hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-12-18 05:53:36 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Upgrade to file version 3.19.

Browse Source
This commit is contained in:
Mike Pritchard 1996-01-23 12:29:07 +00:00
parent c7510038dc
commit 8356464a86
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/vendor/file/dist/; revision=13584
94 changed files with 2102 additions and 541 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
usr.bin/file/LEGAL.NOTICE
View File

@ -1,13 +1,10 @@
Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992.
Written by Ian F. Darwin and others.
$Id: LEGAL.NOTICE,v 1.8 1993/03/17 11:35:30 ian Exp $
Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995.
Software written by Ian F. Darwin and others; maintained by Christos Zoulas.
$Id: LEGAL.NOTICE,v 1.9 1995/10/27 23:14:20 christos Exp $
This software is not subject to and may not be made subject to any
license of the American Telephone and Telegraph Company (AT&T Inc.),
UNIX System Laboratories (USL Inc.), Novell Inc., Sun Microsystems
Inc., Digital Equipment Inc., Lotus Development Inc., the Regents of
the University of California, The X Consortium or MIT, or The Free
Software Foundation.
This software (or derivative software) may not be made subject to any
license which denies anyone permission to alter it and redistribute it
freely. Derivative software must also still fall under this license.
This software is not subject to any export provision of the United States
Department of Commerce, and may be exported to any country or planet.
@ -26,12 +23,9 @@ to the following restrictions:
3. Altered versions must be plainly marked as such, and must not be
misrepresented as being the original software. Since few users
ever read sources, credits must appear in the documentation.
Derivative works must also be marked as such, and credits must appear
in the documentation.
4. This notice may not be removed or altered.
UNIX is a trademark of UNIX System Laboratories (which is probably a
subsidiary of Novell, Inc., by the time you read this). The name "UNIX"
may not be used by commercial undertakings without permission in
writing from USL. Just ask BSDI (Berkeley Software Design Inc.), a
commercial venture not officially connected with the University of
California at Berkeley.

8
usr.bin/file/Magdir/Localstuff
View File

@ -1,3 +1,7 @@
# $Id: Localstuff,v 1.2 1993/01/05 13:22:25 ian Exp $
# Add any locally-observed files here. Remember:
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
# $Id: Localstuff,v 1.3 1995/01/21 21:09:00 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.

4
usr.bin/file/Magdir/alliant
View File

@ -1,5 +1,7 @@
#------------------------------------------------------------------------------
# alliant: file(1) magic for Alliant FX series a.out files
#
# Alliant FX series a.out files:
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".

54
usr.bin/file/Magdir/animation Normal file
View File

@ -0,0 +1,54 @@
#------------------------------------------------------------------------------
# animation: file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
# MPEG animation format
0 string \000\000\001\263 MPEG file
# FLI animation format
4 leshort 0xAF11 FLI file
>6 leshort x - %d frames,
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# FLC animation format
4 leshort 0xAF12 FLC file
>6 leshort x - %d frames
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work. Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)! The DL format is really bad.
#
#0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
#>42 byte x - %d screens,
#>43 byte x %d commands
#0 byte 2 DL version 2
#>1 byte 1 - large format (320x200,1 image/screen),
#>1 byte 2 - medium format (160x100,4 images/screen),
#>1 byte >2 - unknown format,
#>42 byte x %d screens,
#>43 byte x %d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003. Most of them start with non-null values at hex offset 0x34 or so.
#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
# SGI and Apple formats
0 string MOVI Silicon Graphics movie file
4 string moov Apple QuickTime movie file (moov)
4 string mdat Apple QuickTime movie file (mdat)

6
usr.bin/file/Magdir/apl
View File

@ -1,4 +1,6 @@
#
# magic.apl:
#------------------------------------------------------------------------------
# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
# workspaces)
#
0 long 0100554 APL workspace (Ken's original?)

6
usr.bin/file/Magdir/apple
View File

@ -1,5 +1,6 @@
#
# Apple II file formats
#------------------------------------------------------------------------------
# apple: file(1) magic for Apple II file formats
#
0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
0 string \x0aGL Binary II (apple ][) data
@ -7,4 +8,3 @@
0 string SIT! StuffIt (macintosh) text
0 string NuFile NuFile archive (apple ][) data
0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data

210
usr.bin/file/Magdir/archive
View File

@ -1,15 +1,215 @@
# A collection of various "ar" and "cpio" archive formats.
# "Tar" archives are handled in the C code.
#------------------------------------------------------------------------------
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.
# POSIX tar archives
257 string ustar\0 POSIX tar archive
257 string ustar\040\040\0 GNU tar archive
# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0 short 070707 cpio archive
0 string 070707 ASCII cpio archive
0 short 0143561 byte-swapped cpio archive
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
0 string 070702 ASCII cpio archive (SVR4 with CRC)
# other archives
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0177545 old archive
0 short 0177545 old PDP-11 archive
0 long 0100554 apl workspace
0 string =<ar> archive
# MIPS archive (needs to go first)
#
0 string !<arch>\n__________E MIPS archive
>20 string U with MIPS Ucode members
>21 string L with MIPSEL members
>21 string B with MIPSEB members
>19 string L and an EL hash table
>19 string B and an EB hash table
>22 string X -- out of date
0 string !<arch> archive
>8 string __.SYMDEF random library
0 string -h- Software Tools format archive text
# Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu.
20 long 0xdca7c4fd Rahul Dhesi's "zoo" archive
#
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0 string !<arch> current ar archive
# 0 long 0x213c6172 archive file
#
# and for SVR3.1 archives, we have:
#
# 0 string \<ar> System V Release 1 ar archive
# 0 string =<ar> archive
# 0 string =<ar> archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0 string !<arch> current ar archive
>8 string __.SYMDEF random library
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
>0 beshort 2 - object archive
>0 beshort 3 - shared library module
>0 beshort 4 - debug break-pointed module
>0 beshort 5 - absolute code program module
0 string \<ar> System V Release 1 ar archive
0 string =<ar> archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0 belong 0x65ff0000 VAX 3.0 archive
0 belong 0x3c61723e VAX 5.0 archive
#
0 long 0x213c6172 archive file
0 lelong 0177555 very old VAX archive
0 leshort 0177555 very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0 lelong 0177545 old VAX archive
>8 string __.SYMDEF random library
0 leshort 0177545 old PDP-11 archive
>8 string __.SYMDEF random library
#
0 string =<ar> archive
#
# From "pdp":
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
#
0 string -h- Software Tools format archive text
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated). Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR: the original entries collide with ARC, above; replaced with combined
# version (not tested)]
#0 byte 0x1a RISC OS archive
#>1 string archive (ArcFS format)
0 string \032archive RISC OS archive (ArcFS format)
# ARJ archiver (jason@jarthur.Claremont.EDU)
0 leshort 0xea60 ARJ archive data
>5 byte x \b, v%d,
>8 byte &0x04 multi-volume,
>8 byte &0x10 slash-switched,
>8 byte &0x20 backup,
>34 string x original name: %s,
>7 byte 0 os: MS-DOS
>7 byte 1 os: PRIMOS
>7 byte 2 os: Unix
>7 byte 3 os: Amiga
>7 byte 4 os: Macintosh
>7 byte 5 os: OS/2
>7 byte 6 os: Apple ][ GS
>7 byte 7 os: Atari ST
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0 string HA HA archive data,
#>2 leshort =1 1 file,
#>2 leshort >1 %u files,
#>4 byte&0x0f =0 first is type CPY
#>4 byte&0x0f =1 first is type ASC
#>4 byte&0x0f =2 first is type HSC
#>4 byte&0x0f =0x0e first is type DIR
#>4 byte&0x0f =0x0f first is type SPECIAL
# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0 string HPAK HPACK archive data
# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0 string \351,\001JAM\ JAM archive,
>7 string >\0 version %.4s
>0x26 byte =0x27 -
>>0x2b string >\0 label %.11s,
>>0x27 lelong x serial %08x,
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2 string -lh0- LHarc 1.x archive data [lh0]
2 string -lh1- LHarc 1.x archive data [lh1]
2 string -lz4- LHarc 1.x archive data [lz4]
2 string -lz5- LHarc 1.x archive data [lz5]
# [never seen any but the last; -lh4- reported in comp.compression:]
2 string -lzs- LHa 2.x? archive data [lzs]
2 string -lh - LHa 2.x? archive data [lh ]
2 string -lhd- LHa 2.x? archive data [lhd]
2 string -lh2- LHa 2.x? archive data [lh2]
2 string -lh3- LHa 2.x? archive data [lh3]
2 string -lh4- LHa (2.x) archive data [lh4]
2 string -lh5- LHa (2.x) archive data [lh5]
>20 byte x - header level %d
# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0 string Rar! RAR archive data
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0 string SQSH squished archive data (Acorn RISCOS)
# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0 string UC2\x1a UC2 archive data
# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0 string PK\003\004 Zip archive data
>4 byte 0x09 \b, at least v0.9 to extract
>4 byte 0x0a \b, at least v1.0 to extract
>4 byte 0x0b \b, at least v1.1 to extract
>4 byte 0x14 \b, at least v2.0 to extract
# Zoo archiver
20 lelong 0xfdc4a7dc Zoo archive data
>4 byte >48 \b, v%c.
>>6 byte >47 \b%c
>>>7 byte >47 \b%c
>32 byte >0 \b, modify: v%d
>>33 byte x \b.%d+
>42 lelong 0xfdc4a7dc \b,
>>70 byte >0 extract: v%d
>>>71 byte x \b.%d+
# Shell archives
10 string #\ This\ is\ a\ shell\ archive shell archive text

9
usr.bin/file/Magdir/att3b
View File

@ -1,5 +1,6 @@
#
# AT&T 3B machines
#------------------------------------------------------------------------------
# att3b: file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
@ -21,7 +22,7 @@
>12 belong >0 not stripped
>18 beshort ^00010000 N/A on 3b2/300 w/paging
>18 beshort &00020000 32100 required
>18 beshort &00040000 and mau hardware required
>18 beshort &00040000 and MAU hardware required
>20 beshort 0407 (impure)
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
@ -30,7 +31,7 @@
0 beshort 0561 WE32000 COFF executable (TV)
>12 belong >0 not stripped
#>18 beshort &00020000 - 32100 required
#>18 beshort &00040000 and mau hardware required
#>18 beshort &00040000 and MAU hardware required
#>22 beshort >0 - version %ld
#
# core file for 3b2

78
usr.bin/file/Magdir/audio
View File

@ -1,43 +1,73 @@
#------------------------------------------------------------------------------
# audio: file(1) magic for sound formats (see also "iff")
#
# Sound formats, from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#
# Sun/NeXT audio data
0 string .snd audio data:
>12 belong 1 8-bit u-law,
>12 belong 2 8-bit linear PCM,
0 string .snd Sun/NeXT audio data:
>12 belong 1 8-bit ISDN u-law,
>12 belong 2 8-bit linear PCM [REF-PCM],
>12 belong 3 16-bit linear PCM,
>12 belong 4 24-bit linear PCM,
>12 belong 5 32-bit linear PCM,
>12 belong 6 32-bit floating point,
>12 belong 7 64-bit floating point,
>12 belong 23 compressed (G.721 ADPCM),
>12 belong 6 32-bit IEEE floating point,
>12 belong 7 64-bit IEEE floating point,
>12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20 belong 1 mono,
>20 belong 2 stereo,
>20 belong 4 quad,
>16 belong x %d Hz
>16 belong >0 %d Hz
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
# (0x0064732E in little-endian encoding).
0 lelong 0x0064732E DEC audio data:
>12 lelong 1 8-bit u-law,
>12 lelong 2 8-bit linear PCM,
>12 lelong 1 8-bit ISDN u-law,
>12 lelong 2 8-bit linear PCM [REF-PCM],
>12 lelong 3 16-bit linear PCM,
>12 lelong 4 24-bit linear PCM,
>12 lelong 5 32-bit linear PCM,
>12 lelong 6 32-bit floating point,
>12 lelong 7 64-bit floating point,
>12 lelong 23 compressed (G.721 ADPCM),
>12 lelong 6 32-bit IEEE floating point,
>12 lelong 7 64-bit IEEE floating point,
>12 lelong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20 lelong 1 mono,
>20 lelong 2 stereo,
>20 lelong 4 quad,
>16 lelong x %d Hz
# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
8 string AIFF AIFF audio data
8 string AIFC AIFF-C audio data
8 string 8SVX IFF/8SVX audio data
# Bytes 0-3 of Waveform (*.wav) audio files are "RIFF"
8 string WAVE Waveform audio data
0 string Creative\ Voice\ File Soundblaster audio data
0 long 0x4e54524b MultiTrack sound data file
>4 long x - version %ld
>16 lelong >0 %d Hz
# Creative Labs AUDIO stuff
0 string MThd Standard MIDI data
>9 byte >0 (format %d)
>11 byte >1 using %d channels
0 string CTMF Creative Music (CMF) data
0 string SBI SoundBlaster instrument data
0 string Creative\ Voice\ File Creative Labs voice data
# is this next line right? it came this way...
>19 byte 0x1A
>23 byte >0 - version %d
>22 byte >0 \b.%d
# first entry is also the string "NTRK"
0 belong 0x4e54524b MultiTrack sound data
>4 belong x - version %ld
# Microsoft WAVE format (*.wav)
# [GRR 950115: probably all of the shorts and longs should be leshort/lelong]
0 string RIFF Microsoft RIFF
>8 string WAVE \b, WAVE audio data
>34 short >0 \b, %d bit
>22 short =1 \b, mono
>22 short =2 \b, stereo
>22 short >2 \b, %d channels
>24 long >0 %d Hz
# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0 string EMOD Extended MOD sound data,
>4 byte&0xf0 x version %d
>4 byte&0x0f x \b.%d,
>45 byte x %d instruments
>83 byte 0 (module)
>83 byte 1 (song)

5
usr.bin/file/Magdir/blit
View File

@ -1,4 +1,7 @@
# 68K Blit stuff as seen from 680x0 machine
#------------------------------------------------------------------------------
# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on

16
usr.bin/file/Magdir/c-lang
View File

@ -1,3 +1,13 @@
# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
0 string /* c program text
#------------------------------------------------------------------------------
# c-lang: file(1) magic for C programs (or REXX)
#
# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0 string /*\ XPM\ */ X pixmap image data
# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0 string /* C or REXX program text
0 string // C++ program text

