diff --git a/contrib/file-4/AUTHORS b/contrib/file-4/AUTHORS new file mode 100644 index 0000000..3d3d34a --- /dev/null +++ b/contrib/file-4/AUTHORS @@ -0,0 +1 @@ +See COPYING. \ No newline at end of file diff --git a/contrib/file-4/COPYING b/contrib/file-4/COPYING new file mode 100644 index 0000000..b3db8b2 --- /dev/null +++ b/contrib/file-4/COPYING @@ -0,0 +1,29 @@ +$File: COPYING,v 1.1 2008/02/05 19:08:11 christos Exp $ +Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995. +Software written by Ian F. Darwin and others; +maintained 1994- Christos Zoulas. + +This software is not subject to any export provision of the United States +Department of Commerce, and may be exported to any country or planet. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice immediately at the beginning of the file, without modification, + this list of conditions, and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR +ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +SUCH DAMAGE. diff --git a/contrib/file-4/ChangeLog b/contrib/file-4/ChangeLog index 2beffb0..9052613 100644 --- a/contrib/file-4/ChangeLog +++ b/contrib/file-4/ChangeLog @@ -1,4 +1,50 @@ -2007-12-28 15:06 Christos Zoulas + +2008-03-27 16:16 Robert Byrnes + + * src/readelf.c (donote): + ELF core file command name/line bug fixes and enhancements: + + Try larger offsets first to avoid false matches + from earlier data that happen to look like strings; + this primarily affected SunOS 5.x 32-bit Intel core files. + + Add support for command line (instead of just short name) + for SunOS 5.x. + + Add information about NT_PSINFO for SunOS 5.x. + + Only trim whitespace from end of command line. + +2007-02-11 01:36 Reuben Thomas + + * Change strength of ! from MULT to 0, as it matches almost + anything (Reuben Thomas) + + * Debian fixes (Reuben Thomas) + +2007-02-11 00:17 Reuben Thomas + + * Clarify UTF-8 BOM message (Reuben Thomas) + + * Add HTML comment to token list in names.h + +2007-02-04 15:50 Christos Zoulas + + * Debian fixes (Reuben Thomas) + +2007-02-04 11:31 Christos Zoulas + + * !:mime annotations in magic files (Reuben Thomas) + +2007-01-29 15:35 Christos Zoulas + + * zero out utime/utimes structs (Gavin Atkinson) + +2007-01-26 13:45 Christos Zoulas + + * reduce writable data from Diego "Flameeyes" Petten + +2007-12-28 15:06 Christos Zoulas * strtof detection @@ -6,7 +52,7 @@ * better mismatch version message -2007-12-27 11:35 Christos Zoulas +2007-12-27 11:35 Christos Zoulas * bring back some fixes from OpenBSD @@ -14,46 +60,46 @@ * fix gcc warnings -2007-12-01 19:55 Christos Zoulas +2007-12-01 19:55 Christos Zoulas * make sure we have zlib.h and libz to compile the builtin decompress code -2007-10-28 20:48 Christos Zoulas +2007-10-28 20:48 Christos Zoulas * float and double magic support (Behan Webster) -2007-10-28 20:48 Christos Zoulas +2007-10-28 20:48 Christos Zoulas * Convert fortran to a soft test (Reuben Thomas) -2007-10-23 5:25 Christos Zoulas +2007-10-23 5:25 Christos Zoulas * Add --with-filename, and --no-filename (Reuben Thomas) -2007-10-23 3:59 Christos Zoulas +2007-10-23 3:59 Christos Zoulas * Rest of the mime split (Reuben Thomas) * Make usage message generated from the flags so that they stay consistent (Reuben Thomas) -2007-10-20 3:06 Christos Zoulas +2007-10-20 3:06 Christos Zoulas * typo in comment, missing ifdef QUICK, remove unneeded code (Charles Longeau) -2007-10-17 3:33 Christos Zoulas +2007-10-17 3:33 Christos Zoulas * Fix problem printing -\012 in some entries * Separate magic type and encoding flags (Reuben Thomas) -2007-10-09 3:55 Christos Zoulas +2007-10-09 3:55 Christos Zoulas * configure fix for int64 and strndup (Reuben Thomas) -2007-09-26 4:45 Christos Zoulas +2007-09-26 4:45 Christos Zoulas * Add magic_descriptor() function. @@ -62,7 +108,7 @@ * Don't convert NUL's to spaces in {l,b}estring16 (Daniel Dawson) -2007-08-19 6:30 Christos Zoulas +2007-08-19 6:30 Christos Zoulas * Make mime format consistent so that it can be easily parsed: @@ -79,38 +125,38 @@ This work was done by Reuben Thomas -2007-05-24 10:00 Christos Zoulas +2007-05-24 10:00 Christos Zoulas * Fix another integer overflow (Colin Percival) -2007-03-26 13:58 Christos Zoulas +2007-03-26 13:58 Christos Zoulas * make sure that all of struct magic_set is initialized appropriately (Brett) -2007-03-25 17:44 Christos Zoulas +2007-03-25 17:44 Christos Zoulas * reset left bytes in the buffer (Dmitry V. Levin) * compilation failed with COMPILE_ONLY and ENABLE_CONDITIONALS (Peter Avalos) -2007-03-15 10:51 Christos Zoulas +2007-03-15 10:51 Christos Zoulas * fix fortran and nroff reversed tests (Dmitry V. Levin) * fix exclude option (Dmitry V. Levin) -2007-02-08 17:30 Christos Zoulas +2007-02-08 17:30 Christos Zoulas * fix integer underflow in file_printf which can lead to to exploitable heap overflow (Jean-Sebastien Guay-Lero) -2007-02-05 11:35 Christos Zoulas +2007-02-05 11:35 Christos Zoulas * make socket/pipe reading more robust -2007-01-25 16:01 Christos Zoulas +2007-01-25 16:01 Christos Zoulas * Centralize all the tests in file_buffer. @@ -184,7 +230,7 @@ * make file.c compile with gcc warnings and pass lint -2006-12-11 16:49 Christos Zoulas +2006-12-11 16:49 Christos Zoulas * fix byteswapping issue @@ -193,7 +239,7 @@ * add a few missed cases in the strength routine -2006-12-08 16:32 Christos Zoulas +2006-12-08 16:32 Christos Zoulas * store and print the line number of the magic entry for debugging. @@ -210,7 +256,7 @@ * propagate the error return from match to file_softmagic. -2006-11-25 13:35 Christos Zoulas +2006-11-25 13:35 Christos Zoulas * Don't store the current offset in the magic struct, because it needs to be restored and @@ -221,12 +267,12 @@ print it as an additional separator; print it as the only separator. -2006-11-17 10:51 Christos Zoulas +2006-11-17 10:51 Christos Zoulas * Added a -0 option to print a '\0' separator Etienne Buira -2006-10-31 15:14 Christos Zoulas +2006-10-31 15:14 Christos Zoulas * Check offset before copying (Mike Frysinger) @@ -242,7 +288,7 @@ * use calloc to initialize the ascii buffers (Jos van den Oever) -2006-06-08 11:11 Christos Zoulas +2006-06-08 11:11 Christos Zoulas * QNX fixes (Mike Gorchak) @@ -256,7 +302,7 @@ * Magic format function improvent (Karl Chen) -2006-05-03 11:11 Christos Zoulas +2006-05-03 11:11 Christos Zoulas * Pick up some elf changes and some constant fixes from SUSE @@ -264,13 +310,13 @@ * When keep going, don't print spurious newlines (Radek Vokál) -2006-04-01 12:02 Christos Zoulas +2006-04-01 12:02 Christos Zoulas * Use calloc instead of malloc (Mike Frysinger) * Fix configure script to detect wctypes.h (Mike Frysinger) -2006-03-02 16:06 Christos Zoulas +2006-03-02 16:06 Christos Zoulas * Print empty if the file is (Mike Frysinger) @@ -278,21 +324,21 @@ * Sort magic entries by strength [experimental] -2005-11-29 13:26 Christos Zoulas +2005-11-29 13:26 Christos Zoulas * Use iswprint() to convert the output string. (Bastien Nocera) -2005-10-31 8:54 Christos Zoulas +2005-10-31 8:54 Christos Zoulas * Fix regression where the core info was not completely processed (Radek Vokál) -2005-10-20 11:15 Christos Zoulas +2005-10-20 11:15 Christos Zoulas * Middle Endian magic (Diomidis Spinellis) -2005-10-17 11:15 Christos Zoulas +2005-10-17 11:15 Christos Zoulas * Open with O_BINARY for CYGWIN (Corinna Vinschen) @@ -300,39 +346,39 @@ * Look for note sections in non executables. -2005-09-20 13:33 Christos Zoulas +2005-09-20 13:33 Christos Zoulas * Don't print SVR4 Style in core files multiple times (Radek Vokál) -2005-08-27 04:09 Christos Zoulas +2005-08-27 04:09 Christos Zoulas * Cygwin changes Corinna Vinschen -2005-08-18 09:53 Christos Zoulas +2005-08-18 09:53 Christos Zoulas * Remove erroreous mention of /etc/magic in the file man page This is gentoo bug 101639. (Mike Frysinger) * Cross-compile support and detection (Mike Frysinger) -2005-08-12 10:17 Christos Zoulas +2005-08-12 10:17 Christos Zoulas * Add -h flag and dereference symlinks if POSIXLY_CORRECT is set. -2005-07-29 13:57 Christos Zoulas +2005-07-29 13:57 Christos Zoulas * Avoid search and regex buffer overflows (Kelledin) -2005-07-12 11:48 Christos Zoulas +2005-07-12 11:48 Christos Zoulas * Provide stub implementations for {v,}nsprintf() for older OS's that don't have them. * Change mbstate_t autoconf detection macro from AC_MBSTATE_T to AC_TYPE_MBSTATE_T. -2005-06-25 11:48 Christos Zoulas +2005-06-25 11:48 Christos Zoulas * Dynamically allocate the string buffers and make the default read size 256K. @@ -361,43 +407,43 @@ With CRLF, the line length was not computed correctly, and even lines of length MAXLINELEN - 1 were treated as ``very long''. -2004-12-07 14:15 Christos Zoulas +2004-12-07 14:15 Christos Zoulas * bzip2 needs a lot of input buffer space on some files before it can begin uncompressing. This makes file -z fail on some bz2 files. Fix it by giving it a copy of the file descriptor to read as much as it wants if we - have access to it. + have access to it. -2004-11-24 12:39 Christos Zoulas +2004-11-24 12:39 Christos Zoulas * Stack smash fix, and ELF more conservative reading. Jakub Bogusz -2004-11-20 18:50 Christos Zoulas +2004-11-20 18:50 Christos Zoulas * New FreeBSD version parsing code: Jon Noack - * Hackish support for ucs16 strings + * Hackish support for ucs16 strings -2004-11-13 03:07 Christos Zoulas +2004-11-13 03:07 Christos Zoulas * print the file name and line number in syntax errors. -2004 10-12 10:50 Christos Zoulas +2004 10-12 10:50 Christos Zoulas * Fix stack overwriting on 0 length strings: Tim Waugh Ned Ludd -2004-09-27 11:30 Christos Zoulas +2004-09-27 11:30 Christos Zoulas * Remove 3rd and 4th copyright clause; approved by Ian Darwin. * Fix small memory leaks; caught by: Tamas Sarlos -2004-07-24 16:33 Christos Zoulas +2004-07-24 16:33 Christos Zoulas * magic.mime update Danny Milosavljevic @@ -407,19 +453,19 @@ * errors reading elf magic Jakub Bogusz -2004-04-12 10:55 Christos Zoulas +2004-04-12 10:55 Christos Zoulas * make sure that magic formats match magic types during compilation * fix broken sgi magic file -2004-04-06 20:36 Christos Zoulas +2004-04-06 20:36 Christos Zoulas * detect present of mbstate_t Petter Reinholdtsen * magic fixes -2004-03-22 15:25 Christos Zoulas +2004-03-22 15:25 Christos Zoulas * Lots of mime fixes (Joerg Ostertag) @@ -428,7 +474,7 @@ (Edwin Groothuis) * correct cleanup in all cases; don't just close the file. - (Christos Zoulas) + (Christos Zoulas) * add gettext message catalogue support (Michael Piefel) @@ -446,37 +492,37 @@ or name and description note sizes. Reported by (Mikael Magnusson) -2004-03-09 13:55 Christos Zoulas +2004-03-09 13:55 Christos Zoulas * Fix possible memory leak on error and add missing regfree (Dmitry V. Levin) -2003-12-23 12:12 Christos Zoulas +2003-12-23 12:12 Christos Zoulas * fix -k flag (Maciej W. Rozycki) -2003-11-18 14:10 Christos Zoulas +2003-11-18 14:10 Christos Zoulas * Try to give us much info as possible on corrupt elf files. (Willy Tarreau) * Updated python bindings (Brett Funderburg) -2003-11-11 15:03 Christos Zoulas +2003-11-11 15:03 Christos Zoulas * Include file.h first, because it includes config.h breaks largefile test macros otherwise. (Paul Eggert via Lars Hecking ) -2003-10-14 21:39 Christos Zoulas +2003-10-14 21:39 Christos Zoulas * Python bindings (Brett Funderburg) * Don't lookup past the end of the buffer (Chad Hanson) * Add MAGIC_ERROR and api on magic_errno() -2003-10-08 12:40 Christos Zoulas +2003-10-08 12:40 Christos Zoulas * handle error conditions from compile as fatal (Antti Kantee) @@ -486,32 +532,32 @@ * describe magic file handling (Bryan Henderson) -2003-09-12 15:09 Christos Zoulas +2003-09-12 15:09 Christos Zoulas * update magic files. * remove largefile support from file.h; it breaks things on most OS's -2003-08-10 10:25 Christos Zoulas +2003-08-10 10:25 Christos Zoulas * fix unmapping'ing of mmaped files. -2003-07-10 12:03 Christos Zoulas +2003-07-10 12:03 Christos Zoulas * don't exit with -1 on error; always exit 1 (Marty Leisner) * restore utimes code. -2003-06-10 17:03 Christos Zoulas +2003-06-10 17:03 Christos Zoulas * make sure we don't access uninitialized memory. * pass lint * #ifdef __cplusplus in magic.h -2003-05-25 19:23 Christos Zoulas +2003-05-25 19:23 Christos Zoulas * rename cvs magic file to revision to deal with case insensitive filesystems. -2003-05-23 17:03 Christos Zoulas +2003-05-23 17:03 Christos Zoulas * documentation fixes from Michael Piefel * magic fixes (various) @@ -521,30 +567,30 @@ close files Maciej W. Rozycki +2003-04-21 20:12 Christos Zoulas * fix zsh magic -2003-04-04 16:59 Christos Zoulas +2003-04-04 16:59 Christos Zoulas * fix operand sort order in string. -2003-04-02 17:30 Christos Zoulas +2003-04-02 17:30 Christos Zoulas * cleanup namespace in magic.h -2003-04-02 13:50 Christos Zoulas +2003-04-02 13:50 Christos Zoulas * Magic additions (Alex Ott) * Fix bug that broke VPATH compilation (Peter Breitenlohner) -2003-03-28 16:03 Christos Zoulas +2003-03-28 16:03 Christos Zoulas * remove packed attribute from magic struct. * make the magic struct properly aligned. * bump version number of compiled files to 2. -2003-03-27 13:10 Christos Zoulas +2003-03-27 13:10 Christos Zoulas * separate tar detection and run it before softmagic. * fix reversed symlink test. @@ -552,7 +598,7 @@ * make separator a string instead of a char. * update manual page and sort options. -2003-03-26 11:00 Christos Zoulas +2003-03-26 11:00 Christos Zoulas * Pass lint * make NULL in magic_file mean stdin diff --git a/contrib/file-4/INSTALL b/contrib/file-4/INSTALL new file mode 100644 index 0000000..5458714 --- /dev/null +++ b/contrib/file-4/INSTALL @@ -0,0 +1,234 @@ +Installation Instructions +************************* + +Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005, +2006 Free Software Foundation, Inc. + +This file is free documentation; the Free Software Foundation gives +unlimited permission to copy, distribute and modify it. + +Basic Installation +================== + +Briefly, the shell commands `./configure; make; make install' should +configure, build, and install this package. The following +more-detailed instructions are generic; see the `README' file for +instructions specific to this package. + + The `configure' shell script attempts to guess correct values for +various system-dependent variables used during compilation. It uses +those values to create a `Makefile' in each directory of the package. +It may also create one or more `.h' files containing system-dependent +definitions. Finally, it creates a shell script `config.status' that +you can run in the future to recreate the current configuration, and a +file `config.log' containing compiler output (useful mainly for +debugging `configure'). + + It can also use an optional file (typically called `config.cache' +and enabled with `--cache-file=config.cache' or simply `-C') that saves +the results of its tests to speed up reconfiguring. Caching is +disabled by default to prevent problems with accidental use of stale +cache files. + + If you need to do unusual things to compile the package, please try +to figure out how `configure' could check whether to do them, and mail +diffs or instructions to the address given in the `README' so they can +be considered for the next release. If you are using the cache, and at +some point `config.cache' contains results you don't want to keep, you +may remove or edit it. + + The file `configure.ac' (or `configure.in') is used to create +`configure' by a program called `autoconf'. You need `configure.ac' if +you want to change it or regenerate `configure' using a newer version +of `autoconf'. + +The simplest way to compile this package is: + + 1. `cd' to the directory containing the package's source code and type + `./configure' to configure the package for your system. + + Running `configure' might take a while. While running, it prints + some messages telling which features it is checking for. + + 2. Type `make' to compile the package. + + 3. Optionally, type `make check' to run any self-tests that come with + the package. + + 4. Type `make install' to install the programs and any data files and + documentation. + + 5. You can remove the program binaries and object files from the + source code directory by typing `make clean'. To also remove the + files that `configure' created (so you can compile the package for + a different kind of computer), type `make distclean'. There is + also a `make maintainer-clean' target, but that is intended mainly + for the package's developers. If you use it, you may have to get + all sorts of other programs in order to regenerate files that came + with the distribution. + +Compilers and Options +===================== + +Some systems require unusual options for compilation or linking that the +`configure' script does not know about. Run `./configure --help' for +details on some of the pertinent environment variables. + + You can give `configure' initial values for configuration parameters +by setting variables in the command line or in the environment. Here +is an example: + + ./configure CC=c99 CFLAGS=-g LIBS=-lposix + + *Note Defining Variables::, for more details. + +Compiling For Multiple Architectures +==================================== + +You can compile the package for more than one kind of computer at the +same time, by placing the object files for each architecture in their +own directory. To do this, you can use GNU `make'. `cd' to the +directory where you want the object files and executables to go and run +the `configure' script. `configure' automatically checks for the +source code in the directory that `configure' is in and in `..'