b0VIM 8.2r?^@ZwAVBl'C^DbEoSFaGf#HcI`JhLKhLMwNZOZuP]Qn,RgS_Td`UdV_(WlXZY\M Zk [_!\Xs!]f!^c1"_T"`o"agW#bn#c{,$dn$e}%f]%go%hq^&iX&jc''kk'lh'm_](ng(o]#)pV)qa)ri7*T*ad  k"N U & ` ] ! U    Z 8   ^ 5 3  gO%  zxv%~\5qn2R;?oD"+#>2 beshort <0x7fff Release %3d,+#0 byte 6 Infocom game data (Z-machine 6,+#>18 string >\0 Serial %.6s)+#>26 beshort >0 Size %d*4+#>2 beshort <0x7fff Release %3d,+#0 byte 5 Infocom game data (Z-machine 5,+#>18 string >\0 Serial %.6s)+#>26 beshort >0 Size %d*2+#>2 beshort <0x7fff Release %3d,+#0 byte 3 Infocom game data (Z-machine 3,+# there are 4 Infocom games that use version 4 that are not recognized.)+# recognized since only the oldest Zork I and II used them. Similarly+# (Note: to avoid false matches Z-machine version 1 and 2 are not+# Infocom+# Conflicts with too much other stuff!++>2 byte <10 version 2.6%d+0 beshort 0x0206 ALAN game data+# saw in the archive.+# I assume there are other, lower versions, but these are the only ones I+# ALAN+#+# Edited by Chris Chittleborough , March 2002+# Edited by Dave Chapeskie Jun 28, 1998+# from Allen Garvin +#+# adventure: file(1) magic for Adventure game files+#------------------------------------------------------------------------------++>18 lelong ^010 not stripped+>18 lelong &010 stripped+>>18 lelong ^01 relocatable object,+>>18 lelong &01 static object,+>18 lelong ^02+>18 lelong &02 executable,+0 leshort 0x521c COFF DSP21k+#+# From Gregory McGarry +# adi: file(1) magic for ADi's objects+#------------------------------------------------------------------------------+++>8 byte x version %d+0 string Maestro\r RISC OS music file+# From RISC OS Programmer's Reference Manual, Appendix E+# RISC OS Music files++>5 byte x version %d+0 string FONT\4 RISC OS 4bpp font data+>5 byte x version %d+0 string FONT\1 RISC OS 1bpp font data,+>5 byte x version %d+0 string FONT\0 RISC OS outline font data,+# From RISC OS Programmer's Reference Manual, Appendix E+# RISC OS new format font files++0 string Draw RISC OS Draw file data+# From RISC OS Programmer's Reference Manual, Appendix E+# RISC OS Draw files++16 lelong 0xef000011 RISC OS AIF executable+# RISC OS AIF, contains "SWI OS_Exit" at offset 16.++>12 string LIB_ \b, ALF library+>12 string OBJ_ \b, AOF object+0 lelong 0xc3cbc6c5 RISC OS Chunk data+# We guess the file type from the type of the first chunk.+# From RISC OS Programmer's Reference Manual, Appendix D+# RISC OS Chunk File Format++#+# acorn: file(1) magic for files found on Acorn systems+#------------------------------------------------------------------------------+# text if readable, executable if runnable binary, data if unreadable.+# Add any locally observed files here. Remember:+# $Id: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $+#+# Localstuff: file(1) magic for locally observed files+#------------------------------------------------------------------------------++# files is 5 on V7 and BSD, 4 on SV, and ?? in the SKeeping the same magic file instead of recreating one with all the new patteKeepatterns included in the 'file' repository because the new magic file would be 1Mo bigger than what it is now.1Mo bigger than what it is now.patterns included in the 'file' repository because the new magic file would beWe keep the same magic file instead of recreating a new one out of all the newmagic_old, 4359: Warning: Printf format is too long for type `long' in description `(%lu x'formats such as in the following error:escaped characters that should not be escaped, and size errors in printfwarnings raised by the new 'file' binary (v5.42). They mostly consisted ofThis patch is a copy of file-magic.patch that was modified to fix all thead6T?*ZXB t Z 6  w N % ~ 8 6 | Q 7   | f R > #  @85 sq I.,|T65+>10 byte&0x04 4 with resync+>10 byte&0x0B 8 - New ADPCM3 encoding+>10 byte&0x0B 3 - ADPCM4 encoding+>10 byte&0x0B 2 - ADPCM3 encoding+>10 byte&0x0B 1 - ADPCM2 encoding+>10 byte 0 - CELP encoding+0 string ZyXEL\002 ZyXEL voice data++# ZyXEL-defined standard)+# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a+# These are the /etc/magic entries to decode datafiles as used for the+# From +#+# zyxel: file(1) magic for ZyXEL modems+#------------------------------------------------------------------------------++0 long 0xe805 overlay object file (z8000 a.out)+0 long 0xe809 separate object file (z8000 a.out)+0 long 0xe808 pure object file (z8000 a.out)+0 long 0xe807 object file (z8000 a.out)+#+# say.+# Was it big-endian or little-endian? My Product Specification doesn't+#+# zilog: file(1) magic for Zilog Z8000.+#------------------------------------------------------------------------------++>28 long 1000 RGB24]+>28 long 1008 YUV422]+>24 long x %dx+>20 long x %dx+>8 long x - [%d -+>4 long x - version %d+0 long 395726 Jaleo XFS file+# Jaleo XFS files++>8 long x (version %d)+0 string xFSdump0 xfsdump archive+# xfsdump archive++>0 byte =0 obsolete+>3 byte >0 version %d+0 string xkm Compiled XKB Keymap: msb,+>0 byte =0 obsolete+>0 byte >0 version %d+1 string mkx Compiled XKB Keymap: lsb,+# XKM (compiled X keymap) files (including version and byte ordering)+# Compiled X Keymap ++# xwindows: file(1) magic for various X/Window system file formats.+#------------------------------------------------------------------------------++>6 leshort&0x0003 =0x0003 alignment 256+>6 leshort&0x0003 =0x0002 alignment 4+>6 leshort&0x0003 =0x0001 alignment 2+>6 leshort&0x0003 =0x0000 alignment 1+>6 leshort&0x4000 =0x0000 byte reloc,+>6 leshort&0x4000 =0x4000 page reloc,+>6 leshort&0x2000 =0x0000 16 bit,+>6 leshort&0x2000 =0x2000 32 bit,+>6 leshort&0x8000 =0x0000 6502,+>6 leshort&0x8000 =0x8000 65816,+>5 byte x version %d,+>6 leshort&0x1000 =0x1000 object,+>6 leshort&0x1000 =0x0000 executable,+0 string \x01\x00\x6F\x36\x35 o65+# o65 object files++>4 leshort x version %d+0 string \x6E\x61\x55\x7A xo65 library,+# xo65 library files++>6 leshort&0x0001 =0x0000 no debug info+>6 leshort&0x0001 =0x0001 with debug info+>4 leshort x version %d,+0 string \x55\x7A\x6E\x61 xo65 object,+#+# From: "Ullrich von Bassewitz" +# xo65 object files+#------------------------------------------------------------------------------++0 leshort 0x580 XENIX 8086 relocatable or 80286 small model++>0x1e leshort &0x102 Huge Objects EnabledadzZ{9%NL P  } z x [ ! w u @   t : o m V  _2/{[YW |a_7,W, iK +#>2 beshort <0x7fff Release %3d,+#0 byte 6 Infocom game data (Z-machine 6,+#>18 string >\0 Serial %.6s)+#>26 beshort >0 Size %d*4+#>2 beshort <0x7fff Release %3d,+#0 byte 5 Infocom game data (Z-machine 5,+#>18 string >\0 Serial %.6s)+#>26 beshort >0 Size %d*2+#>2 beshort <0x7fff Release %3d,+#0 byte 3 Infocom game data (Z-machine 3,+# there are 4 Infocom games that use version 4 that are not recognized.)+# recognized since only the oldest Zork I and II used them. Similarly+# (Note: to avoid false matches Z-machine version 1 and 2 are not+# Infocom+# Conflicts with too much other stuff!++>2 byte <10 version 2.6%d+0 beshort 0x0206 ALAN game data+# saw in the archive.+# I assume there are other, lower versions, but these are the only ones I+# ALAN+#+# Edited by Chris Chittleborough , March 2002+# Edited by Dave Chapeskie Jun 28, 1998+# from Allen Garvin +#+# adventure: file(1) magic for Adventure game files+#------------------------------------------------------------------------------++>18 lelong ^010 not stripped+>18 lelong &010 stripped+>>18 lelong ^01 relocatable object,+>>18 lelong &01 static object,+>18 lelong ^02+>18 lelong &02 executable,+0 leshort 0x521c COFF DSP21k+#+# From Gregory McGarry +# adi: file(1) magic for ADi's objects+#------------------------------------------------------------------------------+++>8 byte x version %d+0 string Maestro\r RISC OS music file+# From RISC OS Programmer's Reference Manual, Appendix E+# RISC OS Music files++>5 byte x version %d+0 string FONT\4 RISC OS 4bpp font data+>5 byte x version %d+0 string FONT\1 RISC OS 1bpp font data,+>5 byte x version %d+0 string FONT\0 RISC OS outline font data,+# From RISC OS Programmer's Reference Manual, Appendix E+# RISC OS new format font files++0 string Draw RISC OS Draw file data+# From RISC OS Programmer's Reference Manual, Appendix E+# RISC OS Draw files++16 lelong 0xef000011 RISC OS AIF executable+# RISC OS AIF, contains "SWI OS_Exit" at offset 16.++>12 string LIB_ \b, ALF library+>12 string OBJ_ \b, AOF object+0 lelong 0xc3cbc6c5 RISC OS Chunk data+# We guess the file type from the type of the first chunk.+# From RISC OS Programmer's Reference Manual, Appendix D+# RISC OS Chunk File Format++#+# acorn: file(1) magic for files found on Acorn systems+#------------------------------------------------------------------------------+# text if readable, executable if runnable binary, data if unreadable.+# Add any locally observed files here. Remember:+# $Id: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $+#+# Localstuff: file(1) magic for locally observed files+#------------------------------------------------------------------------------++# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID.+# Format is described in magic(files), where:+# Machine-generated from src/cmd/file/magdir/*; edit there only!+# Magic data for file(1) command.+# Magic@@ -0,0 +1,10985 @@+++ file-5.42/magic/magic_old 011-07-19 15:01:39.341338727 +0200--- file-5.42-orig/magic/magic_old 1970-01-01 01:00:00.000000000 +0100diff -Naurp file-5.42-orig/magic/magic file-5.42/magic/magicad[z_A?ud M 3  y * ^ u $ S   =;)&dHkQ&{hf~4}>+#+# amanda: file(1) magic for amanda file format+#------------------------------------------------------------------------------++>24 string >\0 \b, from '%s'+0 string Core\002 Alpha COFF format core dump (Digital UNIX)+>24 string >\0 \b, from '%s'+0 string Core\001 Alpha COFF format core dump (Digital UNIX)+#+# version 2.+# byte of the version number as well; DU 5.0 appears only to be up to+# UNIX core dump file may produce too many false hits, so we include one+# number; however, treating any file that begins with "Core" as a Digital+# The actual magic number is just "Core", followed by a 2-byte version+#+# Basic recognition of Digital UNIX core dumps - Mike Bremford ++>28 byte x -%d+>26 byte x .%d+>27 byte x - version %d+>24 leshort 0407 object+>22 leshort&030000 020000 shared library+>16 lelong 0 stripped+>16 lelong !0 not stripped+>22 leshort&020000 !0 dynamically linked+>24 leshort 0413 paged+>24 leshort 0410 pure+>22 leshort&030000 !020000 executable+0 leshort 0603 COFF format alpha++#+# alpha architecture description+#------------------------------------------------------------------------------+>16 long >0 not stripped+>2 short &0x0020 common library+0 short 0421 0421 Alliant compact executable+>16 long >0 not stripped+>2 short &0x0020 common library+0 short 0420 0420 Alliant virtual executable+#+# the 860 in....+# big-endian or little-endian versions, depending on the mode they ran+# If it's the i860-based one, they should probably become either the+# "long" should probably become "belong".+# instruction set, the "short" should probably become "beshort" and the+# If the FX series is the one that had a processor with a 68K-derived+#+# alliant: file(1) magic for Alliant FX series a.out files+#------------------------------------------------------------------------------++0 belong 0x736C682B Allegro datafile (appended exe data)+0 belong 0x736C682E Allegro datafile (not packed/autodetect)+0 belong 0x736C6821 Allegro datafile (packed)+#+# Toby Deshane +# allegro: file(1) magic for Allegro datafiles+#------------------------------------------------------------------------------+>>14 string >\0 %s saved game data+>10 belong 0x0A0D1A00+>10 belong !0x0A0D1A00 saved game data, CORRUPTED+0 string TADS2\ save TADS+# version.+# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter+>>(16.s+32) string >\0 %s saved game data+>12 belong 0x0A0D1A00+>12 belong !0x0A0D1A00 saved game data, CORRUPTED+0 string TADS2\ save/g TADS+# "TADS2 save\n\r\032\0" and the interpreter version. +# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),+# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian+>>13 string >\0 %s resource data+>9 belong 0x0A0D1A00+>9 belong !0x0A0D1A00 resource data, CORRUPTED+0 string TADS2\ rsc TADS+# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.+>>13 string >\0 %s game data+>9 belong 0x0A0D1A00+>9 belong !0x0A0D1A00 game data, CORRUPTED+0 string TADS2\ bin TADS+# Game files start with "TADS2 bin\n\r\032\0" then the compiler version.+# on the way).+# with a version string of the form "V2..\0" (but TADS 3 is+# All files are machine-independent (games compile to byte-code) and are tagged+# TADS (Text Adventure Development System)++#>18 string >\0 Serial %.6s)+#>26 beshort >0 Size %d*8+#>2 beshort <0x7fff Release %3d,+#0 byte 8 Infocom game data (Z-machine 8,+#>18 string >\0 Serial %.6s)+#>26 beshort >0 Size %d*8adYmN3qnA f M 1  g 3 0 Q  R % g e " |zfb@&mD$"?t5y,Kf+>8 string iso2 \b, MPEG v4 system, part 12 revision+>8 string isom \b, MPEG v4 system, version 1+4 string ftyp ISO Media+0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data+4 string pckg Apple QuickTime compressed archive+4 string idat Apple QuickTime image (unoptimized)+4 string idsc Apple QuickTime image (fast start)+4 string free Apple QuickTime movie (modified)+4 string skip Apple QuickTime movie (modified)+4 string wide Apple QuickTime movie (unoptimized)+4 string mdat Apple QuickTime movie (unoptimized)+>12 string rmra \b multiple URLs+>12 string cmov \b movie (fast start, compressed header)+>12 string mdra \b URL+>12 string mvhd \b movie (fast start)+4 string moov Apple QuickTime+0 string MOVI Silicon Graphics movie file+# SGI and Apple formats++# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)+# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)+# animation formats+#+# animation: file(1) magic for animation/movie formats+#------------------------------------------------------------------------------++0 string KICK Kickstart disk+0 string DOS\5 Amiga Fastdir FFS disk+0 string DOS\4 Amiga Fastdir DOS disk+0 string DOS\3 Amiga Inter FFS disk+0 string DOS\2 Amiga Inter DOS disk+0 string DOS\1 Amiga FFS disk+0 string DOS\0 Amiga DOS disk+>160 string x on %.24s+0 string RDSK Rigid Disk Block+# +# Amiga disk types++0 string ##\ version catalog translation+0 belong 0x80001001 AmigaOS outline tag+0 beshort 0x0f03 AmigaOS outline font+0 beshort 0x0f00 AmigaOS bitmap font+# The following are from: "Stefan A. Haubenthal" ++#26 string V.2 Brian Postma's Soundmon Module sound file v2+#26 string BPSM Brian Postma's Soundmon Module sound file v3+#26 string V.3 Brian Postma's Soundmon Module sound file v3+# Too simple (short, pure ASCII, deep), MPi+0 string COSO\0 Hippel-COSO Module sound file+0 string BeEp\0 JamCracker Module sound file+0 string ARP. The Holy Noise Module sound file+0 string Synth4.0 Synthesis Module sound file+58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file+1 string MUGICIAN/SOFTEYES Mugician Module sound file+0 string AON4artofnoise Art Of Noise Module sound file+0 string SMOD Future Composer 1.3 Module sound file+0 string FC14 Future Composer 1.4 Module sound file+#+# G=F6tz Waschk +# various sound formats from the Amiga+#+>2 beshort >1 icon, vers. %d+>>48 byte 8 workbench application icon+>>48 byte 7 kickstart icon+>>48 byte 6 device icon+>>48 byte 5 garbage icon+>>48 byte 4 project icon+>>48 byte 3 tool icon+>>48 byte 2 drawer icon+>>48 byte 1 disk icon+>2 beshort 1 +0 beshort 0xe310 Amiga Workbench+#+0 belong 0x000003e7 AmigaOS object/library data+0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary+0 belong 0x000003fa AmigaOS shared library+#+# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)+#++# amigaos: file(1) magic for AmigaOS binary formats:+#------------------------------------------------------------------------------+>>13 string >\ DATE %s+>8 string FILE\ dump file,+>>23 string >\ DATE %s+>>>25 string >\ Unused %s+>>23 string X+>8 string TAPESTART\ DATE tape header file,+0 string AMANDA:\ AMANDA ad2ZCn5h6 Y - +  p 7  Y 7 V  s = Km8OOg,PdZY+>>4 byte 145 \b, advanced RT simple @ L!+>>4 byte 130 \b, hybrid @ L2+>>4 byte 129 \b, hybrid @ L1+>>4 byte 114 \b, basic animation text @ L2+>>4 byte 113 \b, basic animation text @ L1+>>4 byte 100 \b, simple face basic animation @ L2+>>4 byte 99 \b, simple face basic animation @ L1+>>4 byte 98 \b, simple face animation @ L2+>>4 byte 97 \b, simple face animation @ L1+>>4 byte 81 \b, scalable texture @ L1+>>4 byte 66 \b, n-bit @ L2+>>4 byte 53 \b, main @ L4+>>4 byte 51 \b, main @ L3+>>4 byte 50 \b, main @ L2+>>4 byte 34 \b, core @ L2+>>4 byte 33 \b, core @ L1+>>4 byte 18 \b, simple scalable @ L2+>>4 byte 17 \b, simple scalable @ L1+>>4 byte 4 \b, simple @ L0+>>4 byte 3 \b, simple @ L3+>>4 byte 2 \b, simple @ L2+>>4 byte 1 \b, simple @ L1+>>>9 byte&0xF8 32 \b, face+>>>9 byte&0xF8 24 \b, mesh+>>>9 byte&0xF8 16 \b, still texture+>>>9 byte&0xF8 8 \b, video+>>>>10 byte&0xF0 64 \b, face+>>>>10 byte&0xF0 48 \b, mesh+>>>>10 byte&0xF0 32 \b, still texture+>>>>10 byte&0xF0 16 \b, video+>>>9 byte &0x80+>>5 belong 0x000001B5+>3 byte 0xB0 \b, v4+>>6 byte x \b @ L %u+>>4 byte 88 \b, extended+>>4 byte 77 \b, main+>>4 byte 66 \b, baseline+>3 byte&0x1F 0x07 \b, H.264 video+>3 byte 0xBB \b, v1/2, multiplex (missing pack header)+>>4 byte ^0x40 \b, v1, system multiplex+>>4 byte &0x40 \b, v2, program multiplex+>3 byte 0xBA+0 belong&0xFFFFFF00 0x00000100 MPEG sequence+>>7 byte x \b @ L %u+>>5 byte 88 \b, extended+>>5 byte 77 \b, main+>>5 byte 66 \b, baseline+>4 byte&0x1F 0x07 \b, H.264 video+0 belong 0x00000001 JVT NAL sequence+# Scans for all common MPEG header start codes+# MPEG sequences++#>8 string/B qt \b, Apple QuickTime movie+#>8 string/B M4B \b, MPEG v4 system, iTunes bookmarked+#>8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted+#>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC+>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC+>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile+>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)+>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)+>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)+>8 string 3gp \b, MPEG v4 system, 3GPP+#>8 string/B jp2 \b, JPEG 2000+>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML+>8 string mp7t \b, MPEG v4 system, MPEG v7 XML+>8 string mp42 \b, MPEG v4 system, version 2+>8 string mp41 \b, MPEG v4 system, version 1ad**9p(_ o  J i & _  W  CF b/ f{$fZ'^*)+>>>17 byte&0xF0 96 \b@H-14+>>>17 byte&0xF0 64 \b@HL+>>>16 byte&0x0F 5 \b SP+>>>16 byte&0x0F 4 \b MP+>>>16 byte&0x0F 3 \b SNR+>>>16 byte&0x0F 2 \b Spt+>>>16 byte&0x0F 1 \b HP+>>12 belong 0x000001B5 \b, v2,+>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video+>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video+>3 byte 0xB3+>>4 byte&0xF8 32 \b, face (missing profile header)+>>4 byte&0xF8 24 \b, mesh (missing profile header)+>>4 byte&0xF8 16 \b, still texture (missing profile header)+>>4 byte&0xF8 8 \b, video (missing profile header)+>>>5 byte&0xF0 64 \b, face (missing profile header)+>>>5 byte&0xF0 48 \b, mesh (missing profile header)+>>>5 byte&0xF0 32 \b, still texture (missing profile header)+>>>5 byte&0xF0 16 \b, video (missing profile header)+>>4 byte &0x80+>3 byte 0xB5 \b, v4+>>4 byte 253 \b, FGS @ L5+>>4 byte 252 \b, FGS @ L4+>>4 byte 251 \b, FGS @ L3+>>4 byte 250 \b, FGS @ L2+>>4 byte 249 \b, FGS @ L1+>>4 byte 248 \b, FGS @ L0+>>4 byte 247 \b, advanced simple @ L3b+>>4 byte 245 \b, advanced simple @ L5+>>4 byte 244 \b, advanced simple @ L4+>>4 byte 243 \b, advanced simple @ L3+>>4 byte 242 \b, advanced simple @ L2+>>4 byte 241 \b, advanced simple @ L1+>>4 byte 240 \b, advanced simple @ L0+>>4 byte 232 \b, core studio @ L4+>>4 byte 231 \b, core studio @ L3+>>4 byte 230 \b, core studio @ L2+>>4 byte 229 \b, core studio @ L1+>>4 byte 228 \b, simple studio @ L4+>>4 byte 227 \b, simple studio @ L3+>>4 byte 226 \b, simple studio @ L2+>>4 byte 225 \b, simple studio @ L1+>>4 byte 211 \b, advanced scalable texture @ L3+>>4 byte 210 \b, advanced scalable texture @ L2+>>4 byte 209 \b, advanced scalable texture @ L1+>>4 byte 194 \b, advanced core @ L2+>>4 byte 193 \b, advanced core @ L1+>>4 byte 180 \b, advanced coding efficiency @ L4+>>4 byte 179 \b, advanced coding efficiency @ L3+>>4 byte 178 \b, advanced coding efficiency @ L2+>>4 byte 177 \b, advanced coding efficiency @ L1+>>4 byte 163 \b, core scalable @ L3+>>4 byte 162 \b, core scalable @ L2+>>4 byte 161 \b, core scalable @ L1+>>4 byte 148 \b, advanced RT simple @ L4+>>4 byte 147 \b, advanced RT simple @ L3+>>4 byte 146 \b, advanced RT simple @ L2ad6^Ca'a> u A  w E  { @  @ i 8  rAr9v:X$Ty> f2^]+>>>5 beshort&0x0FFF 0x00F0 \b NTSC+>>4 beshort&0xFFF0 0x1600 \b, CIF+>>>7 byte&0xF0 0x10 \b, 4:3+>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120+>>>7 byte&0xF0 0x10 \b, 4:3+>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160+>>>7 byte&0xF0 0x10 \b, 4:3+>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240+>>>7 byte&0xF0 0x10 \b, 4:3+>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P+>>>7 byte&0xF0 0xC0 \b, NTSC 4:3+>>>7 byte&0xF0 0x80 \b, PAL 4:3+>>>7 byte&0xF0 0x40 \b, 11:5+>>>7 byte&0xF0 0x30 \b, 16:9+>>>7 byte&0xF0 0x20 \b, 4:3+>>>5 beshort&0x0FFF 0x0240 \b PAL+>>>5 beshort&0x0FFF 0x01E0 \b NTSC+>>4 beshort&0xFFF0 0x2C00 \b, 4CIF+>>>7 byte&0xF0 0x10 \b, 4:3+>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture+>>>7 byte&0xF0 0x10 \b, 16:9+>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I+>>>7 byte&0xF0 0x10 \b, 16:9+>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P+>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video+>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video+>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video+>>>81 byte ^0x08 \b interlaced+>>>81 byte &0x08 \b progressive+>>>81 byte&0xF0 160 \b@LL+>>>81 byte&0xF0 128 \b@ML+>>>81 byte&0xF0 96 \b@H-14+>>>81 byte&0xF0 64 \b@HL+>>>80 byte&0x0F 5 \b SP+>>>80 byte&0x0F 4 \b MP+>>>80 byte&0x0F 3 \b SNR+>>>80 byte&0x0F 2 \b Spt+>>>80 byte&0x0F 1 \b HP+>>76 belong 0x000001B5 \b, v2,+>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video+>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video+>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video+>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video+>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video+>>>>>145 byte ^0x08 \b interlaced+>>>>>145 byte &0x08 \b progressive+>>>>>145 byte&0xF0 160 \b@LL+>>>>>145 byte&0xF0 128 \b@ML+>>>>>145 byte&0xF0 96 \b@H-14+>>>>>145 byte&0xF0 64 \b@HL+>>>>>144 byte&0x0F 5 \b SP+>>>>>144 byte&0x0F 4 \b MP+>>>>>144 byte&0x0F 3 \b SNR+>>>>>144 byte&0x0F 2 \b Spt+>>>>>144 byte&0x0F 1 \b HP+>>>>140 belong 0x000001B5 \b, v2,+>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video+>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video+>>>75 byte &0x01+>>11 byte &0x02+>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video+>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video+>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video+>>>17 byte ^0x08 \b interlaced+>>>17 byte &0x08 \b progressive+>>>17 byte&0xF0 160 \b@LL+>>>17 byte&0xF0 128 \b@MLad ]Md/S x A n 6 a & ~ G  c a >  g1Y#Kj7Os;~>5]\+>2 byte&0xF0 0x40 \b, 64 kBits+>2 byte&0xF0 0x30 \b, 56 kBits+>2 byte&0xF0 0x20 \b, 48 kBits+>2 byte&0xF0 0x10 \b, 32 kBits+# rates+0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1+# MP2, M1A++#>3 byte&0x03 3 \b, NR: CCIT J.17+#>3 byte&0x03 1 \b, NR: 50/15 ms+#>3 byte &0x04 \b, Original Source+#>3 byte &0x08 \b, Copyrighted+#>2 byte &0x01 \b, Custom Flag+#>2 byte &0x02 \b, Packet Pad+#>1 byte ^0x01 \b, Data Verify+>3 byte&0xC0 0xC0 \b, Monaural+>3 byte&0xC0 0x80 \b, 2x Monaural+>3 byte&0xC0 0x40 \b, JntStereo+>3 byte&0xC0 0x00 \b, Stereo+# channels/options+>2 byte&0x0C 0x08 \b, 32 kHz+>2 byte&0x0C 0x04 \b, 48 kHz+>2 byte&0x0C 0x00 \b, 44.1 kHz+# timing+>2 byte&0xF0 0xE0 \b, 320 kBits+>2 byte&0xF0 0xD0 \b, 256 kBits+>2 byte&0xF0 0xC0 \b, 224 kBits+>2 byte&0xF0 0xB0 \b, 192 kBits+>2 byte&0xF0 0xA0 \b, 160 kBits+>2 byte&0xF0 0x90 \b, 128 kBits+>2 byte&0xF0 0x80 \b, 112 kBits+>2 byte&0xF0 0x70 \b, 96 kBits+>2 byte&0xF0 0x60 \b, 80 kBits+>2 byte&0xF0 0x50 \b, 64 kBits+>2 byte&0xF0 0x40 \b, 56 kBits+>2 byte&0xF0 0x30 \b, 48 kBits+>2 byte&0xF0 0x20 \b, 40 kBits+>2 byte&0xF0 0x10 \b, 32 kBits+# rates+0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1+# MP3, M1A++# modified to fully support MPEG ADTS+# from dreesen@math.fu-berlin.de+# MPEG ADTS Audio (*.mpx/mxa/aac)++>>11 byte &0x04 \b, Constrained+>>7 byte&0x0F 8 \b, 60 fps+>>7 byte&0x0F 7 \b, 59.94 fps+>>7 byte&0x0F 6 \b, 50 fps+>>7 byte&0x0F 5 \b, 30 fps+>>7 byte&0x0F 4 \b, 29.97 fps+>>7 byte&0x0F 3 \b, 25 fps+>>7 byte&0x0F 2 \b, 24 fps+>>7 byte&0x0F 1 \b, 23.976 fps+>>>7 byte&0xF0 0x40 \b, 11:5+>>>7 byte&0xF0 0x30 \b, 16:9+>>>7 byte&0xF0 0x20 \b, 4:3+>>>5 beshort&0x0FFF 0x0240 \b PAL 625+>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525+>>4 beshort&0xFFF0 0x1E00 \b, SVCD+>>>7 byte&0xF0 0x40 \b, 11:5+>>>7 byte&0xF0 0x30 \b, 16:9+>>>7 byte&0xF0 0x20 \b, 4:3+>>>5 beshort&0x0FFF 0x0240 \b PAL 625+>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525+>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU+>>>>7 byte&0xF0 0x40 \b, 11:5+>>>>7 byte&0xF0 0x30 \b, 16:9+>>>>7 byte&0xF0 0x20 \b, 4:3+>>>5 beshort&0x0FFF 0x0240 \b PAL 625+>>>7 byte&0xF0 0xC0 \b, NTSC 4:3+>>>7 byte&0xF0 0x80 \b, PAL 4:3+>>>7 byte&0xF0 0x40 \b, 11:5+>>>7 byte&0xF0 0x30 \b, 16:9+>>>7 byte&0xF0 0x20 \b, 4:3+>>>5 beshort&0x0FFF 0x0120 \b PALad6L^(P r ? + U  v :  z r <  d . V ~t? \$Ha_S h2Z$+>2 byte&0xF0 0xC0 \b, 128 kBits+>2 byte&0xF0 0xB0 \b, 112 kBits+>2 byte&0xF0 0xA0 \b, 96 kBits+>2 byte&0xF0 0x90 \b, 80 kBits+>2 byte&0xF0 0x80 \b, 64 kBits+>2 byte&0xF0 0x70 \b, 56 kBits+>2 byte&0xF0 0x60 \b, 48 kBits+>2 byte&0xF0 0x50 \b, 40 kBits+>2 byte&0xF0 0x40 \b, 32 kBits+>2 byte&0xF0 0x30 \b, 24 kBits+>2 byte&0xF0 0x20 \b, 16 kBits+>2 byte&0xF0 0x10 \b, 8 kBits+# rate+0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2+# MP3, M2A++#>3 byte&0x03 3 \b, NR: CCIT J.17+#>3 byte&0x03 1 \b, NR: 50/15 ms+#>3 byte &0x04 \b, Original Source+#>3 byte &0x08 \b, Copyrighted+#>2 byte &0x01 \b, Custom Flag+#>2 byte &0x02 \b, Packet Pad+#>1 byte ^0x01 \b, Data Verify+>3 byte&0xC0 0xC0 \b, Monaural+>3 byte&0xC0 0x80 \b, 2x Monaural+>3 byte&0xC0 0x40 \b, JntStereo+>3 byte&0xC0 0x00 \b, Stereo+# channels/options+>2 byte&0x0C 0x08 \b, 32 kHz+>2 byte&0x0C 0x04 \b, 48 kHz+>2 byte&0x0C 0x00 \b, 44.1 kHz+# timing+>2 byte&0xF0 0xE0 \b, 448 kBits+>2 byte&0xF0 0xD0 \b, 416 kBits+>2 byte&0xF0 0xC0 \b, 384 kBits+>2 byte&0xF0 0xB0 \b, 352 kBits+>2 byte&0xF0 0xA0 \b, 320 kBits+>2 byte&0xF0 0x90 \b, 288 kBits+>2 byte&0xF0 0x80 \b, 256 kBits+>2 byte&0xF0 0x70 \b, 224 kBits+>2 byte&0xF0 0x60 \b, 192 kBits+>2 byte&0xF0 0x50 \b, 160 kBits+>2 byte&0xF0 0x40 \b, 128 kBits+>2 byte&0xF0 0x30 \b, 96 kBits+>2 byte&0xF0 0x20 \b, 64 kBits+>2 byte&0xF0 0x10 \b, 32 kBits+# rate+0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1+# MPA, M1A++#>3 byte&0x03 3 \b, NR: CCIT J.17+#>3 byte&0x03 1 \b, NR: 50/15 ms+#>3 byte &0x04 \b, Original Source+#>3 byte &0x08 \b, Copyrighted+#>2 byte &0x01 \b, Custom Flag+#>2 byte &0x02 \b, Packet Pad+#>1 byte ^0x01 \b, Data Verify+>3 byte&0xC0 0xC0 \b, Monaural+>3 byte&0xC0 0x80 \b, 2x Monaural+>3 byte&0xC0 0x40 \b, JntStereo+>3 byte&0xC0 0x00 \b, Stereo+# channels/options+>2 byte&0x0C 0x08 \b, 32 kHz+>2 byte&0x0C 0x04 \b, 48 kHz+>2 byte&0x0C 0x00 \b, 44.1 kHz+# timing+>2 byte&0xF0 0xE0 \b, 384 kBits+>2 byte&0xF0 0xD0 \b, 320 kBits+>2 byte&0xF0 0xC0 \b, 256 kBits+>2 byte&0xF0 0xB0 \b, 224 kBits+>2 byte&0xF0 0xA0 \b, 192 kBits+>2 byte&0xF0 0x90 \b, 160 kBits+>2 byte&0xF0 0x80 \b, 128 kBits+>2 byte&0xF0 0x70 \b, 112 kBits+>2 byte&0xF0 0x60 \b, 96 kBits+>2 byte&0xF0 0x50 \b, 80 kBitsadhNT!q9 ] % v t h (  | F  n 8  ` * p=b+F  Ks=e/P hg+>3 byte&0xC0 0x80 \b, 2x Monaural+>3 byte&0xC0 0x40 \b, JntStereo+>3 byte&0xC0 0x00 \b, Stereo+# channels/options+>2 byte&0x0C 0x08 \b, 16 kHz+>2 byte&0x0C 0x04 \b, 24 kHz+>2 byte&0x0C 0x00 \b, 22.05 kHz+# timing+>2 byte&0xF0 0xE0 \b, 256 kBits+>2 byte&0xF0 0xD0 \b, 224 kBits+>2 byte&0xF0 0xC0 \b, 192 kBits+>2 byte&0xF0 0xB0 \b, 176 kBits+>2 byte&0xF0 0xA0 \b, 160 kBits+>2 byte&0xF0 0x90 \b, 144 kBits+>2 byte&0xF0 0x80 \b, 128 kBits+>2 byte&0xF0 0x70 \b, 112 kBits+>2 byte&0xF0 0x60 \b, 96 kBits+>2 byte&0xF0 0x50 \b, 80 kBits+>2 byte&0xF0 0x40 \b, 64 kBits+>2 byte&0xF0 0x30 \b, 56 kBits+>2 byte&0xF0 0x20 \b, 48 kBits+>2 byte&0xF0 0x10 \b, 32 kBits+# rate+0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2+# MPA, M2A++#>3 byte&0x03 3 \b, NR: CCIT J.17+#>3 byte&0x03 1 \b, NR: 50/15 ms+#>3 byte &0x04 \b, Original Source+#>3 byte &0x08 \b, Copyrighted+#>2 byte &0x01 \b, Custom Flag+#>2 byte &0x02 \b, Packet Pad+#>1 byte ^0x01 \b, Data Verify+>3 byte&0xC0 0xC0 \b, Monaural+>3 byte&0xC0 0x80 \b, 2x Monaural+>3 byte&0xC0 0x40 \b, JntStereo+>3 byte&0xC0 0x00 \b, Stereo+# channels/options+>2 byte&0x0C 0x08 \b, 16 kHz+>2 byte&0x0C 0x04 \b, 24 kHz+>2 byte&0x0C 0x00 \b, 22.05 kHz+# timing+>2 byte&0xF0 0xE0 \b, 160 kBits+>2 byte&0xF0 0xD0 \b, 144 kBits+>2 byte&0xF0 0xC0 \b, 128 kBits+>2 byte&0xF0 0xB0 \b, 112 kBits+>2 byte&0xF0 0xA0 \b, 96 kBits+>2 byte&0xF0 0x90 \b, 80 kBits+>2 byte&0xF0 0x80 \b, 64 kBits+>2 byte&0xF0 0x70 \b, 56 kBits+>2 byte&0xF0 0x60 \b, 48 kBits+>2 byte&0xF0 0x50 \b, 40 kBits+>2 byte&0xF0 0x40 \b, 32 kBits+>2 byte&0xF0 0x30 \b, 24 kBits+>2 byte&0xF0 0x20 \b, 16 kBits +>2 byte&0xF0 0x10 \b, 8 kBits+# rate +0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2+# MP2, M2A++#>3 byte&0x03 3 \b, NR: CCIT J.17+#>3 byte&0x03 1 \b, NR: 50/15 ms+#>3 byte &0x04 \b, Original Source+#>3 byte &0x08 \b, Copyrighted+#>2 byte &0x01 \b, Custom Flag+#>2 byte &0x02 \b, Packet Pad+#>1 byte ^0x01 \b, Data Verify+>3 byte&0xC0 0xC0 \b, Monaural+>3 byte&0xC0 0x80 \b, 2x Monaural+>3 byte&0xC0 0x40 \b, JntStereo+>3 byte&0xC0 0x00 \b, Stereo+# channels/options+>2 byte&0x0C 0x08 \b, 16 kHz+>2 byte&0x0C 0x04 \b, 24 kHz+>2 byte&0x0C 0x00 \b, 22.05 kHz+# timing+>2 byte&0xF0 0xE0 \b, 160 kBits+>2 byte&0xF0 0xD0 \b, 144 kBitsadfM\$w=;. t >  f 0 X " x F 2 \ $ }Ai2yC Zk1I \-fe+>2 byte&0xc0 0x40 \b LC+>2 byte&0xc0 0x00 \b Main+>>2 byte &0xC0 \b LTP+# profile+>1 byte ^0x08 \b, v4+>1 byte &0x08 \b, v2+0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC+# Live or stored single AAC stream (used with MPEG-2 systems)++>>4 byte &0x20 \b, Home Source+>>4 byte &0x40 \b, Original Stream(s)+>>7 byte &0x10 \b, 8 or more streams+>>7 byte &0x08 \b, 4 or more streams+>>7 byte&0x1E 0x06 \b, 3 streams+>>7 byte&0x1E 0x04 \b, 2 streams+>>7 byte&0x1E 0x02 \b, single stream+>>4 byte ^0x10 \b, CBR+>>4 byte &0x10 \b, VBR+>4 byte ^0x80+>>13 byte &0x20 \b, Home Flag+>>13 byte &0x40 \b, Original Source+>>4 byte &0x80 \b, Copyrighted+>>16 byte &0x10 \b, 8 or more streams+>>16 byte &0x08 \b, 4 or more streams+>>16 byte&0x1E 0x06 \b, 3 streams+>>16 byte&0x1E 0x04 \b, 2 streams+>>16 byte&0x1E 0x02 \b, single stream+>>13 byte ^0x10 \b, CBR+>>13 byte &0x10 \b, VBR+>4 byte &0x80+0 string ADIF MPEG ADIF, AAC+# Stored AAC streams (instead of the MP4 format)++# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio++#>3 byte&0x03 3 \b, NR: CCIT J.17+#>3 byte&0x03 1 \b, NR: 50/15 ms+#>3 byte &0x04 \b, Original Source+#>3 byte &0x08 \b, Copyrighted+#>2 byte &0x01 \b, Custom Flag+#>2 byte &0x02 \b, Packet Pad+#>1 byte ^0x01 \b, Data Verify+>3 byte&0xC0 0xC0 \b, Monaural+>3 byte&0xC0 0x80 \b, 2x Monaural+>3 byte&0xC0 0x40 \b, JntStereo+>3 byte&0xC0 0x00 \b, Stereo+# channels/options+>2 byte&0x0C 0x08 \b, 8 kHz+>2 byte&0x0C 0x04 \b, 12 kHz+>2 byte&0x0C 0x00 \b, 11.025 kHz+# timing+>2 byte&0xF0 0xE0 \b, 160 kBits+>2 byte&0xF0 0xD0 \b, 144 kBits+>2 byte&0xF0 0xC0 \b, 128 kBits+>2 byte&0xF0 0xB0 \b, 112 kBits+>2 byte&0xF0 0xA0 \b, 96 kBits+>2 byte&0xF0 0x90 \b, 80 kBits+>2 byte&0xF0 0x80 \b, 64 kBits+>2 byte&0xF0 0x70 \b, 56 kBits+>2 byte&0xF0 0x60 \b, 48 kBits+>2 byte&0xF0 0x50 \b, 40 kBits+>2 byte&0xF0 0x40 \b, 32 kBits+>2 byte&0xF0 0x30 \b, 24 kBits+>2 byte&0xF0 0x20 \b, 16 kBits+>2 byte&0xF0 0x10 \b, 8 kBits+# rate +0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5+# MP3, M25A++#>3 byte&0x03 3 \b, NR: CCIT J.17+#>3 byte&0x03 1 \b, NR: 50/15 ms+#>3 byte &0x04 \b, Original Source+#>3 byte &0x08 \b, Copyrighted+#>2 byte &0x01 \b, Custom Flag+#>2 byte &0x02 \b, Packet Pad+#>1 byte ^0x01 \b, Data Verify+>3 byte&0xC0 0xC0 \b, MonauraladGV_,^( Y M  k 6 M  f 2 i 3 b,z86_G) pFCm&~f1[+#+# iso 13818 transport stream++#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3+# \003. Most of them start with non-null values at hex offset 0x34 or so.+# Based on empirical evidence, DL version 3 have several nulls following the+#>43 byte x %d commands+#>42 byte x %d screens,+#>1 byte >2 - unknown format,+#>1 byte 2 - medium format (160x100,4 images/screen),+#>1 byte 1 - large format (320x200,1 image/screen),+#0 byte 2 DL version 2+#>43 byte x %d commands+#>42 byte x - %d screens,+#0 byte 1 DL version 1, medium format (160x100, 4 images/screen)+#+# 255 (hex FF)! The DL format is really bad.+# at decimal offsets 2 and 22, respectively, but they are XOR'ed with+# Note that title and author appear in the two 20-byte chunks+#+# careful!+# -appears- to work. Note that it might catch other files, too, so be+# I couldn't find a real magic number for these, however, this+#+# XXX - collision with most `mips' magic+# DL animation format++>16 leshort x ticks/frame=%d+>12 leshort x depth=%d,+>10 leshort x height=%d pixels,+>8 leshort x width=%d pixels,+>6 leshort x - %d frames+4 leshort 0xAF12 FLC file+# FLC animation format+>16 leshort x ticks/frame=%d+>12 leshort x depth=%d,+>10 leshort x height=%d pixels,+>8 leshort x width=%d pixels,+>6 leshort x - %d frames,+4 leshort 0xAF11 FLI file+# FLI animation format++0 beshort 0x4DE1 MPEG-4 LO-EP audio stream+>>4 byte &0x40 \b, 8 or more streams+>>4 byte &0x20 \b, 4 or more streams+>>4 byte&0x78 0x18 \b, 3 streams+>>4 byte&0x78 0x10 \b, 2 streams+>>4 byte&0x78 0x08 \b, single stream+>3 byte&0xC0 0+>>4 byte &0x20 \b, 8 or more streams+>>4 byte &0x08 \b, 4 or more streams+>>4 byte&0x3C 0x0C \b, 3 streams+>>4 byte&0x3C 0x08 \b, 2 streams+>>4 byte&0x3C 0x04 \b, single stream+>3 byte&0xE0 0x40+#>1 beshort&0x1FFF x \b, %u byte packet+0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS+# Live MPEG-4 audio streams (instead of RTP FlexMux)++#>3 byte &0x08 \b, Copyrighted+#>3 byte &0x10 \b, Home Source+#>3 byte &0x20 \b, Original Stream+#>2 byte &0x02 \b, Custom Flag+#>1 byte ^0x01 \b, Data Verify+>2 beshort &0x01C0 \b, surround + side+>2 beshort&0x01c0 0x0180 \b, surround + LFE+>2 beshort&0x01c0 0x0140 \b, surround+>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE+>2 beshort&0x01c0 0x00c0 \b, stereo + center+>2 beshort&0x01c0 0x0080 \b, stereo+>2 beshort&0x01c0 0x0040 \b, monaural+# channels+>2 byte&0x3c 0x2c \b, 8 kHz+>2 byte&0x3c 0x28 \b, 11.025 kHz+>2 byte&0x3c 0x24 \b, 12 kHz+>2 byte&0x3c 0x20 \b, 16 kHz+>2 byte&0x3c 0x1c \b, 22.05 kHz+>2 byte&0x3c 0x18 \b, 24 kHz+>2 byte&0x3c 0x14 \b, 32 kHz+>2 byte&0x3c 0x10 \b, 44.1 kHz+>2 byte&0x3c 0x0c \b, 48 kHz+>2 byte&0x3c 0x08 \b, 64 kHz+>2 byte&0x3c 0x04 \b, 88.2 kHz+>2 byte&0x3c 0x00 \b, 96 kHz+# timing+>2 byte&0xc0 0x80 \b SSRadip&hJ1 l C  d b # O *  l j =  | 1 }aE&${y(DLsL ^DBT:8+>12 belong &0x80000000 AutoRemove,+>8 byte 9 NOS 2.x,+>8 byte 8 NOS 1.x,+0 string package4 Newton package,++>16 belong x version %d+>12 belong &0x02000000 UseFasterCompression,+>12 belong &0x04000000 Relocation,+>12 belong &0x10000000 NoCompression,+>12 belong &0x40000000 CopyProtect,+>12 belong &0x80000000 AutoRemove,+0 string package1 Newton package, NOS 2.x,++>16 belong x version %d+>12 belong &0x02000000 UseFasterCompression,+>12 belong &0x04000000 Relocation,+>12 belong &0x10000000 NoCompression,+>12 belong &0x40000000 CopyProtect,+>12 belong &0x80000000 AutoRemove,+0 string package0 Newton package, NOS 1.x,+# from Ruda Moura +# magic for Newton PDA package formats++0 belong 0x00051607 AppleDouble encoded Macintosh file+0 belong 0x00051600 AppleSingle encoded Macintosh file+0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data+0 string NuFile NuFile archive (apple ][) data+0 string \x76\xff Squeezed (apple ][) data+0 string \x0aGL Binary II (apple ][) data+0 string FiLeStArTfIlEsTaRt binscii (apple ][) text+#+# apple: file(1) magic for Apple file formats+#------------------------------------------------------------------------------++0 long 0100554 APL workspace (Ken's original?)+#+# workspaces)+# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL+#------------------------------------------------------------------------------++>0x21 byte x v%x+0 string DVDVIDEO-VMG Video manager,+>0x21 byte x v%x+0 string DVDVIDEO-VTS Video title set,+# From: "Stefan A. Haubenthal" ++>0x42 ubeshort >0 %dHz audio+>0x42 ubeshort 0 no audio+>0x26 ubeshort x %dµs,+>0x36 ubeshort x %d,+>0x34 ubeshort x %d x+>0 byte x GameCube movie,+>6 string >\0 v%s+0 string HVQM4 %s+#+# From Mark Sheppard , 2002-10-03+# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube+#---------------------------------------------------------------------------++0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file+0 string/b #VRML\ V1.0\ ascii VRML 1 file+# VRML (Virtual Reality Modelling Language)++3 string \x0D\x0AVersion:Vivo Vivo video data+# Vivo video (Wolfram Kleff)++>>20 belong x %d+>>16 belong x %d x+>4 belong 0x0d0a1a0a+>4 belong !0x0d0a1a0a CORRUPTED,+0 string \x8bJNG JNG video data,+# JNG Video Format, ++>>20 belong x %d+>>16 belong x %d x+>4 belong 0x0d0a1a0a+>4 belong !0x0d0a1a0a CORRUPTED,+0 string \x8aMNG MNG video data,+# MNG Video Format, ++0 belong 0x3026b275 Microsoft ASF+# Microsoft Advanced Streaming Format (ASF) ++>3 byte ^0x80 (NTSC)+>3 byte &0x80 (PAL)+>4 byte ^0x01 (DV) movie file+>4 byte &0x01 (DVCPRO) movie file+0 belong&0xffffff00 0x1f070000 DIF+# DIF digital video file format ++>188 byte !0x47 CORRUPTED+0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data+# conti_count 4 bit 0+# adaptfld_ctrl 2 bit 1 or 3+# scrambling 2 bit -+# PID 13 bit 0x0000+# priority 1 bit -+# payload_start 1 bit 1+# error_ind 1 bit -+# syncbyte 8 bit 0x47+# disturb)+# cut from an input device data right in the middle, but this shouldn't+# that starts with PAT properly. it won't work for stream data, that is+# (the following is a little bit restrictive and works fine for a stream+# from Oskar Schirmer Feb 3, 2001 (ISO 13818.1)adLZp+d r + ( S ' u r + C A  t q ' m@uRP|9mj#O[u"+8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background+8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background+8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background+8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background++# to have a solid-colored line at the bottom of the screen.