5
usr.bin/file/Magdir/chi
View File

@ -1,4 +1,7 @@
# ChiWriter files
#------------------------------------------------------------------------------
# chi: file(1) magic for ChiWriter files
#
0 string \\1cw\ ChiWriter file
>5 string >\0 version %s
0 string \\1cw ChiWriter file

5
usr.bin/file/Magdir/clipper
View File

@ -1,5 +1,6 @@
#
# Intergraph, formerly Fairchild, Clipper.
#------------------------------------------------------------------------------
# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#

97
usr.bin/file/Magdir/commands
View File

@ -1,40 +1,75 @@
#
# "Commands": stuff for various shells and interpreters.
#------------------------------------------------------------------------------
# commands: file(1) magic for various shells and interpreters
#
0 string :\ shell archive or commands for antique kernel text
0 string #!/bin/sh Bourne Shell script text
0 string #!\ /bin/sh Bourne Shell script text
0 string #!/bin/csh C Shell script text
0 string #!\ /bin/csh C Shell script text
0 string #!/bin/sh Bourne shell script text
0 string #!\ /bin/sh Bourne shell script text
0 string #!/bin/csh C shell script text
0 string #!\ /bin/csh C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string #!/bin/ksh Korn Shell script text
0 string #!\ /bin/ksh Korn Shell script text
0 string #!/bin/tcsh Tenex C Shell script text
0 string #!\ /bin/tcsh Tenex C Shell script text
0 string #!/usr/local/tcsh Tenex C Shell script text
0 string #!\ /usr/local/tcsh Tenex C Shell script text
0 string #!/usr/local/bin/tcsh Tenex C Shell script text
0 string #!\ /usr/local/bin/tcsh Tenex C Shell script text
0 string #!/bin/awk Awk Commands text
0 string #!\ /bin/awk Awk Commands text
0 string #!/bin/ksh Korn shell script text
0 string #!\ /bin/ksh Korn shell script text
0 string #!/bin/tcsh Tenex C shell script text
0 string #!\ /bin/tcsh Tenex C shell script text
0 string #!/usr/local/tcsh Tenex C shell script text
0 string #!\ /usr/local/tcsh Tenex C shell script text
0 string #!/usr/local/bin/tcsh Tenex C shell script text
0 string #!\ /usr/local/bin/tcsh Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0 string #!/usr/local/bin/zsh Paul Falstad's zsh
0 string #!\ /usr/local/bin/zsh Paul Falstad's zsh
0 string #!/usr/local/bin/ash Neil Brown's ash
0 string #!\ /usr/local/bin/ash Neil Brown's ash
0 string #!/usr/local/bin/ae Neil Brown's ae
0 string #!\ /usr/local/bin/ae Neil Brown's ae
0 string #!/bin/nawk new awk script text
0 string #!\ /bin/nawk new awk script text
0 string #!/usr/bin/nawk new awk script text
0 string #!\ /usr/bin/nawk new awk script text
0 string #!/usr/local/bin/nawk new awk script text
0 string #!\ /usr/local/bin/nawk new awk script text
0 string #!/bin/gawk GNU awk script text
0 string #!\ /bin/gawk GNU awk script text
0 string #!/usr/bin/gawk GNU awk script text
0 string #!\ /usr/bin/gawk GNU awk script text
0 string #!/usr/local/bin/gawk GNU awk script text
0 string #!\ /usr/local/bin/gawk GNU awk script text
#
0 string #!/bin/awk awk commands text
0 string #!\ /bin/awk awk commands text
0 string #!/usr/bin/awk awk commands text
0 string #!\ /usr/bin/awk awk commands text
0 string BEGIN awk commands text
# For Larry Wall's perl language. The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
# Keith Waclena <keith@cerberus.uchicago.edu>
0 string #!/bin/perl perl commands text
0 string #!\ /bin/perl perl commands text
0 string eval\ "exec\ /bin/perl perl commands text
0 string #!/usr/bin/perl perl commands text
0 string #!\ /usr/bin/perl perl commands text
0 string eval\ "exec\ /usr/bin/perl perl commands text
0 string #!/usr/local/bin/perl perl commands text
0 string #!\ /usr/local/bin/perl perl commands text
0 string eval\ "exec\ /usr/local/bin/perl perl commands text
# AT&T Bell Labs' Plan 9 shell
0 string #!/bin/rc Plan 9 rc shell script text
0 string #!\ /bin/rc Plan 9 rc shell script text
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string #!/bin/bash Bourne-Again shell script text
0 string #!\ /bin/bash Bourne-Again shell script text
0 string #!/usr/local/bin/bash Bourne-Again shell script text
0 string #!\ /usr/local/bin/bash Bourne-Again shell script text
# generic shell magic
0 string #!\ / a
>3 string >\0 %s script text
0 string #!/ a
>2 string >\0 %s script text
0 string #!\ commands text
>3 string >\0 for %s
# For Larry Wall's perl language. The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
# Keith Waclena <keith@cerberus.uchicago.edu>
0 string #!/bin/perl perl commands text
0 string #!\ /bin/perl perl commands text
0 string eval\ "exec\ /bin/perl perl commands text
0 string #!/usr/bin/perl perl commands text
0 string #!\ /usr/bin/perl perl commands text
0 string eval\ "exec\ /usr/bin/perl perl commands text
0 string #!/usr/local/bin/perl perl commands text
0 string #!\ /usr/local/bin/perl perl commands text
0 string eval\ "exec\ /usr/local/bin/perl perl commands text
0 string #!/bin/rc Plan 9 rc Shell script text
0 string #!\ /bin/rc Plan 9 rc Shell script text

80
usr.bin/file/Magdir/compress
View File

@ -1,25 +1,60 @@
#------------------------------------------------------------------------------
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.
# According to gzip.h, this is the correct byte order for packed data.
#
0 string \037\036 packed data
# standard unix compress
0 string \037\235 compress'd data
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
0 string \037\213 gzip compressed data
>2 byte <8 \b, reserved method,
>2 byte 8 \b, deflated,
>3 byte &0x01 ASCII,
>3 byte &0x02 continuation,
>3 byte &0x04 extra field,
>3 byte &0x08 original filename,
>3 byte &0x10 comment,
>3 byte &0x20 encrypted,
>4 ledate x last modified: %s,
>8 byte 2 max compression,
>8 byte 4 max speed,
>9 byte =0x00 os: MS-DOS
>9 byte =0x01 os: Amiga
>9 byte =0x02 os: VMS
>9 byte =0x03 os: Unix
>9 byte =0x05 os: Atari
>9 byte =0x06 os: OS/2
>9 byte =0x07 os: MacOS
>9 byte =0x0A os: Tops/20
>9 byte =0x0B os: Win/32
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0 string \037\036 packed data
>2 belong >1 \b, %d characters originally
>2 belong =1 \b, %d character originally
#
# This magic number is byte-order-independent.
#
# This magic number is byte-order-independent. XXX - Does that mean this
# is big-endian, little-endian, either, or that you can't tell?
# this short is valid for SunOS
0 short 017437 old packed data
#
# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0 short 0x1fff compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0 string \377\037 compacted data
0 short 0145405 huf output
#
# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats. Note that I can only uncrunch, not crunch, and
@ -27,14 +62,25 @@
# Keith Waclena <keith@cerberus.uchicago.edu>
0 leshort 0x76FF squeezed data (CP/M, DOS)
0 leshort 0x76FE crunched data (CP/M, DOS)
# Freeze
0 string \037\237 Frozen file 2.1
0 string \037\236 Frozen file 1.0 (or gzip 0.5)
#
# Standard unix compress
#
0 string \037\235 compressed data
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
0 string \037\240 LZH compressed data
# Freeze
0 string \037\237 frozen file 2.1
0 string \037\236 frozen file 1.0 (or gzip 0.5)
# SCO compress -H (LZH)
0 string \037\240 SCO compress -H (LZH) data
# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes. This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0 byte&0xF0 0xd0 data
#>33 byte&0xF0 0xd0
#>66 byte&0xF0 0xd0
#>99 byte&0xF0 0xd0
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio

5
usr.bin/file/Magdir/convex
View File

@ -1,4 +1,7 @@
#------------------------------------------------------------------------------
# convex: file(1) magic for Convex boxes
#
# XXX - what byte order does a Convex use?
# Convexes are big-endian.
#
0 long 0513 Convex executable

36
usr.bin/file/Magdir/database Normal file
View File

@ -0,0 +1,36 @@
#------------------------------------------------------------------------------
# database: file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
# Will be maintained as part of the GDBM distribution in the future.
# <downsj@teeny.org>
0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
0 string GDBM GNU dbm 2.x database
#
0 belong 0x061561 Berkeley DB Hash file
>4 belong >0 (Version %d,
>8 belong 1234 Little Endian,
>8 belong 4321 Big Endian,
>12 belong x Bucket Size %d,
>16 belong x Directory Size %d,
>20 belong x Segment Size %d,
>24 belong x Segment Shift %d,
>28 belong x Overflow Point %d,
>32 belong x Last Freed %d,
>36 belong x Max Bucket %d,
>40 belong x High Mask 0x%x,
>44 belong x Low Mask 0x%x,
>48 belong x Fill Factor %d,
>52 belong x Number of Keys %d)
#
0 belong 0x053162 Berkeley DB Btree file
>4 belong >0 (Version %d,
>8 belong x Page Size %d,
>12 belong x Free Page %d,
>16 belong x Number of Records %d,
>20 belong x Flags 0x%x)

3
usr.bin/file/Magdir/diamond
View File

@ -1,3 +1,6 @@
#------------------------------------------------------------------------------
# diamond: file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#

4
usr.bin/file/Magdir/diff
View File

@ -1,5 +1,7 @@
#------------------------------------------------------------------------------
# diff: file(1) magic for diff(1) output
#
# magic file lines for output from "diff"...
0 string diff\ 'diff' output text
0 string ***\ 'diff' output text
0 string Only\ in\ 'diff' output text

5
usr.bin/file/Magdir/dump
View File

@ -1,5 +1,6 @@
#
# magic.dump, dump file format. For new and old dump filesystems
#------------------------------------------------------------------------------
# dump: file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#

76
usr.bin/file/Magdir/elf
View File

@ -1,44 +1,56 @@
#------------------------------------------------------------------------------
# elf: file(1) magic for ELF executables
#
# ELF
# Missing MIPS image type and flags
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# Question marks on processor types flag "should not happen because the
# byte order is wrong". We have to check the byte order flag to see what
# byte order all the other stuff in the header is in.
# Byte order is probably big-endian for MIPS RS3000 and Amdahl.
# MIPS RS3000 may also be for MIPS RS2000.
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0 string \177ELF ELF
>4 byte 0 invalid class
>4 byte 1 32-bit
>4 byte 2 64-bit
>5 byte 0 invalid byte order
>5 byte 1 LSB
>>16 leshort 0 unknown type
>>16 leshort 1 relocatable
>>16 leshort 2 executable
>>16 leshort 3 dynamic lib
>>16 leshort 4 core file
>>18 leshort 0 unknown machine
>>18 leshort 1 WE32100 and up
>>18 leshort 2 SPARC?
>>18 leshort 3 i386 (386 and up)
>>18 leshort 4 M68000?
>>18 leshort 5 M88000?
>>18 leshort 7 i860
>>20 lelong 1 Version 1
>>16 leshort 0 no file type,
>>16 leshort 1 relocatable,
>>16 leshort 2 executable,
>>16 leshort 3 shared object,
>>16 leshort 4 core file,
>>16 leshort &0xff00 processor-specific,
>>18 leshort 0 no machine,
>>18 leshort 1 AT&T WE32100 - invalid byte order,
>>18 leshort 2 SPARC - invalid byte order,
>>18 leshort 3 Intel 80386,
>>18 leshort 4 Motorola 68000 - invalid byte order,
>>18 leshort 5 Motorola 88000 - invalid byte order,
>>18 leshort 6 Intel 80486,
>>18 leshort 7 Intel 80860,
>>18 leshort 8 MIPS RS3000,
>>18 leshort 9 Amdahl,
>>20 lelong 0 invalid version
>>20 lelong 1 version 1
>>36 lelong 1 MathCoPro/FPU/MAU Required
>5 byte 2 MSB
>>16 beshort 0 unknown type
>>16 beshort 1 relocatable
>>16 beshort 2 executable
>>16 beshort 3 dynamic lib
>>16 beshort 4 core file
>>18 beshort 0 unknown machine
>>18 beshort 1 WE32100 and up
>>18 beshort 2 SPARC
>>18 beshort 3 i386 (386 and up)?
>>18 beshort 4 M68000
>>18 beshort 5 M88000
>>18 beshort 7 i860
>>20 belong 1 Version 1
>>16 beshort 0 no file type,
>>16 beshort 1 relocatable,
>>16 beshort 2 executable,
>>16 beshort 3 shared object,
>>16 beshort 4 core file,
>>16 beshort &0xff00 processor-specific,
>>18 beshort 0 no machine,
>>18 beshort 1 AT&T WE32100,
>>18 beshort 2 SPARC,
>>18 beshort 3 Intel 80386 - invalid byte order,
>>18 beshort 4 Motorola 68000,
>>18 beshort 5 Motorola 88000,
>>18 beshort 6 Intel 80486 - invalid byte order,
>>18 beshort 7 Intel 80860,
>>18 beshort 8 MIPS RS3000,
>>18 leshort 9 Amdahl,
>>20 belong 0 invalid version
>>20 belong 1 version 1
>>36 belong 1 MathCoPro/FPU/MAU Required

5
usr.bin/file/Magdir/encore
View File

@ -1,5 +1,6 @@
#
# magic.encore: Recognize encore machines
#------------------------------------------------------------------------------
# encore: file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).