. + + With a non-GNU `make', it is safer to compile the package for one +architecture at a time in the source code directory. After you have +installed the package for one architecture, use `make distclean' before +reconfiguring for another architecture. + +Installation Names +================== + +By default, `make install' installs the package's commands under +`/usr/local/bin', include files under `/usr/local/include', etc. You +can specify an installation prefix other than `/usr/local' by giving +`configure' the option `--prefix=PREFIX'. + + You can specify separate installation prefixes for +architecture-specific files and architecture-independent files. If you +pass the option `--exec-prefix=PREFIX' to `configure', the package uses +PREFIX as the prefix for installing programs and libraries. +Documentation and other data files still use the regular prefix. + + In addition, if you use an unusual directory layout you can give +options like `--bindir=DIR' to specify different values for particular +kinds of files. Run `configure --help' for a list of the directories +you can set and what kinds of files go in them. + + If the package supports it, you can cause programs to be installed +with an extra prefix or suffix on their names by giving `configure' the +option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. + +Optional Features +================= + +Some packages pay attention to `--enable-FEATURE' options to +`configure', where FEATURE indicates an optional part of the package. +They may also pay attention to `--with-PACKAGE' options, where PACKAGE +is something like `gnu-as' or `x' (for the X Window System). The +`README' should mention any `--enable-' and `--with-' options that the +package recognizes. + + For packages that use the X Window System, `configure' can usually +find the X include and library files automatically, but if it doesn't, +you can use the `configure' options `--x-includes=DIR' and +`--x-libraries=DIR' to specify their locations. + +Specifying the System Type +========================== + +There may be some features `configure' cannot figure out automatically, +but needs to determine by the type of machine the package will run on. +Usually, assuming the package is built to be run on the _same_ +architectures, `configure' can figure that out, but if it prints a +message saying it cannot guess the machine type, give it the +`--build=TYPE' option. TYPE can either be a short name for the system +type, such as `sun4', or a canonical name which has the form: + + CPU-COMPANY-SYSTEM + +where SYSTEM can have one of these forms: + + OS KERNEL-OS + + See the file `config.sub' for the possible values of each field. If +`config.sub' isn't included in this package, then this package doesn't +need to know the machine type. + + If you are _building_ compiler tools for cross-compiling, you should +use the option `--target=TYPE' to select the type of system they will +produce code for. + + If you want to _use_ a cross compiler, that generates code for a +platform different from the build platform, you should specify the +"host" platform (i.e., that on which the generated programs will +eventually be run) with `--host=TYPE'. + +Sharing Defaults +================ + +If you want to set default values for `configure' scripts to share, you +can create a site shell script called `config.site' that gives default +values for variables like `CC', `cache_file', and `prefix'. +`configure' looks for `PREFIX/share/config.site' if it exists, then +`PREFIX/etc/config.site' if it exists. Or, you can set the +`CONFIG_SITE' environment variable to the location of the site script. +A warning: not all `configure' scripts look for a site script. + +Defining Variables +================== + +Variables not defined in a site shell script can be set in the +environment passed to `configure'. However, some packages may run +configure again during the build, and the customized values of these +variables may be lost. In order to avoid this problem, you should set +them in the `configure' command line, using `VAR=value'. For example: + + ./configure CC=/usr/local2/bin/gcc + +causes the specified `gcc' to be used as the C compiler (unless it is +overridden in the site shell script). + +Unfortunately, this technique does not work for `CONFIG_SHELL' due to +an Autoconf bug. Until the bug is fixed you can use this workaround: + + CONFIG_SHELL=/bin/bash /bin/bash ./configure CONFIG_SHELL=/bin/bash + +`configure' Invocation +====================== + +`configure' recognizes the following options to control how it operates. + +`--help' +`-h' + Print a summary of the options to `configure', and exit. + +`--version' +`-V' + Print the version of Autoconf used to generate the `configure' + script, and exit. + +`--cache-file=FILE' + Enable the cache: use and save the results of the tests in FILE, + traditionally `config.cache'. FILE defaults to `/dev/null' to + disable caching. + +`--config-cache' +`-C' + Alias for `--cache-file=config.cache'. + +`--quiet' +`--silent' +`-q' + Do not print messages saying which checks are being made. To + suppress all normal output, redirect it to `/dev/null' (any error + messages will still be shown). + +`--srcdir=DIR' + Look for the package's source code in directory DIR. Usually + `configure' can determine that directory automatically. + +`configure' also accepts some other, not widely useful, options. Run +`configure --help' for more details. + diff --git a/contrib/file-4/LEGAL.NOTICE b/contrib/file-4/LEGAL.NOTICE deleted file mode 100644 index 68148e2..0000000 --- a/contrib/file-4/LEGAL.NOTICE +++ /dev/null @@ -1,29 +0,0 @@ -$File: LEGAL.NOTICE,v 1.15 2006/05/03 18:48:33 christos Exp $ -Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995. -Software written by Ian F. Darwin and others; -maintained 1994- Christos Zoulas. - -This software is not subject to any export provision of the United States -Department of Commerce, and may be exported to any country or planet. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions -are met: -1. Redistributions of source code must retain the above copyright - notice immediately at the beginning of the file, without modification, - this list of conditions, and the following disclaimer. -2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - -THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR -ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -SUCH DAMAGE. diff --git a/contrib/file-4/MAINT b/contrib/file-4/MAINT index 077f9d6..b881615 100644 --- a/contrib/file-4/MAINT +++ b/contrib/file-4/MAINT @@ -1,4 +1,4 @@ -$File: MAINT,v 1.9 2007/01/19 21:15:27 christos Exp $ +$File: MAINT,v 1.10 2008/02/05 19:08:11 christos Exp $ Maintenance notes: @@ -41,5 +41,4 @@ ascmagic.c file_ascmagic() readelf.c file_tryelf() "unknown" -Christos Zoulas -christos@astron.com +Christos Zoulas (see README for email address) diff --git a/contrib/file-4/NEWS b/contrib/file-4/NEWS new file mode 100644 index 0000000..939a279 --- /dev/null +++ b/contrib/file-4/NEWS @@ -0,0 +1 @@ +See ChangeLog. \ No newline at end of file diff --git a/contrib/file-4/README b/contrib/file-4/README index b7e9d55..2b6b7f5 100644 --- a/contrib/file-4/README +++ b/contrib/file-4/README @@ -1,5 +1,10 @@ ** README for file(1) Command ** -@(#) $File: README,v 1.34 2006/05/03 18:48:33 christos Exp $ +@(#) $File: README,v 1.39 2008/02/14 20:22:20 christos Exp $ + +E-mail: christos@astron.com +Mailing List: file@mx.gw.com + +Phone: Do not even think of telephoning me about this program. Send cash first! This is Release 4.x of Ian Darwin's (copyright but distributable) file(1) command. This version is the standard "file" command for Linux, @@ -71,6 +76,10 @@ readelf.[ch] - Stand-alone elf parsing code. compress.c - on-the-fly decompression. print.c - print results, errors, warnings. +You can download the latest version of file from: + + ftp://ftp.astron.com/pub/file/ + If your gzip sometimes fails to decompress things complaining about a short file, apply this patch [which is going to be in the next version of gzip]: *** - Tue Oct 29 02:06:35 1996 @@ -85,10 +94,6 @@ file, apply this patch [which is going to be in the next version of gzip]: } bytes_in += (ulg)insize; -E-mail: christos@astron.com - -Phone: Do not even think of telephoning me about this program. Send cash first! - Parts of this software were developed at SoftQuad Inc., developers of SGML/HTML/XML publishing software, in Toronto, Canada. SoftQuad was swallowed up by Corel in 2002 diff --git a/contrib/file-4/README.DELETED b/contrib/file-4/README.DELETED index 71c739e..e870b14 100644 --- a/contrib/file-4/README.DELETED +++ b/contrib/file-4/README.DELETED @@ -1,23 +1,21 @@ Makefile.am Makefile.in -PORTING acinclude.m4 aclocal.m4 config.guess config.h.in config.sub configure -configure.in +configure.ac depcomp install-sh ltmain.sh missing -mkinstalldirs doc/Makefile.am doc/Makefile.in magic/Makefile.am magic/Makefile.in -magic/magic2mime python src/Makefile.am src/Makefile.in +tests/ diff --git a/contrib/file-4/doc/file.man b/contrib/file-4/doc/file.man index 05bf9e7..197700f 100644 --- a/contrib/file-4/doc/file.man +++ b/contrib/file-4/doc/file.man @@ -1,5 +1,5 @@ -.\" $File: file.man,v 1.66 2007/10/23 19:58:59 christos Exp $ -.Dd January 8, 2007 +.\" $File: file.man,v 1.73 2008/02/19 17:58:00 rrt Exp $ +.Dd February 19, 2008 .Dt FILE __CSECTION__ .Os .Sh NAME @@ -8,8 +8,8 @@ .Sh SYNOPSIS .Nm .Op Fl bchikLnNprsvz -.Op Fl mime-type -.Op Fl mime-encoding +.Op Fl -mime-type +.Op Fl -mime-encoding .Op Fl f Ar namefile .Op Fl F Ar separator .Op Fl m Ar magicfiles @@ -17,6 +17,8 @@ .Nm .Fl C .Op Fl m Ar magicfile +.Nm +.Op Fl -help .Sh DESCRIPTION This manual page documents version __VERSION__ of the .Nm @@ -25,7 +27,7 @@ command. .Nm tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: -filesystem tests, magic number tests, and language tests. +filesystem tests, magic tests, and language tests. The .Em first test that succeeds causes the file type to be printed. @@ -49,11 +51,9 @@ meaning anything else (data is usually or non-printable). Exceptions are well-known file formats (core files, tar archives) that are known to contain binary data. -When modifying the file -.Pa __MAGIC__ -or the program itself, make sure to +When modifying magic files or the program itself, make sure to .Em "preserve these keywords" . -People depend on knowing that all the readable files in a directory +Users depend on knowing that all the readable files in a directory have the word .Dq text printed. @@ -61,12 +61,6 @@ Don't do as Berkeley did and change .Dq shell commands text to .Dq shell script . -Note that the file -.Pa __MAGIC__ -is built mechanically from a large number of small files in -the subdirectory -.Pa Magdir -in the source distribution of this program. .Pp The filesystem tests are based on examining the return from a .Xr stat 2 @@ -80,7 +74,7 @@ are intuited if they are defined in the system header file .In sys/stat.h . .Pp -The magic number tests are used to check for files with data in +The magic tests are used to check for files with data in particular fixed formats. The canonical example of this is a binary executable (compiled program) .Dv a.out @@ -97,22 +91,20 @@ near the beginning of the file that tells the .Dv UNIX operating system that the file is a binary executable, and which of several types thereof. The concept of a -.Sq "magic number" +.Sq "magic" has been applied by extension to data files. Any file with some invariant identifier at a small fixed offset into the file can usually be described in this way. The information identifying these files is read from the compiled magic file .Pa __MAGIC__.mgc , -or +or the files in the directory .Pa __MAGIC__ -if the compile file does not exist. In addition -.Nm -will look in -.Pa $HOME/.magic.mgc , +if the compiled file does not exist. In addition, if +.Pa $HOME/.magic.mgc or .Pa $HOME/.magic -for magic entries. +exists, it will be used in preference to the system magic files. .Pp If a file does not match any of the entries in the magic file, it is examined to see if it seems to be a text file. @@ -145,9 +137,9 @@ Once has determined the character set used in a text-type file, it will attempt to determine in what language the file is written. -The language tests look for particular strings (cf +The language tests look for particular strings (cf. .In names.h -that can appear anywhere in the first few blocks of a file. +) that can appear anywhere in the first few blocks of a file. For example, the keyword .Em .br indicates that the file is most likely a @@ -163,7 +155,8 @@ The language test routines also test for some miscellany archives). .Pp Any file that cannot be identified as having been written -in any of the character sets listed above is simply said to be ``data''. +in any of the character sets listed above is simply said to be +.Dq data . .Sh OPTIONS .Bl -tag -width indent .It Fl b , -brief @@ -176,7 +169,7 @@ flag to debug a new magic file before installing it. .It Fl C , -compile Write a .Pa magic.mgc -output file that contains a pre-parsed version of the magic file. +output file that contains a pre-parsed version of the magic file or directory. .It Fl e , -exclude Ar testname Exclude the test named in .Ar testname @@ -239,12 +232,18 @@ file. (See .Dq FILES section, below). -.It Fl -mime-type , -mime-encoding +.It Fl -mime-type , -mime-encoding Like .Fl i , but print only the specified element(s). .It Fl k , -keep-going -Don't stop at the first match, keep going. +Don't stop at the first match, keep going. Subsequent matches will be +have the string +.Dq "\[rs]012\- " +prepended. +(If you want a newline, see the +.Dq "\-r" +option.) .It Fl L , -dereference option causes symlinks to be followed, as the like-named option in .Xr ls 1 @@ -253,16 +252,9 @@ This is the default if the environment variable .Dv POSIXLY_CORRECT is defined. .It Fl m , -magic-file Ar list -Specify an alternate list of files containing magic numbers. -This can be a single file, or a colon-separated list of files. -If a compiled magic file is found alongside, it will be used instead. -With the -.Fl i -or -.Fl "mime" -option, the program adds -.Dq .mime -to each file name. +Specify an alternate list of files and directories containing magic. +This can be a single item, or a colon-separated list. +If a compiled magic file is found alongside a file or directory, it will be used instead. .It Fl n , -no-buffer Force stdout to be flushed after checking each file. This is only useful if checking a list of files. @@ -316,38 +308,27 @@ the output. This does not affect the separator which is still printed. Print a help message and exit. .El .Sh FILES -.Bl -tag -width __MAGIC__.mime.mgc -compact +.Bl -tag -width __MAGIC__.mgc -compact .It Pa __MAGIC__.mgc -Default compiled list of magic numbers +Default compiled list of magic. .It Pa __MAGIC__ -Default list of magic numbers -.It Pa __MAGIC__.mime.mgc -Default compiled list of magic numbers, used to output mime types when -the -.Fl i -option is specified. -.It Pa __MAGIC__.mime -Default list of magic numbers, used to output mime types when the -.Fl i -option is specified. +Directory containing default magic files. .El .Sh ENVIRONMENT The environment variable .Dv MAGIC -can be used to set the default magic number file name. +can be used to set the default magic file name. If that variable is set, then .Nm will not attempt to open .Pa $HOME/.magic . .Nm adds -.Dq .mime -and/or .Dq .mgc to the value of this variable as appropriate. The environment variable .Dv POSIXLY_CORRECT -controls (on systems that support symbolic links), if +controls (on systems that support symbolic links), whether .Nm will attempt to follow symlinks or not. If set, then .Nm @@ -361,7 +342,8 @@ options. .Xr magic __FSECTION__ , .Xr strings 1 , .Xr od 1 , -.Xr hexdump 1 +.Xr hexdump 1, +.Xr file 1posix .Sh STANDARDS CONFORMANCE This program is believed to exceed the System V Interface Definition of FILE(CMD), as near as one can determine from the vague language @@ -465,7 +447,7 @@ command in every .Dv UNIX since at least Research Version 4 (man page dated November, 1973). The System V version introduced one significant major change: -the external list of magic number types. +the external list of magic types. This slowed the program down slightly but made it a lot more flexible. .Pp This program, based on the System V version, @@ -486,17 +468,23 @@ Christos Zoulas (christos@astron.com). Altered by Chris Lowth, chris@lowth.com, 2000: Handle the .Fl i -option to output mime type strings and using an alternative +option to output mime type strings, using an alternative magic file and internal logic. .Pp Altered by Eric Fischer (enf@pobox.com), July, 2000, to identify character codes and attempt to identify the languages of non-ASCII files. .Pp -The list of contributors to the "Magdir" directory (source for the -.Pa __MAGIC__ -file) is too long to include here. +Altered by Reuben Thomas (rrt@sc3d.org), 2007 to 2008, to improve MIME +support and merge MIME and non-MIME magic, support directories as well +as files of magic, apply many bug fixes and improve the build system. +.Pp +The list of contributors to the +.Dq magic +directory (magic files) +is too long to include here. You know who you are; thank you. +Many contributors are listed in the source files. .Sh LEGAL NOTICE Copyright (c) Ian F. Darwin, Toronto, Canada, 1986-1999. Covered by the standard Berkeley Software Distribution copyright; see the file @@ -510,17 +498,10 @@ were written by John Gilmore from his public-domain .Xr tar 1 program, and are not covered by the above license. .Sh BUGS +.Pp There must be a better way to automate the construction of the Magic file from all the glop in Magdir. What is it? -.