+# Nevertheless this will manage to catch a lot of images that happen+#+# or, occasionally, 8184.+# address (if preserved) -- 8192 or 16384 -- and their length -- 8192+# there's really no reasonably way to distinguish them except for their+# These are actually just bit-for-bit dumps of the frame buffer, so+#+# Some attempts at images.++#2 belong&0xFF00FF 0x040008 Fantavision movie data+# Probably :-)++# Will they cause too many conflicts?+# I don't know what these values really mean, but they seem to recur.+#+# Broderbund Fantavision++#>5 byte x \b, build number %d+#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data+# XXX Conflicts with ELF+# some sort of date code instead of the two zero bytes at 6 and 7+# This will not identify ORCA/M source files, since those have+# +# ORCA/EZ assembler:++#>2 leshort x \b, first line number %d+0 belong&0xff00ff 0x80000 Applesoft BASIC program data++# number is less than 256. Yuck.+# written at its usual memory location of 2048 and its first line+# This is incredibly sloppy, but will be true if the program was+#+# Applesoft BASIC:++#131 string CM AppleWorks spreadsheet data+#131 string CA AppleWorks spreadsheet data+#131 string RM AppleWorks spreadsheet data+#131 string RA AppleWorks spreadsheet data++# recalculation.+# row- or column-order recalculation; the A or M means automatic or manual+# Likewise, this isn't really meant as a magic number. The R or C means+#+# AppleWorks spreadsheet:++#30 string \x02R AppleWorks database data+#30 string \x01R AppleWorks database data+#30 string \x02D AppleWorks database data+#30 string \x01D AppleWorks database data++# mean that the cursor should move either down or right when you press Return.+# categories" and "left to right, top to bottom," respectively; the D and R+# that I could find. The 1 and 2 really mean "order in which you defined+# This isn't really a magic number, but it's the closest thing to one+#+# AppleWorks database:++#>91 byte x \b, left margin %d+>92 byte&0x01 >0 \b, with mail merge+>90 byte&0x01 >0 \b, paginated+>85 byte&0x01 >0 \b, zoomed+4 string O==== AppleWorks word processor data++# necessary to check the tab stops that follow it to avoid false positives.+# The "O" is really the magic number, but that's so common that it's+#+# a file has a tab stop set in the first four columns this will fail.+# This matches the standard tab stops for an AppleWorks file, but if+#+# AppleWorks word processor:++# Eric Fischer +#+# in the files themselves.+# therefore programmers never felt much need to include type information+# and especially Apple ProDOS have strong typing in the file system and+# In general, Apple II formats are hard to identify because Apple DOS+#+# been encapsulated by any of the above archivers.+# been transferred as raw binary data from an Apple, without having+# The following entries for the Apple II are for files that have++>12 belong &0x10000000 NoCompression,+>12 belong &0x40000000 CopyProtect,ad'_OMo  [   s 1 i @  | b = ; r o % nkG{<IG~`3jD$ rN*++>22 string X -- out of date+>19 string B and an EB hash table+>19 string L and an EL hash table+>21 string B with MIPSEB members+>21 string L with MIPSEL members+>20 string U with MIPS Ucode members+0 string !\n__________E MIPS archive+#+# MIPS archive (needs to go before regular portable archives)++0 string = archive+0 long 0100554 apl workspace+0 short 0177545 old PDP-11 archive+0 long 0177545 old archive+0 short 0177555 very old PDP-11 archive+0 long 0177555 very old archive+# other archives++#>136 ledate x created: %s+>84 string gz \b, uses gzip compression+>81 string bz2 \b, uses bzip2 compression+>68 string >\0 (format %s)+>8 string debian-binary Debian binary package+>8 string debian-split part of multipart Debian package+0 string !\ndebian+#+# Debian package (needs to go before regular portable archives)++0 string 070702 ASCII cpio archive (SVR4 with CRC)+0 string 070701 ASCII cpio archive (SVR4 with no CRC)+0 string 070707 ASCII cpio archive (pre-SVR4 or odc)+0 short 0143561 byte-swapped cpio archive+0 short 070707 cpio archive+# character-header formats and thus are strings, not numbers.+# are defined as "short"s; I think all the new formats are+# The SVR4 "cpio(4)" hints that there are additional formats, but they+#+# from the machine running "file" with "byte-swapped cpio archive".+# to indicate archives produced on machines with the opposite byte order+# byte order as the machine running "file" with "cpio archive", and+# The idea is to indicate archives produced on machines with the same+# Yes, the top two "cpio archive" formats *are* supposed to just be "short".+#+# cpio archives++257 string ustar\040\040\0 GNU tar archive+257 string ustar\0 POSIX tar archive+# POSIX tar archives++# pre-POSIX "tar" archives are handled in the C code.+# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.+#+# extracting compressed archives)+# archive: file(1) magic for archive formats (see also "msdos" for self-+#------------------------------------------------------------------------------++>7 string BUILDER Builder Object+>7 string MACRO Macro+>7 string SPREADSHEETS Spreadsheet+>7 string RASTER Bitmap+>7 string GRAPHICS Graphic+>7 string WORDS Words Document+0 string *BEGIN Applixware+#+# From: Peter Soos +# applix: file(1) magic for Applixware+#------------------------------------------------------------------------------++#>0x410 string disk\ image UDIF read/write image (UDRW)+#0 long 0x45520200+# information seems to be more useful.+# data" entry - however since this entry is more specific - this+# Note that this entry is recognized correctly by the "Apple Partition +#+#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)+#0 long 0x7801730d+#+# line matches and the second doesn't then it is not of that type.+# specified type if both of the lines are correct - i.e. if the first+# The intended meaning of these tests is, that the file is only of the +#+# particularly the "Apple Partition data" entry.+# entry. Note this entry should be placed before the mac filesystem section, +# Note there might be some problems with the "VAX COFF executable" +#+# These entries are disabled for now until we fix the following issues.+# From Johan Gade.+# Apple Universal Disk Image Format (UDIF) - dmg files.++0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font++# Beagle Bros. Apple Mechanic fonts++8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange backgroundad'a=:wt, f E $ p V S ~ { U / , i , )  e b ;   @_!n3\ w/|]<#rU;% +# HA archiver (Greg Roelofs, newt@uchicago.edu)++>3 byte >0 %d]+>7 byte 9 os: VAX/VMS+>7 byte 8 os: NeXT+>7 byte 7 os: Atari ST+>7 byte 6 os: Apple ][ GS+>7 byte 5 os: OS/2+>7 byte 4 os: Macintosh+>7 byte 3 os: Amiga+>7 byte 2 os: Unix+>7 byte 1 os: PRIMOS+>7 byte 0 os: MS-DOS+>34 string x original name: %s,+>8 byte &0x20 backup,+>8 byte &0x10 slash-switched,+>8 byte &0x04 multi-volume,+>5 byte x \b, v%d,+0 leshort 0xea60 ARJ archive data+# ARJ archiver (jason@jarthur.Claremont.EDU)++0 string Archive\000 RISC OS archive (ArcFS format)+0 string \032 RISC OS archive (spark format)+#0 string \032archive RISC OS archive (ArcFS format)+#>1 string archive (ArcFS format)+#0 byte 0x1a RISC OS archive+# version (not tested)]+# [GRR: the original entries collide with ARC, above; replaced with combined+# I can't create either SPARK or ArcFS archives so I have not tested this stuff+# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)++0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched+0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed+0 lelong&0x8080ffff 0x0000031a ARC archive data, packed+0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed+0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed+0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW+# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.+# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),+# filename of the first file (null terminated). Since some types collide+# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS+# The first byte is the magic (0x1a), byte 2 is the compression type for+#+# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)++0 lelong 0x39bee PDP-11 4.0 archive+0 lelong 0x39bed PDP-11 old archive+#+# From "pdp" (but why a 4-byte quantity?)+#+>8 string __.SYMDEF random library+0 leshort 0177545 old PDP-11 archive+>8 string __.SYMDEF random library+0 lelong 0177545 old VAX archive+#+# be a random library (it said 0xff65 rather than 0177545).+# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus+#+0 leshort 0177555 very old PDP-11 archive+0 lelong 0177555 very old VAX archive+0 long 0x213c6172 archive file+#+0 belong 0x3c61723e VAX 5.0 archive+0 belong 0x65ff0000 VAX 3.0 archive+#+# with "leshort", "lelong", and "string", that's no longer necessary....+# thingies, to help you recognize VAX files on big-endian machines;+# XXX - from "vax", which appears to collect a bunch of byte-swapped+#+0 string = archive+0 string \ System V Release 1 ar archive+>0 beshort 5 - absolute code program module+>0 beshort 4 - debug break-pointed module+>0 beshort 3 - shared library module+>0 beshort 2 - object archive+>0 belong =65539 - post SR9.5+>0 belong =65538 - pre SR9.5+>8 string __.SYMDEF random library+0 string ! current ar archive+#+# "ar" archives?+# and absolute code program modules in the same format as new-style+# XXX - did Aegis really store shared libraries, breakpointed modules,+#+# 0 string = archive+# 0 string \ System V Release 1 ar archive+#+# and for SVR1 archives, we have:+#+# 0 long 0x213c6172 archive file+# 0 string ! current ar archive+#+# "! thingies? Note that 0x213c6172 is+#++0 string -h- Software Tools format archive textad fy]8_;9 v U 3 1 l = k =  S 3 1 i g 2 `^"tGE5 y\EC1A>U_"{F4 ++# Better magic in debian-additions.+# MPi: All CABs have version 1.3, so this is pointless.+#>24 byte x \b.%d+#>25 byte x v%d+#0 string MSCF\0\0\0\0 Microsoft cabinet file data,+# by David Necas (Yeti) +# Microsoft cabinets ++0 leshort 0xeb81 PRCS packaged project+# file which is recognized by the following entry: +# http://prcs.sourceforge.net) generates a packaged project+# The Project Revision Control System (see+# From Rafael Laboissiere ++5 string -pc1- PopCom compressed executable (CP/M)+2 string -pms- PMarc SFX archive (CP/M, DOS)+2 string -pm2- PMarc archive data [pm2]+2 string -pm1- PMarc archive data [pm1]+2 string -pm0- PMarc archive data [pm0]+#+# PMA (CP/M derivative of LHA)+#+0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data+#+# "binary Computer Graphics Metafile" format.+# LBR. NB: May conflict with the questionable +#++10 string #\ This\ is\ a\ shell\ archive shell archive text+# Shell archives++>>>71 byte x \b.%d++>>70 byte >0 extract: v%d+>42 lelong 0xfdc4a7dc \b,+>>33 byte x \b.%d++>32 byte >0 \b, modify: v%d+>>>7 byte >47 \b%c+>>6 byte >47 \b%c+>4 byte >48 \b, v%c.+20 lelong 0xfdc4a7dc Zoo archive data+# Zoo archiver++>4 byte 0x14 \b, at least v2.0 to extract+>4 byte 0x0b \b, at least v1.1 to extract+>4 byte 0x0a \b, at least v1.0 to extract+>4 byte 0x09 \b, at least v0.9 to extract+0 string PK\003\004 Zip archive data+# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)++0 string UC2\x1a UC2 archive data+# I can't figure out the self-extracting form of these buggers...+# UC2 archiver (Greg Roelofs, newt@uchicago.edu)++0 string SQSH squished archive data (Acorn RISCOS)+# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)++>35 byte 3 os: Unix+>35 byte 2 os: Win32+>35 byte 1 os: OS/2+>35 byte 0 os: MS-DOS+>44 byte x v%0x,+0 string Rar! RAR archive data,+# RAR archiver (Greg Roelofs, newt@uchicago.edu)++>20 byte x - header level %d+2 string -lh7- LHa (2.x) archive data [lh7]+2 string -lh6- LHa (2.x) archive data [lh6]+2 string -lh5- LHa (2.x) archive data [lh5]+2 string -lh4- LHa (2.x) archive data [lh4]+2 string -lh3- LHa 2.x? archive data [lh3]+2 string -lh2- LHa 2.x? archive data [lh2]+2 string -lhd- LHa 2.x? archive data [lhd]+2 string -lh\40- LHa 2.x? archive data [lh ]+2 string -lzs- LHa 2.x? archive data [lzs]+# [never seen any but the last; -lh4- reported in comp.compression:]+2 string -lz5- LHarc 1.x archive data [lz5]+2 string -lz4- LHarc 1.x archive data [lz4]+2 string -lh1- LHarc 1.x archive data [lh1]+2 string -lh0- LHarc 1.x archive data [lh0]+# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)++>>0x36 string >\0 fstype %.8s+>>0x27 lelong x serial %08x,+>>0x2b string >\0 label %.11s,+>0x26 byte =0x27 -+>7 string >\0 version %.4s+0 string \351,\001JAM\\t JAM archive,+# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net++0 string HPAK HPACK archive data+# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)++#>4 byte&0x0f =0x0f first is type SPECIAL+#>4 byte&0x0f =0x0e first is type DIR+#>4 byte&0x0f =2 first is type HSC+#>4 byte&0x0f =1 first is type ASC+#>4 byte&0x0f =0 first is type CPY+#>2 leshort >1 %u files,+#>2 leshort =1 1 file,+#0 string HA HA archive data,+# This is a really bad format. A file containing HAWAII will match this...adluU0tA# u = ^ \ ( m T 3  s Q 1  ~ b 8  f8kX)cakhO-|^FDBTQIF%rROFC$+>18 beshort &00000020 executable+>18 beshort ^00000020 object+0 beshort 0560 WE32000 COFF+#+# WE32K+#+#>22 beshort >0 - version %d+#>12 belong >0 not stripped+#0 beshort 0551 3b20 COFF executable (TV)+#>22 beshort >0 - version %d+#>12 belong >0 not stripped+#0 beshort 0550 3b20 COFF executable+# The 3B20 conflicts with SCCS.+#+# 3B20+#+# (Was the problem just one of endianness?)+# The `versions' should be un-commented if they work for you.+#+# att3b: file(1) magic for AT&T 3B machines+#------------------------------------------------------------------------------+++>29 byte 0x38 Macro+>29 byte 0x32 Spreadsheet+>29 byte 0x35 Graphic+>29 byte 0x36 Words Document+0 string 2278 Aster*x Version 2+>7 string MACR Macro+>7 string SPRE Spreadsheet+>7 string GRAP Graphic+>7 string WORD Words Document+0 string *STA Aster*x+#+# From: guy@netapp.com (Guy Harris)+# strings as "long" - we assume they're just strings:+# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character+#------------------------------------------------------------------------------++>12 string x \b, was "%.12s"+0 string Packed\ File\ Personal NetWare Packed File+# DR-DOS 7.03 Packed File *.??_++>>0x2A string >\0 : %s+>>0x1 string >\0 Version %s+>0x15 string 2+0x1A string sfArk sfArk compressed Soundfont+# +# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann++#>18 lelong x Created on+# Date in MS-DOS format (whatever that is)+>5 leshort &0x8000 \b, solid+>5 leshort &0x4000 \b, locked+>5 leshort &0x2000 \b, with recovery record+>>30 string\x16*UNREGISTERED\x20VERSION* (unregistered)+>5 leshort &0x1000 \b, contains AV-String+>5 leshort &0x0800 \b, multi-volume+>5 leshort &0x0400 \b, small dictionary+>5 leshort &0x0200 \b, sfx+>5 leshort &0x0002 \b, contains comment+>>17 byte x \b (part %d),+>5 leshort &0x0080 \b, multiple volumes,+>14 byte x \b, version %d to extract+>16 byte =0x0B \b, from Next+>16 byte =0x0A \b, from Amiga+>16 byte =0x09 \b, from Vax/VMS+>16 byte =0x08 \b, from Atari+>16 byte =0x07 \b, from AppleGS+>16 byte =0x06 \b, from Primos+>16 byte =0x05 \b, from WinNT+>16 byte =0x04 \b, from MacOS+>16 byte =0x03 \b, from Unix+>16 byte =0x02 \b, from Win/32+>16 byte =0x01 \b, from OS/2+>16 byte =0x00 \b, from MS-DOS+>15 byte >0 version %d+7 string **ACE** ACE compressed archive+# by Stefan `Sec` Zehl +# ACE archive (from http://www.wotsit.org/download.asp?f=ace)++0 string PK00PK\003\004 Zip archive data+# Alternate ZIP string (amc@arwen.cs.berkeley.edu)++>8 beshort x \b, ending track: %d+>6 beshort x \b, starting track: %d+>4 beshort 1 \b, 2 sided+>4 beshort 0 \b, 1 sided+>2 beshort x \b, %d sectors per track+0 beshort 0x0e0f Atari MSA archive data+# Atari MSA archive - Teemu Hukkanen ++0 string d8:announce BitTorrent file+# Felix von Leitner ++>48 leshort >0 - file number %d+>48 leshort =0 - Index file+0 string PAR\0 PARity archive data+# Parity archive reconstruction file, the 'par' file format now used on Usenet.+############################################################################++>13 string >3 version %s+>>14 beshort !0x677a (not gzipped)+>>14 beshort 0x677a (gzipped)+>13 string 3 version 3+4 string gtktalog\ GTKtalog catalog data,+# by David Necas (Yeti) +# GTKtalog catalogs adaY<!f<  4 z T 1  p D  k =  S  iQ;$"lI\4U*k5iS<:ig<+# is this next line right? it came this way...+0 string Creative\ Voice\ File Creative Labs voice data+0 string SBI SoundBlaster instrument data+0 string CTMF Creative Music (CMF) data++>12 beshort&0x8000 >0 SMPTE+>12 beshort&0x7fff x at 1/%d+>10 beshort >1 \bs+>10 beshort x using %d track+>8 beshort x (format %d)+0 string MThd Standard MIDI data+# Creative Labs AUDIO stuff++>16 lelong >0 %d Hz+>20 lelong 4 quad,+>20 lelong 2 stereo,+>20 lelong 1 mono,+>12 belong 27 8-bit A-law (CCITT G.711),+>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),+>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),+>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)+#>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding),+>12 belong 21 Music kit DSP commands,+>12 belong 20 16-bit linear with emphasis and compression,+>12 belong 19 16-bit linear compressed,+>12 belong 18 16-bit linear with emphasis,+>12 belong 14 32-bit fixed point,+>12 belong 13 24-bit fixed point,+>12 belong 12 16-bit fixed point,+>12 belong 11 8-bit fixed point,+>12 belong 10 DSP program,+>12 belong 8 Fragmented sample data,+>12 lelong 7 64-bit IEEE floating point,+>12 lelong 6 32-bit IEEE floating point,+>12 lelong 5 32-bit linear PCM,+>12 lelong 4 24-bit linear PCM,+>12 lelong 3 16-bit linear PCM,+>12 lelong 2 8-bit linear PCM [REF-PCM],+>12 lelong 1 8-bit ISDN mu-law,+0 lelong 0x0064732E DEC audio data:+# that uses little-endian encoding and has a different magic number+# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format++>16 belong >0 %d Hz+>20 belong 4 quad,+>20 belong 2 stereo,+>20 belong 1 mono,+>12 belong 27 8-bit A-law (CCITT G.711),+>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),+>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),+>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)+#>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding),+>12 belong 21 Music kit DSP commands,+>12 belong 20 16-bit linear with emphasis and compression,+>12 belong 19 16-bit linear compressed,+>12 belong 18 16-bit linear with emphasis,+>12 belong 14 32-bit fixed point,+>12 belong 13 24-bit fixed point,+>12 belong 12 16-bit fixed point,+>12 belong 11 8-bit fixed point,+>12 belong 10 DSP program,+>12 belong 8 Fragmented sample data,+>12 belong 7 64-bit IEEE floating point,+>12 belong 6 32-bit IEEE floating point,+>12 belong 5 32-bit linear PCM,+>12 belong 4 24-bit linear PCM,+>12 belong 3 16-bit linear PCM,+>12 belong 2 8-bit linear PCM [REF-PCM],+>12 belong 1 8-bit ISDN mu-law,+0 string .snd Sun/NeXT audio data:+# Sun/NeXT audio data++#+# and others+# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),+#+# audio: file(1) magic for sound formats (see also "iff")+#------------------------------------------------------------------------------++>364 string >\0 of '%s'+0 string \000\004\036\212\200 3b2 core file+# core file for 3b2 +#+#>22 beshort >0 - version %d+#>18 beshort &00040000 and MAU hardware required+#>18 beshort &00020000 - 32100 required+>12 belong >0 not stripped+0 beshort 0561 WE32000 COFF executable (TV)+>22 beshort >0 - version %d+>20 beshort 0443 (target shared library)+>20 beshort 0413 (demand paged)+>20 beshort 0410 (pure)+>20 beshort 0407 (impure)+>18 beshort &00040000 and MAU hardware required+>18 beshort &00020000 32100 required+>18 beshort ^00010000 N/A on 3b2/300 w/paging+>12 belong >0 not strippedadjiMKnV9"   N >   g 8 6  ~ e c 5   ` G  } { C }a& x\!uY X<sqV kN* nN1 +>0x36 string >\0 author: "%s"+>0x16 string >\0 name: "%s"+>16 beshort >0 default song: %d+>14 beshort >1 %d songs,+>14 beshort =1 single song,+>4 beshort >0 w/ header v%d,+0 string RSID RSID sidtune PlaySID compatible++>0x56 string >\0 copyright: "%s"+>0x36 string >\0 author: "%s"+>0x16 string >\0 name: "%s"+>16 beshort >0 default song: %d+>14 beshort >1 %d songs,+>14 beshort =1 single song,+>4 beshort >0 w/ header v%d,+0 string PSID PlaySID v2.2+ (AMIGA) sidtune++0 string SIDPLAY\ INFOFILE Sidplay info file+# added name,author,(c) and new RSID type by 2003-06-24+# sidfiles ++0 string TOC TOC sound file+#+# TOC sound files -Trevor Johnson ++>0 string >\0 Title: "%s"+1080 string 32CN 32-channel Taketracker module sound data+>0 string >\0 Title: "%s"+1080 string 16CN 16-channel Taketracker module sound data+#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data+#1082 string CH+# Not good enough.+>0 string >\0 Title: "%s"+1080 string OKTA 8-channel Oktalyzer module sound data+>0 string >\0 Title: "%s"+1080 string CD81 8-channel Octalyser module sound data+>0 string >\0 Title: "%s"+1080 string 8CHN 8-channel Fasttracker module sound data+>0 string >\0 Title: "%s"+1080 string 6CHN 6-channel Fasttracker module sound data+>0 string >\0 Title: "%s"+1080 string 4CHN 4-channel Fasttracker module sound data+>0 string >\0 Title: "%s"+1080 string FLT8 8-channel Startracker module sound data+>0 string >\0 Title: "%s"+1080 string FLT4 4-channel Startracker module sound data+>0 string >\0 Title: "%s"+1080 string M!K! 4-channel Protracker module sound data+>0 string >\0 Title: "%s"+1080 string M.K. 4-channel Protracker module sound data+21 string BMOD2STM Screamtracker 2 module sound data+21 string/c !SCREAM! Screamtracker 2 module sound data++>17 string >\0 Title: "%s"+0 string Extended\ Module: Fasttracker II module sound data++0 string UN05 MikMod UNI format module sound data++>14 string >/0 ultratracker V1.%.1s module sound data+0 string MAS_UTrack_V00+# added title printing on 2003-06-24+# by Steve McIntyre (stevem@chiark.greenend.org.uk)+# Taken from loader code from mikmod version 2.14+#++0 string GF1PATCH100\0ID#000002\0 Old GUS patch+0 string GF1PATCH110\0ID#000002\0 GUS patch++# From +# Gravis UltraSound patches++>0 string >\0 Title: "%s"+0x2c string SCRM ScreamTracker III Module sound data++#>4 string >\15 Title: "%s"+#0 string FAR Module sound data++0 string MAS_U ULT(imate) Module sound data+#0 string JN Composer 669 Module sound data (extended format)+#0 string if Composer 669 Module sound data+#0 string MTM MultiTracker Module sound file+# Too short...+# fixed by 2003-06-24+# Oct 31, 1995+# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]++0 string .RMF RealMedia file+0 belong 0x2e7261fd RealAudio sound file+# Real Audio (Magic .ra\0375)++>83 byte 1 (song)+>83 byte 0 (module)+>45 byte x %d instruments+>4 byte&0x0f x \b.%d,+>4 byte&0xf0 x version %d+0 string EMOD Extended MOD sound data,+# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]+# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED++>4 belong x - version %d+0 belong 0x4e54524b MultiTrack sound data+# first entry is also the string "NTRK"++>22 byte >0 \b.%d+>23 byte >0 - version %d+>19 byte 0x1Aad zyQ)trO v \ ? #  l J (  z B k P 0  p ; % ljMkW+w_C/{gM4 pEVS7lU96  +0 string DBM0 DIGI Booster Pro Module+#+>610 string >\0 \b, "%s"+>>>>23 byte >0 \b%c+>>>22 byte >0 \b%c+>>21 byte >0 \b%c+>20 byte >0 %c+0 string DIGI\ Booster\ module\0 %s+#+0 string OKTASONG Oktalyzer module data+#+>3 byte =1 2 module data+>3 byte =0 1 module data+0 string THX AHX version+#+0 string SymM Symphonie SymMOD music file+0 string MED MED_Song+0 string OctaMEDCmpr OctaMED Soundstudio compressed file+0 string MMD3 OctaMED Soundstudio music file, version 3+0 string MMD1 OctaMED Pro music file, version 1+0 string MMD0 MED music file, version 0+# From: Cory Dikkers +# audio++>30 byte 1 packed+>30 byte 0 unpacked+>31 byte ^4 8bit+>31 byte &4 16bit little endian+>31 byte ^2 mono+>31 byte &2 stereo+>0 byte >2 adlib drum+>0 byte 2 adlib melody+>0 byte 1 sample+76 string SCRS Scream Tracker Sample+# From +#+# scream tracker: file(1) magic for Scream Tracker sample files++>23 byte 3 16kHz+>23 byte 2 50kHz+>23 byte 1 33kHz+>22 byte 0xC9 non-looped+>22 byte 0x49 looped+0 string LM8953 Yamaha TX Wave+# From +# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files++>30 byte !0 %d samples+>28 leshort !0 ITv%x+0 string IMPI Impulse Tracker Instrument+>18 byte ^4 mono+>18 byte &4 stereo+>18 byte ^2 8 bit+>18 byte &2 16 bit+0 string IMPS Impulse Tracker Sample++# samples in Impulse Tracker's native format.+# These are the /etc/magic entries to decode modules, instruments, and+# From ++>0 string >\0 "%s"+60 string IM10 Imago Orpheus module sound data -+# Imago Orpheus module (audio/x-imf)++>42 leshort !0 created w/ITv%x+>40 leshort !0 compatible w/ITv%x+>4 string >\0 "%s"+0 string IMPM Impulse Tracker module sound data -+# Impuse tracker module (audio/x-it)++>122 byte&0x1 =0 NTSC+>122 byte&0x1 =1 PAL+>122 byte&0x2 =1 dual PAL/NTSC+>6 byte x %d tracks,+>5 byte x version %d,+>78 string >\0 %s),+>46 string >\0 %s, copyright+>14 string >\0 ("%s" by+0 string NESM\x1a NES Sound File+# NSF (NES sound file) magic++>4 ubyte <0xff \b%d tag+>3 ubyte <0xff \b%d.+0 string ID3 MP3 file with ID3 version 2.+# ID3 version 2 tags +0 string _SGI_SoundTrack SGI SoundTrack project file+# SGI SoundTrack ++>22 byte =7 replay 47.261 KHz+>22 byte =6 replay 43.885 KHz+>22 byte =5 replay 32.336 KHz+>22 byte =4 replay 21.942 KHz+>22 byte =3 replay 16.168 Khz+>22 byte =2 replay 10.971 Khz+>22 byte =1 replay 8.084 KHz+>22 byte =0 replay 5.485 KHz+#>21 ubyte <=127 note %d,+>18 beshort =-1 loop,+>18 beshort =0 no loop,+>22 belong&0x00ffffff x %d Hz,+>16 beshort =-1 signed,+>16 beshort =0 unsigned,+>14 beshort x %d bits+>12 beshort =-1 stereo,+>12 beshort =0 mono,+0 string 2BIT Audio Visual Research file,+# Audio Visual Research ++0 string SOUND\ SAMPLE\ DATA\ Sample Vision file+# Sample Vision ++0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file+# NIST SPHERE ++0 belong 0x64a30400 IRCAM file (NeXT)+0 belong 0x64a30300 IRCAM file (MIPS little-endian)+0 belong 0x64a30200 IRCAM file (Sun)+0 belong 0x64a30100 IRCAM file (VAX)+# VAX and MIPS files are little-endian; Sun and NeXT are big-endian+# IRCAM ++>0x56 string >\0 copyright: "%s"addywS tG  T  y = ~ h F c .  ~ X 2 [7^3U*pM'%h0x3V7+>8 leshort >0 flags %x,+>6 leshort >0 compression level %d,+>4 leshort >0 version %d,+0 string MAC\\t X/Monkey audio,+# monkeysaudio for magic.mime+# From danny.milo@gmx.net (Danny Milosavljevic)++0 string TFMX-SONG TFMX module sound data+# From "Simon Hosie++0 string A#S#C#S#S#L#HUB Kimwitu++ data+# Kimwitu++ uses a slightly different magic+0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data+# Synthesizer Generator and Kimwitu share their file format++>37 string Propellerhead created by ReBirth+>29 string ReBorn created by ReBorn+8 string RB40 RBS Song file+# David J. Singer +# ReBorn Song Files (.rbs)++0 string VBOX VBOX voice message data+# (ISDN) VBOX voice message file (Wolfram Kleff)++>>>22 belong 0 \b, length unknown+>>>22 belong >0 \b, %u samples+>>21 byte&0xf 0 \b+>>21 byte&0xf >0 \b, >4G samples+>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz+>>17 belong&0xfffff0 0x177000 \b, 96 kHz+>>17 belong&0xfffff0 0x01f400 \b, 8 kHz+>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz+>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz+>>17 belong&0xfffff0 0x03e800 \b, 16 kHz+>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz+>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz+>>17 belong&0xfffff0 0x07d000 \b, 32 kHz+>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz+>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz+# some common sample rates+>>20 byte&0xe 0xe \b, 8 channels+>>20 byte&0xe 0xc \b, 7 channels+>>20 byte&0xe 0xa \b, 6 channels+>>20 byte&0xe 0x8 \b, 5 channels+>>20 byte&0xe 0x6 \b, 4 channels+>>20 byte&0xe 0x4 \b, 3 channels+>>20 byte&0xe 0x2 \b, stereo+>>20 byte&0xe 0x0 \b, mono+>>20 beshort&0x1f0 0x170 \b, 24 bit+>>20 beshort&0x1f0 0x0f0 \b, 16 bit+>>20 beshort&0x1f0 0x0b0 \b, 12 bit+>>20 beshort&0x1f0 0x070 \b, 8 bit+>>20 beshort&0x1f0 0x050 \b, 6 bit+>>20 beshort&0x1f0 0x030 \b, 4 bit+# some common bits/sample values+>4 byte&0x7f 0 \b+>4 byte&0x7f >0 \b, unknown version+0 string fLaC FLAC audio bitstream data+# From: Przemyslaw Augustyniak +# Free lossless audio codec ++>>32 byte x , %d tracks+>20 string Ver01.00 Ver. 1.00+0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody+# Sharp Jisaku Melody format for PDC+0 string MMMD Yamaha SMAF file+# Yamaha SMAF format+0 string \210NOA\015\012\032 NOA Nancy Codec Movie file+# NOA Nancy Codec file+# From: Takeshi Hamasaki ++0 string Extended\40Instrument: Fast Tracker II Instrument+0 string MODINFO1 Open Cubic Player Module Inforation MDZ+>4 string >\0 Title: "%s"+0 string AMF AMF Module+>0 string >\0 Composer: "%s"+0x426 string MaDoKaN96 XMS Adlib Module+0 string RTMM RTM Module+0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD+0 string MT20 MadTracker 2.0 Module MT2+>0 string >\32 Title: "%s"+44 string PTMF Poly Tracker PTM Module+0 string PSM\32 Protracker Studio PSM Module+0 string DMDL DigiTrakker MDL Module+0 string SONG DigiTrekker DTM Module+0 string DSM\32 Dynamic Studio Module DSM+>0x2B string >\0 Composer: "%s"+>0xD string >\0 Title: "%s"+>4 byte x v%i+0 string DDMF Xtracker DMF Module+0 string Extreme Extreme Tracker AMS Module v1.3+0 string AMShdr\32 Velvet Studio AMS Module v2.2+# From: 2003-06-24++>16 string >\0d \b, "%s"+0 string FTMN FaceTheMusic module+#+>16 string >\0 \b, "%s"+>>5 byte x \b%02X+>4 byte >0 V%X.adOgY$!pU8 f  F D &  { i g  > l 0  iC^9rT0.ca/oK~V' nR4 ++>36 belong 0xb4100001 (uses shared libs)+>16 belong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&077777777 0600407 sparc++>36 belong 0xb4100001 (uses shared libs)+>16 belong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&077777777 0600410 sparc pure++>36 belong 0xb4100001 (uses shared libs)+>16 belong >0 not stripped+>0 byte ^0x80 executable+>>20 belong >4096 dynamically linked executable+>>20 belong =4096 dynamically linked executable+>>20 belong <4096 shared library+>0 byte &0x80+0 belong&077777777 0600413 sparc demand paged+# same as in SunOS 4.x, except for static shared libraries++>32 byte 0x6a (uses shared libs)+>16 lelong >0 not stripped+0 lelong 0413 386 demand paged pure executable++>32 byte 0x6a (uses shared libs)+>16 lelong >0 not stripped+0 lelong 0410 386 pure executable++>32 byte 0x6a (uses shared libs)+>16 lelong >0 not stripped+0 lelong 0407 386 executable++>32 byte 0x6a (uses shared libs)+>16 lelong >0 not stripped+0 lelong 0314 386 compact demand paged pure executable++#+# bsdi: file(1) magic for BSD/OS (from BSDI) objects+#------------------------------------------------------------------------------+>8 string __.SYMDEF random library+0 string ! b.out archive+# b.out archive (hp-rt on i960)+#+>16 long >0 not stripped+0 long 0x10d i960 b.out relocatable object+#+# i80960 b.out objects and archives+#+#0 short 0520 tty630 layers executable+# Note that 0520 is the same as COFF+# Need more values for WE32 DMD executables.+0 short 03001 VAX-order 68k Blit mpx/mux executable+0 short 0406 VAX-order2 68k Blit mpx/mux executable+0 long 0406 68k Blit mpx/mux executable+0 short 03401 VAX-order 68K Blit (standalone) executable+#0 short 0407 VAX-order2 68K Blit (standalone) executable+#0 long 0407 68K Blit (standalone) executable+#+# "VAX-order" and "VAX-order2"?+# little-endian machines as well? If so, what's the deal with+# XXX - should this be redone with "be" and "le", so that it works on+#+# Note that this 0407 conflicts with several other a.out formats...+#+# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine+#------------------------------------------------------------------------------++>11 byte x \b%c+>10 byte x \b%c+>9 byte x with version %c.+>8 string =V big endian+>8 string =v little endian+>7 string =- saved as 64-bits+>7 string =_ saved as 32-bits+0 string =BLENDER Blender3D,++# at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender+# You can get latest version with comments and details about the format+# support the rule, so mail GSR if problems with it. Rule version: 1.1.+# data from Ton Roosendaal . Ton or his company do not+# Coded by Guillermo S. Romero using the+#+# blender: file(1) magic for Blender 3D data files+#------------------------------------------------------------------------------+>>36 belong&0x8 0x8 gzdata+>>36 belong&0x4 0x4 gzip+>>36 belong&0x2 0x2 gotpic+>>36 belong&0x1 0x1 ram+>4 belong 4+>4 belong x - version %d+0 string bFLT BFLT executable+#+# From Philippe De Muyter +#+# bFLT: file(1) magic for BFLT uclinux binary files+#------------------------------------------------------------------------------++>24 lelong >0 frames %d+>12 lelong >0 samplerate %d,+>10 leshort >0 channels %d,adbNi1/ ; t q ! = r E C % S P N  v:z9Z-+Y3 ya_<US(&vs4  ++0 string/b #\040xmcd CDDB(tm) format CD text data++#+# CDDB-enabled CD player applications.+# This is the /etc/magic entry to decode datafiles as used by+#+# From +#+# CDDB: file(1) magic for CDDB(tm) format CD text data files+#------------------------------------------------------------------------------++0 belong 0xFF424CFF WRAptor packer (c64)++0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot+0 beshort 0x38CD C64 PCLink Image++0 string C64Image PC64 Freezer Image+>8 string >\0 "%s"+0 string C64File PC64 Emulator file++2 string -LH1- LHA archive (c64)+9 string PSUR ARC archive (c64)++>9 byte x tracks: %i+>8 byte x version: $i+0 string GCR-1541 GCR Image++0 belong 0x43154164 X64 Image+0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image+0x61800 belong 0x28034400 D81 Image+0x16500 belong 0x12014180 D71 Image+0x16500 belong 0x12014100 D64 Image++# From +#+# c64: file(1) magic for various commodore 64 related files+#------------------------------------------------------------------------------++>10 regex .+\ -c\\t text (non-compressed)+>>10 regex .+\ -q\\t with inverted index+>7 string >14+# versions 11 and 15, so look for -q if version is above 14:+# The inverted index functionality was added some time betwen+# truncate it) and mostly redundant.+# We skip the path here, because it is often long (so file will+>7 string x version %.2s+0 string cscope cscope reference data+# From: Mikhail Teterin ++#0 string // C++ program text+#0 string /* C or REXX program text+# in which case rm it; ascmagic will catch real C programs+# this first will upset you if you're a PL/1 shop...++#0 string /*\ XPM\ */ X pixmap image data+# if you uncomment "/*" for C/REXX below, also uncomment this entry+# XPM icons (Greg Roelofs, newt@uchicago.edu)++#+# c-lang: file(1) magic for C programs (or REXX)+#------------------------------------------------------------------------------++0 string AC1014 AutoCad (release 14)+0 string AC1012 AutoCad (release 12)+# AutoCad, from Nahuel Greco++>4 string \030\000\000 CIT File+>>30 string \026\105 DGN File+>>30 string \172\104 DGN File+>>30 string \372\104 DGN File+>3 string \002+0 string \010\011\376 Microstation+# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F+# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682+# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928+# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2+#+# http://filext.com/detaillist.php?extdetail=CIT+# http://filext.com/detaillist.php?extdetail=DGN+# http://www.wotsit.org/search.asp+# +# raster underlays to Microstation DGN (vector) drawings.+# CIT is the proprietary raster format (similar to TIFF) used to attach+# DGN is the default file extension of Microstation/Intergraph CAD files.+# Written October 30, 2003 by Lester Hightower+# Microstation DGN/CIT Files (www.bentley.com)++>5 string \064\000\000\000\000 DWG ver. R14+>5 string \062\000\000\000\000 DWG ver. R13+0 string \101\103\061\060\061 AutoCAD+# Based on the DWG File Format Specifications at http://www.opendwg.org/+# Written December 01, 2003 by Lester Hightower+# AutoCAD DWG versions R13/R14 (www.autodesk.com)++#+# autocad: file(1) magic for cad files+#------------------------------------------------------------------------------adcI<9  D   S 5 g d b ( & $ \ M K ' t B  MEpnM&HkH"<yV3sQ/ +# as SVR3.1's "file" doesn't support anything of the "!074000,000000"+#+# >18 short&074000 074000 TEST+# >18 short&074000 010000 C3 R1+# >18 short&074000 004000 C2 R1+# >18 short&074000 000000 C1 R1 +#+# comparing it with the second, and rewrite it as:+# I shall assume it's ANDing the field with the first value and+#+# >18 short !074000,074000 TEST+# >18 short !074000,010000 C3 R1+# >18 short !074000,004000 C2 R1+# >18 short !074000,000000 C1 R1 +#+# XXX - what's the "!" stuff:+#+# XXX - what byte order does the Clipper use?+#+# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.+#------------------------------------------------------------------------------++#./windows/claris/userd.spl: data+#./windows/claris/clworks.prf: data+#./windows/claris/clworks.lbl: data+#./windows/claris/xtndtran.lst: data+#./windows/claris/xtndtran.l32: data+#./windows/claris/useng.ndx: data+# other claris files++# I am not sure: 000 210 034 000 000+# .chy Hyphenation file++# starts with \0 but no magic header+# .mth Thesaurus++# a t r i s t sp ^ S cr nl d i v sp #+#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043+# soh S p f 8 U D sp ^ S cr nl p o d i+#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151+# I am not sure about a magic header:+# .usp are user dictionary bits++0 string \002\271\262\000\040\002\000\164 Claris works dictionary+# .msp a dictionary file I am not sure about this I have only one .msp file++0 string \020\341\000\000\010\010 Claris Works pallete files .plt+# .plt+0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document+# .cwk+# Claris works files++>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.