From c3ed70309cac56c66c462bf15ec7e72ab8dd3c9d Mon Sep 17 00:00:00 2001 From: DongHun Kwak Date: Thu, 3 Sep 2020 21:45:41 -0700 Subject: [PATCH] Imported Upstream version 5.39 --- ChangeLog | 80 ++++++++ Makefile.am | 5 + configure.ac | 4 +- doc/file.man | 21 +- doc/magic.man | 60 +++++- libmagic.pc.in | 10 + magic/Magdir/animation | 8 +- magic/Magdir/archive | 117 +++++++++-- magic/Magdir/asf | 132 ++++++++++++ magic/Magdir/cad | 11 +- magic/Magdir/commands | 26 ++- magic/Magdir/compress | 13 +- magic/Magdir/console | 96 ++++++++- magic/Magdir/database | 33 ++- magic/Magdir/der | 24 ++- magic/Magdir/dif | 33 +++ magic/Magdir/elf | 7 +- magic/Magdir/filesystems | 6 +- magic/Magdir/games | 12 +- magic/Magdir/gnu | 7 +- magic/Magdir/images | 461 ++++++++++++++++++++++++++++++++++++------ magic/Magdir/intel | 59 +++++- magic/Magdir/kicad | 28 ++- magic/Magdir/linux | 197 ++++++++++-------- magic/Magdir/msdos | 19 +- magic/Magdir/ole2compounddocs | 52 ++++- magic/Magdir/parix | 4 +- magic/Magdir/pascal | 6 +- magic/Magdir/pdf | 9 +- magic/Magdir/pgp | 97 +++++++-- magic/Magdir/python | 226 ++++++++++++++++++--- magic/Magdir/riff | 123 ++++++++++- magic/Magdir/rst | 4 +- magic/Magdir/rtf | 98 ++++++++- magic/Magdir/sgml | 4 +- magic/Magdir/sniffer | 356 ++++++++++++++++---------------- magic/Magdir/ssh | 20 ++ magic/Magdir/sylk | 36 ++++ magic/Magdir/ti-8x | 4 +- magic/Magdir/tplink | 6 +- magic/Magdir/troff | 10 +- magic/Magdir/unisig | 12 ++ magic/Magdir/usd | 21 ++ magic/Magdir/virtual | 2 +- magic/Magdir/web | 12 ++ magic/Magdir/windows | 200 +++++++++++------- magic/Magdir/wordprocessors | 19 +- magic/Magdir/zip | 85 ++++++-- magic/Makefile.am | 8 +- src/apprentice.c | 152 ++++++++++---- src/ascmagic.c | 14 +- src/buffer.c | 6 +- src/compress.c | 56 ++--- src/der.c | 78 +++++-- src/file.c | 90 ++++++--- src/file.h | 94 +++++---- src/file_opts.h | 97 +++++---- src/funcs.c | 138 ++++++++++++- src/is_json.c | 17 +- src/magic.c | 5 +- src/print.c | 29 ++- src/readelf.c | 45 ++++- src/seccomp.c | 13 +- src/softmagic.c | 158 ++++++++++----- 64 files changed, 3009 insertions(+), 866 deletions(-) create mode 100644 libmagic.pc.in create mode 100644 magic/Magdir/asf create mode 100644 magic/Magdir/dif create mode 100644 magic/Magdir/sylk create mode 100644 magic/Magdir/unisig create mode 100644 magic/Magdir/usd create mode 100644 magic/Magdir/web diff --git a/ChangeLog b/ChangeLog index 661a144..f877ad2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,83 @@ +2020-06-14 20:02 Christos Zoulas + + * release 5.39 + +2020-06-07 20:00 Christos Zoulas + + * Remove unused subtype_mime (Steve Grubb) + * Remove unused check in okstat (Steve Grubb) + * Fix mime-type in elf binaries by making sure $x is set + * Fix indirect negative offsets broken by OFFNEGATIVE + * Fix GUID equality check + * PR/165: Handle empty array and strings in JSON + * PR/162: Add --exclude-quiet + +2020-06-06 15:33 Christos Zoulas + + * Fix memory leak in ascmagic (Steve Grubb) + +2020-06-04 00:21 Christos Zoulas + + * Fix string comparison length with ignore whitespace + +2020-05-31 00:11 Christos Zoulas + + * Fix mingwin 64 compilation + +2020-05-30 23:56 Christos Zoulas + + * PR/159: whitelist getpid needed for file_pipe2file() + +2020-05-09 18:57 Christos Zoulas + + * Indicate negative offsets with a flag OFFNEGATIVE + so that -0 works. + * Introduce "offset" magic type that can be used to + detect the file size, and bail on short files. + * document DER better in the magic man page. + +2020-03-11 21:53 Christos Zoulas + + * fix memory leaks (SonarQube) + +2020-03-08 21:33 Christos Zoulas + + * fix memory leaks (SonarQube) + * rewrite confusing loops (SonarQube) + * fix bogus test (SonarQube) + * pass a sized buffer to file_fmttime() (SonarQube) + + * fix memory leaks (SonarQube) + +2020-02-20 15:50 Christos Zoulas + + * Don't allow * in printf formats, or the code itself (Christoph Biedl) + * Introduce a printf output size checker to avoid DoS attacks + +2020-02-17 17:22 Christos Zoulas + + * Avoid memory leak on error (oss-fuzz) + * Check length of string on DER before derefercing and add new types + * Add missing DER string (oss-fuzz) + +2020-02-16 20:45 Christos Zoulas + + * Add missing DER types, and debugging + +2020-02-13 13:10 Christos Zoulas + + * PR/140: Avoid abort with hand-crafted magic file (gockelhahn) + * PR/139 Avoid DoS in