\" Compilation support has been done -.\" Better yet, the magic file should be compiled into binary (say, -.\" .Xr ndbm 3 -.\" or, better yet, fixed-length -.\" .Dv ASCII -.\" strings for use in heterogenous network environments) for faster startup. -.\" Then the program would run as fast as the Version 7 program of the same -.\" name, with the flexibility of the System V version. .Pp .Nm uses several algorithms that favor speed over accuracy, @@ -530,31 +511,6 @@ files. .Pp The support for text files (primarily for programming languages) is simplistic, inefficient and requires recompilation to update. -.\" Else support has been done -.\" There should be an -.\" .Dv else -.\" clause to follow a series of continuation lines. -.\" .Pp -.\" Regular expression support has been done -.\" The magic file and keywords should have regular expression support. -Their use of -.Dv ASCII TAB -as a field delimiter is ugly and makes -it hard to edit the files, but is entrenched. -.Pp -It might be advisable to allow upper-case letters in keywords -for e.g., -.Xr troff 1 -commands vs man page macros. -Regular expression support would make this easy. -.Pp -The program doesn't grok -.Dv FORTRAN . -It should be able to figure -.Dv FORTRAN -by seeing some keywords which -appear indented at the start of line. -Regular expression support would make this easy. .Pp The list of keywords in .Dv ascmagic @@ -563,11 +519,6 @@ This could be done by using some keyword like .Sq * for the offset value. .Pp -.\" Sorting has been done. -.\" Another optimization would be to sort -.\" the magic file so that we can just run down all the -.\" tests for the first byte, first word, first long, etc, once we -.\" have fetched it. Complain about conflicts in the magic file entries. Make a rule that the magic entries sort based on file offset rather than position within the magic file? @@ -587,10 +538,10 @@ versus Still, if the others don't pan out, it should be possible to use the first guess. .Pp -This program is slower than some vendors' file commands. -The new support for multiple character codes makes it even slower. -.Pp This manual page, and particularly this section, is too long. +.Sh RETURN CODE +.Nm +returns 0 on success, and non-zero on error. .Sh AVAILABILITY You can obtain the original author's latest version by anonymous FTP on diff --git a/contrib/file-4/doc/libmagic.man b/contrib/file-4/doc/libmagic.man index 61e8f27..d7082c9 100644 --- a/contrib/file-4/doc/libmagic.man +++ b/contrib/file-4/doc/libmagic.man @@ -1,3 +1,4 @@ +.\" $File: libmagic.man,v 1.18 2008/02/28 22:24:46 rrt Exp $ .\" .\" Copyright (c) Christos Zoulas 2003. .\" All Rights Reserved. @@ -164,7 +165,7 @@ bytes size. .Pp The .Fn magic_setflags -function, sets the +function sets the .Ar flags described above. Note that using both MIME flags together can also return extra information on the charset. @@ -185,7 +186,9 @@ separated list of database files passed in as or NULL for the default database. It returns 0 on success and -1 on failure. The compiled files created are named from the .Xr basename 1 -of each file argument with ".mgc" appended to it. +of each file argument with +.Dq .mgc +appended to it. .Pp The .Fn magic_load @@ -199,7 +202,11 @@ The default database file is named by the MAGIC environment variable. If that variable is not set, the default database file name is __MAGIC__. .Pp .Fn magic_load -adds ".mime" and/or ".mgc" to the database filename as appropriate. +adds +.Dq .mime +and/or +.Dq .mgc +to the database filename as appropriate. .Sh RETURN VALUES The function .Fn magic_open diff --git a/contrib/file-4/doc/magic.man b/contrib/file-4/doc/magic.man index 3842b64..233bea8 100644 --- a/contrib/file-4/doc/magic.man +++ b/contrib/file-4/doc/magic.man @@ -1,11 +1,11 @@ -.\" $File: magic.man,v 1.39 2007/11/08 00:31:37 christos Exp $ +.\" $File: magic.man,v 1.56 2008/03/01 22:21:48 rrt Exp $ .Dd January 10, 2007 .Dt MAGIC __FSECTION__ .Os -.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems. +.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. .Sh NAME .Nm magic -.Nd file command's magic number file +.Nd file command's magic pattern file .Sh DESCRIPTION This manual page documents the format of the magic file as used by the @@ -15,18 +15,17 @@ The .Xr file __CSECTION__ command identifies the type of a file using, among other tests, -a test for whether the file begins with a certain -.Dq "magic number" . +a test for whether the file contains certain +.Dq "magic patterns" . The file .Pa __MAGIC__ -specifies what magic numbers are to be tested for, -what message to print if a particular magic number is found, +specifies what patterns are to be tested for, what message or +MIME type to print if a particular pattern is found, and additional information to extract from the file. .Pp Each line of the file specifies a test to be performed. A test compares the data starting at a particular offset -in the file with a 1-byte, 2-byte, or 4-byte numeric value or -a string. +in the file with a byte value, a string or a numeric value. If the test succeeds, a message is printed. The line consists of the following fields: .Bl -tag -width ".Dv message" @@ -40,15 +39,15 @@ The possible values are: .It Dv byte A one-byte value. .It Dv short -A two-byte value (on most systems) in this machine's native byte order. +A two-byte value in this machine's native byte order. .It Dv long -A four-byte value (on most systems) in this machine's native byte order. +A four-byte value in this machine's native byte order. .It Dv quad -An eight-byte value (on most systems) in this machine's native byte order. +An eight-byte value in this machine's native byte order. .It Dv float -A 32-bit (on most systems) single precision IEEE floating point number in this machine's native byte order. +A 32-bit single precision IEEE floating point number in this machine's native byte order. .It Dv double -A 64-bit (on most systems) double precision IEEE floating point number in this machine's native byte order. +A 64-bit double precision IEEE floating point number in this machine's native byte order. .It Dv string A string of bytes. The string type specification can be optionally followed @@ -69,10 +68,10 @@ Finally the .Dq c flag, specifies case insensitive matching: lowercase characters in the magic match both lower and upper case characters in the -targer, whereas upper case characters in the magic, only much uppercase +target, whereas upper case characters in the magic only match uppercase characters in the target. .It Dv pstring -A pascal style string where the first byte is interpreted as the an +A Pascal-style string where the first byte is interpreted as the an unsigned length. The string is not NUL terminated. .It Dv date @@ -86,106 +85,119 @@ local time rather than UTC. An eight-byte value interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv beshort -A two-byte value (on most systems) in big-endian byte order. +A two-byte value in big-endian byte order. .It Dv belong -A four-byte value (on most systems) in big-endian byte order. +A four-byte value in big-endian byte order. .It Dv bequad -An eight-byte value (on most systems) in big-endian byte order. +An eight-byte value in big-endian byte order. .It Dv befloat -A 32-bit (on most systems) single precision IEEE floating point number in big-endian byte order. +A 32-bit single precision IEEE floating point number in big-endian byte order. .It Dv bedouble -A 64-bit (on most systems) double precision IEEE floating point number in big-endian byte order. +A 64-bit double precision IEEE floating point number in big-endian byte order. .It Dv bedate -A four-byte value (on most systems) in big-endian byte order, +A four-byte value in big-endian byte order, interpreted as a Unix date. .It Dv beqdate -An eight-byte value (on most systems) in big-endian byte order, +An eight-byte value in big-endian byte order, interpreted as a Unix date. .It Dv beldate -A four-byte value (on most systems) in big-endian byte order, +A four-byte value in big-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv beqldate -An eight-byte value (on most systems) in big-endian byte order, +An eight-byte value in big-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv bestring16 A two-byte unicode (UCS16) string in big-endian byte order. .It Dv leshort -A two-byte value (on most systems) in little-endian byte order. +A two-byte value in little-endian byte order. .It Dv lelong -A four-byte value (on most systems) in little-endian byte order. +A four-byte value in little-endian byte order. .It Dv lequad -An eight-byte value (on most systems) in little-endian byte order. +An eight-byte value in little-endian byte order. .It Dv lefloat -A 32-bit (on most systems) single precision IEEE floating point number in little-endian byte order. +A 32-bit single precision IEEE floating point number in little-endian byte order. .It Dv ledouble -A 64-bit (on most systems) double precision IEEE floating point number in little-endian byte order. +A 64-bit double precision IEEE floating point number in little-endian byte order. .It Dv ledate -A four-byte value (on most systems) in little-endian byte order, +A four-byte value in little-endian byte order, interpreted as a UNIX date. .It Dv leqdate -An eight-byte value (on most systems) in little-endian byte order, +An eight-byte value in little-endian byte order, interpreted as a UNIX date. .It Dv leldate -A four-byte value (on most systems) in little-endian byte order, +A four-byte value in little-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv leqldate -An eight-byte value (on most systems) in little-endian byte order, +An eight-byte value in little-endian byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv lestring16 A two-byte unicode (UCS16) string in little-endian byte order. .It Dv melong -A four-byte value (on most systems) in middle-endian (PDP-11) byte order. +A four-byte value in middle-endian (PDP-11) byte order. .It Dv medate -A four-byte value (on most systems) in middle-endian (PDP-11) byte order, +A four-byte value in middle-endian (PDP-11) byte order, interpreted as a UNIX date. .It Dv meldate -A four-byte value (on most systems) in middle-endian (PDP-11) byte order, +A four-byte value in middle-endian (PDP-11) byte order, interpreted as a UNIX-style date, but interpreted as local time rather than UTC. .It Dv regex A regular expression match in extended POSIX regular expression syntax -(much like egrep). -The type specification can be optionally followed by /[cse]*. +(like egrep). Regular expressions can take exponential time to +process, and their performance is hard to predict, so their use is +discouraged. When used in production environments, their performance +should be carefully checked. The type specification can be optionally +followed by +.Dv /[c][s] . The .Dq c flag makes the match case insensitive, while the .Dq s -or -.Dq e -flags update the offset to the starting or ending offsets of the -match (only one should be used). -By default, regex does not update the offset. -The regular expression is always tested against the first +flag update the offset to the start offset of the match, rather than the end. +The regular expression is tested against line +.Dv N + 1 +onwards, where .Dv N -lines, where -.Dv N -is the given offset, thus it -is only useful for (single-byte encoded) text. +is the given offset. +Line endings are assumed to be in the machine's native format. .Dv ^ and .Dv $ -will match the beginning and end of individual lines, respectively, +match the beginning and end of individual lines, respectively, not beginning and end of file. .It Dv search -A literal string search starting at the given offset. -It must be followed by -.Dv \*[Lt]number\*[Gt] -which specifies how many matches shall be attempted (the range). -This is suitable for searching larger binary expressions with variable -offsets, using +A literal string search starting at the given offset. The same +modifier flags can be used as for string patterns. The modifier flags +(if any) must be followed by +.Dv /number +the range, that is, the number of positions at which the match will be +attempted, starting from the start offset. This is suitable for +searching larger binary expressions with variable offsets, using .Dv \e -escapes for special characters. +escapes for special characters. The offset works as for regex. .It Dv default -This is intended to be used with the text -.Dv x +This is intended to be used with the test +.Em x (which is always true) and a message that is to be used if there are no other matches. .El -.El +.Pp +Each top-level magic pattern (see below for an explanation of levels) +is classified as text or binary according to the types used. Types +.Dq regex +and +.Dq search +are classified as text tests, unless non-printable characters are used +in the pattern. All other tests are classified as binary. A top-level +pattern is considered to be a test text when all its patterns are text +patterns; otherwise, it is considered to be a binary pattern. When +matching a file, binary patterns are tried first; if no match is +found, and the file looks like text, then its encoding is determined +and the text patterns are tried. .Pp The numeric types may optionally be followed by .Dv \*[Am] @@ -195,7 +207,6 @@ numeric value before any comparisons are done. Prepending a .Dv u to the type indicates that ordered comparisons should be unsigned. -.Bl -tag -width ".Dv message" .It Dv test The value to be compared with the value from the file. If the type is @@ -232,12 +243,8 @@ Operators and .Dv ~ don't work with floats and doubles. -For all tests except -.Em string -and -.Em regex , -operation -.Dv ! +The operator +.Dv !\& specifies that the line matches if the test does .Em not succeed. @@ -250,8 +257,8 @@ is octal, and .Dv 0x13 is hexadecimal. .Pp -For string values, the byte string from the -file must match the specified byte string. +For string values, the string from the +file must match the specified string. The operators .Dv = , .Dv \*[Lt] @@ -262,10 +269,10 @@ and can be applied to strings. The length used for matching is that of the string argument in the magic file. -This means that a line can match any string, and -then presumably print that string, by doing +This means that a line can match any non-empty string (usually used to +then print the string), with .Em \*[Gt]\e0 -(because all strings are greater than the null string). +(because all non-empty strings are greater than the empty string). .Pp The special test .Em x @@ -276,11 +283,24 @@ If the string contains a .Xr printf 3 format specification, the value from the file (with any specified masking performed) is printed using the message as the format string. -If the string begins with ``\\b'', the message printed is the -remainder of the string with no whitespace added before it: multiple -matches are normally separated by a single space. +If the string begins with +.Dq \eb , +the message printed is the remainder of the string with no whitespace +added before it: multiple matches are normally separated by a single +space. .El .Pp +A MIME type is given on a separate line, which must be the next +non-blank or comment line after the magic line that identifies the +file type, and has the following format: +.Bd -literal -offset indent +!:mime MIMETYPE +.Ed +.Pp +i.e. the literal string +.Dq !:mime +followed by the MIME type. +.Pp Some file formats contain additional information which is to be printed along with the file type or need additional tests to determine the true file type. @@ -350,13 +370,13 @@ That way variable length structures can be examined: \*[Gt]\*[Gt](0x3c.l) string LX\e0\e0 LX executable (OS/2) .Ed .Pp -This strategy of examining has one drawback: You must make sure that +This strategy of examining has a drawback: You must make sure that you eventually print something, or users may get empty output (like, when there is neither PE\e0\e0 nor LE\e0\e0 in the above example) .Pp -If this indirect offset cannot be used as-is, there are simple calculations +If this indirect offset cannot be used directly, simple calculations are possible: appending -.Em [+-*/%\*[Am]|^]\*[Lt]number\*[Gt] +.Em [+-*/%\*[Am]|^]number inside parentheses allows one to modify the value read from the file before it is used as an offset: .Bd -literal -offset indent @@ -468,4 +488,3 @@ a system on which the lengths are invariant. .