+514 string \377\377\377\377\001 Claris clip art?+>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.+514 string \377\377\377\377\000 Claris clip art?+#null to byte 1000 octal+#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000+#*+#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000+# .pct claris works clip art files++# Version 3.0+# Claris Works a word processor, etc.+# "H. Nanosecond" +# claris: file(1) magic for claris+#------------------------------------------------------------------------------+++0 string RuneCT Citrus locale declaration for LC_CTYPE++#+# citrus locale declaration+#------------------------------------------------------------------------------+>7 string >\0 for '%s'+0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode+>7 string >\0 for '%s'+0 belong&0xffffff00 0x85011400 cisco IOS microcode+# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.+#+# Most cisco file-formats are covered by the generic elf code+#+# cisco: file(1) magic for cisco Systems routers+#------------------------------------------------------------------------------++0 string {title Chord text file+#+# File format is actually free, but many distributed files begin with `{title'+# From Philippe De Muyter +#+# chord: file(1) magic for Chord music sheet typesetting utility input files+#------------------------------------------------------------------------------++0 string \\1cw ChiWriter file+>5 string >\0 version %s+0 string \\1cw\ ChiWriter file+#+# chi: file(1) magic for ChiWriter files+#------------------------------------------------------------------------------ad)^t/a^. p S + w V <  t ` L 8 $  h f  { c B @   [31^!r1Rz/o,ro:+# AT&T Bell Labs' Plan 9 shell++0 string BEGIN awk script text+0 string/b #!\ /usr/bin/awk awk script text executable+0 string/b #!\ /bin/awk awk script text executable+#+0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable+0 string/b #!\ /usr/bin/gawk GNU awk script text executable+0 string/b #!\ /bin/gawk GNU awk script text executable+0 string/b #!\ /usr/local/bin/nawk new awk script text executable+0 string/b #!\ /usr/bin/nawk new awk script text executable+0 string/b #!\ /bin/nawk new awk script text executable+0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable+0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable+0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable+0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable+0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable+# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)+#++0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable+0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable+0 string/b #!\ /bin/tcsh Tenex C shell script text executable+0 string/b #!\ /bin/ksh Korn shell script text executable+# korn shell magic, sent by George Wu, gwu@clyde.att.com+0 string/b #!\ /bin/csh C shell script text executable+0 string/b #!\ /bin/sh Bourne shell script text executable+0 string : shell archive or script for antique kernel text+#+# commands: file(1) magic for various shells and interpreters+#------------------------------------------------------------------------------++>>16 string <: v%.4s raw result text+>>>20 string <: v%.4s raw result text+>>15 string _SSL \b_SSL+>13 string <: \b%.2s+0 string BEGIN\040SPECWEB SPECweb++>>37 string <: v%.4s raw result text+>32 string <: \b%.4s+17 string version=SPECjbb SPECjbb++>>12 string . raw result text+>>8 string <: \b%.4s+>4 string .cpu CPU+0 string spec SPEC++# Cloyce D. Spradling +#+# spec: file(1) magic for SPEC raw results (*.raw, *.rsf)+#------------------------------------------------------------------------------++4 string prof CLIPPER instruction profile+4 string pipe CLIPPER instruction trace+>54 byte 4 -Cscb+>54 byte 3 -Cspw+>54 byte 2 -Cssw+>54 byte 1 -Csnc+>53 byte 4 -Cdcb+>53 byte 3 -Cdpw+>53 byte 2 -Cdsw+>53 byte 1 -Cdnc+>52 byte 4 -Ctcb+>52 byte 3 -Ctpw+>52 byte 2 -Ctsw+>52 byte 1 -Ctnc+>48 long&01 01 alignment trap enabled+>22 short >0 - version %d+>12 long >0 not stripped+>20 short 0443 (target shared library)+>20 short 0413 (paged)+>20 short 0411 (separate I&D)+>20 short 0410 (pure)+>20 short 0407 (impure)+>18 short&074000 074000 TEST+>18 short&074000 010000 C3 R1+>18 short&074000 004000 C2 R1+>18 short&074000 000000 C1 R1 +0 short 0577 CLIPPER COFF executable+>22 short >0 - version %d+>12 long >0 not stripped+>20 short 0443 (target shared library)+>20 short 0413 (demand paged)+>20 short 0411 (pure)+>20 short 0410 (5.2 compatible)+>20 short 0407 (impure)+0 short 0575 CLIPPER COFF executable (VAX #)+#+# old-style "&"s into new-style "&"s, which just didn't work at all).+# implemented (at least not after I blew off the bogus code to turn+# man page for this version of "magic", nor does it appear to be+# somebody else thought was a good idea; it's not documented in the+# in CLIX, or something AT&T added in SVR3.2 or later, or something+# sort, nor does SunOS 4.x, so either it's something Intergraph addedad at0k><- ^ & $ A x b K 5   d + t - * g%# \ >_L. qQ/pn#wUS+0 short 0x1fff compacted data+#+# byte-order independent, and one of which is byte-order dependent?+# XXX - why *two* entries for "compacted data", one of which is++0 short 0x1f1f old packed data+# This magic number is byte-order-independent.+#+>2 belong =1 \b, %d character originally+>2 belong >1 \b, %d characters originally+0 string \037\036 packed data+# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis++>8 byte 4 \b, max speed+>8 byte 2 \b, max compression+### >4 ledate x last modified: %s,+>3 byte &0x20 \b, encrypted+>3 byte &0x10 \b, comment+>9 byte =0x0B \b, from Win/32+>9 byte =0x0A \b, from Tops/20+>9 byte =0x07 \b, from MacOS+>9 byte =0x06 \b, from OS/2+>9 byte =0x05 \b, from Atari+>9 byte =0x03 \b, from Unix+>9 byte =0x02 \b, from VMS+>9 byte =0x01 \b, from Amiga+>9 byte =0x00 \b, from MS-DOS+>>10 string x \b, was "%s"+>3 byte&0xC =0x08+>3 byte &0x04 \b, extra field+>3 byte &0x02 \b, continuation+>3 byte &0x01 \b, ASCII+>2 byte >8 \b, unknown method+>2 byte <8 \b, reserved method+0 string \037\213 gzip compressed data+# other than 8 ("deflate", the only method defined in RFC 1952).+# * Produce shorter output - notably, only report compression methods+# * Original filename is only at offset 10 if "extra field" absent+# Edited by Chris Chittleborough , March 2002+# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)++>2 byte&0x1f x %d bits+>2 byte&0x80 >0 block compressed+0 string \037\235 compress'd data+# standard unix compress++# because it tries to uncompress it to figure out what's inside.+# Formats for "compress" proper have been moved into "compress.c",+# Formats for various forms of compressed data+#+# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.+#+# compress: file(1) magic for pure-compression formats (no archives)+#------------------------------------------------------------------------------++0 string submsc Message Sequence Chart (subchart)+0 string msc Message Sequence Chart (chart)+0 string mscdocument Message Sequence Chart (document)+# Added by W. Borgert .+# described in ITU-T Z.120, mainly used for communication protocols.+# MSC (message sequence charts) are a formal description technique,++>>&1 string >\n %s+>&3 string $SuiteId+>>&1 string >\n %s+>&2 string $SuiteId+>>&1 string >\n %s+>&1 string $SuiteId+0 string $Suite TTCN Abstract Test Suite+# Added by W. Borgert .+# It is used for conformance testing of communication protocols.+# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.++# communication+#----------------------------------------------------------------------------++0 string Zend\x00 PHP script Zend Optimizer data++0 string/b #!\ /usr/bin/php PHP script text executable+0 string/b #!\ /usr/local/bin/php PHP script text executable+0 string =+# PHP scripts++>16 string >\0 %s script text executable+0 string #!\ /usr/bin/env a+>15 string >\0 %s script text executable+0 string #!/usr/bin/env a+# using env++0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable+0 string/b #!\ /bin/bash Bourne-Again shell script text executable+# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)++0 string/b #!\ /bin/rc Plan 9 rc shell script text executablead*jsUSJ$fC# x v ] . , j g ! j Q < '  } Y < | L  XnF( ~_B%pT:gJ+^\0oC+>4 belong 0x090A0C0C very good compression+>4 belong 0x090A0B0B good compression+>4 belong 0x090A0A0A mediocre compression+>4 belong 0x09090909 fast compression+0 string PP20 Power Packer 2.0 compressed data,+0 string PP11 Power Packer 1.1 compressed data+0 string XPKF Amiga xpkf.library compressed data+# From: Cory Dikkers ++0 string \037\241 Quasijarus strong compressed data+# http://minnie.tuhs.org/Quasijarus/compress.html+# 4.3BSD-Quasijarus Strong Compression++>>17 byte =0x0E os: Win32+>>17 byte =0x0B os: WinNT+>>17 byte =0x0A os: Tops/20+>>17 byte =0x07 os: MacOS+>>17 byte =0x06 os: OS/2+>>17 byte =0x05 os: Atari+>>17 byte =0x03 os: Unix+>>17 byte =0x02 os: VMS+>>17 byte =0x01 os: Amiga+>>17 byte =0x00 os: MS-DOS+## >>25 bedate >0 last modified: %s,+>>15 byte 3 LZO1X-999,+>>15 byte 2 LZO1X-1(15),+>>15 byte 1 LZO1X-1,+>>9 beshort&0x0fff x \b%03x,+>>9 byte&0xf0 =0x20 - version 2.+>>9 byte&0xf0 =0x10 - version 1.+>>9 byte&0xf0 =0x00 - version 0.+>9 beshort >0x0939+>>14 byte =0x0E os: Win32+>>14 byte =0x0B os: WinNT+>>14 byte =0x0A os: Tops/20+>>14 byte =0x07 os: MacOS+>>14 byte =0x06 os: OS/2+>>14 byte =0x05 os: Atari+>>14 byte =0x03 os: Unix+>>14 byte =0x02 os: VMS+>>14 byte =0x01 os: Amiga+>>14 byte =0x00 os: MS-DOS+## >>22 bedate >0 last modified: %s,+>>13 byte 3 LZO1X-999,+>>13 byte 2 LZO1X-1(15),+>>13 byte 1 LZO1X-1,+>>9 beshort&0x0fff x \b%03x,+>>9 byte&0xf0 =0x00 - version 0.+>9 beshort <0x0940+0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data+# lzop from ++>3 string =9 \b, compression block size 900k+>3 string =8 \b, compression block size 800k+>3 string =7 \b, compression block size 700k+>3 string =6 \b, compression block size 600k+>3 string =5 \b, compression block size 500k+>3 string =4 \b, compression block size 400k+>3 string =3 \b, compression block size 300k+>3 string =2 \b, compression block size 200k+>3 string =1 \b, compression block size 100k+>2 byte x \b, version: %c+0 string BZ bzip compressed data+#+# by Julian Seward and others+# bzip a block-sorting file compressor++#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio+#>99 byte&0xF0 0xd0+#>66 byte&0xF0 0xd0+#>33 byte&0xF0 0xd0+#0 byte&0xF0 0xd0 data+# mismatches to be declared as data too!+# This will cause very short GSM files to be declared as data and+#+# bytes. This isn't suited for use, but maybe we can use it someday.+# There's only a magic nibble (4 bits); that nibble repeats every 33+#+# excitation/long term prediction) coding at 13 kbit/s.+# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse+# European GSM 06.10 is a provisional standard for full-rate speech++0 string \037\240 SCO compress -H (LZH) data+# SCO compress -H (LZH)++0 string \037\236 frozen file 1.0 (or gzip 0.5)+0 string \037\237 frozen file 2.1+# Freeze++>2 string x original name %s+0 beshort 0x76FD LZH compressed data,+>2 string x original name %s+0 beshort 0x76FE crunched data,+>4 string x original name %s+0 beshort 0x76FF squeezed data,+# Michael Haardt +# squeeze and crunch++>3 byte >47 \b, block size = %c00k+0 string BZh bzip2 compressed data+# bzip2++0 short 0145405 huf output+0 string \377\037 compacted data+# in the Ultrix (LE) magic file.+# This string is valid for SunOS (BE) and a matching "short" is listedadChif7 dN" } _ >  e   v P %  l D  q F $ |I"fD"vSQ. Ous"iOA31bI++>9 byte 0xBB+>8 byte 0xAA+>2 byte x \b, last in series or standalone+>0 byte x %dx16k blocks+0x280 string EAMG Super MagicDrive ROM dump+#+# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format+#------------------------------------------------------------------------------++>9 byte 0xBB+>8 byte 0xAA+>2 byte >0 \b, split ROM+>2 byte 0 \b, last in series or standalone+>0 byte x %dx16k blocks+0x280 string EAGN Super MagicDrive ROM dump+#+# genesis: file(1) magic for the Super MegaDrive ROM dump format+#------------------------------------------------------------------------------++>0x1B0 string RA with SRAM+>0x110 string >\0 %.16s+>0x120 string >\0 Name: "%.16s"+0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump+#+# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format+#------------------------------------------------------------------------------++#>0x14e long x \b, CRC: %x++>0x149 byte 4 \b, RAM: 1Mbit+>0x149 byte 3 \b, RAM: 128Kbit+>0x149 byte 2 \b, RAM: 64Kbit+>0x149 byte 1 \b, RAM: 16Kbit++>0x148 byte 0x54 \b, ROM: 12Mbit+>0x148 byte 0x53 \b, ROM: 10Mbit+>0x148 byte 0x52 \b, ROM: 9Mbit+>0x148 byte 6 \b, ROM: 16Mbit+>0x148 byte 5 \b, ROM: 8Mbit+>0x148 byte 4 \b, ROM: 4Mbit+>0x148 byte 3 \b, ROM: 2Mbit+>0x148 byte 2 \b, ROM: 1Mbit+>0x148 byte 1 \b, ROM: 512Kbit+>0x148 byte 0 \b, ROM: 256Kbit++>0x147 byte 0xFF \b, [Hudson HuC-1]+>0x147 byte 0xFE \b, [Hudson HuC-3]+>0x147 byte 0xFD \b, [Bandai TAMA5]+>0x147 byte 0x1F \b, [Pocket Camera]+>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]+>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]+>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]+>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]+>0x147 byte 0x1A \b, [ROM+MBC5+RAM]+>0x147 byte 0x19 \b, [ROM+MBC5]+>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]+>0x147 byte 0x12 \b, [ROM+MBC3+RAM]+>0x147 byte 0x11 \b, [ROM+MBC3]+>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]+>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]+>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]+>0x147 byte 0x0C \b, [ROM+MMM01+SRAM]+>0x147 byte 0x0B \b, [ROM+MMM01]+>0x147 byte 0x09 \b, [ROM+RAM+BATTERY]+>0x147 byte 0x08 \b, [ROM+RAM]+>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]+>0x147 byte 0x05 \b, [ROM+MBC2]+>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]+>0x147 byte 0x02 \b, [ROM+MBC1+RAM]+>0x147 byte 0x01 \b, [ROM+MBC1]+>0x147 byte 0x00 \b, [ROM ONLY]+>0x146 byte 0x03 \b,[SGB]+>0x134 string >\0 "%.16s"+0x104 belong 0xCEED6666 Gameboy ROM:+#+# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format+#------------------------------------------------------------------------------++>6 byte&0x04 =0x8 \b, [4-Scr]+>6 byte&0x04 =0x4 \b, [Trainer]+>6 byte&0x02 =0x2 \b, [SRAM]+>6 byte&0x01 =0x0 \b, [Horiz.]+>6 byte&0x01 =0x1 \b, [Vert.]+>5 byte x \b, %dx8k CHR+>4 byte x %dx16k PRG+0 string NES\032 iNES ROM dump,++# ROM dump format+# ines: file(1) magic for Marat's iNES Nintendo Entertainment System+# Toby Deshane +# Console game magic+#------------------------------------------------------------------------------+2 string -afx- AFX compressed file data+# AFX compressed files (Wolfram Kleff)++>7 byte x \b.%d+>6 byte x version %d+0 string 7z\274\257\047\034 7z archive data,+#+# http://www.7-zip.org or DOC/7zFormat.txt +# 7z archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)++>4 belong 0x090A0C0D best compressionad)bgd c- n   i ( % n Z . , j ` K I i ; %  }UsAxTomI)DkM/ `]<:86 +#+# I don't see why these might collide with anything else.+#+# These go at the end of the iff rules++++0 string Glul Glulx game data+#+# I haven't checked for false matches yet.+#+# Glulx: file(1) magic for Glulx binaries.+#------------------------------------------------------------------------------++>>18 string >\0 Serial %.6s)+>>2 ubeshort x Release %d /+>0 ubyte >0 (Z-machine %d,+>0 ubyte 0 (false match)+>16 belong&0xfe00f0f0 0x3030 Infocom game data+#+# not needed.+# The (false match) message is to correct that behavior. Perhaps it is+#+# appears to be a version-0 Z-machine binary.+# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which+#+# Z-machine: file(1) magic for Z-machine binaries.+#------------------------------------------------------------------------------++>6 string BS93+>2 beshort x RAM start $%04x+0 beshort 0x8008 Lynx cartridge,++# From: "Stefan A. Haubenthal" +# Atari Lynx cartridge dump (EXE/BLL header)++0 string XTF0 XTF, Microsoft Xbox data+0 string XIP0 XIP, Microsoft Xbox data+# Microsoft Xbox data file formats+# --------------------------------++>>>(0x0118-0x0FF60) ulelong >0 \b)+>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer+>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World+>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan+>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA+>>>(0x0118-0x0FF60) ulelong >0 (regions:+>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007+>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions+>0x0104 ulelong =0x10000+# expect base address of 0x10000+>>>&2 ulelong >0 \b, signed+>>&2 ulelong >0+>0x0004 ulelong >0+>>>&2 ulelong =0x0 \b, not signed+>>&2 ulelong =0x0+>0x0004 ulelong =0x0+# probabilistic checks whether signed or not+0 string XBEH XBE, Microsoft Xbox executable+# Microsoft Xbox executables .xbe (Esa Hyytiä )+#------------------------------------------------------------------------------++>113 string x (%s)+# Area:+0 string PS-X\ EXE Sony Playstation executable+# Sony Playstation executables (Adam Sjoegren ) :+#------------------------------------------------------------------------------++#0 beshort 0x4142 MSX game cartridge dump +# Too simple - MPi+# msx: file(1) magic for MSX game cartridge dumps+#------------------------------------------------------------------------------++0 belong 0x37804012 V64 Nintendo 64 ROM dump+#+# v64: file(1) uncertain magic for the V64 format N64 ROM dumps+#------------------------------------------------------------------------------++0 string LCDi Dream Animator file+0 belong 0x21068028 Sega Dreamcast VMU game image+#+# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format+#------------------------------------------------------------------------------++#>1 byte 0xC3 Sega Master System/Game Gear ROM dump+#>1 byte 0xAF Sega Master System/Game Gear ROM dump+#>1 byte 0xDB Sega Master System/Game Gear ROM dump+#>1 byte 0x31 Sega Master System/Game Gear ROM dump+#>1 byte 0xED Sega Master System/Game Gear ROM dump+#0 byte 0xF3+#+# FIXME: need a little more info...;P+#+# on format.+# Does not detect all images. Very preliminary guesswork. Need more data+#+# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps+#------------------------------------------------------------------------------ad^|1/L i 4  T ~ ; i #  a   yvZ4f@ ~OgD igmktI+#+# database: file(1) magic for various databases+#------------------------------------------------------------------------------++>15 long >30 $BS, block size: %i bytes+>7 long >0 $BS, original size: %i bytes+>6 byte >-1 $BS%i)+>5 byte >-1 $BS%i.+>4 byte >-1 (version %i.+0 long 0x444354C3 DACT compressed data+#+# dact: file(1) magic for DACT compressed files+#------------------------------------------------------------------------------++0 string !_TAG Exuberant Ctags tag file text+# From: Alexander Mai +# ctags: file (1) magic for Exuberant Ctags files+# ----------------------------------------------------------------------------++>84 belong&0x18000000 =0x18000000 undefined fpmode+>84 belong&0x18000000 =0x10000000 ieee fpmode+>84 belong&0x18000000 =0x00000000 native fpmode+#+>88 belong &0x00000008 POSIX+>88 belong &0x00080000 intrinsic+>88 belong &0x00040000 parallel+>88 belong &0x00020000 c2mp+>88 belong &0x00010000 c2+>88 belong&0x000f0000 =0x00000000 c1+0 belong 0607 Convex SOFF checkpoint+#+0 belong 0605 Convex SOFF core+#+>84 belong&0x18000000 =0x18000000 undefined fpmode+>84 belong&0x18000000 =0x10000000 ieee fpmode+>84 belong&0x18000000 =0x00000000 native fpmode+>84 belong&0x20000000 =0 not stripped+>84 belong &0x40000000 object+>84 belong &0x80000000 executable+#+>88 belong &0x00000008 POSIX+>88 belong &0x00000004 non-swapped+>88 belong &0x00000002 pre-paged+>88 belong &0x00000001 demand paged+>88 belong &0x00080000 intrinsic+>88 belong &0x00040000 parallel+>88 belong &0x00020000 c2mp+>88 belong &0x00010000 c2+>88 belong&0x000f0000 =0x00000000 c1+0 belong 0601 Convex SOFF+#+# If there is no `=' sign, assume just checking for whether the bit is set?+# what follows is a bunch of bit-mask checks on the flags field of the opthdr.+#+24 belong =60014 dump format, Convex Storage Manager by-reference dump+24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)+24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC+24 belong =60011 dump format, 4.1 BSD or earlier+#+# to be extracted.+# The restore program uses these number to determine how the data is+# secondary storage is not physically contained within the dump.+# a dump that is dependent on Convex Storage Manager, because data in+# to 2K to be compatible with an IDC file system. The fourth indicates+# system. The Third marks the changing of the block size from 1K+# second marks the change between the 4.1 file system and the 4.2 file+# the original dump format on a 4.1 BSD or earlier file system. The+# corresponds to a drastically different dump format. The first on is+# The following are a series of dump format magic numbers. Each one+#+0 belong 0x011257 Core file+>16 belong >0 not stripped+0 belong 0517 Convex old-style pre-paged, non-swapped executable+>16 belong >0 not stripped+0 belong 0515 Convex old-style pre-paged executable+>16 belong >0 not stripped+0 belong 0513 Convex old-style demand paged executable+>16 belong >0 not stripped+0 belong 0507 Convex old-style object+# \*/+# * Added at beginning, because they are expected to be used most.+# * Below are the magic numbers and tests added for Convex.+# /*\+#+# Convexes are big-endian.+#+# convex: file(1) magic for Convex boxes+#------------------------------------------------------------------------------++>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)+>>24 string Exec with executable chunk+>8 string IFRS \b, Blorb Interactive Fiction+#+# Interactive Fiction related formatsadkN7~<9 b ` A 1   e c B 2   i g > S Q 1 X V 6  ZX8\ZE%NLIF\Y6}cI/[tF +#0 byte 0x02 +## XBase database files+#>>>0x04 byte 8 incrementing secondary index .XGn file +#>>0x04 byte 7 secondary index .YGn file +#>>0x04 byte 6 non-incrementing secondary index .XGn file +#>>0x04 byte 5 incrementing secondary index .Xnn file +#>>0x04 byte 4 secondary index .Ynn file +#>>0x04 byte 3 non-incrementing secondary index .Xnn file +#>>0x04 byte 2 non-indexed .DB data file +#>>0x04 byte 1 primary index .PX file +#>>0x04 byte 0 indexed .DB data file +#>0x39 byte 12 v. 7.x +#>0x39 byte 11 v. 5.x +#>0x39 byte 10 v. 5.x +#>0x39 byte 9 v. 4.x +#>0x39 byte 4 v. 3.5 +#>0x39 byte 3 v. 3.0 +#2 leshort 0x0800 Paradox +## Paradox file formats+# Alex Ott +# XXX: Weak magic.++>33 belong x (Compression: %d)+>4 belong x Version %d+0 string root\0 ROOT file+#+# ROOT: file(1) magic for ROOT databases+#----------------------------------------------------------------------+>4 string x version %s+0 string RRD RRDTool DB+# Round Robin Database Tool by Tobias Oetiker +#+#++>16 lelong >0 (Log, version %d, little-endian)+12 lelong 0x00040988 Berkeley DB+>16 belong >0 (Log, version %d, big-endian)+12 belong 0x00040988 Berkeley DB +>16 long >0 (Log, version %d, native byte-order)+12 long 0x00040988 Berkeley DB+# From Max Bowsher.++>16 lelong >0 (Queue, version %d, little-endian)+12 lelong 0x00042253 Berkeley DB+>16 belong >0 (Queue, version %d, big-endian)+12 belong 0x00042253 Berkeley DB+>16 long >0 (Queue, version %d, native byte-order)+12 long 0x00042253 Berkeley DB++>16 lelong >0 (Btree, version %d, little-endian)+12 lelong 0x00053162 Berkeley DB+>16 belong >0 (Btree, version %d, big-endian)+12 belong 0x00053162 Berkeley DB+>16 long >0 (Btree, version %d, native byte-order)+12 long 0x00053162 Berkeley DB++>16 lelong >0 (Hash, version %d, little-endian)+12 lelong 0x00061561 Berkeley DB+>16 belong >0 (Hash, version %d, big-endian)+12 belong 0x00061561 Berkeley DB+>16 long >0 (Hash, version %d, native byte-order)+12 long 0x00061561 Berkeley DB++>4 lelong >0 (Btree, version %d, little-endian)+0 lelong 0x00053162 Berkeley DB 1.85/1.86+>4 belong >0 (Btree, version %d, big-endian)+0 belong 0x00053162 Berkeley DB 1.85/1.86+>4 long >0 (Btree, version %d, native byte-order)+0 long 0x00053162 Berkeley DB 1.85/1.86++>>4 belong >0 (Hash, version %d, native byte-order)+>>4 belong <3 1.85+>>4 belong >2 1.86+>8 belong 1234+>>4 belong >0 (Hash, version %d, big-endian)+>>4 belong <3 1.85+>>4 belong >2 1.86+>8 belong 4321+0 belong 0x00061561 Berkeley DB++>>4 belong >0 (Hash, version %d, little-endian)+>>4 belong <3 1.85+>>4 belong >2 1.86+>8 belong 1234+>>4 belong >0 (Hash, version %d, native byte-order)+>>4 belong <3 1.85+>>4 belong >2 1.86+>8 belong 4321+0 long 0x00061561 Berkeley DB++# Hash and Btree 2.X and later databases store the metadata in host byte order.+# Btree 1.85/1.86 databases store the metadata in host byte order.+# Hash 1.85/1.86 databases store metadata in network byte order.+#+# Ian Darwin's file /etc/magic files: big/little-endian version.+#+# Berkeley DB+#+0 string GDBM GNU dbm 2.x database+0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian+0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian+# +# Will be maintained as part of the GDBM distribution in the future.+# GDBM magic numbers+#+#+# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)adriSiG$! } d N )   ] : 7   } g 2  p M J 0  u F $  b_75S/-{YW, zG{HEBGE+#------------------------------------------------------------------------------++0 string =\n\n Diamond Multimedia Document+# The full deal is too long...+#+# XXX - I think it was either renamed Slate, or replaced by Slate....+#+# ... diamond is a multi-media mail and electronic conferencing system....+#+# diamond: file(1) magic for Diamond system+#------------------------------------------------------------------------------++18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data+# X11 Xauthority file (Wolfram Kleff)++2 string ICE ICE authority data+# ICE authority file data (Wolfram Kleff)++>28 lelong x %d ocons+>24 lelong x %d symbols+>20 lelong 1 MLS+>16 lelong x v%d+0 lelong 0xf97cff8c SE Linux policy+# SE Linux policy database++>>36 lelong x hash size %d bytes+>32 lelong 0x2601196D version 6, little-endian+0 string TDB\ file TDB database+# TDB database from Samba et al - Martin Pool ++4 string Standard\ Jet\ DB Microsoft Access Database+# MS Access database++#0 leshort 0x0006 DBase 3 index file+#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 FoxPro with memo +#>8 leshort >0+#0 byte 0xf5+#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 FlagShip with .dbt memo +#>8 leshort >0+#0 byte 0xb3+#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 dBaseIV with SQL Table +#>8 leshort >0+#0 byte 0x8e +#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 dBaseIV with memo +#>8 leshort >0+#0 byte 0x8b+#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 FoxBase+, dBaseIII+ with memo +#>8 leshort >0+#0 byte 0x83 +#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 dBASEIV with memo +#>8 leshort >0+#0 byte 0x7b+#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 FlagShip with memo var size +#>8 leshort >0+#0 byte 0x43+#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 Visual FoxPro +#>8 leshort >0+#0 byte 0x30+#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 dBASE V no memo file +#>8 leshort >0+#0 byte 0x05 +#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 dBASE IV no memo file +#>8 leshort >0+#0 byte 0x04 +#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo +#>8 leshort >0+#0 byte 0x03 +#+#>>>0x04 lelong >0 (%d records)+#>>>0x04 lelong 0 (no records)+#>>12 leshort 0 FoxBase +#>8 leshort >0add_' XF! M ?  h < 9 ` >  } U R .  [ X L xX# yX5 |Ke;nDoDmB+# dsurmod (these may be incorrect)+>4 byte&0x3e = 0x24 \b, 640 kbit/s+>4 byte&0x3e = 0x22 \b, 576 kbit/s+>4 byte&0x3e = 0x20 \b, 512 kbit/s+>4 byte&0x3e = 0x1e \b, 448 kbit/s+>4 byte&0x3e = 0x1c \b, 384 kbit/s+>4 byte&0x3e = 0x1a \b, 320 kbit/s+>4 byte&0x3e = 0x18 \b, 256 kbit/s+>4 byte&0x3e = 0x16 \b, 224 kbit/s+>4 byte&0x3e = 0x14 \b, 192 kbit/s+>4 byte&0x3e = 0x12 \b, 160 kbit/s+>4 byte&0x3e = 0x10 \b, 128 kbit/s+>4 byte&0x3e = 0x0e \b, 112 kbit/s+>4 byte&0x3e = 0x0c \b, 96 kbit/s+>4 byte&0x3e = 0x0a \b, 80 kbit/s+>4 byte&0x3e = 0x08 \b, 64 kbit/s+>4 byte&0x3e = 0x06 \b, 56 kbit/s+>4 byte&0x3e = 0x04 \b, 48 kbit/s+>4 byte&0x3e = 0x02 \b, 40 kbit/s+>4 byte&0x3e = 0x00 \b, 32 kbit/s+#+>7 byte&0x40 0x40 LFE on,+>7 byte&0x40 0x00 LFE off,+# lfeon (these may be incorrect)+>6 byte&0xe0 0xe0 3 front/2 rear,+>6 byte&0xe0 0xc0 2 front/2 rear,+>6 byte&0xe0 0xa0 3 front/1 rear,+>6 byte&0xe0 0x80 2 front/1 rear,+>6 byte&0xe0 0x60 3 front/0 rear,+>6 byte&0xe0 0x40 2 front/0 rear,+>6 byte&0xe0 0x20 1 front/0 rear,+>6 byte&0xe0 0x00 1+1 front,+# acmod+>5 byte&7 = 6 \b, emergency (E)+>5 byte&7 = 5 \b, commentary (C)+>5 byte&7 = 4 \b, dialogue (D)+>5 byte&7 = 3 \b, hearing impaired (HI)+>5 byte&7 = 2 \b, visually impaired (VI)+>5 byte&7 = 1 \b, music and effects (ME)+>5 byte&7 = 0 \b, complete main (CM)+#+>4 byte&0xc0 0xc0 reserved frequency,+# is this one used for 96 kHz?+>4 byte&0xc0 0x80 32 kHz,+>4 byte&0xc0 0x40 44.1 kHz,+>4 byte&0xc0 0x00 48 kHz,+# fscod+0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,+# syncword+#+# corrections, additions, etc. are always welcome!+# from http://www.atsc.org/standards/a_52a.pdf+# ATSC A/53 aka AC-3 aka Dolby Digital +>6 short 0x40 for Alpha+>6 short 0x24 for MIPS+0 short 0x0501 locale data table+#+# Locale data tables (MIPS and Alpha).+#+0 string !!\n profiling data file+#+0 long 04553207 X image+0 string \033c\033 LN03 output+0 string \377\377\176 ddis/dtif table data+0 string \377\377\174 ddis/dots archive+0 string \377\377\177 ddis/ddif+# Some other interesting Digital formats,+#+#+0 leshort 0x18f Alpha u-code object+0 leshort 0x188 Alpha compressed COFF+# but its not worth it.+# The next is incomplete, we could tell more about this format,+#+>28 leshort >0 %d+>26 byte >0 %d-+>27 byte >0 - version %d.+>>12 lelong >0 executable or object module, not stripped+>>12 lelong 0 executable or object module, stripped+>8 lelong 0+>8 lelong >0 executable or object module, not stripped+>24 leshort 0413 demand paged+>24 leshort 0410 pure+>22 leshort&020000 ^010000 dynamically linked,+>22 leshort&020000 &010000 sharable library,+0 leshort 0x183 COFF format alpha+# but this works+# The stripped stuff really needs to be an 8 byte (64 bit) compare,+# Alpha COFF Based Executables+#+>22 string X -- out of date+0 string !\n________64E Alpha archive+#+# Digital UNIX - Info+0 string Common\ subdirectories:\ 'diff' output text+0 string Only\ in\ 'diff' output text+0 string ***\ 'diff' output text+0 string diff\ 'diff' output text+#+# diff: file(1) magic for diff(1) outputadkNnk" u T 9   U 9  r U :  d G " i g 3  ~V1~]@%  |Z9d:X>qHT0-+#+# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?+#+# other stuff in the header is in.+# We have to check the byte order flag to see what byte order all the+#+# elf: file(1) magic for ELF executables+#------------------------------------------------------------------------------++0 string VimCrypt~ Vim encrypted file data+# by David Necas +# Vi IMproved Encrypted file ++>4 string >2 unknown encoding+>4 string 2 KOI8-CS+>4 string 1 CP 852+>4 string 0 Kamenicky+0 string @CT\ T602 document data,+# by David Necas +# T602 editor documents +#------------------------------------------------------------------------------++>888 lelong >0 Flags %x+>824 string >\0 Host %s,+>760 string >\0 Device %s,+>696 string >\0 Filesystem %s,+>676 string >\0 Label %s,+>0 lelong 7 end of medium (for floppy),+>0 lelong 6 map of inodes deleted,+>0 lelong 5 end of volume,+>0 lelong 4 continuation of file record,+>0 lelong 3 map of inodes on tape,+>0 lelong 2 beginning of file record,+>0 lelong 1 tape header,+>692 lelong >0 Level %d, type:+>692 lelong 0 Level zero, type:+>12 lelong >0 Volume %d,+#>8 ledate x This dump %s,+#>4 ledate x Previous dump %s,+24 lelong 60011 old-fs dump file (little endian),++>888 lelong >0 Flags %x+>824 string >\0 Host %s,+>760 string >\0 Device %s,+>696 string >\0 Filesystem %s,+>676 string >\0 Label %s,+>0 lelong 7 end of medium (for floppy),+>0 lelong 6 map of inodes deleted,+>0 lelong 5 end of volume,+>0 lelong 4 continuation of file record,+>0 lelong 3 map of inodes on tape,+>0 lelong 2 beginning of file record,+>0 lelong 1 tape header,+>692 lelong >0 Level %d, type:+>692 lelong 0 Level zero, type:+>12 lelong >0 Volume %d,+>8 ledate x Previous dump %s,+>4 ledate x This dump %s,+24 lelong 60012 new-fs dump file (little endian),++>888 belong >0 Flags %x+>824 string >\0 Host %s,+>760 string >\0 Device %s,+>696 string >\0 Filesystem %s,+>676 string >\0 Label %s,+>0 belong 7 end of medium (for floppy),+>0 belong 6 map of inodes deleted,+>0 belong 5 end of volume,+>0 belong 4 continuation of file record,+>0 belong 3 map of inodes on tape,+>0 belong 2 beginning of file record,+>0 belong 1 tape header,+>692 belong >0 Level %d, type:+>692 belong 0 Level zero, type:+>12 belong >0 Volume %d,+#>8 bedate x This dump %s,+#>4 bedate x Previous dump %s,+24 belong 60011 old-fs dump file (big endian),++>888 belong >0 Flags %x+>824 string >\0 Host %s,+>760 string >\0 Device %s,+>696 string >\0 Filesystem %s,+>676 string >\0 Label %s,+>0 belong 7 end of medium (for floppy),+>0 belong 6 map of inodes deleted,+>0 belong 5 end of volume,+>0 belong 4 continuation of file record,+>0 belong 3 map of inodes on tape,+>0 belong 2 beginning of file record,+>0 belong 1 tape header,+>692 belong >0 Level %d, type:+>692 belong 0 Level zero, type:+>12 belong >0 Volume %d,+>8 bedate x This dump %s,+>4 bedate x Previous dump %s,+24 belong 60012 new-fs dump file (big endian),+#+# We specify both byte orders in order to recognize byte-swapped dumps.+#+# dump: file(1) magic for dump file format--for new and old dump filesystems+#------------------------------------------------------------------------------++>6 beshort&0x0180 0x0180 reserved Dolby Surround mode+>6 beshort&0x0180 0x0100 Dolby Surround encoded+>6 beshort&0x0180 0x0080 not Dolby Surround encoded+>6 beshort&0x0180 0x0000 Dolby Surround not indicatedad _9(wWF j V C 5  } P #  q D  _ 1 p O  uP'z[@ mN/aE$ pO1`)\'+>>18 leshort 53 Motorola M68HC12,+>>18 leshort 52 Motorola Coldfire,+>>18 leshort 51 Stanford MIPS-X,+>>18 leshort 50 IA-64 (Intel 64 bit architecture)+>>18 leshort 49 Hitachi H8/500,+>>18 leshort 48 Hitachi H8S,+>>18 leshort 47 Hitachi H8/300H,+>>18 leshort 46 Hitachi H8/300,+>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,+>>18 leshort 44 Siemens Tricore Embedded Processor,+>>18 leshort 43 SPARC V9 - invalid byte order,+>>18 leshort 42 Hitachi SH,+>>18 leshort 0xa390 IBM S/390 (obsolete),+>>18 leshort 41 Alpha,+>>18 leshort 40 ARM,+>>18 leshort 39 Motorola RCE,+>>18 leshort 38 TRW RH-32,+>>18 leshort 37 Fujitsu FR20,+>>18 leshort 36 NEC V800,+>>18 leshort 22 IBM S/390,+>>18 leshort 20 PowerPC,+>>18 leshort 18 SPARC32PLUS,+>>18 leshort 17 Fujitsu VPP500,+>>18 leshort 16 nCUBE,+>>>48 leshort &0x0008 (LP64),+>>>50 leshort 0x0214 2.0+>>18 leshort 15 PA-RISC - invalid byte order,+>>18 leshort 11 RS6000 - invalid byte order,+>>18 leshort 10 MIPS (deprecated),+>>18 leshort 9 Amdahl - invalid byte order,+>>18 leshort 8 MIPS,+>>18 leshort 7 Intel 80860,+>>18 leshort 6 Intel 80486,+>>18 leshort 5 Motorola 88000 - invalid byte order,+>>>36 lelong 0 68020 - invalid byte order,+>>>36 lelong &0x00810000 CPU32 - invalid byte order,+>>>36 lelong &0x01000000 68000 - invalid byte order,+>>18 leshort 4 Motorola+>>18 leshort 3 Intel 80386,+>>18 leshort 2 SPARC - invalid byte order,+>>18 leshort 1 AT&T WE32100 - invalid byte order,+>>18 leshort 0 no machine,+>>16 leshort &0xff00 processor-specific,+#>>>(0x38+0x10) lelong >0 (signal %d),+#>>>(0x38+0xcc) string >\0 of '%s'+# Core file detection is not reliable.+>>16 leshort 4 core file+# corrections by Christian 'Dr. Disk' Hechelmann +# Core handling from Peter Tobias +>>16 leshort 3 shared object,+>>16 leshort 2 executable,+>>16 leshort 1 relocatable,+>>16 leshort 0 no file type,+>>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2+>>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2+>>>>48 lelong&0xf0000000 0x70000000 MIPS64 +>>>>48 lelong&0xf0000000 0x60000000 MIPS32+>>>>48 lelong&0xf0000000 0x40000000 MIPS-V+>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV+>>>>48 lelong&0xf0000000 0x20000000 MIPS-III+>>>>48 lelong&0xf0000000 0x10000000 MIPS-II+>>>>48 lelong&0xf0000000 0x00000000 MIPS-I+>>>4 byte 2+# only for 64-bit+>>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2+>>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2+>>>>36 lelong&0xf0000000 0x70000000 MIPS64+>>>>36 lelong&0xf0000000 0x60000000 MIPS32+>>>>36 lelong&0xf0000000 0x40000000 MIPS-V+>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV+>>>>36 lelong&0xf0000000 0x20000000 MIPS-III+>>>>36 lelong&0xf0000000 0x10000000 MIPS-II+>>>>36 lelong&0xf0000000 0x00000000 MIPS-I+>>>4 byte 1+# only for 32-bit+>>18 leshort 8+# say something if #10 is encountered, but only gory details for #8.+# The second number (#10) will be deprecated later. For now, we still+# The official e_machine number for MIPS is now #8, regardless of endianness.+>5 byte 1 LSB+>5 byte 0 invalid byte order+>4 byte 2 64-bit+>>>36 belong &0x20 N32+>>18 beshort 10+>>>36 belong &0x20 N32+>>18 beshort 8+>>>36 lelong &0x20 N32+>>18 leshort 10+>>>36 lelong &0x20 N32+>>18 leshort 8+# only for MIPS - in the future, the ABI field of e_flags should be used.