- permit scriptlet includes from builddir for spec files w/o %setup.
- upgrade to zlib-1.2.2.4 internal.
- macosx: avoid minigzip build failures.
+ - upgrade to file-4.14 internal.
4.4 -> 4.4.1:
- force *.py->*.pyo byte code compilation with brp-python-bytecompile.
+
+2005-06-25 11:48 Christos Zoulas <christos@zoulas.com>
+
+ * Dynamically allocate the string buffers and make the
+ default read size 256K.
+
+2005-06-01 00:00 Joerg Sonnenberger <joerg@britannica.bec.de>
+
+ * Dragonfly ELF note support
+
+2005-03-14 00:00 Giuliano Bertoletti <gb@symbolic.it>
+
+ * Avoid NULL pointer dereference in time conversion.
+
+2005-03-06 00:00 Joerg Walter <jwalt@mail.garni.ch>
+
+ * Add indirect magic offset support, and search mode.
+
+2005-01-12 00:00 Stepan Kasal <kasal@ucw.cz>
+
+ * src/ascmagic.c (file_ascmagic): Fix three bugs about text files:
+ If a CRLF text file happens to have CR at offset HOWMANY - 1
+ (currently 0xffff), it should not be counted as CR line
+ terminator.
+ If a line has length exactly MAXLINELEN, it should not yet be
+ treated as a ``very long line'', as MAXLINELEN is ``longest sane
+ line length''.
+ With CRLF, the line length was not computed correctly, and even
+ lines of length MAXLINELEN - 1 were treated as ``very long''.
+
+2004-12-07 14:15 Christos Zoulas <christos@zoulas.com>
+
+ * bzip2 needs a lot of input buffer space on some files
+ before it can begin uncompressing. This makes file -z
+ fail on some bz2 files. Fix it by giving it a copy of
+ the file descriptor to read as much as it wants if we
+ have access to it. <christos@zoulas.com>
+
2004-11-24 12:39 Christos Zoulas <christos@zoulas.com>
* Stack smash fix, and ELF more conservative reading.
+++ /dev/null
-dnl cloned from autoconf 2.13 acspecific.m4
-AC_DEFUN([AC_C_LONG_LONG],
-[AC_CACHE_CHECK(for long long, ac_cv_c_long_long,
-[if test "$GCC" = yes; then
- ac_cv_c_long_long=yes
-else
-AC_TRY_RUN([int main() {
-long long foo = 0;
-exit(sizeof(long long) < sizeof(long)); }],
-ac_cv_c_long_long=yes, ac_cv_c_long_long=no)
-fi])
-if test $ac_cv_c_long_long = yes; then
- AC_DEFINE(HAVE_LONG_LONG)
-fi
-])
-
-dnl from autoconf 2.13 acspecific.m4, with changes to check for daylight
-
-AC_DEFUN([AC_STRUCT_TIMEZONE_DAYLIGHT],
-[AC_REQUIRE([AC_STRUCT_TM])dnl
-AC_CACHE_CHECK([for tm_zone in struct tm], ac_cv_struct_tm_zone,
-[AC_TRY_COMPILE([#include <sys/types.h>
-#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_zone;],
- ac_cv_struct_tm_zone=yes, ac_cv_struct_tm_zone=no)])
-if test "$ac_cv_struct_tm_zone" = yes; then
- AC_DEFINE(HAVE_TM_ZONE,1,[HAVE_TM_ZONE])
-fi
-AC_CACHE_CHECK(for tzname, ac_cv_var_tzname,
-[AC_TRY_LINK(
-changequote(<<, >>)dnl
-<<#include <time.h>
-#ifndef tzname /* For SGI. */
-extern char *tzname[]; /* RS6000 and others reject char **tzname. */
-#endif>>,
-changequote([, ])dnl
-[atoi(*tzname);], ac_cv_var_tzname=yes, ac_cv_var_tzname=no)])
- if test $ac_cv_var_tzname = yes; then
- AC_DEFINE(HAVE_TZNAME,1,[HAVE_TZNAME])
- fi
-
-AC_CACHE_CHECK([for tm_isdst in struct tm], ac_cv_struct_tm_isdst,
-[AC_TRY_COMPILE([#include <sys/types.h>
-#include <$ac_cv_struct_tm>], [struct tm tm; tm.tm_isdst;],
- ac_cv_struct_tm_isdst=yes, ac_cv_struct_tm_isdst=no)])
-if test "$ac_cv_struct_tm_isdst" = yes; then
- AC_DEFINE(HAVE_TM_ISDST)
-fi
-AC_CACHE_CHECK(for daylight, ac_cv_var_daylight,
-[AC_TRY_LINK(
-changequote(<<, >>)dnl
-<<#include <time.h>
-#ifndef daylight /* In case IRIX #defines this, too */
-extern int daylight;
-#endif>>,
-changequote([, ])dnl
-[atoi(daylight);], ac_cv_var_daylight=yes, ac_cv_var_daylight=no)])
- if test $ac_cv_var_daylight = yes; then
- AC_DEFINE(HAVE_DAYLIGHT)
- fi
-])
-
-dnl from autoconf 2.13 acgeneral.m4, with patch:
-dnl Date: Fri, 15 Jan 1999 05:52:41 -0800
-dnl Message-ID: <199901151352.FAA18237@shade.twinsun.com>
-dnl From: eggert@twinsun.com (Paul Eggert)
-dnl Subject: autoconf 2.13 AC_CHECK_TYPE doesn't allow shell vars
-dnl Newsgroups: gnu.utils.bug
-dnl
-dnl now include <stdint.h> if available
-
-dnl AC_CHECK_TYPE2_STDC(TYPE, DEFAULT)
-AC_DEFUN([AC_CHECK_TYPE2_STDC],
-[AC_REQUIRE([AC_HEADER_STDC])dnl
-AC_REQUIRE([AC_HEADER_STDINT])dnl
-AC_MSG_CHECKING(for $1)
-AC_CACHE_VAL(ac_cv_type_$1,
-[AC_EGREP_CPP(dnl
-[(^|[^a-zA-Z_0-9])$1[^a-zA-Z_0-9]],
-[#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-#include <sys/types.h>
-#if STDC_HEADERS
-#include <stdlib.h>
-#include <stddef.h>
-#endif], eval "ac_cv_type_$1=yes", eval "ac_cv_type_$1=no")])dnl
-if eval "test \"`echo '$ac_cv_type_'$1`\" = yes"; then
- AC_MSG_RESULT(yes)
-else
- AC_MSG_RESULT(no)
- AC_DEFINE_UNQUOTED($1, $2)
-fi
-])
-
-dnl from autoconf 2.13 acgeneral.m4, with additional third argument
-dnl AC_CHECK_SIZEOF_INCLUDES(TYPE [, CROSS-SIZE [, INCLUDES]])
-AC_DEFUN([AC_CHECK_SIZEOF_INCLUDES],
-[dnl The name to #define.
-define([AC_TYPE_NAME], translit(sizeof_$1, [[[a-z *]]], [[[A-Z_P]]]))dnl
-dnl The cache variable name.
-define([AC_CV_NAME], translit(ac_cv_sizeof_$1, [[[ *]]], [[[_p]]]))dnl
-AC_MSG_CHECKING(size of $1)
-AC_CACHE_VAL(AC_CV_NAME,
-[AC_TRY_RUN([$3
-#include <stdio.h>
-main()
-{
- FILE *f=fopen("conftestval", "w");
- if (!f) exit(1);
- fprintf(f, "%d\n", sizeof($1));
- exit(0);
-}], AC_CV_NAME=`cat conftestval`, AC_CV_NAME=0, ifelse([$2], , , AC_CV_NAME=$2))])dnl
-AC_MSG_RESULT($AC_CV_NAME)
-AC_DEFINE_UNQUOTED(AC_TYPE_NAME, $AC_CV_NAME)
-undefine([AC_TYPE_NAME])dnl
-undefine([AC_CV_NAME])dnl
-])
-
-dnl AC_CHECK_SIZEOF_STDC_HEADERS(TYPE [, CROSS_SIZE])
-AC_DEFUN([AC_CHECK_SIZEOF_STDC_HEADERS],
-[AC_REQUIRE([AC_HEADER_STDC])dnl
-AC_REQUIRE([AC_HEADER_STDINT])dnl
-AC_CHECK_SIZEOF_INCLUDES($1, $2,
-[#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-#include <sys/types.h>
-#ifdef STDC_HEADERS
-#include <stdlib.h>
-#endif
-])
-])
-
-
-dnl AC_CHECK_TYPE_STDC(TYPE, DEFAULT)
-AC_DEFUN([AC_CHECK_TYPE_STDC],
-[AC_REQUIRE([AC_HEADER_STDC])dnl
-AC_REQUIRE([AC_HEADER_STDINT])dnl
-AC_MSG_CHECKING(for $1)
-AC_CACHE_VAL(ac_cv_type_$1,
-[AC_EGREP_CPP(dnl
-[(^|[^a-zA-Z_0-9])$1[^a-zA-Z_0-9]],
-[#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-#include <sys/types.h>
-#if STDC_HEADERS
-#include <stdlib.h>
-#include <stddef.h>
-#endif], ac_cv_type_$1=yes, ac_cv_type_$1=no)])dnl
-AC_MSG_RESULT($ac_cv_type_$1)
-if test $ac_cv_type_$1 = no; then
- AC_DEFINE($1, $2)
-fi
-])
-
-dnl AC_HEADER_STDINT
-AC_DEFUN([AC_HEADER_STDINT], [AC_CHECK_HEADERS(stdint.h)])
-
-#serial 19
-
-dnl By default, many hosts won't let programs access large files;
-dnl one must use special compiler options to get large-file access to work.
-dnl For more details about this brain damage please see:
-dnl http://www.sas.com/standards/large.file/x_open.20Mar96.html
-
-dnl Written by Paul Eggert <eggert@twinsun.com>.
-
-dnl Internal subroutine of AC_SYS_LARGEFILE.
-dnl AC_SYS_LARGEFILE_TEST_INCLUDES
-AC_DEFUN([AC_SYS_LARGEFILE_TEST_INCLUDES],
- [[#include <sys/types.h>
- /* Check that off_t can represent 2**63 - 1 correctly.
- We can't simply "#define LARGE_OFF_T 9223372036854775807",
- since some C++ compilers masquerading as C compilers
- incorrectly reject 9223372036854775807. */
-# define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
- int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
- && LARGE_OFF_T % 2147483647 == 1)
- ? 1 : -1];
- ]])
-
-dnl Internal subroutine of AC_SYS_LARGEFILE.
-dnl AC_SYS_LARGEFILE_MACRO_VALUE(C-MACRO, VALUE, CACHE-VAR, COMMENT, INCLU=
-DES, FUNCTION-BODY)
-AC_DEFUN([AC_SYS_LARGEFILE_MACRO_VALUE],
- [AC_CACHE_CHECK([for $1 value needed for large files], $3,
- [$3=no
- AC_TRY_COMPILE([$5],
- [$6],
- ,
- [AC_TRY_COMPILE([#define $1 $2]
-[$5]
- ,
- [$6],
- [$3=$2])])])
- if test "[$]$3" != no; then
- AC_DEFINE_UNQUOTED([$1], [$]$3, [$4])
- fi])
-
-AC_DEFUN([AC_SYS_LARGEFILE],
- [AC_REQUIRE([AC_PROG_CC])
- AC_ARG_ENABLE(largefile,
- [ --disable-largefile omit support for large files])
- if test "$enable_largefile" != no; then
-
- AC_CACHE_CHECK([for special C compiler options needed for large files=
-],
- ac_cv_sys_largefile_CC,
- [ac_cv_sys_largefile_CC=no
- if test "$GCC" != yes; then
- # IRIX 6.2 and later do not support large files by default,
- # so use the C compiler's -n32 option if that helps.
- AC_TRY_COMPILE(AC_SYS_LARGEFILE_TEST_INCLUDES, , ,
- [ac_save_CC="$CC"
- CC="$CC -n32"
- AC_TRY_COMPILE(AC_SYS_LARGEFILE_TEST_INCLUDES, ,
- ac_cv_sys_largefile_CC=' -n32')
- CC="$ac_save_CC"])
- fi])
- if test "$ac_cv_sys_largefile_CC" != no; then
- CC="$CC$ac_cv_sys_largefile_CC"
- fi
-
- AC_SYS_LARGEFILE_MACRO_VALUE(_FILE_OFFSET_BITS, 64,
- ac_cv_sys_file_offset_bits,
- [Number of bits in a file offset, on hosts where this is settable.],
- AC_SYS_LARGEFILE_TEST_INCLUDES)
- AC_SYS_LARGEFILE_MACRO_VALUE(_LARGE_FILES, 1,
- ac_cv_sys_large_files,
- [Define for large files, on AIX-style hosts.],
- AC_SYS_LARGEFILE_TEST_INCLUDES)
- fi
- ])
-
-AC_DEFUN([AC_FUNC_FSEEKO],
- [AC_SYS_LARGEFILE_MACRO_VALUE(_LARGEFILE_SOURCE, 1,
- ac_cv_sys_largefile_source,
- [Define to make fseeko visible on some hosts (e.g. glibc 2.2).],
- [#include <stdio.h>], [return !fseeko;])
- # We used to try defining _XOPEN_SOURCE=500 too, to work around a bug
- # in glibc 2.1.3, but that breaks too many other things.
- # If you want fseeko and ftello with glibc, upgrade to a fixed glibc.
-
- AC_CACHE_CHECK([for fseeko], ac_cv_func_fseeko,
- [ac_cv_func_fseeko=no
- AC_TRY_LINK([#include <stdio.h>],
- [return fseeko && fseeko (stdin, 0, 0);],
- [ac_cv_func_fseeko=yes])])
- if test $ac_cv_func_fseeko != no; then
- AC_DEFINE(HAVE_FSEEKO, 1,
- [Define if fseeko (and presumably ftello) exists and is declared.])
- fi])
-
-# serial 9
-
-# From Paul Eggert.
-
-# BeOS 5 has <wchar.h> but does not define mbstate_t,
-# so you can't declare an object of that type.
-# Check for this incompatibility with Standard C.
-
-# Include stdlib.h first, because otherwise this test would fail on Linux
-# (at least glibc-2.1.3) because the "_XOPEN_SOURCE 500" definition elicits
-# a syntax error in wchar.h due to the use of undefined __int32_t.
-AC_DEFUN([AC_MBSTATE_T],
- [
- AC_CHECK_HEADERS(stdlib.h)
-
- AC_CACHE_CHECK([for mbstate_t], ac_cv_type_mbstate_t,
- [AC_TRY_COMPILE([
-#if HAVE_STDLIB_H
-# include <stdlib.h>
-#endif
-#include <wchar.h>],
- [mbstate_t x; return sizeof x;],
- ac_cv_type_mbstate_t=yes,
- ac_cv_type_mbstate_t=no)])
- if test $ac_cv_type_mbstate_t = no; then
- AC_DEFINE(mbstate_t, int,
- [Define to a type if <wchar.h> does not define.])
- fi])
-
-
export CFLAGS
export LDFLAGS
-LTV="libtoolize (GNU libtool) 1.5.14"
+LTV="libtoolize (GNU libtool) 1.5.18"
ACV="autoconf (GNU Autoconf) 2.59"
AMV="automake (GNU automake) 1.9.5"
USAGE="
This script documents the versions of the tools I'm using to build rpm:
- libtool-1.5.14
+ libtool-1.5.18
autoconf-2.59
automake-1.9.5
Simply edit this script to change the libtool/autoconf/automake versions
dnl Process this file with autoconf to produce a configure script.
AC_INIT
AC_CONFIG_SRCDIR([src/file.c])
-AM_INIT_AUTOMAKE(file, 4.12)
+AM_INIT_AUTOMAKE(file, 4.14)
AM_CONFIG_HEADER([config.h])
dnl AM_MAINTAINER_MODE
dnl Checks for libraries
AC_CHECK_LIB(z,gzopen)
+# XXX Choose /usr/lib or /usr/lib64 for library installs.
+MARK64=
+case "${target_cpu}" in
+x86_64*|powerpc64*|ppc64*|sparc64*|s390x*) MARK64=64 ;;
+esac
+AC_SUBST(MARK64)
+
AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile doc/Makefile python/Makefile])
AC_OUTPUT
.TH FILE __CSECTION__ "Copyright but distributable"
-.\" $Id: file.man,v 1.54 2003/10/27 18:09:08 christos Exp $
+.\" $Id: file.man,v 1.55 2005/02/09 19:07:30 christos Exp $
.SH NAME
file
\- determine file type
.I __MAGIC__.mgc ,
or
.I __MAGIC__
-if the compile file does not exist.
+if the compile file does not exist. In addition
+.B file
+will look in
+.I $HOME/.magic.mgc ,
+or
+.I $HOME/.magic
+for magic entries.
.PP
If a file does not match any of the entries in the magic file,
it is examined to see if it seems to be a text file.
The environment variable
.B MAGIC
can be used to set the default magic number file name.
+If that variable is set, then
+.B file
+will not attempt to open
+.B $HOME/.magic .
.B file
adds ".mime" and/or ".mgc" to the value of this variable as appropriate.
.SH SEE ALSO
A four-byte value (on most systems) in little-endian byte order,
interpreted as a UNIX-style date, but interpreted as local time rather
than UTC.
+.IP regex
+A regular expression match in extended POSIX regular expression syntax
+(much like egrep).
+The type specification can be optionally followed by
+.B /c
+for case-insensitive matches.
+The regular expression is always
+tested against the first
+.B N
+lines, where
+.B N
+is the given offset, thus it
+is only useful for (single-byte encoded) text.
+.B ^
+and
+.B $
+will match the beginning and end of individual lines, respectively,
+not beginning and end of file.
+.IP search
+A literal string search starting at the given offset. It must be followed by
+.B /<number>
+which specifies how many matches shall be attempted (the range).
+This is suitable for searching larger binary expressions with variable
+offsets, using
+.B \e
+escapes for special characters.
.RE
.PP
The numeric types may optionally be followed by
to specify that the value from the file must be greater than the specified
value,
.BR & ,
-to specify that the value from the file must have set all of the bits
+to specify that the value from the file must have set all of the bits
that are set in the specified value,
.BR ^ ,
-to specify that the value from the file must have clear any of the bits
+to specify that the value from the file must have clear any of the bits
that are set in the specified value, or
.BR x ,
to specify that any value will match.
If the character is omitted, it is assumed to be
.BR = .
+For all tests except
+.B string
+and
+.B regex,
+operation
+.BR !
+specifies that the line matches if the test does
+.B not
+succeed.
.IP
Numeric values are specified in C form; e.g.
.B 13
is hexadecimal.
.IP
For string values, the byte string from the
-file must match the specified byte string.
+file must match the specified byte string.
The operators
.BR = ,
.B <
performed) is printed using the message as the format string.
.PP
Some file formats contain additional information which is to be printed
-along with the file type.
-A line which begins with the character
+along with the file type or need additional tests to determine the true
+file type.
+These additional tests are introduced by one or more
.B >
-indicates additional tests and messages to be printed.
+characters preceding the offset.
The number of
.B >
on the line indicates the level of the test; a line with no
.B >
at the beginning is considered to be at level 0.
-Each line at level
-.IB n \(pl1
-is under the control of the line at level
+Tests are arranged in a tree-like hierarchy:
+If a the test on a line at level
.IB n
-most closely preceding it in the magic file.
-If the test on a line at level
-.I n
-succeeds, the tests specified in all the subsequent lines at level
-.IB n \(pl1
-are performed, and the messages printed if the tests succeed.
-The next line at level
-.I n
-terminates this.
+succeeds, all following tests at level
+.IB n+1
+are performed, and the messages printed if the tests succeed, untile a line
+with level
+.IB n
+(or less) appears.
+For more complex files, one can use empty messages to get just the
+"if/then" effect, in the following way:
+.sp
+.nf
+ 0 string MZ
+ >0x18 leshort <0x40 MS-DOS executable
+ >0x18 leshort >0x3f extended PC executable (e.g., MS Windows)
+.fi
+.PP
+Offsets do not need to be constant, but can also be read from the file
+being examined.
If the first character following the last
.B >
is a
in the file.
Indirect offsets are of the form:
.BI (( x [.[bslBSL]][+\-][ y ]).
-The value of
+The value of
.I x
is used as an offset in the file. A byte, short or long is read at that offset
-depending on the
-.B [bslBSL]
+depending on the
+.B [bslBSL]
type specifier.
The capitalized types interpret the number as a big endian
value, whereas the small letter versions interpret the number as a little
is added and the result is used as an offset in the file.
The default type if one is not specified is long.
.PP
-Sometimes you do not know the exact offset as this depends on the length of
-preceding fields.
-You can specify an offset relative to the end of the
-last uplevel field (of course this may only be done for sublevel tests, i.e.
-test beginning with
-.B >
-).
-Such a relative offset is specified using
-.B &
-as a prefix to the offset.
+That way variable length structures can be examined:
+.sp
+.nf
+ # MS Windows executables are also valid MS-DOS executables
+ 0 string MZ
+ >0x18 leshort <0x40 MZ executable (MS-DOS)
+ # skip the whole block below if it is not an extended executable
+ >0x18 leshort >0x3f
+ >>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
+ >>(0x3c.l) string LX\e0\e0 LX executable (OS/2)
+.fi
+.PP
+This strategy of examining has one drawback: You must make sure that
+you eventually print something, or users may get empty output (like, when
+there is neither PE\e0\e0 nor LE\e0\e0 in the above example)
+.PP
+If this indirect offset cannot be used as-is, there are simple calculations
+possible: appending
+.BI [+-*/%&|^]<number>
+inside parentheses allows one to modify
+the value read from the file before it is used as an offset:
+.sp
+.nf
+ # MS Windows executables are also valid MS-DOS executables
+ 0 string MZ
+ # sometimes, the value at 0x18 is less that 0x40 but there's still an
+ # extended executable, simply appended to the file
+ >0x18 leshort <0x40
+ >>(4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)
+ >>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
+.fi
+.PP
+Sometimes you do not know the exact offset as this depends on the length or
+position (when indirection was used before) of preceding fields. You can
+specify an offset relative to the end of the last uplevel field using
+.BI &
+as a prefix to the offset:
+.sp
+.nf
+ 0 string MZ
+ >0x18 leshort >0x3f
+ >>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
+ # immediately following the PE signature is the CPU type
+ >>>&0 leshort 0x14c for Intel 80386
+ >>>&0 leshort 0x184 for DEC Alpha
+.fi
+.PP
+Indirect and relative offsets can be combined:
+.sp
+.nf
+ 0 string MZ
+ >0x18 leshort <0x40
+ >>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
+ # if it's not COFF, go back 512 bytes and add the offset taken
+ # from byte 2/3, which is yet another way of finding the start
+ # of the extended executable
+ >>>&(2.s-514) string LE LE executable (MS Windows VxD driver)
+.fi
+.PP
+Or the other way around:
+.sp
+.nf
+ 0 string MZ
+ >0x18 leshort >0x3f
+ >>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
+ # at offset 0x80 (-4, since relative offsets start at the end
+ # of the uplevel match) inside the LE header, we find the absolute
+ # offset to the code area, where we look for a specific signature
+ >>>(&0x7c.l+0x26) string UPX \eb, UPX compressed
+.fi
+.PP
+Or even both!