6
usr.bin/file/Magdir/filesystems Normal file
View File

@ -0,0 +1,6 @@
#------------------------------------------------------------------------------
# filesystems: file(1) magic for different filesystems
#
0x438 leshort 0xEF53 Linux/i386 ext2 filesystem
0 string \366\366\366\366 PC formatted floppy with no filesystem

29
usr.bin/file/Magdir/fonts
View File

@ -1,3 +1,26 @@
0 string FONT ASCII vfont text
0 short 0436 Berkeley vfont data
0 short 017001 byte-swapped Berkeley vfont data
#------------------------------------------------------------------------------
# fonts: file(1) magic for font data
#
0 string FONT ASCII vfont text
0 short 0436 Berkeley vfont data
0 short 017001 byte-swapped Berkeley vfont data
# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data
# X11 font files in SNF (Server Natural Format) format
0 belong 00000004 X11 SNF font data, MSB first
0 lelong 00000004 X11 SNF font data, LSB first
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string STARTFONT\040 X11 BDF font text
# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0 string \001fcp X11 Portable Compiled Font data
>12 byte 0x02 \b, LSB first
>12 byte 0x0a \b, MSB first
0 string D1.0\015 X11 Speedo font data

22
usr.bin/file/Magdir/frame
View File

@ -1,28 +1,36 @@
#------------------------------------------------------------------------------
# frame: file(1) magic for FrameMaker files
#
# Magic number for FrameMaker files
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0 string \<MakerFile FrameMaker document
>11 string 4.0 (4.0
>11 string 3.0 (3.0
>11 string 2.0 (2.0
>11 string 1.0 (1.0
>14 byte x %c)
0 string \<MIFFile FrameMaker MIF file
0 string \<MIFFile FrameMaker MIF (ASCII) file
>9 string 4.0 (4.0)
>9 string 3.0 (3.0)
>9 string 2.0 (2.0)
>9 string 1.0 (1.x)
0 string \<MakerDictionary FraneMaker Dictionary text
0 string \<MakerDictionary FrameMaker Dictionary text
>17 string 3.0 (3.0)
>17 string 2.0 (2.0)
>17 string 1.0 (1.x)
0 string \<MakerScreenFon FrameMaker Font file
0 string \<MakerScreenFont FrameMaker Font file
>17 string 1.01 (%s)
0 string \<MML FrameMaker MML file
0 string \<Book FrameMaker Book file
0 string \<BookFile FrameMaker Book file
>10 string 3.0 (3.0
>10 string 2.0 (2.0
>10 string 1.0 (1.0
>13 byte x %c)
0 string \<Maker Intermediate Print File FrameMaker IPL file
0 string \<MakerDictionary FraneMaker Dictionary text
# XXX - this book entry should be verified, if you find one, uncomment this
#0 string \<Book\ FrameMaker Book (ASCII) file
#>6 string 3.0 (3.0)
#>6 string 2.0 (2.0)
#>6 string 1.0 (1.0)
0 string \<Maker Intermediate Print File FrameMaker IPL file

85
usr.bin/file/Magdir/hp
View File

@ -1,5 +1,6 @@
#
# magic.hp: Hewlett Packard Magic
#------------------------------------------------------------------------------
# hp: file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
@ -15,18 +16,26 @@
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# I'm guessing that the 200 series was 68K-based; the 300 and 400 series
# are.
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k. The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# 0 beshort 200 hp200 (68010) BSD binary
# 0 beshort 300 hp300 (68020+68881) BSD binary
# 0 beshort 0x20c hp200/300 HP-UX binary
# 0 beshort 0x20b hp800 HP-UX binary
#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0 beshort 0627 Apollo m68k COFF executable
>18 beshort ^040000 not stripped
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 beshort 0624 apollo a88k COFF executable
>18 beshort ^040000 not stripped
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 long 01203604016 TML 0123 byte-order format
0 long 01702407010 TML 1032 byte-order format
@ -36,101 +45,101 @@
0 belong 0x02100106 HPPA-RISC1.1 relocatable object
0 belong 0x02100107 HPPA-RISC1.1 executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x02100108 HPPA-RISC1.1 shared executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x0210010b HPPA-RISC1.1 demand-load executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x0210010e HPPA-RISC1.1 shared library
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x0210010d HPPA-RISC1.1 dynamic load library
>96 belong >0 -not stripped
>96 belong >0 - not stripped
#### 800
0 belong 0x020b0106 HP s800 relocatable object
0 belong 0x020b0107 HP s800 executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x020b0108 HP s800 shared executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x020b010b HP s800 demand-load executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x020b010e HP s800 shared library
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x020b010d HP s800 dynamic load library
>96 belong >0 -not stripped
>96 belong >0 - not stripped
0 belong 0x213c6172 archive file
>68 belong 0x020b0619 -HP s800 relocatable library
>68 belong 0x020b0619 - HP s800 relocatable library
#### 500
0 long 0x02080106 HP s500 relocatable executable
>16 long >0 -version %ld
>16 long >0 - version %ld
0 long 0x02080107 HP s500 executable
>16 long >0 -version %ld
>16 long >0 - version %ld
0 long 0x02080108 HP s500 pure executable
>16 long >0 -version %ld
>16 long >0 - version %ld
#### 200
0 belong 0x020c0108 HP s200 pure executable
>4 beshort >0 -version %ld
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0107 HP s200 executable
>4 beshort >0 -version %ld
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c010b HP s200 demand-load executable
>4 beshort >0 -version %ld
>4 beshort >0 - version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0106 HP s200 relocatable executable
>4 beshort >0 -version %ld
>6 beshort >0 -highwater %d
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>8 belong &0x80000000 save fp regs
>8 belong &0x20000000 debuggable
>8 belong &0x10000000 PIC
0 belong 0x020a0108 HP s200 (2.x release) pure executable
>4 beshort >0 -version %ld
>4 beshort >0 - version %ld
>36 belong >0 not stripped
0 belong 0x020a0107 HP s200 (2.x release) executable
>4 beshort >0 -version %ld
>4 beshort >0 - version %ld
>36 belong >0 not stripped
0 belong 0x020c010e HP s200 shared library
>4 beshort >0 -version %ld
>6 beshort >0 -highwater %d
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
0 belong 0x020c010d HP s200 dynamic load library
>4 beshort >0 -version %ld
>6 beshort >0 -highwater %d
>4 beshort >0 - version %ld
>6 beshort >0 - highwater %d
>36 belong >0 not stripped
#### MISC
@ -142,10 +151,11 @@
0 long 0x015821a6 HP core file
0 long 0x4da7eee8 HP-WINDOWS font
>8 byte >0 -version %ld
>8 byte >0 - version %ld
0 string Bitmapfile HP Bitmapfile
0 string IMGfile CIS compimg HP Bitmapfile
# XXX - see "lif"
0 short 0x8000 lif file
0 long 0x020c010c compiled Lisp
@ -189,3 +199,14 @@
>10 string A(G) A(G)
>14 string F(.) F(.);
>14 string F(,) F(,);
# hpBSD magic numbers
0 beshort 200 hp200 (68010) BSD
>2 beshort 0407 impure binary
>2 beshort 0410 read-only binary
>2 beshort 0413 demand paged binary
0 beshort 300 hp300 (68020+68881) BSD
>2 beshort 0407 impure binary
>2 beshort 0410 read-only binary
>2 beshort 0413 demand paged binary

6
usr.bin/file/Magdir/ibm370
View File

@ -1,5 +1,6 @@
#
# IBM 370 and compatibles.
#------------------------------------------------------------------------------
# ibm370: file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
@ -16,4 +17,3 @@
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %ld

7
usr.bin/file/Magdir/ibm6000
View File

@ -1,7 +1,6 @@
#
# magic.rs6000:
#
# RS/6000 and the RT PC.
#------------------------------------------------------------------------------
# ibm6000: file(1) magic for RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
>12 belong >0 not stripped

33
usr.bin/file/Magdir/iff
View File

@ -1,5 +1,28 @@
# image file format
# From Robert Potter, potter@cs.rochester.edu
0 string Imagefile\ version- iff image data
# this adds the whole header (inc. version number), informative but longish
>10 string >\0 %s
#------------------------------------------------------------------------------
# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange. It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.
0 string FORM IFF data
#>4 belong x \b, FORM is %d bytes long
# audio formats
>8 string AIFF \b, AIFF audio
>8 string AIFC \b, AIFF-C compressed audio
>8 string 8SVX \b, 8SVX 8-bit sampled sound voice
>8 string SAMP \b, SAMP sampled audio
# image formats
>8 string ILBMBMHD \b, ILBM interleaved image
>>20 beshort x \b, %d x
>>22 beshort x %d
>8 string RGBN \b, RGBN 12-bit RGB image
>8 string RGB8 \b, RGB8 24-bit RGB image
>8 string DR2D \b, DR2D 2-D object
>8 string TDDD \b, TDDD 3-D rendering
# other formats
>8 string FTXT \b, FTXT formatted text

249
usr.bin/file/Magdir/images
View File

@ -1,36 +1,58 @@
# image formats, originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
#------------------------------------------------------------------------------
# images: file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# XXX - byte order for GIF and TIFF fields?
# little magic: PCX (first byte is 0x0a)
# no magic: Targa
# PBMPLUS images
# The next byte following the magic is always whitespace.
0 string P1 PBM image text
0 string P2 PGM image text
0 string P3 PPM image text
0 string P4 PBM "rawbits" image data
0 string P5 PGM "rawbits" image data
0 string P6 PPM "rawbits" image data
# NIFF (Navy Interchange File Format, a modification of TIFF) images
0 string IIN1 NIFF image data
# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed. The TIFF specification recommends testing for it.
0 string MM\x00\x2a TIFF image data, big-endian
0 string II\x2a\x00 TIFF image data, little-endian
# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
#
0 string xbtoa btoa'd file
# PBMPLUS
0 string P1 PBM file
0 string P2 PGM file
0 string P3 PPM file
0 string P4 PBM "rawbits" file
0 string P5 PGM "rawbits" file
0 string P6 PPM "rawbits" file
# TIFF and friends
0 string \115\115 TIFF file, big-endian
>2 short >0 version %d
0 string \111\111 TIFF file, little-endian
>2 short >0 version %d
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
# NIFF (Navy Interchange File Format, a modification of TIFF)
0 string IIN1 NIFF raster data
0 string \x89PNG PNG image data,
>4 belong !0x0d0a1a0a CORRUPTED,
>16 belong x %ld x
>20 belong x %ld,
>24 byte x %d-bit
>25 byte 0 grayscale,
>25 byte 2 \b/color RGB,
>25 byte 3 colormap,
>25 byte 4 gray+alpha,
>25 byte 6 \b/color RGBA,
#>26 byte 0 deflate/32K,
>28 byte 0 non-interlaced
>28 byte 1 interlaced
# GIF
0 string GIF GIF picture
>3 string 87a - version %s
>3 string 89a - version %s
0 string GIF8 GIF image data
>4 string 7a \b, version 8%s,
>4 string 9a \b, version 8%s,
>6 leshort >0 %hd x
>8 leshort >0 %hd,
>10 byte &0x40 interlaced,
#>10 byte &0x80 color mapped,
>10 byte&0x07 =0x00 2 colors
>10 byte&0x07 =0x01 4 colors
>10 byte&0x07 =0x02 8 colors
@ -40,30 +62,163 @@
>10 byte&0x07 =0x06 128 colors
>10 byte&0x07 =0x07 256 colors
# Miscellany
0 long 1123028772 Artisan image file
>4 long 1 rectangular 24-bit image
>4 long 2 rectangular 8-bit image with colormap
>4 long 3 rectangular 32-bit image (24-bit with matte)
0 string \361\0\100\273 CMU window manager bitmap
0 string #FIG FIG graphics savefile text
>6 string 2.1 Version 2.1
>6 string 2.0 Version 2.0
# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0 string \361\0\100\273 CMU window manager raster image data
>4 lelong >0 %d x
>8 lelong >0 %d,
>12 lelong >0 %d-bit
# Magick Image File Format
0 string id=ImageMagick MIFF image data
# Artisan
0 long 1123028772 Artisan image data
>4 long 1 \b, rectangular 24-bit
>4 long 2 \b, rectangular 8-bit with colormap
>4 long 3 \b, rectangular 32-bit (24-bit with matte)
# FIG (Facility for Interactive Generation of figures), an object-based format
0 string #FIG FIG image text
>5 string x \b, version %.3s
# PHIGS
0 string ARF_BEGARF PHIGS clear text archive
0 string @(#)SunPHIGS SunPHIGS
# version number follows, in the form m.n
>40 string SunBin binary
>32 string archive archive
# GKS (Graphics Kernel System)
0 string GKSM GKS Metafile
8 string ILBM IFF ILBM file
6 string JFIF JPEG picture
0 string ARF_BEGARF PHIGS clear text archive
>24 string SunGKS \b, SunGKS
# From: <u31b3hs@pool.informatik.rwth-aachen.de> (Michael Haardt)
0 string yz MGR bitmap, modern format, 8 bit aligned
0 string zz MGR bitmap, old format, 1 bit deep, 16 bit aligned
0 string xz MGR bitmap, old format, 1 bit deep, 32 bit aligned
0 string yx MGR bitmap, modern format, squeezed
# CGM image files
0 string BEGMF clear text Computer Graphics Metafile
# XXX - questionable magic
0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
0 beshort 0x3020 character Computer Graphics Metafile
0 string %bitmap FBM pixmap
>30 long 0x31 (mono)
>30 long 0x33 (color)
# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0 string yz MGR bitmap, modern format, 8-bit aligned
0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
0 string yx MGR bitmap, modern format, squeezed
4 string Research, Digifax-G3-File
>29 byte 1 , fine resolution
>29 byte 0 , normal resolution
# Fuzzy Bitmap (FBM) images
0 string %bitmap\0 FBM image data
>30 long 0x31 \b, mono
>30 long 0x33 \b, color
# facsimile data
1 string PC\ Research,\ Inc group 3 fax data
>29 byte 0 \b, normal resolution (204x98 DPI)
>29 byte 1 \b, fine resolution (204x196 DPI)
# JPEG images
0 beshort 0xffd8 JPEG image data
>6 string JFIF \b, JFIF standard
# HSI is Handmade Software's proprietary JPEG encoding scheme
0 string hsi1 JPEG image data, HSI proprietary
# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)
0 string BM PC bitmap data
>14 leshort 12 \b, OS/2 1.x format
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 64 \b, OS/2 2.x format
>>18 leshort x \b, %d x
>>20 leshort x %d
>14 leshort 40 \b, Windows 3.x format
>>18 lelong x \b, %d x
>>22 lelong x %d x
>>28 leshort x %d
0 string IC PC icon data
0 string PI PC pointer image data
0 string CI PC color icon data
0 string CP PC color pointer image data
# Conflicts with other entries [BABYL]
#0 string BA PC bitmap array data
# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0 string /*\ XPM\ */ X pixmap image text
# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0 leshort 0xcc52 RLE image data,
>6 leshort x %d x
>8 leshort x %d
>2 leshort >0 \b, lower left corner: %d
>4 leshort >0 \b, lower right corner: %d
>10 byte&0x1 =0x1 \b, clear first
>10 byte&0x2 =0x2 \b, no background
>10 byte&0x4 =0x4 \b, alpha channel
>10 byte&0x8 =0x8 \b, comment
>11 byte >0 \b, %d color channels
>12 byte >0 \b, %d bits per pixel
>13 byte >0 \b, %d color map channels
# image file format (Robert Potter, potter@cs.rochester.edu)
0 string Imagefile\ version- iff image data
# this adds the whole header (inc. version number), informative but longish
>10 string >\0 %s
# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0 belong 0x59a66a95 Sun raster image data
>4 belong >0 \b, %d x
>8 belong >0 %d,
>12 belong >0 %d-bit,
#>16 belong >0 %d bytes long,
>20 belong 0 old format,
#>20 belong 1 standard,
>20 belong 2 compressed,
>20 belong 3 RGB,
>20 belong 4 TIFF,
>20 belong 5 IFF,
>20 belong 0xffff reserved for testing,
>24 belong 0 no colormap
>24 belong 1 RGB colormap
>24 belong 2 raw colormap
#>28 belong >0 colormap is %d bytes long
# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
# file://sgi.com/graphics/SGIIMAGESPEC
0 beshort 474 SGI image data
#>2 byte 0 \b, verbatim
>2 byte 1 \b, RLE
#>3 byte 1 \b, normal precision
>3 byte 2 \b, high precision
>4 beshort x \b, %d-D
>6 beshort x \b, %d x
>8 beshort x %d
>10 beshort x \b, %d channel
>10 beshort !1 \bs
>80 string >0 \b, "%s"
0 string IT01 FIT image data
>4 belong x \b, %d x
>8 belong x %d x
>12 belong x %d
#
0 string IT02 FIT image data
>4 belong x \b, %d x
>8 belong x %d x
>12 belong x %d
#
2048 string PCD_IPI Kodak Photo CD image pack file
0 string PCD_OPA Kodak Photo CD overview pack file
# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0 string SIMPLE\ \ = FITS image data
>109 string 8 \b, 8-bit, character or unsigned binary integer
>108 string 16 \b, 16-bit, two's complement binary integer
>107 string \ 32 \b, 32-bit, two's complement binary integer
>107 string -32 \b, 32-bit, floating point, single precision
>107 string -64 \b, 64-bit, floating point, double precision
# other images
0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
0 string !! Bennet Yee's "face" format