+>4 byte 1 32-bit+>4 byte 0 invalid class+0 string \177ELF ELF+# updated by Daniel Quinlan (quinlan@yggdrasil.com)ad>bU4vh;  V ) x K  k : n I i N , |dJ$ uU&]3kM,D!kE wJ)+>>36 belong 1 MathCoPro/FPU/MAU Required+>>20 belong 1 version 1+>>20 belong 0 invalid version+>>18 beshort 0xa390 IBM S/390 (obsolete),+>>18 beshort 0x9026 Alpha (unofficial),+>>18 beshort 97 NatSemi 32k,+>>18 beshort 88 Renesas M32R,+>>18 beshort 75 Digital VAX,+>>18 beshort 73 Cray NV1,+>>18 beshort 53 Motorola M68HC12,+>>18 beshort 52 Motorola Coldfire,+>>18 beshort 51 Stanford MIPS-X,+>>18 beshort 50 Intel Merced Processor,+>>18 beshort 49 Hitachi H8/500,+>>18 beshort 48 Hitachi H8S,+>>18 beshort 47 Hitachi H8/300H,+>>18 beshort 46 Hitachi H8/300,+>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,+>>18 beshort 44 Siemens Tricore Embedded Processor,+>>18 beshort 43 SPARC V9,+>>18 beshort 42 Hitachi SH,+>>18 beshort 41 Alpha,+>>18 beshort 40 ARM,+>>18 beshort 39 Motorola RCE,+>>18 beshort 38 TRW RH-32,+>>18 beshort 37 Fujitsu FR20,+>>18 beshort 36 NEC V800 or cisco 12000,+>>18 beshort 25 cisco 7200,+>>18 beshort 24 cisco SVIP,+>>18 beshort 22 IBM S/390,+>>18 beshort 21 cisco 7500,+>>18 beshort 20 PowerPC or cisco 4500,+>>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required,+>>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required,+>>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required,+>>>36 belong&0xffff00 &0x000100 V8+ Required,+>>18 beshort 18 SPARC32PLUS,+>>18 beshort 17 Fujitsu VPP500,+>>18 beshort 16 nCUBE,+>>>48 beshort &0x0008 (LP64)+>>>50 beshort 0x0214 2.0+>>18 beshort 15 PA-RISC+>>18 beshort 11 RS6000,+>>18 beshort 10 MIPS (deprecated),+>>18 beshort 9 Amdahl,+>>18 beshort 8 MIPS,+>>18 beshort 7 Intel 80860,+>>18 beshort 6 Intel 80486 - invalid byte order,+>>18 beshort 5 Motorola 88000,+>>>36 belong 0 68020,+>>>36 belong &0x00810000 CPU32,+>>>36 belong &0x01000000 68000,+>>18 beshort 4 Motorola+>>18 beshort 3 Intel 80386 - invalid byte order,+>>18 beshort 2 SPARC,+>>18 beshort 1 AT&T WE32100,+>>18 beshort 0 no machine,+>>16 beshort &0xff00 processor-specific,+#>>>(0x38+0x10) belong >0 (signal %d),+#>>>(0x38+0xcc) string >\0 of '%s'+>>16 beshort 4 core file,+>>16 beshort 3 shared object,+>>16 beshort 2 executable,+>>16 beshort 1 relocatable,+>>16 beshort 0 no file type,+>>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2+>>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2+>>>>48 belong&0xf0000000 0x70000000 MIPS64 +>>>>48 belong&0xf0000000 0x60000000 MIPS32+>>>>48 belong&0xf0000000 0x40000000 MIPS-V+>>>>48 belong&0xf0000000 0x30000000 MIPS-IV+>>>>48 belong&0xf0000000 0x20000000 MIPS-III+>>>>48 belong&0xf0000000 0x10000000 MIPS-II+>>>>48 belong&0xf0000000 0x00000000 MIPS-I+>>>4 byte 2+# only for 64-bit+>>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2+>>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2+>>>>36 belong&0xf0000000 0x70000000 MIPS64+>>>>36 belong&0xf0000000 0x60000000 MIPS32+>>>>36 belong&0xf0000000 0x40000000 MIPS-V+>>>>36 belong&0xf0000000 0x30000000 MIPS-IV+>>>>36 belong&0xf0000000 0x20000000 MIPS-III+>>>>36 belong&0xf0000000 0x10000000 MIPS-II+>>>>36 belong&0xf0000000 0x00000000 MIPS-I+>>>4 byte 1+# only for 32-bit+>>18 beshort 8+# only for MIPS - see comment in little-endian section above.+>5 byte 2 MSB+>>36 lelong 1 MathCoPro/FPU/MAU Required+>>20 lelong 1 version 1+>>20 lelong 0 invalid version+>>18 leshort 0x9026 Alpha (unofficial),+>>18 leshort 97 NatSemi 32k,+>>18 leshort 88 Renesas M32R,+>>18 leshort 75 Digital VAX,+>>18 leshort 62 AMD x86-64,admqR;,oZB+  o A > z W ,  r V 9 (   T 6   S }n_F.bD#6g`'$rX="vW1 +>0770 long x %d blocks+>0764 long >0 start cyl %d,+>0756 short >0 %d sectors/track,+>0754 short >0 %d heads/partition,+>0752 short >0 %d alt cyls,+>0750 short >0 %d data cyls,+>0746 short >0 %d interleave,+>0740 short >0 %d alts/cyl,+>0736 short >0 %d phys cys,+>0734 short >0 %d rpm,+>0 string x \b'+>>>>95 string >\0 \b%s+>>>63 string >\0 \b%s+>>31 string >\0 \b%s+>0 string x '%s+0774 beshort 0xdabe Sun disk label+# From /usr/include/sun/dklabel.h:+# Sun disk labels+0 string \366\366\366\366 PC formatted floppy with no filesystem+#+# filesystems: file(1) magic for different filesystems+#------------------------------------------------------------------------------+++0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0+0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0+0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0+# From Roger Leigh +# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files+#------------------------------------------------------------------------------++>32 lelong =31 type MultiPatch+>32 lelong =28 type MultiPointM+>32 lelong =25 type PolygonM+>32 lelong =23 type PolyLineM+>32 lelong =21 type PointM+>32 lelong =18 type MultiPointZ+>32 lelong =15 type PolygonZ+>32 lelong =13 type PolyLineZ+>32 lelong =11 type PointZ+>32 lelong =8 type MultiPoint+>32 lelong =5 type Polygon+>32 lelong =3 type PolyLine+>32 lelong =1 type Point+>32 lelong =0 type Null Shape+>24 belong x length %d+>28 lelong x version %d+>20 belong =0+>16 belong =0+>12 belong =0+>8 belong =0+>4 belong =0+0 belong 9994 ESRI Shapefile+# +# Based on info from+# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)+#------------------------------------------------------------------------------++>>8 lelong 0x10000085 TextEd+>>8 lelong 0x1000007D Sketch+>>8 lelong 0x10000088 Sheet+>>8 lelong 0x1000007F Word+>4 lelong 0x1000006D+#0 lelong 0x10000037 Epoc32+# Stefan Praszalowicz (hpicollo@worldnet.fr)+# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris+#------------------------------------------------------------------------------++#>4 date x stamp %s+>22 short 0 -+>22 short >0 - version %d+>12 long >0 not stripped+0 short 0x155 Encore unsupported executable+#>4 date x stamp %s+>22 short 0 -+>22 short >0 - version %d+>12 long >0 not stripped+>20 short 0x10f unsupported executable+>20 short 0x10b demand-paged executable+>20 short 0x108 pure executable+>20 short 0x107 executable+0 short 0x154 Encore+#+# dunno whether they run the 88K in little-endian mode or not).+# XXX - needs to have the byte order specified (NS32K was little-endian,+#+# encore: file(1) magic for Encore machines+#------------------------------------------------------------------------------++>>7 byte 255 (embedded)+>>7 byte 97 (ARM)+>>7 byte 12 (OpenBSD)+>>7 byte 11 (Novell Modesto)+>>7 byte 10 (Tru64)+>>7 byte 9 (FreeBSD)+>>7 byte 8 (IRIX)+>>7 byte 7 (Monterey)+>>7 byte 6 (Solaris)+>>7 byte 5 (86Open)+>>7 byte 4 (GNU/Hurd)+>>7 byte 3 (GNU/Linux)+>>7 byte 2 (NetBSD)+>>7 byte 1 (HP-UX)+>>7 byte 0 (SYSV)+>8 string \0+>>8 string >\0 (%s)+>4 byte <0x80+# like proper ELF, but extracting the string had bad results.+# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemedad<J_IqB s L T :  q C  A  q D  tEuJ qAo@x<_7xU'+>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader+>>>>469 string Insert\ Systemdisk\ +>>>441 string Cannot\ load\ from\ harddisk.\n\r +>>>293 string Booting\ from\ harddisk.\n\r +>>278 string No\ Systemdisk.\ +>242 string Bootsector\ from\ C.H.\ Hochst\204 +>>>>>>200 string >\0 \b, version %-3s+>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader+>>>>273 string Insert\ Systemdisk\ +>>>245 string Cannot\ load\ from\ harddisk.\n\r +>>>220 string Booting\ from\ harddisk.\n\r +>>204 string \rNo\ Systemdisk.\ +>185 string FDBOOT\ Version\ +>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader+>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06)+>480 string Boot\ failed\r +>>377 string GRUB\ \0 \b, GRand Unified Bootloader (0.94)+>383 string Geom\0Hard\ Disk\0Read\0\ Error\0+>>376 string GRUB\ \0 \b, GRand Unified Bootloader (0.93)+>382 string Geom\0Hard\ Disk\0Read\0\ Error\0+>>374 string GRUB\ \0 \b, GRand Unified Bootloader+>380 string Geom\0Hard\ Disk\0Read\0\ Error\0+>>394 string stage1 \b, GRand Unified Bootloader (0.5.95)+>402 string Geom\0Hard\ Disk\0Read\0\ Error\0+>>172 string LILO \b, version 22.5.8 Debian+>>120 string LILO \b, version 22.3.4 SuSe+>6 string LILO \b, LInux i386 boot LOader+>382 string XOSLLOADXCF \b, EXtended Operating System Loader+>>>>6 string >\0 \b, version %s+>>>3 string SBM \b, Smart Boot Manager+>>430 string SBMK\ Bad!\r +>43 string SMART\ BTMGRFAT12\ \ \ +# bootloader, bootmanager+>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta9 MBR+>64 string no\ active\ partition\ found +>0x145 string Default:\ F \b, FREE-DOS MBR+>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)+>>>346 string des\ Betriebssystems +>>328 string Fehler\ beim\ Laden\ +#split string to avoid error: String too long+>300 string Ung\201ltige\ Partitionstabelle+#??>>>389 string Invalid\ system\ disk +>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR+>>324 string Error\ loading\ operating\ system\0+>300 string Invalid\ partition\ table\0 +>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950+>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222+>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)+>>>>>>>387 string Copyright\ (c)\ 1984,1998 +>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ +>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r +>>>>317 string OS\ load\ err$ +>>>310 string No\ OS\ $ +>>302 string Bad\ PT\ $ +>295 string NEWLDR\0 +>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03+>>366 string No\ operating\ system$ +>342 string Invalid\ partition\ table$ +>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03+>>181 string No\ operating\ system$ +>0x9D string Invalid\ partition\ table$ +>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03+>>181 string No\ Operating\ System$ +>0x9D string Invalid\ partition\ table$ +# dr-dos with some upper-, lowercase variants+>0x8C string Invalid\ partition\ table \b, MS-DOS MBR+# J\xf6rg Jenderek +>2 string OSBS \b, OS/BS MBR+0x1FE leshort 0xAA55 x86 boot sector+>0x27E leshort 0xAA55 DOS Emulator image+0 string DOSEMU\0 +# DOS Emulator image is 128 byte header + harddisc image+>512 belong&077777777 0600407 \b, boot block present+# Is there a boot block written 1 sector in?ad)bnR6z82 E * p U 3   T 9   c A   i N 0  $ qS7<!dA!yJEsF+>>390 string Invalid\ system\ disk\xFF\r\n +#+>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader+>>>>428 string Replace\ the\ disk,\ and\ +>>>411 string Disk\ I/O\ error +>>389 string Invalid\ system\ disk\xFF\r\n +>>497 string WINBOOT\ SYS +>472 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS +# DOS loader variants different languages,offsets+>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS+>>>>>429 string Insert\ a\ system\ diskette\ +>>>>484 string NTLDR\ is\ compressed +>>>370 string from\ the\ disk.\r +>>345 string A\ kernel\ file\ is\ missing\ +>313 string A\ disk\ read\ error\ occurred.\r+#>3 string NTFS\ \ \ \ +>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)+>>>>440 string NTLDR\ ist\ komprimiert+>>>426 string NTLDR\ fehlt +>>407 string des\ Datentr\204gers+>389 string Fehler\ beim\ Lesen\ +#>3 string NTFS\ \ \ \ +>>>>>>376 string >\ \b.%-.3s+>>>>>>>373 string >\ \b%-.3s+>>>>>>373 ubyte <0x7E +>>>>>368 string >\ %-.5s+>>>>368 ubyte <0x7E +>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)+>>454 string Medienfehler\xFF\r\n +>430 string Datentr\204ger\ entfernen\xFF\r\n +#+>>>>>>425 string >\ \b.%-.3s+>>>>>>>422 string >\ \b%-.3s+>>>>>>422 ubyte <0x7E +>>>>>417 string >\ %-.5s+>>>>417 ubyte <0x7E +>>>>>>376 string >\ \b.%-.3s+>>>>>>>373 string >\ \b%-.3s+>>>>>>373 ubyte <0x7E +>>>>>368 string >\ %-.5s+>>>>368 ubyte <0x7E +>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)+>>444 string Medienfehler\xFF\r\n +>430 string NTLDR\ fehlt\xFF\r\n +#+>>>>>>425 string >\ \b.%-.3s+>>>>>>>422 string >\ \b%-.3s+>>>>>>422 ubyte <0x7E +>>>>>417 string >\ %-.5s+>>>>417 ubyte <0x7E +>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)+>>444 string Datentr\204gerfehler\xFF\r\n +>430 string NTLDR\ fehlt\xFF\r\n +#+>>>>>>376 string >\ \b.%-.3s+>>>>>>>373 string >\ \b%-.3s+>>>>>>373 ubyte <0x7E +>>>>>368 string >\ %-.5s+>>>>368 ubyte <0x7E +#+>>>>>>425 string >\ \b.%-.3s+>>>>>>>422 string >\ \b%-.3s+>>>>>>422 ubyte <0x7E +>>>>>417 string >\ %-.5s+>>>>417 ubyte <0x7E +>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)+>>453 string Datentr\204gerfehler\xFF\r\n +>430 string NTLDR\ nicht\ gefunden\xFF\r\n +#+>>>>>>376 string >\ \b.%-.3s+>>>>>>>373 string >\ \b%-.3s+>>>>>>373 ubyte <0x7E +>>>>>368 string >\ %-.5s+>>>>368 ubyte <0x7E +#+>>>>>>425 string >\ \b.%-.3s+>>>>>>>422 string >\ \b%-.3s+>>>>>>422 ubyte <0x7E +>>>>>417 string >\ %-.5s+>>>>417 ubyte <0x7E +# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes+>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader+>>449 string Disk\ error\xFF\r\n +>430 string NTLDR\ is\ missing\xFF\r\n +# XP+>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display+>>>>>>>>>>(1.b+12) ubyte 0x56 +>>>>>>>>>(1.b+11) ubyte 0xb +>>>>>>>>(1.b+10) ubyte 0x74 +>>>>>>>(1.b+9) ubyte 0xc0 +>>>>>>(1.b+8) ubyte 0x22 +>>>>>(1.b+7) ubyte 0xac +>>>>(1.b+6) ubyte 0x7c +>>>>(1.b+5) ubyte 0x77 +>>>(1.b+4) ubyte 0xbe +>>(1.b+3) ubyte 0x1f +>(1.b+2) ubyte 0xe +>>>>>>209 string >\0 \b, version %-4.4sad@SZ,xuG b 6   Y 6 g 5 ~ L | y [ 5 wA"x?wWhK+ V5W/qD+>>>>>14 uleshort >32 \b, reserved sectors %u+#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)+>>>>>13 ubyte >1 \b, sectors/cluster %u+>>>>>11 uleshort <512 \b, Bytes/sector %u+#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)+>>>>>11 uleshort >512 \b, Bytes/sector %u+>>>>>3 string >\0 \b, OEM-ID "%8.8s"+>>>>11 uleshort >31 +>>>11 uleshort <2049 +# valid sectorsize are from 32 to 2048+# usual values are marked with comments to get only informations of strange FAT systems+# mtools-3.9.8/msdos.h+>>1 ubyte >37 \b, code offset 0x%x+>0 lelong&0x000000E9 0x000000E9 +>0 lelong&0x009000EB 0x009000EB +# older drives may use E9 xx xx+# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90+>0 string \0\0\0\0 \b, extended partition table+# loader end+>>>505 string >\ \b.%-.3s+>>>>504 string >\ \b%-.1s+>>>>503 string >\ \b%-.1s+>>>497 string >\ %-.6s+>>334 string \ err\0 \b, FREE-DOS Beta 9 Bootloader+>>>505 string >\ \b.%-.3s+>>>>504 string >\ \b%-.1s+>>>>503 string >\ \b%-.1s+>>>497 string >\ %-.6s+>>333 string \ err\0 \b, FREE-DOS BEta 9 Bootloader+>>>505 string >\ \b.%-.3s+>>>>504 string >\ \b%-.1s+>>>>503 string >\ \b%-.1s+>>>497 string >\ %-.6s+# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes+>>331 string \ err\0 \b, FREE-DOS BETa 9 Bootloader+>124 string FreeDOS\0 +>>319 string BOOT\ error! \b, FREE-DOS 5.0 Bootloader+>449 string KERNEL\ \ SYS +>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader+>499 string KERNEL\ \ SYS +>>314 string BOOT\ error! \b, FREE-DOS Bootloader+>444 string KERNEL\ \ SYS +>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader+>>471 string Cannot\ load\ DOS\ +>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader+>>472 string Cannot\ load\ DOS!\ +>70 string IBMBIO\ \ COM +#+>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)+>>324 string VASKK+>54 string SYS+#>43 string \224R-LOADER\ \ SYS =label +>>>>>450 string when\ ready\r \b, Microsoft DOS bootloader+>>>>424 string Replace\ and\ press\ any\ key\ +>>>412 string disk\ error\r +>>393 string Non-System\ disk\ or\ +>480 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS +>>>>>473 string when\ ready\r \b, Microsoft DOS Bootloader+>>>>447 string Replace\ and\ press\ any\ key\ +>>>435 string disk\ error\r +>>416 string Non-System\ disk\ or\ +>486 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS +>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)+>>>433 string Laufwerksfehler +>>416 string Kein\ System\ oder\ +>479 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS +>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)+>>>>428 string Datentraeger\ wechseln\ und\ +>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n +>>389 string Ungueltiges\ System\ \xFF\r\n +#+>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)+>>>>429 string Datentraeger\ wechseln\ und\ +>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n +>>390 string Ungueltiges\ System\ \xFF\r\n +#+>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)+>>>>427 string Datentraeger\ wechseln\ und\ +>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n +>>388 string Ungueltiges\ System\ \xFF\r\n +>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader+>>>>429 string Replace\ the\ disk,\ and\ +>>>412 string Disk\ I/O\ error\xFF\r\n ad}TP!w< Z ( q O " t ` =  u 6  w ` 2 ]7%uMg5 oE`/YByLC}|+0x410 beshort 0x137f Minix filesystem (big endian),+0x410 leshort 0x137f Minix filesystem+# Minix filesystems - Juan Cespedes +++0 string FATX FATX filesystem data+# FATX +>0x200 lelong 0x82564557 \b, BSD disklabel+### FATs end+>>>>>>71 string =NO\ NAME \b, unlabeled+>>>>>>71 string >NO\ NAME \b, label: "%11.11s"+>>>>>>>71 string >>>>>>67 ulelong x \b, serial number 0x%x+>>>>>>66 ubyte =0x29+>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)+>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)+>>>>>>65 ubyte >0 \b, reserved 0x%x+#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)+>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x+#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)+>>>>>>64 ubyte >0x80 \b, physical drive 0x%x+# same structure as FAT1X +>>>>>>62 ulelong >0 \b, reserved3 0x%x+>>>>>>58 ulelong >0 \b, reserved2 0x%x+>>>>>>54 ulelong >0 \b, reserved1 0x%x+>>>>>>50 uleshort <6 \b, Backup boot sector %u+#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) +>>>>>>50 uleshort >6 \b, Backup boot sector %u+>>>>>>48 uleshort <1 \b, infoSector %u+#>>>>>>48 uleshort =1 \b, infoSector %u (usual)+>>>>>>48 uleshort >1 \b, infoSector %u+#>>>>>>44 ulelong =1 \b, rootdir cluster %u+#>>>>>>44 ulelong =2 \b, rootdir cluster %u+>>>>>>44 ulelong >2 \b, rootdir cluster %u+#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)+>>>>>>42 uleshort >0 \b, fsVersion %u+#>>>>>>40 uleshort =0 \b, extension flags %u+>>>>>>40 uleshort >0 \b, extension flags %u+>>>>>>36 ulelong x \b, sectors/FAT %u+>>>>>82 string FAT32 \b, FAT (32 bit)+# FAT32 specific+>>>>>>>54 string FAT16 \b (16 bit)+>>>>>>>54 string FAT12 \b (12 bit)+>>>>>>54 string FAT1 \b, FAT+>>>>>>>43 string =NO\ NAME \b, unlabeled+>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"+>>>>>>>43 string >>>>>>39 ulelong x \b, serial number 0x%x+>>>>>>38 ubyte =0x29+>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)+>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)+#>>>>>>37 ubyte =0 \b, reserved 0x%x+>>>>>>37 ubyte >0 \b, reserved 0x%x+#>>>>>>36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)+>>>>>>36 ubyte&0x7F >0 \b, physical drive 0x%x+#>>>>>>36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk)+>>>>>>36 ubyte >0x80 \b, physical drive 0x%x+>>>>>82 ulelong&0xCCABBEB9 >0+# NOT le FAT3=NOT 3TAF=0xCCABBEB9+# FAT<32 specific +#>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) +>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) +#>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)+>>>>>28 ulelong >0 \b, hidden sectors %u+>>>>>26 ubyte =1 \b, heads %u+#>>>>>26 ubyte =2 \b, heads %u (usual floppy)+>>>>>26 ubyte >2 \b, heads %u+#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)+>>>>>22 uleshort >0 \b, sectors/FAT %u+>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x+#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)+>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x+#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)+>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) +#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)+>>>>>17 uleshort >0 \b, root entries %u+>>>>>16 ubyte >0+>>>>>16 ubyte =1 \b, FAT %u+#>>>>>16 ubyte =2 \b, FATs %u (usual)+>>>>>16 ubyte >2 \b, FATs %u+>>>>>14 uleshort <1 \b, reserved sectors %u+#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)+#>>>>>14 uleshort >1 \b, reserved sectors %u+#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)ad(]O  jh1  f d $ k ?  i :  i <  ` 4  ^/ jP d<SQlj`^^)+19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k+>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector+19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k+>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector+19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k+# Hmmm, is this a better way of detecting _standard_ floppy images ?+############################################################################++>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy+>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy+0x800 belong 0x46fc2700 Atari-ST Minix kernel image+# Minix-ST kernel floppy+############################################################################++>0x64 beshort &0x2004 v2 dirs)+>0x64 beshort ^0x2004 v1 dirs)+>0x68 beshort x inosz %d,+>0x4 belong x (blksz %d,+0 belong 0x58465342 SGI XFS filesystem data+# SGI XFS filesystem - Nathan Scott ++0 belong 0x0BE5A941 SGI disk label (volume header)+# SGI disk labels - Nathan Scott ++>0x464 lelong &0x0000002 (large files)+#>0x464 lelong &0x0000001 (sparse_super)+#>0x460 lelong &0x0000002 (filetype)+>0x460 lelong &0x0000001 (compressed)+>0x43a leshort &0x0000002 (errors)+>>0x460 lelong &0x0000004 (needs journal recovery)+>0x45c lelong &0x0000004 ext3 filesystem data+>>0x43a leshort ^0x0000001 (mounted or unclean)+>0x45c lelong ^0x0000004 ext2 filesystem data+>0x43e leshort x \b.%d+>0x44c lelong x rev %d+0x438 leshort 0xEF53 Linux+# ext2/ext3 filesystems - Andreas Dilger ++>8320 belong 1 SPACE optimization+>8320 belong 0 TIME optimization+>8260 belong x disk rotational speed %drps,+>8256 belong x rotational delay %dms,+>8252 belong x minimum percentage of free blocks %d,+>8244 belong x fragment size %d,+>8240 belong x block size %d,+>8236 belong x number of cylinder groups %d,+>8232 belong x number of data blocks %d,+>8228 belong x number of blocks %d,+>8401 byte x clean flag %d,+>8224 bedate x last written at %s,+#>9504 bedate x last checked at %s,+>8404 string x last mounted on %s,+>>7180 bedate x created on %s,+>>7176 belong x volume label version %d,+>>7186 string x named %s,+>7168 long 0x4c41424c Apple UFS Volume+9564 belong 0x00011954 Unix Fast File system (big-endian),++>8320 lelong 1 SPACE optimization+>8320 lelong 0 TIME optimization+>8260 lelong x disk rotational speed %drps,+>8256 lelong x rotational delay %dms,+>8252 lelong x minimum percentage of free blocks %d,+>8244 lelong x fragment size %d,+>8240 lelong x block size %d,+>8236 lelong x number of cylinder groups %d,+>8232 lelong x number of data blocks %d,+>8228 lelong x number of blocks %d,+>8401 byte x clean flag %d,+>8224 ledate x last written at %s,+#>9504 ledate x last checked at %s,+>8404 string x last mounted on %s,+9564 lelong 0x00011954 Unix Fast File system (little-endian),++0x18b string OS/2 OS/2 Boot Manager++>4 lelong&0xFFFFFF00 !0 unknown mode+>>4 lelong&0x100 0x100 mode 3+>>4 lelong&0x100 0x000 mode 2+>4 lelong&0xFFFFFF00 0+0 lelong 0x1b031336L Netboot image,+# netboot image - Juan Cespedes ++>16 string x named %s.+>8 belong x %d bytes,+0 string -rom1fs-\0 romfs filesystem, version 1+# romfs filesystems - Juan Cespedes ++0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names+0x410 leshort 0x2468 Minix filesystem, version 2+0x410 leshort 0x138f Minix filesystem, 30 char names+>0x1e string minix \b, bootable+>0x402 beshort !0 \b, %d zonesadgVhf96  a , S  r M J   | _ E B #  ` 6    }[|zN{^?!tT3pG#}^qNL4++>35 string x format %s+0 string VoIP\ Startup\ and Aculab VoIP firmware+# From: Mark Brown +# Aculab VoIP firmware++0 string ESTFBINR EST flat binary+# From: Mark Brown +# EST flat binary format (which isn't, but anyway)++0 belong 0x34383931 Linux Journalled Flash File system, big endian+0 lelong 0x34383931 Linux Journalled Flash File system, little endian+# JFFS - russell@coker.com.au++>0x10040 lelong 3 r5 hash+>0x10040 lelong 2 yura hash+>0x10040 lelong 1 tea hash+>0x10000 lelong x num blocks %d+>0x10032 leshort &2 (mounted or unclean)+>0x1002c leshort x block size %d+0x10034 string ReIsEr2Fs ReiserFS V3.6+0x10034 string ReIsErFs ReiserFS V3.5+# reiserfs - russell@coker.com.au++>44 belong x %d files+>40 belong x %d blocks,+>36 belong x edition %d,+>32 belong x CRC 0x%x,+>8 belong &4 hole_support+>8 belong &2 sorted_dirs+>8 belong &1 version #2+>4 belong x size %d+0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian++>44 lelong x %d files+>40 lelong x %d blocks,+>36 lelong x edition %d,+>32 lelong x CRC 0x%x,+>8 lelong &4 hole_support+>8 lelong &2 sorted_dirs+>8 lelong &1 version #2+>4 lelong x size %d+0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian+# cramfs filesystem - russell@coker.com.au++32776 string CDROM High Sierra CD-ROM filesystem data+37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)+>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)+>32808 string >\0 '%s'+# "application id" which appears to be used as a volume label+32769 string CD001 ISO 9660 CD-ROM filesystem data+# CDROM Filesystems++#+# 11111000 Hard disk any format+# 11110000 High density 3½ floppy disk+# 11111001 Double density 3½ floppy disk, high density 5¼+#+# 11 DS, 8 SPT+# 10 SS, 8 SPT+# 01 DS, Not 8 SPT+# 00 SS, Not 8 SPT+# 111111xx Low density disk+# But now it's rather random:+#+# 11111xxx Must be one.+# xxxxx1xx Removable drive+# xxxxx0xx Not Removable drive+# xxxxxx1x 8 SPT+# xxxxxx0x Not 8 SPT+# xxxxxxx1 Double sided+# xxxxxxx0 Not two sided+# Originally a bitmap:+#+# FC xxxK Apricot 70x1x9 boot disk.+#+# F8 ----- Fixed disk +# FE 1.2 MB 8-inch, 2-sided, double-density+# FD 500K 8-inch, 2-sided, single-density+# FE 250K 8-inch, 1-sided, single-density+# FE 160K 5.25-inch, 1-sided, 8-sector+# FC 180K 5.25-inch, 1-sided, 9-sector+# FF 320K 5.25-inch, 2-sided, 8-sector+# FD 360K 5.25-inch, 2-sided, 9-sector+# F9 1.2 MB 5.25-inch, 2-sided, 15-sector+# F9 720K 3.5-inch, 2-sided, 9-sector+# F0 1.44 MB 3.5-inch, 2-sided, 18-sector+# F0 2.88 MB 3.5-inch, 2-sided, 36-sector+#+# -------------------------------------------------+# Byte Capacity Media Size and Type+#+# Valid media descriptor bytes for MS-DOS:++19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k+19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k++>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector+19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs+>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector+19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM++>0x1FE leshort 0xAA55 \b, x86 hard disk boot sectorad ikiT\A, z G ,   e c  p X $ ` 9 6  o 6  q?=? M,pPNub }IGA+# Opentype font data from Avi Bercovich++0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font+0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font++0 string \000\001\000\000\000 TrueType font data+# True Type fonts++>102 string >0 \b: %s+0 string PFR1 PFR1 font+# downloadable fonts for browser (prints type) anthon@mnt.org++4098 string DOSFONT DOSFONT2 encrypted font data+7 belong 0x00564944 DOS code page font data (from Linux?)+7 belong 0x00454741 DOS code page font data+0 belong 0xff464f4e DOS code page font data collection+# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)+>40 string x %s+>10 leshort x \b%d+>8 leshort x %dx+0 belong 0x14025919 libGrx font data,+# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C+++# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)++>3 string >2a version %-2.2s+0 string flc FIGlet controlfile+>3 string >2a version %-2.2s+0 string flf FIGlet font+# "David E. O'Brien" +# From figmagic supplied with Figlet version 2.2+# FIGlet fonts and controlfiles+#------------------------------------------------------------------------------++0 string D1.0\015 X11 Speedo font data+>12 byte 0x0a \b, MSB first+>12 byte 0x02 \b, LSB first+0 string \001fcp X11 Portable Compiled Font data+# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)+# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)++0 string STARTFONT\040 X11 BDF font text+# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)++0 lelong 00000004 X11 SNF font data, LSB first+0 belong 00000004 X11 SNF font data, MSB first+# X11 font files in SNF (Server Natural Format) format++6 string %!PS-AdobeFont-1. PostScript Type 1 font program data+>20 string >\0 (%s)+0 string %!PS-AdobeFont-1. PostScript Type 1 font text+# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com++0 short 017001 byte-swapped Berkeley vfont data+0 short 0436 Berkeley vfont data+0 string FONT ASCII vfont text+#+# fonts: file(1) magic for font data+#------------------------------------------------------------------------------++0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document+# From Dave Wilson+#+>3 byte x version %d+0 string CWS Macromedia Flash data (compressed),+>3 byte x version %d+0 string FWS Macromedia Flash data,+#+# http://www.macromedia.com/software/flash/open/+#+# See+#+# flash: file(1) magic for Macromedia Flash file format+#------------------------------------------------------------------------------++>39 ledate x created: %s+>>51 lelong x blocksize: %d bytes,+>28 leshort >1+>>32 leshort x blocksize: %d bytes,+>28 leshort <2+>4 lelong x %d inodes,+>8 lelong x %d bytes,+>30 leshort x \b%d,+>28 leshort x version %d.+0 string hsqs Squashfs filesystem, little endian,+>39 bedate x created: %s+>>51 belong x blocksize: %d bytes,+>28 beshort >1+>>32 beshort x blocksize: %d bytes,+>28 beshort <2+>4 belong x %d inodes,+>8 belong x %d bytes,+>30 beshort x \b%d,+>28 beshort x version %d.+0 string sqsh Squashfs filesystem, big endian,+# Squashfs++0 lelong 0xe0011985 Linux jffs2 filesystem data little endian+0 leshort 0x1984 Linux old jffs2 filesystem data little endian+# JFFS2 file system++>>12 string x version %s+>4 string PPCBoot+0 belong 0x27051956 PPCBoot image+# From: Mark Brown +# PPCBoot image fileadkXUs[C+ n 6   z O 7   t [ B ) h e   o $  e)Z74WT|;KH ro*}z0+# ("shared" libraries that aren't demand-paged and whose pages probably+# I suspect the two will differ only in perverse and uninteresting cases+#+# had 8K pages; dunno about MIPS.)+# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's+# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K+# (On non-x86, NetBSD does much the same thing, except that it uses+#+# set, then it's just an executable.+# if it doesn't have the "has run-time loader information" bit+#+# it's a dynamically-linked executable);+# if the entry point is = 4096 or > 4096 (i.e., >= 4096),+#+# if the entry point is < 4096, it's a shared library;+#+# then:+# if it has the "has run-time loader information" bit set,+#+# If it's demand-paged:+#+# executable.+# a dynamically-linked executable, otherwise it's just an+# if it has the "has run-time loader information" bit set, it's+#+# If it's pure:+#+# it's an object file.+# if the entry point is non-zero, it's an executable, otherwise+#+# position-independent;+# if it has the "is position-independent" bit set, it's+#+# if it doesn't have that bit set, then:+#+# a dynamically-linked executable;+# if it has the "has run-time loader information" bit set, it's+#+# If it's neither pure nor demand-paged:+#+# On x86, NetBSD says:+#+# loader information" bit is set.+# an executable, and is dynamically-linked if the "has run-time+# if the entry point is >= 4096 (or >4095, same thing), then it's+#+# is set;+# position-independent if the "is position-independent" bit+# the "has run-time loader information" bit is set, and is+# if the entry point is < 4096, then it's a shared library if+#+# above:+# Regardless of whether it's pure, demand-paged, or none of the+#+# FreeBSD says:+#+# and object files.+# schemes for distinguishing between executable images, shared libraries,+# "file"; it, and the NetBSD stuff in "netbsd", appear to use different+# XXX - this comes from the file "freebsd" in a recent FreeBSD version of+#+# little-endian on x86).+# All new-style FreeBSD magic numbers are in host byte order (i.e.,+#+# freebsd: file(1) magic for FreeBSD objects+#------------------------------------------------------------------------------++0 string \6 string 1.0 (1.0)+#>6 string 2.0 (2.0)+#>6 string 3.0 (3.0)+#0 string \13 byte x %c)+>10 string 1.0 (1.0+>10 string 2.0 (2.0+>10 string 3.0 (3.0+0 string \17 string 1.01 (%s)+0 string \17 string 1.0 (1.x)+>17 string 2.0 (2.0)+>17 string 3.0 (3.0)+0 string \9 string 1.0 (1.x)+>9 string 2.0 (2.0)+>9 string 3.0 (3.0)+>9 string 4.0 (4.0)+0 string \14 byte x %c)+>11 string 1.0 (1.0+>11 string 2.0 (2.0+>11 string 3.0 (3.0+>11 string 4.0 (4.0+>11 string 5.0 (5.0+>11 string 5.5 (5.5+0 string \ M , w Z F  { U 4   d  fgGhfc"/iRP zeP;&>!+>0 string =I main wad+1 string =WAD DOOM data,+# Thomas M. Ott (ThMO)++# games: file(1) for games+#------------------------------------------------------------------------------+#>9 byte >0 \b%02d)+#>10 byte 11 \b12-+#>10 byte 10 \b11-+#>10 byte 9 \b10-+#>10 byte 8 \b08-+#>10 byte 7 \b08-+#>10 byte 6 \b07-+#>10 byte 5 \b06-+#>10 byte 4 \b05-+#>10 byte 3 \b04-+#>10 byte 2 \b03-+#>10 byte 1 \b02-+#>10 byte 0 \b01-+#>11 leshort >0 fsav (linux) virus (%d-+#>12 byte 0x07+#8 byte 0x0a+# the eighth character is \n+# comment this out for now because it regognizes every file where++>10 byte >0 \b%02d)+>11 byte >0 \b%02d-+>8 leshort >0 (%d-+0 beshort 0x1575 fsav (linux) macro virus+# Anthon van der Neut (anthon@mnt.org)+# fsav: file(1) magic for datafellows fsav virus definition files+#------------------------------------------------------------------------------++>>11 byte x %d chars high+>>10 byte x %d chars wide by+>9 byte 2 %d bytes in header,+>8 byte x version %d,+0 string SCRSHOT_ scrshot(1) screenshot,+#+# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities+#++#>4 belong <=0 \b)+>4 belong >0 \b, version %d)+0 belong 011421044151 ld.so hints file (Big Endian+#>4 belong <=0 \b)+>4 lelong >0 \b, version %d)+0 lelong 011421044151 ld.so hints file (Little Endian+# What are you laughing about?+# /var/run/ld.so.hints++>1039 string >\0 from '%s'+7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file+#+# PTD is page-aligned+# 28: low order byte of the current PTD entry, always 0 since the+# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0+# 8/9: kernel (ring 0) ss value, always 0x0010+# byte 7: highest byte of the kernel stack pointer, always 0xfe+# cores start with a struct tss; we take advantage of the following:+# XXX gross hack to identify core files++>16 lelong >0 not stripped+>>3 byte&0x80 0x00 executable+>>3 byte&0x80 0x80 dynamically linked executable+>20 lelong >4095+>>3 byte&0xC0 0x00 object+>>3 byte&0xC0 0x40 PIC object+>>3 byte&0xC0 &0x80 shared library+>20 lelong <4096+0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged++>16 lelong >0 not stripped+>>3 byte&0x80 0x00 executable+>>3 byte&0x80 0x80 dynamically linked executable+>20 lelong >4095+>>3 byte&0xC0 0x00 object+>>3 byte&0xC0 0x40 PIC object+>>3 byte&0xC0 &0x80 shared library+>20 lelong <4096+0 lelong&0377777777 041400413 FreeBSD/i386 demand paged++>16 lelong >0 not stripped+>>3 byte&0x80 0x00 executable+>>3 byte&0x80 0x80 dynamically linked executable+>20 lelong >4095+>>3 byte&0xC0 0x00 object+>>3 byte&0xC0 0x40 PIC object+>>3 byte&0xC0 &0x80 shared library+>20 lelong <4096+0 lelong&0377777777 041400410 FreeBSD/i386 pure++>16 lelong >0 not stripped+>>3 byte&0x80 0x00 executable+>>3 byte&0x80 0x80 dynamically linked executable+>20 lelong >4095+>>3 byte&0xC0 0x00 object+>>3 byte&0xC0 0x40 PIC object+>>3 byte&0xC0 &0x80 shared library+>20 lelong <4096+0 lelong&0377777777 041400407 FreeBSD/i386+#+# executables using the NetBSD technique.)+# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged+# probably better than separately checking for "=4096" and ">4096",+# what the right answer is (although using ">4095", FreeBSD-style, is+# I leave it to those more familiar with FreeBSD and NetBSD to figure out+#+# won't actually be shared, executables with entry points <4096).adrOO"}J T R   [ " U 2    v K I "     j  .KSi3EY rq+0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium+0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate+0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine+0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair+0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system+0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment+0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels+0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)+0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight+0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror+0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin+0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central+0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette+0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse+0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress+0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)+0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)+0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel+0 string 5\x0athe_Installation Quake I save: e2m1 The installation+0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon+0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon+0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep+0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)+0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto+0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis+0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned+0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex+0 string 5\x0aIntroduction Quake I save: start Introduction++# Quake 1++# The levels++#0 string 5\x0a Quake I save++#>61 string x level %s +#>30 string x version %.4s+#0 string -1\x0a Quake I demo++0 string PACK Quake I or II world or extension++# Quake++>44 string x , world=%s+>0 string x , name=%s+24 string LxD\ 203 Linuxdoom save++# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01+0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo++0 string PWAD DOOM or DOOM ][ extension world+0 string IWAD DOOM or DOOM ][ world++# DOOM++# submitted by Nicolas Patrois+# Doom and Quake+#---------------------------------------------------------------------------++0 string IDS2 Quake II SP2 sprite file++>4 long 0x2E III Map file (BSP)+>4 long 0x26 II Map file (BSP)+0 string IBSP Quake++>32 long x %u triangles/frame+>28 long x %u texture coordinates,+>24 long x %u vertices/frame,+>16 long x Frame size %u bytes,+>40 long x %u frame(s),+>12 long x %u),+>8 long x (%u x+>20 long x %u skin(s),+0 string IDP2 Quake II 3D Model file,+# Quake II - III data files+# Fabio Bonelli ++>0 byte x unknown junk+>0 string =P patch wadad$@ab V   e  u &  . Q  |!