+.sp
+.nf
+ 0 string MZ
+ >0x18 leshort >0x3f
+ >>(0x3c.l) string LE\e0\e0 LE executable (MS-Windows)
+ # at offset 0x58 inside the LE header, we find the relative offset
+ # to a data area where we look for a specific signature
+ >>>&(&0x54.l-3) string UNACE \eb, ACE self-extracting archive
+.fi
+.PP
+Finally, if you have to deal with offset/length pairs in your file, even the
+second value in a parenthesed expression can be taken from the file itself,
+using another set of parentheses. Note that this additional indirect offset
+is always relative to the start of the main indirect offset.
+.sp
+.nf
+ 0 string MZ
+ >0x18 leshort >0x3f
+ >>(0x3c.l) string PE\e0\e0 PE executable (MS-Windows)
+ # search for the PE section called ".idata"...
+ >>>&0xf4 search/0x140 .idata
+ # ...and go to the end of it, calculated from start+length;
+ # these are located 14 and 10 bytes after the section name
+ >>>>(&0xe.l+(-4)) string PK\e3\e4 \eb, ZIP self-extracting archive
+.fi
.SH BUGS
-The formats
+The formats
.IR long ,
.IR belong ,
.IR lelong ,
and
.I ledate
are system-dependent; perhaps they should be specified as a number
-of bytes (2B, 4B, etc),
+of bytes (2B, 4B, etc),
since the files being recognized typically come from
a system on which the lengths are invariant.
.PP
.\" Date: 3 Sep 85 08:19:07 GMT
.\" Organization: Sun Microsystems, Inc.
.\" Lines: 136
-.\"
+.\"
.\" Here's a manual page for the format accepted by the "file" made by adding
.\" the changes I posted to the S5R2 version.
.\"
.\" Modified for Ian Darwin's version of the file command.
-.\" @(#)$Id: magic.man,v 1.27 2003/09/12 19:43:30 christos Exp $
+.\" @(#)$Id: magic.man,v 1.28 2005/03/17 17:34:15 christos Exp $
+++ /dev/null
-#### This script is meant to be sourced by ltconfig.
-
-# ltcf-c.sh - Create a C compiler specific configuration
-#
-# Copyright (C) 1996-2000, 2001 Free Software Foundation, Inc.
-# Originally by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996
-#
-# This file is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-#
-# As a special exception to the GNU General Public License, if you
-# distribute this file as part of a program that contains a
-# configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-
-# Source file extension for C test sources.
-ac_ext=c
-
-# Object file extension for compiled C test sources.
-objext=o
-
-# Code to be used in simple compile tests
-lt_simple_compile_test_code="int some_variable = 0;"
-
-# Code to be used in simple link tests
-lt_simple_link_test_code='main(){return(0);}'
-
-## Linker Characteristics
-case $host_os in
-cygwin* | mingw*)
- # FIXME: the MSVC++ port hasn't been tested in a loooong time
- # When not using gcc, we currently assume that we are using
- # Microsoft Visual C++.
- if test "$with_gcc" != yes; then
- with_gnu_ld=no
- fi
- ;;
-
-esac
-
-ld_shlibs=yes
-if test "$with_gnu_ld" = yes; then
- # If archive_cmds runs LD, not CC, wlarc should be empty
- wlarc='${wl}'
-
- # See if GNU ld supports shared libraries.
- case $host_os in
- aix3* | aix4* | aix5*)
- # On AIX, the GNU linker is very broken
- ld_shlibs=no
- cat <<EOF 1>&2
-
-*** Warning: the GNU linker, at least up to release 2.9.1, is reported
-*** to be unable to reliably create shared libraries on AIX.
-*** Therefore, libtool is disabling shared libraries support. If you
-*** really care for shared libraries, you may want to modify your PATH
-*** so that a non-GNU linker is found, and then restart.
-
-EOF
- ;;
-
- amigaos*)
- archive_cmds='$rm $output_objdir/a2ixlibrary.data~$echo "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$echo "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$echo "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$echo "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
- hardcode_libdir_flag_spec='-L$libdir'
- hardcode_minus_L=yes
-
- # Samuel A. Falvo II <kc5tja@dolphin.openprojects.net> reports
- # that the semantics of dynamic libraries on AmigaOS, at least up
- # to version 4, is to share data among multiple programs linked
- # with the same dynamic library. Since this doesn't match the
- # behavior of shared libraries on other platforms, we can use
- # them.
- ld_shlibs=no
- ;;
-
- beos*)
- if $LD --help 2>&1 | egrep ': supported targets:.* elf' > /dev/null; then
- allow_undefined_flag=unsupported
- # Joseph Beckenbach <jrb3@best.com> says some releases of gcc
- # support --undefined. This deserves some investigation. FIXME
- archive_cmds='$CC -nostart $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname -o $lib'
- else
- ld_shlibs=no
- fi
- ;;
-
- cygwin* | mingw*)
- # hardcode_libdir_flag_spec is actually meaningless, as there is
- # no search path for DLLs.
- hardcode_libdir_flag_spec='-L$libdir'
- allow_undefined_flag=unsupported
- always_export_symbols=yes
-
- extract_expsyms_cmds='test -f $output_objdir/impgen.c || \
- sed -e "/^# \/\* impgen\.c starts here \*\//,/^# \/\* impgen.c ends here \*\// { s/^# //; p; }" -e d < $0 > $output_objdir/impgen.c~
- test -f $output_objdir/impgen.exe || (cd $output_objdir && \
- if test "x$HOST_CC" != "x" ; then $HOST_CC -o impgen impgen.c ; \
- else $CC -o impgen impgen.c ; fi)~
- $output_objdir/impgen $dir/$soroot > $output_objdir/$soname-def'
-
- old_archive_from_expsyms_cmds='$DLLTOOL --as=$AS --dllname $soname --def $output_objdir/$soname-def --output-lib $output_objdir/$newlib'
-
- # cygwin and mingw dlls have different entry points and sets of symbols
- # to exclude.
- # FIXME: what about values for MSVC?
- dll_entry=__cygwin_dll_entry@12
- dll_exclude_symbols=DllMain@12,_cygwin_dll_entry@12,_cygwin_noncygwin_dll_entry@12~
- case $host_os in
- mingw*)
- # mingw values
- dll_entry=_DllMainCRTStartup@12
- dll_exclude_symbols=DllMain@12,DllMainCRTStartup@12,DllEntryPoint@12~
- ;;
- esac
-
- # mingw and cygwin differ, and it's simplest to just exclude the union
- # of the two symbol sets.
- dll_exclude_symbols=DllMain@12,_cygwin_dll_entry@12,_cygwin_noncygwin_dll_entry@12,DllMainCRTStartup@12,DllEntryPoint@12
-
- # recent cygwin and mingw systems supply a stub DllMain which the user
- # can override, but on older systems we have to supply one (in ltdll.c)
- if test "x$lt_cv_need_dllmain" = "xyes"; then
- ltdll_obj='$output_objdir/$soname-ltdll.'"$objext "
- ltdll_cmds='test -f $output_objdir/$soname-ltdll.c || sed -e "/^# \/\* ltdll\.c starts here \*\//,/^# \/\* ltdll.c ends here \*\// { s/^# //; p; }" -e d < $0 > $output_objdir/$soname-ltdll.c~
- test -f $output_objdir/$soname-ltdll.$objext || (cd $output_objdir && $CC -c $soname-ltdll.c)~'
- else
- ltdll_obj=
- ltdll_cmds=
- fi
-
- # Extract the symbol export list from an `--export-all' def file,
- # then regenerate the def file from the symbol export list, so that
- # the compiled dll only exports the symbol export list.
- # Be careful not to strip the DATA tag left be newer dlltools.
- export_symbols_cmds="$ltdll_cmds"'
- $DLLTOOL --export-all --exclude-symbols '$dll_exclude_symbols' --output-def $output_objdir/$soname-def '$ltdll_obj'$libobjs $convenience~
- sed -e "1,/EXPORTS/d" -e "s/ @ [0-9]*//" -e "s/ *;.*$//" < $output_objdir/$soname-def > $export_symbols'
-
- # If the export-symbols file already is a .def file (1st line
- # is EXPORTS), use it as is.
- # If DATA tags from a recent dlltool are present, honour them!
- archive_expsym_cmds='if test "x`head -1 $export_symbols`" = xEXPORTS; then
- cp $export_symbols $output_objdir/$soname-def;
- else
- echo EXPORTS > $output_objdir/$soname-def;
- _lt_hint=1;
- cat $export_symbols | while read symbol; do
- set dummy \$symbol;
- case \[$]# in
- 2) echo " \[$]2 @ \$_lt_hint ; " >> $output_objdir/$soname-def;;
- *) echo " \[$]2 @ \$_lt_hint \[$]3 ; " >> $output_objdir/$soname-def;;
- esac;
- _lt_hint=`expr 1 + \$_lt_hint`;
- done;
- fi~
- '"$ltdll_cmds"'
- $CC -Wl,--base-file,$output_objdir/$soname-base '$lt_cv_cc_dll_switch' -Wl,-e,'$dll_entry' -o $output_objdir/$soname '$ltdll_obj'$libobjs $deplibs $compiler_flags~
- $DLLTOOL --as=$AS --dllname $soname --exclude-symbols '$dll_exclude_symbols' --def $output_objdir/$soname-def --base-file $output_objdir/$soname-base --output-exp $output_objdir/$soname-exp~
- $CC -Wl,--base-file,$output_objdir/$soname-base $output_objdir/$soname-exp '$lt_cv_cc_dll_switch' -Wl,-e,'$dll_entry' -o $output_objdir/$soname '$ltdll_obj'$libobjs $deplibs $compiler_flags~
- $DLLTOOL --as=$AS --dllname $soname --exclude-symbols '$dll_exclude_symbols' --def $output_objdir/$soname-def --base-file $output_objdir/$soname-base --output-exp $output_objdir/$soname-exp --output-lib $output_objdir/$libname.dll.a~
- $CC $output_objdir/$soname-exp '$lt_cv_cc_dll_switch' -Wl,-e,'$dll_entry' -o $output_objdir/$soname '$ltdll_obj'$libobjs $deplibs $compiler_flags'
- ;;
-
- netbsd*)
- if echo __ELF__ | $CC -E - | grep __ELF__ >/dev/null; then
- archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
- wlarc=
- else
- archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname -o $lib'
- archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname ${wl}-retain-symbols-file $wl$export_symbols -o $lib'
- fi
- ;;
-
- solaris* | sysv5*)
- if $LD -v 2>&1 | egrep 'BFD 2\.8' > /dev/null; then
- ld_shlibs=no
- cat <<EOF 1>&2
-
-*** Warning: The releases 2.8.* of the GNU linker cannot reliably
-*** create shared libraries on Solaris systems. Therefore, libtool
-*** is disabling shared libraries support. We urge you to upgrade GNU
-*** binutils to release 2.9.1 or newer. Another option is to modify
-*** your PATH or compiler configuration so that the native linker is
-*** used, and then restart.
-
-EOF
- elif $LD --help 2>&1 | egrep ': supported targets:.* elf' > /dev/null; then
- archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname -o $lib'
- archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname ${wl}-retain-symbols-file $wl$export_symbols -o $lib'
- else
- ld_shlibs=no
- fi
- ;;
-
- sunos4*)
- archive_cmds='$LD -assert pure-text -Bshareable -o $lib $libobjs $deplibs $linker_flags'
- wlarc=
- hardcode_direct=yes
- hardcode_shlibpath_var=no
- ;;
-
- *)
- if $LD --help 2>&1 | egrep ': supported targets:.* elf' > /dev/null; then
- archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname -o $lib'
- archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname ${wl}-retain-symbols-file $wl$export_symbols -o $lib'
- else
- ld_shlibs=no
- fi
- ;;
- esac
-
- if test "$ld_shlibs" = yes; then
- runpath_var=LD_RUN_PATH
- hardcode_libdir_flag_spec='${wl}--rpath ${wl}$libdir'
- export_dynamic_flag_spec='${wl}--export-dynamic'
- case $host_os in
- cygwin* | mingw*)
- # dlltool doesn't understand --whole-archive et. al.
- whole_archive_flag_spec=
- ;;
- *)
- # ancient GNU ld didn't support --whole-archive et. al.
- if $LD --help 2>&1 | egrep 'no-whole-archive' > /dev/null; then
- whole_archive_flag_spec="$wlarc"'--whole-archive$convenience '"$wlarc"'--no-whole-archive'
- else
- whole_archive_flag_spec=
- fi
- ;;
- esac
- fi
-else
- # PORTME fill in a description of your system's linker (not GNU ld)
- case $host_os in
- aix3*)
- allow_undefined_flag=unsupported
- always_export_symbols=yes
- archive_expsym_cmds='$LD -o $output_objdir/$soname $libobjs $deplibs $linker_flags -bE:$export_symbols -T512 -H512 -bM:SRE~$AR $AR_FLAGS $lib $output_objdir/$soname'
- # Note: this linker hardcodes the directories in LIBPATH if there
- # are no directories specified by -L.
- hardcode_minus_L=yes
- if test "$with_gcc" = yes && test -z "$link_static_flag"; then
- # Neither direct hardcoding nor static linking is supported with a
- # broken collect2.
- hardcode_direct=unsupported
- fi
- ;;
-
- aix4* | aix5*)
- hardcode_direct=yes
- hardcode_libdir_separator=':'
- link_all_deplibs=yes
- # When large executables or shared objects are built, AIX ld can
- # have problems creating the table of contents. If linking a library
- # or program results in "error TOC overflow" add -mminimal-toc to
- # CXXFLAGS/CFLAGS for g++/gcc. In the cases where that is not
- # enough to fix the problem, add -Wl,-bbigtoc to LDFLAGS.
- if test "$with_gcc" = yes; then
- case $host_os in aix4.[012]|aix4.[012].*)
- # We only want to do this on AIX 4.2 and lower, the check
- # below for broken collect2 doesn't work under 4.3+
- collect2name=`${CC} -print-prog-name=collect2`
- if test -f "$collect2name" && \
- strings "$collect2name" | grep resolve_lib_name >/dev/null
- then
- # We have reworked collect2
- hardcode_direct=yes
- else
- # We have old collect2
- hardcode_direct=unsupported
- # It fails to find uninstalled libraries when the uninstalled
- # path is not listed in the libpath. Setting hardcode_minus_L
- # to unsupported forces relinking
- hardcode_minus_L=yes
- hardcode_libdir_flag_spec='-L$libdir'
- hardcode_libdir_separator=
- fi
- esac
- shared_flag='-shared'
- else
- # not using gcc
- if test "$host_cpu" = ia64; then
- shared_flag='${wl}-G'
- else
- shared_flag='${wl}-bM:SRE'
- fi
- fi
-
- if test "$host_cpu" = ia64; then
- # On IA64, the linker does run time linking by default, so we don't
- # have to do anything special.
- aix_use_runtimelinking=no
- exp_sym_flag='-Bexport'
- no_entry_flag=""
- else
- # Test if we are trying to use run time linking, or normal AIX style linking.
- # If -brtl is somewhere in LDFLAGS, we need to do run time linking.
- aix_use_runtimelinking=no
- for ld_flag in $LDFLAGS; do
- if (test $ld_flag = "-brtl" || test $ld_flag = "-Wl,-brtl" ); then
- aix_use_runtimelinking=yes
- break
- fi
- done
- exp_sym_flag='-bexport'
- no_entry_flag='-bnoentry'
- fi
- # -bexpall does not export symbols beginning with underscore (_)
- always_export_symbols=yes
- if test "$aix_use_runtimelinking" = yes; then
- # Warning - without using the other run time loading flags (-brtl), -berok will
- # link without error, but may produce a broken library.
- allow_undefined_flag=' ${wl}-berok'
- hardcode_libdir_flag_spec='${wl}-blibpath:$libdir:/usr/lib:/lib'
- archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs $compiler_flags ${allow_undefined_flag} '"\${wl}$no_entry_flag \${wl}$exp_sym_flag:\$export_symbols"
- else
- if test "$host_cpu" = ia64; then
- hardcode_libdir_flag_spec='${wl}-R $libdir:/usr/lib:/lib'
- allow_undefined_flag="-z nodefs"
- archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs $compiler_flags ${wl}${allow_undefined_flag} '"\${wl}$no_entry_flag \${wl}$exp_sym_flag:\$export_symbols"
- else
- allow_undefined_flag=' ${wl}-berok'
- # -bexpall does not export symbols beginning with underscore (_)
- always_export_symbols=yes
- # Exported symbols can be pulled into shared objects from archives
- whole_archive_flag_spec=' '
- build_libtool_need_lc=yes
- hardcode_libdir_flag_spec='${wl}-blibpath:$libdir:/usr/lib:/lib'
- # This is similar to how AIX traditionally builds it's shared libraries.
- archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs $compiler_flags ${wl}-bE:$export_symbols ${wl}-bnoentry${allow_undefined_flag}~$AR $AR_FLAGS $output_objdir/$libname$release.a $output_objdir/$soname'
- fi
- fi
- ;;
-
- amigaos*)
- archive_cmds='$rm $output_objdir/a2ixlibrary.data~$echo "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$echo "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$echo "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$echo "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
- hardcode_libdir_flag_spec='-L$libdir'
- hardcode_minus_L=yes
- # see comment about different semantics on the GNU ld section
- ld_shlibs=no
- ;;
-
- cygwin* | mingw*)
- # When not using gcc, we currently assume that we are using
- # Microsoft Visual C++.
- # hardcode_libdir_flag_spec is actually meaningless, as there is
- # no search path for DLLs.
- hardcode_libdir_flag_spec=' '
- allow_undefined_flag=unsupported
- # Tell ltmain to make .lib files, not .a files.
- libext=lib
- # FIXME: Setting linknames here is a bad hack.
- archive_cmds='$CC -o $lib $libobjs $compiler_flags `echo "$deplibs" | sed -e '\''s/ -lc$//'\''` -link -dll~linknames='
- # The linker will automatically build a .lib file if we build a DLL.
- old_archive_from_new_cmds='true'
- # FIXME: Should let the user specify the lib program.
- old_archive_cmds='lib /OUT:$oldlib$oldobjs$old_deplibs'
- fix_srcfile_path='`cygpath -w "$srcfile"`'
- ;;
-
- darwin* | rhapsody*)
- case "$host_os" in
- rhapsody* | darwin1.[012])
- allow_undefined_flag='-undefined suppress'
- ;;
- *) # Darwin 1.3 on
- allow_undefined_flag='-flat_namespace -undefined suppress'
- ;;
- esac
- archive_cmds='$CC $(if test .$module = .yes; then echo -bundle; else echo -dynamiclib; fi) $allow_undefined_flag -o $lib $libobjs $deplibs $linkopts -install_name $rpath/$soname $verstring'
- # We need to add '_' to the symbols in $export_symbols first
- #archive_expsym_cmds="$archive_cmds"' && strip -s $export_symbols $lib'
- hardcode_direct=yes
- hardcode_shlibpath_var=no
- whole_archive_flag_spec='-all_load $convenience'
- ;;
-
- freebsd1*)
- ld_shlibs=no
- ;;
-
- # FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor
- # support. Future versions do this automatically, but an explicit c++rt0.o
- # does not break anything, and helps significantly (at the cost of a little
- # extra space).
- freebsd2.2*)
- archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o'
- hardcode_libdir_flag_spec='-R$libdir'
- hardcode_direct=yes
- hardcode_shlibpath_var=no
- ;;
-
- # Unfortunately, older versions of FreeBSD 2 do not have this feature.
- freebsd2*)
- archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'
- hardcode_direct=yes
- hardcode_minus_L=yes
- hardcode_shlibpath_var=no
- ;;
-
- # FreeBSD 3 and greater uses gcc -shared to do shared libraries.
- freebsd*)
- archive_cmds='$CC -shared -o $lib $libobjs $deplibs $compiler_flags'
- hardcode_libdir_flag_spec='-R$libdir'
- hardcode_direct=yes
- hardcode_shlibpath_var=no
- ;;
-
- hpux9* | hpux10* | hpux11*)
- case $host_os in
- hpux9*) archive_cmds='$rm $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test $output_objdir/$soname = $lib || mv $output_objdir/$soname $lib' ;;
- *) archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags' ;;
- esac
- hardcode_libdir_flag_spec='${wl}+b ${wl}$libdir'
- hardcode_libdir_separator=:
- hardcode_direct=yes
- hardcode_minus_L=yes # Not in the search PATH, but as the default
- # location of the library.