printf with hand-crafted magic file (gockelhahn) + * PR/138: Avoid crash with hand-crafted magic file (gockelhahn) + +2020-02-12 17:30 Christos Zoulas + + * PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine) + +2019-12-24 14:16 Christos Zoulas + + * add guid support + 2019-12-16 21:11 Christos Zoulas * release 5.38 diff --git a/Makefile.am b/Makefile.am index 8bd927d..2ab67ed 100644 --- a/Makefile.am +++ b/Makefile.am @@ -3,3 +3,8 @@ ACLOCAL_AMFLAGS = -I m4 EXTRA_DIST = MAINT SUBDIRS = src magic tests doc python + +# This variable must have 'exec' in its name, in order to be installed +# by 'install-exec' target (instead of default 'install-data') +pkgconfigexecdir = $(libdir)/pkgconfig +pkgconfigexec_DATA = libmagic.pc diff --git a/configure.ac b/configure.ac index ac37fcc..64c9f42 100644 --- a/configure.ac +++ b/configure.ac @@ -1,5 +1,5 @@ dnl Process this file with autoconf to produce a configure script. -AC_INIT([file],[5.38],[christos@astron.com]) +AC_INIT([file],[5.39],[christos@astron.com]) AM_INIT_AUTOMAKE([subdir-objects foreign]) m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])]) @@ -217,5 +217,5 @@ if test "$ac_cv_header_lzma_h$ac_cv_lib_lzma_lzma_stream_decoder" = "yesyes"; t AC_DEFINE([XZLIBSUPPORT], 1, [Enable xzlib compression support]) fi -AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile tests/Makefile doc/Makefile python/Makefile]) +AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile tests/Makefile doc/Makefile python/Makefile libmagic.pc]) AC_OUTPUT diff --git a/doc/file.man b/doc/file.man index 84b4b35..afba71e 100644 --- a/doc/file.man +++ b/doc/file.man @@ -1,5 +1,5 @@ -.\" $File: file.man,v 1.138 2019/10/15 18:00:40 christos Exp $ -.Dd July 13, 2019 +.\" $File: file.man,v 1.140 2020/06/07 17:41:07 christos Exp $ +.Dd June 7, 2020 .Dt FILE __CSECTION__ .Os .Sh NAME @@ -10,6 +10,7 @@ .Bk -words .Op Fl bcdEhiklLNnprsSvzZ0 .Op Fl Fl apple +.Op Fl Fl exclude-quiet .Op Fl Fl extension .Op Fl Fl mime-encoding .Op Fl Fl mime-type @@ -229,6 +230,14 @@ the soft magic method. A synonym for .Sq ascii . .El +.It Fl Fl exclude-quiet +Like +.Fl Fl exclude +but ignore tests that +.Nm +does not know about. +This is intended for compatilibity with older versions of +.Nm . .It Fl Fl extension Print a slash-separated list of valid extensions for the file type found. .It Fl F , Fl Fl separator Ar separator @@ -326,13 +335,13 @@ never read them. Set various parameter limits. .Bl -column "elf_phnum" "Default" "XXXXXXXXXXXXXXXXXXXXXXXXXXX" -offset indent .It Sy "Name" Ta Sy "Default" Ta Sy "Explanation" -.It Li indir Ta 15 Ta recursion limit for indirect magic -.It Li name Ta 30 Ta use count limit for name/use magic +.It Li bytes Ta 1048576 Ta max number of bytes to read from file .It Li elf_notes Ta 256 Ta max ELF notes processed -.It Li elf_phnum Ta 128 Ta max ELF program sections processed +.It Li elf_phnum Ta 2048 Ta max ELF program sections processed .It Li elf_shnum Ta 32768 Ta max ELF sections processed +.It Li indir Ta 50 Ta recursion limit for indirect magic +.It Li name Ta 50 Ta use count limit for name/use magic .It Li regex Ta 8192 Ta length limit for regex searches -.It Li bytes Ta 1048576 Ta max number of bytes to read from file .El .It Fl r , Fl Fl raw Don't translate unprintable characters to \eooo. diff --git a/doc/magic.man b/doc/magic.man index ed074ad..f2b6989 100644 --- a/doc/magic.man +++ b/doc/magic.man @@ -1,5 +1,5 @@ -.\" $File: magic.man,v 1.97 2019/11/15 21:03:14 christos Exp $ -.Dd January 21, 2019 +.\" $File: magic.man,v 1.98 2020/05/09 18:55:23 christos Exp $ +.Dd May 9, 2020 .Dt MAGIC __FSECTION__ .Os .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. @@ -300,6 +300,62 @@ This test is always true and clears the match flag for that continuation level. It is intended to be used with the .Dv default test. +.It Dv der +Parse the file as a DER Certificate file. +The test field is used as a der type that needs to be matched. +The DER types are: +.Dv eoc , +.Dv bool , +.Dv int , +.Dv bit_str , +.Dv octet_str , +.Dv null , +.Dv obj_id , +.Dv obj_desc , +.Dv ext , +.Dv real , +.Dv enum , +.Dv embed , +.Dv utf8_str , +.Dv rel_oid , +.Dv time , +.Dv res2 , +.Dv seq , +.Dv set , +.Dv num_str , +.Dv prt_str , +.Dv t61_str , +.Dv vid_str , +.Dv ia5_str , +.Dv utc_time , +.Dv gen_time , +.Dv gr_str , +.Dv vis_str , +.Dv gen_str , +.Dv univ_str , +.Dv char_str , +.Dv bmp_str , +.Dv date , +.Dv tod , +.Dv datetime , +.Dv duration , +.Dv oid-iri , +.Dv rel-oid-iri . +These types can be followed by an optional numeric size, which indicates +the field width in bytes. +.It Dv guid +A Globally Unique Identifier, parsed and printed as +XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX. +It's format is a string. +.It Dv offset +This is a quad value indicating the current offset of the file. +It can be used to determine the size of the file or the magic buffer. +For example the magic entries: +.Bd -literal -offset indent +-0 offset x this file is %lld bytes +-0 offset <=100 must be more than 100 \e + bytes and is only %lld +.Ed .El .Pp For compatibility with the Single diff --git a/libmagic.pc.in b/libmagic.pc.in new file mode 100644 index 0000000..3ad1290 --- /dev/null +++ b/libmagic.pc.in @@ -0,0 +1,10 @@ +prefix=@prefix@ +exec_prefix=@exec_prefix@ +libdir=@libdir@ +includedir=@includedir@ + +Name: libmagic +Description: Magic number recognition library +Version: @VERSION@ +Libs: -L${libdir} -lmagic +Libs.private: @LIBS@ diff --git a/magic/Magdir/animation b/magic/Magdir/animation index 62145b9..470fdb6 100644 --- a/magic/Magdir/animation +++ b/magic/Magdir/animation @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: animation,v 1.74 2019/10/29 01:06:20 christos Exp $ +# $File: animation,v 1.77 2020/04/26 15:23:43 christos Exp $ # animation: file(1) magic for animation/movie formats # # animation formats @@ -159,7 +159,7 @@ >8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 !:mime video/quicktime >8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP -!:mime audio/mp4 +!:mime video/mp4 >8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio !:mime audio/mp4 >8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile @@ -855,10 +855,6 @@ >3 byte &0x80 (PAL) >3 byte ^0x80 (NTSC) -# Microsoft Advanced Streaming Format (ASF) -0 belong 0x3026b275 Microsoft ASF -!:mime video/x-ms-asf - # MNG Video Format, 0 string \x8aMNG MNG video data, !:mime video/x-mng diff --git a/magic/Magdir/archive b/magic/Magdir/archive index 6ec5b6d..99798b0 100644 --- a/magic/Magdir/archive +++ b/magic/Magdir/archive @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: archive,v 1.133 2019/11/15 21:03:14 christos Exp $ +# $File: archive,v 1.138 2020/06/07 23:29:26 christos Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # @@ -236,7 +236,8 @@ !:ext deb/udeb >14 string -binary Debian binary package !:mime application/vnd.debian.binary-package -!:ext deb/udeb +# For ipk packager see also https://en.wikipedia.org/wiki/Opkg +!:ext deb/udeb/ipk # This should not happen >14 default x Unknown Debian package # NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted @@ -250,7 +251,16 @@ >>0 search/0x93e4f data.tar. \b, data compression # the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised # for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb ->>>&0 string x %.4s +>>>&0 string x %.2s +# skip space (0x20 BSD) and slash (0x2f System V) character marking end of name +>>>&2 ubyte !0x20 +>>>>&-1 ubyte !0x2f +# display 3rd character of file name extension like 2 of bz2 or m of lzma +>>>>>&-1 ubyte x \b%c +>>>>>>&0 ubyte !0x20 +>>>>>>>&-1 ubyte !0x2f +# display 4th character of file name extension like a of lzma +>>>>>>>>&-1 ubyte x \b%c # splitted debian package case >68 string =2.1\n # dpkg-1.18.25/dpkg-split/info.c @@ -1124,71 +1134,120 @@ # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) # (mimetype contains "application/vnd.sun.xml.") +# URL: https://en.wikipedia.org/wiki/OpenOffice.org_XML +# reference: http://fileformats.archiveteam.org/wiki/OpenOffice.org_XML >>50 string vnd.sun.xml. OpenOffice.org 1.x >>>62 string writer Writer >>>>68 byte !0x2e document +!:mime application/vnd.sun.xml.writer +!:ext sxw >>>>68 string .template template +!:mime application/vnd.sun.xml.writer.template +!:ext stw +>>>>68 string .web Web template +!:mime application/vnd.sun.xml.writer.web +!:ext stw >>>>68 string .global global document +!:mime application/vnd.sun.xml.writer.global +!:ext sxg >>>62 string calc Calc >>>>66 byte !0x2e spreadsheet +!:mime application/vnd.sun.xml.calc +!:ext sxc >>>>66 string .template template +!:mime application/vnd.sun.xml.calc.template +!:ext stc >>>62 string draw Draw >>>>66 byte !0x2e document +!:mime application/vnd.sun.xml.draw +!:ext