}=@y8@^I  d$#+0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!+0 string 5\x0aSub_Station Quake I save: ddm2 Sub station+0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct++# Malice DeathMatch levels++0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!+0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ+0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive+0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories+0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base+0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base+0 string 5\x0aThe_Foundry Quake I save: d7b The foundry+0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant+0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant+0 string 5\x0aThe_Flood Quake I save: d5 The flood+0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood+0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life+0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers+0 string 5\x0aArea44 Quake I save: d1c Area 44+0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice+0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)+0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)+0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions+0 string 5\x0aArea_33 Quake I save: d1b Area 33+0 string 5\x0aThe_Lab Quake I save: d1 The lab+0 string 5\x0aThe_Academy Quake I save: start The academy++# Malice++0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair+0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet+0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)+0 string 5\x0aLimbo Quake I save: hip3m3 Limbo+0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium+0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment+0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep+0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt+0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs+0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral+0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)+0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms+0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility+0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine+0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)+0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility+0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station+0 string 5\x0aCommand_HQ Quake I save: start Command HQ++# Scourge of Armagon++0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone+0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern+0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place+0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base+0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis+0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths++# Quake DeathMatch levels++0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit+0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony+0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze+0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)adcm:M  u ` K .  | z ) j W C A   X  U mV?*yTRig+i<jN3{A"{6++# magic. Nevertheless, it covers many keyrings.+# This magic is not particularly good, as the keyrings don't have true+0 beshort 0x9901 GPG key public ring+>4 byte x version %d+0 string \001gpg GPG key trust database+# The format is very similar to pgp+# GnuPG+>8 lelong >0 \b, version %d+0 string *nazgul* Nazgul style compiled message catalog+# message catalogs, from Mitchum DSouza +>8 belong x %d messages+>4 belong x revision %d,+0 string \225\4\22\336 GNU message catalog (big endian),+>8 lelong x %d messages+>4 lelong x revision %d,+0 string \336\22\4\225 GNU message catalog (little endian),+#+# GNU nlsutils message catalog file format+#+20 string GIMP GIMP brush data++# ('Bucky' LaDieu, nega@vt.edu)+# by Spencer Kimball and Peter Mattis+# XCF: file(1) magic for the brushes used in the GIMP, developed+#------------------------------------------------------------------------------++>24 string x %s+20 string GPAT GIMP pattern data,++# ('Bucky' LaDieu, nega@vt.edu)+# by Spencer Kimball and Peter Mattis+# XCF: file(1) magic for the patterns used in the GIMP, developed+#------------------------------------------------------------------------------++>22 belong >2 Unknown Image Type.+>22 belong 2 Indexed Color+>22 belong 1 Greyscale+>22 belong 0 RGB Color+>18 belong x %u,+>14 belong x %u x+>>10 string >\0 %s,+>9 string v version+>9 string file version 0,+0 string gimp\ xcf GIMP XCF image data,++# ('Bucky' LaDieu, nega@vt.edu)+# by Spencer Kimball and Peter Mattis+# XCF: file(1) magic for the XCF image format used in the GIMP developed+#------------------------------------------------------------------------------++0 string GIMP\ Gradient GIMP gradient data++# by Federico Mena +# GIMP Gradient: file(1) magic for the GIMP's gradient data files+#------------------------------------------------------------------------------+>4 byte 79 for Objective C+++>4 byte 43 for C+++>4 byte 111 for Objective C+>4 byte 67 for C+# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'++>7 byte x \b%c)+>6 byte x \b%c+>5 byte x (version %c+# The version field is annoying. It's 3 characters, not zero-terminated.++0 string gpch GCC precompiled header+#+# gcc: file(1) magic for GCC special files+#------------------------------------------------------------------------------++#>168 string >\0 \b, copyright "%s"+#>54 short x \br%d+#>52 short x \b, proto %d+#>50 short x \b.%d+#>48 short x \b, rev %d+#>46 short x \b.%d+#>44 short x \b, version %d+>4 string >\0 \b, name "%s"+>40 byte >4 unknown+>40 byte <1 unknown+>40 byte 4 directory label+>40 byte 3 binary+>40 byte 2 VMFile+>40 byte 1 executable+0 belong 0xc745c153 GEOS+# semi-commonly used in embedded and handheld systems.+# GEOS files (Vidar Madsen, vidar@gimp.org)+#------------------------------------------------------------------------------++>12 belong x version %u+0 string MComprHD MAME CHD compressed hard disk image,+++0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder+0 string 5\x0aDOMINO Quake I save: ddm6 Domino+0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse+0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationaadcWfd A %  t b , U  ] . " v M )  xO/ hX6 |Y8y^C(R#!I^0-+>18 leshort&0x0002 =0x0002 executable+>18 leshort&0x0002 =0x0000 object+0 leshort 0x0550 Hitachi SH little-endian COFF+#+>18 beshort&0x0008 =0x0000 \b, not stripped+>18 beshort&0x0008 =0x0008 \b, stripped+>18 beshort&0x0002 =0x0002 executable+>18 beshort&0x0002 =0x0000 object+0 beshort 0x0500 Hitachi SH big-endian COFF+#+# Super-H COFF+#+# hitach-sh: file(1) magic for Hitachi Super-H+#------------------------------------------------------------------------------++0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data+0 belong 0x0e031301 Hierarchical Data Format (version 4) data++# specifications at http://hdf.ncsa.uiuc.edu/+# Hierarchical Data Format, used to facilitate scientific data exchange+#------------------------------------------------------------------------------++>3 string >3 v.%.1s (unknown details)+#file format >3+>>8 byte&0x03 0x03 lvl.9+>>8 byte&0x03 0x02 lvl.6+>>8 byte&0x03 0x01 lvl.3+>>8 byte&0x03 0x00 lvl.0+>>8 byte&0x04 0x04 BZip2+>>8 byte&0x04 0x00 ZLib+>>8 byte&0x08 0x08 RIPEMD-160 hash,+>>8 byte&0x08 0x00 SHA1 hash,+>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,+>>8 byte&0x70 0x60 3DES crypt,+>>8 byte&0x70 0x50 LOKI97 crypt,+>>8 byte&0x70 0x40 SAFER+ crypt,+>>8 byte&0x70 0x30 CAST-256 crypt,+>>8 byte&0x70 0x20 TWOFISH crypt, +>>8 byte&0x70 0x10 SERPENT crypt,+>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,+>3 string 3 v.3, OpenPGP S2K, +#file format 3+>>8 byte&0x03 0x03 lvl.9+>>8 byte&0x03 0x02 lvl.6+>>8 byte&0x03 0x01 lvl.3+>>8 byte&0x03 0x00 lvl.0+>>8 byte&0x04 0x04 BZip2+>>8 byte&0x04 0x00 ZLib+>>8 byte&0x08 0x08 RIPEMD-160 hash,+>>8 byte&0x08 0x00 SHA1 hash,+>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,+>>8 byte&0x70 0x60 3DES crypt,+>>8 byte&0x70 0x50 LOKI97 crypt,+>>8 byte&0x70 0x40 SAFER+ crypt,+>>8 byte&0x70 0x30 CAST-256 crypt,+>>8 byte&0x70 0x20 TWOFISH crypt, +>>8 byte&0x70 0x10 SERPENT crypt,+>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,+>3 string 2 v.2, MCRYPT S2K, +#file format 2+>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9+#file format 1+0 string GRG Gringotts data file+#GRG3????Y+# author: Germano Rizzo +# http://devel.pluto.linux.it/projects/Gringotts/+# gringotts: file(1) magic for Gringotts+#------------------------------------------------------------------------------++# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE+0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file+# ACE/gr fit description files+>>35 string >\0 \b.%.2s)+>>33 string >\0 \b.%.2s+>>32 byte >0 %c+>23 string @version\ (version+0 string #\ Grace\ project\ file Grace project file+# Grace projects+0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file+0 string #\ xmgr\ parameter\ file ACE/gr ascii file+0 string #\ xvgr\ parameter\ file ACE/gr ascii file+# ACE/gr ascii+>39 byte >0 - version %c+0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file+# ACE/gr binary+#+# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE+#------------------------------------------------------------------------------++>7 string 02 \b (frcode)+>7 string >\0 \b, format %s+0 string \0LOCATE GNU findutils locate database data+# gnu find magic+# From: James Youngman ++39 string = [ + s F D A ~Z; BsFl>lj9xvDa3+>168 belong &0x00000004 dynamically linked+0 belong 0x0214010b PA-RISC2.0 demand-load executable++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong &0x00000004 dynamically linked+0 belong 0x02140108 PA-RISC2.0 shared executable++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong &0x00000004 dynamically linked+0 belong 0x02140107 PA-RISC2.0 executable++0 belong 0x02140106 PA-RISC2.0 relocatable object+#### PA-RISC 2.0++>96 belong >0 - not stripped+0 belong 0x0210010d PA-RISC1.1 dynamic load library++>96 belong >0 - not stripped+0 belong 0x0210010e PA-RISC1.1 shared library++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong&0x4 0x4 dynamically linked+0 belong 0x0210010b PA-RISC1.1 demand-load executable++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong&0x4 0x4 dynamically linked+0 belong 0x02100108 PA-RISC1.1 shared executable++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong &0x00000004 dynamically linked+0 belong 0x02100107 PA-RISC1.1 executable+0 belong 0x02100106 PA-RISC1.1 relocatable object+#### PA-RISC 1.1+0 long 01602007412 TML 3210 byte-order format+0 long 01003405017 TML 2301 byte-order format+0 long 01702407010 TML 1032 byte-order format+0 long 01203604016 TML 0123 byte-order format+>22 beshort >0 - version %d+>18 beshort ^040000 not stripped+0 beshort 0624 apollo a88k COFF executable+>22 beshort >0 - version %d+>18 beshort ^040000 not stripped+0 beshort 0627 Apollo m68k COFF executable+#### Old Apollo stuff+#+# like the old 177545 archives (0xff65 = 0177545).+# The "misc" stuff needs a byte order; the archives look suspiciously+#++# 0 beshort 0x214 PA-RISC2.0 HP-UX binary+# 0 beshort 0x211 PA-RISC1.2 HP-UX binary+# 0 beshort 0x210 PA-RISC1.1 HP-UX binary+# 0 beshort 0x20b PA-RISC1.0 HP-UX binary+# 0 beshort 0x20e hp400 (68040?) HP-UX binary+# 0 beshort 0x20d hp400 (68030) HP-UX binary+# 0 beshort 0x20c hp200/300 HP-UX binary+# 0 beshort 300 hp300 (68020+68881) BSD binary+# 0 beshort 200 hp200 (68010) BSD binary+#+# completely?+# used in executables, or have they just not yet updated "/etc/magic"+# stuff, and the 68030 and 68040 stuff isn't there at all - are they not+# "/etc/magic", though, except for the "archive file relocatable library"+# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0+# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,+# Guy Harris (guy@netapp.com): some additions to this list came from+#+# practice in order to avoid collisions.+# HP magic is useful for reference, but using "long" magic is a better+# hp300 are 68020+68881 based; hp400 are also 68k. The following basic+# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;+#+# big-endian or little-endian.+# UNIX environment atop the "SUN kernel"; dunno whether it was+# I think the 500 series was the old stack-based machines, running a+#+# big-endian as it was mostly 68K-based.+# applied to the "TML" stuff; I'm assuming the Apollo stuff is+# XXX - somebody should figure out whether any byte order needs to be+#+# hp: file(1) magic for Hewlett Packard machines (see also "printer")+#------------------------------------------------------------------------------+++>18 leshort&0x0008 =0x0000 \b, not stripped+>18 leshort&0x0008 =0x0008 \b, strippedadwzZXc5 h f -  c a *  q 7 y ] [ /    j G ) ' mOMig2Q3qS3wT,xTR$=+>7 byte >0 - Rev %c+0 string HPHP48- HP48 binary+# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92++>8 long >0 %d messages+0 string msgcat01 HP NLS message catalog,++0 long 0x020c010c compiled Lisp+#0 short 0x8000 lif file+# XXX - see "lif"+0 string IMGfile CIS compimg HP Bitmapfile++0 string Bitmapfile HP Bitmapfile+>8 byte >0 - version %d+0 long 0x4da7eee8 HP-WINDOWS font++0 long 0x015821a6 HP core file++0 long 0x0208ff65 HP s500 old archive+0 long 0x020cff65 HP s200 old archive+0 long 0x020aff65 HP s200 old archive+0 long 0x0000ff65 HP old archive+#### MISC++>36 belong >0 not stripped+>6 beshort >0 - highwater %d+>4 beshort >0 - version %d+0 belong 0x020c010d HP s200 dynamic load library++>36 belong >0 not stripped+>6 beshort >0 - highwater %d+>4 beshort >0 - version %d+0 belong 0x020c010e HP s200 shared library++>36 belong >0 not stripped+>4 beshort >0 - version %d+0 belong 0x020a0107 HP s200 (2.x release) executable++>36 belong >0 not stripped+>4 beshort >0 - version %d+0 belong 0x020a0108 HP s200 (2.x release) pure executable++>8 belong &0x10000000 PIC+>8 belong &0x20000000 debuggable+>8 belong &0x80000000 save fp regs+>6 beshort >0 - highwater %d+>4 beshort >0 - version %d+0 belong 0x020c0106 HP s200 relocatable executable++>36 belong >0 not stripped+>8 belong &0x20000000 debuggable+>8 belong &0x40000000 dynamically linked+>8 belong &0x80000000 save fp regs+>4 beshort >0 - version %d+0 belong 0x020c010b HP s200 demand-load executable++>36 belong >0 not stripped+>8 belong &0x20000000 debuggable+>8 belong &0x40000000 dynamically linked+>8 belong &0x80000000 save fp regs+>4 beshort >0 - version %d+0 belong 0x020c0107 HP s200 executable++>36 belong >0 not stripped+>8 belong &0x20000000 debuggable+>8 belong &0x40000000 dynamically linked+>8 belong &0x80000000 save fp regs+>4 beshort >0 - version %d+0 belong 0x020c0108 HP s200 pure executable+#### 200++>16 long >0 - version %d+0 long 0x02080108 HP s500 pure executable++>16 long >0 - version %d+0 long 0x02080107 HP s500 executable++>16 long >0 - version %d+0 long 0x02080106 HP s500 relocatable executable+#### 500++>68 belong 0x02140619 - PA-RISC2.0 relocatable library+>68 belong 0x02110619 - PA-RISC1.2 relocatable library+>68 belong 0x02100619 - PA-RISC1.1 relocatable library+>68 belong 0x020b0619 - PA-RISC1.0 relocatable library+0 belong 0x213c6172 archive file++>96 belong >0 - not stripped+0 belong 0x020b010d PA-RISC1.0 dynamic load library++>96 belong >0 - not stripped+0 belong 0x020b010e PA-RISC1.0 shared library++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong&0x4 0x4 dynamically linked+0 belong 0x020b010b PA-RISC1.0 demand-load executable++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong&0x4 0x4 dynamically linked+0 belong 0x020b0108 PA-RISC1.0 shared executable++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linked+>168 belong&0x4 0x4 dynamically linked+0 belong 0x020b0107 PA-RISC1.0 executable++0 belong 0x020b0106 PA-RISC1.0 relocatable object+#### 800++>96 belong >0 - not stripped+0 belong 0x0214010d PA-RISC2.0 dynamic load library++>96 belong >0 - not stripped+0 belong 0x0214010e PA-RISC2.0 shared library++>96 belong >0 - not stripped+>(144) belong 0x054ef630 dynamically linkedadkoS6oQ5 k O 3   n U S <  c ?   ` ?  2 zS?1j>e9 _L9% U){N"n[H1+>>>>>>>>0xB4 belong 4 core file+>>>>>>>0x6C belong 0x44+>>>>>>0x60 belong 0x100+>>>>>0x20 belong 0x3C+>>>>0x14 belong 2+>>>0x10 belong 1+>>0xC belong 4+>0 belong 1+0x24 string HP-UX+# Order 3: FORMAT, KERNEL, EXEC, PROC+>>>>>>>>>0xC4 belong 34 - received SIGXFSZ+>>>>>>>>>0xC4 belong 33 - received SIGXCPU+>>>>>>>>>0xC4 belong 12 - received SIGSYS+>>>>>>>>>0xC4 belong 11 - received SIGSEGV+>>>>>>>>>0xC4 belong 10 - received SIGBUS+>>>>>>>>>0xC4 belong 8 - received SIGFPE+>>>>>>>>>0xC4 belong 7 - received SIGEMT+>>>>>>>>>0xC4 belong 6 - received SIGABRT+>>>>>>>>>0xC4 belong 5 - received SIGTRAP+>>>>>>>>>0xC4 belong 4 - received SIGILL+>>>>>>>>>0xC4 belong 3 - received SIGQUIT+>>>>>>>>>0xA4 string >\0 from '%s'+>>>>>>>>0xB4 belong 4 core file+>>>>>>>0x6C belong 0x44+>>>>>>0x60 belong 0x100+>>>>>0x5C belong 1+>>>>0x58 belong 4+>>>0x4C belong 1+# Order 2: KERNEL, FORMAT, EXEC, PROC+>>>>>>>>>0xC4 belong 34 - received SIGXFSZ+>>>>>>>>>0xC4 belong 33 - received SIGXCPU+>>>>>>>>>0xC4 belong 12 - received SIGSYS+>>>>>>>>>0xC4 belong 11 - received SIGSEGV+>>>>>>>>>0xC4 belong 10 - received SIGBUS+>>>>>>>>>0xC4 belong 8 - received SIGFPE+>>>>>>>>>0xC4 belong 7 - received SIGEMT+>>>>>>>>>0xC4 belong 6 - received SIGABRT+>>>>>>>>>0xC4 belong 5 - received SIGTRAP+>>>>>>>>>0xC4 belong 4 - received SIGILL+>>>>>>>>>0xC4 belong 3 - received SIGQUIT+>>>>>>>>>0x90 string >\0 from '%s'+>>>>>>>>0xB4 belong 4 core file+>>>>>>>0xB0 belong 1+>>>>>>0xAC belong 4+>>>>>0xA0 belong 1+>>>>0x58 belong 0x44+>>>0x4C belong 0x100+>>0xC belong 0x3C+>0 belong 2+0x10 string HP-UX+# Order 1: KERNEL, EXEC, FORMAT, PROC+# assume that PROC will always be last+# but we include all 6 variations of the order of the first 3, and+# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC+# CORE_FORMAT, which contains the version of the core file format (== 1)+# CORE_PROC, which contains the signal number that caused the core dump+# CORE_EXEC, which contains the name of the command+# CORE_KERNEL, which starts with the string "HP-UX"+# There are four we care about:+# Unfortunately, HP-UX uses corehead blocks without specifying the order+# HP-UX 10.20 core file format from /usr/include/sys/core.h+# From David Gero +#+>2 beshort 0413 demand paged binary+>2 beshort 0410 read-only binary+>2 beshort 0407 impure binary+0 beshort 300 hp300 (68020+68881) BSD+>2 beshort 0413 demand paged binary+>2 beshort 0410 read-only binary+>2 beshort 0407 impure binary+0 beshort 200 hp200 (68010) BSD+# hpBSD magic numbers++>14 string F(,) F(,);+>14 string F(.) F(.);+>10 string A(G) A(G)+>10 string A(R) A(R)+>10 string A(D) A(D)+>6 string T(3) - T(3)+>6 string T(2) - T(2)+>6 string T(1) - T(1)+>6 string T(0) - T(0)+0 string %%HP: HP48 text+>8 beshort 0x922e (XLIB)+>8 beshort 0x6d2e (LNAME)+>8 beshort 0x482e (GNAME)+>8 beshort 0xcc2d (CODE)+>8 beshort 0x9d2d (PROG)+>8 beshort 0x882b (LIBDATA)+>8 beshort 0x622b (BACKUP)+>8 beshort 0x402b (LIB)+>8 beshort 0x1e2b (GROB)+>8 beshort 0xfc2a (TAGGED)+>8 beshort 0xda2a (UNIT)+>8 beshort 0xb82a (ALG)+>8 beshort 0x962a (DIR)+>8 beshort 0x742a (LIST)+>8 beshort 0x4e2a (HXS)+>8 beshort 0x2c2a (STRING)+>8 beshort 0x0a2a (LNKARRAY)+>8 beshort 0xe829 (ARRAY)+>8 beshort 0xbf29 (CHAR)+>8 beshort 0x9d29 (LCOMPLX)+>8 beshort 0x7729 (COMPLX)+>8 beshort 0x5529 (LREAL)+>8 beshort 0x3329 (REAL)+>8 beshort 0x1129 (ADR)ad*eX,}Q$ m Y D . d 8 ] 0   h S :  p D  i<sZ8d9\/-I5sP2g= +#0 belong 0xd1010000 Human68k ar ascii archive+#0 belong 0xd1000000 Human68k ar binary archive+#0 beshort 0x6000 Human68k object file+#0 beshort 0x601a Human68k Z executable+#>32 belong >0 with debug information+#>28 belong >0 not stripped+#>4 belong >0 - base address 0x%x+#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1+#>0 string HU X executable+#>(8.L+66) string #HUPAIR hupair+#>60 belong >0 binded+#>>(8.L+78) string >\0 (version %s)+#>(8.L+74) string LZX LZX compressed+#>>72 string >\0 (version %s)+#>68 string LZX LZX compressed+#0 string HU Human68k+# Magic too short!+# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats+#------------------------------------------------------------------------------+++0 string HPHP49- HP49 binary+# From: AMAKAWA Shuhei ++>>>>>>>>>0xC4 belong 34 - received SIGXFSZ+>>>>>>>>>0xC4 belong 33 - received SIGXCPU+>>>>>>>>>0xC4 belong 12 - received SIGSYS+>>>>>>>>>0xC4 belong 11 - received SIGSEGV+>>>>>>>>>0xC4 belong 10 - received SIGBUS+>>>>>>>>>0xC4 belong 8 - received SIGFPE+>>>>>>>>>0xC4 belong 7 - received SIGEMT+>>>>>>>>>0xC4 belong 6 - received SIGABRT+>>>>>>>>>0xC4 belong 5 - received SIGTRAP+>>>>>>>>>0xC4 belong 4 - received SIGILL+>>>>>>>>>0xC4 belong 3 - received SIGQUIT+>>>>>>>>>0x44 string >\0 from '%s'+>>>>>>>>0xB4 belong 4 core file+>>>>>>>0x74 belong 0x2C+>>>>>>0x68 belong 2+>>>>>0x64 belong 1+>>>>0x60 belong 4+>>>0x54 belong 1+>>0xC belong 0x44+>0 belong 0x100+# Order 6: EXEC, FORMAT, KERNEL, PROC+>>>>>>>>>0xC4 belong 34 - received SIGXFSZ+>>>>>>>>>0xC4 belong 33 - received SIGXCPU+>>>>>>>>>0xC4 belong 12 - received SIGSYS+>>>>>>>>>0xC4 belong 11 - received SIGSEGV+>>>>>>>>>0xC4 belong 10 - received SIGBUS+>>>>>>>>>0xC4 belong 8 - received SIGFPE+>>>>>>>>>0xC4 belong 7 - received SIGEMT+>>>>>>>>>0xC4 belong 6 - received SIGABRT+>>>>>>>>>0xC4 belong 5 - received SIGTRAP+>>>>>>>>>0xC4 belong 4 - received SIGILL+>>>>>>>>>0xC4 belong 3 - received SIGQUIT+>>>>>>>>>0x58 string >\0 from '%s'+>>>>>>>>0xB4 belong 4 core file+>>>>>>>0x74 belong 0x3C+>>>>>>0x68 belong 2+>>>>>0x20 belong 0x44+>>>>0x14 belong 0x100+>>>0x10 belong 1+>>0xC belong 4+>0 belong 1+0x78 string HP-UX+# Order 5: FORMAT, EXEC, KERNEL, PROC+>>>>>>>>>0xC4 belong 34 - received SIGXFSZ+>>>>>>>>>0xC4 belong 33 - received SIGXCPU+>>>>>>>>>0xC4 belong 12 - received SIGSYS+>>>>>>>>>0xC4 belong 11 - received SIGSEGV+>>>>>>>>>0xC4 belong 10 - received SIGBUS+>>>>>>>>>0xC4 belong 8 - received SIGFPE+>>>>>>>>>0xC4 belong 7 - received SIGEMT+>>>>>>>>>0xC4 belong 6 - received SIGABRT+>>>>>>>>>0xC4 belong 5 - received SIGTRAP+>>>>>>>>>0xC4 belong 4 - received SIGILL+>>>>>>>>>0xC4 belong 3 - received SIGQUIT+>>>>>>>>>0x44 string >\0 from '%s'+>>>>>>>>0xB4 belong 4 core file+>>>>>>>0xB0 belong 1+>>>>>>0xAC belong 4+>>>>>0xA0 belong 1+>>>>0x60 belong 0x3C+>>>0x54 belong 2+>>0xC belong 0x44+>0 belong 0x100+0x64 string HP-UX+# Order 4: EXEC, KERNEL, FORMAT, PROC+>>>>>>>>>0xC4 belong 34 - received SIGXFSZ+>>>>>>>>>0xC4 belong 33 - received SIGXCPU+>>>>>>>>>0xC4 belong 12 - received SIGSYS+>>>>>>>>>0xC4 belong 11 - received SIGSEGV+>>>>>>>>>0xC4 belong 10 - received SIGBUS+>>>>>>>>>0xC4 belong 8 - received SIGFPE+>>>>>>>>>0xC4 belong 7 - received SIGEMT+>>>>>>>>>0xC4 belong 6 - received SIGABRT+>>>>>>>>>0xC4 belong 5 - received SIGTRAP+>>>>>>>>>0xC4 belong 4 - received SIGILL+>>>>>>>>>0xC4 belong 3 - received SIGQUIT+>>>>>>>>>0xA4 string >\0 from '%s'ad!do=;mL.+ } _ @ "  u W ( R 4 p R 0 q S ' b_|]>~b975ERP6 wNY-+# other formats+>8 string TDDD \b, TDDD 3-D rendering+>8 string DR2D \b, DR2D 2-D object+>8 string RGB8 \b, RGB8 24-bit RGB image+>8 string RGBN \b, RGBN 12-bit RGB image+>>22 beshort x %d+>>20 beshort x \b, %d x+>8 string ILBMBMHD \b, ILBM interleaved image+# image formats+>8 string PTCH \b, PTCH binary patch+>8 string DTYP \b, DTYP datatype description+>8 string SAMP \b, SAMP sampled audio+>8 string 8SVX \b, 8SVX 8-bit sampled sound voice+>8 string AIFC \b, AIFF-C compressed audio+>8 string AIFF \b, AIFF audio+# audio formats+#>4 belong x \b, FORM is %d bytes long+0 string FORM IFF data++# FORM type, which is followed by the first chunk in the FORM.+# IFF files begin with an 8 byte FORM header, followed by a 4 character+#+# especially Commodore-Amiga.+# Arts for file interchange. It has also been used by Apple, SGI, and+# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic+#+# iff: file(1) magic for Interchange File Format (see also "audio" & "images")+#------------------------------------------------------------------------------+++0 string \ archive (big format)+0 string \ archive+0 belong 0x000001f9 AIX compiled message catalog+0 string 0xabcdef AIX message catalog+0 beshort 0xfe04 structured file+0 beshort 0x0105 ctab data+0 beshort 0x0104 shared library+#>6 beshort >0 - version %d+#>28 belong >0 not stripped+#>2 byte 0x50 pure+#0 beshort 0x0103 executable (RT Version 2) or obj module+# Breaks sun4 statically linked execs.+>12 belong >0 not stripped+0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module+#+# ibm6000: file(1) magic for RS/6000 and the RT PC.+#------------------------------------------------------------------------------++>24 belong >0 - version %d+>12 belong >0 not stripped+0 beshort 0535 SVR2 executable (USS/370)+>24 belong >0 - version %d+>12 belong >0 not stripped+0 beshort 0530 SVR2 pure executable (USS/370)+>24 belong >0 - version %d+>12 belong >0 not stripped+0 beshort 0534 SVR2 pure executable (Amdahl-UTS)+>24 belong >0 - version %d+>12 belong >0 not stripped+0 beshort 0531 SVR2 executable (Amdahl-UTS)+>12 belong >0 not stripped+0 beshort 057401 370 XA sysV executable+>12 belong >0 not stripped+0 beshort 056401 370 sysV executable+>12 belong >0 not stripped+0 beshort 055001 370 XA sysV pure executable+>12 belong >0 not stripped+0 beshort 054001 370 sysV pure executable+>30 belong >0 - 5.2 format+>22 beshort >0 - version %d+>12 belong >0 not stripped+0 beshort 0532 370 XA sysV pure executable +>30 belong >0 - 5.2 format+>22 beshort >0 - version %d+>12 belong >0 not stripped+0 beshort 0537 370 XA sysV executable +#+# instead of the "USS/370" versions of the same magic numbers.+#+# >30 long >0 - 5.2 format+# >22 short >0 - version %d+# >12 long >0 not stripped+# 0 short 0530 370 sysV pure executable +# >30 long >0 - 5.2 format+# >22 short >0 - version %d+# >12 long >0 not stripped+# 0 short 0535 370 sysV executable +#+# AIX 4.1's "/etc/magic" has+# What the heck *is* "USS/370"?+# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".+#+# ibm370: file(1) magic for IBM 370 and compatibles.+#------------------------------------------------------------------------------++#2 string #HUPAIR Human68k hupair R executable+#>4 string LZX R executable+#>8 string >\0 (version %s)+#4 string LZX Human68k LZX compressed+#0 beshort 0x0068 Human68k lib archivead*g1q;8  v 2 j 3   t < &  _ : S   hO64:N)gP:%iK1rQ1lJH+# 1 plane, no encoding.+# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,++#>10 byte&0x07 =0x07 256 colors+#>10 byte&0x07 =0x06 128 colors+#>10 byte&0x07 =0x05 64 colors+#>10 byte&0x07 =0x04 32 colors+#>10 byte&0x07 =0x03 16 colors+#>10 byte&0x07 =0x02 8 colors+#>10 byte&0x07 =0x01 4 colors+#>10 byte&0x07 =0x00 2 colors+#>10 byte &0x80 color mapped,+>8 leshort >0 %d+>6 leshort >0 %d x+>4 string 9a \b, version 8%s,+>4 string 7a \b, version 8%s,+0 string GIF8 GIF image data+# GIF++1 string PNG PNG image data, CORRUPTED+>>28 byte 1 interlaced+>>28 byte 0 non-interlaced+#>>26 byte 0 deflate/32K,+>>25 byte 6 \b/color RGBA,+>>25 byte 4 gray+alpha,+>>25 byte 3 colormap,+>>25 byte 2 \b/color RGB,+>>25 byte 0 grayscale,+>>24 byte x %d-bit+>>20 belong x %d,+>>16 belong x %d x+>4 belong 0x0d0a1a0a+>4 belong !0x0d0a1a0a CORRUPTED,+0 string \x89PNG PNG image data,+#+# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...+#+# (Albert Cahalan, acahalan@cs.uml.edu)+# (Greg Roelofs, newt@uchicago.edu)+# PNG [Portable Network Graphics, or "PNG's Not GIF"] images++0 string II\x2a\x00 TIFF image data, little-endian+0 string MM\x00\x2a TIFF image data, big-endian+# never changed. The TIFF specification recommends testing for it.+# The second word of TIFF files is the TIFF version number, 42, which has+# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)++0 string IIN1 NIFF image data+# NIFF (Navy Interchange File Format, a modification of TIFF) images++>21 byte 51 version 3+>21 byte 48 version 2+0 string .MDP MicroDesign page data+>21 byte 51 version 3+>21 byte 48 version 2+0 string .MDA MicroDesign data+>4 string \021 MGI Type 17+>4 string \013 MGI Type 11+0 string \117\072 Solitaire Image Recorder format+# From: bryanh@giraffe-data.com (Bryan Henderson)++0 string P7 Netpbm PAM image file+0 string P6 Netpbm PPM "rawbits" image data+0 string P5 Netpbm PGM "rawbits" image data+0 string P4 Netpbm PBM "rawbits" image data+0 string P3 Netpbm PPM image text+0 string P2 Netpbm PGM image text+0 string P1 Netpbm PBM image text+# The next byte following the magic is always whitespace.+# PBMPLUS images++>14 leshort >0 %d+>12 leshort >0 %d x+>2 byte&8 8 - RLE+1 belong&0xfff7ffff 0x00030000 Targa image data - Mono+>14 leshort >0 %d+>12 leshort >0 %d x+>2 byte&8 8 - RLE+1 belong&0xfff7ffff 0x00020000 Targa image data - RGB+>14 leshort >0 %d+>12 leshort >0 %d x+>2 byte&8 8 - RLE+1 belong&0xfff7ffff 0x01010000 Targa image data - Map+# `tgatoppm' recognizes a superset (Index may be anything)+# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)+# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs+# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise+# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11+# by Philippe De Muyter +# Targa - matches `povray', `ppmtotga' and `xv' outputs++# little magic: PCX (first byte is 0x0a)+#+# merging several one- and two-line files into here.+# additions by janl@ifi.uio.no as well as others. Jan also suggested+# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),+#+# images: file(1) magic for image formats (see also "iff")+#------------------------------------------------------------------------------++>8 string PREF \b, PREF preferences+>8 string CTLG \b, CTLG message catalog+>8 string FTXT \b, FTXT formatted textad*m~b86+wu% ] @ !  t X  b " n T 9 7 % [ 6 4 2 sM2~X5 ;c7]42ydb qV:%+>20 belong 5 IFF,+>20 belong 4 TIFF,+>20 belong 3 RGB,+>20 belong 2 compressed,+#>20 belong 1 standard,+>20 belong 0 old format,+#>16 belong >0 %d bytes long,+>12 belong >0 %d-bit,+>8 belong >0 %d,+>4 belong >0 \b, %d x+0 belong 0x59a66a95 Sun raster image data+# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)++>10 string >\0 %s+# this adds the whole header (inc. version number), informative but longish+0 string Imagefile\ version- iff image data+# image file format (Robert Potter, potter@cs.rochester.edu)++>13 byte >0 \b, %d color map channels+>12 byte >0 \b, %d bits per pixel+>11 byte >0 \b, %d color channels+>10 byte&0x8 =0x8 \b, comment+>10 byte&0x4 =0x4 \b, alpha channel+>10 byte&0x2 =0x2 \b, no background+>10 byte&0x1 =0x1 \b, clear first+>4 leshort >0 \b, lower right corner: %d+>2 leshort >0 \b, lower left corner: %d+>8 leshort x %d+>6 leshort x %d x+0 leshort 0xcc52 RLE image data,+# Utah Raster Toolkit RLE images (janl@ifi.uio.no)++0 string /*\ XPM\ */ X pixmap image text+# note possible collision with C/REXX entry in c-lang; currently commented out+# XPM icons (Greg Roelofs, newt@uchicago.edu)++#0 string BA PC bitmap array data+# Conflicts with other entries [BABYL]+#0 string CP PC color pointer image data+#0 string CI PC color icon data+#0 string PI PC pointer image data+#0 string IC PC icon data+# Too simple - MPi+>>28 leshort x %d+>>22 lelong x %d x+>>18 lelong x \b, %d x+>14 leshort 40 \b, Windows 3.x format+>>20 leshort x %d+>>18 leshort x \b, %d x+>14 leshort 64 \b, OS/2 2.x format+>>20 leshort x %d+>>18 leshort x \b, %d x+>14 leshort 12 \b, OS/2 1.x format+0 string BM PC bitmap data+# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)+++0 string Sfff structured fax file+# From: Herbert Rosmanith +>29 byte 1 \b, fine resolution (204x196 DPI)+>29 byte 0 \b, normal resolution (204x98 DPI)+1 string PC\ Research,\ Inc group 3 fax data+# facsimile data++>30 long 0x33 \b, color+>30 long 0x31 \b, mono+0 string %bitmap\0 FBM image data+# Fuzzy Bitmap (FBM) images++0 string yx MGR bitmap, modern format, squeezed+0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned+0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned+0 string yz MGR bitmap, modern format, 8-bit aligned+# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)++0 beshort 0x3020 character Computer Graphics Metafile+0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile+# XXX - questionable magic+0 string BEGMF clear text Computer Graphics Metafile+# CGM image files++>24 string SunGKS \b, SunGKS+0 string GKSM GKS Metafile+# GKS (Graphics Kernel System)++>32 string archive archive+>40 string SunBin binary+# version number follows, in the form m.n+0 string @(#)SunPHIGS SunPHIGS+0 string ARF_BEGARF PHIGS clear text archive+# PHIGS++>5 string x \b, version %.3s+0 string #FIG FIG image text+# FIG (Facility for Interactive Generation of figures), an object-based format++>4 long 3 \b, rectangular 32-bit (24-bit with matte)+>4 long 2 \b, rectangular 8-bit with colormap+>4 long 1 \b, rectangular 24-bit+0 long 1123028772 Artisan image data+# Artisan++0 string id=ImageMagick MIFF image data+# Magick Image File Format++>12 lelong >0 %d-bit+>8 lelong >0 %d,+>4 lelong >0 %d x+0 string \361\0\100\273 CMU window manager raster image dataadnSQ ~[;"  l X E B " Y 0  K i , o m ]  sq_97)\>n)g=_AfNKxVTL +# SGI RICE image file +# magic.+# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other+# XXX:++>5 byte 0xFF (black background)+>5 byte 0x00 (white background)+0 string pM86 Atari ST STAD bitmap image data (vert)+>5 byte 0xFF (black background)+>5 byte 0x00 (white background)+0 string pM85 Atari ST STAD bitmap image data (hor)+#+# used for runs of yy.+# most frequent byte, xx and zz are runlength escape codes, where xx is+# bytes either run horizontally (pM85) or vertically (pM86). yy is the+# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.+# p M 8 5/6 xx yy zz data...+# from Oskar Schirmer Feb 2, 2001+#+# pM8x: ATARI STAD compressed bitmap format++0 string LBLSIZE= PDS (VICAR) image data+0 string PDS_ PDS image data+2 string CCSD3Z PDS (CCSD) image data+0 string CCSD3ZF PDS (CCSD) image data+2 string NJPL1I PDS (JPL) image data+0 string NJPL1I00 PDS (JPL) image data+# strings have been found to be most likely.+# Unfortunately, there is no certain magic, but the following+# These files use Parameter Value Language in the header section.+# PDS - Planetary Data System++>12 belong x \b%d+>20 belong x \b%dx+>16 belong x \b, %dx+>100 string >\0 \b, "%s"+4 belong 7 XWD X Window Dump image data+# Bradford Castalia, idaeim, 1/01+# used by the xwd program.+# As described in /usr/X11R6/include/X11/XWDFile.h+# XWD - X Window Dump file.++128 string DICM DICOM medical imaging data+# DICOM medical imaging data++0 string %TGIF\ x Tgif file version %s+# Tgif files++03000 string Visio\ (TM)\ Drawing %s+# Visio drawings++0 beshort 0x1010 PEX Binary Archive+#+# stuff.+# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image++0 string !! Bennet Yee's "face" format+0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file+# other images++>107 string -64 \b, 64-bit, floating point, double precision+>107 string -32 \b, 32-bit, floating point, single precision+>107 string \ 32 \b, 32-bit, two's complement binary integer+>108 string 16 \b, 16-bit, two's complement binary integer+>109 string 8 \b, 8-bit, character or unsigned binary integer+0 string SIMPLE\ \ = FITS image data+# (FITS floating point formats are big-endian.)+# data and image transfer, storage, etc., for the astronomical community.+# FITS is the Flexible Image Transport System, the de facto standard for+# FITS format. Jeff Uphoff ++0 string PCD_OPA Kodak Photo CD overview pack file+>0xe02 byte&0x03 0x03 , portrait mode+>0xe02 byte&0x03 0x02 , landscape mode+>0xe02 byte&0x03 0x01 , portrait mode+>0xe02 byte&0x03 0x00 , landscape mode+2048 string PCD_IPI Kodak Photo CD image pack file+#+>12 belong x %d+>8 belong x %d x+>4 belong x \b, %d x+0 string IT02 FIT image data+#+>12 belong x %d+>8 belong x %d x+>4 belong x \b, %d x+0 string IT01 FIT image data++>80 string >0 \b, "%s"+>10 beshort !1 \bs+>10 beshort x \b, %d channel+>8 beshort x %d+>6 beshort x \b, %d x+>4 beshort x \b, %d-D+>3 byte 2 \b, high precision+#>3 byte 1 \b, normal precision+>2 byte 1 \b, RLE+#>2 byte 0 \b, verbatim+0 beshort 474 SGI image data+#+# http://reality.sgi.com/grafica/sgiimage.html+# See+#+# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)++#>28 belong >0 colormap is %d bytes long+>24 belong 2 raw colormap+>24 belong 1 RGB colormap+>24 belong 0 no colormap+>20 belong 0xffff reserved for testing,adrv_H1;8 H ( & X  d J 1  y c E ,   S    |aL., LI-EiVAnT9!  Y}M+>>10 leshort x %d groups+>>8 leshort x %d colors+>>5 byte x %d bit+>4 byte 16 color+0 string KiSS KISS/GS+# taken from fkiss: ( ?)++0 string P7\ 332 XV "thumbnail file" (icon) data+# descended from "xv", but in use by other applications as well (Wolfram Kleff)+# "thumbnail file" (icon)++0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File++>>30 beshort >0 %d)+>>28 beshort >0 (%d x+>>24 belong >0 %d frames+# >>32 string JFIF JPEG+>16 string _VID \b,+>>>46 beshort >0 %d)+>>>44 beshort >0 (%d x+>>>40 belong >0 %d frames+# >>>48 string JFIF JPEG+>>32 string _VID \b,+# Help! Isn't there any way to avoid writing this part twice?+>>28 byte 2 stereo+>>27 byte 1 mono+# >>28 string APCM ADPCM compressed+>>28 string NONE uncompressed+>>26 byte 16 16-bit+>>26 byte 8 8-bit+>>24 beshort >0 %d Hz+>16 string _SND \b,+# file is encountered the output should still be reasonable.+# the SMJPEG files I tried it on used this feature. Even if such a+# headers here, but I can't think of any way of handling that. None of+# According to the specification you could find any number of _TXT+>8 belong x %d.x data+0 string \0\nSMJPEG SMJPEG+#+# Software Torbjorn Andersson .