- export_dynamic_flag_spec='${wl}-E'
- ;;
-
- irix5* | irix6*)
- if test "$with_gcc" = yes; then
- archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname ${wl}$soname `test -n "$verstring" && echo ${wl}-set_version ${wl}$verstring` ${wl}-update_registry ${wl}${objdir}/so_locations -o $lib'
- else
- archive_cmds='$LD -shared $libobjs $deplibs $linker_flags -soname $soname `test -n "$verstring" && echo -set_version $verstring` -update_registry ${objdir}/so_locations -o $lib'
- fi
- hardcode_libdir_flag_spec='${wl}-rpath ${wl}$libdir'
- hardcode_libdir_separator=:
- link_all_deplibs=yes
- ;;
-
- netbsd*)
- if echo __ELF__ | $CC -E - | grep __ELF__ >/dev/null; then
- archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags' # a.out
- else
- archive_cmds='$LD -shared -o $lib $libobjs $deplibs $linker_flags' # ELF
- fi
- hardcode_libdir_flag_spec='-R$libdir'
- hardcode_direct=yes
- hardcode_shlibpath_var=no
- ;;
-
- newsos6)
- archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linkopts'
- hardcode_direct=yes
- hardcode_libdir_flag_spec='${wl}-rpath ${wl}$libdir'
- hardcode_libdir_separator=:
- hardcode_shlibpath_var=no
- ;;
-
- openbsd*)
- archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'
- hardcode_libdir_flag_spec='-R$libdir'
- hardcode_direct=yes
- hardcode_shlibpath_var=no
- ;;
-
- os2*)
- hardcode_libdir_flag_spec='-L$libdir'
- hardcode_minus_L=yes
- allow_undefined_flag=unsupported
- archive_cmds='$echo "LIBRARY $libname INITINSTANCE" > $output_objdir/$libname.def~$echo "DESCRIPTION \"$libname\"" >> $output_objdir/$libname.def~$echo DATA >> $output_objdir/$libname.def~$echo " SINGLE NONSHARED" >> $output_objdir/$libname.def~$echo EXPORTS >> $output_objdir/$libname.def~emxexp $libobjs >> $output_objdir/$libname.def~$CC -Zdll -Zcrtdll -o $lib $libobjs $deplibs $compiler_flags $output_objdir/$libname.def'
- old_archive_from_new_cmds='emximp -o $output_objdir/$libname.a $output_objdir/$libname.def'
- ;;
-
- osf3*)
- if test "$with_gcc" = yes; then
- allow_undefined_flag=' ${wl}-expect_unresolved ${wl}\*'
- archive_cmds='$CC -shared${allow_undefined_flag} $libobjs $deplibs $compiler_flags ${wl}-soname ${wl}$soname `test -n "$verstring" && echo ${wl}-set_version ${wl}$verstring` ${wl}-update_registry ${wl}${objdir}/so_locations -o $lib'
- else
- allow_undefined_flag=' -expect_unresolved \*'
- archive_cmds='$LD -shared${allow_undefined_flag} $libobjs $deplibs $linker_flags -soname $soname `test -n "$verstring" && echo -set_version $verstring` -update_registry ${objdir}/so_locations -o $lib'
- fi
- hardcode_libdir_flag_spec='${wl}-rpath ${wl}$libdir'
- hardcode_libdir_separator=:
- ;;
-
- osf4* | osf5*) # as osf3* with the addition of -msym flag
- if test "$with_gcc" = yes; then
- allow_undefined_flag=' ${wl}-expect_unresolved ${wl}\*'
- archive_cmds='$CC -shared${allow_undefined_flag} $libobjs $deplibs $compiler_flags ${wl}-msym ${wl}-soname ${wl}$soname `test -n "$verstring" && echo ${wl}-set_version ${wl}$verstring` ${wl}-update_registry ${wl}${objdir}/so_locations -o $lib'
- hardcode_libdir_flag_spec='${wl}-rpath ${wl}$libdir'
- else
- allow_undefined_flag=' -expect_unresolved \*'
- archive_cmds='$LD -shared${allow_undefined_flag} $libobjs $deplibs $linker_flags -msym -soname $soname `test -n "$verstring" && echo -set_version $verstring` -update_registry ${objdir}/so_locations -o $lib'
- archive_expsym_cmds='for i in `cat $export_symbols`; do printf "-exported_symbol " >> $lib.exp; echo "\$i" >> $lib.exp; done; echo "-hidden">> $lib.exp~
- $LD -shared${allow_undefined_flag} -input $lib.exp $linker_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && echo -set_version $verstring` -update_registry ${objdir}/so_locations -o $lib~$rm $lib.exp'
-
- # cc supports -rpath directly
- hardcode_libdir_flag_spec='-rpath $libdir'
- fi
- hardcode_libdir_separator=:
- ;;
-
- sco3.2v5*)
- archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
- hardcode_shlibpath_var=no
- runpath_var=LD_RUN_PATH
- hardcode_runpath_var=yes
- ;;
-
- solaris*)
- no_undefined_flag=' -z defs'
- # $CC -shared without GNU ld will not create a library from C++
- # object files and a static libstdc++, better avoid it by now
- archive_cmds='$LD -G${allow_undefined_flag} -h $soname -o $lib $libobjs $deplibs $linker_flags'
- archive_expsym_cmds='$echo "{ global:" > $lib.exp~cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $lib.exp~$echo "local: *; };" >> $lib.exp~
- $LD -G${allow_undefined_flag} -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$rm $lib.exp'
- hardcode_libdir_flag_spec='-R$libdir'
- hardcode_shlibpath_var=no
- case $host_os in
- solaris2.[0-5] | solaris2.[0-5].*) ;;
- *) # Supported since Solaris 2.6 (maybe 2.5.1?)
- whole_archive_flag_spec='-z allextract$convenience -z defaultextract' ;;
- esac
- link_all_deplibs=yes
- ;;
-
- sunos4*)
- archive_cmds='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags'
- hardcode_libdir_flag_spec='-L$libdir'
- hardcode_direct=yes
- hardcode_minus_L=yes
- hardcode_shlibpath_var=no
- ;;
-
- sysv4)
- archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
- runpath_var='LD_RUN_PATH'
- hardcode_shlibpath_var=no
- hardcode_direct=no #Motorola manual says yes, but my tests say they lie
- ;;
-
- sysv4.3*)
- archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
- hardcode_shlibpath_var=no
- export_dynamic_flag_spec='-Bexport'
- ;;
-
- sysv5*)
- no_undefined_flag=' -z text'
- # $CC -shared without GNU ld will not create a library from C++
- # object files and a static libstdc++, better avoid it by now
- archive_cmds='$LD -G${allow_undefined_flag} -h $soname -o $lib $libobjs $deplibs $linker_flags'
- archive_expsym_cmds='$echo "{ global:" > $lib.exp~cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $lib.exp~$echo "local: *; };" >> $lib.exp~
- $LD -G${allow_undefined_flag} -M $lib.exp -h $soname -o $lib $libobjs $deplibs $linker_flags~$rm $lib.exp'
- hardcode_libdir_flag_spec=
- hardcode_shlibpath_var=no
- runpath_var='LD_RUN_PATH'
- ;;
-
- uts4*)
- archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
- hardcode_libdir_flag_spec='-L$libdir'
- hardcode_shlibpath_var=no
- ;;
-
- dgux*)
- archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
- hardcode_libdir_flag_spec='-L$libdir'
- hardcode_shlibpath_var=no
- ;;
-
- sysv4*MP*)
- if test -d /usr/nec; then
- archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
- hardcode_shlibpath_var=no
- runpath_var=LD_RUN_PATH
- hardcode_runpath_var=yes
- ld_shlibs=yes
- fi
- ;;
-
- sysv4.2uw2*)
- archive_cmds='$LD -G -o $lib $libobjs $deplibs $linker_flags'
- hardcode_direct=yes
- hardcode_minus_L=no
- hardcode_shlibpath_var=no
- hardcode_runpath_var=yes
- runpath_var=LD_RUN_PATH
- ;;
-
- sysv5uw7* | unixware7*)
- no_undefined_flag='${wl}-z ${wl}text'
- if test "$GCC" = yes; then
- archive_cmds='$CC -shared ${wl}-h ${wl}$soname -o $lib $libobjs $deplibs $compiler_flags'
- else
- archive_cmds='$CC -G ${wl}-h ${wl}$soname -o $lib $libobjs $deplibs $compiler_flags'
- fi
- runpath_var='LD_RUN_PATH'
- hardcode_shlibpath_var=no
- ;;
-
- *)
- ld_shlibs=no
- ;;
- esac
-fi
-
-## Compiler Characteristics: PIC flags, static flags, etc
-if test "X${ac_cv_prog_cc_pic+set}" = Xset; then
- :
-else
- ac_cv_prog_cc_pic=
- ac_cv_prog_cc_shlib=
- ac_cv_prog_cc_wl=
- ac_cv_prog_cc_static=
- ac_cv_prog_cc_no_builtin=
- ac_cv_prog_cc_can_build_shared=$can_build_shared
-
- if test "$with_gcc" = yes; then
- ac_cv_prog_cc_wl='-Wl,'
- ac_cv_prog_cc_static='-static'
-
- case $host_os in
- aix*)
- # All AIX code is PIC.
- if test "$host_cpu" = ia64; then
- # AIX 5 now supports IA64 processor
- lt_cv_prog_cc_static='-Bstatic'
- else
- lt_cv_prog_cc_static='-bnso -bI:/lib/syscalls.exp'
- fi
- ;;
- amigaos*)
- # FIXME: we need at least 68020 code to build shared libraries, but
- # adding the `-m68020' flag to GCC prevents building anything better,
- # like `-m68040'.
- ac_cv_prog_cc_pic='-m68020 -resident32 -malways-restore-a4'
- ;;
- beos* | irix5* | irix6* | osf3* | osf4* | osf5*)
- # PIC is the default for these OSes.
- ;;
- cygwin* | mingw* | os2*)
- # This hack is so that the source file can tell whether it is being
- # built for inclusion in a dll (and should export symbols for example).
- ac_cv_prog_cc_pic='-DDLL_EXPORT'
- ;;
- darwin* | rhapsody*)
- # PIC is the default on this platform
- # Common symbols not allowed in MH_DYLIB files
- ac_cv_prog_cc_pic='-fno-common'
- ;;
- *djgpp*)
- # DJGPP does not support shared libraries at all
- ac_cv_prog_cc_pic=
- ;;
- sysv4*MP*)
- if test -d /usr/nec; then
- ac_cv_prog_cc_pic=-Kconform_pic
- fi
- ;;
- *)
- ac_cv_prog_cc_pic='-fPIC'
- ;;
- esac
- else
- # PORTME Check for PIC flags for the system compiler.
- case $host_os in
- aix*)
- # All AIX code is PIC.
- ac_cv_prog_cc_static="$ac_cv_prog_cc_static ${ac_cv_prog_cc_wl}-lC"
- ;;
-
- hpux9* | hpux10* | hpux11*)
- # Is there a better ac_cv_prog_cc_static that works with the bundled CC?
- ac_cv_prog_cc_wl='-Wl,'
- ac_cv_prog_cc_static="${ac_cv_prog_cc_wl}-a ${ac_cv_prog_cc_wl}archive"
- ac_cv_prog_cc_pic='+Z'
- ;;
-
- irix5* | irix6*)
- ac_cv_prog_cc_wl='-Wl,'
- ac_cv_prog_cc_static='-non_shared'
- # PIC (with -KPIC) is the default.
- ;;
-
- cygwin* | mingw* | os2*)
- # This hack is so that the source file can tell whether it is being
- # built for inclusion in a dll (and should export symbols for example).
- ac_cv_prog_cc_pic='-DDLL_EXPORT'
- ;;
-
- newsos6)
- ac_cv_prog_cc_pic='-KPIC'
- ac_cv_prog_cc_static='-Bstatic'
- ;;
-
- osf3* | osf4* | osf5*)
- # All OSF/1 code is PIC.
- ac_cv_prog_cc_wl='-Wl,'
- ac_cv_prog_cc_static='-non_shared'
- ;;
-
- sco3.2v5*)
- ac_cv_prog_cc_pic='-Kpic'
- ac_cv_prog_cc_static='-dn'
- ac_cv_prog_cc_shlib='-belf'
- ;;
-
- solaris*)
- ac_cv_prog_cc_pic='-KPIC'
- ac_cv_prog_cc_static='-Bstatic'
- ac_cv_prog_cc_wl='-Wl,'
- ;;
-
- sunos4*)
- ac_cv_prog_cc_pic='-PIC'
- ac_cv_prog_cc_static='-Bstatic'
- ac_cv_prog_cc_wl='-Qoption ld '
- ;;
-
- sysv4 | sysv4.2uw2* | sysv4.3* | sysv5*)
- ac_cv_prog_cc_pic='-KPIC'
- ac_cv_prog_cc_static='-Bstatic'
- ac_cv_prog_cc_wl='-Wl,'
- ;;
-
- uts4*)
- ac_cv_prog_cc_pic='-pic'
- ac_cv_prog_cc_static='-Bstatic'
- ;;
-
- sysv4*MP*)
- if test -d /usr/nec ;then
- ac_cv_prog_cc_pic='-Kconform_pic'
- ac_cv_prog_cc_static='-Bstatic'
- fi
- ;;
-
- *)
- ac_cv_prog_cc_can_build_shared=no
- ;;
- esac
- fi
- case "$host_os" in
- # Platforms which do not suport PIC and -DPIC is meaningless
- # on them:
- *djgpp*)
- ac_cv_prog_cc_pic=
- ;;
- *)
- ac_cv_prog_cc_pic="$ac_cv_prog_cc_pic -DPIC"
- ;;
- esac
-fi
-
-need_lc=yes
-if test "$enable_shared" = yes && test "$with_gcc" = yes; then
- case $archive_cmds in
- *'~'*)
- # FIXME: we may have to deal with multi-command sequences.
- ;;
- '$CC '*)
- # Test whether the compiler implicitly links with -lc since on some
- # systems, -lgcc has to come before -lc. If gcc already passes -lc
- # to ld, don't add -lc before -lgcc.
- echo $ac_n "checking whether -lc should be explicitly linked in... $ac_c" 1>&6
- if eval "test \"`echo '$''{'ac_cv_archive_cmds_needs_lc'+set}'`\" = set"; then
- echo $ac_n "(cached) $ac_c" 1>&6
- need_lc=$ac_cv_archive_cmds_needs_lc
- else
- $rm conftest*
- echo "static int dummy;" > conftest.$ac_ext
- if { (eval echo ltcf-c.sh:need_lc: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>conftest.err; }; then
- # Append any warnings to the config.log.
- cat conftest.err 1>&5
- soname=conftest
- lib=conftest
- libobjs=conftest.$ac_objext
- deplibs=
- wl=$ac_cv_prog_cc_wl
- compiler_flags=-v
- linker_flags=-v
- verstring=
- output_objdir=.
- libname=conftest
- save_allow_undefined_flag=$allow_undefined_flag
- allow_undefined_flag=
- if { (eval echo ltcf-c.sh:need_lc: \"$archive_cmds\") 1>&5; (eval $archive_cmds) 2>&1 | grep " -lc " 1>&5 ; }; then
- need_lc=no
- fi
- allow_undefined_flag=$save_allow_undefined_flag
- else
- cat conftest.err 1>&5
- fi
- fi
- $rm conftest*
- echo "$ac_t$need_lc" 1>&6
- ;;
- esac
-fi
-ac_cv_archive_cmds_needs_lc=$need_lc
0 beshort 0x0206 ALAN game data
>2 byte <10 version 2.6%d
-# Conflicts with too much other stuff!
-# Infocom
-# (Note: to avoid false matches Z-machine version 1 and 2 are not
-# recognized since only the oldest Zork I and II used them. Similarly
-# there are 4 Infocom games that use version 4 that are not recognized.)
-#0 byte 3 Infocom game data (Z-machine 3,
-#>2 beshort <0x7fff Release %3d,
-#>26 beshort >0 Size %d*2
-#>18 string >\0 Serial %.6s)
-#0 byte 5 Infocom game data (Z-machine 5,
-#>2 beshort <0x7fff Release %3d,
-#>26 beshort >0 Size %d*4
-#>18 string >\0 Serial %.6s)
-#0 byte 6 Infocom game data (Z-machine 6,
-#>2 beshort <0x7fff Release %3d,
-#>26 beshort >0 Size %d*8
-#>18 string >\0 Serial %.6s)
-#0 byte 8 Infocom game data (Z-machine 8,
-#>2 beshort <0x7fff Release %3d,
-#>26 beshort >0 Size %d*8
-#>18 string >\0 Serial %.6s)
+
+# Infocom (see z-machine)
+#------------------------------------------------------------------------------
+# Z-machine: file(1) magic for Z-machine binaries.
+#
+# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
+# appears to be a version-0 Z-machine binary.
+#
+# The (false match) message is to correct that behavior. Perhaps it is
+# not needed.
+#
+16 belong&0xfe00f0f0 0x3030 Infocom game data
+>0 ubyte 0 (false match)
+>0 ubyte >0 (Z-machine %d,
+>>2 ubeshort x Release %d /
+>>18 string >\0 Serial %.6s)
+
+#------------------------------------------------------------------------------
+# Glulx: file(1) magic for Glulx binaries.
+#
+# I haven't checked for false matches yet.
+#
+0 string Glul Glulx game data
+>4 beshort x (Version %d
+>>6 byte x \b.%d
+>>8 byte x \b.%d)
+>36 string Info Compiled by Inform
+
+
+
+# For Quetzal and blorb magic see iff
+
# TADS (Text Adventure Development System)
# All files are machine-independent (games compile to byte-code) and are tagged
>10 belong !0x0A0D1A00 saved game data, CORRUPTED
>10 belong 0x0A0D1A00
>>14 string >\0 %s saved game data
+
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
+# SGI and Apple formats
+0 string MOVI Silicon Graphics movie file
+4 string moov Apple QuickTime
+>12 string mvhd \b movie (fast start)
+>12 string mdra \b URL
+>12 string cmov \b movie (fast start, compressed header)
+>12 string rmra \b multiple URLs
+4 string mdat Apple QuickTime movie (unoptimized)
+4 string wide Apple QuickTime movie (unoptimized)
+4 string skip Apple QuickTime movie (modified)
+4 string free Apple QuickTime movie (modified)
+4 string idsc Apple QuickTime image (fast start)
+4 string idat Apple QuickTime image (unoptimized)
+4 string pckg Apple QuickTime compressed archive
+4 string/B jP JPEG 2000 image
+4 string ftyp ISO Media
+>8 string isom \b, MPEG v4 system, version 1
+>8 string iso2 \b, MPEG v4 system, part 12 revision
+>8 string mp41 \b, MPEG v4 system, version 1
+>8 string mp42 \b, MPEG v4 system, version 2
+>8 string mp7t \b, MPEG v4 system, MPEG v7 XML
+>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
+>8 string/B jp2 \b, JPEG 2000
+>8 string 3gp \b, MPEG v4 system, 3GPP
+>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
+>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
+>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
+>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
+>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
+>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
+>8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted
+>8 string/B M4B \b, MPEG v4 system, iTunes bookmarked
+>8 string/B qt \b, Apple QuickTime movie
+
# MPEG sequences
# Scans for all common MPEG header start codes
+0 belong 0x00000001 JVT NAL sequence
+>4 byte&0x1F 0x07 \b, H.264 video
+>>5 byte 66 \b, baseline
+>>5 byte 77 \b, main
+>>5 byte 88 \b, extended
+>>7 byte x \b @ L %u
0 belong&0xFFFFFF00 0x00000100 MPEG sequence
>3 byte 0xBA
>>4 byte &0x40 \b, v2, program multiplex
>>4 byte ^0x40 \b, v1, system multiplex
>3 byte 0xBB \b, v1/2, multiplex (missing pack header)
+>3 byte&0x1F 0x07 \b, H.264 video
+>>4 byte 66 \b, baseline
+>>4 byte 77 \b, main
+>>4 byte 88 \b, extended
+>>6 byte x \b @ L %u
>3 byte 0xB0 \b, v4
>>5 belong 0x000001B5
>>>9 byte &0x80
>>>>10 byte&0xF0 32 \b, still texture
>>>>10 byte&0xF0 48 \b, mesh
>>>>10 byte&0xF0 64 \b, face
->>>9 byte ^0x80
->>>>9 byte&0xF8 8 \b, video
->>>>9 byte&0xF8 16 \b, still texture
->>>>9 byte&0xF8 24 \b, mesh
->>>>9 byte&0xF8 32 \b, face
+>>>9 byte&0xF8 8 \b, video
+>>>9 byte&0xF8 16 \b, still texture
+>>>9 byte&0xF8 24 \b, mesh
+>>>9 byte&0xF8 32 \b, face
>>4 byte 1 \b, simple @ L1
>>4 byte 2 \b, simple @ L2
>>4 byte 3 \b, simple @ L3
>>>5 byte&0xF0 32 \b, still texture (missing profile header)
>>>5 byte&0xF0 48 \b, mesh (missing profile header)
>>>5 byte&0xF0 64 \b, face (missing profile header)
->>4 byte ^0x80
->>>4 byte&0xF8 8 \b, video (missing profile header)
->>>4 byte&0xF8 16 \b, still texture (missing profile header)
->>>4 byte&0xF8 24 \b, mesh (missing profile header)
->>>4 byte&0xF8 32 \b, face (missing profile header)
+>>4 byte&0xF8 8 \b, video (missing profile header)
+>>4 byte&0xF8 16 \b, still texture (missing profile header)
+>>4 byte&0xF8 24 \b, mesh (missing profile header)
+>>4 byte&0xF8 32 \b, face (missing profile header)