sxd >>>>66 string .template template +!:mime application/vnd.sun.xml.draw.template +!:ext std >>>62 string impress Impress >>>>69 byte !0x2e presentation +!:mime application/vnd.sun.xml.impress +!:ext sxi >>>>69 string .template template +!:mime application/vnd.sun.xml.impress.template +!:ext sti >>>62 string math Math document +!:mime application/vnd.sun.xml.math +!:ext sxm >>>62 string base Database file +!:mime application/vnd.sun.xml.base +!:ext sdb # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +# URL: http://fileformats.archiveteam.org/wiki/OpenDocument # https://lists.oasis-open.org/archives/office/200505/msg00006.html # (mimetype contains "application/vnd.oasis.opendocument.") >>50 string vnd.oasis.opendocument. OpenDocument >>>73 string text >>>>77 byte !0x2d Text !:mime application/vnd.oasis.opendocument.text +!:ext odt >>>>77 string -template Text Template !:mime application/vnd.oasis.opendocument.text-template +!:ext ott >>>>77 string -web HTML Document Template !:mime application/vnd.oasis.opendocument.text-web +!:ext oth >>>>77 string -master Master Document !:mime application/vnd.oasis.opendocument.text-master +!:ext odm >>>73 string graphics >>>>81 byte !0x2d Drawing !:mime application/vnd.oasis.opendocument.graphics ->>>>81 string -template Template +!:ext odg +>>>>81 string -template Drawing Template !:mime application/vnd.oasis.opendocument.graphics-template +!:ext otg >>>73 string presentation >>>>85 byte !0x2d Presentation !:mime application/vnd.oasis.opendocument.presentation ->>>>85 string -template Template +!:ext odp +>>>>85 string -template Presentation Template !:mime application/vnd.oasis.opendocument.presentation-template +!:ext otp >>>73 string spreadsheet >>>>84 byte !0x2d Spreadsheet !:mime application/vnd.oasis.opendocument.spreadsheet ->>>>84 string -template Template +!:ext ods +>>>>84 string -template Spreadsheet Template !:mime application/vnd.oasis.opendocument.spreadsheet-template +!:ext ots >>>73 string chart >>>>78 byte !0x2d Chart !:mime application/vnd.oasis.opendocument.chart ->>>>78 string -template Template +!:ext odc +>>>>78 string -template Chart Template !:mime application/vnd.oasis.opendocument.chart-template +!:ext otc >>>73 string formula >>>>80 byte !0x2d Formula !:mime application/vnd.oasis.opendocument.formula ->>>>80 string -template Template +!:ext odf +>>>>80 string -template Formula Template !:mime application/vnd.oasis.opendocument.formula-template +!:ext otf +# https://www.loc.gov/preservation/digital/formats/fdd/fdd000441.shtml >>>73 string database Database !:mime application/vnd.oasis.opendocument.database +!:ext odb # Valid for LibreOffice Base 6.0.1.1 at least >>>73 string base Database -!:mime application/vnd.oasis.opendocument.base +# https://bugs.documentfoundation.org/show_bug.cgi?id=45854 +!:mime application/vnd.oasis.opendocument.database +#!:mime application/vnd.oasis.opendocument.base +!:ext odb >>>73 string image >>>>78 byte !0x2d Image !:mime application/vnd.oasis.opendocument.image ->>>>78 string -template Template +!:ext odi +>>>>78 string -template Image Template !:mime application/vnd.oasis.opendocument.image-template +!:ext oti # EPUB (OEBPS) books using OCF (OEBPS Container Format) # https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. @@ -1206,12 +1265,33 @@ >>>62 string draw.template+zip Draw template, version 14-16 !:mime application/x-vnd.corel.draw.template+zip !:ext cdrt ->>>62 string zcf.draw.document+zip Draw drawing, version 17-21 +>>>62 string zcf.draw.document+zip Draw drawing, version 17-22 !:mime application/x-vnd.corel.zcf.draw.document+zip !:ext cdr ->>>62 string zcf.draw.template+zip Draw template, version 17-21 +>>>62 string zcf.draw.template+zip Draw template, version 17-22 !:mime application/x-vnd.corel.zcf.draw.template+zip !:ext cdt/cdrt +# URL: http://product.corel.com/help/CorelDRAW/540240626/Main/EN/Doc/CorelDRAW-Other-file-formats.html +>>>62 string zcf.pattern+zip Draw pattern, version 22 +!:mime application/x-vnd.corel.zcf.pattern+zip +!:ext pat +# URL: https://en.wikipedia.org/wiki/Corel_Designer +# Reference: http://fileformats.archiveteam.org/wiki/Corel_Designer +# Note: called by TrID "Corel DESIGN graphics" +>>>62 string designer.document+zip DESIGNER graphics, version 14-16 +!:mime application/x-vnd.corel.designer.document+zip +!:ext des +>>>62 string zcf.designer.document+zip