+# SMJPEG. A custom Motion JPEG format used by Loki Entertainment+#++>4 leshort x version %d+0 lelong 0x0018FFFF GEM Metafile data+# GEM Metafile (Wolfram Kleff)++>10 beshort x %d pixelsize+>8 beshort x %d x+>4 beshort x %d planes,+>14 beshort x %d,+>12 beshort x %d x+0 belong 0x00010008 GEM Image data+# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)++>25 string >\0 dated %.14s+0 string NITF National Imagery Transmission Format+# NITF is defined by United States MIL-STD-2500A++0 string P7\ 332 XV thumbnail image data+# XV thumbnail indicator (ThMO)++0 string 8BPS Adobe Photoshop Image+# Adobe Photoshop++>2 byte 1 RLE compressed+>2 byte 0 uncompressed+>>14 leshort x %d dpi,+>12 leshort >0 %d x+>68 byte <0 image,+>68 byte >2 image,+>68 byte 2 grayscale,+>68 byte 1 colour,+>68 byte 0 image,+>3 byte x %d-bit+>65 byte >1 %d planes each of+>10 leshort x %d],+>8 leshort x [%d,+>6 leshort x %d] -+>4 leshort x bounding box [%d,+0 beshort 0x0a05 PCX ver. 3.0 image data+0 beshort 0x0a04 PCX for Windows image data+0 beshort 0x0a03 PCX ver. 2.8 image data, without palette+0 beshort 0x0a02 PCX ver. 2.8 image data, with palette+0 beshort 0x0a00 PCX ver. 2.5 image data+# From: Dan Fandrich +# PCX image files++0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file++# of various EPOC file formats+# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description+#+# for the EPOC operating system, which is used with PDAs like those from Psion+# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format+#+#------------------------------------------------------------------------------++#>12 beshort 4 YUV+#>12 beshort 3 RP175+#>12 beshort 2 CCIR601+#>12 beshort 1 RGB+#>10 beshort 3 4:4:4:4+#>10 beshort 2 4:4:4+#>10 beshort 1 4:2:2:4+#>10 beshort 0 4:2:2+#>8 beshort 3 13 bit+#>8 beshort 2 12 bit+#>8 beshort 1 10 bit+#>8 beshort 0 8 bit+#>6 beshort x %d)+#>4 beshort x (%d x+#>2 beshort x v%d+#0 beshort 0x5249 RICE imagead;^tHrpS2 G E O M  a _ 4 \ 6  ~ R ;  oFDomECgECtrL0  a_.=+0 belong 0x0e031301 Hierarchical Data Format (version 4) data+# specifications at http://hdf.ncsa.uiuc.edu/+# Hierarchical Data Format, used to facilitate scientific data exchange+#-----------------------------------------------------------------------++0 string CDF\001 NetCDF Data Format data+# http://www.unidata.ucar.edu/packages/netcdf/+# From: Tom Hilinski ++0 lelong 20000630 OpenEXR image data+# From Marc Espie++0 beshort 0x3020 character Computer Graphics Metafile+# From: Jason Bacon ++0 string AT&TFORM DjVu Image file+# http://www.djvuzone.org/+# From: stephane.loeuillet@tiscali.f++0 string \000MRM Minolta Dimage camera raw image data+# http://www.dalibor.cz/minolta/raw_file_format.htm+# The description of *.mrw format can be found at+# From Jan "Yenya" Kasprzak ++>4 leshort >1 %d images in file+>4 leshort =1 1 image in file+>2 leshort >0 %d,+>0 leshort >0 %d x+54 leshort 12345 Bio-Rad .PIC Image File+# From: Vebjorn Ljosa +# and related image processing software used by biologists.+# Bio-Rad .PIC is an image format used by microscope control systems+++>204 belong >0 %d+>200 belong >0 \b, %d x+0 lelong 0xd75f2a80 Cineon image data+# http://www.kodak.com/US/en/motion/support/dlad/+# Kodak Cineon format for scanned negatives+# Simon Walton ++0 lelong 987654321 DCX multi-page PCX image data+# From: Joerg Wunsch +# offsets for the respective PCX components.+# DCX is multi-page PCX, using a simple header of up to 1024++>0x0020 string <0.6.1 file version %s+>0x0020 string >0.6.1 file version %s+>>0x2744 lelong >2 compressed with unknown algorithm+>>0x2744 lelong 2 bzip2 compressed+>>0x2744 lelong 1 gzip compressed+>>0x2744 lelong 0 not compressed+# Some fields omitted+>>0x1600 string >\0 original filename %s,+>>0x1400 string >\0 device %s,+>>0x0200 string >\0 type %s+#>>0x007c reserved+#>>0x0064 8 byte identifier+>>0x0060 lelong >-1 volume %d+>0x0020 string 0.6.1 file version %s+0 string PaRtImAgE-VoLuMe PartImage+# Author: Hans-Joachim Baader +# partimage: file(1) magic for PartImage files (experimental, incomplete)++0 string 'From\040Squeak Squeak program text+0 string \146\031\0\0 Squeak image data+# Squeak images and - etoffi@softhome.net++>16 byte x \b, device type 33%2.2X+>12 long x \b, track size %d bytes+>8 long x \b, %d heads per cylinder+0 string CKD_S370 Hercules CKD DASD shadow file++>16 byte x \b, device type 33%2.2X+>12 long x \b, track size %d bytes+>8 long x \b, %d heads per cylinder+0 string CKD_C370 Hercules compressed CKD DASD image file++>16 byte x \b, device type 33%2.2X+>12 long x \b, track size %d bytes+>8 long x \b, %d heads per cylinder+0 string CKD_P370 Hercules CKD DASD image file+# From Jan Jaeger +# Hercules DASD image files++0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file+# Webshots (www.webshots.com), by John Harrison++>>14 leshort x +%d+>>12 leshort x +%d+>>10 leshort x %d+>>8 leshort x %d x+>>5 byte x %d bit+>4 byte 32 cellad4ZiC@R  f c =  u W 1  a C # x v 0 u J  T$"uJ$  sb=:khli:^+Y&+>2 leshort 0x09 7-bit, no capitalization, 128 flags+>2 leshort 0x08 8-bit, no capitalization, 128 flags+>2 leshort 0x07 7-bit, capitalization, 52 flags+>2 leshort 0x06 8-bit, capitalization, 52 flags+>2 leshort 0x05 7-bit, no capitalization, 52 flags+>2 leshort 0x04 8-bit, no capitalization, 52 flags+>2 leshort 0x03 7-bit, capitalization, 26 flags+>2 leshort 0x02 8-bit, capitalization, 26 flags+>2 leshort 0x01 7-bit, no capitalization, 26 flags+>2 leshort 0x00 8-bit, no capitalization, 26 flags+>0 byte 3 hash file (?),+>0 byte 2 3.1 hash file,+>0 byte 1 3.0 hash file,+>0 byte 0 hash file (?),+0 leshort&0xFFFC 0x9600 little endian ispell+#+# Updated by Daniel Quinlan (quinlan@yggdrasil.com)+#+# (No other current magic entries collide.)+# will match 0x9600 through 0x9603 in *both* little endian and big endian.+# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic+#+# ispell: file(1) magic for ispell+#------------------------------------------------------------------------------+++13 string DrawFile IslandDraw document+4 string pgscriptver IslandWrite document+#+# From: guy@netapp.com (Guy Harris)+# "/etc/magic":+# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1+#------------------------------------------------------------------------------++>>17 string >\0 %.3s+>5 string ,\ Version\ = \b, version+0 string =2 byte x (%d*512)+>42 string PROMISE Promise+>28 string Adaptec Adaptec+>26 string Adaptec Adaptec+>30 string IBM IBM comp. Video+>7 string LDR UNDI image+>5 string USB USB+0 beshort 0x55AA BIOS (ia32) ROM Ext.+# From Gürkan Sengün , www.linuks.mine.nu+# mapped into memory between 0xC0000 and 0xFFFFF+# rom: file(1) magic for BIOS ROM Extensions found in intel machines++>22 leshort >0 - version %d+>12 lelong >0 not stripped+0 leshort =0514 80386 COFF executable+# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan+#>22 leshort >0 - version %d+>12 lelong >0 not stripped+0 leshort =0522 iAPX 286 executable large model (COFF)+#>22 leshort >0 - version %d+>12 lelong >0 not stripped+0 leshort =0512 iAPX 286 executable small model (COFF)+>12 lelong >0 not stripped+0 leshort 0511 x86 executable (TV)+>12 lelong >0 not stripped+0 leshort 0510 x86 executable+#>22 leshort >0 - version %d+>12 lelong >0 not stripped+0 leshort 0503 basic-16 executable (TV)+#>22 leshort >0 - version %d+>12 lelong >0 not stripped+0 leshort 0502 basic-16 executable+#+# (Was the problem just one of endianness?)+# The `versions' should be un-commented if they work for you.+#+# as well, if, as, and when IBM makes it portable.+# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere+# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and+#+# Windows as well.+# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do+# Various flavors of x86 UNIX executable/object (other than Xenix, which+#+# intel: file(1) magic for x86 Unix+#------------------------------------------------------------------------------++0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) dataaduVa*lP4 ] * X ! K  I ; _ ) sC)jEC~{HE!k kJ%tr/Xu+>>12 string II +# Little-endian+# The combinations included below are from real-world JPEGs.+# is possible. And both endians are possible...+# All possible combinations of entries have to be enumerated, since no looping+# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.+>6 string Exif \b, EXIF standard+# - Patrik R=E5dman +# and EXIF version number printing added.+# EXIF moved down here to avoid reporting a bogus version number,++>>>19 byte x \b%d+>>18 byte !0 \b, thumbnail %dx+# Next, show thumbnail info, if it exists:+#>>4 beshort x \b, segment length %d+#>>13 byte 2 \b, resolution (DPCM)+#>>13 byte 1 \b, resolution (DPI)+#>>13 byte 0 \b, aspect ratio+# Next, the resolution or aspect ratio of the image:+>>12 byte x \b%02d+>>11 byte x \b %d.+# First, a little JFIF version info:+# impossible to specify in magic(4) format.+# tests are not fool-proof since some perfectly valid JPEGs are currently+# in a vain attempt to add image size reporting for JFIF. Note that these+# The following added by Erik Rossen 1999-09-06+>6 string JFIF \b, JFIF standard+0 beshort 0xffd8 JPEG image data+#+# both of which turn into "JPEG image data" here.+#+# 0 string \377\330\377\356 JPG file+# 0 string \377\330\377\340 JPEG file+#+# SunOS 5.5.1 had+# JPEG images+#------------------------------------------------------------------------------++>2 beshort >0x0004 \b, version %d+0 beshort 0xaced Java serialization data+# From Martin Pool (m.pool@pharos.com.au)+# Java serialization+#------------------------------------------------------------+>4 beshort x \b%d+>6 beshort x version %d.+0 belong 0xcafebabe compiled Java class data,+# From Larry Schwimmer (schwim@cs.stanford.edu)+# Java ByteCode+#------------------------------------------------------------+>20 long x stblsize %d+>16 long x hashsize %d,+>12 long x lexsize %d,+>8 long x lexletters %d,+>4 long x hash file version %d,+0 string ISPL ispell+# Ispell 4.0+# ispell 4.0 hash files kromJx +>4 beshort >0 and %d string characters+>2 beshort 0x0F 7-bit, capitalization, 256 flags+>2 beshort 0x0E 8-bit, capitalization, 256 flags+>2 beshort 0x0D 7-bit, no capitalization, 256 flags+>2 beshort 0x0C 8-bit, no capitalization, 256 flags+>2 beshort 0x0B 7-bit, capitalization, 128 flags+>2 beshort 0x0A 8-bit, capitalization, 128 flags+>2 beshort 0x09 7-bit, no capitalization, 128 flags+>2 beshort 0x08 8-bit, no capitalization, 128 flags+>2 beshort 0x07 7-bit, capitalization, 52 flags+>2 beshort 0x06 8-bit, capitalization, 52 flags+>2 beshort 0x05 7-bit, no capitalization, 52 flags+>2 beshort 0x04 8-bit, no capitalization, 52 flags+>2 beshort 0x03 7-bit, capitalization, 26 flags+>2 beshort 0x02 8-bit, capitalization, 26 flags+>2 beshort 0x01 7-bit, no capitalization, 26 flags+>2 beshort 0x00 8-bit, no capitalization, 26 flags+>1 byte 3 hash file (?),+>1 byte 2 3.1 hash file,+>1 byte 1 3.0 hash file,+>1 byte 0 hash file (?),+0 beshort&0xFFFC 0x9600 big endian ispell+>4 leshort >0 and %d string characters+>2 leshort 0x0F 7-bit, capitalization, 256 flags+>2 leshort 0x0E 8-bit, capitalization, 256 flags+>2 leshort 0x0D 7-bit, no capitalization, 256 flags+>2 leshort 0x0C 8-bit, no capitalization, 256 flags+>2 leshort 0x0B 7-bit, capitalization, 128 flags+>2 leshort 0x0A 8-bit, capitalization, 128 flagsad$l{]<)s`>( s W 8  o M 7  f G %  p ] ; %  p T 5  lJ4kJ.cK6 RS.m+#>(4.S+5) byte 0xDB \b, quantisation table+# I've commented-out quantisation table reporting. I doubt anyone cares yet.+>>(4.S+9) beshort x \b%d+>>(4.S+7) beshort x \b, %dx+>>(4.S+6) byte x \b, precision %d+>(4.S+5) byte 0xC2 \b, progressive+>>(4.S+9) beshort x \b%d+>>(4.S+7) beshort x \b, %dx+>>(4.S+6) byte x \b, precision %d+>(4.S+5) byte 0xC1 \b, extended sequential+>>(4.S+9) beshort x \b%d+>>(4.S+7) beshort x \b, %dx+>>(4.S+6) byte x \b, precision %d+>(4.S+5) byte 0xC0 \b, baseline+# and image dimensions if we are lucky and the SOFn (image segment) is here:+# Or, we can show the encoding type (I've included only the three most common)+#>>(4.S+8) string >\0 \b, "%s"+#>>(4.S+6) beshort x \b length=%d+#>(4.S+5) byte 0xFE \b, comment+>>(4.S+8) string >\0 \b, comment: "%s"+>(4.S+5) byte 0xFE+# At least we can show a comment if no other segments got inserted before:+# named accumulators, it would be even more effective...+# And if there was some sort of looping construct to do searches, plus a few+# do pointer arithemetic like in an assembler language. Christos?+# indirect addressing, and that's all. It would be great if we could+# Here things get sticky. We can do ONE MORE marker segment with+>>>>>(150.L+61) byte !0x30 \b%c+>>>>>(150.L+60) byte x \b.%c+>>>>>(150.L+59) byte x %c+>>>>(150.L+50) beshort 0x9000 +# EXIF IFD Entry #4:+>>>142 beshort 0x8769 +# IFD 0 Entry #11+>>>>>(138.L+73) byte !0x30 \b%c+>>>>>(138.L+72) byte x \b.%c+>>>>>(138.L+71) byte x %c+>>>>(138.L+62) beshort 0x9000 +# EXIF IFD Entry #5:+>>>>>(138.L+49) byte !0x30 \b%c+>>>>>(138.L+48) byte x \b.%c+>>>>>(138.L+47) byte x %c+>>>>(138.L+38) beshort 0x9000 +# EXIF IFD Entry #3:+>>>130 beshort 0x8769 +# IFD 0 Entry #10+>>>>>(126.L+49) byte !0x30 \b%c+>>>>>(126.L+48) byte x \b.%c+>>>>>(126.L+47) byte x %c+>>>>(126.L+38) beshort 0x9000 +# EXIF IFD Entry #3:+>>>>>(126.L+25) byte !0x30 \b%c+>>>>>(126.L+24) byte x \b.%c+>>>>>(126.L+23) byte x %c+>>>>(126.L+14) beshort 0x9000 +# EXIF IFD Entry #1:+>>>118 beshort 0x8769 +# IFD 0 Entry #9:+>>12 string MM +# Big-endian+>>>>>(150.l+73) byte !0x30 \b%c+>>>>>(150.l+72) byte x \b.%c+>>>>>(150.l+71) byte x %c+>>>>(150.l+62) leshort 0x9000 +# EXIF IFD Entry #5:+>>>>>(150.l+61) byte !0x30 \b%c+>>>>>(150.l+60) byte x \b.%c+>>>>>(150.l+59) byte x %c+>>>>(150.l+50) leshort 0x9000 +# EXIF IFD Entry #4:+>>>>>(150.l+49) byte !0x30 \b%c+>>>>>(150.l+48) byte x \b.%c+>>>>>(150.l+47) byte x %c+>>>>(150.l+38) leshort 0x9000 +# EXIF IFD Entry #3:+>>>142 leshort 0x8769 +# IFD 0 Entry #11+>>>>>(138.l+73) byte !0x30 \b%c+>>>>>(138.l+72) byte x \b.%c+>>>>>(138.l+71) byte x %c+>>>>(138.l+62) leshort 0x9000 +# EXIF IFD Entry #5:+>>>>>(138.l+61) byte !0x30 \b%c+>>>>>(138.l+60) byte x \b.%c+>>>>>(138.l+59) byte x %c+>>>>(138.l+50) leshort 0x9000 +# EXIF IFD Entry #4:+>>>>>(138.l+49) byte !0x30 \b%c+>>>>>(138.l+48) byte x \b.%c+>>>>>(138.l+47) byte x %c+>>>>(138.l+38) leshort 0x9000 +# EXIF IFD Entry #3:+>>>130 leshort 0x8769 +# IFD 0 Entry #10+>>>>>(126.l+49) byte !0x30 \b%c+>>>>>(126.l+48) byte x \b.%c+>>>>>(126.l+47) byte x %c+>>>>(126.l+38) leshort 0x9000 +# EXIF IFD Entry #3:+>>>118 leshort 0x8769 +# IFD 0 Entry #9:+>>>>>(78.l+25) byte !0x30 \b%c+>>>>>(78.l+24) byte x \b.%c+>>>>>(78.l+23) byte x %c+>>>>(78.l+14) leshort 0x9000 +# EXIF IFD Entry #1:+>>>70 leshort 0x8769 +# IFD 0 Entry #5:ad+^g53`2/ q I  y v G  u 0 k h K I } 7 u? sVf@+ZW"~V;c`*p@-+4086 string SWAP-SPACE Linux/i386 swap file+# Linux swap file, from Daniel Quinlan +>3 byte >0 8x%d+>2 byte 3 512 characters, Unicode directory,+>2 byte 2 256 characters, Unicode directory,+>2 byte 1 512 characters, no directory,+>2 byte 0 256 characters, no directory,+0 leshort 0x0436 Linux/i386 PC Screen Font data,+# PSF fonts, from H. Peter Anvin +#+2 string LILO Linux/i386 LILO boot/chain loader+# this can be overridden by the DOS executable (COM) entry+# LILO boot/chain loaders, from Daniel Quinlan +#+>200 lelong >0 (signal %d)+>220 string >\0 of '%s'+216 lelong 0421 Linux/i386 core file+# core dump file, from Bill Reynolds +>28 long !0 not stripped+0 string \01\03\040\20 Minix-386 executable+>28 long !0 not stripped+0 string \01\03\020\20 Minix-386 impure executable+#+0 string \243\206\001\0 Linux-8086 object file+#+>28 long !0 not stripped+0 string \01\03\040\04 Linux-8086 executable+>28 long !0 not stripped+0 string \01\03\020\04 Linux-8086 impure executable+# Linux-8086 stuff:+>20 lelong >0x1020 \b, DLL library+0 string \007\001\000 Linux/i386 object file+#+>16 lelong 0 \b, stripped+0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)+>16 lelong 0 \b, stripped+0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)+>16 lelong 0 \b, stripped+0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)+>16 lelong 0 \b, stripped+0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)+#+# >0 leshort 0314 demand-paged executable (QMAGIC)+# >0 leshort 0413 demand-paged executable (ZMAGIC)+# >0 leshort 0410 pure executable (NMAGIC)+# >0 leshort 0407 impure executable (OMAGIC)+# 2 leshort 100 Linux/i386+#+# "long" magic is a better practice in order to avoid collisions.+# The following basic Linux magic is useful for reference, but using+# Values for Linux/i386 binaries, from Daniel Quinlan +#+# linux: file(1) magic for Linux files+#------------------------------------------------------------------------------++0 beshort 0x8000 lif file+#+# (Daniel Quinlan )+#+# lif: file(1) magic for lif+#------------------------------------------------------------------------------++0 string %{ lex description text+# lex description file, from Daniel Quinlan +21 string generated\ by\ flex C program text (from flex)+# C program text from GNU flex, from Daniel Quinlan +>3 string >\0 for %s+53 string yyprevious C program text (from lex)+# derived empirically, your offsets may vary!+#+# lex: file(1) magic for lex+#------------------------------------------------------------------------------++0 string lect DEC SRC Virtual Paper Lectern file+# Karl M. Hegbloom +# DEC SRC Virtual Paper: Lectern files+#------------------------------------------------------------------------------+>16 belong x %u+0 string KarmaRHD Version Karma Data Structure Version++# From +#+# karma: file(1) magic for Karma data files+#------------------------------------------------------------------------------++0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data+# From: David Santinoli ++0 string hsi1 JPEG image data, HSI proprietary+# HSI is Handmade Software's proprietary JPEG encoding scheme++#>16 beshort x \b %d+#>14 beshort x \b, %d x+#>>(4.S+6) beshort x \b length=%dadbuVyNK+  ~ 7 u =  { ] ?  ] ; r p 4  ^\E V=;~US4 uO.`.gI*hf+>5 string . +0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless+# Linux 8086 executable+############################################################################++>0x1e6 belong !0x454c4b53 style boot sector+>0x1e6 belong 0x454c4b53 ELKS Kernel+0 belong 0xb8c0078e Linux+# Linux boot sector thefts.++>>>>(526.s+0x200) string >\0 \b, version %s+>>>>529 byte 1 \b, bzImage+>>>>529 byte 0 \b, zImage+>>>518 leshort >0x1FF+>>514 string HdrS+>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72+>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45+>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41+>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30+>>>0xa99 belong 0x55AA5a5a version 1.3.1,2+>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0+>>514 belong 0x15b281cd+>>514 belong 0x908ed881 version 1.1.43-1.1.45+>>506 leshort >0 vga=%d+>>506 leshort 0xFFFD vga=ask+>>506 leshort 0xFFFE vga=extended+>>506 leshort 0xFFFF vga=normal+>>>498 leshort 0 \b-rw+>>>498 leshort 1 \b-ro+>>508 leshort >0 root=0x%X+>>502 leshort >0 swap=0x%X+>>504 leshort >0 RAMdisksize=%u KB+>497 leshort !0 x86 kernel++>>514 belong 0x908ed8b8 for memtest86+>>514 belong 0x908ed8b4 version 0.99-1.1.42+>>514 belong 0x8e of a kernel from the dawn of time!+>497 leshort 0 x86 boot sector+0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux++# Linux kernel versions+############################################################################++>8 string >\0 \b, backing file %s+>4 belong x \b, version %d+0 belong 0x4f4f4f4d User-mode Linux COW file+# From Matt Zimmerman++0 string Begin4 Linux Software Map entry text (new format)+0 string Begin3 Linux Software Map entry text+# LSM entries - Nicolás Lichtmaier ++8 string \ A\ _text Linux kernel symbol map text+# System.map files - Nicolás Lichtmaier ++>0x1e9 string Loading from prehistoric times+>0x1e3 string Loading version 1.3.79 or older+0 belong 0xb8c0078e Linux kernel+# This also matches new kernels, which were caught above by "HdrS".+>>506 leshort >0 Video mode %d+>>506 leshort 0xFFFD Prompt for Videomode+>>506 leshort 0xFFFE Extended VGA+>>506 leshort 0xFFFF Normal VGA+>>504 leshort >0 RAMdisksize %u KB,+>>502 leshort >0 swap_dev 0x%X,+>>508 leshort >0 root_dev 0x%X,+>>498 leshort 0 RW-rootFS,+>>498 leshort 1 RO-rootFS,+>>>(526.s+0x200) string >\0 version %s,+>>>529 byte 1 bzImage,+>>529 byte 0 zImage,+#>>518 leshort >=3D0x200+>510 leshort 0xAA55 x86 boot executable+514 string HdrS Linux kernel+# Linux kernel boot images (i386 arch) (Wolfram Kleff)+# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29+# and Nicolás Lichtmaier +# and others such as Axel Kohlmeyer +# Linux kernel boot images, from Albert Cahalan +#+>23 leshort >0 - version %d.+>8 long 0 stripped+>8 long >0 not stripped+>24 leshort 0413 demand paged+>24 leshort 0410 pure+>24 leshort 0407 executable+0 leshort 0x0183 ECOFF alpha+#+# GNU BFD and MIPS info found below.+# updated by David Mosberger (davidm@azstarnet.com) based on+# could be wrong+# from Erik Troan (ewt@redhat.com) examining od dumps, so this+#+# ECOFF magic for OSF/1 and Linux (only tested under Linux though)+>0x404 long x size %d pages+>0x400 long x %d (4K pages)+4086 string SWAPSPACE2 Linux/i386 swap file (new style)+# according to man page of mkswap (8) March 1999adoz^M/cR+) K I  0   r p 4 y -  =  LJ*N52 {`A, wZK+mQ5lWA(eLI+# Daniel Quinlan, quinlan@yggdrasil.com+# BinHex is the Macintosh ASCII-encoded file format (see also "apple")+#+# macintosh description+#------------------------------------------------------------------------------++>>4 belong x architecture=%d+>4 belong >18+>4 belong 18 ppc+>4 belong 17 rs6000+>4 belong 16 i860+>4 belong 15 i860-big+>4 belong 14 sparc+>4 belong 13 m88k+>4 belong 12 acorn+>4 belong 11 hp pa-risc+>4 belong 10 architecture=10+>4 belong 9 ns32532+>4 belong 8 mips+>4 belong 7 i386+>>8 belong 3 (mc68030 only)+>>8 belong 2 (mc68040)+# >>8 belong 1 (mc68030)+# i.e. mc680x0_all, ignore+# from NeXTstep 3.0 +>4 belong 6 for m68k architecture+>4 belong 5 ns32332+>4 belong 4 ns32032+>4 belong 3 architecture=3+>4 belong 2 romp+>4 belong 1 vax+>>4 belong x architecture=%d+>4 belong <0+>>12 belong x filetype=%d+>12 belong >8+>12 belong 8 bundle+>12 belong 7 dynamic linker+>12 belong 6 dynamically linked shared library+>12 belong 5 preload executable+>12 belong 4 core+>12 belong 3 shared library+>12 belong 2 executable+>12 belong 1 object+0 belong 0xfeedface Mach-O+#+>>4 belong x with %d architectures +>4 belong >1+>4 belong 1 with 1 architecture+0 belong 0xcafebabe Mach-O fat file+#+# mach file description+#------------------------------------------------------------------------------+0 string \++0 string \372\372\372\372 MIT scheme (library?)+#.com and .bin for MIT scheme ++0 long 0x950412DE GNU-format message catalog data+0 long 0xDE120495 GNU-format message catalog data+# Files produced by GNU gettext++0 long 0xD28B7670 CLISP memory image data, other endian+0 long 0x70768BD2 CLISP memory image data+0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text+# Files produced by CLISP Common Lisp From: Bruno Haible ++>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data+>4 byte >19 +0 string ;ELC +# support or similar - Chris Chittleborough +# Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp+# Emacs 19+ - ver. recognition added by Ian Springer+0 string \012( Emacs v18 byte-compiled Lisp data+# Emacs 18 - this is always correct, but not very magical.++0 string ;; Lisp/Scheme program text+# This is a guess, but a good one.++# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)+#+# lisp: file(1) magic for lisp programs+#------------------------------------------------------------------------------++>6 leshort x \b, height %d+>4 leshort x \b, width %d+0 lelong =0x1413f33d SYSLINUX' LSS16 image data+#+# http://syslinux.zytor.com/+# SYSLINUX boot logo files (from 'ppmtolss16' sources)++# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable+# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable+# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable+# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable++>>36 string >\0 \b, libc version %s+>37 string . +>28 long !0 \b, not stripped+>2 byte&0x80 !0 \b, A_TOVLY+>2 byte&0x40 !0 \b, A_PURE+>2 byte&0x08 !0 \b, A_STAND+>2 byte&0x04 !0 \b, A_NSYM+>2 byte&0x02 !0 \b, A_PAL+>>2 byte&0x10 !0 \b, A_EXEC+>2 byte&0x20 !0+>2 byte&0x20 0 \b, impure+>2 byte&0x01 !0 \b, unmapped zero page+0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable++>>4 string >\0 \b, libc version %sadaPmXV) s \ Z - b M    L 7 5  q ? * o , fI;l?lCI,)LJH6+# +# and that 74 will be 0. So something like+# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,+# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will+# Another possibility, that would also work for MacBinary I, is to use+#+# the nulls in 0, 74, and 82 as the magic number.+# floating around that this will miss. The original spec calls for using+# has been in use since 1987 so I hope there aren't many really old files+# MacBinary I doesn't have the version number field at all, but MacBinary II++#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data+# Unfortunately, this magic is quite weak - MPi++# be 0x81. This works for the files I have, but maybe not for everyone's.+# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second+# This attempts to use the version numbers as a magic number, requiring+#+# 124 beshort # checksum+# 123 byte 129 # minimum version that can read fmt+# 122 byte 130 # for MacBinary III+# 122 byte 129 # for MacBinary II+# 120 beshort # length of add'l header+# 116 belong # total file length+# 107 byte # still more Finder flags+# 106 byte # char. code of file name+# 102 string mBIN # (only in MacBinary III)+# 101 byte # new Finder flags+# 99 beshort # length of comment after resource+# 95 belong # file modification date+# 91 belong # file creation date+# 87 belong # length of resource segment+# 83 belong # length of data segment+# 82 byte 0+# 81 byte # protected?+# 79 beshort # window or folder ID+# 77 beshort # horiz posn in window+# 75 beshort # vertical posn in window+# 74 byte 0+# 73 byte # Finder flags+# 69 string # file creator+# 65 string # file type+# 2 string # filename+# 1 byte # filename length+# 0 byte 0+#+# do it, but the magic file format isn't up to the challenge.+# to the MacBinary III format. The checksum is really the way to+# Unfortunately MacBinary doesn't really have a magic number prior+#+# MacBinary format (Eric Fischer, enf@pobox.com)++>2 string x : %s+0 string PDF Macintosh PDF File (data)+>2 string x : %s+0 string TEXT Macintosh TeachText File (data)+>2 string x : %s+0 string ttro Macintosh TeachText File (data)+>2 string x : %s+0 string PACT Macintosh Compact Pro Archive (data)+# Additional Macintosh Files (franklsm@tuns.ca)++>2 string x : %s+0 string LWFN Macintosh Postscript Font (data)+>2 string x : %s+0 string FFIL Macintosh Truetype Font (data)+>2 string x : %s+0 string INIT Macintosh Extension (data)+>2 string x : %s+0 string cdev Macintosh Control Panel (data)+>2 string x : %s+0 string shlb Macintosh Shared Library (data)+>2 string x : %s+0 string libr Macintosh Library (data)+0 string FNDR Macintosh Finder (data)+0 string zsys Macintosh System File (data)+# Macintosh System files (franklsm@tuns.ca)++>2 string x \b: %s+0 string APPL Macintosh Application (data)+# Macintosh Applications and Installation binaries (franklsm@tuns.ca)++#>162 string >0 : %s+0 string StuffIt StuffIt Archive+# Newer StuffIt archives (grant@netbsd.org)++>2 string x : %s+0 string Seg StuffIt Deluxe Segment (data)+>2 string x : %s+0 string SITD StuffIt Deluxe (data)+>2 string x : %s+0 string SIT! StuffIt Archive (data)+# files obtained from most archives. (franklsm@tuns.ca)+# Stuffit archives are the de facto standard of compression for Macintosh++>41 string x \b, version %.3s+11 string must\ be\ converted\ with\ BinHex BinHex binary textadfyY9hF$ j <  h I # ^ <  { Z 4 z F  yU( sN#?=hI+|X;Z;xI$+#>69 string PSAL (Hunt the Wumpus)+#>69 string PJMM (Think Pascal)+#>69 string NCSA (NCSA Telnet)+#>69 string MSWD (Microsoft Word)+#>69 string MSBB (Microsoft BASIC (binary))+#>69 string MPNT (MacPaint)+#>69 string MLND (Defender)+#>69 string MAcK (MacKnowledge terminal emulator)+#>69 string MACS (Macintosh operating system)+#>69 string MACA (MacWrite)+#>69 string LZIV (compress)+#>69 string LWFU (LaserWriter Utility)+#>69 string KAHL (Think C)+#>69 string Gzip (GNU gzip)+#>69 string EXTR (self-extracting archive)+#>69 string ERIK (Macintosh Finder)+#>69 string EDIT (Macintosh Edit)+#>69 string DSIM (DigSim)+#>69 string DMOV (Font/DA Mover)+#>69 string CSOm (Eudora)+#>69 string CPCT (Compact Pro)+#>69 string CDmo (The Talking Moose)+#>69 string CCL\ (Common Lisp)+#>69 string CCL2 (Common Lisp 2)+#>69 string BTFT (BitFont)+#>69 string BRKL (Brickles)+#>69 string APSC (Apple Scanner)+#>69 string APLS (Apple Scanner)+#>69 string ALFA (Alpha editor)+#>69 string ALD4 (PageMaker 4)+#>69 string ALD3 (PageMaker 3)+#>69 string 8BIM (Adobe Photoshop)++# just the ones that I happened to have files from and was able to identify.+# Somewhere, Apple has a repository of registered Creator IDs. These are++#>69 string x \b, creator "%4.4s"++#>65 string zsys (system file)+#>65 string ttro (SimpleText read-only)+#>65 string shlb (shared library)+#>65 string scbk (Scrapbook)+#>65 string rsrc (resource)+#>65 string nX^w (WriteNow dictionary)+#>65 string nX^d (WriteNow word processor)+#>65 string libr (library)+#>65 string dfil (Desk Acessory suitcase)+#>65 string cdev (control panel)+#>65 string acf3 (Aldus FreeHand)+#>65 string ZSYS (Pre-System 7 system file)+#>65 string ZIVM (compress (.Z))+#>65 string XLS\ (Microsoft Excel)+#>65 string WORD (MacWrite word processor)+#>65 string WDBN (Microsoft Word word processor)+#>65 string TOVF (Eudora table of contents)+#>65 string TIFF (TIFF image)+#>65 string TEXT (ASCII)+#>65 string TARF (Unix tar archive)+#>65 string Seg\ (StuffIt segment)+#>65 string STAK (HyperCard stack)+#>65 string SPn3 (SuperPaint)+#>65 string SITD (StuffIt Deluxe)+#>65 string SCRN (startup screen)+#>65 string SCFL (Defender scores)+#>65 string QPRJ (Think Pascal project)+#>65 string PROJ (Think C project)+#>65 string PREF (preferences)+#>65 string PNTG (MacPaint picture)+#>65 string PICT (picture)+#>65 string PDF\ (Portable Document Format)+#>65 string PACT (Compact Pro archive)+#>65 string MSBC (Microsoft BASIC)+#>65 string LWFN (PostScript font)+#>65 string LIB\ (library)+#>65 string INIT (system extension)+#>65 string Gzip (GNU gzip)+#>65 string GIFf (GIF image)+#>65 string FNDR (Macintosh Finder)+#>65 string FKEY (function key)+#>65 string FFIL (font suitcase)+#>65 string EPSF (Encapsulated PostScript)+#>65 string DRWG (MacDraw)+#>65 string CIRC (simulated circuit)+#>65 string AWWP (AppleWorks word processor)+#>65 string APPL (application)+#>65 string ALT3 (PageMaker 3)+#>65 string ALB4 (PageMaker 4)+#>65 string ALB3 (PageMaker 3)+#>65 string 8BIM (PhotoShop)++#>65 string x \b, type "%4.4s"++# >73 byte&0x10 0x80 \b, locked+# >73 byte&0x10 0x40 \b, invisible+# >73 byte&0x10 0x20 \b, bundle+# >73 byte&0x10 0x10 \b, system+# >73 byte&0x08 0x08 \b, bozo+# >73 byte&0x04 0x04 \b, busy+# >73 byte&0x02 0x02 \b, changed+# >73 byte&0x01 0x01 \b, inited+# +# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary dataadGcnQ3^9 t S ) '   s _ B $ s @  n I G A O b`4pE `4~M(a:[+>&14 beldate-0x7C25B080 x created: %s,+# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"+# really, that should be treated as a belong and we print a string+>&6 string x last mounted by: '%.4s',+>&2 belong &0x00008000 (locked)+>&2 belong &0x00000800 (unclean)+>&2 belong &0x00000200 (spared blocks)+>0x404 belong ^0x00000100 (mounted)+>0 beshort 0x4C4B (bootable)+>&0 beshort x version %d data+0x400 beshort 0x482B Macintosh HFS Extended++#>0x424 pstring x volume name: %s+#>0x412 beshort x number of blocks: %d,+#>0x414 belong x block size: %d,+#>0x440 beldate-0x7C25B080 >0 last backup: %s,+#>0x406 beldate-0x7C25B080 x last modified: %s,+#>0x402 beldate-0x7C25B080 x created: %s,+#>0x47C beshort 0x482B (Embedded HFS+ Volume)+#>0x40a beshort &0x0800 (unclean)+#>0x40a beshort &0x0200 (spared blocks)+#>0x40a beshort ^0x0100 (mounted)+#>0x40a beshort &0x8000 (locked)+#>0 beshort 0x4C4B (bootable)+#0x400 beshort 0x4244 Macintosh HFS data+# "BD" is has many false positives++>0x424 pstring x volume name: %s+>0x412 beshort x number of blocks: %d,+>0x414 belong x block size: %d,+>0x406 beldate-0x7C25B080 >0 last backup: %s,+>0x402 beldate-0x7C25B080 x created: %s,+>0x40a beshort &0x8000 (locked)+>0 beshort 0x4C4B (bootable)+0x400 beshort 0xD2D7 Macintosh MFS data++# unused, so a simply >0 should suffice.+# Alternatively, the boot block is supposed to be zeroed if it's+# But if this is true for MFS or HFS+ volumes, I don't know.+# "for HFS volumes, this field always contains the value 0x4C4B."+# The boot block signature, according to IM:Files, is ++# There's also some Pascal strings in here, ditto...+# entries depend on the data arithmetic added after v.35+# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these+# Fixed HFS+ and Partition map magic: Ethan Benson +# From "Tom N Harris" +# Macintosh filesystem data++>24 string x %s+0 string $FL2 SPSS System File++>40 string x %s+0 long 0xc1e2c3c9 SPSS Portable File++# from Bruce Foster (bef@nwu.edu).+# spss magic for SPSS system and portable files, ++>0x9C string VIEW data view+>0x9C string INDEX data file index+>0x9C string CATALOG catalog+>0x9C string DATA data file+0x54 string SAS SAS 7++#+# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)+>24 string VIEW data view+>24 string INDEX data file index+>24 string CATALOG catalog+>24 string DATA data file+0 string SAS SAS+#>8 string x %s+#0 string SAS SAS+#+# sas magic from Bruce Foster (bef@nwu.edu)++102 string mBIN MacBinary III data with surprising version number++# Just in case...++#>69 string ufox (Foreign File Access)+#>69 string ttxt (SimpleText)+#>69 string scbk (Scrapbook)+#>69 string pdos (Apple ProDOS file system)+#>69 string nX^n (WriteNow)+#>69 string movr (Font/DA Mover)+#>69 string dosa (Macintosh MS-DOS file system)+#>69 string aca3 (Aldus FreeHand)+#>69 string aCa2 (Fontographer)+#>69 string XCEL (Microsoft Excel)+#>69 string WILD (HyperCard)+#>69 string VIM! (Vim editor)+#>69 string Unix (NeXT Mac filesystem)+#>69 string SPNT (SuperPaint)+#>69 string SIT! (StuffIt)+#>69 string Rich (BBEdit)+#>69 string RSED (Resource Editor)+#>69 string RMKR (Resource Maker)+#>69 string R*ch (BBEdit)+#>69 string PSI2 (Apple File Exchange)ad`V(r0 3 ~ Z <  k F ' n D  h B # mQ* qoZ"wt$zJtP-fd9++0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB+# From: Simon Matter ++0 string *mbx* MBX mail folder+# From: Kevin Sullivan ++0 lelong 0x223E9F78 Transport Neutral Encapsulation Format+# TNEF files...++#0 string Content- MIME entity text+0 string MIME-Version: MIME entity text+0 string Received: RFC 822 mail text+0 string BABYL Emacs RMAIL text+0 string Article saved news text+0 string From: news or mail text+0 string Xref: news text+0 string Path: news text+0 string Return-Path: smtp mail text+0 string Pipe\ to mail piping text+0 string Forward\ to mail forwarding text+0 string N#!\ rnews mailed, batched news text+0 string #!\ rnews batched news text+0 string Relay-Version: old news text+# There are tests to ascmagic.c to cope with mail and news.+#0 string From mail text+# Unfortunately, saved netnews also has From line added in some news software.+#+# mail.news: file(1) magic for mail and news+#------------------------------------------------------------------------------++>4 belong x (version %d) (big endian)+0 belong 0xF11E041C magic binary file for file(1) cmd+>4 lelong x (version %d) (little endian)+0 lelong 0xF11E041C magic binary file for file(1) cmd+0 string #\ Magic magic text file for file(1) cmd+#+# magic: file(1) magic for magic files+#------------------------------------------------------------------------------++0 string BOMStore Mac OS X bill of materials (BOM) fil+# From: Remi Mommsen ++>>>>0xa54 belong x number of blocks: %d+>>>>0xa10 string x name: %s,+>>>>0xa30 string x fourth type: %s,+>>>0xa00 beshort 0x504D +>>>0x854 belong x number of blocks: %d,+>>>0x810 string x name: %s,+>>>0x830 string x third type: %s,+>>0x800 beshort 0x504D +>>0x454 belong x number of blocks: %d,+>>0x410 string x name: %s,+>>0x430 string x second type: %s,+>0x400 beshort 0x504D +>0x254 belong x number of blocks: %d,+>0x210 string x name: %s,+>0x230 string x first type: %s,+>0x2 beshort x block size: %d,+0x200 beshort 0x5453 Apple Old Partition data+# AFAIK, only the signature is different+>>>>0xa54 belong x number of blocks: %d+>>>>0xa10 string x name: %s,+>>>>0xa30 string x fourth type: %s,+>>>0xa00 beshort 0x504D +>>>0x854 belong x number of blocks: %d,+>>>0x810 string x name: %s,+>>>0x830 string x third type: %s,+>>0x800 beshort 0x504D +>>0x454 belong x number of blocks: %d,+>>0x410 string x name: %s,+>>0x430 string x second type: %s,+>0x400 beshort 0x504D +>0x254 belong x number of blocks: %d,+>0x210 string x name: %s,+>0x230 string x first type: %s,+>0x2 beshort x block size: %d,+0x200 beshort 0x504D Apple Partition data+# what're you gonna do?+# cstring. Of course, partitions can contain more than four entries, but +# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a +# Is that the partition type a cstring or a pstring? Well, IM says "strings ++#>&24 beshort =1 \b, MacOS+#0 beshort 0x4552 Apple Device Driver data+# partition map+# anything with a valid driver descriptor will also have a valid+# I don't think this is really necessary since it doesn't do much and ++>&46 belong x free blocks: %d+>&42 belong x number of blocks: %d,+>&38 belong x block size: %d,+>&26 bedate-0x7C25B080 >0 last checked: %s,+>&22 bedate-0x7C25B080 >0 last backup: %s,+>&18 bedate-0x7C25B080 x last modified: %s,+# only the creation date is local time, all other timestamps in HFS+ are UTC.adg#hzxOY0 l ? = 4   5  h T d ? "  ] ? )  |MKi0.}Q97%nl*b` d&zB@>%#"++# Mathematica .mx files+++0 string (*^\n::[\011 Mathematica notebook version 2.x+0 string (*^\n\n::[\011 Mathematica notebook version 2.x+0 string (*^\r\n::[\011 Mathematica notebook version 2.x+0 string (*^\r::[\011 Mathematica notebook version 2.x+0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x+0 string (*^\015 Mathematica notebook version 2.x+0 string (*\^\r\n\r\n::[\011 Mathematica notebook version 2.x+0 string (*^\r\r::[\011 Mathematica notebook version 2.x+# generic:++# there may be 'cr' instread of 'nl' in some does this matter?