>3 byte 0xB3
>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
->>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
->>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
->>>76 belong 0x000001B5 \b, v2,
->>>80 byte&0x0F 1 \b HP
->>>80 byte&0x0F 2 \b Spt
->>>80 byte&0x0F 3 \b SNR
->>>80 byte&0x0F 4 \b MP
->>>80 byte&0x0F 5 \b SP
->>>81 byte&0xF0 64 \b@HL
->>>81 byte&0xF0 96 \b@H-14
->>>81 byte&0xF0 128 \b@ML
->>>81 byte&0xF0 160 \b@LL
->>>81 byte &0x08 \b progressive
->>>81 byte ^0x08 \b interlaced
->>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
->>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
->>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
+>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
+>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
+>>76 belong 0x000001B5 \b, v2,
+>>>80 byte&0x0F 1 \b HP
+>>>80 byte&0x0F 2 \b Spt
+>>>80 byte&0x0F 3 \b SNR
+>>>80 byte&0x0F 4 \b MP
+>>>80 byte&0x0F 5 \b SP
+>>>81 byte&0xF0 64 \b@HL
+>>>81 byte&0xF0 96 \b@H-14
+>>>81 byte&0xF0 128 \b@ML
+>>>81 byte&0xF0 160 \b@LL
+>>>81 byte &0x08 \b progressive
+>>>81 byte ^0x08 \b interlaced
+>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
+>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
+>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
>>>7 byte&0xF0 0x10 \b, 16:9
>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M1A
0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# MPA, M1A
0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP3, M2A
0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M2A
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# MPA, M2A
0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP3, M25A
0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
-#>1 byte ^0x01 \b, Data Verify
-#>2 byte &0x02 \b, Packet Pad
-#>2 byte &0x01 \b, Custom Flag
-#>3 byte &0x08 \b, Copyrighted
-#>3 byte &0x04 \b, Original Source
-#>3 byte&0x03 1 \b, NR: 50/15 ms
-#>3 byte&0x03 3 \b, NR: CCIT J.17
+#>1 byte ^0x01 \b, Data Verify
+#>2 byte &0x02 \b, Packet Pad
+#>2 byte &0x01 \b, Custom Flag
+#>3 byte &0x08 \b, Copyrighted
+#>3 byte &0x04 \b, Original Source
+#>3 byte&0x03 1 \b, NR: 50/15 ms
+#>3 byte&0x03 3 \b, NR: CCIT J.17
# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
# Live or stored single AAC stream (used with MPEG-2 systems)
0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
->1 byte ^0x08 \b, v2
->1 byte &0x08 \b, v4
+>1 byte &0x08 \b, v2
+>1 byte ^0x08 \b, v4
# profile
>>2 byte &0xC0 \b LTP
->2 byte&0xc0 0x00 \b, Main
->2 byte&0xc0 0x40 \b, LC
->2 byte&0xc0 0x80 \b, SSR
+>2 byte&0xc0 0x00 \b Main
+>2 byte&0xc0 0x40 \b LC
+>2 byte&0xc0 0x80 \b SSR
# timing
>2 byte&0x3c 0x00 \b, 96 kHz
>2 byte&0x3c 0x04 \b, 88.2 kHz
>2 byte&0x3c 0x24 \b, 12 kHz
>2 byte&0x3c 0x28 \b, 11.025 kHz
>2 byte&0x3c 0x2c \b, 8 kHz
-# channels/options
+# channels
>2 beshort&0x01c0 0x0040 \b, monaural
>2 beshort&0x01c0 0x0080 \b, stereo
>2 beshort&0x01c0 0x00c0 \b, stereo + center
# \003. Most of them start with non-null values at hex offset 0x34 or so.
#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
-# SGI formats
-0 string MOVI Silicon Graphics movie file
-
-# Apple Quicktime and ISO types
-4 string moov Apple QuickTime
->12 string mvhd \b movie (fast start)
->12 string mdra \b URL
->12 string cmov \b movie (fast start, compressed header)
->12 string rmra \b multiple URLs
-4 string mdat Apple QuickTime movie (unoptimized)
-4 string wide Apple QuickTime movie (unoptimized)
-4 string skip Apple QuickTime movie (modified)
-4 string free Apple QuickTime movie (modified)
-4 string idsc Apple QuickTime image (fast start)
-4 string idat Apple QuickTime image (unoptimized)
-4 string pckg Apple QuickTime compressed archive
-4 string/B jP JPEG 2000 image
-4 string ftyp ISO Media
->8 string isom \b, MPEG v4 system
->8 string mp41 \b, MPEG v4 system, version 1
->8 string mp42 \b, MPEG v4 system, version 2
->8 string/B jp2 \b, JPEG 2000 image
->8 string 3gp \b, MPEG v4 system, 3GPP (H.263/AMR)
->8 string mmp4 \b, MPEG v4 system, Mobile
->8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
->8 string/B M4P \b, MPEG v4 system, ISMA encrypted AAC-LC
->8 string/B M4B \b, MPEG v4 system, iTunes AAC-LC/AMR
->8 string/B qt \b, Apple QuickTime movie
-
# iso 13818 transport stream
#
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
>0x26 ubeshort x %dµs,
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio
+
+# From: "Stefan A. Haubenthal" <polluks@web.de>
+0 string DVDVIDEO-VTS Video title set,
+>0x21 byte x v%x
+0 string DVDVIDEO-VMG Video manager,
+>0x21 byte x v%x
# information seems to be more useful.
#0 long 0x45520200
#>0x410 string disk\ image UDIF read/write image (UDRW)
+
+# From: Toby Peterson <toby@apple.com>
+0 string bplist00 Apple binary property list
# Debian package (needs to go before regular portable archives)
#
-0 string !<arch>\ndebian
+0 string
=!<arch>\ndebian
>8 string debian-split part of multipart Debian package
>8 string debian-binary Debian binary package
>68 string >\0 (format %s)
# MIPS archive (needs to go before regular portable archives)
#
-0 string !<arch>\n__________E MIPS archive
+0 string =!<arch>\n__________E MIPS archive
>20 string U with MIPS Ucode members
>21 string L with MIPSEL members
>21 string B with MIPSEB members
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
-# 0 string !<arch> current ar archive
+# 0 string =!<arch> current ar archive
# 0 long 0x213c6172 archive file
#
# and for SVR1 archives, we have:
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
-0 string !<arch> current ar archive
+0 string =!<arch> current ar archive
>8 string __.SYMDEF random library
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
+# [JW] stuff taken from idarc, obviously ARC successors:
+0 lelong&0x8080ffff 0x00000a1a PAK archive data
+0 lelong&0x8080ffff 0x0000141a ARC+ archive data
+0 lelong&0x8080ffff 0x0000481a HYP archive data
# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
0 string \032 RISC OS archive (spark format)
0 string Archive\000 RISC OS archive (ArcFS format)
+# All these were taken from idarc, many could not be verified. Unfortunately,
+# there were many low-quality sigs, i.e. easy to trigger false positives.
+# Please notify me of any real-world fishy/ambiguous signatures and I'll try
+# to get my hands on the actual archiver and see if I find something better. [JW]
+# probably many can be enhanced by finding some 0-byte or control char near the start
+
+# idarc calls this Crush/Uncompressed... *shrug*
+0 string CRUSH Crush archive data
+# Squeeze It (.sqz)
+0 string HLSQZ Squeeze It archive data
+# SQWEZ
+0 string SQWEZ SQWEZ archive data
+# HPack (.hpk)
+0 string HPAK HPack archive data
+# HAP
+0 string \x91\x33HF HAP archive data
+# MD/MDCD
+0 string MDmd MDCD archive data
+# LIM
+0 string LIM\x1a LIM archive data
+# SAR
+3 string LH5 SAR archive data
+# BSArc/BS2
+0 string \212\3SB \0 BSArc/BS2 archive data
+# MAR
+2 string =-ah MAR archive data
+# ACB
+0 belong&0x00f800ff 0x00800000 ACB archive data
+# CPZ
+# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
+# JRC
+0 string JRchive JRC archive data
+# Quantum
+0 string DS\0 Quantum archive data
+# ReSOF
+0 string PK\3\6 ReSOF archive data
+# QuArk
+0 string 7\4 QuArk archive data
+# YAC
+14 string YC YAC archive data
+# X1
+0 string X1 X1 archive data
+0 string XhDr X1 archive data
+# CDC Codec (.dqt)
+0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
+# AMGC
+0 string \xad6" AMGC archive data
+# NuLIB
+0 string NõFélå NuLIB archive data
+# PakLeo
+0 string LEOLZW PAKLeo archive data
+# ChArc
+0 string SChF ChArc archive data
+# PSA
+0 string PSA PSA archive data
+# CrossePAC
+0 string DSIGDCC CrossePAC archive data
+# Freeze
+0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
+# KBoom
+0 string ¨MP¨ KBoom archive data
+# NSQ, must go after CDC Codec
+0 string \x76\xff NSQ archive data
+# DPA
+0 string Dirk\ Paehl DPA archive data
+# BA
+# TODO: idarc says "bytes 0-2 == bytes 3-5"
+# TTComp
+0 string \0\6 TTComp archive data
+# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
+0 string ESP ESP archive data
+# ZPack
+0 string \1ZPK\1 ZPack archive data
+# Sky
+0 string \xbc\x40 Sky archive data
+# UFA
+0 string UFA UFA archive data
+# Dry
+0 string =-H2O DRY archive data
+# FoxSQZ
+0 string FOXSQZ FoxSQZ archive data
+# AR7
+0 string ,AR7 AR7 archive data
+# PPMZ
+0 string PPMZ PPMZ archive data
+# MS Compress
+4 string \x88\xf0\x27 MS Compress archive data
+# MP3 (archiver, not lossy audio compression)
+0 string MP3\x1a MP3-Archiver archive data
+# ZET
+0 string OZÝ ZET archive data
+# TSComp
+0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
+# ARQ
+0 string gW\4\1 ARQ archive data
+# Squash
+3 string OctSqu Squash archive data
+# Terse
+0 string \5\1\1\0 Terse archive data
+# PUCrunch
+0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
+# UHarc
+0 string UHA UHarc archive data
+# ABComp
+0 string \2AB ABComp archive data
+0 string \3AB2 ABComp archive data
+# CMP
+0 string CO\0 CMP archive data
+# Splint
+0 string \x93\xb9\x06 Splint archive data
+# InstallShield
+0 string \x13\x5d\x65\x8c InstallShield Z archive Data
+# Gather
+1 string GTH Gather archive data
+# BOA
+0 string BOA BOA archive data
+# RAX
+0 string ULEB\xa RAX archive data
+# Xtreme
+0 string ULEB\0 Xtreme archive data
+# Pack Magic
+0 string @â\1\0 Pack Magic archive data
+# BTS
+0 belong&0xfeffffff 0x1a034465 BTS archive data
+# ELI 5750
+0 string Ora\ ELI 5750 archive data
+# QFC
+0 string \x1aFC\x1a QFC archive data
+0 string \x1aQF\x1a QFC archive data
+# PRO-PACK
+0 string RNC PRO-PACK archive data
+# 777
+0 string 777 777 archive data
+# LZS221
+0 string sTaC LZS221 archive data
+# HPA
+0 string HPA HPA archive data
+# Arhangel
+0 string LG Arhangel archive data
+# EXP1, uses bzip2
+0 string 0123456789012345BZh EXP1 archive data
+# IMP
+0 string IMP\xa IMP archive data
+# NRV
+0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
+# Squish
+0 string \x73\xb2\x90\xf4 Squish archive data
+# Par
+0 string PHILIPP Par archive data
+0 string PAR Par archive data
+# HIT
+0 string UB HIT archive data
+# SBX
+0 belong&0xfffff000 0x53423000 SBX archive data
+# NaShrink
+0 string NSK NaShrink archive data
+# SAPCAR
+0 string #\ CAR\ archive\ header SAPCAR archive data
+0 string CAR\ 2.00RG SAPCAR archive data
+# Disintegrator
+0 string DST Disintegrator archive data
+# ASD
+0 string ASD ASD archive data
+# InstallShield CAB
+0 string ISc( InstallShield CAB
+# TOP4
+0 string T4\x1a TOP4 archive data
+# BatComp left out: sig looks like COM executable
+# so TODO: get real 4dos batcomp file and find sig
+# BlakHole
+0 string BH\5\7 BlakHole archive data
+# BIX
+0 string BIX0 BIX archive data
+# ChiefLZA
+0 string ChfLZ ChiefLZA archive data
+# Blink
+0 string Blink Blink archive data
+# Logitech Compress
+0 string \xda\xfa Logitech Compress archive data
+# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
+1 string (C)\ STEPANYUK ARS-Sfx archive data
+# AKT/AKT32
+0 string AKT32 AKT32 archive data
+0 string AKT AKT archive data
+# NPack
+0 string MSTSM NPack archive data
+# PFT
+0 string \0\x50\0\x14 PFT archive data
+# SemOne
+0 string SEM SemOne archive data
+# PPMD
+0 string \x8f\xaf\xac\x84 PPMD archive data
+# FIZ
+0 string FIZ FIZ archive data
+# MSXiE
+0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
+# DeepFreezer
+0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
+# DC
+0 string =<DC- DC archive data
+# TPac
+0 string \4TPAC\3 TPac archive data
+# Ai
+0 string Ai\1\1\0 Ai archive data
+0 string Ai\1\0\0 Ai archive data
+# Ai32
+0 string Ai\2\0 Ai32 archive data
+0 string Ai\2\1 Ai32 archive data
+# SBC
+0 string SBC SBC archive data
+# Ybs
+0 string YBS Ybs archive data
+# DitPack
+0 string \x9e\0\0 DitPack archive data
+# DMS
+0 string DMS! DMS archive data
+# EPC
+0 string \x8f\xaf\xac\x8c EPC archive data
+# VSARC
+0 string VS\x1a VSARC archive data
+# PDZ
+0 string PDZ PDZ archive data
+# ReDuq
+0 string rdqx ReDuq archive data
+# GCA
+0 string GCAX GCA archive data
+# PPMN
+0 string pN PPMN archive data
+# WinImage
+3 string WINIMAGE WinImage archive data
+# Compressia
+0 string CMP0CMP Compressia archive data
+# UHBC
+0 string UHB UHBC archive data
+# WinHKI
+0 string \x61\x5C\x04\x05 WinHKI archive data
+# WWPack data file
+0 string WWP WWPack archive data
+# BSN (BSA, PTS-DOS)
+0 string \xffBSG BSN archive data
+1 string \xffBSG BSN archive data
+3 string \xffBSG BSN archive data
+1 string \0\xae\2 BSN archive data
+1 string \0\xae\3 BSN archive data
+1 string \0\xae\7 BSN archive data
+# AIN
+0 string \x33\x18 AIN archive data
+0 string \x33\x17 AIN archive data
+# XPA32
+0 string xpa\0\1 XPA32 archive data
+# SZip (TODO: doesn't catch all versions)
+0 string SZ\x0a\4 SZip archive data
+# XPack DiskImage
+0 string jm XPack DiskImage archive data
+# XPack Data
+0 string xpa XPack archive data
+# XPack Single Data
+0 string Í\ jm XPack single archive data
+
+# TODO: missing due to unknown magic/magic at end of file:
+#DWC
+#ARG
+#ZAR
+#PC/3270
+#InstallIt
+#RKive
+#RK
+#XPack Diskimage
+
+# These were inspired by idarc, but actually verified
+# Dzip archiver (.dz)
+0 string DZ Dzip archive data
+>2 byte x \b, version %i
+>3 byte x \b.%i
+# ZZip archiver (.zz)
+0 string ZZ\ \0\0 ZZip archive data
+0 string ZZ0 ZZip archive data
+# PAQ archiver (.paq)
+0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
+0 string PAQ PAQ archive data
+>3 byte&0xf0 0x30
+>>3 byte x (v%c)
+# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
+0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
+0 string JARCS JAR (ARJ Software, Inc.) archive data
+
# ARJ archiver (jason@jarthur.Claremont.EDU)
0 leshort 0xea60 ARJ archive data
>5 byte x \b, v%d,
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
+# [JW] idarc says this is also possible
+2 leshort 0xea60 ARJ archive data
# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#>4 byte&0x0f =2 first is type HSC
#>4 byte&0x0f =0x0e first is type DIR
#>4 byte&0x0f =0x0f first is type SPECIAL
+# suggestion: at least identify small archives (<1024 files)
+0 belong&0xffff00fc 0x48410000 HA archive data
+>2 leshort =1 1 file,
+>2 leshort >1 %u files,
+>4 byte&0x0f =0 first is type CPY
+>4 byte&0x0f =1 first is type ASC
+>4 byte&0x0f =2 first is type HSC
+>4 byte&0x0f =0x0e first is type DIR
+>4 byte&0x0f =0x0f first is type SPECIAL
# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0 string HPAK HPACK archive data
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
-2 string -lh0- LHarc 1.x archive data [lh0]
-2 string -lh1- LHarc 1.x archive data [lh1]
+2 string -lh0- LHarc 1.x/ARX archive data [lh0]
+2 string -lh1- LHarc 1.x/ARX archive data [lh1]
2 string -lz4- LHarc 1.x archive data [lz4]
2 string -lz5- LHarc 1.x archive data [lz5]
# [never seen any but the last; -lh4- reported in comp.compression:]
-2 string -lzs- LHa 2.x? archive data [lzs]
+2 string -lzs- LHa/LZS archive data [lzs]
2 string -lh\40- LHa 2.x? archive data [lh ]
2 string -lhd- LHa 2.x? archive data [lhd]
2 string -lh2- LHa 2.x? archive data [lh2]
2 string -lh4- LHa (2.x) archive data [lh4]
2 string -lh5- LHa (2.x) archive data [lh5]
2 string -lh6- LHa (2.x) archive data [lh6]
-2 string -lh7- LHa (2.x) archive data [lh7]
+2 string -lh7- LHa (2.x)/LHark archive data [lh7]
>20 byte x - header level %d
+# taken from idarc [JW]
+2 string -lZ PUT archive data
+2 string -lz LZS archive data
+2 string -sw1- Swag archive data
# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0 string Rar! RAR archive data,
>35 byte 1 os: OS/2
>35 byte 2 os: Win32
>35 byte 3 os: Unix
+# some old version? idarc says:
+0 string RE\x7e\x5e RAR archive data
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0 string SQSH squished archive data (Acorn RISCOS)
# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
-# I can't figure out the self-extracting form of these buggers...
+# [JW] see exe section for self-extracting version
0 string UC2\x1a UC2 archive data
# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
# by Stefan `Sec` Zehl <sec@42.org>
-7 string **ACE** ACE compressed archive
+7 string **ACE** ACE archive data
>15 byte >0 version %d
>16 byte =0x00 \b, from MS-DOS
>16 byte =0x01 \b, from OS/2
>>0x1 string >\0 Version %s
>>0x2A string >\0 : %s
+# DR-DOS 7.03 Packed File *.??_
+0 string Packed\ File\ Personal NetWare Packed File
+>12 string x \b, was "%.12s"
+
+# EET archive
+# From: Tilman Sauerbeck <tilman@code-monkey.de>
+0 belong 0x1ee7ff00 EET archive
0 string Extended\ Module: Fasttracker II module sound data
>17 string >\0 Title: "%s"
-21 string/c !SCREAM! Screamtracker 2 module sound data
+21 string/c =!SCREAM! Screamtracker 2 module sound data
21 string BMOD2STM Screamtracker 2 module sound data
1080 string M.K. 4-channel Protracker module sound data
>0 string >\0 Title: "%s"
>12 lelong >0 samplerate %d,
>24 lelong >0 frames %d
+# adlib sound files
+# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
+0 string RAWADATA RdosPlay RAW
+
+1068 string RoR AMUSIC Adlib Tracker
+
+0 string JCH EdLib
+
+0 string mpu401tr MPU-401 Trakker
+
+0 string SAdT Surprise! Adlib Tracker
+>4 byte x Version %d
+
+0 string XAD! eXotic ADlib
+
+0 string ofTAZ! eXtra Simple Music
>16 long >0 not stripped
#
# b.out archive (hp-rt on i960)
-0 string !<bout> b.out archive
+0 string =!<bout> b.out archive
>8 string __.SYMDEF random library
>4 belong 0x090A0C0C very good compression
>4 belong 0x090A0C0D best compression
-# 7z archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
+# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# http://www.7-zip.org or DOC/7zFormat.txt
#
-0 string 7z\274\257\047\034 7z archive data,
+0 string 7z\274\257\047\034 7-zip archive data,
>6 byte x version %d
>7 byte x \b.%d
>2 beshort x RAM start $%04x
>6 string BS93
-#------------------------------------------------------------------------------
-# Z-machine: file(1) magic for Z-machine binaries.
-#
-# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
-# appears to be a version-0 Z-machine binary.
-#
-# The (false match) message is to correct that behavior. Perhaps it is
-# not needed.
-#
->16 belong&0xfe00f0f0 0x3030 Infocom game data
->0 ubyte 0 (false match)
->0 ubyte >0 (Z-machine %d,
->>2 ubeshort x Release %d /
->>18 string >\0 Serial %.6s)
-
-#------------------------------------------------------------------------------
-# Glulx: file(1) magic for Glulx binaries.
-#
-# I haven't checked for false matches yet.
-#
-0 string Glul Glulx game data
-
-# These go at the end of the iff rules
-#
-# I don't see why these might collide with anything else.
-#
-# Interactive Fiction related formats
-#
->8 string IFRS \b, Blorb Interactive Fiction
->>24 string Exec with executable chunk
->8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
# ----------------------------------------------------------------------------
# ctags: file (1) magic for Exuberant Ctags files
# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
-0 string !_TAG Exuberant Ctags tag file text
+0 string =!_TAG Exuberant Ctags tag file text
>16 belong >0 (Queue, version %d, big-endian)
12 lelong 0x00042253 Berkeley DB
>16 lelong >0 (Queue, version %d, little-endian)
+
+# From Max Bowsher.