\" the changes I posted to the S5R2 version. .\" .\" Modified for Ian Darwin's version of the file command. -.\" @(#)$Id: magic.man,v 1.39 2007/11/08 00:31:37 christos Exp $ diff --git a/contrib/file-4/magic/Magdir/adventure b/contrib/file-4/magic/Magdir/adventure index 405d3cc..7b30c49 100644 --- a/contrib/file-4/magic/Magdir/adventure +++ b/contrib/file-4/magic/Magdir/adventure @@ -73,3 +73,13 @@ >10 belong 0x0A0D1A00 >>14 string >\0 %s saved game data +# Danny Milosavljevic +# this are adrift (adventure game standard) game files, extension .taf +# depending on version magic continues with 0x93453E6139FA (V 4.0) +# 0x9445376139FA (V 3.90) +# 0x9445366139FA (V 3.80) +# this is from source (http://www.adrift.org.uk/) and I have some taf +# files, and checked them. +#0 belong 0x3C423FC9 +#>4 belong 0x6A87C2CF Adrift game file +#!:mime application/x-adrift diff --git a/contrib/file-4/magic/Magdir/animation b/contrib/file-4/magic/Magdir/animation index 6392f85..62fc359 100644 --- a/contrib/file-4/magic/Magdir/animation +++ b/contrib/file-4/magic/Magdir/animation @@ -8,37 +8,58 @@ # SGI and Apple formats 0 string MOVI Silicon Graphics movie file +!:mime video/x-sgi-movie 4 string moov Apple QuickTime +!:mime video/quicktime >12 string mvhd \b movie (fast start) >12 string mdra \b URL >12 string cmov \b movie (fast start, compressed header) >12 string rmra \b multiple URLs 4 string mdat Apple QuickTime movie (unoptimized) -4 string wide Apple QuickTime movie (unoptimized) -4 string skip Apple QuickTime movie (modified) -4 string free Apple QuickTime movie (modified) +!:mime video/quicktime +#4 string wide Apple QuickTime movie (unoptimized) +#!:mime video/quicktime +#4 string skip Apple QuickTime movie (modified) +#!:mime video/quicktime +#4 string free Apple QuickTime movie (modified) +#!:mime video/quicktime 4 string idsc Apple QuickTime image (fast start) -4 string idat Apple QuickTime image (unoptimized) +!:mime image/x-quicktime +#4 string idat Apple QuickTime image (unoptimized) +#!:mime image/x-quicktime 4 string pckg Apple QuickTime compressed archive +!:mime application/x-quicktime-player 4 string/B jP JPEG 2000 image +!:mime image/jp2 4 string ftyp ISO Media >8 string isom \b, MPEG v4 system, version 1 +!:mime video/mp4 >8 string iso2 \b, MPEG v4 system, part 12 revision >8 string mp41 \b, MPEG v4 system, version 1 +!:mime video/mp4 >8 string mp42 \b, MPEG v4 system, version 2 +!:mime video/mp4 >8 string mp7t \b, MPEG v4 system, MPEG v7 XML >8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML >8 string/B jp2 \b, JPEG 2000 +!:mime image/jp2 >8 string 3gp \b, MPEG v4 system, 3GPP +!:mime video/3gpp >>11 byte 4 \b v4 (H.263/AMR GSM 6.10) >>11 byte 5 \b v5 (H.263/AMR GSM 6.10) >>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) >8 string mmp4 \b, MPEG v4 system, 3GPP Mobile +!:mime video/mp4 >8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC +!:mime video/3gpp >8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC +!:mime audio/mp4 +>8 string/B M4V \b, MPEG v4 system, iTunes AVC-LC +!:mime video/mp4 >8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted >8 string/B M4B \b, MPEG v4 system, iTunes bookmarked >8 string/B qt \b, Apple QuickTime movie +!:mime video/quicktime # MPEG sequences # Scans for all common MPEG header start codes @@ -48,7 +69,7 @@ >>5 byte 77 \b, main >>5 byte 88 \b, extended >>7 byte x \b @ L %u -0 belong&0xFFFFFF00 0x00000100 MPEG sequence +0 string \000\000\001 MPEG sequence >3 byte 0xBA >>4 byte &0x40 \b, v2, program multiplex >>4 byte ^0x40 \b, v1, system multiplex @@ -252,22 +273,39 @@ # modified to fully support MPEG ADTS # MP3, M1A -0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1 +# modified by Joerg Jenderek +# GRR the original test are too common for many DOS files +# so don't accept as MP3 until we've tested the rate +0 beshort&0xFFFE # rates ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 40 kBits ->2 byte&0xF0 0x30 \b, 48 kBits ->2 byte&0xF0 0x40 \b, 56 kBits ->2 byte&0xF0 0x50 \b, 64 kBits ->2 byte&0xF0 0x60 \b, 80 kBits ->2 byte&0xF0 0x70 \b, 96 kBits ->2 byte&0xF0 0x80 \b, 112 kBits ->2 byte&0xF0 0x90 \b, 128 kBits ->2 byte&0xF0 0xA0 \b, 160 kBits ->2 byte&0xF0 0xB0 \b, 192 kBits ->2 byte&0xF0 0xC0 \b, 224 kBits ->2 byte&0xF0 0xD0 \b, 256 kBits ->2 byte&0xF0 0xE0 \b, 320 kBits +>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps +!:mime audio/mpeg +>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps +!:mime audio/mpeg +>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps +!:mime audio/mpeg # timing >2 byte&0x0C 0x00 \b, 44.1 kHz >2 byte&0x0C 0x04 \b, 48 kHz @@ -288,20 +326,20 @@ # MP2, M1A 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 # rates ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 48 kBits ->2 byte&0xF0 0x30 \b, 56 kBits ->2 byte&0xF0 0x40 \b, 64 kBits ->2 byte&0xF0 0x50 \b, 80 kBits ->2 byte&0xF0 0x60 \b, 96 kBits ->2 byte&0xF0 0x70 \b, 112 kBits ->2 byte&0xF0 0x80 \b, 128 kBits ->2 byte&0xF0 0x90 \b, 160 kBits ->2 byte&0xF0 0xA0 \b, 192 kBits ->2 byte&0xF0 0xB0 \b, 224 kBits ->2 byte&0xF0 0xC0 \b, 256 kBits ->2 byte&0xF0 0xD0 \b, 320 kBits ->2 byte&0xF0 0xE0 \b, 384 kBits +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 160 kbps +>2 byte&0xF0 0xA0 \b, 192 kbps +>2 byte&0xF0 0xB0 \b, 224 kbps +>2 byte&0xF0 0xC0 \b, 256 kbps +>2 byte&0xF0 0xD0 \b, 320 kbps +>2 byte&0xF0 0xE0 \b, 384 kbps # timing >2 byte&0x0C 0x00 \b, 44.1 kHz >2 byte&0x0C 0x04 \b, 48 kHz @@ -322,58 +360,59 @@ # MPA, M1A # updated by Joerg Jenderek # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 -0 beshort&0xFFFE 0xFFFE ->2 ubyte&0xF0 >0x0F ->>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 -# rate ->>>2 byte&0xF0 0x10 \b, 32 kBits ->>>2 byte&0xF0 0x20 \b, 64 kBits ->>>2 byte&0xF0 0x30 \b, 96 kBits ->>>2 byte&0xF0 0x40 \b, 128 kBits ->>>2 byte&0xF0 0x50 \b, 160 kBits ->>>2 byte&0xF0 0x60 \b, 192 kBits ->>>2 byte&0xF0 0x70 \b, 224 kBits ->>>2 byte&0xF0 0x80 \b, 256 kBits ->>>2 byte&0xF0 0x90 \b, 288 kBits ->>>2 byte&0xF0 0xA0 \b, 320 kBits ->>>2 byte&0xF0 0xB0 \b, 352 kBits ->>>2 byte&0xF0 0xC0 \b, 384 kBits ->>>2 byte&0xF0 0xD0 \b, 416 kBits ->>>2 byte&0xF0 0xE0 \b, 448 kBits -# timing ->>>2 byte&0x0C 0x00 \b, 44.1 kHz ->>>2 byte&0x0C 0x04 \b, 48 kHz ->>>2 byte&0x0C 0x08 \b, 32 kHz -# channels/options ->>>3 byte&0xC0 0x00 \b, Stereo ->>>3 byte&0xC0 0x40 \b, JntStereo ->>>3 byte&0xC0 0x80 \b, 2x Monaural ->>>3 byte&0xC0 0xC0 \b, Monaural -#>1 byte ^0x01 \b, Data Verify -#>2 byte &0x02 \b, Packet Pad -#>2 byte &0x01 \b, Custom Flag -#>3 byte &0x08 \b, Copyrighted -#>3 byte &0x04 \b, Original Source -#>3 byte&0x03 1 \b, NR: 50/15 ms -#>3 byte&0x03 3 \b, NR: CCIT J.17 +# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) +#0 beshort&0xFFFE 0xFFFE +#>2 ubyte&0xF0 >0x0F +#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 +## rate +#>>>2 byte&0xF0 0x10 \b, 32 kbps +#>>>2 byte&0xF0 0x20 \b, 64 kbps +#>>>2 byte&0xF0 0x30 \b, 96 kbps +#>>>2 byte&0xF0 0x40 \b, 128 kbps +#>>>2 byte&0xF0 0x50 \b, 160 kbps +#>>>2 byte&0xF0 0x60 \b, 192 kbps +#>>>2 byte&0xF0 0x70 \b, 224 kbps +#>>>2 byte&0xF0 0x80 \b, 256 kbps +#>>>2 byte&0xF0 0x90 \b, 288 kbps +#>>>2 byte&0xF0 0xA0 \b, 320 kbps +#>>>2 byte&0xF0 0xB0 \b, 352 kbps +#>>>2 byte&0xF0 0xC0 \b, 384 kbps +#>>>2 byte&0xF0 0xD0 \b, 416 kbps +#>>>2 byte&0xF0 0xE0 \b, 448 kbps +## timing +#>>>2 byte&0x0C 0x00 \b, 44.1 kHz +#>>>2 byte&0x0C 0x04 \b, 48 kHz +#>>>2 byte&0x0C 0x08 \b, 32 kHz +## channels/options +#>>>3 byte&0xC0 0x00 \b, Stereo +#>>>3 byte&0xC0 0x40 \b, JntStereo +#>>>3 byte&0xC0 0x80 \b, 2x Monaural +#>>>3 byte&0xC0 0xC0 \b, Monaural +##>1 byte ^0x01 \b, Data Verify +##>2 byte &0x02 \b, Packet Pad +##>2 byte &0x01 \b, Custom Flag +##>3 byte &0x08 \b, Copyrighted +##>3 byte &0x04 \b, Original Source +##>3 byte&0x03 1 \b, NR: 50/15 ms +##>3 byte&0x03 3 \b, NR: CCIT J.17 # MP3, M2A 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -394,20 +433,20 @@ # MP2, M2A 0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -428,20 +467,20 @@ # MPA, M2A 0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 # rate ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 48 kBits ->2 byte&0xF0 0x30 \b, 56 kBits ->2 byte&0xF0 0x40 \b, 64 kBits ->2 byte&0xF0 0x50 \b, 80 kBits ->2 byte&0xF0 0x60 \b, 96 kBits ->2 byte&0xF0 0x70 \b, 112 kBits ->2 byte&0xF0 0x80 \b, 128 kBits ->2 byte&0xF0 0x90 \b, 144 kBits ->2 byte&0xF0 0xA0 \b, 160 kBits ->2 byte&0xF0 0xB0 \b, 176 kBits ->2 byte&0xF0 0xC0 \b, 192 kBits ->2 byte&0xF0 0xD0 \b, 224 kBits ->2 byte&0xF0 0xE0 \b, 256 kBits +>2 byte&0xF0 0x10 \b, 32 kbps +>2 byte&0xF0 0x20 \b, 48 kbps +>2 byte&0xF0 0x30 \b, 56 kbps +>2 byte&0xF0 0x40 \b, 64 kbps +>2 byte&0xF0 0x50 \b, 80 kbps +>2 byte&0xF0 0x60 \b, 96 kbps +>2 byte&0xF0 0x70 \b, 112 kbps +>2 byte&0xF0 0x80 \b, 128 kbps +>2 byte&0xF0 0x90 \b, 144 kbps +>2 byte&0xF0 0xA0 \b, 160 kbps +>2 byte&0xF0 0xB0 \b, 176 kbps +>2 byte&0xF0 0xC0 \b, 192 kbps +>2 byte&0xF0 0xD0 \b, 224 kbps +>2 byte&0xF0 0xE0 \b, 256 kbps # timing >2 byte&0x0C 0x00 \b, 22.05 kHz >2 byte&0x0C 0x04 \b, 24 kHz @@ -462,20 +501,20 @@ # MP3, M25A 0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 # rate ->2 byte&0xF0 0x10 \b, 8 kBits ->2 byte&0xF0 0x20 \b, 16 kBits ->2 byte&0xF0 0x30 \b, 24 kBits ->2 byte&0xF0 0x40 \b, 32 kBits ->2 byte&0xF0 0x50 \b, 40 kBits ->2 byte&0xF0 0x60 \b, 48 kBits ->2 byte&0xF0 0x70 \b, 56 kBits ->2 byte&0xF0 0x80 \b, 64 kBits ->2 byte&0xF0 0x90 \b, 80 kBits ->2 byte&0xF0 0xA0 \b, 96 kBits ->2 byte&0xF0 0xB0 \b, 112 kBits ->2 byte&0xF0 0xC0 \b, 128 kBits ->2 byte&0xF0 0xD0 \b, 144 kBits ->2 byte&0xF0 0xE0 \b, 160 kBits +>2 byte&0xF0 0x10 \b, 8 kbps +>2 byte&0xF0 0x20 \b, 16 kbps +>2 byte&0xF0 0x30 \b, 24 kbps +>2 byte&0xF0 0x40 \b, 32 kbps +>2 byte&0xF0 0x50 \b, 40 kbps +>2 byte&0xF0 0x60 \b, 48 kbps +>2 byte&0xF0 0x70 \b, 56 kbps +>2 byte&0xF0 0x80 \b, 64 kbps +>2 byte&0xF0 0x90 \b, 80 kbps +>2 byte&0xF0 0xA0 \b, 96 kbps +>2 byte&0xF0 0xB0 \b, 112 kbps +>2 byte&0xF0 0xC0 \b, 128 kbps +>2 byte&0xF0 0xD0 \b, 144 kbps +>2 byte&0xF0 0xE0 \b, 160 kbps # timing >2 byte&0x0C 0x00 \b, 11.025 kHz >2 byte&0x0C 0x04 \b, 12 kHz @@ -497,6 +536,7 @@ # Stored AAC streams (instead of the MP4 format) 0 string ADIF MPEG ADIF, AAC +!:mime audio/x-hx-aac-adif >4 byte &0x80 >>13 byte &0x10 \b, VBR >>13 byte ^0x10 \b, CBR @@ -521,6 +561,7 @@ # Live or stored single AAC stream (used with MPEG-2 systems) 0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC +!:mime audio/x-hx-aac-adts >1 byte &0x08 \b, v2 >1 byte ^0x08 \b, v4 # profile @@ -557,6 +598,7 @@ # Live MPEG-4 audio streams (instead of RTP FlexMux) 0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS +!:mime audio/x-mp4a-latm #>1 beshort&0x1FFF x \b, %u byte packet >3 byte&0xE0 0x40 >>4 byte&0x3C 0x04 \b, single stream @@ -570,10 +612,13 @@ >>4 byte&0x78 0x18 \b, 3 streams >>4 byte &0x20 \b, 4 or more streams >>4 byte &0x40 \b, 8 or more streams -0 beshort 0x4DE1 MPEG-4 LO-EP audio stream +# This magic isn't strong enough (matches plausible ISO-8859-1 text) +#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream +#!:mime audio/x-mp4a-latm # FLI animation format 4 leshort 0xAF11 FLI file +!:mime video/x-fli >6 leshort x - %d frames, >8 leshort x width=%d pixels, >10 leshort x height=%d pixels, @@ -581,6 +626,7 @@ >16 leshort x ticks/frame=%d # FLC animation format 4 leshort 0xAF12 FLC file +!:mime video/x-flc >6 leshort x - %d frames >8 leshort x width=%d pixels, >10 leshort x height=%d pixels, @@ -599,9 +645,11 @@ # 255 (hex FF)! The DL format is really bad. # #0 byte 1 DL version 1, medium format (160x100, 4 images/screen) +#!:mime video/x-unknown #>42 byte x - %d screens, #>43 byte x %d commands #0 byte 2 DL version 2 +#!:mime video/x-unknown #>1 byte 1 - large format (320x200,1 image/screen), #>1 byte 2 - medium format (160x100,4 images/screen), #>1 byte >2 - unknown format, @@ -641,6 +689,7 @@ # MNG Video Format, 0 string \x8aMNG MNG video data, +!:mime video/x-mng >4 belong !0x0d0a1a0a CORRUPTED, >4 belong 0x0d0a1a0a >>16 belong x %ld x @@ -648,6 +697,7 @@ # JNG Video Format, 0 string \x8bJNG JNG video data, +!:mime video/x-jng >4 belong !0x0d0a1a0a CORRUPTED, >4 belong 0x0d0a1a0a >>16 belong x %ld x @@ -658,7 +708,9 @@ # VRML (Virtual Reality Modelling Language) 0 string/b #VRML\ V1.0\ ascii VRML 1 file +!:mime model/vrml 0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file +!:mime model/vrml #--------------------------------------------------------------------------- # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube @@ -681,7 +733,10 @@ # From: Behan Webster # NuppelVideo used by Mythtv (*.nuv) -0 regex NuppelVideo|MythTVVideo MythTV NuppelVideo +# Note: there are two identical stanzas here differing only in the +# initial string matched. It used to be done with a regex, but we're +# trying to get rid of those. +0 string NuppelVideo MythTV NuppelVideo >12 string x v%s >20 lelong x (%d >24 lelong x \bx%d), @@ -689,3 +744,33 @@ >36 string I \binterlaced, >40 ledouble x \baspect:%.2f, >48 ledouble x \bfps:%.2f +0 string MythTV MythTV NuppelVideo +>12 string x v%s +>20 lelong x (%d +>24 lelong x \bx%d), +>36 string P \bprogressive, +>36 string I \binterlaced, +>40 ledouble x \baspect:%.2f, +>48 ledouble x \bfps:%.2f + +# MPEG file +# MPEG sequences +# FIXME: This section is from the old magic.mime file and needs integrating with the rest +0 belong 0x000001BA +>4 byte &0x40 +!:mime video/mp2p +>4 byte ^0x40 +!:mime video/mpeg +0 belong 0x000001BB +!:mime video/mpeg +0 belong 0x000001B0 +!:mime video/mp4v-es +0 belong 0x000001B5 +!:mime video/mp4v-es +0 belong 0x000001B3 +!:mime video/mpv +0 belong&0xFF5FFF1F 0x47400010 +!:mime video/mp2t +0 belong 0x00000001 +>4 byte&0x1F 0x07 +!:mime video/h264 diff --git a/contrib/file-4/magic/Magdir/apple b/contrib/file-4/magic/Magdir/apple index 4a593ea..669ab04 100644 --- a/contrib/file-4/magic/Magdir/apple +++ b/contrib/file-4/magic/Magdir/apple @@ -1,8 +1,7 @@ - #------------------------------------------------------------------------------ # apple: file(1) magic for Apple file formats # -0 string FiLeStArTfIlEsTaRt binscii (apple ][) text +0 search/1 FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string NuFile NuFile archive (apple ][) data @@ -10,6 +9,23 @@ 0 belong 0x00051600 AppleSingle encoded Macintosh file 0 belong 0x00051607 AppleDouble encoded Macintosh file +# Type: Apple Emulator 2IMG format +# From: Radek Vokal +0 string 2IMG Apple ][ 2IMG Disk Image +>4 string XGS! \b, XGS +>4 string CTKG \b, Catakig +>4 string ShIm \b, Sheppy's ImageMaker +>4 string WOOF \b, Sweet 16 +>4 string B2TR \b, Bernie ][ the Rescue +>4 string !nfc \b, ASIMOV2 +>4 string x \b, Unknown Format +>0xc byte 00 \b, DOS 3.3 sector order +>>0x10 byte 00 \b, Volume 254 +>>0x10 byte&0x7f x \b, Volume %u +>0xc byte 01 \b, ProDOS sector order +>>0x14 short x \b, %u Blocks +>0xc byte 02 \b, NIB data + # magic for Newton PDA package formats # from Ruda Moura 0 string package0 Newton package, NOS 1.x, @@ -118,11 +134,12 @@ # Nevertheless this will manage to catch a lot of images that happen # to have a solid-colored line at the bottom of the screen. -8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background -8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background -8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background -8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background -8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background +# GRR: Magic too weak +#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background +#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background +#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background +#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background +#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background # Beagle Bros. Apple Mechanic fonts diff --git a/contrib/file-4/magic/Magdir/archive b/contrib/file-4/magic/Magdir/archive index 0b3a9ba..ccf9621 100644 --- a/contrib/file-4/magic/Magdir/archive +++ b/contrib/file-4/magic/Magdir/archive @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) @@ -8,7 +7,9 @@ # POSIX tar archives 257 string ustar\0 POSIX tar archive +!:mime application/x-tar # encoding: posix 257 string ustar\040\040\0 GNU tar archive +!:mime application/x-tar # encoding: gnu # cpio archives # @@ -22,7 +23,9 @@ # are defined as "short"s; I think all the new formats are # character-header formats and thus are strings, not numbers. 