++#>675 string >\0 %s #doesn't work well+#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x++#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x++#>41 string >\0 %s+0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook++# multiple possibilites:+# .ma++0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook+0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook+#mathematica .mb++# versions 2.2 and 3.0+# Mathematica a multi-purpose math program+# "H. Nanosecond" +# mathematica: file(1) magic for mathematica files+#------------------------------------------------------------------------------++0 string #\ \r##\ Maple something anomalous.+0 string \r#\r##\ 4 string \001\122 The latest save+>4 string \000\105 An old revision+# 'soh R' means new +# a sort of revision marking+# I think 'nul E' means a file that was saved as a different name+# from byte 4 it is either 'nul E' or 'soh R'+0 string \0\0\001$ Maple something+# .mps++>>>11 string >\0 %.1s+>>10 string+>9 string >\0 version %.1s.+0 string {VERSION\ Maple worksheet+# that is {VERSION major_version miunor_version computer_type version_string}+# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n+0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird+#this is anomalous+0 string \000\000\001\044\000\221 Maple worksheet+# .mws++#0 string #=========== Maple help file, old style+0 string #\ daub Maple help file, old style+#0 string #\ Newton Maple help file, old style+0 string \n\+# .mhp++0 string \000\004\000\000 Maple help database+# .hdb ++# they are compiled indexes for maple files+# no magic for these :-(+# .ind++0 string \000MVR4\nI MapleVr4 library+# maple library .lib++#+# Maple V release 4, a multi-purpose math program+# "H. Nanosecond" +# maple: file(1) magic for maple files+#------------------------------------------------------------------------------++#>4 leshort >0 (%d messages)+#256 leshort 0xAFAE4453 Squish message area data file+# XXX: Weak magic+# SQD file (requires at least one message in the area)+# Squish Fidonet message area databases++>12 leshort >0 (%d messages)+0 string JAM\0 JAM message area header file+# JHR file+# JAM(mbp) Fidonet message area databasesad hCe  [ Y L O M  Z 2 ] Z : 7 5 )   a 7 ywJ$cA#lEfK0pmR=$ vIxcC+0 beshort 0x8765 disk quotas file+0 belong 0410 old SGI 68020 pure executable+0 belong 0407 old SGI 68020 executable+>10 short >0 with %d table(s)+>8 byte >0 Ver %d:+0 string kbd!map kbd map file+# kbd file definitions+#+# XXX - what is the blank "-" line?+#+# MIPS machines, as far as I know.+# all of SGI's *current* machines and OSes run in big-endian mode on the+# Dec Ultrix (MIPS)+# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)+#------------------------------------------------------------------------------++>13 string >\0 %s+0 string Content-Type:+>14 string >\0 %s+0 string Content-Type:\ +#+# mime: file(1) magic for MIME encoded files+#------------------------------------------------------------------------------+>5 byte 3 keymode: MD5 hash+>5 byte 2 keymode: SHA-1 hash+>5 byte 1 keymode: 4bit+>5 byte 0 keymode: 8bit+>4 byte 4 mode: nOFB,+>4 byte 3 mode: OFB,+>4 byte 2 mode: CFB,+>4 byte 1 mode: ECB,+>4 byte 0 mode: CBC,+>3 byte 101 algorithm: IDEA,+>3 byte 100 algorithm: RC6,+>3 byte 16 algorithm: blowfish-256,+>3 byte 15 algorithm: blowfish-192,+>3 byte 14 algorithm: blowfish-128,+>3 byte 13 algorithm: TWOFISH-256,+>3 byte 12 algorithm: TWOFISH-192,+>3 byte 11 algorithm: RC2,+>3 byte 10 algorithm: TWOFISH-128,+>3 byte 9 algorithm: xTEA,+>3 byte 8 algorithm: CAST-128,+>3 byte 7 algorithm: SAFER-SK128,+>3 byte 6 algorithm: SAFER-SK64,+>3 byte 4 algorithm: GOST,+>3 byte 3 algorithm: 3-WAY,+>3 byte 2 algorithm: 3DES,+>3 byte 1 algorithm: DES,+>3 byte 0 algorithm: blowfish-448,+0 string \0m\2 mcrypt 2.2 encrypted data,++>>>&0 string >\0 mode: %s,+>>&1 leshort >0 keysize: %d bytes,+>4 string >\0 algorithm: %s,+0 string \0m\3 mcrypt 2.5 encrypted data,+# mcrypt: file(1) magic for mcrypt 2.2.x;+# Mavroyanopoulos Nikos +#------------------------------------------------------------------------------++>>8 string matroska Matroska data+# DocType contents:+>5 beshort 0x4282+# DocType id:+0 belong 0x1a45dfa3+# EBML id:++#+# See http://www.matroska.org/+#+# matroska: file(1) magic for Matroska files+#------------------------------------------------------------------------------+++>>124 leshort x version 0x%04x+>126 short 0x4d49 (little endian)+>>124 beshort x version 0x%04x+>126 short 0x494d (big endian)+0 string MATLAB Matlab v5 mat-file+# MatLab v5+#########################++0 string (* Mathematica, or Pascal, Modula-2 or 3 code text+# other (* matches it is a comment start in these langs++0 string (*********************** Mathematica 3.0 notebook+#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook+# .nb files++4 string \ A~ MAthematica .ml file+# how to put that into a magic rule?+# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ +# .ml files These are menu resources I think++0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)+# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000+# Mathematica files PBF:+++>88 string >\0 from %s+# >71... is optional+#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 +0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file+#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary fileadTu\4cG*  c F +  ~ ` D (  | ` D -   { ` D -   t X A '   iR8&#}fL:7# |eK96x^LIn\Y%olM+~hTS+# N32bit core file+>16 string >\0 '%s'+>4 belong 1 of+0 belong 0xdeadad40 IRIX 64-bit core dump+# 64bit core file+>16 string >\0 '%s'+>4 belong 1 of+0 belong 0xdeadadb0 IRIX core dump+# 32bit core file+0 beshort 0x182 MIPSEL-BE Ucode+0 beshort 0x180 MIPSEB Ucode+#+>22 byte x .%d+>23 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 05401 (paged)+>20 beshort 04001 (swapped)+>20 beshort 03401 (impure)+0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable+#+>22 byte x .%d+>23 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 05401 (paged)+>20 beshort 04001 (swapped)+>20 beshort 03401 (impure)+0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable+#+>23 byte x .%d+>22 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 0413 (paged)+>20 beshort 0410 (swapped)+>20 beshort 0407 (impure)+0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable+#+>23 byte x .%d+>22 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 0413 (paged)+>20 beshort 0410 (swapped)+>20 beshort 0407 (impure)+0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable+#+# MIPS 3 additions+#+>22 byte x .%d+>23 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 05401 (paged)+>20 beshort 04001 (swapped)+>20 beshort 03401 (impure)+0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable+#+>22 byte x .%d+>23 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 05401 (paged)+>20 beshort 04001 (swapped)+>20 beshort 03401 (impure)+0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable+#+>23 byte x .%d+>22 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 0413 (paged)+>20 beshort 0410 (swapped)+>20 beshort 0407 (impure)+0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable+#+>23 byte x .%d+>22 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 0413 (paged)+>20 beshort 0410 (swapped)+>20 beshort 0407 (impure)+0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable+#+# MIPS 2 additions+#+>22 byte x .%d+>23 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 05401 (paged)+>20 beshort 04001 (swapped)+>20 beshort 03401 (impure)+0 beshort 0x6201 MIPSEL ECOFF executable+#+>22 byte x .%d+>23 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 05401 (paged)+>20 beshort 04001 (swapped)+>20 beshort 03401 (impure)+0 beshort 0x6001 MIPSEB-LE ECOFF executable+#+>22 byte x .%d+>23 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 0413 (paged)+>20 beshort 0410 (swapped)+>20 beshort 0407 (impure)+0 beshort 0x0162 MIPSEL-BE ECOFF executable+#+>23 byte x .%d+>22 byte x - version %d+>8 belong 0 stripped+>8 belong >0 not stripped+>20 beshort 0413 (paged)+>20 beshort 0410 (swapped)+>20 beshort 0407 (impure)+0 beshort 0x0160 MIPSEB ECOFF executable+#+>8 belong >0 - version %d+0 belong 0xdeadbabe IRIX Parallel Arena+>4 byte x - version %d+0 belong 0x5443464d IRIS Showcase template+>4 byte x - version %d+0 belong 0x5343464d IRIS Showcase file+>3 byte x - version %d+>2 byte 0x63 -+0 beshort 0x0226 IRIS Showcase template+>3 byte x - version %d+>2 byte 0x49 -+0 beshort 0x0506 IRIS Showcase fileadwm.c@= r G ?  r 9 6  { M J   j > ;  ZW/|W7~|y]Z1`^[@=PMFC&iF%EB+# Motorola/88Open BCS+#+# 88K+#+0 beshort 0554 68K BCS executable+#+# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)+#+>12 belong >0 not stripped+0 beshort 0522 mc68k executable (shared demand paged)+>12 belong >0 not stripped+0 beshort 0521 mc68k executable (shared)+>20 beshort 0421 (standalone)+>20 beshort 0413 (demand paged)+>20 beshort 0410 (pure)+>20 beshort 0407 (impure)+>168 string .lowmem Apple toolbox+>12 belong >0 not stripped+>18 beshort &00000020 executable+>18 beshort ^00000020 object+0 beshort 0520 mc68k COFF+#+# 68K+#+# motorola: file(1) magic for Motorola 68K and 88K binaries+#------------------------------------------------------------------------------+++>5 string >\0 (ascii %s)+0 string PVF2\n portable voice format+#+# portable voice format 2+#++>5 string >\0 (binary %s)+0 string PVF1\n portable voice format+#+# portable voice format 1+#++>20 short >0 compression type 0x%04x)+>4 string >\0 (%s /+0 string RMD1 raw modem data+#+# raw modem data version 1+#++# (Martin Seine & Marc Eberhard)+# Magic data for vgetty voice formats+#+0 short 0x1400 raw G3 data+0 short 0x0100 raw G3 data, byte-padded++>29 byte 0 , normal resolution+>29 byte 1 , fine resolution+4 string Research, Digifax-G3-File+# From: Florian La Roche +#+# modem: file(1) magic for modem programs+#------------------------------------------------------------------------------+0 string \001\001\001\001 MMDF mailbox+#+# mmdf: file(1) magic for MMDF mail files+#------------------------------------------------------------------------------++>10 lelong x %d samples+>4 leshort x algorithm %d,+0 lelong 0xffffabcd MLSSA datafile,+#+# mlssa: file(1) magic for MLSSA datafiles+#------------------------------------------------------------------------------++>2 short >0 version %d+0 string \311\304 ID tags data+#+# XXX - byte order?+#+# ID is the binary tags database produced by mkid(1).+#+# mkid: file(1) magic for mkid(1) databases+#------------------------------------------------------------------------------++0 string BEGIN:VCALENDAR vCalendar calendar file+0 string %%!! X-Post-It-Note text+#+# misctools: file(1) magic for miscelanous UNIX tools.+#-----------------------------------------------------------------------------+0 long 31415 Mirage Assembler m.out executable+#+# XXX - byte order?+#+# mirage: file(1) magic for Mirage executables+#------------------------------------------------------------------------------++4 belong 0x00000010 GLS_BINARY_MSB_FIRST+4 belong 0x10000000 GLS_BINARY_LSB_FIRST+0 string glsBeginGLS( GLS_TEXT+# GLS is OpenGL stream encoding; GLS is the successor of GLF+4 belong 0x0000007d GLF_BINARY_MSB_FIRST+4 belong 0x7d000000 GLF_BINARY_LSB_FIRST+0 string glfHeadMagic(); GLF_TEXT+# GLF is OpenGL stream encoding+0 string #Inventor V2 Open Inventor 2.0 file+0 string #Inventor V IRIS Inventor 1.0 file+#+0 string WNGZWZHP Wingz help file+0 string WNGZWZSS Wingz spreadsheet+0 string WNGZWZSC Wingz compiled script+#+>9 byte x .%d+>8 byte x - version %d+0 string SGIAUDIT SGI Audit file+# Trusted IRIX info+>36 string >\0 '%s'+0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of+# New style crash dump file+>16 string >\0 '%s'+>4 belong 1 of+0 belong 0xbabec0bb IRIX N32 core dumpadZCA%"yI x _   f % I . b , l ! ^\ xv4n+ FuP/_F0i; +#>>148 leshort >27+#>>>155 byte x \b.%d,+#>>>154 byte x linker %d+#>>148 leshort >0+>>150 leshort&0x1000 >0 system file+#>>150 leshort&0x0200 =0 with debug symbols,+#>>150 leshort&0x0008 =0 with local symbols,+#>>150 leshort&0x0004 =0 with line numbers,+>>150 leshort&0x0001 >0 not relocatable+#>>136 ledate x stamp %s,+>150 leshort&0x2000 =0 executable+>>220 leshort 7 POSIX+>>220 leshort 3 console+>>220 leshort 2 GUI+>>220 leshort 1 native+>>220 leshort 0 unknown subsystem+>148 leshort >27+>132 leshort 0x290 PA-RISC+>132 leshort 0x1f0 PowerPC+>132 leshort 0x268 Motorola 68000+>132 leshort 0x184 Alpha+>132 leshort 0x166 MIPS R4000+>132 leshort 0x14c Intel 80386+>132 leshort 0x0 unknown processor+>150 leshort&0x0100 >0 32-bit+128 string PE\0\0 MS Windows PE+#+# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).+# probably some linker directive to set it. The linker version was+# they're interesting. The user version was 0.0, but there's+# executables built with Visual C++ 4.0, so it's not clear that+# Required OS version and subsystem version were 4.0 on some NT 3.51+#+# PE header at 0x80 = 128.+# So, for now, we assume the standard MS-DOS stub, which puts the+# to specify an indirect offset with a specified byte order.+# unfortunately, that's a little-endian offset, and there's no way+# PE-format executable is the offset in the file of the PE header;+# XXX - according to Microsoft's spec, at an offset of 0x3c in a++0 string/c @echo\ off MS-DOS batch file text+# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)++#+# msdos: file(1) magic for MS-DOS files+#------------------------------------------------------------------------------++>8 beshort x (version %04x)+0 beshort 0x0064 Atari 68xxx CPX file++>44 string ZIP! [Self-Extracting ZIP SFX archive]+>38 string SFX [Self-Extracting LZH SFX archive]+>30 string SFX [Self-Extracting LZH SFX archive]+>26 beshort !0 + relocation tab+>26 beshort 0 no relocation tab+>22 belong x flags: 0x%X,+>22 belong &0x04 malloc may be from alternate RAM,+>22 belong &0x02 may be loaded to alternate RAM,+>22 belong &0x01 fastload flag,+>18 belong 0+>14 belong x symboltab len %u,+>10 belong x BSS len %u,+>6 belong x data len %u,+>2 belong x text len %u,+0 beshort 0x601A Atari 68xxx executable,+# Atari ST/TT... program format (sent by Wolfram Kleff )++>14 belong x sym=%d)+>10 belong x bss=%d,+>6 belong x dat=%d,+>2 belong x (txt=%d,+0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable+>14 belong x sym=%d)+>10 belong x bss=%d,+>6 belong x dat=%d,+>2 belong x (txt=%d,+0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable+# The additional 0x601b distinction I took from Doug Lee's magic.+# not larger than 1 MB (which is a lot on ST).+# besides the magic 0x601a, the text segment size is checked to be+# (according to Roland Waldi, Oct 21, 1987)+# from Oskar Schirmer Feb 3, 2001+#+# ATARI ST relocatable PRG++0 string S0 Motorola S-Record; binary data in text format+# Motorola S-Records, from Gerd Truschinski +#+0 beshort 0555 88K BCS executable+#adZZ?#U0 r W .  p < $ K 3 1 i 6  G V"<$j3KK'b@I+# 0xeb conflicts with "sequent" magic+#0 byte 0x8c MS-DOS executable (COM)+#>6 string SFX\ of\ LHarc (%s)+#0 byte 0xe9 MS-DOS executable (COM)+# two dozen different one-byte "magics".+# but it isn't feasible to match all COM files since there must be at least+# Uncommenting only the first two lines will cover about 2/3 of COM files,+# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)++>>49824 leshort >1 \b, %u files+>>49824 leshort =1 \b, 1 file+>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21+# TELVOX Teleinformatica CODEC self-extractor for OS/2:+#+>69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption+# this is the NT/Win32 version:+>49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption+>47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12+# these are the OS/2 versions (OS/2 is flagged above):+>26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption+>25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12+# these are the DOS versions:+# Info-ZIP self-extractors+#+>28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02+>15770 string PK\003\004 \b, PKZIP SFX archive v2.04g+>15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09+>13297 string PK\003\004 \b, PKZIP SFX archive v1.93a+>11696 string PK\003\004 \b, PKZIP SFX archive v1.1+#+# [GRR: some company sells a self-extractor/displayer for image data(!)]+# NT/Win32 and VMS.]+# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,+# 8161 bytes are ignored. To make the following entries work, increase+# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than+#+>7195 string Rar! \b, RAR self-extracting archive+>1638 string -lh5- \b, LHa SFX archive v2.13S+>0x24 string LHA's\ SFX \b, %.15s+>0x24 string LHa's\ SFX \b, %.15s+>0x1e string PKLITE\ Copr. \b, %.6s compressed+# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"+>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX+>0x1c string LZ91 \b, LZEXE v0.91 compressed+>0x1c string LZ09 \b, LZEXE v0.90 compressed+>0x1c string diet\xf9\x9c \b, diet compressed+>0x1c string RJSX\xff\xff \b, ARJ SFX+>>122 string Windows\ self-extracting\ ZIP \b, %s+>>0xe9 string PKSFX2 \b, %s+>>0xe7 string LH/2\ Self-Extract \b, %s+>24 string @ \b, OS/2 or MS Windows+0 string MZ MS-DOS executable (EXE)+#+# .EXE formats (Greg Roelofs, newt@uchicago.edu)++#>4 ledate x stamp %s+0 leshort 0x290 MS Windows COFF PA-RISC object file+#>4 ledate x stamp %s+0 leshort 0x1f0 MS Windows COFF PowerPC object file+#>4 ledate x stamp %s+0 leshort 0x268 MS Windows COFF Motorola 68000 object file+#>4 ledate x stamp %s+0 leshort 0x184 MS Windows COFF Alpha object file+#>4 ledate x stamp %s+0 leshort 0x166 MS Windows COFF MIPS R4000 object file+#>4 ledate x stamp %s+0 leshort 0x14c MS Windows COFF Intel 80386 object file+#>>>202 leshort x \b.%d,+#>>>200 leshort x subsystem version %d+#>>>198 leshort x \b.%d,+#>>>196 leshort x user version %d+#>>>194 leshort x \b.%d,+#>>>192 leshort x requires OS %d+#>>148 leshort >27+#>>>155 byte x \b.%d,+#>>>154 byte x linker %d+#>>148 leshort >0+>>150 leshort&0x1000 >0 system file+#>>150 leshort&0x0200 =0 with debug symbols,+#>>150 leshort&0x0008 =0 with local symbols,+#>>150 leshort&0x0004 =0 with line numbers,+>>150 leshort&0x0001 >0 not relocatable+#>>136 ledate x stamp %s,+>150 leshort&0x2000 >0 DLL+#>>>202 leshort x \b.%d,+#>>>200 leshort x subsystem version %d+#>>>198 leshort x \b.%d,+#>>>196 leshort x user version %d+#>>>194 leshort x \b.%d,+#>>>192 leshort x requires OS %dad]i=:85 4  a  { x C ` ]  Z W 6  c;rpaFD+r5wNA?$+# Windows help file FTG FTS+++0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 Ms-windows special zipped file+# windows zips files .dmf++0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig+0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig+0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig+0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig+0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig+0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig+#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig+# PGP sig files .sig++0 string \003\003\001\004\070\001\000\000 tz3 ms-works file+0 string \003\002\001\004\070\001\000\000 tz3 ms-works file+0 string \003\001\001\004\070\001\000\000 tz3 ms-works file+#tz3 files whatever that is (MS Works files)++0 string \327\315\306\232\000\000\000\000\000\000 ms-windows metafont .wmf+# Windows Metafont .WMF++>15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal+0 string HyperTerminal\ hyperterm+# Hyper terminal:++0 string Nullsoft\ AVS\ Preset\ Winamp plug in+#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player+# Winamp .avs++0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is+# DeIsL1.isu what this is I don't know++0 string ?_\3\0 MS Windows Help Data+# Help files++>4 belong 0x06800200 fmt document data+>4 belong 0x06040600 wk1 document data+0 belong 0x00000200 Lotus 1-2-3+#+>4 belong 0x07800000 fm3 or fmb document data+>4 belong 0x07800100 fm3 or fmb document data+>4 belong 0x02100400 wk4 document data+>4 belong 0x00100400 wk3 document data+0 belong 0x00001a00 Lotus 1-2-3+#+0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet+2121 string Biff5 Microsoft Excel 5.0 Worksheet+# Italian MS-Excel+2114 string Biff5 Microsoft Excel 5.0 Worksheet+# Pawel Wiecek (for polish Excel)+#+2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s+2080 string Microsoft\ Excel\ 5.0\ Worksheet %s+#+0 string \333\245-\0\0\0 Microsoft Office Document+0 string \320\317\021\340\241\261\032\341 Microsoft Office Document+0 string \376\067\0\043 Microsoft Office Document+#+0 string PO^Q` Microsoft Word 6.0 Document+#+0 belong 0x31be0000 Microsoft Word Document+#+2112 string MSWordDoc Microsoft Word document data+# Pawel Wiecek (for polish Word)+2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data+2080 string Microsoft\ Word\ 6.0\ Document %s+# Popular applications++>30 byte 12 (4kB sectors)+>30 byte 9 (512B sectors)+0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage+>30 byte 12 (4kB sectors)+>30 byte 9 (512B sectors)+0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage+# Stuart Cunningham+# AAF files:+++0 string CREG Windows 95 registry file+0 string regf Windows NT registry file+#+# Windows Registry files.+#++#+#0 byte 0xf0 MS-DOS program library data+0 string LZ MS-DOS executable (built-in)+# miscellaneous formats++#0 byte 0xb8 MS-DOS executable (COM)+#0 byte 0xeb MS-DOS executable (COM)adnSQO1][* ~ a _ ] O )   R   d @ & i g E  p F  ZXgG fdFe=!b`C_8a$ +0 string MSCF\0\0\0\0 Microsoft Cabinet file+# Microsoft Cabinet files+# From Stuart Caie (developer of cabextract)+#------------------------------------------------------------------------------++>>0x1c string pmodedj stubbed with %s+>>>&1 string >\0 %.4s]+>>0x8ad string UPX [compressed w/%s+>>>&1 string >\0 %.4s]+>>0x8b2 string djp [compressed w/%s+>0x20c string >0 (stub v%.4s)+0x200 string go32stub DOS-executable compiled w/DJGPP+# v >2, uses DPMI & small(2k) stub (Robert vd Boon, rjvdboon@europe.com)+# DJGPP compiled files++2 string GFA-BASIC3 GFA-BASIC 3 data+# GFA-BASIC (Wolfram Kleff)++0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data+# HtmlHelp files (.chm)++0 lelong 0x223e9f78 TNEF+# TNEF magic From "Joomy" ++>>>>24 long >0 length %d+>>>20 long >0 TIFF starts at byte %d+>>>>16 long >0 length %d+>>>12 long >0 Metafile starts at byte %d+>>8 long >0 length %d+>4 long >0 Postscript starts at byte %d+0 belong 0xC5D0D3C6 DOS EPS Binary File+# From: Ed Sznyter +# DOS EPS Binary File Header++>4 lelong 0x00021401 Windows shortcut file+0 lelong 0x4C+>9 byte >0x2F \b.%c file+>8 byte >0x2F version %c+1 string RDC-meg MegaDots +0 string PMCC Windows 3.x .GRP file+0 leshort 0x0006 DBase 3 index file+>0x04 lelong >0 (%d records)+>0x04 lelong 0 (no records)+0 byte 0x83 DBase 3 data file with memo(s)+>0x04 lelong >0 (%d records)+>0x04 lelong 0 (no records)+0 byte 0x03 DBase 3 data file+# WARNING: below line conflicts with Infocom game data Z-machine 3++0 lelong 0x08084b50 TurboC Font file+0 lelong 0x08086b70 TurboC BGI file+#0 string AH Halo(TM) bitmapped font file+# Too simple - MPi+0 string ! MKS Spell hash list+0 string ! MKS Spell hash list (old format)+0 string DCU1 Borland Delphi .DCU file+9 string RABBITGRAPH RabbitGraph file+0 string GERBIL First Choice device file+9 string GERBILCLIP First Choice database+9 string GERBILDB First Choice database+9 string GERBILDOC First Choice document+# From Doug Lee via a FreeBSD pr++#it clashes with ttf files so put it lower down.+#>3 string >\0 oops, not a font file. Cancel that.+#>3 string \002\000\000Copyright\ yes+#>3 string \022\000\000Copyright\ yes+#0 string \000\001 pfm?+# or \000 \001 any? \022 \000 \000+# these have the form \000 \001 any? \002 \000 \000+# Acroread or something files wrongly identified as G3 .pfm+##### put in Either Magic/font or Magic/news+++9 string \000\000\000\030\001\000\000\000 ms-windows recycled bin info+# recycled/info the windows trash bin index+++# then there is a copyright notice+>4 string >\0 %s+0 string pk\010\010BGI Borland device +# .bgi files+++# then there is a copyright notice+>4 string >\0 %s+0 string PK\010\010BGI Borland font +# .chr files+++>>8 byte >0 \b, %d-colors+>>8 byte 0 \b, 256-colors+>>>7 byte >0 \b%d+>>6 byte >0 \b, %dx+>4 byte >1 - %d icons+>4 byte 1 - 1 icon+0 string \000\000\001\000 ms-windows icon resource+# Windows icons (Ian Springer )++0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for ms-windows+#ico files++0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 ms-Windows shortcut+# lnk files windows symlinks+++0 string \120\115\103\103 Ms-windows 3.1 group files+# grp old windows 3.1 group files++0 string \164\146\115\122\012\000\000\000\001\000\000\000 ms-windows help cacheadg\;wU3 ` C # x v O $ " i G & o ( V  ^>r0cMI31)-`'%|zs53+|S@>7 +0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000+#.wsp++0 string \002\000\002\001 MSVC .bsc+#.bsc++>5 string >\0 %s+0 string \000\002\000\007\000 MSVC .sbr+#.sbr++>33 string >\0 ver %s+>18 string program\ database\ +0 string Microsoft\ C/C++\ MSVC program database+# too long 0 string Microsoft\ C/C++\ program\ database\ +# .pdb++0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch+#.pch++0 string \360\175\000\000 Microsoft Visual C library+0 string \360\075\000\000 Microsoft Visual C library+0 string \360\015\000\000 Microsoft Visual C library+#.lib++0 string \377\003\000\377\001\000\060\020\350 MSVC .res+0 string \377\003\000\377\001\000\020\020\350 MSVC .res+0 string \000\000\000\000\040\000\000\000\377 MSVC .res+# .res++0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide+#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide+# .ide++0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file+# .aps++# I have version 1.0+# +# Microsoft visual C+# "H. Nanosecond" +# msvc: file(1) magic for msvc+#------------------------------------------------------------------------------++>>(64.l) lestring16 >0 Description: %15.15s+# number of characters -- indicated by the ulelong at offset 60.+# of characters instead of all the "description length"+# as below. Unfortunately the following only prints out the first couple+# Note it would be better to print out the description, which is found +>>60 ulelong >0 (length 0x%x)+>64 ulelong >0 Description available at offset 0x%x+# found at offset (*64).+# If the description has a length greater than zero, it exists and is +>44 ulelong x version 0x%x.+40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data+# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data+# 0 lelong 1+# syntax available by some file commands you could write:+# the first double word in the file should be 1. With the extended+# for further information. Note that "0 lelong 1" should be true i.e.+# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp +# Windows Enhanced Metafile (EMF)+++>4 byte =0x30 Offline database+>4 byte =0xC7 Accounts informations+>4 byte =0xC6 Folder database+>4 byte =0xC5 Message database+0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File+>20 string >\0 Version %s+0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File+# Christophe Monniez++0 lelong 0x00035f3f Windows 3.x help file+# From: Dirk Jagdmann ++0 lelong 0x4E444221 Microsoft Outlook binary email folder+# Outlook Personal Folders++>56 leshort >1 \b, %u registry entries+>56 leshort 1 \b, 1 registry entry+>52 leshort >1 \b, %u files+>52 leshort 1 \b, 1 file+>20 lelong 70001 \b, ARM 7TDMI+>20 lelong 10005 \b, Hitachi SH4+>20 lelong 10004 \b, Hitachi SH3E+>20 lelong 10003 \b, Hitachi SH3+>20 lelong 4000 \b, MIPS R4000+>20 lelong 0xA11 \b, StrongARM+>20 lelong 104 \b, Hitachi SH4+>20 lelong 103 \b, Hitachi SH3+>20 lelong 0 \b, architecture-independent+0 string MSCE\0\0\0\0 Microsoft WinCE install header+# Windows CE package files++>(12.l+40) lelong x %u files+>5 byte&0xf0 !0x60 version 4/5,+>5 byte&0xf0 =0x60 version 6,+0 string ISc( InstallShield Cabinet file+# InstallShield Cabinet files++>28 leshort >1 \b, %u files+>28 leshort 1 \b, 1 file+>8 lelong x \b, %u bytesad0_t530b_  i  c % i < 9 ' h H '  v P /  ~U5}\6}\6d>}z@=;F3j4+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 041400410 a.out NetBSD/i386 pure+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>>20 lelong >4096 dynamically linked executable+>>20 lelong =4096 dynamically linked executable+>>20 lelong <4096 shared library+>0 byte &0x80 +0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged++>16 belong >0 not stripped+0 belong 000000407 a.out NetBSD big-endian object file+>16 lelong >0 not stripped+0 lelong 000000407 a.out NetBSD little-endian object file++#+# All new-style magic numbers are in network byte order.+#+# netbsd: file(1) magic for NetBSD objects+#------------------------------------------------------------------------------++>22 beshort >0 - version %d+>12 belong >0 not stripped+>20 beshort 0413 pure executable+>20 beshort 0407 executable+>18 beshort &060000 object+>18 beshort &040000 compatible object+0 beshort 000645 Tower32/800 68010+>22 beshort >0 - version %d+>12 belong >0 not stripped+>20 beshort 0413 pure executable+>20 beshort 0407 executable+>18 beshort &060000 object+>18 beshort &040000 compatible object+>18 beshort &020000 w/68881 object+0 beshort 000640 Tower32/800 68020+>22 beshort >0 - version %d+>20 beshort 0410 pure executable+>20 beshort 0407 executable+>12 belong >0 not stripped+0 beshort 000630 Tower32/600/400 68020 object+>22 beshort >0 - version %d+>20 beshort 0410 pure executable+>20 beshort 0407 executable+>12 belong >0 not stripped+0 beshort 000625 Tower/XP rel 3 object+>22 beshort >0 - version %d+>20 beshort 0410 pure executable+>20 beshort 0407 executable+>12 belong >0 not stripped+0 beshort 000620 Tower/XP rel 3 object+>22 beshort >0 - version %d+>20 beshort 0410 pure executable+>20 beshort 0407 executable+>12 belong >0 not stripped+0 beshort 000615 Tower/XP rel 2 object+>22 beshort >0 - version %d+>20 beshort 0410 pure executable+>20 beshort 0407 executable+>12 belong >0 not stripped+0 beshort 000610 Tower/XP rel 2 object+#+# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP+# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa+# contributed by+#+# ncr: file(1) magic for NCR Tower objects+#------------------------------------------------------------------------------++0 string VMAP National Instruments, VXI File, data+# This is for VXI Package+>8 string rsc Resources File, data+# This is for General Resources+>8 string LMNULBVW Portable File Names, data+# This is for Menu Libraries+>>10 string AR VI Library, data+>>10 string IN Virtual Instrument Program, data+>>10 string SB Code Resource File, data+# Check wich kind of file is+>8 string LV LabVIEW File,+# Check if it's a LabVIEW File+0 string RSRC National Instruments,+#+# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing+# Many formats still missing, we use, for the moment LabVIEW+# version 1+# From Enrique Gámez-Flores+#++# natinst: file(1) magic for National Instruments Code Files+#-----------------------------------------------------------------------------++# these seem to start with the version and contain menusaddfH) YF! } G  z i A #  t r 2  u V   O >  eGEdG(OQ4}jEj:cE&+>12 string >\0 from '%s'+0 belong&0377777777 042400507 a.out NetBSD/sparc core+>16 belong >0 not stripped+>>20 belong =0 object file+>>20 belong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042400407 a.out NetBSD/sparc+>16 belong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042400410 a.out NetBSD/sparc pure+>16 belong >0 not stripped+>0 byte ^0x80 executable+>>20 belong >8192 dynamically linked executable+>>20 belong =8192 dynamically linked executable+>>20 belong <8192 shared library+>0 byte &0x80 +0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged++>12 string >\0 from '%s'+0 belong&0377777777 045200507 a.out NetBSD/powerpc core++>32 lelong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 042200507 a.out NetBSD/ns32532 core+>16 lelong >0 not stripped+>>20 lelong =0 object file+>>20 lelong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042200407 a.out NetBSD/ns32532+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>>20 lelong >4096 dynamically linked executable+>>20 lelong =4096 dynamically linked executable+>>20 lelong <4096 shared library+>0 byte &0x80 +0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged++>32 belong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 042000507 a.out NetBSD/m68k4k core+>16 belong >0 not stripped+>>20 belong =0 object file+>>20 belong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042000407 a.out NetBSD/m68k4k+>16 belong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure+>16 belong >0 not stripped+>0 byte ^0x80 executable+>>20 belong >4096 dynamically linked executable+>>20 belong =4096 dynamically linked executable+>>20 belong <4096 shared library+>0 byte &0x80 +0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged++>32 belong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 041600507 a.out NetBSD/m68k core+>16 belong >0 not stripped+>>20 belong =0 object file+>>20 belong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 041600407 a.out NetBSD/m68k+>16 belong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 041600410 a.out NetBSD/m68k pure+>16 belong >0 not stripped+>0 byte ^0x80 executable+>>20 belong >8192 dynamically linked executable+>>20 belong =8192 dynamically linked executable+>>20 belong <8192 shared library+>0 byte &0x80 +0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged++>32 lelong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 041400507 a.out NetBSD/i386 core+>16 lelong >0 not stripped+>>20 lelong =0 object file+>>20 lelong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 041400407 a.out NetBSD/i386addj6`C$ l M . { h C  g 7  _ A "  N ;  r: kZ2caeE['Q4{]>++>32 belong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 043400507 a.out NetBSD/mips core+>16 belong >0 not stripped+>>20 belong =0 object file+>>20 belong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 043400407 a.out NetBSD/mips+>16 belong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 043400410 a.out NetBSD/mips pure+>16 belong >0 not stripped+>0 byte ^0x80 executable+>>20 belong >8192 dynamically linked executable+>>20 belong =8192 dynamically linked executable+>>20 belong <8192 shared library+>0 byte &0x80 +0 belong&0377777777 043400413 a.out NetBSD/mips demand paged++>32 lelong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 043200507 a.out NetBSD/alpha core+>10 leshort 0x0000 stripped+>10 leshort 0x0001 not stripped+0 lelong 0x00070185 ECOFF NetBSD/alpha binary+# dealt with in "elf".+# so no rules are provided for them. NetBSD/alpha ELF objects are +# NetBSD/alpha does not support (and has never supported) a.out objects,++>32 lelong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 045400507 a.out NetBSD/vax 4k core+>16 lelong >0 not stripped+>>20 lelong =0 object file+>>20 lelong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 045400407 a.out NetBSD/vax 4k+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>>20 lelong >4096 dynamically linked executable+>>20 lelong =4096 dynamically linked executable+>>20 lelong <4096 shared library+>0 byte &0x80 +0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged++>32 lelong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 043000507 a.out NetBSD/vax 1k core+>16 lelong >0 not stripped+>>20 lelong =0 object file+>>20 lelong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 043000407 a.out NetBSD/vax 1k+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>>20 lelong >4096 dynamically linked executable+>>20 lelong =4096 dynamically linked executable+>>20 lelong <4096 shared library+>0 byte &0x80 +0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged++>32 lelong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 042600507 a.out NetBSD/pmax core+>16 lelong >0 not stripped+>>20 lelong =0 object file+>>20 lelong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042600407 a.out NetBSD/pmax+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 042600410 a.out NetBSD/pmax pure+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>>20 lelong >4096 dynamically linked executable+>>20 lelong =4096 dynamically linked executable+>>20 lelong <4096 shared library+>0 byte &0x80 +0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged++>32 belong !0 (signal %d)ad_W#cD l M  y w & U   i 4 2 e@_4nJ:,FsK!F7  +#+# other stuff in the header is in.+# We have to check the byte order flag to see what byte order all the+#+# olf: file(1) magic for OLF executables+#------------------------------------------------------------------------------++0 string Octave-1-B Octave binary data (big endian)+0 string Octave-1-L Octave binary data (little endian)+# octave binary data file(1) magic, from Dirk Eddelbuettel +#------------------------------------------------------------------------------+>9 string >\0 (Version %3.3s).+>8 string N abstract syntax tree interface file+>8 string M abstract syntax tree implementation file+>8 string Z native library file (.cmxa)+>8 string Y native object file (.cmx)+>8 string A library file (.cma)+>8 string O object file (.cmo)+>8 string I interface file (.cmi)+>8 string X exec file+0 string Caml1999 Objective caml+# ocaml: file(1) magic for Objective Caml files.+#------------------------------------------------------------------------------++>26 belong x Pkts: %u+>22 belong x Flows: %u+>18 belong x Bytes1: %u+>14 belong x Bytes: %u+>10 bedate x stopped: %s+>6 bedate x started: %s+>5 byte x %d+>4 byte x V%d.+0 string NPFF NItpicker Flow File +# From: Christian Jachmann http://www.nitpicker.de+# nitpicker: file(1) magic for Flowfiles.