6
usr.bin/file/Magdir/intel
View File

@ -1,6 +1,9 @@
#------------------------------------------------------------------------------
# intel: file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft"). DOS is in "ms-dos"; the ambitious soul can do
# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
@ -26,6 +29,7 @@
0 leshort =0522 iAPX 286 executable large model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0 leshort =0514 80386 COFF executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld

9
usr.bin/file/Magdir/interleaf
View File

@ -1,7 +1,8 @@
#------------------------------------------------------------------------------
# interleaf: file(1) magic for InterLeaf TPS:
#
# magic for InterLeaf TPS:
0 string =\210OPS Interleaf saved data
0 string =<!OPS Interleaf document text
>5 string ,\ Version\ (version
>>14 string >\0 %s)
>5 string ,\ Version\ = \b, version
>>17 string >\0 %.3s

71
usr.bin/file/Magdir/ispell
View File

@ -1,23 +1,54 @@
#------------------------------------------------------------------------------
# ispell: file(1) magic for ispell
#
# magic.ispell
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# XXX - byte order?
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0 short 0xffff9601 ispell hash file
>2 short 0x00 - 8-bit, no capitalization, 26 flags
>2 short 0x01 - 7-bit, no capitalization, 26 flags
>2 short 0x02 - 8-bit, capitalization, 26 flags
>2 short 0x03 - 7-bit, capitalization, 26 flags
>2 short 0x04 - 8-bit, no capitalization, 52 flags
>2 short 0x05 - 7-bit, no capitalization, 52 flags
>2 short 0x06 - 8-bit, capitalization, 52 flags
>2 short 0x07 - 7-bit, capitalization, 52 flags
>2 short 0x08 - 8-bit, no capitalization, 128 flags
>2 short 0x09 - 7-bit, no capitalization, 128 flags
>2 short 0x0A - 8-bit, capitalization, 128 flags
>2 short 0x0B - 7-bit, capitalization, 128 flags
>2 short 0x0C - 8-bit, no capitalization, 256 flags
>2 short 0x0D - 7-bit, no capitalization, 256 flags
>2 short 0x0E - 8-bit, capitalization, 256 flags
>2 short 0x0F - 7-bit, capitalization, 256 flags
>4 short >0 and %d string characters
0 leshort&0xFFFC 0x9600 little endian ispell
>0 byte 0 hash file (?),
>0 byte 1 3.0 hash file,
>0 byte 2 3.1 hash file,
>0 byte 3 hash file (?),
>2 leshort 0x00 8-bit, no capitalization, 26 flags
>2 leshort 0x01 7-bit, no capitalization, 26 flags
>2 leshort 0x02 8-bit, capitalization, 26 flags
>2 leshort 0x03 7-bit, capitalization, 26 flags
>2 leshort 0x04 8-bit, no capitalization, 52 flags
>2 leshort 0x05 7-bit, no capitalization, 52 flags
>2 leshort 0x06 8-bit, capitalization, 52 flags
>2 leshort 0x07 7-bit, capitalization, 52 flags
>2 leshort 0x08 8-bit, no capitalization, 128 flags
>2 leshort 0x09 7-bit, no capitalization, 128 flags
>2 leshort 0x0A 8-bit, capitalization, 128 flags
>2 leshort 0x0B 7-bit, capitalization, 128 flags
>2 leshort 0x0C 8-bit, no capitalization, 256 flags
>2 leshort 0x0D 7-bit, no capitalization, 256 flags
>2 leshort 0x0E 8-bit, capitalization, 256 flags
>2 leshort 0x0F 7-bit, capitalization, 256 flags
>4 leshort >0 and %d string characters
0 beshort&0xFFFC 0x9600 big endian ispell
>1 byte 0 hash file (?),
>1 byte 1 3.0 hash file,
>1 byte 2 3.1 hash file,
>1 byte 3 hash file (?),
>2 beshort 0x00 8-bit, no capitalization, 26 flags
>2 beshort 0x01 7-bit, no capitalization, 26 flags
>2 beshort 0x02 8-bit, capitalization, 26 flags
>2 beshort 0x03 7-bit, capitalization, 26 flags
>2 beshort 0x04 8-bit, no capitalization, 52 flags
>2 beshort 0x05 7-bit, no capitalization, 52 flags
>2 beshort 0x06 8-bit, capitalization, 52 flags
>2 beshort 0x07 7-bit, capitalization, 52 flags
>2 beshort 0x08 8-bit, no capitalization, 128 flags
>2 beshort 0x09 7-bit, no capitalization, 128 flags
>2 beshort 0x0A 8-bit, capitalization, 128 flags
>2 beshort 0x0B 7-bit, capitalization, 128 flags
>2 beshort 0x0C 8-bit, no capitalization, 256 flags
>2 beshort 0x0D 7-bit, no capitalization, 256 flags
>2 beshort 0x0E 8-bit, capitalization, 256 flags
>2 beshort 0x0F 7-bit, capitalization, 256 flags
>4 beshort >0 and %d string characters

8
usr.bin/file/Magdir/karma Normal file
View File

@ -0,0 +1,8 @@
#------------------------------------------------------------------------------
# karma: file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>
0 string KarmaRHD Version Karma Data Structure Version
>16 long x %lu

10
usr.bin/file/Magdir/lex
View File

@ -1,3 +1,11 @@
#------------------------------------------------------------------------------
# lex: file(1) magic for lex
#
# derived empirically, your offsets may vary!
53 string yyprevious c program text (from lex)
53 string yyprevious C program text (from lex)
>3 string >\0 for %s
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21 string generated\ by\ flex C program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0 string %{ lex description text

7
usr.bin/file/Magdir/lif
View File

@ -1,6 +1,7 @@
#------------------------------------------------------------------------------
# lif: file(1) magic for lif
#
# magic.lif:
#
# XXX - byte order?
# XXX - byte order? (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
#
0 short 0x8000 lif file

66
usr.bin/file/Magdir/linux
View File

@ -1,11 +1,55 @@
# Values for Linux/i386 binaries, From: Rik Faith <faith@cs.unc.edu>
2 leshort 100 Linux/i386
>0 leshort 0407 executable or impure executable (OMAGIC)
>0 leshort 0410 pure executable (NMAGIC)
>0 leshort 0413 demand-paged executable (ZMAGIC)
>0 leshort 0314 demand-paged executable (QMAGIC)
>16 lelong >0 not stripped
>0 string Jump jump
# core dump file
216 lelong 0421 core file (Linux)
>220 string >\0 core file (Linux) of %s
#------------------------------------------------------------------------------
# linux: file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2 leshort 100 Linux/i386
# >0 leshort 0407 impure executable (OMAGIC)
# >0 leshort 0410 pure executable (NMAGIC)
# >0 leshort 0413 demand-paged executable (ZMAGIC)
# >0 leshort 0314 demand-paged executable (QMAGIC)
#
0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
>16 lelong 0 \b, stripped
0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
>16 lelong 0 \b, stripped
0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
>16 lelong 0 \b, stripped
0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
>16 lelong 0 \b, stripped
#
0 string \007\001\000 Linux/i386 object file
>20 lelong >0x1020 \b, DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0 string *nazgul* compiled message catalog
>8 lelong >0 \b, version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216 lelong 0421 Linux/i386 core file
>220 string >\0 of '%s'
>200 lelong >0 (signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2 string LILO Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0 string 0.9
>8 byte 0x0a Debian Binary Package
>>3 byte >0 \b, created by dpkg 0.9%c
>>4 byte >0 pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0 leshort 0x0436 Linux/i386 PC Screen Font data,
>2 byte 0 256 characters, no directory,
>2 byte 1 512 characters, no directory,
>2 byte 2 256 characters, Unicode directory,
>2 byte 3 512 characters, Unicode directory,
>3 byte >0 8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086 string SWAP-SPACE Linux/i386 swap file
# From: Erik Troan <ewt@redhat.com>
0 leshort 0x00070183 ECOFF (Linux/OSF) Alpha binary
>10 leshort 0x0001 not stripped
>10 leshort 0x0000 stripped

10
usr.bin/file/Magdir/lisp Normal file
View File

@ -0,0 +1,10 @@
#------------------------------------------------------------------------------
# lisp: file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string ;; Lisp/Scheme program text
# Emacs 18 - this is always correct, but not very magical.
0 string \012( byte-compiled Emacs-Lisp program data
# Emacs 19
0 string ;ELC\023\000\000\000 byte-compiled Emacs-Lisp program data

4
usr.bin/file/Magdir/magic
View File

@ -1 +1,5 @@
#------------------------------------------------------------------------------
# magic: file(1) magic for magic files
#
0 string #\ Magic magic text file for file(1) cmd

5
usr.bin/file/Magdir/mail.news
View File

@ -1,3 +1,7 @@
#------------------------------------------------------------------------------
# mail.news: file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0 string From mail text
# There are tests to ascmagic.c to cope with mail and news.
@ -11,3 +15,4 @@
0 string Xref: news text
0 string From: news or mail text
0 string Article saved news text
0 string BABYL Emacs RMAIL text

10
usr.bin/file/Magdir/microsoft
View File

@ -1,5 +1,6 @@
#
# Microsoft (Xenix, not DOS)
#------------------------------------------------------------------------------
# microsoft: file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
@ -7,7 +8,7 @@
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives....
# XXX - "x.out" collides with PDP-11 archives
#
0 string core core file (Xenix)
0 byte 0x80 8086 relocatable (Microsoft)
@ -26,7 +27,10 @@
>0x1c byte &0x40 word-swapped
>0x10 lelong >0 not-stripped
>0x1e leshort ^0xc000 pre-SysV
>0x1e leshort &0x4000 V2.3
>0x1e leshort &0x8000 V3.0
>0x1c byte &0x4 86
>0x1c byte &0xb 186
>0x1c byte &0x9 286
>0x1c byte &0xa 386
>0x1f byte <0x040 small model

3
usr.bin/file/Magdir/mirage
View File

@ -1,3 +1,6 @@
#------------------------------------------------------------------------------
# mirage: file(1) magic for Mirage executables
#
# XXX - byte order?
#

3
usr.bin/file/Magdir/mkid
View File

@ -1,3 +1,6 @@
#------------------------------------------------------------------------------
# mkid: file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#

4
usr.bin/file/Magdir/mmdf
View File

@ -1 +1,5 @@
#------------------------------------------------------------------------------
# mmdf: file(1) magic for MMDF mail files
#
0 string \001\001\001\001 MMDF mailbox

5
usr.bin/file/Magdir/motorola
View File

@ -1,5 +1,6 @@
#
# Motorola
#------------------------------------------------------------------------------
# motorola: file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#