DESIGNER graphics, version 17-21 +!:mime application/x-vnd.corel.zcf.designer.document+zip +!:ext des +# URL: http://product.corel.com/help/CorelDRAW/540223850/Main/EN/Documentation/ +# CorelDRAW-Corel-Symbol-Library-CSL.html +>>>62 string symbol.library+zip Symbol Library, version 6-16.3 +!:mime application/x-vnd.corel.symbol.library+zip +!:ext csl +>>>62 string zcf.symbol.library+zip Symbol Library, version 17-22 +!:mime application/x-vnd.corel.zcf.symbol.library+zip +!:ext csl # Catch other ZIP-with-mimetype formats # In a ZIP file, the bytes immediately after a member's contents are @@ -1239,16 +1319,19 @@ >>>>38 search/64 .app/ iOS App !:mime application/x-ios-app +>30 search/100/b application/epub+zip EPUB document +!:mime application/epub+zip # Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) # Next line excludes specialized formats: >(26.s+30) leshort !0xcafe ->>26 string !\x8\0\0\0mimetype Zip archive data +>>30 search/100/b !application/epub+zip +>>>26 string !\x8\0\0\0mimetype Zip archive data !:mime application/zip ->>>4 beshort x \b, at least ->>>4 use zipversion ->>>4 beshort x to extract ->>>0x161 string WINZIP \b, WinZIP self-extracting +>>>>4 beshort x \b, at least +>>>>4 use zipversion +>>>>4 beshort x to extract +>>>>0x161 string WINZIP \b, WinZIP self-extracting # StarView Metafile # From Pierre Ducroquet diff --git a/magic/Magdir/asf b/magic/Magdir/asf new file mode 100644 index 0000000..c97f549 --- /dev/null +++ b/magic/Magdir/asf @@ -0,0 +1,132 @@ + +#------------------------------------------------------------------------------ +# $File: asf,v 1.1 2019/12/26 02:07:53 christos Exp $ +# asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files +# http://www.staroceans.org/e-book/ASF_Specification.pdf + +0 name asf-name +# ASF_Data_Object +#>0 guid 75B22636-668E-11CF-A6D9-00AA0062CE6C +#>16 lequad >0 +#>>(16.q) use asf-object +# ASF_Simple_Index_Object +>0 guid 33000890-E5B1-11CF-89F4-00A0C90349CB +>0 guid D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object +>0 guid FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object +>0 guid 3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object + +# ASF_File_Properties_Object +>0 guid 8CABDCA1-A947-11CF-8EE4-00C00C205365 + +# ASF_Stream_Properties_Object +>0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365 +#>>56 lequad x Time Offset %lld +#>>64 lelong x Type-Specicic Data Length %d +#>>68 lelong x Error Correction Data Length %d +#>>72 leshort x Flags 0x%x +#>>74 lelong x Reserved %x +# ASF_Audio_Media +>>24 guid F8699E40-5B4D-11CF-A8FD-00805F5C442B \b, Audio Media ( +>>>78 leshort x \bCodec Id %d +>>>80 leshort x \b, Number of channels %d +>>>82 lelong x \b, Samples Per Second %d +>>>86 lelong x \b, Average Number of Bytes Per Second %d +>>>90 lelong x \b, Block Alignment %d +>>>94 leshort x \b, Bits Per Sample %d +# ASF_Video_Media +>>24 guid BC19EFC0-5B4D-11CF-A8FD-00805F5C442B \b, Video Media ( +>>>78 lelong x \bEncoded Image Width %d +>>>82 lelong x \b, Encoded Image Height %d +#>>>85 leshort x \b, Format Data Size %x +>>>93 lelong x \b, Image Width %d +>>>97 lelong x \b, Image Height %d +#>>>101 leshort x \b, Reserved 0x%x +>>>103 leshort x \b, Bits Per Pixel Count %d +#>>>105 lelong x \b, Compression ID %d +#>>>109 lelong x \b, Image Size %d +#>>>113 lelong x \b, Horizontal Pixels Per Meter %d +#>>>117 lelong x \b, Vertical Pixels Per Meter %d +#>>>121 lelong x \b, Colors Used Count %d +#>>>125 lelong x \b, Important Colors Count %d +>>0 lelong x \b, Error correction type +>>40 use asf-name +>>0 lelong x \b) +#ASF_Header_Extension_Object +>0 guid 5FBF03B5-A92E-11CF-8EE3-00C00C205365 +# ASF_Codec_List_Object +>0 guid 86D15240-311D-11D0-A3A4-00A0C90348F6 +>0 guid 1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object +>0 guid F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object +>0 guid D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object +>0 guid 75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object +# ASF_Content_Description_Object +>0 guid 75B22633-668E-11CF-A6D9-00AA0062CE6C +#>>24 leshort title length %d +#>>26 leshort author length %d +#>>28 leshort copyright length %d +#>>30 leshort descriptor length %d +#>>32 leshort rating length %d +>0 guid D2D0A440-E307-11D2-97F0-00A0C95EA850 ASF_Extended_Content_Description_Object +>0 guid 2211B3FA-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Branding_Object +>0 guid 7BF875CE-468D-11D1-8D82-006097C9A2B2 ASF_Stream_Bitrate_Properties_Object +>0 guid 2211B3FB-BD23-11D2-B4B7-00A0C955FC6E ASF_Content_Encryption_Object +>0 guid 298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object +>0 guid 2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object +# ASF_Padding_Object +>0 guid 1806D474-CADF-4509-A4BA-9AABCB96AAE8 +>0 guid 14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object +>0 guid A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object +>0 guid D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object +>0 guid D4FED15B-88D3-454F-81F0-ED5C45999E24 ASF_Stream_Prioritization_Object +>0 guid A69609E6-517B-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Object +>0 guid 7C4346A9-EFE0-4BFC-B229-393EDE415C85 ASF_Language_List_Object +>0 guid C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA ASF_Metadata_Object +>0 guid 44231C94-9498-49D1-A141-1D134E457054 ASF_Metadata_Library_Object +>0 guid D6E229DF-35DA-11D1-9034-00A0C90349BE ASF_Index_Parameters_Object +>0 guid 6B203BAD-3F11-48E4-ACA8-D7613DE2CFA7 ASF_Media_Object_Index_Parameters_Object +>0 guid F55E496D-9797-4B5D-8C8B-604DFE9BFB24 ASF_Timecode_Index_Parameters_Object +>0 guid 26F18B5D-4584-47EC-9F5F-0E651F0452C9 ASF_Compatibility_Object +>0 guid 43058533-6981-49E6-9B74-AD12CB86D58C ASF_Advanced_Content_Encryption_Object +>0 guid 59DACFC0-59E6-11D0-A3AC-00A0C90348F6 ASF_Command_Media +>0 guid B61BE100-5B4E-11CF-A8FD-00805F5C44 ASF_JFIF_Media +>0 guid 35907DE0-E415-11CF-A917-00805F5C442B ASF_Degradable_JPEG_Media +>0 guid 91BD222C-F21C-497A-8B6D-5AA86BFC0185 ASF_File_Transfer_Media +>0 guid 3AFB65E2-47EF-40F2-AC2C-70A90D71D343 ASF_Binary_Media +>0 guid 776257D4-C627-41CB-8F81-7AC7FF1C40CC ASF_Web_Stream_Media_Subtype +>0 guid DA1E6B13-8359-4050-B398-388E965BF00C ASF_Web_Stream_Format +>0 guid 20FB5700-5B55-11CF-A8FD-00805F5C442B ASF_No_Error_Correction +>0 guid BFC3CD50-618F-11CF-8BB2-00AA00B4E220 ASF_Audio_Spread +>0 guid ABD3D211-A9BA-11cf-8EE6-00C00C205365 ASF_Reserved_1 +>0 guid 7A079BB6-DAA4-4e12-A5CA-91D38DC11A8D ASF_Content_Encryption_System_Windows_Media_DRM +# _Network_Devices +>0 guid 86D15241-311D-11D0-A3A4-00A0C90348F6 ASF_Reserved_2 +>0 guid 4B1ACBE3-100B-11D0-A39B-00A0C90348F6 ASF_Reserved_3 +>0 guid 4CFEDB20-75F6-11CF-9C0F-00A0C90349CB ASF_Reserved_4 +>0 guid D6E22A00-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Language +>0 guid D6E22A01-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Bitrate +>0 guid D6E22A02-35DA-11D1-9034-00A0C90349BE ASF_Mutex_Unknown +>0 guid AF6060AA-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Exclusive +>0 guid AF6060AB-5197-11D2-B6AF-00C04FD908E9 ASF_Bandwidth_Sharing_Partial +>0 guid 399595EC-8667-4E2D-8FDB-98814CE76C1E ASF_Payload_Extension_System_Timecode +>0 guid E165EC0E-19ED-45D7-B4A7-25CBD1E28E9B ASF_Payload_Extension_System_File_Name +>0 guid D590DC20-07BC-436C-9CF7-F3BBFBF1A4DC ASF_Payload_Extension_System_Content_Type +>0 guid 1B1EE554-F9EA-4BC8-821A-376B74E4C4B8 ASF_Payload_Extension_System_Pixel_Aspect_Ratio +>0 guid C6BD9450-867F-4907-83A3-C77921B733AD ASF_Payload_Extension_System_Sample_Duration +>0 guid 6698B84E-0AFA-4330-AEB2-1C0A98D7A44D ASF_Payload_Extension_System_Encryption_Sample_ID +>0 guid 00E1AF06-7BEC-11D1-A582-00C04FC29CFB ASF_Payload_Extension_System_Degradable_JPEG + +0 name asf-object +>0 use asf-name +#>>16 lequad >0 (size %lld) [ +>>16 lequad >0 +>>>(16.q) use asf-object +#>>16 lequad 0 ] + +# Microsoft Advanced Streaming Format (ASF) +0 guid 75B22630-668E-11CF-A6D9-00AA0062CE6C Microsoft ASF +!:mime video/x-ms-asf +#>16 lequad >0 (size %lld +#>>24 lelong x \b, %d header objects) +>16 lequad >0 +>>30 use asf-object +>>(16.q) use asf-object diff --git a/magic/Magdir/cad b/magic/Magdir/cad index 509cab3..3d07b42 100644 --- a/magic/Magdir/cad +++ b/magic/Magdir/cad @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: cad,v 1.20 2019/08/10 13:34:17 christos Exp $ +# $File: cad,v 1.23 2020/05/30 23:58:07 christos Exp $ # autocad: file(1) magic for cad files # @@ -229,7 +229,11 @@ !:mime image/vnd.dwg 0 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 !:mime image/vnd.dwg -0 string AC1027 DWG AutoDesk AutoCAD 2013/2014 +0 string AC1027 DWG AutoDesk AutoCAD 2013-2017 +!:mime image/vnd.dwg + +# From GNU LibreDWG +0 string AC1032 DWG AutoDesk AutoCAD 2018/2019 !:mime image/vnd.dwg # KOMPAS 2D drawing from ASCON @@ -315,3 +319,6 @@ 0 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model !:mime application/vnd.sketchup.skp !:ext skp + +4 regex/b P[0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9][0-9][0-9][0-9]\\.