+#------------------------------------------------------------------------------+8 belong 0x137A2B48 X11/NeWS font family+8 belong 0x137A2B45 X11/NeWS bitmap font+0 belong 0x137A2951 encrypted scalable OpenFont binary+0 belong 0x137A2950 scalable OpenFont binary+0 belong 0x137A2947 NeWS font family+0 belong 0x137A2944 NeWS bitmap font+0 string StartFont ASCII font bits+0 string StartFontMetrics ASCII font metrics+#+# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")+#------------------------------------------------------------------------------++0 string JG\004\016\0\0\0\0 ART+#This is files ending in .art, FIXME add more rules+#++0 string SX961999 Net2phone+#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060+# Net 2 Phone +# .n2p +0 string \000\036\204\220\000 Netscape folder cache+0 string #\ Netscape\ folder\ cache Netscape folder cache+# .snm Caches++0 string \000\017\102\111 Netscape Communicator address book+# Netscape Communicator address book++0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book+# Netscape Address book .nab++#+# version 3 and 4 I think+# "H. Nanosecond" +# netscape: file(1) magic for Netscape files+#------------------------------------------------------------------------------++>32 lelong !0 (signal %d)+>12 string >\0 from '%s'+0 belong&0377777777 043600507 a.out NetBSD/arm core+# format with NetBSD/arm32.+# NetBSD/arm26 has always used ELF objects, but it shares a core file+>16 lelong >0 not stripped+>>20 lelong =0 object file+>>20 lelong !0 executable+>>0 byte &0x40 position independent+>0 byte ^0x80+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 043600407 a.out NetBSD/arm32+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>0 byte &0x80 dynamically linked executable+0 belong&0377777777 043600410 a.out NetBSD/arm32 pure+>16 lelong >0 not stripped+>0 byte ^0x80 executable+>>20 lelong >4096 dynamically linked executable+>>20 lelong =4096 dynamically linked executable+>>20 lelong <4096 shared library+>0 byte &0x80+0 belong&0377777777 043600413 a.out NetBSD/arm32 demand pagedadlXkWD2   q R 4  } a =  h I  g 8  ` D &  wX:fF-bA'd:~c75e%uT* +#0 string news: OS/2 URL object text+#>7 string >\ (email) <%s>+#0 string mailto: OS/2 URL object text+#>5 string >\ (WWW) +#0 string http: OS/2 URL object text+# David Mediavilla +# Provided 1998/08/22 by+# OS/2 URL objects++>24 string >\\t (URL=<%s>)+1 string InternetShortcut MS Windows 95 Internet shortcut text+# David Mediavilla +# Provided 1998/08/22 by++#+# os2: file(1) magic for OS/2 files+#------------------------------------------------------------------------------++>>36 belong 1 MathCoPro/FPU/MAU Required+>>20 belong 1 version 1+>>20 belong 0 invalid version+>>18 beshort 0x9026 Alpha,+>>18 beshort 36 cisco 12000,+>>18 beshort 25 cisco 7200,+>>18 beshort 24 cisco SVIP,+>>18 beshort 21 cisco 7500,+>>18 beshort 20 PowerPC or cisco 4500,+>>18 beshort 18 SPARC32PLUS,+>>18 beshort 17 VPP500,+>>18 beshort 16 nCUBE,+>>18 beshort 15 PA-RISC,+>>18 beshort 11 RS6000,+>>18 beshort 10 MIPS R3000_LE - invalid byte order,+>>18 beshort 9 Amdahl,+>>18 beshort 8 MIPS R3000_BE,+>>18 beshort 7 Intel 80860,+>>18 beshort 6 Intel 80486 - invalid byte order,+>>18 beshort 5 Motorola 88000,+>>18 beshort 4 Motorola 68000,+>>18 beshort 3 Intel 80386 - invalid byte order,+>>18 beshort 2 SPARC,+>>18 beshort 1 AT&T WE32100,+>>18 beshort 0 no machine,+>>16 beshort &0xff00 processor-specific,+>>>(0x38+0x10) belong >0 (signal %d),+>>>(0x38+0xcc) string >\0 of '%s'+>>16 beshort 4 core file,+>>16 beshort 3 shared object,+>>16 beshort 2 executable,+>>16 beshort 1 relocatable,+>>16 beshort 0 no file type,+>5 byte 2 MSB+>8 string >\0 (%s)+>>36 lelong 1 MathCoPro/FPU/MAU Required+>>20 lelong 1 version 1+>>20 lelong 0 invalid version+>>18 leshort 0x9026 Alpha,+>>18 leshort 20 PowerPC,+>>18 leshort 18 SPARC32PLUS,+>>18 leshort 17 VPP500,+>>18 leshort 16 nCUBE,+>>18 leshort 15 PA-RISC - invalid byte order,+>>18 leshort 11 RS6000 - invalid byte order,+>>18 leshort 10 MIPS R3000_LE,+>>18 leshort 9 Amdahl - invalid byte order,+>>18 leshort 8 MIPS R3000_BE - invalid byte order,+>>18 leshort 7 Intel 80860,+>>18 leshort 6 Intel 80486,+>>18 leshort 5 Motorola 88000 - invalid byte order,+>>18 leshort 4 Motorola 68000 - invalid byte order,+>>18 leshort 3 Intel 80386,+>>18 leshort 2 SPARC - invalid byte order,+>>18 leshort 1 AT&T WE32100 - invalid byte order,+>>18 leshort 0 no machine,+>>16 leshort &0xff00 processor-specific,+>>>(0x38+0x10) lelong >0 (signal %d),+>>>(0x38+0xcc) string >\0 of '%s'+>>16 leshort 4 core file+# corrections by Christian 'Dr. Disk' Hechelmann +# Core handling from Peter Tobias +>>16 leshort 3 shared object,+>>16 leshort 2 executable,+>>16 leshort 1 relocatable,+>>16 leshort 0 no file type,+>5 byte 1 LSB+>5 byte 0 invalid byte order+>7 byte 12 NCR+>7 byte 11 Dell+>7 byte 10 SCO+>7 byte 9 Irix+>7 byte 8 Solaris+>7 byte 7 esix+>7 byte 6 SVR4+>7 byte 5 Linux+>7 byte 4 4.4BSD+>7 byte 3 FreeBSD+>7 byte 2 NetBSD+>7 byte 1 OpenBSD+>7 byte 0 invalid os+>4 byte 2 64-bit+>4 byte 1 32-bit+>4 byte 0 invalid class+0 string \177OLF OLF+# Based on elf from Daniel Quinlan +# Created by Erik Theisen +#+# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?+# MIPS R3000 may also be for MIPS R2000.adZrOMsp8 K  w G   t r T "  Q E t * ab_\z*?|yvsRO+(eC@yX30  +>0x14 byte&0x40 0x40 ghost+>0x14 byte&0x80 0x80 re-entrant+# attr+#+0 beshort 0x4AFC OS9/68K module:+#+# OS9/m68k stuff (to be continued)+#+>6 byte&0xf0 0xF0 device descriptor+>6 byte&0xf0 0xE0 device driver+>6 byte&0xf0 0xD0 file manager+>6 byte&0xf0 0xC0 system module+#+>6 byte&0xf0 0x40 data module+>6 byte&0xf0 0x30 multi-module+>6 byte&0xf0 0x20 subroutine+>6 byte&0xf0 0x10 program executable+#+>6 byte&0x0f 0x06 Fortran I-code+>6 byte&0x0f 0x05 COBOL I-code+>6 byte&0x0f 0x04 C I-code+>6 byte&0x0f 0x03 Pascal P-code+>6 byte&0x0f 0x02 BASIC I-code+>6 byte&0x0f 0x01 machine language+>6 byte&0x0f 0x00 non-executable+#+0 beshort 0x87CD OS9/6809 module:+#+# OS9/6809 module descriptions:+#+#+#+# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR+# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,+# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. +# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+#+#+# derived from this software without specific prior written permission.+# 4. The name of the author may not be used to endorse or promote products+# the NetBSD project.+# This product includes software developed by Ignatios Souvatzis for+# must display the following acknowledgement:+# 3. All advertising materials mentioning features or use of this software+# documentation and/or other materials provided with the distribution.+# notice, this list of conditions and the following disclaimer in the+# 2. Redistributions in binary form must reproduce the above copyright+# notice, this list of conditions and the following disclaimer.+# 1. Redistributions of source code must retain the above copyright+# are met:+# modification, are permitted provided that the following conditions+# Redistribution and use in source and binary forms, with or without+#+# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.+#+0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI+# OS/2 INI (this is a guess)++>107 string >0 (%s)+0 string HSP\x10\x9b\x00 OS/2 HLP+>107 string >0 (%s)+0 string HSP\x01\x9b\x00 OS/2 INF+# +# int16 unknown2; // unknown purpose+# int16 hdrsize; // total size of header+# // seem to work with INF settings here as well.+# // using the VIEW command, while help files +# // patching this byte allows reading HLP files+# // bit 4: set if HLP style file+# // bit 0: set if INF style file+# int8 flags; // probably a flag word...+# int8 unknown1; // unknown purpose, could be third letter of ID+# int16 ID; // ID magic word (5348h = "HS")+#+# list the following header format in inf02a.doc:+# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)+# Carl Hauser (chauser.parc@xerox.com) and +# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)++#>5 string >\ (Local file) <%s>+#0 string file: OS/2 URL object text+#>4 string >\ (FTP) +#0 string ftp: OS/2 URL object text+#>5 string >\ (Usenet) <%s>ad\u]A# cF( 6 a + # c - +  ` / | K  o5[*Rt5Y(}Lp6++>0 string >\0 "%s"+60 string ToRaTRPW TomeRaider PalmOS document+>0 string >\0 "%s"+60 string TdatTide Tides PalmOS document+>0 string >\0 "%s"+60 string dataTDBP ThinkDB PalmOS document+>0 string >\0 "%s"+60 string DataTlPt TealPaint PalmOS document+>0 string >\0 "%s"+60 string DataTlMl TealMeal PalmOS document+>0 string >\0 "%s"+60 string InfoTlIf TealInfo PalmOS document+>0 string >\0 "%s"+60 string DataTlPt TealDoc PalmOS document+>0 string >\0 "%s"+60 string SM01SMem SuperMemo PalmOS document+>0 string >\0 "%s"+60 string DataSprd QuickSheet PalmOS document+>0 string >\0 "%s"+60 string DataPlkr Plucker PalmOS document+>0 string >\0 "%s"+60 string PNRdPPrs PeanutPress PalmOS document+>0 string >\0 "%s"+60 string Mdb1Mdb1 MobileDB PalmOS document+>0 string >\0 "%s"+60 string DATALSdb List PalmOS document+>0 string >\0 "%s"+60 string JfDbJFil JFile Pro PalmOS document+>0 string >\0 "%s"+60 string JfDbJBas JFile PalmOS document+>0 string >\0 "%s"+60 string ToGoToGo iSilo PalmOS document+>0 string >\0 "%s"+60 string InfoINDB InfoView PalmOS document+>0 string >\0 "%s"+60 string PmDBPmDB HanDBase PalmOS document+>0 string >\0 "%s"+60 string vIMGView FireViewer/ImageViewer PalmOS document+>0 string >\0 "%s"+60 string DB99DBOS DB PalmOS document+>0 string >\0 "%s"+60 string BVokBDIC BDicty PalmOS document+# Thanks to Hasan Umit Ezerce for his DocType+# Michael-John Turner +# Variety of PalmOS document types++>0 string >\0 "%s"+60 belong 0x4841434b HackMaster hack+# HACK+>0 string >\0 "%s"+60 belong 0x54455874 AportisDoc file+# TEXt+>0 string >\0 "%s"+60 belong 0x6170706c PalmOS application+# appl++# Brian Lalor +#+# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks+#------------------------------------------------------------------------------++0 short 0565 i386 COFF object+#+# I386 magic number info+0 long 0xefbe OSF/Rose object+#+# Mach magic number info+#+>0x12 byte 15 device descriptor+>0x12 byte 14 device driver+>0x12 byte 13 file manager+>0x12 byte 12 system module+>0x12 byte 11 trap library+>0x12 byte 4 data module+>0x12 byte 3 multi-module+>0x12 byte 2 subroutine+>0x12 byte 1 program executable+#+# type:+#+#+>0x13 byte 6 Fortran I-code+>0x13 byte 5 COBOL I-code+>0x13 byte 4 C I-code+>0x13 byte 3 Pascal P-code+>0x13 byte 2 BASIC I-code+>0x13 byte 1 machine language+#+# lang:+#+>0x14 byte&0x20 0x20 system-statead<km[.+e:  z ] [ @  o 9   b _ B *  c 2 /   ^ [ Y :  ro5`;9ig?=b`*  ~1h-x75+# XXX: christos matches+# a couple more, by me++0 string eval\ '(exit\ $?0)'\ &&\ eval\ 'exec perl script text+0 string eval\ "exec\ /usr/local/bin/perl perl script text executable+0 string/b #!\ /usr/local/bin/perl perl script text+0 string eval\ "exec\ /usr/bin/perl perl script text+0 string/b #!\ /usr/bin/perl perl script text executable+0 string eval\ "exec\ /bin/perl perl script text+0 string/b #!\ /bin/perl perl script text executable+# Send additions to +# Keith Waclena +# The ``eval'' line recognizes an outrageously clever hack for USG systems.+#+# perl: file(1) magic for Larry Wall's perl language.+#------------------------------------------------------------------------------++>8 leshort >0 not stripped+0 leshort 0431 PDP-11 overlaid separate executable++>8 leshort >0 not stripped+0 leshort 0430 PDP-11 overlaid pure executable++>8 leshort >0 not stripped+0 leshort 0413 PDP-11 demand-paged pure executable+# These last three are derived from 2.11BSD file(1)++0 leshort 0437 PDP-11 kernel overlay++>15 byte >0 - version %d+>8 leshort >0 not stripped+0 leshort 0411 PDP-11 separate I&D executable++>15 byte >0 - version %d+>8 leshort >0 not stripped+0 leshort 0410 PDP-11 pure executable++0 leshort 0405 PDP-11 old overlay+0 leshort 0401 PDP-11 UNIX/RT ldp++>15 byte >0 - version %d+>8 leshort >0 not stripped+0 leshort 0407 PDP-11 executable+#+# PDP-11 a.out+#+0 lelong 0101554 PDP-11 double precision APL workspace+0 lelong 0101555 PDP-11 single precision APL workspace+#+# pdp: file(1) magic for PDP-11 executable/object and APL workspace+#------------------------------------------------------------------------------++>7 byte x \b.%c+>5 byte x \b, version %c+0 string %PDF- PDF document++#+# pdf: file(1) magic for Portable Document Format+#------------------------------------------------------------------------------+0 short 0x2a17 "compact bitmap" format (Poskanzer)+#+# XXX - byte order?+#+# pbm: file(1) magic for Portable Bitmap files+#------------------------------------------------------------------------------++>19 byte&0x0c 0x00 not stripped+>19 byte&0x02 0x00 object+>19 byte&0x02 0x02 executable+>0 byte&0xf0 0x90 T9000+>0 byte&0xf0 0x80 T800+0 beshort&0xfff 0xACE PARIX+#+# From: Ignatios Souvatzis +# Parix COFF executables+#+#------------------------------------------------------------------------------++>0 string >\0 "%s"+60 string BOOKMOBI Mobipocket E-book+# Mobipocket (www.mobipocket.com), donated by Carl Witty++>0 string >\0 "%s"+60 string ptch Palm OS operating system patch data+>0 string >\0 "%s"+60 string libr Palm OS dynamic library data+# Palm OS .prc file types++>>(0x4E.L+1) byte x %02d)+>(0x4E.L) byte >1 (v%d.+>>>>(0x4E.L+14) beshort >1 - %d annotations+>>>>(0x4E.L+14) beshort <2 - 1 annotation+>>>(0x4E.L+14) beshort >0+>>>>(0x4E.L+10) beshort >1 - %d bookmarks+>>>>(0x4E.L+10) beshort <2 - 1 bookmark+>>>(0x4E.L+10) beshort >0+>>(0x4E.L+1) byte x (v1.%02d)+>(0x4E.L) byte 1+>>(0x4E.L+1) byte x (v0.%02d)+>(0x4E.L) byte 0+>0 string >\0 "%s"+60 string zTXT A GutenPalm zTXT e-book+#+# For other versions, just outputs version.+# annotations.+# For version 1.xx zTXTs, outputs version and numbers of bookmarks and+# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)ad_{M2w`HF ~ 7 D =   j * Z + V/xS10jI+ pO.zO+>>8 long >0 length %d+>4 long >0 Postscript starts at byte %d+0 belong 0xC5D0D3C6 DOS EPS Binary File+# From: Ed Sznyter +# DOS EPS Binary File Header+++0 string \033%-12345X%!PS PostScript document+>>>16 string ExitServer - type %s+>>>16 string Query - type %s+>>>16 string EPS - type %s+>>12 string >\0 at level %.3s+>3 string PS-Adobe- conforming+0 string \004%! PostScript document text+# Some PCs have the annoying habit of adding a ^D as a document separator+>>>15 string ExitServer - type %s+>>>15 string Query - type %s+>>>15 string EPS - type %s+>>11 string >\0 at level %.3s+>2 string PS-Adobe- conforming+0 string %! PostScript document text+# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)++#+# printer: file(1) magic for printer-formatted files+#------------------------------------------------------------------------------++>15 byte >0x02 - Bad Flags+>15 byte 0x02 - K/D format+>15 byte 0x01 - P/K/D format+>15 byte 0x00 - P/D format+>8 short >0 - %d byte blocks+>2 byte >0 (V%d)+0 short 0x25a mumps blt global+>7 byte >0 and %d byte data cells+>6 byte >0 with %d byte name+>2 byte >0 (V%d)+0 short 0x259 mumps avl global+#+# XXX - byte order? Paging Hokey....+#+# plus5: file(1) magic for Plus Five's UNIX MUMPS+#------------------------------------------------------------------------------++0 belong 0x0000084B Plan 9 executable, DEC Alpha+0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE+0 belong 0x000006EB Plan 9 executable, PowerPC+0 belong 0x00000647 Plan 9 executable, ARM 7-something+0 belong 0x000005AB Plan 9 executable, AMD 29000+0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE+0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210+0 belong 0x00000407 Plan 9 executable, MIPS R3000+0 belong 0x000002AB Plan 9 executable, SPARC+0 belong 0x00000247 Plan 9 executable, Intel 960+0 belong 0x000001EB Plan 9 executable, Intel 386+0 belong 0x00000107 Plan 9 executable, Motorola 68k+#+# From: "Stefan A. Haubenthal" +# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables+#------------------------------------------------------------------------------++0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)+#+# pkgadd: file(1) magic for SysV R4 PKG Datastreams+#------------------------------------------------------------------------------++>15 string PGP\040SIGNATURE- signature+>15 string SIGNED\040MESSAGE- signed message+>15 string MESSAGE- message+>15 string PUBLIC\040KEY\040BLOCK- public key block+0 string -----BEGIN\040PGP PGP armored data+0 beshort 0xa600 PGP encrypted data+0 beshort 0x9500 PGP key security ring+0 beshort 0x9501 PGP key security ring+0 beshort 0x9900 PGP key public ring+#+# pgp: file(1) magic for Pretty Good Privacy+#------------------------------------------------------------------------------++>>5 byte >0 (minor %d)+>>4 byte =4 (major 2)+>>4 byte =5 (major 2)+>>4 byte &01 (network-ordered)+>4 byte >0+0 string pst0 perl Storable(v0.7) data++>>4 byte =2 (major 1)+>>4 byte =3 (major 1)+>>4 byte &01 (network-ordered)+>4 byte >0 (net-order %d)+0 string perl-store perl Storable(v0.6) data+# Perl Storable data files.++0 string package Perl5 module source text+#0 regex package Perl5 module source text (via regex)adDXI~PN3 > # Y @ & ` 7  p D  Y   g8 [!zaK'%#gWiF!~IG+# HP LaserJet 1000 series downloadable firmware file+#------------------------------------------------------------------------------++0 string %!VMF SunClock's Vector Map Format data+# This would otherwise be recognized as PostScript - nick@debian.org++>0x0b byte 0 Oak Technologies printer stream+>0x07 byte 0+0 string OAK+# Rick Richardson +# Oak Technologies printer stream+#------------------------------------------------------------------------------+++>0x12 string ZZ Zenographics ZjStream printer data (little-endian)+0 string ZJZJ+>0x12 string ZZ Zenographics ZjStream printer data (big-endian)+0 string JZJZ+# Rick Richardson rickr@mn.rr.com+# zenographics: file(1) magic for Zenographics ZjStream printer data+#------------------------------------------------------------------------------+++0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data+# These are the /etc/magic entries to decode data sent to an Epson printer.+# From ++0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data+# From Jukka Ukkonen+>45 string >0 face %s+0 string Rast RST-format raster font data+# Now magic for IMAGEN font files...+#+# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]+# to keep the word `text' if the file is human-readable.+# Add any other languages that your Imagen uses - remember+>10 string language\ tektronix (Tektronix 4014 emulation)+>10 string language\ printer (line printer emulation)+>10 string language\ diablo (daisywheel text)+>10 string language\ daisy (daisywheel text)+>10 string language\ impress (imPRESS data)+# this only works if "language xxx" is first item in Imagen header.+0 string @document( Imagen printer+# IMAGEN printer-ready files:++>3 string \&l-90A - Intl. DL envelope size (landscape)+>3 string \&l-81A - No. 10 envelope size (landscape)+>3 string \&l100A - Intl. B5 envelope size+>3 string \&l91A - Intl. C5 envelope size+>3 string \&l90A - Intl. DL envelope size+>3 string \&l81A - No. 10 envelope size+>3 string \&l80A - Monarch envelope size+>3 string \&l26A - A4 page size+>3 string \&l3A - US legal page size+>3 string \&l2A - US letter page size+>3 string \&l1A - US executive page size+>3 string \&l0A - default page size+0 string \033E\033 HP PCL printer data+# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)++#>31 string PostScript PostScript+#>15 string \ ENTER\ LANGUAGE\ =+>>>>&0 string >\0 %s +>>>&0 string >\0 %s +>>&0 string >\0 %s +>&0 string >\0 %s +0 string \033%-12345X@PJL HP Printer Job Language data+# +# From: Uwe Bonnes +# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10+# (LANGUAGE and Language)+# Every driver puts the language at some random position, with random case+# (TM)+# The header found on Win95 HP plot files is the "Silliest Thing possible" +# HP Printer Job Language+0 string \033%-12345X@PJL HP Printer Job Language data+# HP Printer Job Language++>13 string x \b, ve+0 string *PPD-Adobe: PPD file+#+# Yves Arrouye +# Adobe's PostScript Printer Description (PPD) files++>>>>24 long >0 length %d+>>>20 long >0 TIFF starts at byte %d+>>>>16 long >0 length %d+>>>12 long >0 Metafile starts at byte %dad fl0.m># _ \ 0  s C @  V ?  Z 8  y Y 9 7 xU: Z1/nkJ-*(g?<'$[?=e6P!++0 belong 0x3bf20d0a python 2.3 byte-compiled+0 belong 0x2ded0d0a python 2.2 byte-compiled+0 belong 0x2aeb0d0a python 2.1 byte-compiled+0 belong 0x87c60d0a python 2.0 byte-compiled+0 belong 0x994e0d0a python 1.5/1.6 byte-compiled+# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"+# MAGIC as specified in Python/import.c (1.5 to 2.3.0a)+0 string """ a python script text executable+# often the module starts with a multiline string+# From: David Necas +#+# python: file(1) magic for python+#------------------------------------------------------------------------------++>16 long >0 not stripped+0 long 0x5090010b Pyramid 90x family demand paged pure executable+>16 long >0 not stripped+0 long 0x50900108 Pyramid 90x family pure executable+0 long 0x50900107 Pyramid 90x family executable+#+# XXX - byte order?+#+# pyramid: file(1) magic for Pyramids+#------------------------------------------------------------------------------+++>8 ubelong x \b%d+>4 ubelong x Version: %d.+0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.++#+# mailto:rok.papez@lugos.si+# http://pulsar.sourceforge.net+#+# pulsar: file(1) magic for Pulsar POP3 daemon binary files+#------------------------------------------------------------------------------++0 lelong 0x1000007A Psion Series 5 executable++>4 lelong 0x10000141 printer defintion+>4 lelong 0x10000140 printer defintion+>4 lelong 0x100000E5 file transfer protocol+>4 lelong 0x100000E5 file transfer protocol+>4 lelong 0x100000AD physical device driver+>4 lelong 0x100000AC logical device driver+>4 lelong 0x1000008D DLL+>4 lelong 0x1000006C application+>4 lelong 0x1000005D OPX+>4 lelong 0x1000004A comms protocol library+>4 lelong 0x10000049 comms hardware library+>4 lelong 0x00000000 DLL+0 lelong 0x10000079 Psion Series 5 binary:++>4 lelong 0x100000E4 ini file+>4 lelong 0x1000006D database+0 lelong 0x10000050 Psion Series 5++0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image++>4 lelong 0x1000008A exported multi-bitmap image+>4 lelong 0x10000074 OPL application+>4 lelong 0x10000073 OPO module+>>8 lelong 0x100001C4 EasyFax initialisation file+>>8 lelong 0x10000088 sheet file+>>8 lelong 0x10000085 OPL program+>>8 lelong 0x1000007F word file+>>8 lelong 0x1000007E voice note+>>8 lelong 0x1000007D sketch image+>4 lelong 0x1000006D+>4 lelong 0x1000006A application infomation file+>4 lelong 0x10000042 multi-bitmap image+>4 lelong 0x1000003B clipboard+>4 lelong 0x1000003A printer driver+>4 lelong 0x10000039 font file+0 lelong 0x10000037 Psion Series 5+#+# from: Peter Breitenlohner +# psion: file(1) magic for Psion handhelds data+#------------------------------------------------------------------------------++>4 string >\0 from kernel %s+>1 string >\0 version %s+0 belong&0xff00ffff 0x56000000 ps database+#+# psdbms: file(1) magic for psdatabase+#------------------------------------------------------------------------------++>10 string 3 version 2.11 or later+>10 string 2 version 2.8 to 2.10+>10 string 1 version 2.7+0 string FTNCHEK_\ P project file for ftnchek+# Magic strings for ftnchek project files. Alexander Mai+# +# project: file(1) magic for Project management+#------------------------------------------------------------------------------++0 string \x1b\x01@EJL Epson ESC/Page language printer data+# Epson ESC/Page, ESC/PageColor +# From: Paolo ++0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware adcW#!eb y P l U *  d C " l K  x Z 7  b0l9m:RiZ:L=whH(+>>>>&4 lelong 33367 29.97 fps,+>>>>>>&-4 lelong !40000 ~25 fps,+>>>>>&-4 lelong >39841+>>>>&4 lelong <40161+# ]24.9,25.1[+>>>>&4 lelong 40000 25.00 fps,+>>>>>>>&-4 lelong !41667 ~24 fps,+>>>>>>&-4 lelong !41708+>>>>>&-4 lelong >41494+>>>>&4 lelong <41841+# ]23.9,24.1[+>>>>&4 lelong 41667 24.00 fps,+>>>>&4 lelong 41708 23.98 fps,+>>>>&4 lelong 50000 20.00 fps,+>>>>>>&-4 lelong !66667 ~15 fps,+>>>>>&-4 lelong >66225+>>>>&4 lelong <67114+# ]14.9,15.1[+>>>>&4 lelong 66667 15.00 fps,+>>>>>>&-4 lelong !83333 ~12 fps,+>>>>>&-4 lelong >82645+>>>>&4 lelong <84034+# ]11.9,12.1[+>>>>&4 lelong 83333 12.00 fps,+>>>>>>&-4 lelong !100000 ~10 fps,+>>>>>&-4 lelong >99010+>>>>&4 lelong <101010+# ]9.9,10.1[+>>>>&4 lelong 100000 10.00 fps,+>>>>&4 lelong 111111 9.00 fps,+>>>>&4 lelong 125000 8.00 fps,+>>>>&4 lelong 142857 7.00 fps,+>>>>&4 lelong 166667 6.00 fps,+>>>>&4 lelong 200000 5.00 fps,+>>>>&4 lelong 250000 4.00 fps,+>>>>&4 lelong 333333 3.00 fps,+>>>>&4 lelong 500000 2.00 fps,+>>>>&4 lelong 1000000 1.00 fps,+>>>>&4 lelong >1000000 <1 fps,+>>>>&40 lelong x %u,+>>>>&36 lelong x \b, %u x+>>>20 string hdrlavih+>>12 string LIST+>8 string AVI\040 \b, AVI+# AVI == Audio Video Interleave+>8 string CDRA \b, Corel Draw Picture+# Corel Draw Picture+>>24 lelong >0 %d Hz+>>22 leshort >2 \b, %d channels+>>22 leshort =2 \b, stereo+>>22 leshort =1 \b, mono+>>20 leshort 85 \b, MPEG Layer 3+>>20 leshort 80 \b, MPEG+>>20 leshort 64 \b, ITU G.721 ADPCM+>>20 leshort 49 \b, GSM 6.10+>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)+>>20 leshort 17 \b, IMA ADPCM+>>20 leshort 7 \b, ITU G.711 mu-law+>>20 leshort 6 \b, ITU G.711 A-law+>>20 leshort 2 \b, Microsoft ADPCM+>>>34 leshort >0 \b, %d bit+>>20 leshort 1 \b, Microsoft PCM+>8 string WAVE \b, WAVE audio+# Microsoft WAVE format (*.wav)+>8 string RMMP \b, multimedia movie+# RIFF Multimedia Movie File format+>8 string RMID \b, MIDI+# RIFF MIDI format+>>>>44 leshort x %d+>>>>38 lelong x %d x+>>>>34 lelong x \b, %d x+>>>30 leshort 40 \b, Windows 3.x format+>>>>36 leshort x %d+>>>>34 leshort x \b, %d x+>>>30 leshort 64 \b, OS/2 2.x format+>>>>36 leshort x %d+>>>>34 leshort x \b, %d x+>>>30 leshort 12 \b, OS/2 1.x format+>>16 string BM +>8 string RDIB \b, device-independent bitmap+# RIFF Device Independent Bitmap format+>>18 leshort x \b, %d entries+>>16 leshort x \b, version %d+>8 string PAL \b, palette+# RIFF Palette format+0 string RIFF RIFF (little-endian) data+#+# AVI section extended by Patrik Rådman +#+# http://www.seanet.com/users/matts/riffmci/riffmci.htm+#+# See+# riff: file(1) magic for RIFF format+#------------------------------------------------------------------------------++0 string /1\ :pserver: cvs password text file+# From Hendrik Scholz +# file(1) magic for revision control files+#------------------------------------------------------------------------------admT}]+R# M 6  ` % j % t 7 n <  XV"Y?p=yBh%u74 m+# RIFF Device Independent Bitmap format+>>18 beshort x \b, %d entries+>>16 beshort x \b, version %d+>8 string PAL \b, palette+# RIFF Palette format+0 string RIFX RIFF (big-endian) data+#+# files, and "GDMF" appears to be another multimedia format.+# Also "MV93" appears to be for one form of Macromedia Director+#+# XXX - some of the below may only appear in little-endian form.+#++>8 string 4XMV \b, 4X Movie file +>8 string CDXA \b, wrapped MPEG-1 (CDXA)+# MPEG-1 wrapped in a RIFF, apparently+>8 string sfbk SoundFont/Bank+# SoundFont 2 +>8 string ACON \b, animated cursor+# Animated Cursor format+>>>>>>>>(92.l+192) lelong x %d Hz)+>>>>>>>>(92.l+190) leshort >2 (%d channels,+>>>>>>>>(92.l+190) leshort 2 (stereo,+>>>>>>>>(92.l+190) leshort 1 (mono,+##>>>>>>>>(92.l+188) leshort x (0x%.4x)+>>>>>>>>(92.l+188) leshort 0x0161 DivX+>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3+>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3+>>>>>>>>(92.l+188) leshort 0x0002 ADPCM+>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM+>>>>>>>(92.l+180) string strf+# auds strh length = 64:+>>>>>>>>(92.l+184) lelong x %d Hz)+>>>>>>>>(92.l+182) leshort >2 (%d channels,+>>>>>>>>(92.l+182) leshort 2 (stereo,+>>>>>>>>(92.l+182) leshort 1 (mono,+##>>>>>>>>(92.l+180) leshort x (0x%.4x)+>>>>>>>>(92.l+180) leshort 0x0161 DivX+>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3+>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3+>>>>>>>>(92.l+180) leshort 0x0002 ADPCM+>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM+>>>>>>>(92.l+172) string strf+# auds strh length = 56:+>>>>>>(92.l+116) string auds \b, audio:+>>>>>(92.l+104) string strlstrh+>>>>(92.l+96) string LIST+# skip past first (video) LIST+##>>>>>>>(104.l+132) string x (%.4s)+>>>>>>>(104.l+132) lelong 0+>>>>>>>(104.l+132) string/c xvid XviD+>>>>>>>(104.l+132) string/c dx50 DivX 5+>>>>>>>(104.l+132) string/c divx DivX 4+>>>>>>>>112 string/c div4 Fast-Motion+>>>>>>>>112 string/c div3 Low-Motion+>>>>>>>(104.l+132) string/c div3 DivX 3+>>>>>>>(104.l+132) string/c mjpg Motion JPEG+>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3+>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2+>>>>>>>(104.l+132) string/c iv50 Indeo 5.0+>>>>>>>(104.l+132) string/c iv41 Indeo 4.1+>>>>>>>(104.l+132) string/c iv32 Indeo 3.2+>>>>>>>(104.l+132) string/c i263 Intel I.263+>>>>>>>(104.l+132) string/c cvid Cinepak+>>>>>>>(104.l+132) lelong 1 RLE 8bpp+>>>>>>(104.l+108) string strf+# skip past vids strh+>>>>>>&0 lelong 0 uncompressed+>>>>>108 string vids video:+>>>>96 string strlstrh+>>>88 string LIST+# assuming avih length = 56+# (Should cover 99.9% of all AVIs.)+# "vids" optionally followed by "auds".+# Note: The tests below assume that the AVI has 1 or 2 streams,+##>>>>&20 lelong x %u frames,+##>>>>&4 lelong x (%u)+>>>>&4 lelong <32224 >30 fps,+>>>>>>>&-4 lelong !33333 ~30 fps,+>>>>>>&-4 lelong !33367+>>>>>&-4 lelong >33223+>>>>&4 lelong <33445+# ]29.9,30.1[+>>>>&4 lelong 33333 30.00 fps,ad$oxa9{`; s U 2   ] ' ] Z   y b L 3   } { * |c@ol@>|S g,mE}zM.WT(+#+# i.e. files in /usr/share/sendmail/cf/+# From Hendrik Scholz +#+# sendmail: file(1) magic for sendmail m4(1) files+#------------------------------------------------------------------------------++>16 string >\0 - version %s+0 short 0x271c Sendmail frozen configuration+>16 string >\0 - version %s+0 byte 046 Sendmail frozen configuration +#+# XXX - byte order?+#+# sendmail: file(1) magic for sendmail config files+#------------------------------------------------------------------------------++8 string \001s\ SCCS archive data+# Hence the following official kludge:+# and we don't have regular expression matching yet. +# is a checksum that could (presumably) have any leading digit,+# Further, you can't just say '\001h0', because the five-digit number+# Maybe we should just switch everybody from SCCS to RCS!+# *Sigh*. And these both came from various parts of the USG.+# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).+# ... etc.+# \001U+# \001u+# \001e+# \001c date and time created 87/09/23 08:09:20 by ian+# \001d D 1.1 87/09/23 08:09:20 ian 1 0+# \001s 00276/00000/00000+# \001h01207+# SCCS archive structure:+#+# sccs: file(1) magic for SCCS archives+#------------------------------------------------------------------------------++38 string Spreadsheet sc spreadsheet file+#+# sc: file(1) magic for "sc" spreadsheet+#------------------------------------------------------------------------------++>6 string \\pca IBM PS/2, code page 850+>6 string \\pc IBM PC, code page 437+>6 string \\mac Apple Macintosh+>6 string \\ansi ANSI+>5 byte x version %c,+0 string {\\rtf Rich Text Format data,+#+# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk+#+# rtf: file(1) magic for Rich Text Format (RTF)+#------------------------------------------------------------------------------++>>10 string x %s+>>8 beshort 12 ARM+>>8 beshort 11 MIPSel+>>8 beshort 10 Sparc64+>>8 beshort 9 IA64+>>8 beshort 8 RS6000+>>8 beshort 7 SGI+>>8 beshort 6 68000+>>8 beshort 5 PowerPC+>>8 beshort 4 MIPS+>>8 beshort 3 Sparc+>>8 beshort 2 Alpha+>>8 beshort 1 i386+>>6 beshort 1 src+>>6 beshort 0 bin+>>4 byte x v%d+>2 beshort 0xeedb RPM+0 beshort 0xedab+#+# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)+#+#------------------------------------------------------------------------------+>8 string sfbk SoundFont/Bank+# SoundFont 2 +>8 string NIFF \b, Notation Interchange File Format+# Notation Interchange File Format (big-endian only)+>8 string ACON \b, animated cursor+# Animated Cursor format+>8 string AVI\040 \b, AVI+# AVI == Audio Video Interleave+>8 string CDRA \b, Corel Draw Picture+# Corel Draw Picture+>>24 belong >0 %d Hz+>>22 beshort >2 \b, %d channels+>>22 beshort =2 \b, stereo+>>22 beshort =1 \b, mono+>>>34 leshort >0 \b, %d bit+>>20 leshort 1 \b, Microsoft PCM+>8 string WAVE \b, WAVE audio+# Microsoft WAVE format (*.wav)+>8 string RMMP \b, multimedia movie+# RIFF Multimedia Movie File format+>8 string RMID \b, MIDI+# RIFF MIDI format+>>>>44 beshort x %d+>>>>38 belong x %d x+>>>>34 belong x \b, %d x+>>>30 beshort 40 \b, Windows 3.x format+>>>>36 beshort x %d+>>>>34 beshort x \b, %d x+>>>30 beshort 64 \b, OS/2 2.x format+>>>>36 beshort x %d+>>>>34 beshort x \b, %d x+>>>30 beshort 12 \b, OS/2 1.x format+>>16 string BM +>8 string RDIB \b, device-independent bitmapadgxHEi- } a " E  d H  e c   W ;   kQ-g=) {^4nT:u@igh+0 string/cb \32 string >\0 version %s scene+8 string MayaFOR4 Alias|Wavefront Maya Binary File,+>32 string >\0 version %s scene+8 string MAYAFOR4 Alias|Wavefront Maya Binary File,+>13 string >\0 version %s+0 string //Maya ASCII Alias|Wavefront Maya Ascii File,+# Alias|Wavefront Maya files++>11 byte x dataformat %d+>17 byte x hash %d,+>7 byte x pagesize 2^%d,+>6 byte x 2^%d pages,+>5 byte x version %d,+0 string mdbm mdbm file,+0 lelong 0x01023962 mdbm file, version 0 (obsolete)+# mdbm files++0 lelong 0x13130303 SpeedShop data file+# SpeedShop data files++>17 string >\0 (V.%1.1s)+3 string pmieconf-pmie PCP pmie config+>16 string >\0 (V.%1.1s)+0 string #pmieconf-rules PCP pmieconf rules+>5 string >\0 (V.%1.1s)+>4 string 2 Text+>4 string 1 Index+0 string PcPh PCP Help +>18 string >\0 (V%1.1s)+>10 string Version+0 string #pmlogger PCP pmlogger config+>15 string >\0 (V%-3.3s)+>7 string Version+0 string pmview PCP pmview config+>17 string >\0 (V%-3.3s)+>9 string Version+0 string #pmchart PCP pmchart view+>18 string >\0 (V.%s)+>9 string Version: Archive Folio+0 string PCPFolio PCP +>24 string >\0 host: %s+>20 lelong >0 log volume #%d+>20 lelong 0 log volume #0+>20 lelong -1 metadata+>20 lelong -2 temporal index+>7 byte x (V.%d)+3 lelong 0x84500526 PCP archive+>3 string >\0 (V.%1.1s)+0 string PmN PCP compiled namespace+0 string PmNs PCP compiled namespace (V.0)+# Performance Co-Pilot file types+#+#++# sgi: file(1) magic for Silicon Graphics applications+#------------------------------------------------------------------------------++>124 lelong >0 version %d+>16 lelong >0 not stripped+0 leshort 0x42eb SYMMETRY i386 standalone executable+>124 lelong >0 version %d+>16 lelong >0 not stripped+0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)+>124 lelong >0 version %d+>16 lelong >0 not stripped+0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)+>124 lelong >0 version %d+>16 lelong >0 not stripped+0 leshort 0x12eb SYMMETRY i386 .o+# byte 0xeb is matched before these get a chance.+# Symmetry magic nums will not be reached if DOS COM comes before them;+# Symmetry information added by Jason Merrill .+#+>124 lelong >0 version %d+>16 lelong >0 not stripped+0 lelong 0x30ea BALANCE NS32000 standalone executable+>124 lelong >0 version %d+>16 lelong >0 not stripped+0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)+>124 lelong >0 version %d+>16 lelong >0 not stripped+0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)+>124 lelong >0 version %d+>16 lelong >0 not stripped+0 lelong 0x00ea BALANCE NS32000 .o+# For Sequent's multiprocessor systems (incomplete).+# Sequent information updated by Don Dwiggins .+#+# sequent: file(1) magic for Sequent machines+#------------------------------------------------------------------------------+++0 string divert(-1)\n sendmail m4 text fileadnq@P) j 7 5  N   e 9 7 S   z x Q 1  ec9DkhS;" i53~|b8|^64}]K8& +#>>16 lelong x , table: %d+#>>12 lelong x , data: %d+>>8 byte x \b%d+>>9 byte x \b%d.+>>10 byte x %d.+>7 byte&1 =0 LE image version+# little-endian+0 string GSTIm\0\0 GNU SmallTalk+#+# From: catull_us@yahoo.com+# GNU Smalltalk image, starting at version 1.6.2+#-----------------------------------------------++0 string ##Sketch Sketch document text+# From: Edwin Mons +# Sketch Drawings: http://sketch.sourceforge.net/ +#------------------------------------------------------------------------------++>9 pstring >\0 named: %s+>9 pstring =\0 un-named+0 belong =0x4AFB0001 QL plugin-ROM data,+# Sinclair QL ROM (ThMO)++>9 pstring x '%s'+4 belong 0x4AFB QDOS executable+# Sinclair QL executables (was ThMO)++>2 pstring x '%s'+0 beshort 0xFB01 QDOS object+# Sinclair QL libraries (was ThMO)++0 string NqNqNq`\004 QL firmware executable (BCPL)+# Sinclair QL firmware executables (ThMO)++#>>>>>49142 string >\0 version %.4s+#>>>>>49148 string >\0 type %.3s,+#>>>>49136 belong <47104 QL OS dump data,+#>>>49132 belong <47104+#>>49128 belong <47104+#>49124 belong <47104+#0 belong =0x30000+#+# than the first 8K of a file... #-(+# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more+#+# reliably and faster...)+# differing from the natural host format, this could be written more+# (NOTE: if `file' would be able to use indirect references in a endian format+# Sinclair QL OS dump (ThMO)++>4 string >\0 label:%.10s+>3 string =C 3.2 MB,+>3 string =B 1.44 MB,+>3 string =A 720 KB,+0 string =QL5 QL disk dump data,+# Sinclair QL floppy disk formats (ThMO)++# additions to /etc/magic by Thomas M. Ott (ThMO)++# sinclair: file(1) sinclair QL+#------------------------------------------------------------------------------++>>12 lelong >0 , not stripped+>2 leshort >1 , %d sections+0 leshort 0x521C SHARC COFF binary++0 string .system SHARC architecture file+0 string .SYSTEM SHARC architecture file+0 string Analog ADi asm listing file+0 string ! Assembler source++# SHARC DSP stuff (based on the FGM SHARC DSP SDK)+#------------------------------------------------------------------------++0 string PACK RiscOS PackdDir archive+0 string Draw RiscOS Drawfile+#------------------------------------------------------------------------++# FutureGroove Music (dsp@futuregroove.de)+# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by +#+# file(1) magic for sharc files+#------------------------------------------------------------------------++0 string #\ KDE\ Cookie\ File Konqueror cookie text+0 string #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text+0 string #\ HTTP\ Cookie\ File Web browser cookie text+# Ulf Harnhammar +# (Mozilla, Galeon, Netscape 4, Konqueror..)+# Web browser cookie files++0 string/cb \