+12 long 0x00040988 Berkeley DB
+>16 long >0 (Log, version %d, native byte-order)
+12 belong 0x00040988 Berkeley DB
+>16 belong >0 (Log, version %d, big-endian)
+12 lelong 0x00040988 Berkeley DB
+>16 lelong >0 (Log, version %d, little-endian)
+
#
#
# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
# Digital UNIX - Info
#
-0 string !<arch>\n________64E Alpha archive
+0 string =!<arch>\n________64E Alpha archive
>22 string X -- out of date
#
# Alpha COFF Based Executables
0 string \033c\033 LN03 output
0 long 04553207 X image
#
-0 string !<PDF>!\n profiling data file
+0 string =!<PDF>!\n profiling data file
#
# Locale data tables (MIPS and Alpha).
#
>0770 long x %ld blocks
# Is there a boot block written 1 sector in?
>512 belong&077777777 0600407 \b, boot block present
+# DOS Emulator image is 128 byte header + harddisc image
+0 string DOSEMU\0
+>0x27E leshort 0xAA55 DOS Emulator image
0x1FE leshort 0xAA55 x86 boot sector
>2 string OSBS \b, OS/BS MBR
# J\xf6rg Jenderek <joerg.jenderek@gmx.net>
>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
->0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03
+# dr-dos with some upper-, lowercase variants
+>0x9D string Invalid\ partition\ table$
+>>181 string No\ Operating\ System$
+>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
+>0x9D string Invalid\ partition\ table$
+>>181 string No\ operating\ system$
+>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
+>342 string Invalid\ partition\ table$
+>>366 string No\ operating\ system$
+>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
+>295 string NEWLDR\0
+>>302 string Bad\ PT\ $
+>>>310 string No\ OS\ $
+>>>>317 string OS\ load\ err$
+>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
+>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
+>>>>>>>387 string Copyright\ (c)\ 1984,1998
+>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
->0x145 string Default:\ F \b, FREE-DOS MBR
+>300 string Invalid\ partition\ table\0
+>>324 string Error\ loading\ operating\ system\0
+>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
+#??>>>389 string Invalid\ system\ disk
+>300 string Ung\201ltige\ Partitionstabelle
+#split string to avoid error: String too long
+>>328 string Fehler\ beim\ Laden\
+>>>346 string des\ Betriebssystems
+>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
+>0x145 string Default:\ F \b, FREE-DOS MBR
+>64 string no\ active\ partition\ found
+>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta9 MBR
+# bootloader, bootmanager
+>43 string SMART\ BTMGRFAT12\ \ \
+>>430 string SBMK\ Bad!\r
+>>>3 string SBM \b, Smart Boot Manager
+>>>>6 string >\0 \b, version %s
+>382 string XOSLLOADXCF \b, EXtended Operating System Loader
+>6 string LILO \b, LInux i386 boot LOader
+>>120 string LILO \b, version 22.3.4 SuSe
+>>172 string LILO \b, version 22.5.8 Debian
+>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
+>>394 string stage1 \b, GRand Unified Bootloader (0.5.95)
+>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
+>>374 string GRUB\ \0 \b, GRand Unified Bootloader
+>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
+>>376 string GRUB\ \0 \b, GRand Unified Bootloader (0.93)
+>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
+>>377 string GRUB\ \0 \b, GRand Unified Bootloader (0.94)
+>480 string Boot\ failed\r
+>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06)
+>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
+>185 string FDBOOT\ Version\
+>>204 string \rNo\ Systemdisk.\
+>>>220 string Booting\ from\ harddisk.\n\r
+>>>245 string Cannot\ load\ from\ harddisk.\n\r
+>>>>273 string Insert\ Systemdisk\
+>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
+>>>>>>200 string >\0 \b, version %-3s
+>242 string Bootsector\ from\ C.H.\ Hochst\204
+>>278 string No\ Systemdisk.\
+>>>293 string Booting\ from\ harddisk.\n\r
+>>>441 string Cannot\ load\ from\ harddisk.\n\r
+>>>>469 string Insert\ Systemdisk\
+>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
+>>>>>>209 string >\0 \b, version %-4.4s
+>(1.b+2) ubyte 0xe
+>>(1.b+3) ubyte 0x1f
+>>>(1.b+4) ubyte 0xbe
+>>>>(1.b+5) ubyte 0x77
+>>>>(1.b+6) ubyte 0x7c
+>>>>>(1.b+7) ubyte 0xac
+>>>>>>(1.b+8) ubyte 0x22
+>>>>>>>(1.b+9) ubyte 0xc0
+>>>>>>>>(1.b+10) ubyte 0x74
+>>>>>>>>>(1.b+11) ubyte 0xb
+>>>>>>>>>>(1.b+12) ubyte 0x56
+>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
+# XP
+>430 string NTLDR\ is\ missing\xFF\r\n
+>>449 string Disk\ error\xFF\r\n
+>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
+# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
+>>>>417 ubyte <0x7E
+>>>>>417 string >\ %-.5s
+>>>>>>422 ubyte <0x7E
+>>>>>>>422 string >\ \b%-.3s
+>>>>>>425 string >\ \b.%-.3s
+#
+>>>>368 ubyte <0x7E
+>>>>>368 string >\ %-.5s
+>>>>>>373 ubyte <0x7E
+>>>>>>>373 string >\ \b%-.3s
+>>>>>>376 string >\ \b.%-.3s
+#
+>430 string NTLDR\ nicht\ gefunden\xFF\r\n
+>>453 string Datentr\204gerfehler\xFF\r\n
+>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
+>>>>417 ubyte <0x7E
+>>>>>417 string >\ %-.5s
+>>>>>>422 ubyte <0x7E
+>>>>>>>422 string >\ \b%-.3s
+>>>>>>425 string >\ \b.%-.3s
+#
+>>>>368 ubyte <0x7E
+>>>>>368 string >\ %-.5s
+>>>>>>373 ubyte <0x7E
+>>>>>>>373 string >\ \b%-.3s
+>>>>>>376 string >\ \b.%-.3s
+#
+>430 string NTLDR\ fehlt\xFF\r\n
+>>444 string Datentr\204gerfehler\xFF\r\n
+>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
+>>>>417 ubyte <0x7E
+>>>>>417 string >\ %-.5s
+>>>>>>422 ubyte <0x7E
+>>>>>>>422 string >\ \b%-.3s
+>>>>>>425 string >\ \b.%-.3s
+#
+>430 string NTLDR\ fehlt\xFF\r\n
+>>444 string Medienfehler\xFF\r\n
+>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
+>>>>368 ubyte <0x7E
+>>>>>368 string >\ %-.5s
+>>>>>>373 ubyte <0x7E
+>>>>>>>373 string >\ \b%-.3s
+>>>>>>376 string >\ \b.%-.3s
+>>>>417 ubyte <0x7E
+>>>>>417 string >\ %-.5s
+>>>>>>422 ubyte <0x7E
+>>>>>>>422 string >\ \b%-.3s
+>>>>>>425 string >\ \b.%-.3s
+#
+>430 string Datentr\204ger\ entfernen\xFF\r\n
+>>454 string Medienfehler\xFF\r\n
+>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
+>>>>368 ubyte <0x7E
+>>>>>368 string >\ %-.5s
+>>>>>>373 ubyte <0x7E
+>>>>>>>373 string >\ \b%-.3s
+>>>>>>376 string >\ \b.%-.3s
+#>3 string NTFS\ \ \ \
+>389 string Fehler\ beim\ Lesen\
+>>407 string des\ Datentr\204gers
+>>>426 string NTLDR\ fehlt
+>>>>440 string NTLDR\ ist\ komprimiert
+>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
+#>3 string NTFS\ \ \ \
+>313 string A\ disk\ read\ error\ occurred.\r
+>>345 string A\ kernel\ file\ is\ missing\
+>>>370 string from\ the\ disk.\r
+>>>>484 string NTLDR\ is\ compressed
+>>>>>429 string Insert\ a\ system\ diskette\
+>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
+# DOS loader variants different languages,offsets
+>472 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
+>>497 string WINBOOT\ SYS
+>>389 string Invalid\ system\ disk\xFF\r\n
+>>>411 string Disk\ I/O\ error
+>>>>428 string Replace\ the\ disk,\ and\
+>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
+#
+>>390 string Invalid\ system\ disk\xFF\r\n
+>>>412 string Disk\ I/O\ error\xFF\r\n
+>>>>429 string Replace\ the\ disk,\ and\
+>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
+>>388 string Ungueltiges\ System\ \xFF\r\n
+>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>427 string Datentraeger\ wechseln\ und\
+>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
+#
+>>390 string Ungueltiges\ System\ \xFF\r\n
+>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>429 string Datentraeger\ wechseln\ und\
+>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
+#
+>>389 string Ungueltiges\ System\ \xFF\r\n
+>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
+>>>>428 string Datentraeger\ wechseln\ und\
+>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
+>479 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
+>>416 string Kein\ System\ oder\
+>>>433 string Laufwerksfehler
+>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
+>486 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
+>>416 string Non-System\ disk\ or\
+>>>435 string disk\ error\r
+>>>>447 string Replace\ and\ press\ any\ key\
+>>>>>473 string when\ ready\r \b, Microsoft DOS Bootloader
+>480 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS
+>>393 string Non-System\ disk\ or\
+>>>412 string disk\ error\r
+>>>>424 string Replace\ and\ press\ any\ key\
+>>>>>450 string when\ ready\r \b, Microsoft DOS bootloader
+#>43 string \224R-LOADER\ \ SYS =label
+>54 string SYS
+>>324 string VASKK
+>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
+#
+>70 string IBMBIO\ \ COM
+>>472 string Cannot\ load\ DOS!\
+>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
+>>471 string Cannot\ load\ DOS\
+>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
+>444 string KERNEL\ \ SYS
+>>314 string BOOT\ error! \b, FREE-DOS Bootloader
+>499 string KERNEL\ \ SYS
+>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
+>449 string KERNEL\ \ SYS
+>>319 string BOOT\ error! \b, FREE-DOS 5.0 Bootloader
+>124 string FreeDOS\0
+>>331 string \ err\0 \b, FREE-DOS BETa 9 Bootloader
+# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
+>>>497 string >\ %-.6s
+>>>>503 string >\ \b%-.1s
+>>>>504 string >\ \b%-.1s
+>>>505 string >\ \b.%-.3s
+>>333 string \ err\0 \b, FREE-DOS BEta 9 Bootloader
+>>>497 string >\ %-.6s
+>>>>503 string >\ \b%-.1s
+>>>>504 string >\ \b%-.1s
+>>>505 string >\ \b.%-.3s
+>>334 string \ err\0 \b, FREE-DOS Beta 9 Bootloader
+>>>497 string >\ %-.6s
+>>>>503 string >\ \b%-.1s
+>>>>504 string >\ \b%-.1s
+>>>505 string >\ \b.%-.3s
+# loader end
>0 string \0\0\0\0 \b, extended partition table
# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
# older drives may use E9 xx xx
# JFFS2 file system
0 leshort 0x1984 Linux old jffs2 filesystem data little endian
0 lelong 0xe0011985 Linux jffs2 filesystem data little endian
+
+# Squashfs
+0 string sqsh Squashfs filesystem, big endian,
+>28 beshort x version %d.
+>30 beshort x \b%d,
+>8 belong x %d bytes,
+>4 belong x %d inodes,
+>28 beshort <2
+>>32 beshort x blocksize: %d bytes,
+>28 beshort >1
+>>51 belong x blocksize: %d bytes,
+>39 bedate x created: %s
+0 string hsqs Squashfs filesystem, little endian,
+>28 leshort x version %d.
+>30 leshort x \b%d,
+>8 lelong x %d bytes,
+>4 lelong x %d inodes,
+>28 leshort <2
+>>32 leshort x blocksize: %d bytes,
+>28 leshort >1
+>>51 lelong x blocksize: %d bytes,
+>39 ledate x created: %s
+#------------------------------------------------------------------------------
+# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
#
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0 string *nazgul* Nazgul style compiled message catalog
>8 lelong >0 \b, version %ld
+
# GnuPG
# The format is very similar to pgp
0 string \001gpg GPG key trust database
>4 byte x version %d
-0 beshort 0x9901 GPG key public ring
+0 beshort 0x8502 GPG encrypted data
# This magic is not particularly good, as the keyrings don't have true
# magic. Nevertheless, it covers many keyrings.
+0 beshort 0x9901 GPG key public ring
# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as "compressed", but at least -z helps
39 string =<gmr:Workbook Gnumeric spreadsheet
+
+# From: James Youngman <jay@gnu.org>
+# gnu find magic
+0 string \0LOCATE GNU findutils locate database data
+>7 string >\0 \b, format %s
+>7 string 02 \b (frcode)
>8 string FTXT \b, FTXT formatted text
>8 string CTLG \b, CTLG message catalog
>8 string PREF \b, PREF preferences
+
+# These go at the end of the iff rules
+#
+# I don't see why these might collide with anything else.
+#
+# Interactive Fiction related formats
+#
+>8 string IFRS \b, Blorb Interactive Fiction
+>>24 string Exec with executable chunk
+>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
# other images
0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
-0 string !! Bennet Yee's "face" format
+0 string =!! Bennet Yee's "face" format
# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
# stuff.
# From: Jason Bacon <bacon@smithers.neuro.mcw.edu>
0 beshort 0x3020 character Computer Graphics Metafile
-
+# From Marc Espie
+0 lelong 20000630 OpenEXR image data
# From: Tom Hilinski <tom.hilinski@comcast.net>
# http://www.unidata.ucar.edu/packages/netcdf/
-0 string CDF\001 netcdf file
+0 string CDF\001 NetCDF Data Format data
+#-----------------------------------------------------------------------
+# Hierarchical Data Format, used to facilitate scientific data exchange
+# specifications at http://hdf.ncsa.uiuc.edu/
+0 belong 0x0e031301 Hierarchical Data Format (version 4) data
+0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data
# The boot loaders syslinux and isolinux use a RLE based image format
# called SLL16 to store splash screens.
0 lelong 0x1413f33d Syslinux SLL16 image data,
>4 leshort >0 %hd x
>6 leshort >0 %hd
-
-
#------------------------------------------------------------
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
-0 belong 0xcafebabe compiled Java class data,
->6 beshort x version %d.
->4 beshort x \b%d
+# Handled in Mach now
+#0 belong 0xcafebabe compiled Java class data,
+#>6 beshort x version %d.
+#>4 beshort x \b%d
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
>3 byte >0 8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086 string SWAP-SPACE Linux/i386 swap file
+# From: Jeff Bailey <jbailey@ubuntu.com>
+# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
+4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
# according to man page of mkswap (8) March 1999
4086 string SWAPSPACE2 Linux/i386 swap file (new style)
>0x400 long x %d (4K pages)
#------------------------------------------------------------------------------
# mach file description
#
-0 belong 0xcafebabe Mach-O fat file
->4 belong 1 with 1 architecture
+# Since Java bytecode and Mach-O fat-files have the same magic number the test
+# must be preformed in the same "magic" sequence to get both right. The long
+# at offset 4 in a fat file tells the number of architectures. The short at
+# offset 4 in a Java bytecode file is the compiler minor version and the
+# short at offset 6 is the compiler major version. Since there are only
+# only 18 labeled Mach-O architectures at current, and the first released
+# Java class format was version 43.0, we can safely choose any number
+# between 18 and 39 to test the number of architectures against
+# (and use as a hack).
+#
+0 belong 0xcafebabe
+>4 belong >19 compiled Java class data,
+>>6 beshort x version %d.
+>>4 beshort x \b%d
+>4 belong 1 Mach-O fat file with 1 architecture
>4 belong >1
->>4 belong x with %ld architectures
+# The following is necessary to support java class files.
+>>4 belong <20 Mach-O fat file with %ld architectures
+#>>4 belong <0xffff Mach-O fat file with %ld architectures
+#
+0 lelong&0xfeffffff 0xfeedface Mach-O
+>0 byte 0xcf 64-bit
+>12 lelong 1 object
+>12 lelong 2 executable
+>12 lelong 3 fixed virtual memory shared library
+>12 lelong 4 core
+>12 lelong 5 preload executable
+>12 lelong 6 dynamically linked shared library
+>12 lelong 7 dynamic linker
+>12 lelong 8 bundle
+>12 lelong 9 dynamically linked shared library stub
+>12 lelong >9
+>>12 lelong x filetype=%ld
+>4 lelong <0
+>>4 lelong x architecture=%ld
+>4 lelong 1 vax
+>4 lelong 2 romp
+>4 lelong 3 architecture=3
+>4 lelong 4 ns32032
+>4 lelong 5 ns32332
+>4 lelong 6 m68k
+>4 lelong 7 i386
+>4 lelong 8 mips
+>4 lelong 9 ns32532
+>4 lelong 10 architecture=10
+>4 lelong 11 hppa
+>4 lelong 12 acorn
+>4 lelong 13 m88k
+>4 lelong 14 sparc
+>4 lelong 15 i860-big
+>4 lelong 16 i860
+>4 lelong 17 rs6000
+>4 lelong 18 ppc
+>4 lelong 16777234 ppc64
+>4 lelong >16777234
+>>4 lelong x architecture=%ld
#
-0 belong 0xfeedface Mach-O
+0 belong&0xfffffffe 0xfeedface Mach-O
+>3 byte 0xcf 64-bit
>12 belong 1 object
>12 belong 2 executable
->12 belong 3 shared library
+>12 belong 3 fixed virtual memory shared library
>12 belong 4 core
>12 belong 5 preload executable
>12 belong 6 dynamically linked shared library
>12 belong 7 dynamic linker
>12 belong 8 bundle
->12 belong >8
+>12 belong 9 dynamically linked shared library stub
+>12 belong >9
>>12 belong x filetype=%ld
>4 belong <0
>>4 belong x architecture=%ld
>4 belong 8 mips
>4 belong 9 ns32532
>4 belong 10 architecture=10
->4 belong 11 hp pa-risc
+>4 belong 11 hppa
>4 belong 12 acorn
>4 belong 13 m88k
>4 belong 14 sparc
>4 belong 16 i860
>4 belong 17 rs6000
>4 belong 18 ppc
->4 belong >18
+>4 belong 16777234 ppc64
+>4 belong >16777234
>>4 belong x architecture=%ld
# Newer StuffIt archives (grant@netbsd.org)
0 string StuffIt StuffIt Archive
->162 string >0 : %s
+#>162 string >0 : %s
# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
0 string APPL Macintosh Application (data)
# Squish Fidonet message area databases
# SQD file (requires at least one message in the area)
-256 leshort 0xAFAE4453 Squish message area data file
->4 leshort >0 (%d messages)
+# XXX: Weak magic
+#256 leshort 0xAFAE4453 Squish message area data file
+#>4 leshort >0 (%d messages)
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0 string/c @echo\ off MS-DOS batch file text
-# XXX - according to Microsoft's spec, at an offset of 0x3c in a
-# PE-format executable is the offset in the file of the PE header;
-# unfortunately, that's a little-endian offset, and there's no way
-# to specify an indirect offset with a specified byte order.
-# So, for now, we assume the standard MS-DOS stub, which puts the
-# PE header at 0x80 = 128.
-#
-# Required OS version and subsystem version were 4.0 on some NT 3.51
-# executables built with Visual C++ 4.0, so it's not clear that
-# they're interesting. The user version was 0.0, but there's
-# probably some linker directive to set it. The linker version was
-# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
-#
-128 string PE\0\0 MS Windows PE
->150 leshort&0x0100 >0 32-bit
->132 leshort 0x0 unknown processor
->132 leshort 0x14c Intel 80386
->132 leshort 0x166 MIPS R4000
->132 leshort 0x184 Alpha
->132 leshort 0x268 Motorola 68000
->132 leshort 0x1f0 PowerPC
->132 leshort 0x290 PA-RISC
->148 leshort >27
->>220 leshort 0 unknown subsystem
->>220 leshort 1 native
->>220 leshort 2 GUI
->>220 leshort 3 console
->>220 leshort 7 POSIX
->150 leshort&0x2000 =0 executable
-#>>136 ledate x stamp %s,
->>150 leshort&0x0001 >0 not relocatable
-#>>150 leshort&0x0004 =0 with line numbers,
-#>>150 leshort&0x0008 =0 with local symbols,
-#>>150 leshort&0x0200 =0 with debug symbols,
->>150 leshort&0x1000 >0 system file
-#>>148 leshort >0
-#>>>154 byte x linker %d
-#>>>155 byte x \b.%d,
-#>>148 leshort >27
-#>>>192 leshort x requires OS %d
-#>>>194 leshort x \b.%d,
-#>>>196 leshort x user version %d
-#>>>198 leshort x \b.%d,
-#>>>200 leshort x subsystem version %d
-#>>>202 leshort x \b.%d,
->150 leshort&0x2000 >0 DLL
-#>>136 ledate x stamp %s,
->>150 leshort&0x0001 >0 not relocatable
-#>>150 leshort&0x0004 =0 with line numbers,
-#>>150 leshort&0x0008 =0 with local symbols,
-#>>150 leshort&0x0200 =0 with debug symbols,
->>150 leshort&0x1000 >0 system file
-#>>148 leshort >0
-#>>>154 byte x linker %d
-#>>>155 byte x \b.%d,
-#>>148 leshort >27
-#>>>192 leshort x requires OS %d
-#>>>194 leshort x \b.%d,
-#>>>196 leshort x user version %d
-#>>>198 leshort x \b.%d,
-#>>>200 leshort x subsystem version %d
-#>>>202 leshort x \b.%d,
+# OS/2 batch files are REXX. the second regex is a bit generic, oh well
+# the matched commands seem to be common in REXX and uncommon elsewhere
+100 regex/c =^\\s*call\s+rxfuncadd.*sysloadfu OS/2 REXX batch file text
+100 regex/c =^\\s*say\ ['"] OS/2 REXX batch file text
+
0 leshort 0x14c MS Windows COFF Intel 80386 object file
#>4 ledate x stamp %s
0 leshort 0x166 MS Windows COFF MIPS R4000 object file
0 leshort 0x290 MS Windows COFF PA-RISC object file
#>4 ledate x stamp %s
-# .EXE formats (Greg Roelofs, newt@uchicago.edu)
+# XXX - according to Microsoft's spec, at an offset of 0x3c in a
+# PE-format executable is the offset in the file of the PE header;
+# unfortunately, that's a little-endian offset, and there's no way
+# to specify an indirect offset with a specified byte order.
+# So, for now, we assume the standard MS-DOS stub, which puts the
+# PE header at 0x80 = 128.
#
-0 string MZ MS-DOS executable (EXE)
->24 string @ \b, OS/2 or MS Windows
->>0xe7 string LH/2\ Self-Extract \b, %s
->>0xe9 string PKSFX2 \b, %s
->>122 string Windows\ self-extracting\ ZIP \b, %s
->0x1c string RJSX\xff\xff \b, ARJ SFX
->0x1c string diet\xf9\x9c \b, diet compressed
->0x1c string LZ09 \b, LZEXE v0.90 compressed
->0x1c string LZ91 \b, LZEXE v0.91 compressed
->0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX
-# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"
->0x1e string PKLITE\ Copr. \b, %.6s compressed
->0x24 string LHa's\ SFX \b, %.15s
->0x24 string LHA's\ SFX \b, %.15s
->1638 string -lh5- \b, LHa SFX archive v2.13S
->7195 string Rar! \b, RAR self-extracting archive
+# Required OS version and subsystem version were 4.0 on some NT 3.51
+# executables built with Visual C++ 4.0, so it's not clear that
+# they're interesting. The user version was 0.0, but there's
+# probably some linker directive to set it. The linker version was
+# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
#
-# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
-# 8161 bytes are ignored. To make the following entries work, increase
-# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
-# NT/Win32 and VMS.]