[0-9] NAXOS CAD System file from version %s +!:strength +40 diff --git a/magic/Magdir/commands b/magic/Magdir/commands index faa94ae..10f8d2b 100644 --- a/magic/Magdir/commands +++ b/magic/Magdir/commands @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: commands,v 1.61 2019/10/30 03:16:43 christos Exp $ +# $File: commands,v 1.63 2020/06/06 15:36:30 christos Exp $ # commands: file(1) magic for various shells and interpreters # #0 string/w : shell archive or script for antique kernel text @@ -84,6 +84,30 @@ 0 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable !:mime text/x-shellscript +# Fish shell magic +# From: Benjamin Lowry +0 string/wt #!\ /usr/local/bin/fish fish shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/bin/fish fish shell script text executable +!:mime text/x-shellscript +0 string/wt #!\ /usr/bin/env\ fish fish shell script text executable +!:mime text/x-shellscript + + +0 search/1/wt #!\ /usr/bin/tclsh Tcl/Tk script text executable +!:mime text/x-tcl + +0 search/1/wt #!\ /usr/bin/texlua LuaTex script text executable +!:mime text/x-luatex + +0 search/1/wt #!\ /usr/bin/luatex LuaTex script text executable +!:mime text/x-luatex + +0 search/1/wt #!\ /usr/bin/stap Systemtap script text executable +!:mime text/x-systemtap + + + # PHP scripts # Ulf Harnhammar 0 search/1/c =>>0 use gzip-info # size of the original (uncompressed) input data modulo 2^32 +>>-0 offset >48 >>>-4 ulelong x \b, original size modulo 2^32 %u +>>-0 offset <48 \b, truncated # gzipped TAR or VirtualBox extension package #!:mime application/x-compressed-tar #!:mime application/x-virtualbox-vbox-extpack @@ -84,7 +86,9 @@ !:ext gz/tgz/tpz/zabw/svgz >>0 use gzip-info # size of the original (uncompressed) input data modulo 2^32 ->>-4 ulelong x \b, original size modulo 2^32 %u +>>-0 offset >48 +>>>-4 ulelong x \b, original size modulo 2^32 %u +>>-0 offset <48 \b, truncated # display information of gzip compressed files 0 name gzip-info #>2 byte x THIS iS GZIP @@ -392,3 +396,8 @@ 0 string bvx1 lzfse compressed, uncompressed tables 0 string bvx2 lzfse compressed, compressed tables 0 string bvxn lzfse encoded, lzvn compressed + +# pcxLib.exe compression program +# http://www.shikadi.net/moddingwiki/PCX_Library +0 string/b pcxLib +>0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed diff --git a/magic/Magdir/console b/magic/Magdir/console index 28cc368..022054d 100644 --- a/magic/Magdir/console +++ b/magic/Magdir/console @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: console,v 1.49 2019/05/27 01:33:32 christos Exp $ +# $File: console,v 1.55 2020/04/19 17:30:55 christos Exp $ # Console game magic # Toby Deshane @@ -628,10 +628,12 @@ 0 string CON\x20 Microsoft Xbox 360 package (console-signed) >0 use xbox-360-package -0 string PIRS Microsoft Xbox 360 package (non-Xbox Live) ->0 use xbox-360-package -0 string LIVE Microsoft Xbox 360 package (Xbox Live) ->0 use xbox-360-package +0 string PIRS +>0 belong 0 Microsoft Xbox 360 package (non-Xbox Live) +>>0 use xbox-360-package +0 string LIVE +>0x104 belong 0 Microsoft Xbox 360 package (Xbox Live) +>>0 use xbox-360-package # Atari Lynx cartridge dump (EXE/BLL header) # From: "Stefan A. Haubenthal" @@ -667,6 +669,30 @@ # IPS Patch Files from: From: Thomas Klausner # see https://zerosoft.zophar.net/ips.php 0 string PATCH IPS patch file +!:ext ips + +# BPS Patch Files - from: David Korth +# Reference: https://www.romhacking.net/documents/746/ +0 string BPS1 BPS patch file +!:ext bps + +# APS Patch Files - from: David Korth +# Reference: https://github.com/btimofeev/UniPatcher/wiki/APS-(N64) +0 string APS10 APS patch file +!:ext aps +>5 byte 0 \b, simple patch +>5 byte 1 \b, N64-specific patch for +>>58 byte x N%c +>>59 byte x \b%c +>>60 byte x \b%c +>7 byte !0x20 +# FIXME: /T specifier isn't working with a fixed-length string. +>>7 string x \b: "%.50s" + +# UPS Patch Files - from: David Korth +# Reference: http://fileformats.archiveteam.org/wiki/UPS_(binary_patch_format) +0 string UPS1 UPS patch file +!:ext ups # Playstations Patch Files from: From: Thomas Klausner 0 string PPF30 Playstation Patch File version 3.0 @@ -767,6 +793,8 @@ >0x07 byte x \b, Rev.