m->type, flip)) {
+ switch (cvt_flip(m->type, flip)) {
case FILE_BYTE:
if (cvt_8(p, m) == -1)
goto out;
case FILE_DER:
case FILE_SEARCH:
if (offset > nbytes)
- offset = nbytes;
+ offset = CAST(uint32_t, nbytes);
ms->search.s = RCAST(const char *, s) + offset;
ms->search.s_len = nbytes - offset;
ms->search.offset = offset;
return -1;
if ((ms->flags & MAGIC_DEBUG) != 0) {
- fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%"
+ fprintf(stderr, "mget(type=%d, flag=%#x, offset=%u, o=%"
SIZE_T_FORMAT "u, " "nbytes=%" SIZE_T_FORMAT
"u, il=%hu, nc=%hu)\n",
m->type, m->flag, offset, o, nbytes,
*/
const unsigned char *a = (const unsigned char *)s1;
const unsigned char *b = (const unsigned char *)s2;
+ const unsigned char *eb = b + len;
uint64_t v;
/*
}
else { /* combine the others */
while (len-- > 0) {
+ if (b >= eb) {
+ v = 1;
+ break;
+ }
if ((flags & STRING_IGNORE_LOWERCASE) &&
islower(*a)) {
if ((v = tolower(*b++) - *a++) != '\0')
a++;
if (isspace(*b++)) {
if (!isspace(*a))
- while (isspace(*b))
+ while (b < eb && isspace(*b))
b++;
}
else {
else if ((flags & STRING_COMPACT_OPTIONAL_WHITESPACE) &&
isspace(*a)) {
a++;
- while (isspace(*b))
+ while (b < eb && isspace(*b))
b++;
}
else {
v = 0;
for (idx = 0; m->str_range == 0 || idx < m->str_range; idx++) {
- if (slen + idx >= ms->search.s_len)
+ if (slen + idx > ms->search.s_len)
return 0;
v = file_strncmp(m->value.s, ms->search.s + idx, slen,
check_PROGRAMS = test
test_LDADD = $(top_builddir)/src/libmagic.la
-test_CPPFLAGS = -I$(top_srcdir)/src
+test_CPPFLAGS = -I$(top_builddir)/src
EXTRA_DIST = \
escapevel.result \
projects / platform / upstream / file.git / commitdiff