77
usr.bin/file/Magdir/ms-dos
View File

@ -1,8 +1,73 @@
#------------------------------------------------------------------------------
# msdos: file(1) magic for MS-DOS files
#
# Various MS-DOS magic numbers
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0 string @echo\ off MS-DOS batch file text
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0 string MZ DOS executable (EXE)
0 string LZ DOS executable (built-in)
0 byte 0xe9 DOS executable (COM)
0 byte 0xeb DOS executable (COM)
0 byte 0xf0 MS-DOS program library
0 string MZ MS-DOS executable (EXE)
>24 string @ \b, OS/2 or Windows
>1638 string -lh5- \b, LHa SFX archive v2.13S
>7195 string Rar! \b, RAR self-extracting archive
#
# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
# 8161 bytes are ignored. To make the following entries work, increase
# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
# NT/Win32 and VMS.]
# [GRR: some company sells a self-extractor/displayer for image data(!)]
#
>11696 string PK\003\004 \b, PKZIP SFX archive v1.1
>13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
>15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
>15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
>28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
# these are the DOS versions:
>25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# these are the OS/2 versions (OS/2 is flagged above):
>47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# this is the NT/Win32 version:
>69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0 byte 0xe9 MS-DOS executable (COM)
#0 byte 0x8c MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0 byte 0xeb MS-DOS executable (COM)
#0 byte 0xb8 MS-DOS executable (COM)
# miscellaneous formats
0 string LZ MS-DOS executable (built-in)
#0 byte 0xf0 MS-DOS program library data
#
# Popular applications
2080 string Microsoft\ Word\ 6.0\ Document %s
#
0 belong 0x31be0000 Microsoft Word Document
#
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
#
0 belong 0x00001a00 Lotus 1-2-3
>4 belong 0x00100400 wk3 document
>4 belong 0x02100400 wk4 document
>4 belong 0x07800100 fm3 or fmb document
>4 belong 0x07800000 fm3 or fmb document
#
0 belong 0x00000200 Lotus 1-2-3
>4 belong 0x06040600 wk1 document
>4 belong 0x06800200 fmt document

7
usr.bin/file/Magdir/ncr
View File

@ -1,7 +1,8 @@
#------------------------------------------------------------------------------
# ncr: file(1) magic for NCR Tower objects
#
# magic.tower:
#
# NCR Tower objects, contributed by
# contributed by
# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
#

94
usr.bin/file/Magdir/netbsd
View File

@ -1,3 +1,6 @@
#------------------------------------------------------------------------------
# netbsd: file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
#
@ -5,6 +8,8 @@
>16 lelong >0 not stripped
0 lelong 000000314 BSDI demand paged executable
>16 lelong >0 not stripped
>32 byte 0x6a (uses shared libs)
0 lelong 000000407 NetBSD little-endian object file
>16 lelong >0 not stripped
@ -25,9 +30,12 @@
0 belong&0377777777 041400407 NetBSD/i386
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 041400507 NetBSD/i386 core
>12 string >\0 from '%s'
0 belong&0377777777 041600413 NetBSD/m68k demand paged
>0 byte &0x80
@ -43,9 +51,12 @@
0 belong&0377777777 041600407 NetBSD/m68k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 041600507 NetBSD/m68k core
>12 string >\0 from '%s'
0 belong&0377777777 042000413 NetBSD/m68k4k demand paged
>0 byte &0x80
@ -61,9 +72,12 @@
0 belong&0377777777 042000407 NetBSD/m68k4k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 042000507 NetBSD/m68k4k core
>12 string >\0 from '%s'
0 belong&0377777777 042200413 NetBSD/ns32532 demand paged
>0 byte &0x80
@ -79,9 +93,12 @@
0 belong&0377777777 042200407 NetBSD/ns32532
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 042200507 NetBSD/ns32532 core
>12 string >\0 from '%s'
0 belong&0377777777 042400413 NetBSD/sparc demand paged
>0 byte &0x80
@ -97,21 +114,72 @@
0 belong&0377777777 042400407 NetBSD/sparc
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 041400507 NetBSD/i386 core
>12 string >\0 from '%s'
0 belong&0377777777 041600507 NetBSD/m68k core
>12 string >\0 from '%s'
0 belong&0377777777 042000507 NetBSD/m68k4k core
>12 string >\0 from '%s'
0 belong&0377777777 042200507 NetBSD/ns32532 core
>12 string >\0 from '%s'
0 belong&0377777777 042400507 NetBSD/sparc core
>12 string >\0 from '%s'
0 belong&0377777777 042600413 NetBSD/pmax demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042600410 NetBSD/pmax pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042600407 NetBSD/pmax
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 042600507 NetBSD/pmax core
>12 string >\0 from '%s'
0 belong&0377777777 043000413 NetBSD/vax demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 043000410 NetBSD/vax pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 043000407 NetBSD/vax
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 043000507 NetBSD/vax core
>12 string >\0 from '%s'
0 belong&0377777777 043400413 NetBSD/mips demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 043400410 NetBSD/mips pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 043400407 NetBSD/mips
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>0 byte &0x40 position independent
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 043400507 NetBSD/mips core
>12 string >\0 from '%s'

13
usr.bin/file/Magdir/news
View File

@ -1,5 +1,12 @@
# NeWS, not "news" as in "netnews"
#------------------------------------------------------------------------------
# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
#
0 string StartFontMetrics ASCII font metrics
0 string StartFont ASCII font bits
0 long 0x137A2944 NeWS bitmap font
0 long 0x137A2947 NeWS font family
0 belong 0x137A2944 NeWS bitmap font
0 belong 0x137A2947 NeWS font family
0 belong 0x137A2950 scalable OpenFont binary
0 belong 0x137A2951 encrypted scalable OpenFont binary
8 belong 0x137A2B45 X11/NeWS bitmap font
8 belong 0x137A2B48 X11/NeWS font family

3
usr.bin/file/Magdir/pbm
View File

@ -1,3 +1,6 @@
#------------------------------------------------------------------------------
# pbm: file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#

7
usr.bin/file/Magdir/pdf Normal file
View File

@ -0,0 +1,7 @@
#------------------------------------------------------------------------------
# pdf: file(1) magic for Portable Document Format
#
0 string %PDF- PDF document
>5 string x \b, version %.3s

9
usr.bin/file/Magdir/pdp
View File

@ -1,22 +1,25 @@
#
# magic.pdp: PDP-11 executable/object and APL workspace
#------------------------------------------------------------------------------
# pdp: file(1) magic for PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
0 lelong 0101554 PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0 leshort 0407 PDP-11 executable
>8 leshort >0 not stripped
>15 byte >0 - version %ld
0 leshort 0401 PDP-11 UNIX/RT ldp
0 leshort 0405 PDP-11 old overlay
0 leshort 0410 PDP-11 pure executable
>8 leshort >0 not stripped
>15 byte >0 - version %ld
0 leshort 0411 PDP-11 separate I&D executable
>8 leshort >0 not stripped
>15 byte >0 - version %ld
0 leshort 0437 PDP-11 kernel overlay

14
usr.bin/file/Magdir/pgp
View File

@ -1,10 +1,12 @@
#------------------------------------------------------------------------------
# pgp: file(1) magic for Pretty Good Privacy
#
# pgp (pretty good protection)
0 beshort 0x9900 pgp key public ring
0 beshort 0x9501 pgp key security ring
0 beshort 0x9500 pgp key security ring
0 string -----BEGIN\040PGP pgp armored data
>15 string PUBLIC\040KEY\040BLOCK- public key blocK
0 beshort 0x9900 PGP key public ring
0 beshort 0x9501 PGP key security ring
0 beshort 0x9500 PGP key security ring
0 string -----BEGIN\040PGP PGP armored data
>15 string PUBLIC\040KEY\040BLOCK- public key block
>15 string MESSAGE- message
>15 string SIGNED\040MESSAGE- signed message
>15 string PGP\040SIGNATURE- signature

5
usr.bin/file/Magdir/pkgadd
View File

@ -1,4 +1,5 @@
#
# SysV R4 PKG Datastreams:
#------------------------------------------------------------------------------
# pkgadd: file(1) magic for SysV R4 PKG Datastreams
#
0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)

5
usr.bin/file/Magdir/plus5
View File

@ -1,5 +1,6 @@
#
#/etc/magic entries for Plus Five's UNIX MUMPS
#------------------------------------------------------------------------------
# plus5: file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order? Paging Hokey....
#

55
usr.bin/file/Magdir/printer Normal file
View File

@ -0,0 +1,55 @@
#------------------------------------------------------------------------------
# printer: file(1) magic for printer-formatted files
#
# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0 string %! PostScript document text
>2 string PS-Adobe- conforming
>>11 string >\0 at level %.3s
>>>15 string EPS - type %s
>>>15 string Query - type %s
>>>15 string ExitServer - type %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0 string \004%! PostScript document text
>3 string PS-Adobe- conforming
>>12 string >\0 at level %.3s
>>>16 string EPS - type %s
>>>16 string Query - type %s
>>>16 string ExitServer - type %s
# HP Printer Job Language
0 string \033%-12345X@PJL HP Printer Job Language data
>15 string \ ENTER\ LANGUAGE\ =
>31 string PostScript Postscript
# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0 string \033E\033 HP PCL printer data
>3 string \&l0A - default page size
>3 string \&l1A - US executive page size
>3 string \&l2A - US letter page size
>3 string \&l3A - US legal page size
>3 string \&l26A - A4 page size
>3 string \&l80A - Monarch envelope size
>3 string \&l81A - No. 10 envelope size
>3 string \&l90A - Intl. DL envelope size
>3 string \&l91A - Intl. C5 envelope size
>3 string \&l100A - Intl. B5 envelope size
>3 string \&l-81A - No. 10 envelope size (landscape)
>3 string \&l-90A - Intl. DL envelope size (landscape)
# IMAGEN printer-ready files:
0 string @document( Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10 string language\ impress (imPRESS data)
>10 string language\ daisy (daisywheel text)
>10 string language\ diablo (daisywheel text)
>10 string language\ printer (line printer emulation)
>10 string language\ tektronix (Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0 string Rast RST-format raster font data
>45 string >0 face %

5
usr.bin/file/Magdir/psdbms
View File

@ -1,5 +1,6 @@
#
# magic.ps: psdatabase magic
#------------------------------------------------------------------------------
# psdbms: file(1) magic for psdatabase
#
0 belong&0xff00ffff 0x56000000 ps database
>1 string >\0 version %s

5
usr.bin/file/Magdir/pyramid
View File

@ -1,5 +1,6 @@
#
# magic.pyramid: Magic for pyramids
#------------------------------------------------------------------------------
# pyramid: file(1) magic for Pyramids
#
# XXX - byte order?
#

14
usr.bin/file/Magdir/rpm Normal file
View File

@ -0,0 +1,14 @@
#------------------------------------------------------------------------------
#
# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
#
0 beshort 0xedab
>2 beshort 0xeedb RPM
>>4 byte x v%d
>>6 beshort 0 bin
>>6 beshort 1 src
>>8 beshort 1 i386
>>8 beshort 2 Alpha
>>8 beshort 3 PowerPC
>>8 beshort 4 Sparc
>>10 string x %s

12
usr.bin/file/Magdir/rtf Normal file
View File

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# rtf: file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0 string {\\rtf Rich Text Format data,
>5 byte x version %c,
>6 string \\ansi ANSI
>6 string \\mac Apple Macintosh
>6 string \\pc IBM PC, code page 437
>6 string \\pca IBM PS/2, code page 850

7
usr.bin/file/Magdir/sc
View File

@ -1,2 +1,5 @@
# for SC
38 string Spreadsheet sc file
#------------------------------------------------------------------------------
# sc: file(1) magic for "sc" spreadsheet
#
38 string Spreadsheet sc spreadsheet file

6
usr.bin/file/Magdir/sccs
View File

@ -1,3 +1,7 @@
#------------------------------------------------------------------------------
# sccs: file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
@ -14,4 +18,4 @@
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet.
# Hence the following official kludge:
8 string \001s\ SCCS archive.
8 string \001s\ SCCS archive data

5
usr.bin/file/Magdir/sendmail
View File

@ -1,5 +1,6 @@
#
# magic.sendmail:
#------------------------------------------------------------------------------
# sendmail: file(1) magic for sendmail config files
#
# XXX - byte order?
#

4
usr.bin/file/Magdir/sequent
View File

@ -1,3 +1,7 @@
#------------------------------------------------------------------------------
# sequent: file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0 lelong 0x00ea BALANCE NS32000 .o

165
usr.bin/file/Magdir/sgi Normal file
View File

@ -0,0 +1,165 @@
#------------------------------------------------------------------------------
# sgi: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
#
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
0 belong 0407 old SGI 68020 executable
0 belong 0410 old SGI 68020 pure executable
0 beshort 0x8765 disk quotas file
0 beshort 0x0506 IRIS Showcase file
>2 byte 0x49 -
>3 byte x - version %ld
0 beshort 0x0226 IRIS Showcase template
>2 byte 0x63 -
>3 byte x - version %ld
0 belong 0x5343464d IRIS Showcase file
>4 byte x - version %ld
0 belong 0x5443464d IRIS Showcase template
>4 byte x - version %ld
0 belong 0xdeadbabe IRIX Parallel Arena
>8 belong >0 - version %ld
#
0 beshort 0x0160 MIPSEB COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x0162 MIPSEL COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %d
>22 byte x .%ld
#
0 beshort 0x6001 MIPSEB-LE COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %d
>23 byte x .%ld
#
0 beshort 0x6201 MIPSEL-LE COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
# MIPS 2 additions
#
0 beshort 0x0163 MIPSEB MIPS-II COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x0166 MIPSEL MIPS-II COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x6301 MIPSEB-LE MIPS-II COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x6601 MIPSEL-LE MIPS-II COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
# MIPS 3 additions
#
0 beshort 0x0140 MIPSEB MIPS-III COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x0142 MIPSEL MIPS-III COFF executable
>20 beshort 0407 (impure)
>20 beshort 0410 (swapped)
>20 beshort 0413 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>22 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x4001 MIPSEB-LE MIPS-III COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x4201 MIPSEL-LE MIPS-III COFF executable
>20 beshort 03401 (impure)
>20 beshort 04001 (swapped)
>20 beshort 05401 (paged)
>8 belong >0 not stripped
>8 belong 0 stripped
>23 byte x - version %ld
>23 byte x .%ld
#
0 beshort 0x180 MIPSEB Ucode
0 beshort 0x182 MIPSEL Ucode
# 32bit core file
0 belong 0xdeadadb0 IRIX core dump
>4 belong 1 of
>16 string >\0 '%s'
# 64bit core file
0 belong 0xdeadad40 IRIX 64-bit core dump
>4 belong 1 of
>16 string >\0 '%s'
# New style crash dump file
0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
>36 string >\0 '%s'
# Trusted IRIX info
0 string SGIAUDIT SGI Audit file
>8 byte x - version %d
>9 byte x .%ld
# Are these three SGI-based file types or general ones?
0 string WNGZWZSC Wingz compiled script
0 string WNGZWZSS Wingz spreadsheet
0 string WNGZWZHP Wingz help file
#
0 string \#Inventor V IRIS Inventor file
# XXX - I don't know what next thing is! It is likely to be an image
# (or movie) format
0 string glfHeadMagic(); GLF_TEXT
4 belong 0x41010000 GLF_BINARY_LSB_FIRST
4 belong 0x00000141 GLF_BINARY_MSB_FIRST