-# [GRR: some company sells a self-extractor/displayer for image data(!)]
+# many of the compressed formats were extraced from IDARC 1.23 source code
#
->11696 string PK\003\004 \b, PKZIP SFX archive v1.1
->13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
->15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
->15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
->28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
+0 string MZ
+>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 PE executable for MS Windows
+>>&18 leshort&0x2000 >0 (DLL)
+>>&88 leshort 0 (unknown subsystem)
+>>&88 leshort 1 (native)
+>>&88 leshort 2 (GUI)
+>>&88 leshort 3 (console)
+>>&88 leshort 7 (POSIX)
+>>&0 leshort 0x0 unknown processor
+>>&0 leshort 0x14c Intel 80386
+>>&0 leshort 0x166 MIPS R4000
+>>&0 leshort 0x184 Alpha
+>>&0 leshort 0x268 Motorola 68000
+>>&0 leshort 0x1f0 PowerPC
+>>&0 leshort 0x290 PA-RISC
+>>&18 leshort&0x0100 >0 32-bit
+>>&18 leshort&0x1000 >0 system file
+>>&0xf4 search/0x140 \x0\x40\x1\x0
+>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
+
+>0x18 leshort >0x3f
+>>(0x3c.l) string PE\0\0 PE executable
+# hooray, there's a DOS extender using the PE format, with a valid PE
+# executable inside (which just prints a message and exits if run in win)
+>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
+>>>(8.s*16) string !32STUB for MS Windows
+>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
+>>>>(0x3c.l+92) leshort 0 (unknown subsystem)
+>>>>(0x3c.l+92) leshort 1 (native)
+>>>>(0x3c.l+92) leshort 2 (GUI)
+>>>>(0x3c.l+92) leshort 3 (console)
+>>>>(0x3c.l+92) leshort 7 (POSIX)
+>>>>(0x3c.l+4) leshort 0x0 unknown processor
+>>>>(0x3c.l+4) leshort 0x14c Intel 80386
+>>>>(0x3c.l+4) leshort 0x166 MIPS R4000
+>>>>(0x3c.l+4) leshort 0x184 Alpha
+>>>>(0x3c.l+4) leshort 0x268 Motorola 68000
+>>>>(0x3c.l+4) leshort 0x1f0 PowerPC
+>>>>(0x3c.l+4) leshort 0x290 PA-RISC
+>>>>(0x3c.l+22) leshort&0x0100 >0 32-bit
+>>>>(0x3c.l+22) leshort&0x1000 >0 system file
+
+>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
+>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
+>>>>(0x3c.l+0xf8) search/0x140 UPX2
+>>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
+>>>>(0x3c.l+0xf8) search/0x140 .idata
+>>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
+>>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
+>>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
+>>>>(0x3c.l+0xf8) search/0x140 .rsrc
+>>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
+>>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
+>>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
+>>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
+>>>>(0x3c.l+0xf8) search/0x140 .data
+>>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
+>>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
+>>>>>(0x3c.l+0xf7) byte x
+>>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
+>>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
+>>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
+>>>>(0x3c.l+0xf8) search/0x140 .reloc
+>>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip)
+
+>>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
+>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
+>>>>0x30 string Inno \b, InnoSetup self-extracting archive
+
+>>(0x3c.l) string NE NE executable
+>>>(0x3c.l+0x36) byte 0 (unknown OS)
+>>>(0x3c.l+0x36) byte 1 for OS/2 1.x
+>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
+>>>(0x3c.l+0x36) byte 3 for MS-DOS
+>>>(0x3c.l+0x36) byte >3 (unknown OS)
+>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
+>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
+>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
+>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
+>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
+
+>>(0x3c.l) string LX\0\0 LX executable
+>>>(0x3c.l+0x0a) leshort <1 (unknown OS)
+>>>(0x3c.l+0x0a) leshort 1 for OS/2
+>>>(0x3c.l+0x0a) leshort 2 for MS Windows
+>>>(0x3c.l+0x0a) leshort 3 for DOS
+>>>(0x3c.l+0x0a) leshort >3 (unknown OS)
+>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
+>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
+>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
+>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
+>>>(0x3c.l+0x08) leshort 1 i80286
+>>>(0x3c.l+0x08) leshort 2 i80386
+>>>(0x3c.l+0x08) leshort 3 i80486
+>>>(8.s*16) string emx \b, emx
+>>>>&1 string x %s
+>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
+
+# MS Windows system file, supposedly a collection of LE executables
+>>(0x3c.l) string W3 W3 executable for MS Windows
+
+>>(0x3c.l) string LE\0\0 LE executable
+>>>(0x3c.l+0x0a) leshort 1
+# some DOS extenders use LE files with OS/2 header
+>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
+>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
+>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
+>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
+>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
+>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
+>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
+# this is a wild guess; hopefully it is a specific signature
+>>>>&0x24 lelong <0x50
+>>>>>(&0x4c.l) string \xfc\xb8WATCOM
+>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
+# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
+#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
+# fails with DOS-Extenders.
+>>>(0x3c.l+0x0a) leshort 2 for MS Windows
+>>>(0x3c.l+0x0a) leshort 3 for MS-DOS
+>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
+>>>(&0x7c.l+0x26) string UPX \b, UPX compressed
+>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
+
+# looks like ASCII, probably some embedded copyright message.
+# and definitely not NE/LE/LX/PE
+>>0x3c lelong >0x20000000
+>>>(4.s*512) leshort !0x014c MZ executable for MS-DOS
+# header data too small for extended executable
+>2 long !0
+>>0x18 leshort <0x40
+>>>(4.s*512) leshort !0x014c
+
+>>>>&(2.s-514) string !LE
+>>>>>&-2 string !BW MZ executable for MS-DOS
+>>>>&(2.s-514) string LE LE executable
+>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
+# educated guess since indirection is still not capable enough for complex offset
+# calculations (next embedded executable would be at &(&2*512+&0-2)
+# I suspect there are only LE executables in these multi-exe files
+>>>>&(2.s-514) string BW
+>>>>>0x240 search/0x100 DOS/4G LE executable for MS-DOS, DOS4GW DOS extender (embedded)
+>>>>>0x240 search/0x100 !DOS/4G BW executable collection for MS-DOS
+
+# This sequence skips to the first COFF segment, usually .text
+>(4.s*512) leshort 0x014c COFF executable
+>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
+>>(8.s*16) string emx
+>>>&1 string x for DOS, Win or OS/2, emx %s
+>>&(&0x42.l-3) byte x
+>>>&0x26 string UPX \b, UPX compressed
+# and yet another guess: small .text, and after large .data is unusal, could be 32lite
+>>&0x2c search/0xa0 .text
+>>>&0x0b lelong <0x2000
+>>>>&0 lelong >0x6000 \b, 32lite compressed
+
+>(8.s*16) string $WdX \b, WDos/X DOS extender
+
+# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
-# Info-ZIP self-extractors
-# these are the DOS versions:
->25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
->26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
-# these are the OS/2 versions (OS/2 is flagged above):
->47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
->49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
-# this is the NT/Win32 version:
->69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
+>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
+>0xe7 string LH/2\ Self-Extract \b, %s
+>0x1c string diet \b, diet compressed
+>0x1c string LZ09 \b, LZEXE v0.90 compressed
+>0x1c string LZ91 \b, LZEXE v0.91 compressed
+>0x1c string tz \b, TinyProg compressed
+>0x1e string PKLITE \b, %s compressed
+>0x64 string W\ Collis\0\0 \b, Compack compressed
+>0x24 string LHa's\ SFX \b, LHa self-extracting archive
+>0x24 string LHA's\ SFX \b, LHa self-extracting archive
+>0x24 string \ $ARX \b, ARX self-extracting archive
+>0x24 string \ $LHarc \b, LHarc self-extracting archive
+>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
+>1638 string -lh5- \b, LHa self-extracting archive v2.13S
+>0x17888 string Rar! \b, RAR self-extracting archive
+>0x40 string aPKG \b, aPackage self-extracting archive
+
+>32 string AIN
+>>35 string 2 \b, AIN 2.x compressed
+>>35 string <2 \b, AIN 1.x compressed
+>>35 string >2 \b, AIN 1.x compressed
+>28 string UC2X \b, UCEXE compressed
+>28 string WWP\ \b, WWPACK compressed
+
+# skip to the end of the exe
+>(4.s*512) long x
+>>&(2.s-517) byte x
+>>>&0 string PK\3\4 \b, ZIP self-extracting archive
+>>>&0 string Rar! \b, RAR self-extracting archive
+>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
+>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
+>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
+>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
+>>>&7 search/400 **ACE** \b, ACE self-extracting archive
+>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
+
+>0x1c string RJSX \b, ARJ self-extracting archive
+# winarj stores a message in the stub instead of the sig in the MZ header
+>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
+
+# a few unknown ZIP sfxes, no idea if they are needed or if they are
+# already captured by the generic patterns above
+>122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
+>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
+# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
#
+
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
>>49824 leshort =1 \b, 1 file
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
-#0 byte 0xe9 MS-DOS executable (COM)
-#>6 string SFX\ of\ LHarc (%s)
-#0 byte 0x8c MS-DOS executable (COM)
+0 byte 0xe9 MS-DOS executable (COM)
+>6 string SFX\ of\ LHarc (%s)
+0 byte 0x8c MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
-#0 byte 0xeb MS-DOS executable (COM)
-#0 byte 0xb8 MS-DOS executable (COM)
+0 byte 0xeb MS-DOS executable (COM)
+>4 string \ $ARX \b, ARX self-extracting archive
+>4 string \ $LHarc \b, LHarc self-extracting archive
+>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
+0 byte 0xb8 COM executable for MS-DOS
+# many compressed/converted COMs start with a copy loop instead of a jump
+0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
+0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for MS-DOS
+>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
+0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
+# FIXME: missing diet .com compression
# miscellaneous formats
0 string LZ MS-DOS executable (built-in)
0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
# windows zips files .dmf
-0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 Ms-windows special zipped file
+0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
# Windows help file FTG FTS
-0 string \164\146\115\122\012\000\000\000\001\000\000\000 ms-windows help cache
+0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
# grp old windows 3.1 group files
-0 string \120\115\103\103 Ms-windows 3.1 group files
+0 string \120\115\103\103 MS Windows 3.1 group files
# lnk files windows symlinks
-0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 ms-Windows shortcut
+0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut
#ico files
-0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for ms-windows
+0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
# Windows icons (Ian Springer <ips@fpk.hp.com>)
-0 string \000\000\001\000 ms-windows icon resource
+0 string \000\000\001\000 MS Windows icon resource
>4 byte 1 - 1 icon
>4 byte >1 - %d icons
>>6 byte >0 \b, %dx
# recycled/info the windows trash bin index
-9 string \000\000\000\030\001\000\000\000 ms-windows recycled bin info
+9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info
##### put in Either Magic/font or Magic/news
0 string GERBIL First Choice device file
9 string RABBITGRAPH RabbitGraph file
0 string DCU1 Borland Delphi .DCU file
-0 string !<spell> MKS Spell hash list (old format)
-0 string !<spell2> MKS Spell hash list
+0 string =!<spell> MKS Spell hash list (old format)
+0 string =!<spell2> MKS Spell hash list
# Too simple - MPi
#0 string AH Halo(TM) bitmapped font file
0 lelong 0x08086b70 TurboC BGI file
# GFA-BASIC (Wolfram Kleff)
2 string GFA-BASIC3 GFA-BASIC 3 data
-# DJGPP compiled files
-# v >2, uses DPMI & small(2k) stub (Robert vd Boon, rjvdboon@europe.com)
-0x200 string go32stub DOS-executable compiled w/DJGPP
->0x20c string >0 (stub v%.4s)
->>0x8b2 string djp [compressed w/%s
->>>&1 string >\0 %.4s]
->>0x8ad string UPX [compressed w/%s
->>>&1 string >\0 %.4s]
->>0x1c string pmodedj stubbed with %s
-
-# QDOS
-4 belong 0x4AFB QDOS executable
->9 pstring x '%s'
-0 beshort 0xFB01 QDOS object
->2 pstring x '%s'
-
#------------------------------------------------------------------------------
# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
# Microsoft Cabinet files
-0 string MSCF\0\0\0\0 Microsoft Cabinet file
+0 string MSCF\0\0\0\0 Microsoft Cabinet archive data
>8 lelong x \b, %u bytes
>28 leshort 1 \b, 1 file
>28 leshort >1 \b, %u files
# InstallShield Cabinet files
-0 string ISc( InstallShield Cabinet file
+0 string ISc( InstallShield Cabinet archive data
>5 byte&0xf0 =0x60 version 6,
>5 byte&0xf0 !0x60 version 4/5,
>(12.l+40) lelong x %u files
#------------------------------------------------------------------------------
# HP LaserJet 1000 series downloadable firmware file
0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
+
+# From: Paolo <oopla@users.sf.net>
+# Epson ESC/Page, ESC/PageColor
+0 string \x1b\x01@EJL Epson ESC/Page language printer data
>>>>>>>(104.l+132) string/c divx DivX 4
>>>>>>>(104.l+132) string/c dx50 DivX 5
>>>>>>>(104.l+132) string/c xvid XviD
+>>>>>>>(104.l+132) string/c h264 X.264
>>>>>>>(104.l+132) lelong 0
##>>>>>>>(104.l+132) string x (%.4s)
# skip past first (video) LIST
>17 byte x hash %d,
>11 byte x dataformat %d
-# Alias|Wavefront Maya files
-0 string //Maya ASCII Alias|Wavefront Maya Ascii File,
+# Alias Maya files
+0 string //Maya ASCII Alias Maya Ascii File,
>13 string >\0 version %s
-8 string MAYAFOR4 Alias|Wavefront Maya Binary File,
+8 string MAYAFOR4 Alias Maya Binary File,
>32 string >\0 version %s scene
-8 string MayaFOR4 Alias|Wavefront Maya Binary File,
+8 string MayaFOR4 Alias Maya Binary File,
>32 string >\0 version %s scene
-8 string CIMG Alias|Wavefront Maya Image File
-8 string DEEP Alias|Wavefront Maya Image File
+8 string CIMG Alias Maya Image File
+8 string DEEP Alias Maya Image File
#------------------------------------------------------------------------
# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
-0 string ! Assembler source
+0 string =! Assembler source
0 string Analog ADi asm listing file
0 string .SYSTEM SHARC architecture file
0 string .system SHARC architecture file
0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
>3 byte x Version %d
0 string \376bin MySQL replication log
+
+#------------------------------------------------------------------------------
+# iRiver H Series database file
+# From Ken Guest <ken@linux.ie>
+# As observed from iRivNavi.iDB and unencoded firmware
+#
+0 string iRivDB iRiver Database file
+>11 string >\0 Version %s
+>39 string iHP-100 [H Series]
+
+#------------------------------------------------------------------------------
+# SQLite database file
+# From Ken Guest <ken@linux.ie>
+#
+0 string SQLite SQLite database
+>14 string >\0 (Version %s)
# Harbour <URL:http://www.harbour-project.org/> HRB files.
0 string \xc0HRB Harbour HRB file
>4 short x version %d
-
-# From: "Stefan A. Haubenthal" <polluks@web.de>
-0 belong 0x000001EB Plan 9 executable
#
>8 string CDRA image/x-coreldraw
+# AAC (aka MPEG-2 NBC)
+0 beshort&FFF6 0xFFF0 audio/X-HX-AAC-ADTS
+0 string ADIF audio/X-HX-AAC-ADIF
+0 beshort&0xFFE0 0x56E0 audio/MP4A-LATM
+0 beshort 0x4DE1 audio/MP4A-LATM
# MPEG Layer 3 sound files
0 beshort&0xfffe =0xfffa audio/mpeg
# XPM icons (Greg Roelofs, newt@uchicago.edu)
# ideally should go into "images", but entries below would tag XPM as C source
-0 string /*\ XPM image/x-xpm 7bit
+0 string /*\ XPM image/x-xpmi 7bit
# 3DS (3d Studio files)
-#16 beshort 0x3d3d image/x-3ds
+16 beshort 0x3d3d image/x-3ds
# this first will upset you if you're a PL/1 shop... (are there any left?)
# in which case rm it; ascmagic will catch real C programs
# because it tries to uncompress it to figure out what's inside.
# standard unix compress
-#0 string \037\235 application/x-compress
+0 string \037\235 application/x-compress
# gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
-#0 string \037\213 application/x-gzip
+0 string \037\213 application/x-gzip
0 string PK\003\004 application/x-zip
# animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# MPEG file
# MPEG sequences
-0 belong 0x000001BA video/mpeg
-0 belong 0x000001BB video/mpeg
-0 belong 0x000001B0 video/mp4v-es
-0 belong 0x000001B5 video/mp4v-es
-0 belong 0x000001B3 video/mpv
-0 belong&0xFF5FFF1F 0x47400010 video/mp2t
+0 belong 0x000001BA
+>4 byte &0x40 video/mp2p
+>4 byte ^0x40 video/mpeg
+0 belong 0x000001BB video/mpeg
+0 belong 0x000001B0 video/mp4v-es
+0 belong 0x000001B5 video/mp4v-es
+0 belong 0x000001B3 video/mpv
+0 belong&0xFF5FFF1F 0x47400010 video/mp2t
+0 belong 0x00000001
+>4 byte&1F 0x07 video/h264
+
# FLI animation format
0 leshort 0xAF11 video/fli
# FLC animation format
#
# SGI and Apple formats
# Added ISO mimes
-# Added ISO mimes
0 string MOVI video/sgi
4 string moov video/quicktime
4 string mdat video/quicktime
4 string idat image/x-quicktime
4 string pckg application/x-quicktime
4 string/B jP image/jp2
-4 string ftyp application/octet-stream
+4 string ftyp
>8 string isom video/mp4
>8 string mp41 video/mp4
>8 string mp42 video/mp4
>8 string/B jp2 image/jp2
>8 string 3gp video/3gpp
+>8 string avc1 video/3gpp
>8 string mmp4 video/mp4
>8 string/B M4A audio/mp4
>8 string/B qt video/quicktime
# (made the mimetype up)
0 string \0\0MMXPR3\0 application/x-quark-xpress-3
+# EET archive
+# From: Tilman Sauerbeck <tilman@code-monkey.de>
+0 belong 0x1ee7ff00 application/x-eet
+
# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as "compressed", but at least -z helps
39 string =<gmr:Workbook application/x-gnumeric
+
#endif
#ifndef lint
-FILE_RCSID("@(#)$Id: apprentice.c,v 1.82 2004/11/24 18:56:04 christos Exp $")
+FILE_RCSID("@(#)$Id: apprentice.c,v 1.84 2005/03/25 18:03:18 christos Exp $")
#endif /* lint */
#define EATAB {while (isascii((unsigned char) *l) && \
#define MAXPATHLEN 1024
#endif
-#define IS_STRING(t) ((t) == FILE_STRING || (t) == FILE_PSTRING || \
+#define IS_PLAINSTRING(t) ((t) == FILE_STRING || (t) == FILE_PSTRING || \
(t) == FILE_BESTRING16 || (t) == FILE_LESTRING16)
+
+#define IS_STRING(t) (IS_PLAINSTRING(t) || (t) == FILE_REGEX || \
+ (t) == FILE_SEARCH)
/*@unchecked@*/
private size_t maxmagic = 0;
case FILE_PSTRING:
case FILE_BESTRING16:
case FILE_LESTRING16:
- break;
case FILE_REGEX:
+ case FILE_SEARCH:
break;
default:
if (ms->flags & MAGIC_CHECK)
m->cont_level++;
}
+ if (m->cont_level != 0 && *l == '&') {
+ ++l; /* step over */
+ m->flag |= OFFADD;
+ }
if (m->cont_level != 0 && *l == '(') {
++l; /* step over */
m->flag |= INDIR;
+ if (m->flag & OFFADD)
+ m->flag = (m->flag & ~OFFADD) | INDIROFFADD;
}
if (m->cont_level != 0 && *l == '&') {
++l; /* step over */
l++;
}
if (*l == '~') {
- m->in_op = FILE_OPINVERSE;
+ m->in_op |= FILE_OPINVERSE;
l++;
}
switch (*l) {
l++;
break;
}
- if (isdigit((unsigned char)*l))
- m->in_offset = (uint32_t)strtoul(l, &t, 0);
+ if (*l == '(') {
+ m->in_op |= FILE_OPINDIRECT;
+ l++;
+ }
+ if (isdigit((unsigned char)*l) || *l == '-')
+ m->in_offset = (int32_t)strtol(l, &t, 0);
else
t = l;
- if (*t++ != ')')
+ if (*t++ != ')' ||
+ ((m->in_op & FILE_OPINDIRECT) && *t++ != ')'))
if (ms->flags & MAGIC_CHECK)
file_magwarn(ms,
"missing ')' in indirect offset");
#define NREGEX 5
#define NBESTRING16 10
#define NLESTRING16 10
+#define NSEARCH 6
if (*l == 'u') {
++l;
} else if (strncmp(l, "lestring16", NLESTRING16)==0) {
m->type = FILE_LESTRING16;
l += NLESTRING16;
+ } else if (strncmp(l, "search", NSEARCH)==0) {
+ m->type = FILE_SEARCH;
+ l += NSEARCH;
} else {
if (ms->flags & MAGIC_CHECK)
file_magwarn(ms, "type `%s' invalid", l);
/* New and improved: ~ & | ^ + - * / % -- exciting, isn't it? */
if (*l == '~') {
if (!IS_STRING(m->type))
- m->mask_op = FILE_OPINVERSE;
+ m->mask_op |= FILE_OPINVERSE;
++l;
}
if ((t = strchr(fops, *l)) != NULL) {
uint32_t op = (uint32_t)(t - fops);
- if (op != FILE_OPDIVIDE || !IS_STRING(m->type)) {
+ if (op != FILE_OPDIVIDE || !IS_PLAINSTRING(m->type)) {
++l;
m->mask_op |= op;
val = (uint32_t)strtoul(l, &l, 0);
return -1;
}
}
+ ++l;
}
}
/*
}
break;
case '!':
- if (!IS_STRING(m->type)) {
- m->reln = *l;
- ++l;
- break;
- }
- /*@fallthrough@*/
+ m->reln = *l;
+ ++l;
+ break;
default:
- if (*l == 'x' && isascii((unsigned char)l[1]) &&
- isspace((unsigned char)l[1])) {
+ if (*l == 'x' && ((isascii((unsigned char)l[1]) &&
+ isspace((unsigned char)l[1])) || !l[1])) {
m->reln = *l;
++l;
goto GetDesc; /* Bill The Cat */
case FILE_STRING:
case FILE_PSTRING:
case FILE_REGEX:
+ case FILE_SEARCH:
*p = getstr(ms, *p, m->value.s, sizeof(m->value.s), &slen);
if (*p == NULL) {
if (ms->flags & MAGIC_CHECK)
m->cont_level = swap2(m->cont_level);
m->offset = swap4((uint32_t)m->offset);
m->in_offset = swap4((uint32_t)m->in_offset);
- if (IS_STRING(m->type))
+ if (!IS_STRING(m->type))
m->value.l = swap4(m->value.l);
m->mask = swap4(m->mask);
}
#include "names.h"
#ifndef lint
-FILE_RCSID("@(#)$Id: ascmagic.c,v 1.41 2004/09/11 19:15:57 christos Exp $")
+FILE_RCSID("@(#)$Id: ascmagic.c,v 1.43 2005/06/25 15:52:14 christos Exp $")
#endif /* lint */
typedef unsigned long unichar;
file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes)
{
size_t i;
- unsigned char nbuf[HOWMANY+1]; /* one extra for terminating '\0' */
- unichar ubuf[HOWMANY+1]; /* one extra for terminating '\0' */
+ unsigned char *nbuf = NULL;
+ unichar *ubuf = NULL;
size_t ulen;
struct names *p;
+ int rv = -1;
const char *code = NULL;
const char *code_mime = NULL;
int has_escapes = 0;
int has_backspace = 0;
+ int seen_cr = 0;
int n_crlf = 0;
int n_lf = 0;
* Undo the NUL-termination kindly provided by process()
* but leave at least one byte to look at
*/
-
while (nbytes > 1 && buf[nbytes - 1] == '\0')
nbytes--;
- /* nbuf and ubuf relies on this */
- if (nbytes > HOWMANY)
- nbytes = HOWMANY;
+ if ((nbuf = malloc((nbytes + 1) * sizeof(nbuf[0]))) == NULL)
+ goto done;
+ if ((ubuf = malloc((nbytes + 1) * sizeof(ubuf[0]))) == NULL)
+ goto done;
/*
* Then try to determine whether it's any character code we can
type = "character data";
code_mime = "ebcdic";
} else {
- return 0; /* doesn't look like text at all */
+ rv = 0;
+ goto done; /* doesn't look like text at all */
}
}
* Now try to discover other details about the file.