0 short 070707 cpio archive +!:mime application/x-cpio 0 short 0143561 byte-swapped cpio archive +!:mime application/x-cpio # encoding: swapped 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC) @@ -30,8 +33,10 @@ # Debian package (needs to go before regular portable archives) # 0 string =!\ndebian +!:mime application/x-debian-package >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package +>8 string !debian >68 string >\0 (format %s) # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only @@ -49,6 +54,7 @@ 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string = archive +!:mime application/x-archive # MIPS archive (needs to go before regular portable archives) # @@ -60,7 +66,7 @@ >19 string B and an EB hash table >22 string X -- out of date -0 string -h- Software Tools format archive text +0 search/1 -h- Software Tools format archive text # # XXX - why are there multiple thingies? Note that 0x213c6172 is @@ -79,6 +85,7 @@ # "ar" archives? # 0 string =! current ar archive +!:mime application/x-archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 @@ -121,15 +128,24 @@ # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched +!:mime application/x-arc # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000141a ARC+ archive data +!:mime application/x-arc 0 lelong&0x8080ffff 0x0000481a HYP archive data +!:mime application/x-arc # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff @@ -435,6 +451,7 @@ # ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data +!:mime application/x-arj >5 byte x \b, v%d, >8 byte &0x04 multi-volume, >8 byte &0x10 slash-switched, @@ -487,19 +504,32 @@ # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 2 string -lh0- LHarc 1.x/ARX archive data [lh0] +!:mime application/x-lharc 2 string -lh1- LHarc 1.x/ARX archive data [lh1] +!:mime application/x-lharc 2 string -lz4- LHarc 1.x archive data [lz4] +!:mime application/x-lharc 2 string -lz5- LHarc 1.x archive data [lz5] +!:mime application/x-lharc # [never seen any but the last; -lh4- reported in comp.compression:] 2 string -lzs- LHa/LZS archive data [lzs] +!:mime application/x-lha 2 string -lh\40- LHa 2.x? archive data [lh ] +!:mime application/x-lha 2 string -lhd- LHa 2.x? archive data [lhd] +!:mime application/x-lha 2 string -lh2- LHa 2.x? archive data [lh2] +!:mime application/x-lha 2 string -lh3- LHa 2.x? archive data [lh3] +!:mime application/x-lha 2 string -lh4- LHa (2.x) archive data [lh4] +!:mime application/x-lha 2 string -lh5- LHa (2.x) archive data [lh5] +!:mime application/x-lha 2 string -lh6- LHa (2.x) archive data [lh6] +!:mime application/x-lha 2 string -lh7- LHa (2.x)/LHark archive data [lh7] +!:mime application/x-lha >20 byte x - header level %d # taken from idarc [JW] 2 string -lZ PUT archive data @@ -508,6 +538,7 @@ # RAR archiver (Greg Roelofs, newt@uchicago.edu) 0 string Rar! RAR archive data, +!:mime application/x-rar >44 byte x v%0x, >10 byte >0 flags: >>10 byte &0x01 Archive volume, @@ -532,13 +563,18 @@ # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 0 string PK\003\004 >4 byte 0x00 Zip archive data +!:mime application/zip >4 byte 0x09 Zip archive data, at least v0.9 to extract +!:mime application/zip >4 byte 0x0a Zip archive data, at least v1.0 to extract +!:mime application/zip >4 byte 0x0b Zip archive data, at least v1.1 to extract +!:mime application/zip +>0x161 string WINZIP Zip archive data, WinZIP self-extracting +!:mime application/zip >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract ->0x161 string WINZIP Zip archive data, WinZIP self-extracting - +!:mime application/zip # OpenOffice.org / KOffice / StarOffice documents # From: Abel Cheung @@ -578,6 +614,7 @@ >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text +!:mime application/vnd.oasis.opendocument.text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document @@ -596,6 +633,7 @@ # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data +!:mime application/x-zoo >4 byte >48 \b, v%c. >>6 byte >47 \b%c >>>7 byte >47 \b%c @@ -607,6 +645,7 @@ # Shell archives 10 string #\ This\ is\ a\ shell\ archive shell archive text +!:mime application/octet-stream # # LBR. NB: May conflict with the questionable @@ -652,6 +691,7 @@ # Felix von Leitner 0 string d8:announce BitTorrent file +!:mime application/x-bittorrent # Atari MSA archive - Teemu Hukkanen 0 beshort 0x0e0f Atari MSA archive data @@ -709,6 +749,7 @@ # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive +!:mime application/x-eet # rzip archives 0 string RZIP rzip compressed data @@ -729,9 +770,11 @@ # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file +!:mime application/vnd.symbian.install >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) +!:mime x-epoc/x-sisx-app # Pack200 Java archives, http://jcp.org/en/jsr/detail?id=200 0 belong 0xcafed00d Pack200 Java archive @@ -748,3 +791,15 @@ # .kgb 0 string KGB_arch KGB Archiver file >10 string x with compression level %.1s + +# xar (eXtensible ARchiver) archive +# From: "David Remahl" +0 string xar! xar archive +#>4 beshort x header size %d +>6 beshort x version %d, +#>8 quad x compressed TOC: %d, +#>16 quad x uncompressed TOC: %d, +>24 belong 0 no checksum +>24 belong 1 SHA-1 checksum +>24 belong 2 MD5 checksum + diff --git a/contrib/file-4/magic/Magdir/audio b/contrib/file-4/magic/Magdir/audio index 511da1d..832ad88 100644 --- a/contrib/file-4/magic/Magdir/audio +++ b/contrib/file-4/magic/Magdir/audio @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # audio: file(1) magic for sound formats (see also "iff") # @@ -9,12 +8,19 @@ # Sun/NeXT audio data 0 string .snd Sun/NeXT audio data: >12 belong 1 8-bit ISDN mu-law, +!:mime audio/basic >12 belong 2 8-bit linear PCM [REF-PCM], +!:mime audio/basic >12 belong 3 16-bit linear PCM, +!:mime audio/basic >12 belong 4 24-bit linear PCM, +!:mime audio/basic >12 belong 5 32-bit linear PCM, +!:mime audio/basic >12 belong 6 32-bit IEEE floating point, +!:mime audio/basic >12 belong 7 64-bit IEEE floating point, +!:mime audio/basic >12 belong 8 Fragmented sample data, >12 belong 10 DSP program, >12 belong 11 8-bit fixed point, @@ -26,6 +32,7 @@ >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, >12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-adpcm >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -39,12 +46,19 @@ # that uses little-endian encoding and has a different magic number 0 lelong 0x0064732E DEC audio data: >12 lelong 1 8-bit ISDN mu-law, +!:mime audio/x-dec-basic >12 lelong 2 8-bit linear PCM [REF-PCM], +!:mime audio/x-dec-basic >12 lelong 3 16-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 4 24-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 5 32-bit linear PCM, +!:mime audio/x-dec-basic >12 lelong 6 32-bit IEEE floating point, +!:mime audio/x-dec-basic >12 lelong 7 64-bit IEEE floating point, +!:mime audio/x-dec-basic >12 belong 8 Fragmented sample data, >12 belong 10 DSP program, >12 belong 11 8-bit fixed point, @@ -56,6 +70,7 @@ >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, >12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +!:mime audio/x-dec-basic >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -67,6 +82,7 @@ # Creative Labs AUDIO stuff 0 string MThd Standard MIDI data +!:mime audio/midi >8 beshort x (format %d) >10 beshort x using %d track >10 beshort >1 \bs @@ -74,8 +90,11 @@ >12 beshort&0x8000 >0 SMPTE 0 string CTMF Creative Music (CMF) data +!:mime audio/x-unknown 0 string SBI SoundBlaster instrument data +!:mime audio/x-unknown 0 string Creative\ Voice\ File Creative Labs voice data +!:mime audio/x-unknown # is this next line right? it came this way... >19 byte 0x1A >23 byte >0 - version %d @@ -96,7 +115,13 @@ # Real Audio (Magic .ra\0375) 0 belong 0x2e7261fd RealAudio sound file +!:mime audio/x-pn-realaudio 0 string .RMF RealMedia file +!:mime application/vnd.rn-realmedia +#video/x-pn-realvideo +#video/vnd.rn-realvideo +#application/vnd.rn-realmedia +# sigh, there are many mimes for that but the above are the most common. # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] # Oct 31, 1995 @@ -119,44 +144,84 @@ 0 string GF1PATCH110\0ID#000002\0 GUS patch 0 string GF1PATCH100\0ID#000002\0 Old GUS patch +# mime types according to http://www.geocities.com/nevilo/mod.htm: +# audio/it .it +# audio/x-zipped-it .itz +# audio/xm fasttracker modules +# audio/x-s3m screamtracker modules +# audio/s3m screamtracker modules +# audio/x-zipped-mod mdz +# audio/mod mod +# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) + # # Taken from loader code from mikmod version 2.14 # by Steve McIntyre (stevem@chiark.greenend.org.uk) # added title printing on 2003-06-24 0 string MAS_UTrack_V00 >14 string >/0 ultratracker V1.%.1s module sound data +!:mime audio/x-mod +#audio/x-tracker-module 0 string UN05 MikMod UNI format module sound data 0 string Extended\ Module: Fasttracker II module sound data +!:mime audio/x-mod +#audio/x-tracker-module >17 string >\0 Title: "%s" 21 string/c =!SCREAM! Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module 21 string BMOD2STM Screamtracker 2 module sound data +!:mime audio/x-mod +#audio/x-screamtracker-module 1080 string M.K. 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module >0 string >\0 Title: "%s" 1080 string M!K! 4-channel Protracker module sound data +!:mime audio/x-mod +#audio/x-protracker-module >0 string >\0 Title: "%s" 1080 string FLT4 4-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module >0 string >\0 Title: "%s" 1080 string FLT8 8-channel Startracker module sound data +!:mime audio/x-mod +#audio/x-startracker-module >0 string >\0 Title: "%s" 1080 string 4CHN 4-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string 6CHN 6-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string 8CHN 8-channel Fasttracker module sound data +!:mime audio/x-mod +#audio/x-fasttracker-module >0 string >\0 Title: "%s" 1080 string CD81 8-channel Octalyser module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module >0 string >\0 Title: "%s" -1080 string OKTA 8-channel Oktalyzer module sound data +1080 string OKTA 8-channel Octalyzer module sound data +!:mime audio/x-mod +#audio/x-octalysertracker-module >0 string >\0 Title: "%s" # Not good enough. #1082 string CH #>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 1080 string 16CN 16-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module >0 string >\0 Title: "%s" 1080 string 32CN 32-channel Taketracker module sound data +!:mime audio/x-mod +#audio/x-taketracker-module >0 string >\0 Title: "%s" # TOC sound files -Trevor Johnson @@ -221,9 +286,11 @@ # SGI SoundTrack 0 string _SGI_SoundTrack SGI SoundTrack project file # ID3 version 2 tags -0 string ID3 Audio file with ID3 version 2 ->3 ubyte <0xff \b%d. ->4 ubyte <0xff \b%d tag +0 string ID3 Audio file with ID3 version 2. +# ??? Normally such a file is an MP3 file, but this will give false positives +!:mime audio/mpeg +>3 ubyte <0xff \b%d +#>4 ubyte <0xff \b%d tag >2584 string fLaC \b, FLAC encoding >>2588 byte&0x7f >0 \b, unknown version >>2588 byte&0x7f 0 \b @@ -270,6 +337,7 @@ # Impulse tracker module (audio/x-it) 0 string IMPM Impulse Tracker module sound data - +!:mime audio/x-mod >4 string >\0 "%s" >40 leshort !0 compatible w/ITv%x >42 leshort !0 created w/ITv%x @@ -380,6 +448,7 @@ # Free lossless audio codec # From: Przemyslaw Augustyniak 0 string fLaC FLAC audio bitstream data +!:mime audio/x-flac >4 byte&0x7f >0 \b, unknown version >4 byte&0x7f 0 \b # some common bits/sample values @@ -502,9 +571,9 @@ # .preset 0 string [Equalizer\ preset] XMMS equalizer preset # .m3u -0 string #EXTM3U M3U playlist +0 search/1 #EXTM3U M3U playlist text # .pls -0 string [playlist] PLS playlist +0 search/1 [playlist] PLS playlist text # licq.conf 1 string [licq] LICQ configuration file @@ -553,9 +622,6 @@ # http://www.wx800.com/msg/download/irda/iMelody.pdf 0 string BEGIN:IMELODY iMelody Ringtone Format -# From: Matthew Flaschen -0 string #EXTM3U M3U playlist text - # From: "Mateus Caruccio" # guitar pro v3,4,5 from http://filext.com/file-extension/gp3 0 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature @@ -563,3 +629,7 @@ # From: "Leslie P. Polzer" 60 string SONG SoundFX Module sound file +# Type: Adaptive Multi-Rate Codec +# URL: http://filext.com/detaillist.php?extdetail=AMR +# From: Russell Coker +0 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) diff --git a/contrib/file-4/magic/Magdir/c-lang b/contrib/file-4/magic/Magdir/c-lang index fd3f9aa..895e37f 100644 --- a/contrib/file-4/magic/Magdir/c-lang +++ b/contrib/file-4/magic/Magdir/c-lang @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # c-lang: file(1) magic for C programs (or REXX) # @@ -6,11 +5,15 @@ # XPM icons (Greg Roelofs, newt@uchicago.edu) # if you uncomment "/*" for C/REXX below, also uncomment this entry #0 string /*\ XPM\ */ X pixmap image data +#!:mime image/x-xpmi + +# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' +#16 beshort 0x3d3d image/x-3ds # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs -#0 string /* C or REXX program text -#0 string // C++ program text +#0 search/1 /* C or REXX program text +#0 search/1 // C++ program text # From: Mikhail Teterin 0 string cscope cscope reference data @@ -20,5 +23,5 @@ # The inverted index functionality was added some time betwen # versions 11 and 15, so look for -q if version is above 14: >7 string >14 ->>10 regex .+\ -q\ with inverted index ->10 regex .+\ -c\ text (non-compressed) +>>10 search/100 \ -q\ with inverted index +>10 search/100 \ -c\ text (non-compressed) diff --git a/contrib/file-4/magic/Magdir/c64 b/contrib/file-4/magic/Magdir/c64 index a224b21..f8a8b76 100644 --- a/contrib/file-4/magic/Magdir/c64 +++ b/contrib/file-4/magic/Magdir/c64 @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # c64: file(1) magic for various commodore 64 related files # diff --git a/contrib/file-4/magic/Magdir/cafebabe b/contrib/file-4/magic/Magdir/cafebabe index 233411c..40cf585 100644 --- a/contrib/file-4/magic/Magdir/cafebabe +++ b/contrib/file-4/magic/Magdir/cafebabe @@ -12,10 +12,14 @@ # (and use as a hack). Let's not use 18, because the Mach-O people # might add another one or two as time goes by... # -0 belong 0xcafebabe ->4 belong >30 compiled Java class data, ->>6 beshort x version %d. ->>4 beshort x \b%d ->4 belong 1 Mach-O fat file with 1 architecture ->4 belong >1 ->>4 belong <20 Mach-O fat file with %ld architectures +0 beshort 0xcafe +>2 beshort 0xbabe +!:mime application/x-java-applet +>>2 belong >30 compiled Java class data, +>>>6 beshort x version %d. +>>>4 beshort x \b%d +>>4 belong 1 Mach-O fat file with 1 architecture +>>4 belong >1 +>>>4 belong <20 Mach-O fat file with %ld architectures +>2 beshort 0xd00d JAR compressed with pack200 +!:mime application/x-java-pack200 diff --git a/contrib/file-4/magic/Magdir/cddb b/contrib/file-4/magic/Magdir/cddb index 2ea97ee..42ca416 100644 --- a/contrib/file-4/magic/Magdir/cddb +++ b/contrib/file-4/magic/Magdir/cddb @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # CDDB: file(1) magic for CDDB(tm) format CD text data files # @@ -8,4 +7,4 @@ # CDDB-enabled CD player applications. # -0 string/b #\040xmcd CDDB(tm) format CD text data +0 search/1/b #\040xmcd CDDB(tm) format CD text data diff --git a/contrib/file-4/magic/Magdir/clarion b/contrib/file-4/magic/Magdir/clarion new file mode 100644 index 0000000..5f5f6e7 --- /dev/null +++ b/contrib/file-4/magic/Magdir/clarion @@ -0,0 +1,26 @@ + +#------------------------------------------------------------------------------ +# clarion: file(1) magic for # Clarion Personal/Professional Developer +# (v2 and above) +# From: Julien Blache + +# Database files +# signature +0 leshort 0x3343 Clarion Developer (v2 and above) data file +# attributes +>2 leshort &0x0001 \b, locked +>2 leshort &0x0004 \b, encrypted +>2 leshort &0x0008 \b, memo file exists +>2 leshort &0x0010 \b, compressed +>2 leshort &0x0040 \b, read only +# number of records +>5 lelong x \b, %ld records + +# Memo files +0 leshort 0x334d Clarion Developer (v2 and above) memo data + +# Key/Index files +# No magic? :( + +# Help files +0 leshort 0x49e0 Clarion Developer (v2 and above) help data diff --git a/contrib/file-4/magic/Magdir/commands b/contrib/file-4/magic/Magdir/commands index 599c190..cdfc66d 100644 --- a/contrib/file-4/magic/Magdir/commands +++ b/contrib/file-4/magic/Magdir/commands @@ -2,41 +2,62 @@ #------------------------------------------------------------------------------ # commands: file(1) magic for various shells and interpreters # -0 string : shell archive or script for antique kernel text -0 string/b #!