27
usr.bin/file/Magdir/sgml
View File

@ -1,6 +1,21 @@
# $Id: sgml,v 1.3 1993/01/05 12:52:44 ian Exp $
# SGML goop, mostly from rph@sq.
0 string \<!DOCTYPE Exported SGML document
0 string \<!doctype Exported SGML document
0 string \<!SUBDOC Exported SGML subdocument
0 string \<!subdoc Exported SGML subdocument
#------------------------------------------------------------------------------
# sgml: file(1) magic for Standard Generalized Markup Language
# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \<!DOCTYPE\ HTML HTML document text
0 string \<!doctype\ html HTML document text
0 string \<HEAD HTML document text
0 string \<head HTML document text
0 string \<TITLE HTML document text
0 string \<title HTML document text
0 string \<html HTML document text
0 string \<HTML HTML document text
# SGML, mostly from rph@sq
0 string \<!DOCTYPE exported SGML document text
0 string \<!doctype exported SGML document text
0 string \<!SUBDOC exported SGML subdocument text
0 string \<!subdoc exported SGML subdocument text
0 string \<!-- exported SGML document text

7
usr.bin/file/Magdir/softquad
View File

@ -1,5 +1,8 @@
# SoftQuad Publishing Software magic numbers
# $Id: softquad,v 1.8 1993/02/19 14:36:43 ian Exp $
#------------------------------------------------------------------------------
# softquad: file(1) magic for SoftQuad Publishing Software
#
# $Id: softquad,v 1.9 1995/01/21 21:09:00 christos Exp $
# Author/Editor and RulesBuilder
#
# XXX - byte order?

6
usr.bin/file/Magdir/sun
View File

@ -1,7 +1,9 @@
#------------------------------------------------------------------------------
# sun: file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.
# (5.x uses ELF.)
# releases. (5.x uses ELF.)
#
0 belong&077777777 0600413 sparc demand paged
>0 byte &0x80

5
usr.bin/file/Magdir/terminfo
View File

@ -1,5 +1,6 @@
#
# Terminfo
#------------------------------------------------------------------------------
# terminfo: file(1) magic for terminfo
#
# XXX - byte order for screen images?
#

27
usr.bin/file/Magdir/tex
View File

@ -1,7 +1,6 @@
#
# magic.tex:
#
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
#------------------------------------------------------------------------------
# tex: file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>
@ -9,17 +8,29 @@
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0 string \367\002 TeX DVI file
>16 string >\0 (%s)
>16 string >\0 (%s)
0 string \367\203 TeX generic font data
0 string \367\131 TeX packed font data
>4 string >\0 (%s)
>3 string >\0 (%s)
0 string \367\312 TeX virtual font data
0 string This\ is\ TeX, TeX transcript text
0 string This\ is\ TeX, TeX transcript text
0 string This\ is\ METAFONT, METAFONT transcript text
# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data. The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2 string \000\021 TeX font metric data
>33 string >\0 (%s)
2 string \000\022 TeX font metric data
>34 string >\0 (%s)
>33 string >\0 (%s)
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input\ texinfo Texinfo source text
0 string This\ is\ Info\ file GNU Info text
# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input TeX document text
0 string \\section LaTeX document text
0 string \\setlength LaTeX document text
0 string \\documentstyle LaTeX document text
0 string \\chapter LaTeX document text

12
usr.bin/file/Magdir/timezone Normal file
View File

@ -0,0 +1,12 @@
#------------------------------------------------------------------------------
# timezone: file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 timezone data
0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 timezone data

31
usr.bin/file/Magdir/troff
View File

@ -1,6 +1,27 @@
#
# magic.troff:
#
0 string \100\357 very old (C/A/T) troff output data
0 string ' [nt]roff, tbl, or eqn input text
#------------------------------------------------------------------------------
# troff: file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
# troff input
0 string .\\" troff or preprocessor input text
0 string '\\" troff or preprocessor input text
0 string '.\\" troff or preprocessor input text
0 string \\" troff or preprocessor input text
# ditroff intermediate output text
0 string x\ T ditroff text
>4 string cat for the C/A/T phototypesetter
>4 string ps for PostScript
>4 string dvi for DVI
>4 string ascii for ASCII
>4 string lj4 for LaserJet 4
>4 string latin1 for ISO 8859-1 (Latin 1)
>4 string X75 for xditview at 75dpi
>>7 string -12 (12pt)
>4 string X100 for xditview at 100dpi
>>8 string -12 (12pt)
# output data formats
0 string \100\357 very old (C/A/T) troff output data

6
usr.bin/file/Magdir/typeset
View File

@ -1,5 +1,7 @@
# other typesetting magic
0 string \100\357 very old (C/A/T) troff output data
#------------------------------------------------------------------------------
# typeset: file(1) magic for other typesetting
#
0 string Interpress/Xerox Xerox InterPress data
>16 string / (version
>>17 string >\0 %s)

5
usr.bin/file/Magdir/unknown
View File

@ -1,5 +1,6 @@
#
# magic.unknown: Unknown machine magic
#------------------------------------------------------------------------------
# unknown: file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.

31
usr.bin/file/Magdir/uuencode
View File

@ -1,3 +1,30 @@
0 string begin uuencoded mail text
# Btoa(1) is an alternative to uuencode that requires less space.
#------------------------------------------------------------------------------
# uuencode: file(1) magic for ASCII-encoded files
#
# GRR: the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is 'h' instead of
# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.) If regular expressions
# were supported, this entry could possibly be split into two with
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
0 string begin\040 uuencoded or xxencoded text
# btoa(1) is an alternative to uuencode that requires less space.
0 string xbtoa\ Begin btoa'd text
# ship(1) is another, much cooler alternative to uuencode.
# Greg Roelofs, newt@uchicago.edu
0 string $\012ship ship'd binary text
# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
# Greg Roelofs, newt@uchicago.edu
0 string Decode\ the\ following\ with\ bdeco bencoded News text
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11 string must\ be\ converted\ with\ BinHex BinHex binary text
>41 string x \b, version %.3s
# GRR: is MIME BASE64 encoding handled somewhere?

10
usr.bin/file/Magdir/varied.out
View File

@ -1,5 +1,15 @@
#------------------------------------------------------------------------------
# varied.out: file(1) magic for various USG systems
#
# Herewith many of the object file formats used by USG systems.
# Most have been moved to files for a particular processor,
# and deleted if they duplicate other entries.
#
0 short 0610 Perkin-Elmer executable
# AMD 29K
0 beshort 0572 amd 29k coff noprebar executable
0 beshort 01572 amd 29k coff prebar executable
0 beshort 0160007 amd 29k coff archive
# Cray
6 beshort 0407 unicos (cray) executable

5
usr.bin/file/Magdir/vax
View File

@ -1,5 +1,6 @@
#
# magic.pdp: VAX executable/object and APL workspace
#------------------------------------------------------------------------------
# vax: file(1) magic for VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
0 lelong 0101556 VAX double precision APL workspace

5
usr.bin/file/Magdir/visx
View File

@ -1,5 +1,6 @@
#
# magic.visx: Visx format file
#------------------------------------------------------------------------------
# visx: file(1) magic for Visx format files
#
0 short 0x5555 VISX image file
>2 byte 0 (zero)

27
usr.bin/file/Magdir/vms Normal file
View File

@ -0,0 +1,27 @@
#------------------------------------------------------------------------------
# vms: file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
# GRR 950122: I'm just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures. The VAX files
# all had headers similar to this:
#
# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
#
0 string \xb0\0\x30\0 VMS VAX executable
>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
#
0 belong 0x03000000 VMS Alpha executable
>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption

6
usr.bin/file/Magdir/zilog
View File

@ -1,5 +1,6 @@
#
# Zilog Z8000.
#------------------------------------------------------------------------------
# zilog: file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian? My Product Specification doesn't
# say.
@ -8,4 +9,3 @@
0 long 0xe808 pure object file (z8000 a.out)
0 long 0xe809 separate object file (z8000 a.out)
0 long 0xe805 overlay object file (z8000 a.out)

15
usr.bin/file/Magdir/zyxel
View File

@ -1,9 +1,16 @@
#------------------------------------------------------------------------------
# zyxel: file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
# ZyXEL-defined standard)
0 string ZyXEL\002 ZyXEL voice data
>10 byte 0 - CELP encoding
>10 byte 1 - ADPCM2 encoding
>10 byte 2 - ADPCM3 encoding
0 string ZyXEL\002 ZyXEL voice data
>10 byte 0 - CELP encoding
>10 byte&0x0B 1 - ADPCM2 encoding
>10 byte&0x0B 2 - ADPCM3 encoding
>10 byte&0x0B 3 - ADPCM4 encoding
>10 byte&0x0B 8 - New ADPCM3 encoding
>10 byte&0x04 4 with resync

12
usr.bin/file/Makefile
View File

@ -1,6 +1,6 @@
# Makefile for file(1) cmd.
# Copyright (c) Ian F. Darwin 86/09/01 - see LEGAL.NOTICE.
# @(#)$Id: Makefile,v 1.43 1994/05/03 17:57:59 christos Exp $
# @(#)$Id: Makefile,v 1.49 1995/10/27 23:12:33 christos Exp $
#
# This software is not subject to any license of the American Telephone
# and Telegraph Company or of the Regents of the University of California.
@ -21,7 +21,7 @@
# ever read sources, credits must appear in the documentation.
#
# 4. This notice may not be removed or altered.
VERSION = 3.14
VERSION = 3.19
SHELL = /bin/sh
#MAGIC = /etc/magic
MAGIC = /usr/local/etc/magic
@ -91,7 +91,7 @@ try: all $(OFILE)
what ./file >lastnocore
file: $(OBJS)
$(CC) $(CFLAGS) $(OBJS) -o $@
$(CC) $(CFLAGS) $(LDFLAGS) $(OBJS) -o $@
lint: $(SRCS)
lint -ha $(DEFS) $(SRCS) | tee $@
magic: Magdir
@ -119,12 +119,14 @@ clobber:
magic.${MANFEXT} : Makefile magic.man
@rm -f $@
sed -e s@__SECTION__@${MANFEXT}@g \
sed -e s@__CSECTION__@${MANCEXT}@g \
-e s@__FSECTION__@${MANFEXT}@g \
-e s@__MAGIC__@${MAGIC}@g magic.man > $@
file.${MANCEXT} : Makefile file.man
@rm -f $@
sed -e s@__SECTION__@${MANCEXT}@g \
sed -e s@__CSECTION__@${MANCEXT}@g \
-e s@__FSECTION__@${MANFEXT}@g \
-e s@__MAGIC__@${MAGIC}@g file.man > $@
send: dist