*/
for (i = 0; i < ulen; i++) {
- if (i > last_line_end + MAXLINELEN)
- has_long_lines = 1;
-
- if (ubuf[i] == '\033')
- has_escapes = 1;
- if (ubuf[i] == '\b')
- has_backspace = 1;
-
- if (ubuf[i] == '\r' && (i + 1 < ulen && ubuf[i + 1] == '\n')) {
- n_crlf++;
+ if (ubuf[i] == '\n') {
+ if (seen_cr)
+ n_crlf++;
+ else
+ n_lf++;
last_line_end = i;
- }
- if (ubuf[i] == '\r' && (i + 1 >= ulen || ubuf[i + 1] != '\n')) {
+ } else if (seen_cr)
n_cr++;
+
+ seen_cr = (ubuf[i] == '\r');
+ if (seen_cr)
last_line_end = i;
- }
- if (ubuf[i] == '\n' && ((int)i - 1 < 0 || ubuf[i - 1] != '\r')){
- n_lf++;
- last_line_end = i;
- }
+
if (ubuf[i] == 0x85) { /* X3.64/ECMA-43 "next line" character */
n_nel++;
last_line_end = i;
}
+
+ /* If this line is _longer_ than MAXLINELEN, remember it. */
+ if (i > last_line_end + MAXLINELEN)
+ has_long_lines = 1;
+
+ if (ubuf[i] == '\033')
+ has_escapes = 1;
+ if (ubuf[i] == '\b')
+ has_backspace = 1;
}
+ /* Beware, if the data has been truncated, the final CR could have
+ been followed by a LF. If we have HOWMANY bytes, it indicates
+ that the data might have been truncated, probably even before
+ this function was called. */
+ if (seen_cr && nbytes < HOWMANY)
+ n_cr++;
+
if ((ms->flags & MAGIC_MIME)) {
if (subtype_mime) {
if (file_printf(ms, subtype_mime) == -1)
- return -1;
+ goto done;
} else {
if (file_printf(ms, "text/plain") == -1)
- return -1;
+ goto done;
}
if (code_mime) {
if (file_printf(ms, "; charset=") == -1)
- return -1;
+ goto done;
if (file_printf(ms, code_mime) == -1)
- return -1;
+ goto done;
}
} else {
if (file_printf(ms, code) == -1)
- return -1;
+ goto done;
if (subtype) {
if (file_printf(ms, " ") == -1)
- return -1;
+ goto done;
if (file_printf(ms, subtype) == -1)
- return -1;
+ goto done;
}
if (file_printf(ms, " ") == -1)
- return -1;
+ goto done;
if (file_printf(ms, type) == -1)
- return -1;
+ goto done;
if (has_long_lines)
if (file_printf(ms, ", with very long lines") == -1)
- return -1;
+ goto done;
/*
* Only report line terminators if we find one other than LF,
if ((n_crlf == 0 && n_cr == 0 && n_nel == 0 && n_lf == 0) ||
(n_crlf != 0 || n_cr != 0 || n_nel != 0)) {
if (file_printf(ms, ", with") == -1)
- return -1;
+ goto done;
if (n_crlf == 0 && n_cr == 0 && n_nel == 0 && n_lf == 0) {
if (file_printf(ms, " no") == -1)
- return -1;
+ goto done;
} else {
if (n_crlf) {
if (file_printf(ms, " CRLF") == -1)
- return -1;
+ goto done;
if (n_cr || n_lf || n_nel)
if (file_printf(ms, ",") == -1)
- return -1;
+ goto done;
}
if (n_cr) {
if (file_printf(ms, " CR") == -1)
- return -1;
+ goto done;
if (n_lf || n_nel)
if (file_printf(ms, ",") == -1)
- return -1;
+ goto done;
}
if (n_lf) {
if (file_printf(ms, " LF") == -1)
- return -1;
+ goto done;
if (n_nel)
if (file_printf(ms, ",") == -1)
- return -1;
+ goto done;
}
if (n_nel)
if (file_printf(ms, " NEL") == -1)
- return -1;
+ goto done;
}
if (file_printf(ms, " line terminators") == -1)
- return -1;
+ goto done;
}
if (has_escapes)
if (file_printf(ms, ", with escape sequences") == -1)
- return -1;
+ goto done;
if (has_backspace)
if (file_printf(ms, ", with overstriking") == -1)
- return -1;
+ goto done;
}
+ rv = 1;
+done:
+ if (nbuf)
+ free(nbuf);
+ if (ubuf)
+ free(ubuf);
- return 1;
+ return rv;
}
private int
#endif
#ifndef lint
-FILE_RCSID("@(#)$Id: compress.c,v 1.38 2004/09/11 19:15:57 christos Exp $")
+FILE_RCSID("@(#)$Id: compress.c,v 1.42 2005/03/06 05:58:22 christos Exp $")
#endif
{ "\037\240", 2, { "gzip", "-cdq", NULL }, 1 }, /* SCO LZH */
/* the standard pack utilities do not accept standard input */
{ "\037\036", 2, { "gzip", "-cdq", NULL }, 0 }, /* packed */
+ { "PK\3\4", 4, { "gzip", "-cdq", NULL }, 1 }, /* pkzipped, */
+ /* ...only first file examined */
{ "BZh", 3, { "bzip2", "-cd", NULL }, 1 }, /* bzip2-ed */
};
/*@=nullassign@*/
/*@*/;
private ssize_t sread(int fd, void *buf, size_t n)
/*@modifies buf @*/;
-private size_t uncompressbuf(struct magic_set *ms, size_t method, const unsigned char *old,
- unsigned char **newch, size_t n)
+private size_t uncompressbuf(struct magic_set *ms, int fd, size_t method,
+ const unsigned char *old, unsigned char **newch, size_t n)
/*@globals fileSystem, internalState @*/
/*@modifies ms, *newch, fileSystem, internalState @*/;
#ifdef HAVE_LIBZ
#endif
protected int
-file_zmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes)
+file_zmagic(struct magic_set *ms, int fd, const unsigned char *buf,
+ size_t nbytes)
{
unsigned char *newbuf = NULL;
size_t i, nsz;
if (nbytes < compr[i].maglen)
continue;
if (memcmp(buf, compr[i].magic, compr[i].maglen) == 0 &&
- (nsz = uncompressbuf(ms, i, buf, &newbuf, nbytes)) != 0) {
+ (nsz = uncompressbuf(ms, fd, i, buf, &newbuf,
+ nbytes)) != 0) {
ms->flags &= ~MAGIC_COMPRESS;
rv = -1;
- if (file_buffer(ms, newbuf, nsz) == -1)
+ if (file_buffer(ms, -1, newbuf, nsz) == -1)
goto error;
if (file_printf(ms, " (") == -1)
goto error;
- if (file_buffer(ms, buf, nbytes) == -1)
+ if (file_buffer(ms, -1, buf, nbytes) == -1)
goto error;
if (file_printf(ms, ")") == -1)
goto error;
#endif
private size_t
-uncompressbuf(struct magic_set *ms, size_t method, const unsigned char *old,
- unsigned char **newch, size_t n)
+uncompressbuf(struct magic_set *ms, int fd, size_t method,
+ const unsigned char *old, unsigned char **newch, size_t n)
{
int fdin[2], fdout[2];
int r;
pid_t pid1, pid2;
-
- /* The buffer is NUL terminated, and we don't need that. */
- n--;
-
+
#ifdef HAVE_LIBZ
if (method == 2)
return uncompressgzipped(ms, old, newch, n);
#endif
+ (void)fflush(stdout);
+ (void)fflush(stderr);
- if (pipe(fdin) == -1 || pipe(fdout) == -1) {
+ if ((fd != -1 && pipe(fdin) == -1) || pipe(fdout) == -1) {
file_error(ms, errno, "cannot create pipe");
return 0;
}
switch ((pid1=fork())) {
case 0: /* child */
(void) close(0);
- (void) dup(fdin[0]);
- (void) close(fdin[0]);
- (void) close(fdin[1]);
+ if (fd != -1) {
+ (void) dup(fd);
+ (void) lseek(0, (off_t)0, SEEK_SET);
+ } else {
+ (void) dup(fdin[0]);
+ (void) close(fdin[0]);
+ (void) close(fdin[1]);
+ }
(void) close(1);
(void) dup(fdout[1]);
(void) close(fdout[0]);
(void) close(fdout[1]);
+#ifndef DEBUG
if (compr[method].silent)
- (void) close(2);
+ (void)close(2);
+#endif
execvp(compr[method].argv[0],
- (char *const *)compr[method].argv);
+ (char *const *)(intptr_t)compr[method].argv);
+#ifdef DEBUG
+ (void)fprintf(stderr, "exec `%s' failed (%s)\n",
+ compr[method].argv[0], strerror(errno));
+#endif
exit(EXIT_FAILURE);
/*@notreached@*/ break;
case -1:
return 0;
default: /* parent */
- (void) close(fdin[0]);
(void) close(fdout[1]);
- /* fork again, to avoid blocking because both pipes filled */
- switch ((pid2=fork())) {
- case 0: /* child */
- (void)close(fdout[0]);
- if (swrite(fdin[1], old, n) != n)
+ if (fd == -1) {
+ (void) close(fdin[0]);
+ /*
+ * fork again, to avoid blocking because both
+ * pipes filled
+ */
+ switch (fork()) {
+ case 0: /* child */
+ (void)close(fdout[0]);
+ if (swrite(fdin[1], old, n) != n) {
+#ifdef DEBUG
+ (void)fprintf(stderr,
+ "Write failed (%s)\n",
+ strerror(errno));
+#endif
+ exit(EXIT_FAILURE);
+ /*@notreached@*/ /*@innerbreak@*/ break;
+ }
+ exit(EXIT_SUCCESS);
+ /*@notreached@*/ /*@innerbreak@*/ break;
+
+ case -1:
+#ifdef DEBUG
+ (void)fprintf(stderr, "Fork failed (%s)\n",
+ strerror(errno));
+#endif
exit(EXIT_FAILURE);
- exit(EXIT_SUCCESS);
- /*@notreached@*/ /*@innerbreak@*/ break;
-
- case -1:
- exit(EXIT_FAILURE);
- /*@notreached@*/ /*@innerbreak@*/ break;
+ /*@notreached@*/ /*@innerbreak@*/ break;
- default: /* parent */
- /*@innerbreak@*/ break;
+ default: /* parent */
+ /*@innerbreak@*/ break;
+ }
+ (void) close(fdin[1]);
+ fdin[1] = -1;
}
- (void) close(fdin[1]);
- fdin[1] = -1;
+
if ((*newch = (unsigned char *) malloc(HOWMANY + 1)) == NULL) {
+#ifdef DEBUG
+ (void)fprintf(stderr, "Malloc failed (%s)\n",
+ strerror(errno));
+#endif
n = 0;
goto err;
}
if ((r = sread(fdout[0], *newch, HOWMANY)) <= 0) {
+#ifdef DEBUG
+ (void)fprintf(stderr, "Read failed (%s)\n",
+ strerror(errno));
+#endif
free(*newch);
n = 0;
newch[0] = '\0';
#include "patchlevel.h"
#ifndef lint
-FILE_RCSID("@(#)$Id: file.c,v 1.95 2004/09/27 15:28:37 christos Exp $")
+FILE_RCSID("@(#)$Id: file.c,v 1.96 2005/03/06 05:58:22 christos Exp $")
#endif /* lint */
/*@unchecked@*/ /*@observer@*/
private const char *default_magicfile = MAGIC;
/*@unchecked@*/ /*@observer@*/
-private char *separator = ":"; /* Default field separator */
+private const char *separator = ":"; /* Default field separator */
/*@unchecked@*/ /*@null@*/
private char *progname; /* used throughout */
*/
/*
* file.h - definitions for file(1) program
- * @(#)$Id: file.h,v 1.64 2004/11/20 23:50:12 christos Exp $
+ * @(#)$Id: file.h,v 1.68 2005/06/25 15:52:14 christos Exp $
*/
#ifndef __file_h__
#define public
#ifndef HOWMANY
-# define HOWMANY 65536 /* how much of the file to look at */
+# define HOWMANY (256 * 1024) /* how much of the file to look at */
#endif
-#define MAXMAGIS 4096 /* max entries in /etc/magic */
+#define MAXMAGIS 8192 /* max entries in /etc/magic */
#define MAXDESC 64 /* max leng of text description */
#define MAXstring 32 /* max leng of "string" types */
#define INDIR 1 /* if '>(...)' appears, */
#define UNSIGNED 2 /* comparison is unsigned */
#define OFFADD 4 /* if '>&' appears, */
+#define INDIROFFADD 8 /* if '>&(' appears, */
/* Word 2 */
uint8_t reln; /* relation (0=eq, '>'=gt, etc) */
uint8_t vallen; /* length of string value, if any */
#define FILE_REGEX 17
#define FILE_BESTRING16 18
#define FILE_LESTRING16 19
+#define FILE_SEARCH 20
#define FILE_FORMAT_NAME \
/* 0 */ "invalid 0", \
/* 6 */ "date", \
/* 7 */ "beshort", \
/* 8 */ "belong", \
-/* 9 */ "bedate" \
+/* 9 */ "bedate", \
/* 10 */ "leshort", \
/* 11 */ "lelong", \
/* 12 */ "ledate", \
/* 16 */ "leldate", \
/* 17 */ "regex", \
/* 18 */ "bestring16", \
-/* 19 */ "lestring16",
+/* 19 */ "lestring16", \
+/* 20 */ "search",
#define FILE_FMT_NUM "cduxXi"
#define FILE_FMT_STR "s"
/* 16 */ FILE_FMT_STR, \
/* 17 */ FILE_FMT_STR, \
/* 18 */ FILE_FMT_STR, \
-/* 19 */ FILE_FMT_STR,
+/* 19 */ FILE_FMT_STR, \
+/* 20 */ FILE_FMT_STR,
/* Word 3 */
uint8_t in_op; /* operator for indirection */
#define FILE_OPMULTIPLY 5
#define FILE_OPDIVIDE 6
#define FILE_OPMODULO 7
-#define FILE_OPINVERSE 0x80
+#define FILE_OPINVERSE 0x40
+#define FILE_OPINDIRECT 0x80
/* Word 4 */
uint32_t offset; /* offset to magic number */
/* Word 5 */
- uint32_t in_offset; /* offset from indirection */
+ int32_t in_offset; /* offset from indirection */
/* Word 6 */
uint32_t mask; /* mask before comparison with value */
/* Word 7 */
struct stat;
/*@observer@*/
-protected char *file_fmttime(uint32_t, int)
+protected const char *file_fmttime(uint32_t, int)
/*@*/;
-protected int file_buffer(struct magic_set *ms, const void *, size_t)
+protected int file_buffer(struct magic_set *ms, int, const void *, size_t)
/*@globals fileSystem, internalState @*/
/*@modifies ms, fileSystem, internalState @*/;
protected int file_fsmagic(struct magic_set *ms, /*@null@*/ const char *fn, struct stat *sb)
protected int file_tryelf(struct magic_set *ms, int, const unsigned char *, size_t)
/*@globals fileSystem, internalState @*/
/*@modifies ms, fileSystem, internalState @*/;
-protected int file_zmagic(struct magic_set *ms, const unsigned char *, size_t)
+protected int file_zmagic(struct magic_set *ms, int, const unsigned char *, size_t)
/*@globals fileSystem, internalState @*/
/*@modifies ms, fileSystem, internalState @*/;
protected int file_ascmagic(struct magic_set *ms, const unsigned char *, size_t)
#undef HAVE_MAJOR
#ifndef lint
-FILE_RCSID("@(#)$Id: fsmagic.c,v 1.45 2004/11/13 10:19:48 christos Exp $")
+FILE_RCSID("@(#)$Id: fsmagic.c,v 1.46 2005/06/25 15:52:14 christos Exp $")
#endif /* lint */
protected int
/* TODO add code to handle V7 MUX and Blit MUX files */
#ifdef S_IFIFO
case S_IFIFO:
+ if((ms->flags & MAGIC_DEVICES) != 0)
+ break;
if (file_printf(ms, "fifo (named pipe)") == -1)
return -1;
return 1;
default:
file_error(ms, 0, "invalid mode 0%o", sb->st_mode);
return -1;
- /*@notreached@*/
+ /*@notreached@*/ break;
}
/*
#include <ctype.h>
#ifndef lint
-FILE_RCSID("@(#)$Id: funcs.c,v 1.13 2004/09/11 19:15:57 christos Exp $")
+FILE_RCSID("@(#)$Id: funcs.c,v 1.14 2005/01/07 19:17:27 christos Exp $")
#endif /* lint */
/*
* Like printf, only we print to a buffer and advance it.
#ifndef COMPILE_ONLY
protected int
-file_buffer(struct magic_set *ms, const void *buf, size_t nb)
+file_buffer(struct magic_set *ms, int fd, const void *buf, size_t nb)
{
int m;
/* try compression stuff */
- if ((m = file_zmagic(ms, buf, nb)) == 0) {
+ if ((m = file_zmagic(ms, fd, buf, nb)) == 0) {
/* Check if we have a tar file */
if ((m = file_is_tar(ms, buf, nb)) == 0) {
/* try tests in /etc/magic (or surrogate magic file) */
#include "patchlevel.h"
#ifndef lint
-FILE_RCSID("@(#)$Id: magic.c,v 1.24 2004/09/27 15:28:37 christos Exp $")
+FILE_RCSID("@(#)$Id: magic.c,v 1.28 2005/06/25 15:52:14 christos Exp $")
#endif /* lint */
#ifdef __EMX__
magic_file(struct magic_set *ms, const char *inname)
{
int fd = 0;
- unsigned char buf[HOWMANY+1]; /* one extra for terminating '\0' */
- struct stat sb, * st = &sb;
+ int rv = -1;
+ unsigned char *buf;
+ struct stat sb, *st = &sb;
ssize_t nbytes = 0; /* number of bytes read from a datafile */
- if (file_reset(ms) == -1)
+ /*
+ * one extra for terminating '\0', and
+ * some overlapping space for matches near EOF
+ */
+#define SLOP (1 + sizeof(union VALUETYPE))
+ if ((buf = malloc(HOWMANY + SLOP)) == NULL)
return NULL;
+ if (file_reset(ms) == -1)
+ goto done;
+
switch (file_fsmagic(ms, inname, st)) {
case -1:
- return NULL;
+ goto done;
case 0:
break;
default:
- return file_getbuffer(ms);
+ rv = 0;
+ goto done;
}
#ifndef STDIN_FILENO
/* We cannot open it, but we were able to stat it. */
if (sb.st_mode & 0222)
if (file_printf(ms, "writable, ") == -1)
- return NULL;
+ goto done;
if (sb.st_mode & 0111)
if (file_printf(ms, "executable, ") == -1)
- return NULL;
+ goto done;
if (S_ISREG(sb.st_mode))
if (file_printf(ms, "regular file, ") == -1)
- return NULL;
+ goto done;
if (file_printf(ms, "no read permission") == -1)
- return NULL;
- return file_getbuffer(ms);
+ goto done;
+ rv = 0;
+ goto done;
}
/*
if (file_printf(ms, (ms->flags & MAGIC_MIME) ?