\ /bin/sh Bourne shell script text executable +#0 string : shell archive or script for antique kernel text +0 string/b #!\ /bin/sh POSIX shell script text executable +!:mime application/x-shellscript 0 string/b #!\ /bin/csh C shell script text executable +!:mime application/x-shellscript # korn shell magic, sent by George Wu, gwu@clyde.att.com 0 string/b #!\ /bin/ksh Korn shell script text executable +!:mime application/x-shellscript 0 string/b #!\ /bin/tcsh Tenex C shell script text executable +!:mime application/x-shellscript 0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable +!:mime application/x-shellscript 0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable +!:mime application/x-shellscript # # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable +!:mime application/x-shellscript 0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable +!:mime application/x-shellscript 0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable +!:mime application/x-shellscript 0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable +!:mime application/x-shellscript 0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable +!:mime application/x-shellscript 0 string/b #!\ /bin/nawk new awk script text executable +!:mime application/x-nawk 0 string/b #!\ /usr/bin/nawk new awk script text executable +!:mime application/x-nawk 0 string/b #!\ /usr/local/bin/nawk new awk script text executable +!:mime application/x-nawk 0 string/b #!\ /bin/gawk GNU awk script text executable +!:mime application/x-gawk 0 string/b #!\ /usr/bin/gawk GNU awk script text executable +!:mime application/x-gawk 0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable +!:mime application/x-gawk # 0 string/b #!\ /bin/awk awk script text executable +!:mime application/x-awk 0 string/b #!\ /usr/bin/awk awk script text executable +!:mime application/x-awk # update to distinguish from *.vcf files # this is broken because postscript has /EBEGIN{ for example. -#0 regex BEGIN[[:space:]]*[{] awk script text +#0 search/Bb BEGIN { awk script text # AT&T Bell Labs' Plan 9 shell 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 0 string/b #!\ /bin/bash Bourne-Again shell script text executable +!:mime application/x-shellscript 0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable +!:mime application/x-shellscript # using env 0 string #!/usr/bin/env a @@ -46,11 +67,11 @@ # PHP scripts # Ulf Harnhammar -0 string/c =2 byte&0x80 >0 block compressed >2 byte&0x1f x %d bits @@ -19,6 +20,7 @@ # * Produce shorter output - notably, only report compression methods # other than 8 ("deflate", the only method defined in RFC 1952). 0 string \037\213 gzip compressed data +!:mime application/x-gzip >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII @@ -49,23 +51,29 @@ # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 0 string \037\036 packed data +!:mime application/octet-stream >2 belong >1 \b, %d characters originally >2 belong =1 \b, %d character originally # # This magic number is byte-order-independent. 0 short 0x1f1f old packed data +!:mime application/octet-stream # XXX - why *two* entries for "compacted data", one of which is # byte-order independent, and one of which is byte-order dependent? # 0 short 0x1fff compacted data +!:mime application/octet-stream # This string is valid for SunOS (BE) and a matching "short" is listed # in the Ultrix (LE) magic file. 0 string \377\037 compacted data +!:mime application/octet-stream 0 short 0145405 huf output +!:mime application/octet-stream # bzip2 0 string BZh bzip2 compressed data +!:mime application/x-bzip2 >3 byte >47 \b, block size = %c00k # squeeze and crunch @@ -102,17 +110,17 @@ # bzip a block-sorting file compressor # by Julian Seward and others # -0 string BZ bzip compressed data ->2 byte x \b, version: %c ->3 string =1 \b, compression block size 100k ->3 string =2 \b, compression block size 200k ->3 string =3 \b, compression block size 300k ->3 string =4 \b, compression block size 400k ->3 string =5 \b, compression block size 500k ->3 string =6 \b, compression block size 600k ->3 string =7 \b, compression block size 700k ->3 string =8 \b, compression block size 800k ->3 string =9 \b, compression block size 900k +#0 string BZ bzip compressed data +#>2 byte x \b, version: %c +#>3 string =1 \b, compression block size 100k +#>3 string =2 \b, compression block size 200k +#>3 string =3 \b, compression block size 300k +#>3 string =4 \b, compression block size 400k +#>3 string =5 \b, compression block size 500k +#>3 string =6 \b, compression block size 600k +#>3 string =7 \b, compression block size 700k +#>3 string =8 \b, compression block size 800k +#>3 string =9 \b, compression block size 900k # lzop from 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data @@ -174,6 +182,13 @@ >6 byte x version %d >7 byte x \b.%d +# Type: LZMA +# URL: http://www.7-zip.org/sdk.html +# From: Robert Millan and Reuben Thomas +# Commented out because apparently not reliable (according to Debian +# bug #364260) +#0 string ]\000\000\200\000 LZMA compressed data + # AFX compressed files (Wolfram Kleff) 2 string -afx- AFX compressed file data diff --git a/contrib/file-4/magic/Magdir/cracklib b/contrib/file-4/magic/Magdir/cracklib index 8f7e0d4..a1a5a27 100644 --- a/contrib/file-4/magic/Magdir/cracklib +++ b/contrib/file-4/magic/Magdir/cracklib @@ -9,5 +9,5 @@ 0 belong 0x70775631 Cracklib password index, big endian >4 belong >-1 (%i words) # really bellong 0x0000000070775631 -4 belong 0x70775631 Cracklib password index, big endian ("64-bit") +0 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") >12 belong >0 (%i words) diff --git a/contrib/file-4/magic/Magdir/ctags b/contrib/file-4/magic/Magdir/ctags index 84c5b7f..f326cf5 100644 --- a/contrib/file-4/magic/Magdir/ctags +++ b/contrib/file-4/magic/Magdir/ctags @@ -1,5 +1,4 @@ - # ---------------------------------------------------------------------------- # ctags: file (1) magic for Exuberant Ctags files # From: Alexander Mai -0 string =!_TAG Exuberant Ctags tag file text +0 search/1 =!_TAG Exuberant Ctags tag file text diff --git a/contrib/file-4/magic/Magdir/database b/contrib/file-4/magic/Magdir/database index 8f2fc0a..cae67fc 100644 --- a/contrib/file-4/magic/Magdir/database +++ b/contrib/file-4/magic/Magdir/database @@ -9,8 +9,11 @@ # Will be maintained as part of the GDBM distribution in the future. # 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian +!:mime application/x-gdbm 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian +!:mime application/x-gdbm 0 string GDBM GNU dbm 2.x database +!:mime application/x-gdbm # # Berkeley DB # @@ -21,6 +24,7 @@ # Hash and Btree 2.X and later databases store the metadata in host byte order. 0 long 0x00061561 Berkeley DB +!:mime application/x-dbm >8 belong 4321 >>4 belong >2 1.86 >>4 belong <3 1.85 @@ -107,74 +111,87 @@ #>>0x04 byte 6 non-incrementing secondary index .XGn file #>>0x04 byte 7 secondary index .YGn file #>>>0x04 byte 8 incrementing secondary index .XGn file + ## XBase database files #0 byte 0x02 #>8 leshort >0 #>>12 leshort 0 FoxBase +#!:mime application/x-dbf #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x03 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x04 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE IV no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x05 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE V no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x30 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 Visual FoxPro #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x43 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with memo var size #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x7b +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASEIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x83 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, dBaseIII+ with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8b +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8e +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with SQL Table #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xb3 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with .dbt memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xf5 +#!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxPro with memo #>>>0x04 lelong 0 (no records) @@ -183,7 +200,8 @@ #0 leshort 0x0006 DBase 3 index file # MS Access database -4 string Standard\ Jet\ DB Microsoft Access Database +4 string Standard\ Jet\ DB Microsoft Access Database +!:mime application/x-msaccess # TDB database from Samba et al - Martin Pool 0 string TDB\ file TDB database @@ -220,3 +238,7 @@ >5 beshort >0x100 >>7 byte x \b-%d +# Type: Advanced Data Format (ADF) database +# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ +# From: Nicolas Chauvat +0 string @(#)ADF\ Database CGNS Advanced Data Format diff --git a/contrib/file-4/magic/Magdir/diff b/contrib/file-4/magic/Magdir/diff index 187e892..c93a172 100644 --- a/contrib/file-4/magic/Magdir/diff +++ b/contrib/file-4/magic/Magdir/diff @@ -1,10 +1,9 @@ - #------------------------------------------------------------------------------ # diff: file(1) magic for diff(1) output # -0 string diff\ 'diff' output text -0 string ***\ 'diff' output text -0 string Only\ in\ 'diff' output text -0 string Common\ subdirectories:\ 'diff' output text +0 search/1 diff\ diff output text +0 search/1 ***\ diff output text +0 search/1 Only\ in\ diff output text +0 search/1 Common\ subdirectories:\ diff output text -0 string Index: RCS/CVS diff output text +0 search/1 Index: RCS/CVS diff output text diff --git a/contrib/file-4/magic/Magdir/dump b/contrib/file-4/magic/Magdir/dump index addd954..cef191a 100644 --- a/contrib/file-4/magic/Magdir/dump +++ b/contrib/file-4/magic/Magdir/dump @@ -91,3 +91,41 @@ >0 leshort 5 end of volume. >0 leshort 6 map of inodes deleted. >0 leshort 7 end of medium (for floppy). + +24 belong 0x19540119 new-fs dump file (ufs2, big endian), +>896 beqdate x Previous dump %s, +>904 beqdate x This dump %s, +>12 belong >0 Volume %ld, +>692 belong 0 Level zero, type: +>692 belong >0 Level %d, type: +>0 belong 1 tape header, +>0 belong 2 beginning of file record, +>0 belong 3 map of inodes on tape, +>0 belong 4 continuation of file record, +>0 belong 5 end of volume, +>0 belong 6 map of inodes deleted, +>0 belong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 belong >0 Flags %x + +24 lelong 0x19540119 new-fs dump file (ufs2, little endian), +>896 leqdate x This dump %s, +>904 leqdate x Previous dump %s, +>12 lelong >0 Volume %ld, +>692 lelong 0 Level zero, type: +>692 lelong >0 Level %d, type: +>0 lelong 1 tape header, +>0 lelong 2 beginning of file record, +>0 lelong 3 map of inodes on tape, +>0 lelong 4 continuation of file record, +>0 lelong 5 end of volume, +>0 lelong 6 map of inodes deleted, +>0 lelong 7 end of medium (for floppy), +>676 string >\0 Label %s, +>696 string >\0 Filesystem %s, +>760 string >\0 Device %s, +>824 string >\0 Host %s, +>888 lelong >0 Flags %x diff --git a/contrib/file-4/magic/Magdir/elf b/contrib/file-4/magic/Magdir/elf index 464b436..b362fe0 100644 --- a/contrib/file-4/magic/Magdir/elf +++ b/contrib/file-4/magic/Magdir/elf @@ -15,12 +15,17 @@ >5 byte 0 invalid byte order >5 byte 1 LSB >>16 leshort 0 no file type, +!:mime application/octet-stream >>16 leshort 1 relocatable, +!:mime application/x-object >>16 leshort 2 executable, +!:mime application/x-executable >>16 leshort 3 shared object, +!:mime application/x-sharedlib # Core handling from Peter Tobias # corrections by Christian 'Dr. Disk' Hechelmann >>16 leshort 4 core file +!:mime application/x-coredump # Core file detection is not reliable. #>>>(0x38+0xcc) string >\0 of '%s' #>>>(0x38+0x10) lelong >0 (signal %d), @@ -96,9 +101,46 @@ >>18 leshort 51 Stanford MIPS-X, >>18 leshort 52 Motorola Coldfire, >>18 leshort 53 Motorola M68HC12, +>>18 leshort 54 Fujitsu MMA, +>>18 leshort 55 Siemens PCP, +>>18 leshort 56 Sony nCPU, +>>18 leshort 57 Denso NDR1, +>>18 leshort 58 Start*Core, +>>18 leshort 59 Toyota ME16, +>>18 leshort 60 ST100, +>>18 leshort 61 Tinyj emb., >>18 leshort 62 x86-64, +>>18 leshort 63 Sony DSP, +>>18 leshort 66 FX66, +>>18 leshort 67 ST9+ 8/16 bit, +>>18 leshort 68 ST7 8 bit, +>>18 leshort 69 MC68HC16, +>>18 leshort 70 MC68HC11, +>>18 leshort 71 MC68HC08, +>>18 leshort 72 MC68HC05, +>>18 leshort 73 SGI SVx, +>>18 leshort 74 ST19 8 bit, >>18 leshort 75 Digital VAX, +>>18 leshort 76 Axis cris, +>>18 leshort 77 Infineon 32-bit embedded, +>>18 leshort 78 Element 14 64-bit DSP, +>>18 leshort 79 LSI Logic 16-bit DSP, +>>18 leshort 80 MMIX, +>>18 leshort 81 Harvard machine-independent, +>>18 leshort 82 SiTera Prism, +>>18 leshort 83 Atmel AVR 8-bit, +>>18 leshort 84 Fujitsu FR30, +>>18 leshort 85 Mitsubishi D10V, +>>18 leshort 86 Mitsubishi D30V, +>>18 leshort 87 NEC v850, >>18 leshort 88 Renesas M32R, +>>18 leshort 89 Matsushita MN10300, +>>18 leshort 90 Matsushita MN10200, +>>18 leshort 91 picoJava, +>>18 leshort 92 OpenRISC, +>>18 leshort 93 ARC Cores Tangent-A5, +>>18 leshort 0x3426 OpenRISC (obsolete), +>>18 leshort 0x8472 OpenRISC (obsolete), >>18 leshort 94 Tensilica Xtensa, >>18 leshort 97 NatSemi 32k, >>18 leshort 106 Analog Devices Blackfin, @@ -108,10 +150,15 @@ >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB >>16 beshort 0 no file type, +!:mime application/octet-stream >>16 beshort 1 relocatable, +!:mime application/x-object >>16 beshort 2 executable, +!:mime application/x-executable >>16 beshort 3 shared object, +!:mime application/x-sharedlib >>16 beshort 4 core file, +!:mime application/x-coredump #>>>(0x38+0xcc) string >\0 of '%s' #>>>(0x38+0x10) belong >0 (signal %d), >>16 beshort &0xff00 processor-specific, @@ -194,6 +241,9 @@ >>18 beshort 73 Cray NV1, >>18 beshort 75 Digital VAX, >>18 beshort 88 Renesas M32R, +>>18 leshort 92 OpenRISC, +>>18 leshort 0x3426 OpenRISC (obsolete), +>>18 leshort 0x8472 OpenRISC (obsolete), >>18 beshort 94 Tensilica Xtensa, >>18 beshort 97 NatSemi 32k, >>18 beshort 0x18ad AVR32 (unofficial), diff --git a/contrib/file-4/magic/Magdir/erlang b/contrib/file-4/magic/Magdir/erlang new file mode 100644 index 0000000..59f55ec --- /dev/null +++ b/contrib/file-4/magic/Magdir/erlang @@ -0,0 +1,18 @@ + +#------------------------------------------------------------------------------ +# erlang: file(1) magic for Erlang JAM and BEAM files +# URL: http://www.erlang.org/faq/x779.html#AEN812 + +# OTP R3-R4 +0 string \0177BEAM! Old Erlang BEAM file +>6 short >0 - version %d + +# OTP R5 and onwards +0 string FOR1 +>8 string BEAM Erlang BEAM file + +# 4.2 version may have a copyright notice! +4 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2 +79 string Tue Jan 22 14:32:44 MET 1991 Erlang JAM file - version 4.2 + +4 string 1.0 Fri Feb 3 09:55:56 MET 1995 Erlang JAM file - version 4.3 diff --git a/contrib/file-4/magic/Magdir/filesystems b/contrib/file-4/magic/Magdir/filesystems index 20b257b..044d81e 100644 --- a/contrib/file-4/magic/Magdir/filesystems +++ b/contrib/file-4/magic/Magdir/filesystems @@ -833,7 +833,7 @@ # Minix filesystems - Juan Cespedes 0x410 leshort 0x137f Minix filesystem -0x410 beshort 0x137f Minix filesystem (big endian), +0x410 beshort 0x137f Minix filesystem (big endian) >0x402 beshort !0 \b, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f Minix filesystem, 30 char names @@ -1025,19 +1025,42 @@ >&-1248 belong 0 TIME optimization >&-1248 belong 1 SPACE optimization -# ext2/ext3 filesystems - Andreas Dilger -0x438 leshort 0xEF53 Linux ->0x44c lelong x rev %d ->0x43e leshort x \b.%d ->0x45c lelong ^0x0000004 ext2 filesystem data ->>0x43a leshort ^0x0000001 (mounted or unclean) ->0x45c lelong &0x0000004 ext3 filesystem data ->>0x460 lelong &0x0000004 (needs journal recovery) ->0x43a leshort &0x0000002 (errors) ->0x460 lelong &0x0000001 (compressed) -#>0x460 lelong &0x0000002 (filetype) -#>0x464 lelong &0x0000001 (sparse_super) ->0x464 lelong &0x0000002 (large files) +# ext2/ext3 filesystems - Andreas Dilger +# ext4 filesystem - Eric Sandeen +0x438 leshort 0xEF53 Linux +>0x44c lelong x rev %d +>0x43e leshort x \b.