125
usr.bin/file/apprentice.c
View File

@ -29,56 +29,92 @@
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
#include "file.h"
#ifndef lint
static char *moduleid =
"@(#)$Id: apprentice.c,v 1.19 1994/05/03 17:58:23 christos Exp $";
"@(#)$Id: apprentice.c,v 1.23 1995/10/27 23:12:01 christos Exp $";
#endif /* lint */
#define EATAB {while (isascii((unsigned char) *l) && \
isspace((unsigned char) *l)) ++l;}
#define LOWCASE(l) (isupper((unsigned char) (l)) ? \
tolower((unsigned char) (l)) : (l))
static int getvalue __P((struct magic *, char **));
static int hextoint __P((int));
static char *getstr __P((char *, char *, int, int *));
static int parse __P((char *, int *, int));
static void eatsize __P((char **));
static int maxmagic = 0;
static int apprentice_1 __P((char *, int));
int
apprentice(fn, check)
char *fn; /* name of magic file */
char *fn; /* list of magic files */
int check; /* non-zero? checking-only run. */
{
FILE *f;
char line[BUFSIZ+1];
int errs = 0;
f = fopen(fn, "r");
if (f==NULL) {
(void) fprintf(stderr, "%s: can't read magic file %s\n",
progname, fn);
if (check)
return -1;
else
exit(1);
}
char *p, *mfn;
int file_err, errs = -1;
maxmagic = MAXMAGIS;
if ((magic = (struct magic *) calloc(sizeof(struct magic), maxmagic))
== NULL) {
magic = (struct magic *) calloc(sizeof(struct magic), maxmagic);
mfn = malloc(strlen(fn)+1);
if (magic == NULL || mfn == NULL) {
(void) fprintf(stderr, "%s: Out of memory.\n", progname);
if (check)
return -1;
else
exit(1);
}
fn = strcpy(mfn, fn);
while (fn) {
p = strchr(fn, ':');
if (p)
*p++ = '\0';
file_err = apprentice_1(fn, check);
if (file_err > errs)
errs = file_err;
fn = p;
}
if (errs == -1)
(void) fprintf(stderr, "%s: couldn't find any magic files!\n",
progname);
if (!check && errs)
exit(1);
free(mfn);
return errs;
}
static int
apprentice_1(fn, check)
char *fn; /* name of magic file */
int check; /* non-zero? checking-only run. */
{
static const char hdr[] =
"cont\toffset\ttype\topcode\tmask\tvalue\tdesc";
FILE *f;
char line[BUFSIZ+1];
int errs = 0;
f = fopen(fn, "r");
if (f==NULL) {
if (errno != ENOENT)
(void) fprintf(stderr,
"%s: can't read magic file %s (%s)\n",
progname, fn, strerror(errno));
return -1;
}
/* parse it */
if (check) /* print silly verbose header for USG compat. */
(void) printf("cont\toffset\ttype\topcode\tmask\tvalue\tdesc\n");
(void) printf("%s\n", hdr);
for (lineno = 1;fgets(line, BUFSIZ, f) != NULL; lineno++) {
if (line[0]=='#') /* comment, do not parse */
@ -87,11 +123,11 @@ int check; /* non-zero? checking-only run. */
continue;
line[strlen(line)-1] = '\0'; /* delete newline */
if (parse(line, &nmagic, check) != 0)
++errs;
errs = 1;
}
(void) fclose(f);
return errs ? -1 : 0;
return errs;
}
/*
@ -147,8 +183,9 @@ int *ndx, check;
struct magic *m;
char *t, *s;
#define ALLOC_INCR 20
if (nd+1 >= maxmagic){
maxmagic += 20;
maxmagic += ALLOC_INCR;
if ((magic = (struct magic *) realloc(magic,
sizeof(struct magic) *
maxmagic)) == NULL) {
@ -158,6 +195,7 @@ int *ndx, check;
else
exit(1);
}
memset(&magic[*ndx], 0, sizeof(struct magic) * ALLOC_INCR);
}
m = &magic[*ndx];
m->flag = 0;
@ -174,7 +212,7 @@ int *ndx, check;
}
/* get offset, then skip over it */
m->offset = (int) strtol(l,&t,0);
m->offset = (int) strtoul(l,&t,0);
if (l == t)
magwarn("offset %s invalid", l);
l = t;
@ -186,13 +224,16 @@ int *ndx, check;
* read [.lbs][+-]nnnnn)
*/
if (*l == '.') {
switch (*++l) {
l++;
switch (LOWCASE(*l)) {
case 'l':
m->in.type = LONG;
break;
case 'h':
case 's':
m->in.type = SHORT;
break;
case 'c':
case 'b':
m->in.type = BYTE;
break;
@ -205,7 +246,7 @@ int *ndx, check;
s = l;
if (*l == '+' || *l == '-') l++;
if (isdigit((unsigned char)*l)) {
m->in.offset = strtol(l, &t, 0);
m->in.offset = strtoul(l, &t, 0);
if (*s == '-') m->in.offset = - m->in.offset;
}
else
@ -278,7 +319,8 @@ int *ndx, check;
/* New-style anding: "0 byte&0x80 =0x80 dynamically linked" */
if (*l == '&') {
++l;
m->mask = signextend(m, strtol(l, &l, 0));
m->mask = signextend(m, strtoul(l, &l, 0));
eatsize(&l);
} else
m->mask = ~0L;
EATAB;
@ -360,8 +402,10 @@ char **p;
*p = getstr(*p, m->value.s, sizeof(m->value.s), &slen);
m->vallen = slen;
} else
if (m->reln != 'x')
m->value.l = signextend(m, strtol(*p, p, 0));
if (m->reln != 'x') {
m->value.l = signextend(m, strtoul(*p, p, 0));
eatsize(p);
}
return 0;
}
@ -549,3 +593,30 @@ int len;
}
}
}
/*
* eatsize(): Eat the size spec from a number [eg. 10UL]
*/
static void
eatsize(p)
char **p;
{
char *l = *p;
if (LOWCASE(*l) == 'u')
l++;
switch (LOWCASE(*l)) {
case 'l': /* long */
case 's': /* short */
case 'h': /* short */
case 'b': /* char/byte */
case 'c': /* char/byte */
l++;
/*FALLTHROUGH*/
default:
break;
}
*p = l;
}

41
usr.bin/file/ascmagic.c
View File

@ -1,5 +1,5 @@
/*
* Ascii magic -- file types that we know based on keywords
* ASCII magic -- file types that we know based on keywords
* that can appear anywhere in the file.
*
* Copyright (c) Ian F. Darwin, 1987.
@ -36,7 +36,7 @@
#ifndef lint
static char *moduleid =
"@(#)$Id: ascmagic.c,v 1.17 1994/01/21 01:25:30 christos Exp $";
"@(#)$Id: ascmagic.c,v 1.20 1995/05/20 22:09:21 christos Exp $";
#endif /* lint */
/* an optimisation over plain strcmp() */
@ -47,13 +47,24 @@ ascmagic(buf, nbytes)
unsigned char *buf;
int nbytes; /* size actually read */
{
int i, isblock, has_escapes = 0;
int i, has_escapes = 0;
unsigned char *s;
char nbuf[HOWMANY+1]; /* one extra for terminating '\0' */
char *token;
register struct names *p;
/* these are easy, do them first */
/*
* Do the tar test first, because if the first file in the tar
* archive starts with a dot, we can confuse it with an nroff file.
*/
switch (is_tar(buf, nbytes)) {
case 1:
ckfputs("tar archive", stdout);
return 1;
case 2:
ckfputs("POSIX tar archive", stdout);
return 1;
}
/*
* for troff, look for . + letter + letter or .\";
@ -66,13 +77,13 @@ int nbytes; /* size actually read */
while (isascii(*tp) && isspace(*tp))
++tp; /* skip leading whitespace */
if ((isascii(*tp) && (isalnum(*tp) || *tp=='\\') &&
isascii(*(tp+1)) && (isalnum(*(tp+1)) || *tp=='"'))) {
isascii(tp[1]) && (isalnum(tp[1]) || tp[1] == '"'))) {
ckfputs("troff or preprocessor input text", stdout);
return 1;
}
}
if ((*buf == 'c' || *buf == 'C') &&
isascii(*(buf + 1)) && isspace(*(buf + 1))) {
isascii(buf[1]) && isspace(buf[1])) {
ckfputs("fortran program text", stdout);
return 1;
}
@ -82,7 +93,7 @@ int nbytes; /* size actually read */
s = (unsigned char*) memcpy(nbuf, buf, nbytes);
s[nbytes] = '\0';
has_escapes = (memchr(s, '\033', nbytes) != NULL);
while ((token = strtok((char*)s, " \t\n\r\f")) != NULL) {
while ((token = strtok((char *) s, " \t\n\r\f")) != NULL) {
s = NULL; /* make strtok() keep on tokin' */
for (p = names; p < names + NNAMES; p++) {
if (STREQ(p->name, token)) {
@ -95,22 +106,14 @@ int nbytes; /* size actually read */
}
}
switch (is_tar(buf, nbytes)) {
case 1:
ckfputs("tar archive", stdout);
return 1;
case 2:
ckfputs("POSIX tar archive", stdout);
return 1;
}
for (i = 0; i < nbytes; i++) {
if (!isascii(*(buf+i)))
return 0; /* not all ascii */
if (!isascii(buf[i]))
return 0; /* not all ASCII */
}
/* all else fails, but it is ascii... */
ckfputs("ascii text", stdout);
/* all else fails, but it is ASCII... */
ckfputs("ASCII text", stdout);
if (has_escapes) {
ckfputs(" (with escape sequences)", stdout);
}

17
usr.bin/file/compress.c
View File

@ -4,7 +4,7 @@
* information if recognized
* uncompress(method, old, n, newch) - uncompress old into new,
* using method, return sizeof new
* $Id: compress.c,v 1.8 1994/01/21 01:38:24 christos Exp $
* $Id: compress.c,v 1.9 1995/05/20 22:09:21 christos Exp $
*/
#include <stdio.h>
#include <stdlib.h>
@ -20,13 +20,12 @@ static struct {
char *argv[3];
int silent;
} compr[] = {
{ "\037\235", 2, { "uncompress", "-c", NULL }, 0 },
{ "\037\213", 2, { "gzip", "-dq", NULL }, 1 },
/*
* XXX pcat does not work, cause I don't know how to make it read stdin,
* so we use gzip
*/
{ "\037\036", 2, { "gzip", "-dq", NULL }, 0 },
{ "\037\235", 2, { "uncompress", "-c", NULL }, 0 }, /* compressed */
{ "\037\213", 2, { "gzip", "-cdq", NULL }, 1 }, /* gzipped */
{ "\037\236", 2, { "gzip", "-cdq", NULL }, 1 }, /* frozen */
{ "\037\240", 2, { "gzip", "-cdq", NULL }, 1 }, /* SCO LZH */
/* the standard pack utilities do not accept standard input */
{ "\037\036", 2, { "gzip", "-cdq", NULL }, 0 }, /* packed */
};
static int ncompr = sizeof(compr) / sizeof(compr[0]);
@ -121,5 +120,3 @@ int n;
return n;
}
}

59
usr.bin/file/file.1
View File

@ -1,25 +1,19 @@
.TH FILE 1 "Copyright but distributable"
.\# $Id: file.man,v 1.23 1993/09/24 18:50:48 christos Exp $
.TH FILE __CSECTION__ "Copyright but distributable"
.\" $Id: file.man,v 1.26 1995/10/27 23:12:01 christos Exp $
.SH NAME
.I file
file
\- determine file type
.SH SYNOPSIS
.B file
[
.B \-c
]
[
.B \-z
]
[
.B \-L
.B \-vczL
]
[
.B \-f
namefile ]
[
.B \-m
magicfile ]
magicfiles ]
file ...
.SH DESCRIPTION
.I File
@ -101,44 +95,47 @@ The language test routines also test for some miscellany
.I tar
archives) and determine whether an unknown file should be
labelled as `ascii text' or `data'.
.PP
Use
.B \-m
.I file
to specify an alternate file of magic numbers.
.PP
The
.SH OPTIONS
.TP 8
.B \-v
Print the version of the program and exit.
.TP 8
.B \-m list
Specify an alternate list of files containing magic numbers.
This can be a single file, or a colon-separated list of files.
.TP 8
.B \-z
tries to look inside compressed files.
.PP
The
Try to look inside compressed files.
.TP 8
.B \-c
option causes a checking printout of the parsed form of the magic file.
Cause a checking printout of the parsed form of the magic file.
This is usually used in conjunction with
.B \-m
to debug a new magic file before installing it.
.PP
The
.B \-f
.I namefile
option specifies that the names of the files to be examined
are to be read (one per line) from
.TP 8
.B \-f namefile
Read the names of the files to be examined from
.I namefile
(one per line)
before the argument list.
Either
.I namefile
or at least one filename argument must be present;
to test the standard input, use ``-'' as a filename argument.
.PP
The
.TP 8
.B \-L
option causes symlinks to be followed, as the like-named option in
.IR ls (1).
(on systems that support symbolic links).
.SH FILES
.I __MAGIC__
\- default list of magic numbers
.SH ENVIRONMENT
The environment variable
.B MAGIC
can be used to set the default magic number files.
.SH SEE ALSO
.IR magic (__SECTION__)
.IR magic (__FSECTION__)
\- description of magic file format.
.br
.IR Strings (1), " od" (1)

133
usr.bin/file/file.c
View File

@ -26,7 +26,7 @@
*/
#ifndef lint
static char *moduleid =
"@(#)$Id: file.c,v 1.29 1993/10/27 20:59:05 christos Exp $";
"@(#)$Id: file.c,v 1.34 1995/10/27 23:12:01 christos Exp $";
#endif /* lint */
#include <stdio.h>
@ -36,15 +36,24 @@ static char *moduleid =
#include <sys/param.h> /* for MAXPATHLEN */
#include <sys/stat.h>
#include <fcntl.h> /* for open() */
#if (__COHERENT__ >= 0x420)
#include <sys/utime.h>
#else
#include <utime.h>
#endif
#include <unistd.h> /* for read() */
#ifdef __ELF__
#include <elf.h>
#endif
#include "patchlevel.h"
#include "file.h"
#ifdef S_IFLNK
# define USAGE "Usage: %s [-czL] [-f namefile] [-m magicfile] file...\n"
# define USAGE "Usage: %s [-vczL] [-f namefile] [-m magicfiles] file...\n"
#else
# define USAGE "Usage: %s [-cz] [-f namefile] [-m magicfile] file...\n"
# define USAGE "Usage: %s [-vcz] [-f namefile] [-m magicfiles] file...\n"
#endif
#ifndef MAGIC
@ -61,7 +70,7 @@ int /* Misc globals */
struct magic *magic; /* array of magic entries */
char *magicfile = MAGIC;/* where magic be found */
char *magicfile; /* where magic be found */
char *progname; /* used throughout */
int lineno; /* line number in the magic file */
@ -78,15 +87,22 @@ int argc;
char *argv[];
{
int c;
int check = 0, didsomefiles = 0, errflg = 0, ret = 0;
int check = 0, didsomefiles = 0, errflg = 0, ret = 0, app = 0;
if ((progname = strrchr(argv[0], '/')) != NULL)
progname++;
else
progname = argv[0];
while ((c = getopt(argc, argv, "cdf:Lm:z")) != EOF)
if (!(magicfile = getenv("MAGIC")))
magicfile = MAGIC;
while ((c = getopt(argc, argv, "vcdf:Lm:z")) != EOF)
switch (c) {
case 'v':
(void) fprintf(stdout, "%s-%d.%d\n", progname,
FILE_VERSION_MAJOR, patchlevel);
return 1;
case 'c':
++check;
break;
@ -94,6 +110,12 @@ char *argv[];
++debug;
break;
case 'f':
if (!app) {
ret = apprentice(magicfile, check);
if (check)
exit(ret);
app = 1;
}
unwrap(optarg);
++didsomefiles;
break;
@ -113,14 +135,18 @@ char *argv[];
errflg++;
break;
}
if (errflg) {
(void) fprintf(stderr, USAGE, progname);
exit(2);
}
ret = apprentice(magicfile, check);
if (check)
exit(ret);
if (!app) {
ret = apprentice(magicfile, check);
if (check)
exit(ret);
app = 1;
}
if (optind == argc) {
if (!didsomefiles) {
@ -190,10 +216,11 @@ int wid;
struct utimbuf utbuf;
struct stat sb;
int nbytes = 0; /* number of bytes read from a datafile */
char match = '\0';
if (strcmp("-", inname) == 0) {
if (fstat(0, &sb)<0) {
error("cannot fstat `%s' (%s).\n", stdname,
error("cannot fstat `%s' (%s).\n", stdname,
strerror(errno));
/*NOTREACHED*/
}
@ -212,7 +239,7 @@ int wid;
putchar('\n');
return;
}
if ((fd = open(inname, O_RDONLY)) < 0) {
/* We can't open it, but we were able to stat it. */
if (sb.st_mode & 0002) ckfputs("writeable, ", stdout);
@ -232,12 +259,59 @@ int wid;
/*NOTREACHED*/
}
if (nbytes == 0)
if (nbytes == 0)
ckfputs("empty", stdout);
else {
buf[nbytes++] = '\0'; /* null-terminate it */
tryit(buf, nbytes, zflag);
match = tryit(buf, nbytes, zflag);
}
#ifdef __ELF__
/*
* ELF executables have multiple section headers in arbitrary
* file locations and thus file(1) cannot determine it from easily.
* Instead we traverse thru all section headers until a symbol table
* one is found or else the binary is stripped.
* XXX: This will not work for binaries of a different byteorder.
* Should come up with a better fix.
*/
if (match == 's' && nbytes > sizeof (Elf32_Ehdr) &&
buf[EI_MAG0] == ELFMAG0 &&
buf[EI_MAG1] == ELFMAG1 &&
buf[EI_MAG2] == ELFMAG2 &&
buf[EI_MAG3] == ELFMAG3) {
union {
long l;
char c[sizeof (long)];
} u;
Elf32_Ehdr elfhdr;
int stripped = 1;
u.l = 1;
(void) memcpy(&elfhdr, buf, sizeof elfhdr);
/*
* If the system byteorder does not equal the object byteorder
* then don't test.
*/
if ((u.c[sizeof(long) - 1] + 1) == elfhdr.e_ident[5]) {
if (lseek(fd, elfhdr.e_shoff, SEEK_SET)<0)
error("lseek failed (%s).\n", strerror(errno));
for ( ; elfhdr.e_shnum ; elfhdr.e_shnum--) {
if (read(fd, buf, elfhdr.e_shentsize)<0)
error("read failed (%s).\n", strerror(errno));
if (((Elf32_Shdr *)&buf)->sh_type == SHT_SYMTAB) {
stripped = 0;
break;
}
}
if (stripped)
(void) printf (", stripped");
}
}
#endif
if (inname != stdname) {
/*
@ -252,25 +326,24 @@ int wid;
}
void
int
tryit(buf, nb, zflag)
unsigned char *buf;
int nb, zflag;
{
/*
* Try compression stuff
*/
if (!zflag || zmagic(buf, nb) != 1)
/*
* try tests in /etc/magic (or surrogate magic file)
*/
if (softmagic(buf, nb) != 1)
/*
* try known keywords, check for ascii-ness too.
*/
if (ascmagic(buf, nb) != 1)
/*
* abandon hope, all ye who remain here
*/
ckfputs("data", stdout);
/* try compression stuff */
if (zflag && zmagic(buf, nb))
return 'z';
/* try tests in /etc/magic (or surrogate magic file) */
if (softmagic(buf, nb))
return 's';
/* try known keywords, check whether it is ASCII */
if (ascmagic(buf, nb))
return 'a';
/* abandon hope, all ye who remain here */
ckfputs("data", stdout);
return '\0';
}