"application/x-empty" : "empty") == -1)
goto done;
- goto gotit;
} else if (nbytes == 1) {
if (file_printf(ms, "very short file (no magic)") == -1)
goto done;
- goto gotit;
} else {
- buf[nbytes] = '\0'; /* null-terminate it */
+ (void)memset(buf + nbytes, 0, SLOP); /* NUL terminate */
#ifdef __EMX__
switch (file_os2_apptype(ms, inname, buf, nbytes)) {
case -1:
case 0:
break;
default:
- goto gotit;
+ rv = 0;
+ goto done;
}
#endif
- if (file_buffer(ms, buf, (size_t)nbytes) == -1)
+ if (file_buffer(ms, fd, buf, (size_t)nbytes) == -1)
goto done;
#ifdef BUILTIN_ELF
if (nbytes > 5) {
}
#endif
}
-gotit:
- close_and_restore(ms, inname, fd, &sb);
- return file_getbuffer(ms);
+ rv = 0;
done:
+ free(buf);
close_and_restore(ms, inname, fd, &sb);
- return NULL;
+ return rv == 0 ? file_getbuffer(ms) : NULL;
}
* The main work is done here!
* We have the file name and/or the data buffer to be identified.
*/
- if (file_buffer(ms, buf, nb) == -1) {
+ if (file_buffer(ms, -1, buf, nb) == -1) {
return NULL;
}
return file_getbuffer(ms);
#define FILE_VERSION_MAJOR 4
-#define patchlevel 12
+#define patchlevel 14
/*
* Patchlevel file for Ian Darwin's MAGIC command.
- * $Id: patchlevel.h,v 1.55 2004/11/24 18:57:47 christos Exp $
+ * $Id: patchlevel.h,v 1.57 2005/06/25 15:52:14 christos Exp $
*
* $Log: patchlevel.h,v $
+ * Revision 1.57 2005/06/25 15:52:14 christos
+ * Welcome to 4.14
+ *
+ * Revision 1.56 2005/02/09 19:25:13 christos
+ * Welcome to 4.13
+ *
* Revision 1.55 2004/11/24 18:57:47 christos
* Re-do the autoconf stuff once more; passes make dist now.
*
#include <time.h>
#ifndef lint
-FILE_RCSID("@(#)$Id: print.c,v 1.46 2004/11/13 08:11:39 christos Exp $")
+FILE_RCSID("@(#)$Id: print.c,v 1.47 2005/03/14 16:56:25 christos Exp $")
#endif /* lint */
#define SZOF(a) (sizeof(a) / sizeof(a[0]))
fputc('\n', stderr);
}
-protected char *
+protected const char *
file_fmttime(uint32_t v, int local)
{
char *pp, *rt;
struct tm *tm1;
(void)time(&now);
tm1 = localtime(&now);
+ if (tm1 == NULL)
+ return "*Invalid time*";
daylight = tm1->tm_isdst;
}
#endif /* HAVE_TM_ISDST */
if (daylight)
t += 3600;
tm = gmtime(&t);
+ if (tm == NULL)
+ return "*Invalid time*";
pp = asctime(tm);
}
#include "readelf.h"
#ifndef lint
-FILE_RCSID("@(#)$Id: readelf.c,v 1.45 2004/11/24 17:38:24 christos Exp $")
+FILE_RCSID("@(#)$Id: readelf.c,v 1.47 2005/06/25 15:52:14 christos Exp $")
#endif
#ifdef ELFCORE
/*@unchecked@*/ /*@observer@*/
size_t prpsoffsets64[] = {
+ 40, /* Linux (tested on core from 2.4.x) */
120, /* SunOS 5.x, 64-bit */
};
return size;
}
+ if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 &&
+ nh_type == NT_DRAGONFLY_VERSION && descsz == 4) {
+ uint32_t desc;
+ if (file_printf(ms, ", for DragonFly") == -1)
+ return size;
+ (void)memcpy(&desc, &nbuf[doff], sizeof(desc));
+ desc = getu32(swap, desc);
+ if (file_printf(ms, " %d.%d.%d", desc / 100000,
+ desc / 10000 % 10, desc % 10000) == -1)
+ return size;
+ return size;
+ }
+
/*
* Sigh. The 2.0.36 kernel in Debian 2.1, at
* least, doesn't correctly implement name
#define NT_NETBSD_EMULATION 2
#define NT_FREEBSD_VERSION 1
#define NT_OPENBSD_VERSION 1
+#define NT_DRAGONFLY_VERSION 1
/* GNU executables (name = "GNU") */
#define NT_GNU_VERSION 1
#ifndef lint
-FILE_RCSID("@(#)$Id: softmagic.c,v 1.72 2004/11/24 17:38:25 christos Exp $")
+FILE_RCSID("@(#)$Id: softmagic.c,v 1.73 2005/03/06 05:58:22 christos Exp $")
#endif /* lint */
private int match(struct magic_set *ms, struct magic *magic, uint32_t nmagic,
/*@globals fileSystem @*/
/*@modifies ms, magic, fileSystem @*/;
private int mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s,
- struct magic *m, size_t nbytes)
+ struct magic *m, size_t nbytes, int)
/*@globals fileSystem @*/
/*@modifies ms, p, m, fileSystem @*/;
private int mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
/*@globals fileSystem @*/
- /*@modifies ms, p, fileSystem @*/;
-private int32_t mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
+ /*@modifies ms, p, m, fileSystem @*/;
+private int32_t mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
/*@globals fileSystem @*/
/*@modifies ms, p, fileSystem @*/;
private void mdebug(uint32_t offset, const char *str, size_t len)
for (magindex = 0; magindex < nmagic; magindex++) {
/* if main entry matches, print it... */
- int flush = !mget(ms, &p, s, &magic[magindex], nbytes);
- switch (mcheck(ms, &p, &magic[magindex])) {
- case -1:
- return -1;
- case 0:
- flush++;
- /*@switchbreak@*/ break;
- default:
- /*@switchbreak@*/ break;
+ int flush = !mget(ms, &p, s, &magic[magindex], nbytes,
+ cont_level);
+ if (flush) {
+ if (magic[magindex].reln == '!') flush = 0;
+ } else {
+ switch (mcheck(ms, &p, &magic[magindex])) {
+ case -1:
+ return -1;
+ case 0:
+ flush++;
+ /*@switchbreak@*/ break;
+ default:
+ /*@switchbreak@*/ break;
+ }
}
if (flush) {
/*
*/
cont_level = magic[magindex].cont_level;
}
+ oldoff = magic[magindex].offset;
if (magic[magindex].flag & OFFADD) {
- oldoff=magic[magindex].offset;
- magic[magindex].offset += ms->c.off[cont_level-1];
+ magic[magindex].offset +=
+ ms->c.off[cont_level - 1];
}
- if (!mget(ms, &p, s, &magic[magindex], nbytes))
+
+ flush = !mget(ms, &p, s, &magic[magindex], nbytes,
+ cont_level);
+ if (flush && magic[magindex].reln != '!')
goto done;
- switch (mcheck(ms, &p, &magic[magindex])) {
+ switch (flush ? 1 : mcheck(ms, &p, &magic[magindex])) {
case -1:
return -1;
case 0:
return -1;
}
done:
- if (magic[magindex].flag & OFFADD) {
- magic[magindex].offset = oldoff;
- }
+ magic[magindex].offset = oldoff;
}
firstline = 0;
returnval = 1;
case FILE_PSTRING:
case FILE_BESTRING16:
case FILE_LESTRING16:
- if (m->reln == '=') {
+ if (m->reln == '=' || m->reln == '!') {
if (file_printf(ms, m->desc, m->value.s) == -1)
return -1;
- t = m->offset + strlen(m->value.s);
+ t = m->offset + m->vallen;
}
else {
if (*m->value.s == '\0') {
return -1;
t = m->offset + strlen(p->s);
break;
+ case FILE_SEARCH:
+ if (file_printf(ms, m->desc, m->value.s) == -1)
+ return -1;
+ t = m->offset + m->vallen;
+ break;
default:
file_error(ms, 0, "invalid m->type (%d) in mprint()", m->type);
switch (m->type) {
case FILE_BYTE:
if (m->mask)
- switch (m->mask_op&0x7F) {
+ switch (m->mask_op & 0x7F) {
case FILE_OPAND:
p->b &= m->mask;
/*@innerbreak@*/ break;
return 1;
case FILE_SHORT:
if (m->mask)
- switch (m->mask_op&0x7F) {
+ switch (m->mask_op & 0x7F) {
case FILE_OPAND:
p->h &= m->mask;
/*@innerbreak@*/ break;
case FILE_DATE:
case FILE_LDATE:
if (m->mask)
- switch (m->mask_op&0x7F) {
+ switch (m->mask_op & 0x7F) {
case FILE_OPAND:
p->l &= m->mask;
/*@innerbreak@*/ break;
p->l = ~p->l;
return 1;
case FILE_REGEX:
+ case FILE_SEARCH:
return 1;
default:
file_error(ms, 0, "invalid type %d in mconvert()", m->type);
* offset is interpreted as last line to search,
* (starting at 1), not as bytes-from start-of-file
*/
- unsigned char *b, *last = NULL;
+ char *b, *c, *last = NULL;
if ((p->buf = strdup((const char *)s)) == NULL) {
file_oomem(ms);
return -1;
}
- for (b = (unsigned char *)p->buf; offset &&
- (b = (unsigned char *)strchr((char *)b, '\n')) != NULL;
- offset--, s++)
+ for (b = p->buf; offset &&
+ ((b = strchr(c = b, '\n')) || (b = strchr(c, '\r')));
+ offset--, b++) {
last = b;
+ if (b[0] == '\r' && b[1] == '\n') b++;
+ }
if (last != NULL)
*last = '\0';
return 0;
private int
mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s,
- struct magic *m, size_t nbytes)
+ struct magic *m, size_t nbytes, int cont_level)
{
uint32_t offset = m->offset;
if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes) == -1)
return -1;
- /* Verify we have enough data to match magic type */
- switch (m->type) {
- case FILE_BYTE:
- if (nbytes < (offset + 1)) /* should alway be true */
- return 0;
- break;
-
- case FILE_SHORT:
- case FILE_BESHORT:
- case FILE_LESHORT:
- if (nbytes < (offset + 2))
- return 0;
- break;
-
- case FILE_LONG:
- case FILE_BELONG:
- case FILE_LELONG:
- case FILE_DATE:
- case FILE_BEDATE:
- case FILE_LEDATE:
- case FILE_LDATE:
- case FILE_BELDATE:
- case FILE_LELDATE:
- if (nbytes < (offset + 4))
- return 0;
- break;
-
- case FILE_STRING:
- case FILE_PSTRING:
- if (nbytes < (offset + m->vallen))
- return 0;
- break;
- }
-
if ((ms->flags & MAGIC_DEBUG) != 0) {
mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
file_mdump(m);
}
if (m->flag & INDIR) {
+ int off = m->in_offset;
+ if (m->in_op & FILE_OPINDIRECT) {
+ const union VALUETYPE *q =
+ ((const union VALUETYPE *)(s + offset + off));
+ switch (m->in_type) {
+ case FILE_BYTE:
+ off = q->b;
+ break;
+ case FILE_SHORT:
+ off = q->h;
+ break;
+ case FILE_BESHORT:
+ off = (short)((q->hs[0]<<8)|(q->hs[1]));
+ break;
+ case FILE_LESHORT:
+ off = (short)((q->hs[1]<<8)|(q->hs[0]));
+ break;
+ case FILE_LONG:
+ off = q->l;
+ break;
+ case FILE_BELONG:
+ off = (int32_t)((q->hl[0]<<24)|(q->hl[1]<<16)|
+ (q->hl[2]<<8)|(q->hl[3]));
+ break;
+ case FILE_LELONG:
+ off = (int32_t)((q->hl[3]<<24)|(q->hl[2]<<16)|
+ (q->hl[1]<<8)|(q->hl[0]));
+ break;
+ }
+ }
switch (m->in_type) {
case FILE_BYTE:
- if (m->in_offset) {
- switch (m->in_op&0x7F) {
+ if (nbytes < (offset + 1)) return 0;
+ if (off) {
+ switch (m->in_op & 0x3F) {
case FILE_OPAND:
- offset = p->b & m->in_offset;
+ offset = p->b & off;
/*@innerbreak@*/ break;
case FILE_OPOR:
- offset = p->b | m->in_offset;
+ offset = p->b | off;
/*@innerbreak@*/ break;
case FILE_OPXOR:
- offset = p->b ^ m->in_offset;
+ offset = p->b ^ off;
/*@innerbreak@*/ break;
case FILE_OPADD:
- offset = p->b + m->in_offset;
+ offset = p->b + off;
/*@innerbreak@*/ break;
case FILE_OPMINUS:
- offset = p->b - m->in_offset;
+ offset = p->b - off;
/*@innerbreak@*/ break;
case FILE_OPMULTIPLY:
- offset = p->b * m->in_offset;
+ offset = p->b * off;
/*@innerbreak@*/ break;
case FILE_OPDIVIDE:
- offset = p->b / m->in_offset;
+ offset = p->b / off;
/*@innerbreak@*/ break;
case FILE_OPMODULO:
- offset = p->b % m->in_offset;
+ offset = p->b % off;
/*@innerbreak@*/ break;
}
} else
offset = ~offset;
break;
case FILE_BESHORT:
- if (m->in_offset) {
+ if (nbytes < (offset + 2))
+ return 0;
+ if (off) {
switch (m->in_op & 0x7F) {
case FILE_OPAND:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) &
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPOR:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) |
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPXOR:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) ^
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPADD:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) +
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMINUS:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) -
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMULTIPLY:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) *
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPDIVIDE:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) /
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMODULO:
offset = (short)((p->hs[0]<<8)|
(p->hs[1])) %
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
}
} else
offset = ~offset;
break;
case FILE_LESHORT:
- if (m->in_offset) {
+ if (nbytes < (offset + 2))
+ return 0;
+ if (off) {
switch (m->in_op & 0x7F) {
case FILE_OPAND:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) &
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPOR:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) |
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPXOR:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) ^
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPADD:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) +
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMINUS:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) -
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMULTIPLY:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) *
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPDIVIDE:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) /
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMODULO:
offset = (short)((p->hs[1]<<8)|
(p->hs[0])) %
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
}
} else
offset = ~offset;
break;
case FILE_SHORT:
- if (m->in_offset) {
+ if (nbytes < (offset + 2))
+ return 0;
+ if (off) {
switch (m->in_op & 0x7F) {
case FILE_OPAND:
- offset = p->h & m->in_offset;
+ offset = p->h & off;
/*@innerbreak@*/ break;
case FILE_OPOR:
- offset = p->h | m->in_offset;
+ offset = p->h | off;
/*@innerbreak@*/ break;
case FILE_OPXOR:
- offset = p->h ^ m->in_offset;
+ offset = p->h ^ off;
/*@innerbreak@*/ break;
case FILE_OPADD:
- offset = p->h + m->in_offset;
+ offset = p->h + off;
/*@innerbreak@*/ break;
case FILE_OPMINUS:
- offset = p->h - m->in_offset;
+ offset = p->h - off;
/*@innerbreak@*/ break;
case FILE_OPMULTIPLY:
- offset = p->h * m->in_offset;
+ offset = p->h * off;
/*@innerbreak@*/ break;
case FILE_OPDIVIDE:
- offset = p->h / m->in_offset;
+ offset = p->h / off;
/*@innerbreak@*/ break;
case FILE_OPMODULO:
- offset = p->h % m->in_offset;
+ offset = p->h % off;
/*@innerbreak@*/ break;
}
}
offset = ~offset;
break;
case FILE_BELONG:
- if (m->in_offset) {
+ if (nbytes < (offset + 4))
+ return 0;
+ if (off) {
switch (m->in_op & 0x7F) {
case FILE_OPAND:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) &
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPOR:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) |
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPXOR:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) ^
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPADD:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) +
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMINUS:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) -
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMULTIPLY:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) *
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPDIVIDE:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) /
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMODULO:
offset = (int32_t)((p->hl[0]<<24)|
(p->hl[1]<<16)|
(p->hl[2]<<8)|
(p->hl[3])) %
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
}
} else
offset = ~offset;
break;
case FILE_LELONG:
- if (m->in_offset) {
+ if (nbytes < (offset + 4))
+ return 0;
+ if (off) {
switch (m->in_op & 0x7F) {
case FILE_OPAND:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) &
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPOR:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) |
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPXOR:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) ^
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPADD:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) +
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMINUS:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) -
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMULTIPLY:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) *
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPDIVIDE:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) /
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
case FILE_OPMODULO:
offset = (int32_t)((p->hl[3]<<24)|
(p->hl[2]<<16)|
(p->hl[1]<<8)|
(p->hl[0])) %
- m->in_offset;
+ off;
/*@innerbreak@*/ break;
}
} else
offset = ~offset;
break;
case FILE_LONG:
- if (m->in_offset) {
+ if (nbytes < (offset + 4))
+ return 0;
+ if (off) {
switch (m->in_op & 0x7F) {
case FILE_OPAND:
- offset = p->l & m->in_offset;
+ offset = p->l & off;
/*@innerbreak@*/ break;
case FILE_OPOR:
- offset = p->l | m->in_offset;
+ offset = p->l | off;
/*@innerbreak@*/ break;
case FILE_OPXOR:
- offset = p->l ^ m->in_offset;
+ offset = p->l ^ off;
/*@innerbreak@*/ break;
case FILE_OPADD:
- offset = p->l + m->in_offset;
+ offset = p->l + off;
/*@innerbreak@*/ break;
case FILE_OPMINUS:
- offset = p->l - m->in_offset;
+ offset = p->l - off;
/*@innerbreak@*/ break;
case FILE_OPMULTIPLY:
- offset = p->l * m->in_offset;
+ offset = p->l * off;
/*@innerbreak@*/ break;
case FILE_OPDIVIDE:
- offset = p->l / m->in_offset;
+ offset = p->l / off;
/*@innerbreak@*/ break;
case FILE_OPMODULO:
- offset = p->l % m->in_offset;
+ offset = p->l % off;
/*@innerbreak@*/ break;
/* case TOOMANYSWITCHBLOCKS:
* ugh = p->eye % m->strain;
break;
}
+ if (m->flag & INDIROFFADD) offset += ms->c.off[cont_level-1];
if (mcopy(ms, p, m->type, 0, s, offset, nbytes) == -1)
return -1;
+ m->offset = offset;
if ((ms->flags & MAGIC_DEBUG) != 0) {
mdebug(offset, (char *)(void *)p,
file_mdump(m);
}
}
+
+ /* Verify we have enough data to match magic type */
+ switch (m->type) {
+ case FILE_BYTE:
+ if (nbytes < (offset + 1)) /* should alway be true */
+ return 0;
+ break;
+
+ case FILE_SHORT:
+ case FILE_BESHORT:
+ case FILE_LESHORT:
+ if (nbytes < (offset + 2))
+ return 0;
+ break;
+
+ case FILE_LONG:
+ case FILE_BELONG:
+ case FILE_LELONG:
+ case FILE_DATE:
+ case FILE_BEDATE:
+ case FILE_LEDATE:
+ case FILE_LDATE:
+ case FILE_BELDATE:
+ case FILE_LELDATE:
+ if (nbytes < (offset + 4))
+ return 0;
+ break;
+
+ case FILE_STRING:
+ case FILE_PSTRING:
+ case FILE_SEARCH:
+ if (nbytes < (offset + m->vallen))
+ return 0;
+ break;
+ default: break;
+ }
+
+ if (m->type == FILE_SEARCH) {
+ p->buf = malloc(m->mask + m->vallen);
+ if (p->buf == NULL) {
+ file_error(ms, errno, "Cannot allocate search buffer");
+ return 0;
+ }
+ (void)memcpy(p->buf, s + offset, m->mask + m->vallen);
+ }
if (!mconvert(ms, p, m))
- return 0;
+ return 0;
return 1;
}
regex_t rx;
char errmsg[512];
- rc = regcomp(&rx, m->value.s, REG_EXTENDED|REG_NOSUB);
+ rc = regcomp(&rx, m->value.s,
+ REG_EXTENDED|REG_NOSUB|REG_NEWLINE|
+ ((m->mask & STRING_IGNORE_LOWERCASE) ? REG_ICASE : 0));
if (rc) {
free(p->buf);
regerror(rc, &rx, errmsg, sizeof(errmsg));
return !rc;
}
}
+ case FILE_SEARCH:
+ {
+ /*
+ * search for a string in a certain range
+ */
+ unsigned char *a = (unsigned char*)m->value.s;
+ unsigned char *b = (unsigned char*)p->buf;
+ int len = m->vallen;
+ int range = 0;
+ l = 0;
+ v = 0;
+ while (++range <= m->mask) {
+ while (len-- > 0 && (v = *b++ - *a++) == 0)
+ /*@innercontinue@*/ continue;
+ if (!v) {
+ m->offset += range-1;
+ /*@loopbreak@*/ break;
+ }
+ len = m->vallen;
+ a = (unsigned char*)m->value.s;
+ b = (unsigned char*)p->buf + range;
+ }
+ free(p->buf);
+ break;
+ }
default:
file_error(ms, 0, "invalid type %d in mcheck()", m->type);
return -1;
%{__includedir}/popt.h
%changelog
-* Sat Jul 16 2005 Jeff Johnson <jbj@jbj.org> 4.4.2-0.9
+* Sun Jul 17 2005 Jeff Johnson <jbj@jbj.org> 4.4.2-0.9
- upgrade to zlib-1.2.2.4 internal.
- macosx: avoid minigzip build failures.
+- upgrade to file-4.14 internal.
* Wed Jul 13 2005 Jeff Johnson <jbj@jbj.org> 4.4.2-0.8
- updated de.po (#162756).
projects / platform / upstream / rpm.git / commitdiff