%d +# No journal? ext2 +>0x45c lelong ^0x0000004 ext2 filesystem data +>>0x43a leshort ^0x0000001 (mounted or unclean) +# Has a journal? ext3 or ext4 +>0x45c lelong &0x0000004 +# and small INCOMPAT? +>>0x460 lelong <0x0000040 +# and small RO_COMPAT? +>>>0x464 lelong <0x0000008 ext3 filesystem data +# else large RO_COMPAT? +>>>0x464 lelong >0x0000007 ext4 filesystem data +# else large INCOMPAT? +>>0x460 lelong >0x000003f ext4 filesystem data +# General flags for any ext* fs +>0x460 lelong &0x0000004 (needs journal recovery) +>0x43a leshort &0x0000002 (errors) +# INCOMPAT flags +>0x460 lelong &0x0000001 (compressed) +#>0x460 lelong &0x0000002 (filetype) +#>0x460 lelong &0x0000010 (meta bg) +>0x460 lelong &0x0000040 (extents) +>0x460 lelong &0x0000080 (64bit) +#>0x460 lelong &0x0000100 (mmp) +#>0x460 lelong &0x0000200 (flex bg) +# RO_INCOMPAT flags +#>0x464 lelong &0x0000001 (sparse super) +>0x464 lelong &0x0000002 (large files) +>0x464 lelong &0x0000008 (huge files) +#>0x464 lelong &0x0000010 (gdt checksum) +#>0x464 lelong &0x0000020 (many subdirs) +#>0x463 lelong &0x0000040 (extra isize) # SGI disk labels - Nathan Scott 0 belong 0x0BE5A941 SGI disk label (volume header) @@ -1115,40 +1138,42 @@ # CDROM Filesystems # Modified for UDF by gerardo.cacciari@gmail.com -32769 string CD001 ->38913 string !NSR0 ISO 9660 CD-ROM filesystem data ->38913 string NSR0 UDF filesystem data ->>38917 string 1 (version 1.0) ->>38917 string 2 (version 1.5) ->>38917 string 3 (version 2.0) ->>38917 byte >0x33 (unknown version, ID 0x%X) ->>38917 byte <0x31 (unknown version, ID 0x%X) +32769 string CD001 +!:mime application/x-iso9660-image +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data +>38913 string NSR0 UDF filesystem data +>>38917 string 1 (version 1.0) +>>38917 string 2 (version 1.5) +>>38917 string 3 (version 2.0) +>>38917 byte >0x33 (unknown version, ID 0x%X) +>>38917 byte <0x31 (unknown version, ID 0x%X) # "application id" which appears to be used as a volume label ->32808 string >\0 '%s' ->34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) -37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) -32776 string CDROM High Sierra CD-ROM filesystem data +>32808 string >\0 '%s' +>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) +37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) +!:mime application/x-iso9660-image +32776 string CDROM High Sierra CD-ROM filesystem data # cramfs filesystem - russell@coker.com.au 0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian ->4 lelong x size %d +>4 lelong x size %lu >8 lelong &1 version #2 >8 lelong &2 sorted_dirs >8 lelong &4 hole_support >32 lelong x CRC 0x%x, ->36 lelong x edition %d, ->40 lelong x %d blocks, ->44 lelong x %d files +>36 lelong x edition %lu, +>40 lelong x %lu blocks, +>44 lelong x %lu files 0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian ->4 belong x size %d +>4 belong x size %lu >8 belong &1 version #2 >8 belong &2 sorted_dirs >8 belong &4 hole_support >32 belong x CRC 0x%x, ->36 belong x edition %d, ->40 belong x %d blocks, ->44 belong x %d files +>36 belong x edition %lu, +>40 belong x %lu blocks, +>44 belong x %lu files # reiserfs - russell@coker.com.au 0x10034 string ReIsErFs ReiserFS V3.5 @@ -1259,3 +1284,8 @@ # http://filext.com/file-extension/DAA # describes the daa file format. The magic would be: 0 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive + +# From Albert Cahalan +# really le32 operation,destination,payloadsize (but quite predictable) +# 01 00 00 00 00 00 00 c0 00 02 00 00 +0 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware diff --git a/contrib/file-4/magic/Magdir/flash b/contrib/file-4/magic/Magdir/flash index f14b460..0b985f2 100644 --- a/contrib/file-4/magic/Magdir/flash +++ b/contrib/file-4/magic/Magdir/flash @@ -8,10 +8,13 @@ # 0 string FWS Macromedia Flash data, >3 byte x version %d +!:mime application/x-shockwave-flash 0 string CWS Macromedia Flash data (compressed), +!:mime application/x-shockwave-flash >3 byte x version %d # From: Cal Peake 0 string FLV Macromedia Flash Video +!:mime video/x-flv # # From Dave Wilson diff --git a/contrib/file-4/magic/Magdir/fonts b/contrib/file-4/magic/Magdir/fonts index cf6e0d7..a6f43e7 100644 --- a/contrib/file-4/magic/Magdir/fonts +++ b/contrib/file-4/magic/Magdir/fonts @@ -1,14 +1,13 @@ - #------------------------------------------------------------------------------ # fonts: file(1) magic for font data # -0 string FONT ASCII vfont text +0 search/1 FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com -0 string %!PS-AdobeFont-1. PostScript Type 1 font text ->20 string >\0 (%s) +0 search/1 %!PS-AdobeFont-1. PostScript Type 1 font text +>20 search/1 >\0 (%s) 6 string %!PS-AdobeFont-1. PostScript Type 1 font program data # X11 font files in SNF (Server Natural Format) format @@ -16,7 +15,7 @@ 0 lelong 00000004 X11 SNF font data, LSB first # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) -0 string STARTFONT\040 X11 BDF font text +0 search/1 STARTFONT\ X11 BDF font text # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) diff --git a/contrib/file-4/magic/Magdir/fortran b/contrib/file-4/magic/Magdir/fortran index ce004ad..3e49033 100644 --- a/contrib/file-4/magic/Magdir/fortran +++ b/contrib/file-4/magic/Magdir/fortran @@ -1,2 +1,3 @@ # FORTRAN source 0 string/c c\ FORTRAN program +!:mime text/x-fortran diff --git a/contrib/file-4/magic/Magdir/frame b/contrib/file-4/magic/Magdir/frame index 1b397df..3699b44 100644 --- a/contrib/file-4/magic/Magdir/frame +++ b/contrib/file-4/magic/Magdir/frame @@ -1,11 +1,14 @@ - #------------------------------------------------------------------------------ # frame: file(1) magic for FrameMaker files # # This stuff came on a FrameMaker demo tape, most of which is # copyright, but this file is "published" as witness the following: # +# Note that this is the Framemaker Maker Interchange Format, not the +# Normal format which would be application/vnd.framemaker. +# 0 string \11 string 5.5 (5.5 >11 string 5.0 (5.0 >11 string 4.0 (4.0 @@ -14,25 +17,32 @@ >11 string 1.0 (1.0 >14 byte x %c) 0 string \9 string 4.0 (4.0) >9 string 3.0 (3.0) >9 string 2.0 (2.0) >9 string 1.0 (1.x) -0 string \17 string 3.0 (3.0) >17 string 2.0 (2.0) >17 string 1.0 (1.x) 0 string \17 string 1.01 (%s) 0 string \10 string 3.0 (3.0 >10 string 2.0 (2.0 >10 string 1.0 (1.0 >13 byte x %c) # XXX - this book entry should be verified, if you find one, uncomment this #0 string \6 string 3.0 (3.0) #>6 string 2.0 (2.0) #>6 string 1.0 (1.0) 0 string \11 string >\0 Clam AntiVirus database %-.23s >>34 string : ->>>35 regex [^:]+ \b, version +>>>35 string !: \b, version >>>>35 string x \b%-.1s >>>>>36 string !: >>>>>>36 string x \b%-.1s @@ -55,6 +55,10 @@ >>>>>>>>>38 string !: >>>>>>>>>>38 string x \b%-.1s >>>>512 string \037\213 \b, gzipped ->>>>769 string ustar\0 \b, tared +>>>>769 string ustar\0 \b, tarred >512 string \037\213 \b, gzipped ->769 string ustar\0 \b, tared +>769 string ustar\0 \b, tarred + +# Type: Grisoft AVG AntiVirus +# From: David Newgas +0 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data diff --git a/contrib/file-4/magic/Magdir/games b/contrib/file-4/magic/Magdir/games index 2dc17da..571c146 100644 --- a/contrib/file-4/magic/Magdir/games +++ b/contrib/file-4/magic/Magdir/games @@ -1,12 +1,6 @@ #------------------------------------------------------------------------------ # games: file(1) for games -# Thomas M. Ott (ThMO) -1 string =WAD DOOM data, ->0 string =I main wad ->0 string =P patch wad ->0 byte x unknown junk - # Fabio Bonelli # Quake II - III data files 0 string IDP2 Quake II 3D Model file, @@ -29,11 +23,6 @@ # Doom and Quake # submitted by Nicolas Patrois -# DOOM - -0 string IWAD DOOM or DOOM ][ world -0 string PWAD DOOM or DOOM ][ extension world - 0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo # some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 @@ -155,3 +144,10 @@ 0 string MComprHD MAME CHD compressed hard disk image, >12 belong x version %lu + +# doom - submitted by Jon Dowland + +0 string =IWAD doom main IWAD data +>4 lelong x containing %d lumps +0 string =PWAD doom patch PWAD data +>4 lelong x containing %d lumps diff --git a/contrib/file-4/magic/Magdir/gnome-keyring b/contrib/file-4/magic/Magdir/gnome-keyring new file mode 100644 index 0000000..80a4f88 --- /dev/null +++ b/contrib/file-4/magic/Magdir/gnome-keyring @@ -0,0 +1,23 @@ +# GNOME keyring +# Contributed by Josh Triplett +# FIXME: Could be simplified if pstring supported two-byte counts +0 string GnomeKeyring\n\r\0\n GNOME keyring +>&0 ubyte 0 \b, major version 0 +>>&0 ubyte 0 \b, minor version 0 +>>>&0 ubyte 0 \b, crypto type 0 (AEL) +>>>&0 ubyte >0 \b, crypto type %hhu (unknown) +>>>&1 ubyte 0 \b, hash type 0 (MD5) +>>>&1 ubyte >0 \b, hash type %hhu (unknown) +>>>&2 ubelong 0xFFFFFFFF \b, name NULL +>>>&2 ubelong !0xFFFFFFFF +>>>>&-4 ubelong >255 \b, name too long for file's pstring type +>>>>&-4 ubelong <256 +>>>>>&-1 pstring x \b, name "%s" +>>>>>>&0 ubeqdate x \b, last modified %s +>>>>>>&8 ubeqdate x \b, created %s +>>>>>>&16 ubelong &1 +>>>>>>>&0 ubelong x \b, locked if idle for %u seconds +>>>>>>&16 ubelong ^1 \b, not locked if idle +>>>>>>&24 ubelong x \b, hash iterations %u +>>>>>>&28 ubequad x \b, salt %llu +>>>>>>&52 ubelong x \b, %u item(s) diff --git a/contrib/file-4/magic/Magdir/gnu b/contrib/file-4/magic/Magdir/gnu index 42d9c7b..a237f53 100644 --- a/contrib/file-4/magic/Magdir/gnu +++ b/contrib/file-4/magic/Magdir/gnu @@ -17,10 +17,14 @@ # The format is very similar to pgp 0 string \001gpg GPG key trust database >4 byte x version %d +# Note: magic.mime had 0x8501 for the next line instead of 0x8502 0 beshort 0x8502 GPG encrypted data +!:mime text/PGP # encoding: data + # This magic is not particularly good, as the keyrings don't have true # magic. Nevertheless, it covers many keyrings. 0 beshort 0x9901 GPG key public ring +!:mime application/x-gnupg-keyring # Gnumeric spreadsheet # This entry is only semi-helpful, as Gnumeric compresses its files, so diff --git a/contrib/file-4/magic/Magdir/gnumeric b/contrib/file-4/magic/Magdir/gnumeric new file mode 100644 index 0000000..76dfa90 --- /dev/null +++ b/contrib/file-4/magic/Magdir/gnumeric @@ -0,0 +1,7 @@ + +#------------------------------------------------------------------------------ +# gnumeric: file(1) magic for Gnumeric spreadsheet +# This entry is only semi-helpful, as Gnumeric compresses its files, so +# they will ordinarily reported as "compressed", but at least -z helps +39 string =8 long >0 %d messages # addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 -0 string HPHP48- HP48 binary ->7 byte >0 - Rev %c ->8 beshort 0x1129 (ADR) ->8 beshort 0x3329 (REAL) ->8 beshort 0x5529 (LREAL) ->8 beshort 0x7729 (COMPLX) ->8 beshort 0x9d29 (LCOMPLX) ->8 beshort 0xbf29 (CHAR) ->8 beshort 0xe829 (ARRAY) ->8 beshort 0x0a2a (LNKARRAY) ->8 beshort 0x2c2a (STRING) ->8 beshort 0x4e2a (HXS) ->8 beshort 0x742a (LIST) ->8 beshort 0x962a (DIR) ->8 beshort 0xb82a (ALG) ->8 beshort 0xda2a (UNIT) ->8 beshort 0xfc2a (TAGGED) ->8 beshort 0x1e2b (GROB) ->8 beshort 0x402b (LIB) ->8 beshort 0x622b (BACKUP) ->8 beshort 0x882b (LIBDATA) ->8 beshort 0x9d2d (PROG) ->8 beshort 0xcc2d (CODE) ->8 beshort 0x482e (GNAME) ->8 beshort 0x6d2e (LNAME) ->8 beshort 0x922e (XLIB) -0 string %%HP: HP48 text +0 string HPHP4 HP +>5 string 8 48 binary +>5 string 9 49 binary +>7 byte >64 - Rev %c +>8 leshort 0x2911 (ADR) +>8 leshort 0x2933 (REAL) +>8 leshort 0x2955 (LREAL) +>8 leshort 0x2977 (COMPLX) +>8 leshort 0x299d (LCOMPLX) +>8 leshort 0x29bf (CHAR) +>8 leshort 0x29e8 (ARRAY) +>8 leshort 0x2a0a (LNKARRAY) +>8 leshort 0x2a2c (STRING) +>8 leshort 0x2a4e (HXS) +>8 leshort 0x2a74 (LIST) +>8 leshort 0x2a96 (DIR) +>8 leshort 0x2ab8 (ALG) +>8 leshort 0x2ada (UNIT) +>8 leshort 0x2afc (TAGGED) +>8 leshort 0x2b1e (GROB) +>8 leshort 0x2b40 (LIB) +>8 leshort 0x2b62 (BACKUP) +>8 leshort 0x2b88 (LIBDATA) +>8 leshort 0x2d9d (PROG) +>8 leshort 0x2dcc (CODE) +>8 leshort 0x2e48 (GNAME) +>8 leshort 0x2e6d (LNAME) +>8 leshort 0x2e92 (XLIB) + +0 search/1 %%HP: HP text >6 string T(0) - T(0) >6 string T(1) - T(1) >6 string T(2) - T(2) @@ -240,6 +242,23 @@ >14 string F(.) F(.); >14 string F(,) F(,); +0 string HP3 HP +>3 string 8 38 +>3 string 9 39 +>4 string Bin binary +>4 string Asc ASCII +>7 string A (Directory List) +>7 string B (Zaplet) +>7 string C (Note) +>7 string D (Program) +>7 string E (Variable) +>7 string F (List) +>7 string G (Matrix) +>7 string H (Library) +>7 string I (Target List) +>7 string J (ASCII Vector specification) +>7 string K (wildcard) + # hpBSD magic numbers 0 beshort 200 hp200 (68010) BSD >2 beshort 0407 impure binary @@ -391,5 +410,5 @@ >>>>>>>>>0xC4 belong 34 - received SIGXFSZ # From: AMAKAWA Shuhei -0 string HPHP49- HP49 binary +#0 string HPHP49- HP49 binary diff --git a/contrib/file-4/magic/Magdir/iff b/contrib/file-4/magic/Magdir/iff index 3c88f90..4d2a832 100644 --- a/contrib/file-4/magic/Magdir/iff +++ b/contrib/file-4/magic/Magdir/iff @@ -13,8 +13,11 @@ #>4 belong x \b, FORM is %d bytes long # audio formats >8 string AIFF \b, AIFF audio +!:mime audio/x-aiff >8 string AIFC \b, AIFF-C compressed audio +!:mime audio/x-aiff >8 string 8SVX \b, 8SVX 8-bit sampled sound voice +!:mime audio/x-aiff >8 string 16SV \b, 16SV 16-bit sampled sound voice >8 string SAMP \b, SAMP sampled audio >8 string MAUD \b, MAUD MacroSystem audio diff --git a/contrib/file-4/magic/Magdir/images b/contrib/file-4/magic/Magdir/images index fd9e14f..1a16c5f 100644 --- a/contrib/file-4/magic/Magdir/images +++ b/contrib/file-4/magic/Magdir/images @@ -1,6 +1,6 @@ - #------------------------------------------------------------------------------ -# images: file(1) magic for image formats (see also "iff") +# images: file(1) magic for image formats (see also "iff", and "c-lang" for +# XPM bitmaps) # # originally from jef@helios.ee.lbl.gov (Jef Poskanzer), # additions by janl@ifi.uio.no as well as others. Jan also suggested @@ -30,13 +30,20 @@ # PBMPLUS images # The next byte following the magic is always whitespace. -0 string P1 Netpbm PBM image text -0 string P2 Netpbm PGM image text -0 string P3 Netpbm PPM image text +0 search/1 P1 Netpbm PBM image text +!:mime image/x-portable-bitmap +0 search/1 P2 Netpbm PGM image text +!:mime image/x-portable-greymap +0 search/1 P3 Netpbm PPM image text +!:mime image/x-portable-pixmap 0 string P4 Netpbm PBM "rawbits" image data +!:mime image/x-portable-bitmap 0 string P5 Netpbm PGM "rawbits" image data +!:mime image/x-portable-greymap 0 string P6 Netpbm PPM "rawbits" image data +!:mime image/x-portable-pixmap 0 string P7 Netpbm PAM image file +!:mime image/x-portable-pixmap # From: bryanh@giraffe-data.com (Bryan Henderson) 0 string \117\072 Solitaire Image Recorder format @@ -50,13 +57,17 @@ >21 byte 51 version 3 # NIFF (Navy Interchange File Format, a modification of TIFF) images +# [GRR: this *must* go before TIFF] 0 string IIN1 NIFF image data +!:mime image/x-niff # Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) # The second word of TIFF files is the TIFF version number, 42, which has # never changed. The TIFF specification recommends testing for it. 0 string MM\x00\x2a TIFF image data, big-endian +!:mime image/tiff 0 string II\x2a\x00 TIFF image data, little-endian +!:mime image/tiff # PNG [Portable Network Graphics, or "PNG's Not GIF"] images # (Greg Roelofs, newt@uchicago.edu) @@ -65,6 +76,7 @@ # 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... # 0 string \x89PNG PNG image data, +!:mime image/png >4 belong !0x0d0a1a0a CORRUPTED, >4 belong 0x0d0a1a0a >>16 belong x %ld x @@ -80,8 +92,27 @@ >>28 byte 1 interlaced 1 string PNG PNG image data, CORRUPTED +# possible GIF replacements; none yet released! +# (Greg Roelofs, newt@uchicago.edu) +# +# GRR 950115: this was mine ("Zip GIF"): +0 string GIF94z ZIF image (GIF+deflate alpha) +!:mime image/x-unknown +# +# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): +# +0 string FGF95a FGF image (GIF+deflate beta) +!:mime image/x-unknown +# +# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal +# (best; not yet implemented): +# +0 string PBF PBF image (deflate compression) +!:mime image/x-unknown + # GIF 0 string GIF8 GIF image data +!:mime image/gif >4 string 7a \b, version 8%s, >4 string 9a \b, version 8%s, >6 leshort >0 %hd x @@ -113,7 +144,7 @@ >4 long 3 \b, rectangular 32-bit (24-bit with matte) # FIG (Facility for Interactive Generation of figures), an object-based format -0 string #FIG FIG image text +0 search/1 #FIG FIG image text >5 string x \b, version %.3s # PHIGS @@ -130,8 +161,8 @@ # CGM image files 0 string BEGMF clear text Computer Graphics Metafile # XXX - questionable magic -0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile -0 beshort 0x3020 character Computer Graphics Metafile +#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile +#0 beshort 0x3020 character Computer Graphics Metafile # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 0 string yz MGR bitmap, modern format, 8-bit aligned @@ -152,8 +183,9 @@ 0 string Sfff structured fax file -# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu) +# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 0 string BM PC bitmap data +!:mime image/x-ms-bmp >14 leshort 12 \b, OS/2 1.x format >>18 leshort x \b, %d x >>20 leshort x %d @@ -174,7 +206,7 @@ # XPM icons (Greg Roelofs, newt@uchicago.edu) # note possible collision with C/REXX entry in c-lang; currently commented out -0 string /*\ XPM\ */ X pixmap image text +0 search/1 /*\ XPM\ */ X pixmap image text # Utah Raster Toolkit RLE images (janl@ifi.uio.no) 0 leshort 0xcc52 RLE image data, @@ -260,7 +292,7 @@ # other images 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file -0 string =!! Bennet Yee's "face" format +#0 string =!! Bennet Yee's "face" format # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image # stuff. @@ -269,6 +301,7 @@ # DICOM medical imaging data 128 string DICM DICOM medical imaging data +!:mime application/dicom # XWD - X Window Dump file. # As described in /usr/X11R6/include/X11/XWDFile.h @@ -367,6 +400,7 @@ # Adobe Photoshop 0 string 8BPS Adobe Photoshop Image +!:mime image/vnd.adobe.photoshop # XV thumbnail indicator (ThMO) 0 string P7\ 332 XV thumbnail image data @@ -456,9 +490,9 @@ >12 long x \b, track size %d bytes >16 byte x \b, device type 33%2.2X -# Squeak images and - etoffi@softhome.net -0 string \146\031\0\0 Squeak image data -0 string 'From\040Squeak Squeak program text +# Squeak images and programs - etoffi@softhome.net +0 string \146\031\0\0 Squeak image data +0 search/1 'From\040Squeak Squeak program text # partimage: file(1) magic for PartImage files (experimental, incomplete) # Author: Hans-Joachim Baader @@ -508,9 +542,7 @@ # From: stephane.loeuillet@tiscali.f # http://www.djvuzone.org/ 0 string AT&TFORM DjVu Image file - -# From: Jason Bacon -0 beshort 0x3020 character Computer Graphics Metafile +!:mime image/vnd.djvu # From Marc Espie 0 lelong 20000630 OpenEXR image data @@ -523,9 +555,36 @@ # Hierarchical Data Format, used to facilitate scientific data exchange # specifications at http://hdf.ncsa.uiuc.edu/ 0 belong 0x0e031301 Hierarchical Data Format (version 4) data +!:mime application/x-hdf 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data +!:mime application/x-hdf # From: Tobias Burnus # Xara (for a while: Corel Xara) is a graphic package, see -# http://www.xara.com/ for Windows and as GPL application for +# http://www.xara.com/ for Windows and as GPL application for Linux 0 string XARA\243\243 Xara graphics file + +# http://www.cartesianinc.com/Tech/ +0 string CPC\262 Cartesian Perceptual Compression image +!:mime image/x-cpi + +# From Albert Cahalan +# puredigital used it for the CVS disposable camcorder +#8 lelong 4 ZBM bitmap image data +#>4 leshort x %u x +#>6 leshort x %u + +# From Albert Cahalan +# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons +0 string C565 OLPC firmware icon image data +>4 leshort x %u x +>6 leshort x %u + +# Applied Images - Image files from Cytovision +# Gustavo Junior Alves +0 string \xce\xda\xde\xfa Cytovision Metaphases file +0 string \xed\xad\xef\xac Cytovision Karyotype file +0 string \x0b\x00\x03\x00 Cytovision FISH Probe file +0 string \xed\xfe\xda\xbe Cytovision FLEX file +0 string \xed\xab\xed\xfe Cytovision FLEX file +0 string \xad\xfd\xea\xad Cytovision RATS file diff --git a/contrib/file-4/magic/Magdir/inform b/contrib/file-4/magic/Magdir/inform new file mode 100644 index 0000000..ba35d61 --- /dev/null +++ b/contrib/file-4/magic/Magdir/inform @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# inform: file(1) magic for Inform interactive fiction language + +# URL: http://www.inform-fiction.org/ +# From: Reuben Thomas + +0 search/cB/100 constant\ story Inform source text diff --git a/contrib/file-4/magic/Magdir/java b/contrib/file-4/magic/Magdir/java index 971b72c..cca5542 100644 --- a/contrib/file-4/magic/Magdir/java +++ b/contrib/file-4/magic/Magdir/java @@ -9,8 +9,9 @@ >2 beshort >0x0004 \b, version %d 0 belong 0xfeedfeed Java KeyStore - +!:mime application/x-java-keystore 0 belong 0xcececece Java JCE KeyStore +!:mime application/x-java-jce-keystore # Dalvik .dex format. http://retrodev.com/android/dexformat.html # From "Mike Fleming" diff --git a/contrib/file-4/magic/Magdir/jpeg b/contrib/file-4/magic/Magdir/jpeg index af646d6..9a9509e 100644 --- a/contrib/file-4/magic/Magdir/jpeg +++ b/contrib/file-4/magic/Magdir/jpeg @@ -9,6 +9,7 @@ # both of which turn into "JPEG image data" here. # 0 beshort 0xffd8 JPEG image data +!:mime image/jpeg >6 string JFIF \b, JFIF standard # The following added by Erik Rossen 1999-09-06 # in a vain attempt to add image size reporting for JFIF. Note that these @@ -153,3 +154,8 @@ # From: David Santinoli 0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data + +# Type: JPEG 2000 codesream +# From: Mathieu Malaterre +0 belong 0xff4fff51 JPEG 2000 codestream +45 beshort 0xff52 diff --git a/contrib/file-4/magic/Magdir/kde b/contrib/file-4/magic/Magdir/kde new file mode 100644 index 0000000..d81ee69 --- /dev/null +++ b/contrib/file-4/magic/Magdir/kde @@ -0,0 +1,10 @@ + +#------------------------------------------------------------------------------ +# kde: file(1) magic for KDE + +0 string [KDE\ Desktop\ Entry] KDE desktop entry +!:mime application/x-kdelnk +0 string #\ KDE\ Config\ File KDE config file +!:mime application/x-kdelnk +0 string #\ xmcd xmcd database file for kscd +!:mime text/x-xmcd diff --git a/contrib/file-4/magic/Magdir/lex b/contrib/file-4/magic/Magdir/lex index 7b6d0f7..eae9b10 100644 --- a/contrib/file-4/magic/Magdir/lex +++ b/contrib/file-4/magic/Magdir/lex @@ -1,11 +1,10 @@ - #------------------------------------------------------------------------------ # lex: file(1) magic for lex # # derived empirically, your offsets may vary! -53 string yyprevious C program text (from lex) ->3 string >\0 for %s +0 search/100 yyprevious C program text (from lex) +>3 search/1 >\0 for %s # C program text from GNU flex, from Daniel Quinlan -21 string generated\ by\ flex C program text (from flex) +0 search/100 generated\ by\ flex C program text (from flex) # lex description file, from Daniel Quinlan -0 string %{ lex description text +0 search/1 %{ lex description text diff --git a/contrib/file-4/magic/Magdir/linux b/contrib/file-4/magic/Magdir/linux index fe68013..d4ae0f0 100644 --- a/contrib/file-4/magic/Magdir/linux +++ b/contrib/file-4/magic/Magdir/linux @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # linux: file(1) magic for Linux files # @@ -103,16 +102,18 @@ >0x1e9 string Loading from prehistoric times # System.map files - Nicolás Lichtmaier -8 string \ A\ _text Linux kernel symbol map text +8 search/1 \ A\ _text Linux kernel symbol map text # LSM entries - Nicolás Lichtmaier -0 string Begin3 Linux Software Map entry text -0 string Begin4 Linux Software Map entry text (new format) - -# From Matt Zimmerman -0 belong 0x4f4f4f4d User-mode Linux COW file ->4 belong x \b, version %d ->8 string >\0 \b, backing file %s +0 search/1 Begin3 Linux Software Map entry text +0 search/1 Begin4 Linux Software Map entry text (new format) + +# From Matt Zimmerman, enhanced for v3 by Matthew Palmer +0 belong 0x4f4f4f4d User-mode Linux COW file +>4 belong <3 \b, version %d +>>8 string >\0 \b, backing file %s +>4 belong >2 \b, version %d +>>32 string >\0 \b, backing file %s ############################################################################ # Linux kernel versions diff --git a/contrib/file-4/magic/Magdir/lisp b/contrib/file-4/magic/Magdir/lisp index e9c8ba8..2144992 100644 --- a/contrib/file-4/magic/Magdir/lisp +++ b/contrib/file-4/magic/Magdir/lisp @@ -1,15 +1,15 @@ - #------------------------------------------------------------------------------ # lisp: file(1) magic for lisp programs # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) # updated by Joerg Jenderek -0 string ;; +# GRR: This lot is too weak +#0 string ;; # windows INF files often begin with semicolon and use CRLF as line end # lisp files are mainly created on unix system with LF as line end ->2 search/2048 !\r Lisp/Scheme program text ->2 search/2048 \r Windows INF file +#>2 search/2048 !\r Lisp/Scheme program text +#>2 search/2048 \r Windows INF file 0 search/256 (if\ Lisp/Scheme program text 0 search/256 (setq\ Lisp/Scheme program text @@ -21,15 +21,17 @@ # Emacs 18 - this is always correct, but not very magical. 0 string \012( Emacs v18 byte-compiled Lisp data +!:mime application/x-elc # Emacs 19+ - ver. recognition added by Ian Springer -# Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp -# support or similar - Chris Chittleborough -0 string ;ELC ->4 byte >19 +# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs +# - Chris Chittleborough +0 string ;ELC +>4 byte >18 >4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data +!:mime application/x-elc # Files produced by CLISP Common Lisp From: Bruno Haible -0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text +0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program 0 long 0x70768BD2 CLISP memory image data 0 long 0xD28B7670 CLISP memory image data, other endian @@ -41,4 +43,5 @@ 0 string \372\372\372\372 MIT scheme (library?) # From: David Allouche -0 string \ + +0 string llvm LLVM byte-codes, uncompressed +0 string llvc0 LLVM byte-codes, null compression +0 string llvc1 LLVM byte-codes, gzip compression +0 string llvc2 LLVM byte-codes, bzip2 compression diff --git a/contrib/file-4/magic/Magdir/lua b/contrib/file-4/magic/Magdir/lua new file mode 100644 index 0000000..303fd37 --- /dev/null +++ b/contrib/file-4/magic/Magdir/lua @@ -0,0 +1,15 @@ +#------------------------------------------------------------------------------ +# lua: file(1) magic for Lua scripting language +# URL: http://www.lua.org/ +# From: Reuben Thomas , Seo Sanghyeon + +# Lua scripts +0 search/1/b #!\ /usr/bin/lua Lua script text executable +0 search/1/b #!\ /usr/local/bin/lua Lua script text executable +0 search/1 #!/usr/bin/env\ lua Lua script text executable +0 search/1 #!\ /usr/bin/env\ lua Lua script text executable + +# Lua bytecode +0 string \033Lua Lua bytecode, +>4 byte 0x50 version 5.0 +>4 byte 0x51 version 5.1 diff --git a/contrib/file-4/magic/Magdir/luks b/contrib/file-4/magic/Magdir/luks new file mode 100644 index 0000000..2ab2393 --- /dev/null +++ b/contrib/file-4/magic/Magdir/luks @@ -0,0 +1,12 @@ + +#------------------------------------------------------------------------------ +# luks: file(1) magic for Linux Unified Key Setup +# URL: http://luks.endorphin.org/spec +# From: Anthon van der Neut + +0 string LUKS\xba\xbe LUKS encrypted file, +>6 beshort x ver %d +>8 string x [%s, +>40 string x %s, +>72 string x %s] +>168 string x UUID: %s diff --git a/contrib/file-4/magic/Magdir/macintosh b/contrib/file-4/magic/Magdir/macintosh index 4acd5c8..77187a3 100644 --- a/contrib/file-4/magic/Magdir/macintosh +++ b/contrib/file-4/magic/Magdir/macintosh @@ -5,6 +5,7 @@ # BinHex is the Macintosh ASCII-encoded file format (see also "apple") # Daniel Quinlan, quinlan@yggdrasil.com 11 string must\ be\ converted\ with\ BinHex BinHex binary text +!:mime application/mac-binhex40 >41 string x \b, version %.3s # Stuffit archives are the de facto standard of compression for Macintosh @@ -18,37 +19,41 @@ # Newer StuffIt archives (grant@netbsd.org) 0 string StuffIt StuffIt Archive +!:mime application/x-stuffit #>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@tuns.ca) -0 string APPL Macintosh Application (data) ->2 string x \b: %s +# GRR: Too weak +#0 string APPL Macintosh Application (data) +#>2 string x \b: %s # Macintosh System files (franklsm@tuns.ca) -0 string zsys Macintosh System File (data) -0 string FNDR Macintosh Finder (data) -0 string libr Macintosh Library (data) ->2 string x : %s -0 string shlb Macintosh Shared Library (data) ->2 string x : %s -0 string cdev Macintosh Control Panel (data) ->2 string x : %s -0 string INIT Macintosh Extension (data) ->2 string x : %s -0 string FFIL Macintosh Truetype Font (data) ->2 string x : %s -0 string LWFN Macintosh Postscript Font (data) ->2 string x : %s +# GRR: Too weak +#0 string zsys Macintosh System File (data) +#0 string FNDR Macintosh Finder (data) +#0 string libr Macintosh Library (data) +#>2 string x : %s +#0 string shlb Macintosh Shared Library (data) +#>2 string x : %s +#0 string cdev Macintosh Control Panel (data) +#>2 string x : %s +#0 string INIT Macintosh Extension (data) +#>2 string x : %s +#0 string FFIL Macintosh Truetype Font (data) +#>2 string x : %s +#0 string LWFN Macintosh Postscript Font (data) +#>2 string x : %s # Additional Macintosh Files (franklsm@tuns.ca) -0 string PACT Macintosh Compact Pro Archive (data) ->2 string x : %s -0 string ttro Macintosh TeachText File (data) ->2 string x : %s -0 string TEXT Macintosh TeachText File (data) ->2 string x : %s -0 string PDF Macintosh PDF File (data) ->2 string x : %s +# GRR: Too weak +#0 string PACT Macintosh Compact Pro Archive (data) +#>2 string x : %s +#0 string ttro Macintosh TeachText File (data) +#>2 string x : %s +#0 string TEXT Macintosh TeachText File (data) +#>2 string x : %s +#0 string PDF Macintosh PDF File (data) +#>2 string x : %s # MacBinary format (Eric Fischer, enf@pobox.com) # @@ -320,41 +325,50 @@ # shorter than 32 bytes must be terminated with NULL" so I'll treat it as a # cstring. Of course, partitions can contain more than four entries, but # what're you gonna do? -0x200 beshort 0x504D Apple Partition data ->0x2 beshort x block size: %d, ->0x230 string x first type: %s, ->0x210 string x name: %s, ->0x254 belong x number of blocks: %d, ->0x400 beshort 0x504D ->>0x430 string x second type: %s, ->>0x410 string x name: %s, ->>0x454 belong x number of blocks: %d, ->>0x800 beshort 0x504D ->>>0x830 string x third type: %s, ->>>0x810 string x name: %s, ->>>0x854 belong x number of blocks: %d, ->>>0xa00 beshort 0x504D ->>>>0xa30 string x fourth type: %s, ->>>>0xa10 string x name: %s, ->>>>0xa54 belong x number of blocks: %d -# AFAIK, only the signature is different -0x200 beshort 0x5453 Apple Old Partition data ->0x2 beshort x block size: %d, ->0x230 string x first type: %s, ->0x210 string x name: %s, ->0x254 belong x number of blocks: %d, ->0x400 beshort 0x504D ->>0x430 string x second type: %s, ->>0x410 string x name: %s, ->>0x454 belong x number of blocks: %d, ->>0x800 beshort 0x504D ->>>0x830 string x third type: %s, ->>>0x810 string x name: %s, ->>>0x854 belong x number of blocks: %d, ->>>0xa00 beshort 0x504D ->>>>0xa30 string x fourth type: %s, ->>>>0xa10 string x name: %s, ->>>>0xa54 belong x number of blocks: %d +# GRR: This magic is too weak, it is just "PM" +#0x200 beshort 0x504D Apple Partition data +#>0x2 beshort x (block size: %d): +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x600 beshort 0x504D +#>>>0x630 string x third type: %s, +#>>>0x610 string x name: %s, +#>>>0x654 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x fourth type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fifth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d +#>>>0xc00 beshort 0x504D +#>>>>0xc30 string x sixth type: %s, +#>>>>0xc10 string x name: %s, +#>>>>0xc54 belong x number of blocks: %d +## AFAIK, only the signature is different +#0x200 beshort 0x5453 Apple Old Partition data +#>0x2 beshort x block size: %d, +#>0x230 string x first type: %s, +#>0x210 string x name: %s, +#>0x254 belong x number of blocks: %d, +#>0x400 beshort 0x504D +#>>0x430 string x second type: %s, +#>>0x410 string x name: %s, +#>>0x454 belong x number of blocks: %d, +#>>0x800 beshort 0x504D +#>>>0x830 string x third type: %s, +#>>>0x810 string x name: %s, +#>>>0x854 belong x number of blocks: %d, +#>>>0xa00 beshort 0x504D +#>>>>0xa30 string x fourth type: %s, +#>>>>0xa10 string x name: %s, +#>>>>0xa54 belong x number of blocks: %d # From: Remi Mommsen 0 string BOMStore Mac OS X bill of materials (BOM) file diff --git a/contrib/file-4/magic/Magdir/mail.news b/contrib/file-4/magic/Magdir/mail.news index f08261c..0b9d90a 100644 --- a/contrib/file-4/magic/Magdir/mail.news +++ b/contrib/file-4/magic/Magdir/mail.news @@ -1,4 +1,3 @@ - #------------------------------------------------------------------------------ # mail.news: file(1) magic for mail and news # @@ -6,17 +5,28 @@ #0 string From mail text # There are tests to ascmagic.c to cope with mail and news. 0 string Relay-Version: old news text +!:mime message/rfc822 0 string #!\ rnews batched news text +!:mime message/rfc822 0 string N#!\ rnews mailed, batched news text +!:mime message/rfc822 0 string Forward\ to mail forwarding text +!:mime message/rfc822 0 string Pipe\ to mail piping text +!:mime message/rfc822 0 string Return-Path: smtp mail text +!:mime message/rfc822 0 string Path: news text +!:mime message/news 0 string Xref: news text +!:mime message/news 0 string From: news or mail text +!:mime message/rfc822 0 string Article saved news text +!:mime message/news 0 string BABYL Emacs RMAIL text 0 string Received: RFC 822 mail text +!:mime message/rfc822 0 string MIME-Version: MIME entity text #0 string Content- MIME entity text @@ -39,3 +49,5 @@ # XXX: Weak magic #256 leshort 0xAFAE4453 Squish message area data file #>4 leshort >0 (%d messages) + +#0 string \