9
usr.bin/file/file.h
View File

@ -1,6 +1,6 @@
/*
* file.h - definitions for file(1) program
* @(#)$Id: file.h,v 1.19 1994/05/03 17:58:23 christos Exp $
* @(#)$Id: file.h,v 1.22 1995/05/20 22:09:21 christos Exp $
*
* Copyright (c) Ian F. Darwin, 1987.
* Written by Ian F. Darwin.
@ -26,7 +26,9 @@
* 4. This notice may not be removed or altered.
*/
#define HOWMANY 8192 /* how much of the file to look at */
#ifndef HOWMANY
# define HOWMANY 8192 /* how much of the file to look at */
#endif
#define MAXMAGIS 1000 /* max entries in /etc/magic */
#define MAXDESC 50 /* max leng of text description */
#define MAXstring 32 /* max leng of "string" types */
@ -92,7 +94,7 @@ extern void mdump __P((struct magic *));
extern void process __P((const char *, int));
extern void showstr __P((FILE *, const char *, int));
extern int softmagic __P((unsigned char *, int));
extern void tryit __P((unsigned char *, int, int));
extern int tryit __P((unsigned char *, int, int));
extern int zmagic __P((unsigned char *, int));
extern void ckfprintf __P((FILE *, const char *, ...));
extern unsigned long signextend __P((struct magic *, unsigned long));
@ -121,6 +123,7 @@ extern int sys_nerr;
extern char *sys_errlist[];
#define strerror(e) \
(((e) >= 0 && (e) < sys_nerr) ? sys_errlist[(e)] : "Unknown error")
#define strtoul(a, b, c) strtol(a, b, c)
#endif
#ifndef MAXPATHLEN

4
usr.bin/file/fsmagic.c
View File

@ -46,7 +46,7 @@
#ifndef lint
static char *moduleid =
"@(#)$Id: fsmagic.c,v 1.22 1993/02/19 12:09:04 ian Exp $";
"@(#)$Id: fsmagic.c,v 1.23 1995/01/21 21:03:35 christos Exp $";
#endif /* lint */
int
@ -151,9 +151,11 @@ struct stat *sb;
return 1;
#endif
#ifdef S_IFSOCK
#ifndef __COHERENT__
case S_IFSOCK:
ckfputs("socket", stdout);
return 1;
#endif
#endif
case S_IFREG:
break;

22
usr.bin/file/magic.5
View File

@ -1,10 +1,10 @@
.TH MAGIC __SECTION__ "Public Domain"
.TH MAGIC __FSECTION__ "Public Domain"
.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems.
.SH NAME
magic \- file command's magic number file
.SH DESCRIPTION
The
.IR file (1)
.IR file (__CSECTION__)
command identifies the type of a file using,
among other tests,
a test for whether the file begins with a certain
@ -79,10 +79,13 @@ value,
.BR & ,
to specify that the value from the file must have set all of the bits
that are set in the specified value,
or
.BR ^ ,
to specify that the value from the file must have clear any of the bits
that are set in the specified value.
that are set in the specified value, or
.BR x ,
to specify that any value will match. If the character is omitted,
it is assumed to be
.BR = .
.IP
Numeric values are specified in C form; e.g.
.B 13
@ -91,9 +94,6 @@ is decimal,
is octal, and
.B 0x13
is hexadecimal.
to specify that any value will match. If the character
is omitted, it is assumed to be
.BR = .
.IP
For string values, the byte string from the
file must match the specified byte string.
@ -143,7 +143,7 @@ If the first character following the last
is a
.B (
then the string after the parenthesis is interpreted as an indirect offset.
That means that the number after the parenthesis is used as a offset in
That means that the number after the parenthesis is used as an offset in
the file. The value at that offset is read, and is used again as an offset
in the file. Indirect offsets are of the form:
.BI (( x [.[bsl]][+-][ y ]).
@ -168,7 +168,7 @@ The formats
.IR bedate ,
and
.I ledate
are system-dependant; perhaps they should be specified as a number
are system-dependent; perhaps they should be specified as a number
of bytes (2B, 4B, etc),
since the files being recognized typically come from
a system on which the lengths are invariant.
@ -176,7 +176,7 @@ a system on which the lengths are invariant.
There is (currently) no support for specified-endian data to be used in
indirect offsets.
.SH SEE ALSO
.IR file (1)
.IR file (__CSECTION__)
\- the command that reads this file.
.\"
.\" From: guy@sun.uucp (Guy Harris)
@ -191,4 +191,4 @@ indirect offsets.
.\" the changes I posted to the S5R2 version.
.\"
.\" Modified for Ian Darwin's version of the file command.
.\" @(#)$Id: magic.man,v 1.11 1994/05/03 17:58:23 christos Exp $
.\" @(#)$Id: magic.man,v 1.12 1995/01/21 21:03:35 christos Exp $

13
usr.bin/file/names.h
View File

@ -10,7 +10,7 @@
*
* See LEGAL.NOTICE
*
* $Id: names.h,v 1.11 1993/09/16 21:14:20 christos Exp $
* $Id: names.h,v 1.12 1995/04/28 17:29:13 christos Exp $
*/
/* these types are used to index the table 'types': keep em in sync! */
@ -25,13 +25,13 @@
#define L_NEWS 8 /* Usenet Netnews */
static char *types[] = {
"c program text",
"fortran program text",
"C program text",
"FORTRAN program text",
"make commands text" ,
"pl/1 program text",
"PL/1 program text",
"assembler program text",
"English text",
"pascal program text",
"Pascal program text",
"mail text",
"news text",
"can't happen error on names.h/types",
@ -43,7 +43,7 @@ static struct names {
} names[] = {
/* These must be sorted by eye for optimal hit rate */
/* Add to this list only after substantial meditation */
{"/*", L_C}, /* must preced "The", "the", etc. */
{"/*", L_C}, /* must precede "The", "the", etc. */
{"#include", L_C},
{"char", L_C},
{"The", L_ENG},
@ -75,6 +75,7 @@ static struct names {
{".byte", L_MACH},
{".even", L_MACH},
{".globl", L_MACH},
{".text", L_MACH},
{"clr", L_MACH},
{"(input,", L_PAS},
{"dcl", L_PLI},

36
usr.bin/file/patchlevel.h
View File

@ -1,11 +1,43 @@
#define FILE_VERSION_MAJOR 3
#define patchlevel 14
#define patchlevel 19
/*
* Patchlevel file for Ian Darwin's MAGIC command.
* $Id: patchlevel.h,v 1.14 1994/05/03 17:58:23 christos Exp $
* $Id: patchlevel.h,v 1.19 1995/10/27 23:14:46 christos Exp $
*
* $Log: patchlevel.h,v $
* Revision 1.19 1995/10/27 23:14:46 christos
* Ability to parse colon separated list of magic files
* New LEGAL.NOTICE
* Various magic file changes
*
* Revision 1.18 1995/05/20 22:09:21 christos
* Passed incorrect argument to eatsize().
* Use %ld and %lx where appropriate.
* Remove unused variables
* ELF support for both big and little endian
* Fixes for small files again.
*
* Revision 1.17 1995/04/28 17:29:13 christos
* - Incorrect nroff detection fix from der Mouse
* - Lost and incorrect magic entries.
* - Added ELF stripped binary detection [in C; ugh]
* - Look for $MAGIC to find the magic file.
* - Eat trailing size specifications from numbers i.e. ignore 10L
* - More fixes for very short files
*
* Revision 1.16 1995/03/25 22:06:45 christos
* - use strtoul() where it exists.
* - fix sign-extend bug
* - try to detect tar archives before nroff files, otherwise
* tar files where the first file starts with a . will not work
*
* Revision 1.15 1995/01/21 21:03:35 christos
* Added CSECTION for the file man page
* Added version flag -v
* Fixed bug with -f input flag (from iorio@violet.berkeley.edu)
* Lots of magic fixes and reorganization...
*
* Revision 1.14 1994/05/03 17:58:23 christos
* changes from mycroft@gnu.ai.mit.edu (Charles Hannum) for unsigned
*

8
usr.bin/file/print.c
View File

@ -40,7 +40,7 @@
#ifndef lint
static char *moduleid =
"@(#)$Id: print.c,v 1.21 1994/05/03 17:58:23 christos Exp $";
"@(#)$Id: print.c,v 1.22 1995/05/20 22:09:21 christos Exp $";
#endif /* lint */
#define SZOF(a) (sizeof(a) / sizeof(a[0]))
@ -58,7 +58,7 @@ struct magic *m;
m->offset);
if (m->flag & INDIR)
(void) fprintf(stderr, "(%s,%d),",
(void) fprintf(stderr, "(%s,%ld),",
(m->in.type >= 0 && m->in.type < SZOF(typ)) ?
typ[(unsigned char) m->in.type] :
"*bad*",
@ -69,7 +69,7 @@ struct magic *m;
typ[(unsigned char) m->type] :
"*bad*");
if (m->mask != ~0L)
(void) fprintf(stderr, " & %.8x", m->mask);
(void) fprintf(stderr, " & %.8lx", m->mask);
(void) fprintf(stderr, ",%c", m->reln);
@ -82,7 +82,7 @@ struct magic *m;
case LELONG:
case BESHORT:
case BELONG:
(void) fprintf(stderr, "%d", m->value.l);
(void) fprintf(stderr, "%ld", m->value.l);
break;
case STRING:
showstr(stderr, m->value.s, -1);

28
usr.bin/file/softmagic.c
View File

@ -34,7 +34,7 @@
#ifndef lint
static char *moduleid =
"@(#)$Id: softmagic.c,v 1.26 1994/06/06 05:27:29 christos Exp $";
"@(#)$Id: softmagic.c,v 1.30 1995/05/20 22:09:21 christos Exp $";
#endif /* lint */
static int match __P((unsigned char *, int));
@ -179,18 +179,24 @@ struct magic *m;
switch (m->type) {
case BYTE:
v = p->b;
v = signextend(m, v) & m->mask;
(void) printf(m->desc, (unsigned char) v);
break;
case SHORT:
case BESHORT:
case LESHORT:
v = p->h;
v = signextend(m, v) & m->mask;
(void) printf(m->desc, (unsigned short) v);
break;
case LONG:
case BELONG:
case LELONG:
v = p->l;
v = signextend(m, v) & m->mask;
(void) printf(m->desc, (unsigned long) v);
break;
case STRING:
@ -214,9 +220,6 @@ struct magic *m;
error("invalid m->type (%d) in mprint().\n", m->type);
/*NOTREACHED*/
}
v = signextend(m, v) & m->mask;
(void) printf(m->desc, (unsigned char) v);
}
/*
@ -270,7 +273,7 @@ long offset;
char *str;
int len;
{
(void) fprintf(stderr, "mget @%d: ", offset);
(void) fprintf(stderr, "mget @%ld: ", offset);
showstr(stderr, (char *) str, len);
(void) fputc('\n', stderr);
(void) fputc('\n', stderr);
@ -284,11 +287,20 @@ struct magic *m;
int nbytes;
{
long offset = m->offset;
if (offset + sizeof(union VALUETYPE) > nbytes)
return 0;
if (offset + sizeof(union VALUETYPE) <= nbytes)
memcpy(p, s + offset, sizeof(union VALUETYPE));
else {
/*
* the usefulness of padding with zeroes eludes me, it
* might even cause problems
*/
long have = nbytes - offset;
memset(p, 0, sizeof(union VALUETYPE));
if (have > 0)
memcpy(p, s + offset, have);
}
memcpy(p, s + offset, sizeof(union VALUETYPE));
if (debug) {
mdebug(offset, (char *) p, sizeof(union VALUETYPE));