%02u) >0x18 belong 0x5D1C9EA3 >>0x60 beshort 0x0101 \b (Unencrypted) +>0x200 string NKIT \b (NKit compressed) + # Type: Nintendo GameCube disc image # From: David Korth @@ -1015,3 +1043,61 @@ >>>>>>0x5B byte 0x02 >>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- >>>>>>>0x58 belong x \b%08X + +#------------------------------------------------------------------------------ +# Type: Nintendo Switch XCI (Game Cartridge Image) +# From: Benjamin Lowry +# Reference: https://switchbrew.org/wiki/Gamecard_Format +0x100 string HEAD +>0x10D byte 0xFA Nintendo Switch cartridge image (XCI), 1GB +>0x10D byte 0xF8 Nintendo Switch cartridge image (XCI), 2GB +>0x10D byte 0xF0 Nintendo Switch cartridge image (XCI), 4GB +>0x10D byte 0xE0 Nintendo Switch cartridge image (XCI), 8GB +>0x10D byte 0xE1 Nintendo Switch cartridge image (XCI), 16GB +>0x10D byte 0xE2 Nintendo Switch cartridge image (XCI), 32GB + +#------------------------------------------------------------------------------ +# Type: Nintendo Switch Executable +# From: Benjamin Lowry +# Reference: https://switchbrew.org/wiki/NSO +0x00 string NSO0 Nintendo Switch executable (NSO) + +#------------------------------------------------------------------------------ +# Type: Nintendo Switch PFS0 +# From: Benjamin Lowry +# Reference: https://switchbrew.org/wiki/NCA_Format#PFS0 +0x00 string PFS0 Nintendo Switch partition filesystem (PFS0) +>0x04 ulelong x \b, %d files + +#------------------------------------------------------------------------------ +# amiibo: file(1) magic for Nintendo Badge Arcade files. +# From: David Korth +# References: +# - https://github.com/GerbilSoft/rom-properties/issues/92 +# - https://github.com/CaitSith2/BadgeArcadeTool +# - https://github.com/TheMachinumps/Advanced-badge-editor + +# PRBS: Individual badge and/or mega badge. +0 string PRBS +>0x44 byte >0x20 Nintendo Badge Arcade +>>0xB8 ulelong <2 +>>>0xBC ulelong <2 badge: +>>>0xBC ulelong >1 Mega Badge +>>>>0xB8 ulelong x (%ux +>>>>0xBC ulelong x \b%u): +>>0xB8 ulelong >1 Mega Badge +>>>0xB8 ulelong x (%ux +>>>0xBC ulelong x \b%u): +>0x44 string x "%s" +>0x3C ulelong x \b, badge ID: %u +>0x74 byte >0x20 +>>0x74 string x \b, set: "%s" +>0xA8 ulelong !0xFFFFFFFF +>>0xA8 ulelong x \b, launch title ID: %08X +>>0xA4 ulelong x \b-%08X + +# CABS: Badge set. +0 string CABS +>0x2C byte >0x20 Nintendo Badge Arcade badge set: +>>0x2C string x "%.48s" +>>0x24 ulelong x \b, set ID: %u diff --git a/magic/Magdir/database b/magic/Magdir/database index 9578c0f..a8a788e 100644 --- a/magic/Magdir/database +++ b/magic/Magdir/database @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: database,v 1.56 2019/06/14 20:12:00 christos Exp $ +# $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) @@ -359,16 +359,22 @@ >>>>>>>>>>>>0 use foxpro-memo-print # dBASE III DBT , garbage # skip WORD1XW.DOC with improbably high free block index ->>>>>>>>>0 lelong <2205083 +>>>>>>>>>0 ulelong <0x400000 +# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item +>>>>>>>>>>513 ubyte >037 # unusual dBASE III DBT like adressen.dbt ->>>>>>>>>>0 use dbase3-memo-print +>>>>>>>>>>>0 use dbase3-memo-print # dBASE III DBT like angest.dbt, or garbage PCX DBF >>>>>>>>8 ubelong !0 # skip PCX and some DBF by test for for reserved NULL bytes >>>>>>>>>510 ubeshort 0 -# skip AI070GEP.EPS with improbably high free block index ->>>>>>>>>>0 lelong <458766 ->>>>>>>>>>>0 use dbase3-memo-print +# skip bad symples with improbably high free block index above 2 GiB file limit +>>>>>>>>>>0 ulelong <0x400000 +# skip AI070GEP.EPS by printable 1st character of 1st memo item +>>>>>>>>>>>512 ubyte >037 +# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character +>>>>>>>>>>>>513 ubyte >037 +>>>>>>>>>>>>>0 use dbase3-memo-print # dBASE IV DBT with positive block size >>>>>>>20 uleshort >0 # dBASE IV DBT with valid block length like 512, 1024 @@ -490,9 +496,9 @@ #>>52 ulelong 3 \b, CleanShutdown >>52 ulelong 4 \b, BeingConverted >>52 ulelong 5 \b, ForceDetach -# Windows NT major version when the databases indexes were updated. +# Windows NT major version when the databases indexes were updated. >>216 ulelong x \b, Windows version %d -# Windows NT minor version +# Windows NT minor version >>220 ulelong x \b.%d # From: Joerg Jenderek @@ -645,3 +651,14 @@ # From: David Korth 0 string //\